From 7ec382baebf84c397538e680d122e3a7d2f7d4d1 Mon Sep 17 00:00:00 2001 From: Pier Carlo Chiodi Date: Sat, 24 Sep 2022 17:21:33 +0200 Subject: [PATCH 1/5] OpenBGPD 7.6 --- .github/workflows/cicd.yml | 2 +- docs/FEATURES.rst | 2 +- pierky/arouteserver/builder.py | 3 ++- pierky/arouteserver/tests/live_tests/openbgpd.py | 14 ++++++++++++-- 4 files changed, 16 insertions(+), 5 deletions(-) diff --git a/.github/workflows/cicd.yml b/.github/workflows/cicd.yml index d90382f6..541a736c 100644 --- a/.github/workflows/cicd.yml +++ b/.github/workflows/cicd.yml @@ -69,8 +69,8 @@ jobs: echo "$DOCKER_PASSWORD" | docker login --username "$DOCKER_USERNAME" --password-stdin docker pull pierky/bird:1.6.8 docker pull pierky/bird:2.0.10 - docker pull pierky/openbgpd:7.4 docker pull pierky/openbgpd:7.5 + docker pull pierky/openbgpd:7.6 docker pull pierky/exabgp:4.2.7 docker pull nlnetlabs/routinator:v0.8.3 env: diff --git a/docs/FEATURES.rst b/docs/FEATURES.rst index ddb21f7b..fdcd4357 100644 --- a/docs/FEATURES.rst +++ b/docs/FEATURES.rst @@ -33,7 +33,7 @@ How it works #. `Jinja2`_ built-in templates are used to render the final route server's configuration file. - Currently, **BIRD** (>= 1.6.3 up to 1.6.8), **BIRD v2** (starting from 2.0.7) and **OpenBGPD** (OpenBSD 6.1 up to 7.5 and also OpenBGPD Portable 6.5p1 up to 7.5) are supported, with almost `feature parity `__ between them. + Currently, **BIRD** (>= 1.6.3 up to 1.6.8), **BIRD v2** (starting from 2.0.7) and **OpenBGPD** (OpenBSD 6.1 up to 7.6 and also OpenBGPD Portable 6.5p1 up to 7.6) are supported, with almost `feature parity `__ between them. **Validation** and testing of the configurations generated with this tool are performed using the built-in **live tests** framework: `Docker`_ instances are used to simulate several scenarios and to validate the behaviour of the route server after configuring it with ARouteServer. More details on the `Live tests `__ section. diff --git a/pierky/arouteserver/builder.py b/pierky/arouteserver/builder.py index feb16f47..7ec45cda 100644 --- a/pierky/arouteserver/builder.py +++ b/pierky/arouteserver/builder.py @@ -953,7 +953,8 @@ class OpenBGPDConfigBuilder(ConfigBuilder): LOCAL_FILES_BASE_DIR = "/etc/bgpd" AVAILABLE_VERSION = ["6.0", "6.1", "6.2", "6.3", "6.4", "6.5", "6.6", "6.7", - "6.8", "6.9", "7.0", "7.1", "7.2", "7.3", "7.4", "7.5"] + "6.8", "6.9", "7.0", "7.1", "7.2", "7.3", "7.4", "7.5", + "7.6"] DEFAULT_VERSION = AVAILABLE_VERSION[-1] IGNORABLE_ISSUES = ConfigBuilder.IGNORABLE_ISSUES + \ diff --git a/pierky/arouteserver/tests/live_tests/openbgpd.py b/pierky/arouteserver/tests/live_tests/openbgpd.py index 43ff8279..6dec01e1 100644 --- a/pierky/arouteserver/tests/live_tests/openbgpd.py +++ b/pierky/arouteserver/tests/live_tests/openbgpd.py @@ -607,5 +607,15 @@ class OpenBGPD75PortableInstance(OpenBGPDPortableInstance): TARGET_VERSION = "7.5" -OpenBGPDPortablePreviousInstance = OpenBGPD74PortableInstance -OpenBGPDPortableLatestInstance = OpenBGPD75PortableInstance +class OpenBGPD76PortableInstance(OpenBGPDPortableInstance): + + DOCKER_IMAGE = "pierky/openbgpd:7.6" + + TAG = "openbgpd76p" + + BGP_SPEAKER_VERSION = "7.6" + TARGET_VERSION = "7.6" + + +OpenBGPDPortablePreviousInstance = OpenBGPD75PortableInstance +OpenBGPDPortableLatestInstance = OpenBGPD76PortableInstance From 11b04eb01451cd0298157aa8d418fc41ec722566 Mon Sep 17 00:00:00 2001 From: Pier Carlo Chiodi Date: Sat, 24 Sep 2022 17:21:49 +0200 Subject: [PATCH 2/5] Enable `rde evaluate all` with ADD-PATH in 7.6 This is to enable `rde evaluate all` again in 7.6 when ADD-PATH is turned on. https://github.com/openbgpd-portable/openbgpd-portable/issues/37 --- templates/fingerprints.yml | 2 +- templates/openbgpd/clients.j2 | 2 +- tests/live_tests/scenarios/path_hiding/base.py | 1 + 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/templates/fingerprints.yml b/templates/fingerprints.yml index 9a96c62a..86ab484c 100644 --- a/templates/fingerprints.yml +++ b/templates/fingerprints.yml @@ -16,7 +16,7 @@ md: macros.j2: bb4c38f830831d476840c228ede6de8cc778de55b74b2882451b1ce980a47cea56b0f9426236dc5c0f844af4fbc73642e85efb510b24b26ddc96ab1206942c88 main.j2: be98308fd4c8f4992e58cebcdd41b6bbb59122763bbbf1c3d74dc5e980db59aabd716e8d809a5bee05b60be6530e4704026cb054235c1f4c35b23d450f9bd59b openbgpd: - clients.j2: 5518aff8ce7e928f449867ca9edce5a11c7dee879279b6a9db1037425f96c1faa5c0bbb6f6b1ad5eb415554be59273ab91225852db4037fbe475e4cceba439c1 + clients.j2: b3e5cee4cfeb581b15462055d2c6283fe648750312f8f98d7676b374f7fa4d48e2e249f13d847c80e39be449e0b19cd7f832163dc7da0e3c9727d9f092eb477c filters.j2: 67230b4a9841be775a0edb724f408a651c42469c1535b360c3b0ee3af5bff2929964540514d64ac320116f2c0faed22c089f51d647c455b9316dd3975d583d2d header.j2: 9b6700145069c22bb51f0a694f984da3babecc2528555e2afa8f50d347424508fe8a9868fffae956bf1a7801545fcd278cb08bece8855ead71ad262c181496d0 irrdb.j2: a41aff6077c4b7ddd8ae03f0ac33f3ff47c9812350204d929a8b02fe63d023a813e802a7c9183528058b55d7502f7aeaef77a65acc906022586510f37453b88a diff --git a/templates/openbgpd/clients.j2 b/templates/openbgpd/clients.j2 index b39573ab..cf3ad9dc 100644 --- a/templates/openbgpd/clients.j2 +++ b/templates/openbgpd/clients.j2 @@ -27,7 +27,7 @@ group "clients" { remote-as {{ client.asn }} {% if cfg.path_hiding and "6.9"|target_version_ge %} -{% if "7.5"|target_version_ge and client.cfg.add_path %} +{% if "7.5"|target_version_ge and "7.5"|target_version_le and client.cfg.add_path %} # This is needed to avoid the bgpd error # "neighbors with add-path send cannot use 'rde evaluate all'" # It overrides the global 'rde evaluate all' setting for diff --git a/tests/live_tests/scenarios/path_hiding/base.py b/tests/live_tests/scenarios/path_hiding/base.py index 1407a85b..f5f145b1 100644 --- a/tests/live_tests/scenarios/path_hiding/base.py +++ b/tests/live_tests/scenarios/path_hiding/base.py @@ -207,6 +207,7 @@ def test_040_AS3_and_AS4_prefix_via_AS2(self): for inst in (self.AS3, self.AS4): if isinstance(self.rs, OpenBGPDInstance) and \ version.parse(target_version) >= version.parse("7.5") and \ + version.parse(target_version) < version.parse("7.6") and \ inst is self.AS3: # On OpenBGPD 7.5, ADD_PATH support was introduced: however, # when it is set, the 'rde evaluate all' config knob that allows From 046099122fb940a61e42cc8d757d753f1b70fdb2 Mon Sep 17 00:00:00 2001 From: Pier Carlo Chiodi Date: Sun, 25 Sep 2022 12:54:07 +0200 Subject: [PATCH 3/5] Prevent calls to external APIs --- pierky/arouteserver/tests/base.py | 24 ++++++++++++++++++ requirements-dev.txt | 1 + .../static/data/arin-whois-originas.json.bz2 | Bin 0 -> 1513935 bytes .../static/data/peeringdb_net_3333_10745.json | 1 + tests/static/test_enricher_irrdb.py | 5 ++++ 5 files changed, 31 insertions(+) create mode 100644 tests/static/data/arin-whois-originas.json.bz2 create mode 100644 tests/static/data/peeringdb_net_3333_10745.json diff --git a/pierky/arouteserver/tests/base.py b/pierky/arouteserver/tests/base.py index c54213ac..edb08a95 100644 --- a/pierky/arouteserver/tests/base.py +++ b/pierky/arouteserver/tests/base.py @@ -17,6 +17,26 @@ import os import sys import unittest +import requests_mock +import json + + +def setup_requests_mock(): + res = requests_mock.Mocker() + res.start() + res.get( + "https://www.peeringdb.com/api/net?info_never_via_route_servers=1", + json={} + ) + res.get( + "https://www.peeringdb.com/api/net?asn__in=3333,10745", + json=json.load(open("tests/static/data/peeringdb_net_3333_10745.json")) + ) + res.get( + "http://irrexplorer.nlnog.net/static/dumps/arin-whois-originas.json.bz2", + content=open("tests/static/data/arin-whois-originas.json.bz2", "br").read() + ) + return res class CaptureLog(logging.Handler): @@ -46,6 +66,7 @@ def reset(self): finally: self.release() + class ARouteServerTestCase(unittest.TestCase): NEED_TO_CAPTURE_LOG = False @@ -79,6 +100,8 @@ def _setUpClass(cls): @classmethod def setUpClass(cls): + # Prevent actual calls to external APIs. + cls.requests_mock = setup_requests_mock() cls._setUpClass() @classmethod @@ -87,6 +110,7 @@ def _tearDownClass(cls): @classmethod def tearDownClass(cls): + cls.requests_mock.stop() cls._tearDownClass() @classmethod diff --git a/requirements-dev.txt b/requirements-dev.txt index 220e5938..d443b346 100644 --- a/requirements-dev.txt +++ b/requirements-dev.txt @@ -2,3 +2,4 @@ nose>=1.3.7 mock>=2.0.0;python_version<"3.3" flake8 coveralls +requests-mock==1.9.3 diff --git a/tests/static/data/arin-whois-originas.json.bz2 b/tests/static/data/arin-whois-originas.json.bz2 new file mode 100644 index 0000000000000000000000000000000000000000..7e489384d33fcf3a03aecfb1570f0c7986c2aa54 GIT binary patch literal 1513935 zcmb4~Wl$VS*XIY9;O@a4f;(K?-90!28Jq!z$;BOlYaqA`ZZp6D!3i4Nh8Z9PLXg2B z2{-rIyzlOQ*biG<+uhaGA5NdHt~%9y{?)%$xA&13SF_`_u) zYfjhqsU1)IXRf}^N&oSP)1;eHv2zmB)X)+p)>x@(AR@LRRyO;wW_6pY04>sehM=J<7XaP(6AlO@3yNMZ zloxW)_Ecs#3=r?i)Nn$rlo@8lpr~tTqraJMLh(d=U$r~`dSbo!LGh+*b|(V!+F>d~ zolh3lZ=et|Fo;11e3Yaw*5TMv?4UqE+8nJfe(E_Phmi z;1pqk56@IzL1IbS8XN88HL;#57*yzo?IVB@CW@cqNy~(qL<~1PlIG2sNd1jW^TKT@ zmCGA_$nxty@df}W-#?pD(h6efYt{>>@-Hls!p!`U9!Y{LS)Kf5w1B7B|F-%+x)+FD zUu}_EQ<*iNHvqG?Q2?olT7zYse(c*CQUJgMfM3F?r=RoRQ?L!|X$ZCW*C>_&9;1fr zRMGW%RZ`6bvH1VxmQ$UbMnCo4DydGB&jS zPC(0le5e5IjsKcbT9L&8ta?>xeeg6jjVDdb)cJ|i3B&j~iT_%r#iRM_!Z}kEOd& zx>4+cgBCvVz5y`T-HW@O)jnO=GFRq&P$t1FU4to0kiRf!Q}8$#)f?(KouIwaqCG9; zZW^F1-c_sJ&U7M^#ZoQ@9X(gMtIu8fGkRZWJLwRF=4ciEKB=9KMjtuH^U1}bHX{rr3Do#+gtG~I@ZdfBlWj5t66`&_ix9=-??p8 zF!W}Jq;G~V4il`a)mMbB)~Bs*MUyVykFGDDnJG2jXI1x233n#5s-LfP$J?_E{5&tH zI1Lp)F~Z%|P@sF=tgesQS2{ht2`0EY-8SLVv@zgX)Q8&L6M;&HYr*(i=L`dynvi9C z+c1$XD`sDb|HDXT7h!6PbVKR~Fl#Yobr<%?v}KrO`3lzB3i&Zu*sj!_2m+&1$}2u?@f1RoH^dJfNo2&&#(qKn>a?Zi}?fbYRG$lhSJ19gFQ{kP%`s z*FRqLshbS2%49-6c3}R!_=rj4>iugl?%&g|Cp;@^_}C9v?lQ6FSdBjF`9KK*(Tsa+ zuq%%yp-$^L9yc*5TU3}6AfR#5g#HWPKy2F>N=IxShSAdm&Pw+bsX8u?G98_D1cuYP zd3;gFbeYe*w5xfS$|dy5>4}i{XNY$DfM@i!M)fy%5n{QQg4Jfy3F&sa^(OP#*qMN` zMR7vZ=w-Bd^_}u2(U%m8{S4X;UaBERxbf^a0oD5?+DTbi`gNNAN#p9QB_&%AJ~ z?9sq_CxeL8brR6FZ_V1!;7ud~fh?MejNpdBHH!k>&R#t_582TvK)=%*pJF3GVu zf)+is;f?O+q5Lb)XSVAUAXuZQ`U#s%fzVmW%UR4j>K8sldx@;Ms$FDt=tb1G?(2yA zaH1fa*6S8G`p>-muM`=(S$RWnyhw0tZKbeKHtoS2UwwoCly*7mtcm_jtfq9XcgpAO z92J*2w)eQv8AP2bwTE6aouo)8c_~PWa`XlD!{07{8Dn}YS(|lraBla4x?kzsJPA)^ z#}dfLf`^qlqxfrh2ylj)@JP<|4B71ihL`pA);9))a~gIKilcUPnwDh~rT|tfQ-#o; zwZ$hCTh1+|7jHxnx%Ii!+00&B7nErD>w+iCXX#Qh672E^a{)RpBAPrsCG0hAA@t+3 z+9!!kqTO@JDSqPA=Pm1XBMu)Zf97Jvx}uH``iGNQazEqh&(BVw(d9A>C<^YC0gk#1 z_D-U^-0Y-8tsB)v$<>R{ZwU?gpRqkm-g%;NagZR2ADBFiBZNeJSw)MLrk2&P6?9|u z&I`P|C7`8c`KN4w7M9cBMS=F|SqIpg<4yR%fK)2IeC9MNUG|G#m=>%#njRA?Dn0i6 zXs#-!2(kn7vzqWN@TTWCrb~`XiIRlJ*oz~iIXJm^4DOf8Ia@oz=evUWQv~nWjUVpelgG;5x{4mDxkvC2?exe)aORsOOL!myDYp|O3WAxmd728>lv&1Xb z=V4lVsFfpeH51gz>KH^0@n|~butbBl4L)#BVg1yO%>{6B5OgZh6O#NDOaJ9HTz)G- zNzcOZZP?{xxeH9R|JUytP!e;@16f2G47A>V{``r=>G9XWj{~a0n}zl8*qZbCHLTk) zmY+3ox>nUKf!Y;?E3(Dd<*FCS@425MqkCZ*A+42UgluAlVwqJZ~fr~?>VY3qf zYBu5lmNIB|me|lV88K0SQ}2a7KMVexDlGvEiv{Z3mX;YX+%~4b7VU}4`6(rjaO6OEHsFDQJlO7$5j-6&XeF%!N zC|y7X=Nv?nIpSYL>KbsgXlzXZ%$;&^)=Cm{O-Z<>xYMRVhiB+Ts)OX37QK;t<23t_ z_~fiQeM0@D`lJ%+XeL*NyZ5^+<}i>+Utigr=pzy(X_%aoX&+QXBuYwe|5;YKAGg#< zi^eQCxqYs)I_cQH7~8O_u6$B{=Q4m0cl0uQaL`#{Z@ppFqo&)u=+hw!D}|7C8%{B{ zI^Czb8vVWR9y%jFGZtJcE+KcJY|Gb<;ilfcqUh7&R19ryA{{oE(i!CNr| zwg~=*MwRyO`~NgGz54f4tl)pLi1};(`b2?en~L4>&wsuUVt3em`ZIj00kr)4B^O{- z5F0D_`RVf$!7pq;3oZrT>xU29e+~Zq@t^gOS*6^A^JRh~ zNMf9?`-_y`kXN%D;pqKbGamdO{S;IzQp7fE%lWci_>qpyGq) zc>Klt83ve~bkp!U?%fp_HBDh45TpO#%aR$p_T%(*===HI6_czU$5*(tcE{OkI=o7b zrefBt7?ocE=icG)s-xl!Mq2&(tNiM$xPR!CIXE{9MLUHYM%z~N181SAmRhTcsjGKk zOe2SH+rh1QYzn@rRze>`whBqvqd0ujyNO8Rd1V$f>2yk5cRfTnOZc_jO*L8YYDjoe zq=(}-z+gY&W4)%v+AwBL0d+sBUEN<09Z-35l`9yEXg-@*QppuZm7;vRZ=n4lNx>H* znPDf-Hd${5hZ!RjozTXo&x7iU2zo+o404AnV3vDvmRDv~4-}HdUFqc&3e?@_F2H1a zTCe9(qvj8fWIw|Ki2WQnWwV;`KST_Cs$DUH`ke8cH?PQY=jr`dd#6^L(nc7hM1uQe zf8_Y-g_Sc(Df_C<_;+9?=r8Z~DFzpJxcL4u0ukv70agIcl#;R6DQaNniOXeE41IX4AAAx+D%t2#73=@3cw5 zqH{VJ=;vDaCMlW<^ORk03so3`^@QE}cAqR3@@Z_n4Oj&sw=hMY{Q_O{YsT63}8O@mxEpWyIU!KWengXC9iAzEZ}lqzf}50 zMNGjtG^>vdGg*)+9aRPj1>QUFm)Bc$K&;c-%URZ=oJzaS< z&7I3EP{wyi8zqmxSCz7I&!;LZHu*g9C%dvv`PPt2ANF^U`ykDsq{e}Kii9YK%fH!Z z1xCV(eH^-Wtgd*!FBwD`D_XR#W6bq2mnckWh#t*%?%dwI@;Kd_0hV}mkAO#%kZGl+ zRBeF}xUL;@X@}?$%sctH@0Zm@&rH+6k z^02sYvsa2FuDMWEUgm>>>LlaJi1+rSU-tW656xH_=Y4p^caAexh>Su19tksc7Ed@m z%+jLt=dpV0%xtTMO_#5%a;wPNQqmBbn|KHrjTrx0j(FU=r;STi?aKW5*@K84aIHEav*F8US4$*GV9jl z>7SV7LFFHxe>DESW-tC}M>pnQzLv_4t9QfF4G1gI zk6ynS)zUo6?wgqdWCj9v|9yP4r*y`bGk>8@xGq^iYo}W|AMey|P)QuvdP$nYxn#TC z011Qa=8A#)ki3(#_+hHu%BbjF=R&*h>4?yfhO9PJg`D`Obq#XQBmozQ>GH_bDzNCK zAd7a+?bz`==c3dP=EcioJc^%@pUG7qjz{qGk0PRNK}Xs>c0>rz*C<7} zlfAscFqmmi?xvs6qS<2&8@ZU_a2z z28q1vN6R1s0yPVHP{@}cP$&w8Hk9XrqzYOL%1bmOWSlo--Sz{ex?q>H+-ATC=LMtQ zrCVtBb>)#x$Do&xb#a83asX@>`9k8oM_%Mly;UFGes`wr;K#Wv_T&Lsua(dJs;1=% zf@OzVYYkaD6Bq}%i(`{?m*v5zp;!9SFKz$nA4*G7%~^W04LewD;sL###m=! z7W7!Y`167D)(jM#zv}D!uZt?HrGyswbGV#V%^m&zmX2@t3)|sZd#`en(Ol`P%f>HS zFG2_!_&HsiLojf^h)I||F}EFV9t=q;@RW-hM$^xm#P(J;Fd`+0xY3=Rzt7P(xj*kz z6v61=t+j85Sa%I-DukRbhTm?0iq}%XkWQxEav~x>HUe}7_JK+5kqaj>xZit^TPbJx zX_&YDz4We9hZg3WZ&qpTD_?=3+HdCl%o1lmf{w+H2iigm+<^n2h`#o)owg%XFhUwp z-0I+t5Z)sG8X{W=13?>17eJH*`G^ZeZBgS#;Jt|)rdrx(r;VPxjMgO3tUVQICsZA{ z(5Lu`ZkGTF#T`E8I{9pK+0(1c)v|8*DLi#1Z1`hHRR=#j`J|0VO0b*lQ?dRJi{=-T zg05W0oP0BtAAy2`G?(`kQk^4?>?*nWu*Kx?@PG7noU0pYX%QLVDBa&^hn*t-jB;y2 zb6Yh%j;FjGZwY;m5m(V79AXHXlFol->c8Z`*@z7*DFPu%H{wWc`B)?mp!E2GGkgJ{H4uTfL!r^v~upp z@NGz{4O#Ohl?2;%HOcBh!ak@(gDvQ@;8#s5)Eye<=(j~@=)7RptjB$-z}J7h7Jm17 z>>o-CASz#93Y7E<_*Xg|5q>J zgsRJOqBQB;+e0Bc{RDu&cv}Pnr1Xe(l|RGI-M@1CRxS^S{o5&hY*1TP$0WycWFo{* zt<$8korm#`zIZmqH~d@QC97)fZMmU`)P5dVk4%nIjXRTqGFRqMLKSEq_v3gtz6MM%981W8cI4uk)3(*wn`LJgH1m1lL$7F%K4HqJo9rN_11H7DB z#zU?VZ|u*r?9Y>W(RKNqdA+&4#oj_@t9ov|bn?R$vzWb8(eK`x#r8HSV*3s|b3c*c zgAclOL{w=OEF?UehA$8WubFQT#$R)m+0VDiWYVAgxFn9*Vs@=Kx;Y#qaWoVv_pW(^ z*SbOnHVw0TvN(KAd32fB!GOag5KqnGtlAnu^*uM4mAO?;u5wi_;OIM;#@UN<~f~<_M8wt&1jT zy>NRqo_C=H7K21(+M-0Jf+4`4>u26M7GaH`?=fYF2P=FpAJks3^MZam_9vMJjriR~ zZ;=mwu{e*okGz`v{Z&nbFjEYc!{5y%#=gdQOT+q;y(ia;vBRR+cJn}=aOb^_+Rh!A z$O9)KEKwi^BqfykBHU0SL2%AxZ2CsjBave@4%iKsu^MUC;XqvP^zyH%7qyiU;l!9w z9zJE^%;b$C~sbg-*eXRaeRHL5$z=q-Jz=bgED-geN0i+r*CV$de@iIP$Q^2 z3#O~N(jz_0yhmA8GK!U|*-5dEG9(NglM#3MNEw6k1 zw8}Kcj#5x4jHP(!i<1q@Nl5In0>@>w2CI%c7Tb%lTp;)*sSY-CprH%fY^|~fznw&U zVPOl?hWhMCGm~qrdY?n#6zc3Ch%n7kHpFVrpxu$!2;<9GApc&Dxs3AoO~0fdRo=zn zWvIHZA4i`X_LO|v4y*44M#_C){5BRLEE`;CIUh8jbxF=^TJ`Gk=ho~u2$#?{&;^Lo z#ln6MK}824b_?(UQ0j3H+_I=k zqZLg6i9?-FQUhTdq69?&wx>TFINE97iH0v%ckYTQy_>#q4v-=bFpHNAVr~MJQ~3`Y z`N%sqs_+fCwaYlH4L7zOw4UEF?m8g9bU9y$vAfkp4zr}?DW9b&PFF-D@b)RDw|7uG zri;4b`S=8_io^49dI5ZO@~~GJSzon?PlIEpuf5o{(zn6KT!)S> zpVkMC_}nV3K73w@?B#zDUT z;LiE=pkZOJ!3%!W`C!?8JERWGAJw7I{#a7HbTss)qWQ8JlGn`s>;C*0bJTbF&`#Yo zLTir1cn!~sxO$U8Z~9jnb>9Cvb$u~8@0}bIudF!R!FOZ#))bfh@wUv(Fcr?6J* z%gEn+!%bB3aK-Z{AA27Bz}%LZt6DnU4?)(~5Rc^>qeZvG_}-MF1xc)}@rsBvrC))O zEV=3Hpsjatteiuf3EQwwu>rUDhjeqhNSN3I2}}Y=a3A6bGK^GFE_9T`cK=R+8laxrMChJa!A?Ljd*>Jo>O1pZmyfdn9ni`# zc?zf}Ssrl=#FP(BlCdh*<=5rw>X_0cak&p-o&#j~QBjNCA+_={^%>vbhI1*x=nZ_q z-k>gIUfX2o=x1Uxw{wg}fV2{QGW8I{p^mQ?CVc{x-Pkhu?sXhtcG!U^Gd`tiN))tT zH}O)169;$8u+phihjhXTnZOdR=h{5EAm-L8$E2Y#f#s5l8K^a}{v?rQ(AH0k7IQyC zj4)vJ%Q)3guVS4!;o+T3(#b`9^jUGqRl_C=&u%LaR*TdjOa9!1%}$|KJ6M!Tp;+_O z)JCB7BcluLSh8YQ7eCG-7YZynooBhQqhKFny}PoQj^qfO*lDhc9aL0)AmFt{7fMVG zfA7VVehV^$+q{ZrlJlvymWxp_G}}3@#+PDG!O^~U86ybV0Hnx8fEBx!*u-weGx?2+ zBCo}j%VuOJ#lEW@%8+@oC`5-U*lB07l{PPu;Rabi3FWvYww22mIumI`lam?REy%zS zQMaIb{*~lLUN%Loaw-3Plb3RGb_1(#7AbNGW1oFgPFg#V)vS#X!EG~JO6toX=nct7 zt?+(?Cw<}S##pyd&sd_mBO>AEs-!aCy1-7wIB;+8&{;Qy*#`-qdu;7$Q#l8J5^b0I z0tIiKgT^Q187-HeN>E?p8%YVHsYCpWHWx=)(yuVwV1oK#1}OLFV)wlzubxdN;mXKk7?TMRLZW0LlQ1M605>)!_oXF$qOm*IIvTQ<6{i$h&|$&El1 z0k(z+Ayr^7$z0dGl$kEYH!dlIORDe(l>8onf9u(3hr)4-`|EIPX=~P=@H~kX1x{GWZA{xj<1?J<+Av# z>pkojxf=MO?n()5baF{+*#U+Z$Y!g=slg|O3Mc+ow86ET&MmFk-X>h7?vy^x^M$)Y z(xRWjK%Q2k;6F)&&wbnYPfM}zK3l<-AUg8_s~wo9{G5H$Rdq|th^z;v1|iAYH0MRe z%AEX{;R^B2KD&X^8SU$DdOmI2=((e1{Clr02gzY%3p{%bHiY~}dBAW@ocgy+!nFgi1wA*0}cY5thl>ePq#K`y56-l;oox zPb1|sr!1mZyZaHnro^=ipj9L=lY?mnvS6o&TsY z6}DNUu!W>q7cm(N+lz_`I_@rbs95gXg?;jugJ4l%?L^H3T|t0EA{BpXQ4GkOmb1G$ z?yO}3&tlxg*!R8?q&B=yk|LLx|84Xyicd>FOnM_`;P@=Frq8ieoZPA#vD|4yHKub) zZjE82?78OS#Db?e3s`jw;YuQjxGX8zIlR4PE_J#qiX?=I0*yvK#Gc$_9<7?hE5_GV z`)Us7*N-{)Z+2(HHDda%2gW0rwVz+s4p)QMIV}%R0Z5Y5VF8@@ME((bqhdk|)eoyA z<&Vm^y%^ySiYa?y0u9S_Q+3-_A?eu#Cs#pQJoIYS<|z^llu#an6y}BUIhHoUFtj9Z zGwaGma}M@S>w|kq@AC~xHu(nMJ`aJrv-;g{3I#ydr_Q=KjsWKNDcA2007Efjp3)mTq zcC@n|lRK0{1OJMl+*G{=xGao{iyt6j_*2Xy+Q^d=)AiVu2susIuD>I?w;c9k;aFdU z3_Dm0oxMOqJL`?6DW3Y+bhMg$3eE(6t;^MGHdCI55#Z?n0x3mr;CuMKGYyqm-^bKT zl@SVq{CQmkB~ix};6b#V=Xb^Bb&;OI8u}U3e)8p1vwdw)p48%xa4YSKkK`RzNy=>F zCJFooZOtMFSkSA$waZY95Ew^tgenF$I$S@U-^ywc4fdLnq!=BOwz8{KjrFJ!s*M5_ zR}0=Se=z|FQxMpl_1^DZ#^5kcx^e-s>pL)PBK`=&z3c1Zq2a6I!dVvOnoyhxaruZ> z)c$?gCCaA+O;}fEebg2pP4u!7f96{)dT+)FC568b@juhH%#Gv7z*o9R4i?Q=7q37& zt~4*1q|V-;iXFGrP-b&&3?=mxF;OmY!A_rIv8# zY4sJ9;_N2B6XoR>?3eyTsbioojWza#Q*}L$P)bID$yRLGyr2lr?dt}3_)@$wI$80l zUvFeNoca5%m&JJ5%>)^ znxt~iFI(k2UJ{cWa#WE~lHR5gU}xVED!8)Kh*H?9CgLG@h@e$O%~j=?Uj9(Xmt;T? zmFlk@%{)bU7s&!9lBz1bFw@ukq|1(bqsttw{yE33sK|M7(iKWHN^eI~rqDP3IpmH{G1c0+g4ZEQiAj zU%8=_+ho?xpzWgeGD{?2ThWGYkYadf6sTD_1)pp6JJ8rf?Xu+8@eS~7#$@yUDn^Fg z-|sX-tC7UVW#Rm(x^(Zcf(dP%RYyjIC( z1|<_z>@^F1wk{v`v#;@6|A@smu1B$RRD1q;xNNu#y^5zsNl8hgo0D3C!z@ko>upDv zdV8Lv7%BNvD_zhp@9?@sw1$`ud%UDr=&9nGY1MSeWcxaV|w`_PYb3av-!whm!Hlx@EI!rvS z#;M^`p9Y0Co9ik0p%gC*-wD}Y&QnFXa|~K6mbW_kxPBz7CL24&UAd2IsEv=Sa=GRb z3mUHV?qJ`Qo~^%B^&(YsNYGVgE12fyQBv&3O)IzfU` zNco8E(&D{lQ2jlXef{UKDNrOmeKQ`%JheA)KS1PY`aGihDGewZQ$RdrJQ!od-@LqM zujSGeb{-kSwZ^Hh3-}};4Qx4mj%aa-7e@|r;Eali#p4qUg7##;4>EcWcFo<5>crsy zlp`MR8Zb+Wd#Vde>7tQ*_7b*DBqTVqikpq1UgTgxI4;|dM=p}9@aVS0xC7N#TGvgc zUA891hN%{|i=i7aQvmRU1Yo)!N#nL!{>pV*EH;%QS~3Z-57~U^kyabP8~qXOg(@4o zX8T#+KV#>f0eX@_gWOP4`yl(n9@IC^dm3}Rig}b1DhWVm9#C|uA&GN}G|U93YAP!l zSzF`amP>10v<$|j)@kDE+7-vZt`~7Q#9VPk6qUcQ+yibVa!C8=w*wJ1G%3Aa6L1T+ z4Efb&p;-uV%f`g$J9Z&C1+1lW^T$C44;VaksTkH~VSkn_yhbx!f8aR@U9It))HGrt zhzdj(za2hjdK#Dej6a4+{gh{Y03c^2g4?v_t#1_0W`UT{@Hz1)6AY^>K1~x{T3k);_a7ilZ#a{j> zSy-@b%}pI--UpRBPPc})bH=@p_+4Cy3Oe>Hbo?eJj77z|A#IV`O^}QZjKW71k5VR# zx&p8e9cDnv*cWK(V%R-m7kITBUtj=kbGANHiU(xj5CF7EZ=aLuZQB8o-+CiG_~)gD zau3i6TRozuT>W^Z!YU|ql-nFyaDmXqrtx@e97_?GWor1FtM zNMrvm2H}x5**=5|xwdjjmscNM*4h2kuALewcIZZj&t`}8fyTJ5?ZK?Nx=qykX`{PW z=#Id8;H^2+C%L0nqA!}F$dhfpDk}X&44+3_?QVQ0*_Vvj!nLZZ;HIRW!ctA7P@|;M zq{QXqrpT%7bNp!21iReqO{^w~veF~+4hN06+q7xK=JC@Eo=T`o0&2Bh!+Z^5NHXAP zZ&g`^l4oZ35BJM<6~ zao}on4n2hY^YQN6;;HOojO9=SI*qDGu%k@@{_nR^)*!G62OocnmSB>hatZbcew=fiD zjhm3+l(}CpUuDT=r!)nB#UoE;Lw`A|+9=k-C1;9waGA7l+r*=yr!cBw9~+c&!bwFx zFH9a0jwr>YxjillD?@c zr*UDAE4}_0_WYGLFyerp2?||Sl6wgN)P!ah@0|^Zr0=~&UeRx%H4at0LS|@E$&=Hc z!ehS%lO(JK76CI?B7@=@K6h~qqXc-rheqRPj+N2-AX^PYG}NdsG0&TJh^{<6esOE0 z$mUsZQFbSxgB7{6beXx0z?kQ<@|Le~a!(6I_w_v68930`ovUDk^^JA(Q(b;*hyha1 z+9lC!DRs-}Qygb&5aYT_&91IjqP`{G!N92P;!25(Eg)Evv`v5f9U7a$+Q+ZKmR=ym zs~MmZi$!KB_~qRzP)kY}j_Rl?F3YtXHo(|E?=1}^`XYFiL|2fKKfQ&9&ZC9115i3& zh(KEuqDc1ESVlZddmMib6e}QXi!RL&wU(bf?BEWFTCQ6aBn0rN=#}IJ74;giKK^n?RJxP=MBwa|oYiY#?v#M(Mh}8>8Nt7KFs_2x2hT%5GL zd1^oLU=EuJ6?AP)gDy^l+ga&;%0QeszGh5Ldk5Bg4jzOQgIKf$e}u2+jCwrq|w*9y$r0-hcf{{193O(!MwA)(&#P04`|#4*5%Q zSja_kPx&)k9lT(^(61w7xPO#LgsOEafL0J0F4&gW;%6t*XC;EC#h!`9u4c+MBU?e$ z?NG4E26;NNvYN&rNVsZ~QrO;)_h-+fpdk4EcMQ7n%JkPwyvb{mi0~^pIiA#l~9Ajyp@0(L5s-oYumTrry?A(QJ%WE9u?`tnEUdlO7b!sd9 zEA?vu?@b%dgeGIGl?4|z<(u~$kbut=j2CV`CveF(yVdKBEW6)6i>J&hmr%o3S}n0^ zl$5d9a4D}0jMtzvej!S(KUP@X-hhi(dA{v<;*~0rtqfIA)Co52%TzR-&G%o3yz}CUWKr?*VQ;GRh7Zy=wdmB`4yFY@)QvEmC z9?y`q*4ON~zMYGrgZu+Ios&VI41G*BzYLiMq!PB3Uk%CbL-yV(zcjI(wHTgwOaJyJ zOiT?SL$B4fY(?{0&NTX8AvpWErIi|TAHYM$#!bYrDk1M^Tn_1y~hNV1F@iIy-F)Ww@)N-lT?Dq z>I#0&O%VXD$sOoK9QZ-ng<733r;HPuP?JK9o0y_VgO4oM$>`0_X0PLpLdeqPQiZgE zLf$~W7h6xs&3qjc-dOfj*P^HYb#BYNo`<_PuV~JC&cR$2U`55LCSEpzCH`dzNN1Mj zew4Xu2cHe+BUfj`;;0z7!EK zF!1lYE)6$#;LbC*66y{gw70j%bzyf`+wFN(oE%ZX@pX3YO^qo(`0&tA%!;B4yJlLL zW8pv>))Jj4g18%s@mrX)6Vf-}X%;X5;8IYjQDM_BMOdDK;#q~>uVT{#-wvhkja^Q5 z%yg!IB9FwVG!~BqVoQp>WyA7U-dA*hKXIoEu;;Nch;^z8>!xa|QN+i9(e3w-o@Ulw z`Ejb4`bU;9_b59%zvlLA839wLe9Dn;AEc>Wo|}#83v4N>7Ht2BTpaA?_ZJk4amh&L z_BjD2+!Uzp`E<(aOcg_6}0)bncuR)U6;f z5qB)UsVXi-v(BYs!}|B&w(6#AvZk`?(RZ=zrd7hyiYbr`=_vD;h|m4GxbB`9b?`1s zaq=yDbpk)G$9cFkHx0>{PzH0554)G0J~xf3J3B5w4JRf96r{(?o$MgMp&CC{MTYD8 zr@F9R*?i7OMud?pIDZf#o^wg6ndlut8I~5w^sOQvhLp144(yHrL zbxGzw&n0!7VK6=QDb4&2dWxvQ@H?A`fK9xg0d01`PCahDZd3{g+Y%5jL~BHJi1Z78 zZ;zLGp@hEiy_M_!@x=y_QF(jmL^jyB9kDsb$z~IpFzb$Iu~ZVh_DG2;o5q^E5BmdM zJhrF$ee`%nw#h%Nj^2dma*(|O#6cdMjT{|di`IXo1Wv?|yst|#y>unjEjYE&&^A;a zN0^L0yk>g1BItpmq(o}lcMXP2i1{Gz=N5XTh&rXXxd_L3$UDH6#jYr?ci3u{DzTq< zYt;BA%5I24Cf-^aMyRGIg#U^s$2Pkrl}Hzwn{-o~iFz?8*UZ+>c9vBzVwPCW_BMu* z$|MQWG0wg859dCjv}kf1;il#xAMAF1L<)F|g9c!^WCi3wyDbaq{p?qZkc$)J2K1lB zkAIs#K?fT9rhNYnmkAAJD|&5w^4x3~3VbF#9jvi!HE^_p_}?Eyh}eOp=Tg7E-z;Bh zXChCN3heQ5+H}Q9i6v%fL@*z?A3N2&HgJ@15~zvHQ)Rthr#2=TE!NT`)1$hU!5zMf z-FQ~xhHeK@+Eo(!9e>IQj80^=QNsw4K8fzlfuY|5IcXy+4|dcxteh~}afj?_Qms{b zDbtKsy(lv<{7V@Wx&v5*I4})%j^+g(Q8HRted?!TS{Sq+?2d^vt74}ec|2|D{yAlC z3LqEX8eO;!M^?n=e04gM-dqZkdw%B6>HzU93WIrU!TF&!|W_J623hD z_v7#XbpH+e&+q?y_yvBtyPE$i>qC*N=8zz5sg0a-xdZbRKdUi3Z)icC1 zvS-1#lcdtMIFUSkaoAYq+8oBNgq>?4dQ9tgCYGm_SBlw-GoVW4&rV~J>Kc@zsj4}t z@ouJS-0Iq;n&K~T)i`YpCbID3kUIqWF#k{xp7UW~D1&T?mQGik}FQ|286ce9I1 zPzCq8sE*_2NYnVse9hA)G1ooJDfyZwV;;zYuf6i7e>H~+na#+Z#s4K&H=mv6eV)`8 zUV;B&ijq3Z$+V9I#%pa=?I>J^;^K*8r5LAe<34dGsj7)e{QYFrPw;n5kcb%?^0!dsbk9>73isq_9wlC9lM^20 zab?RTE3qDW;^Pw~d(t^26B!j*YR`q7jmtB>5z`c*WTcpx5M4aq2VX_~#{C;IVA-NY zrf%2VKpRrz)yQ_@Mcw>>T7MhxEi`7X0=1SIFf^o(3UopZysLFU%!fK;4Nw8~WI_K8 zjHT04?OjL|>nQl0we$5v*|s6%vd@rsKC)p%mUZ!0PTmC2na@J(@JV$|)yz%cOv8nYp(?3Tr=|+J{q{=5wW0 zKG@aT;||xB^@1>!=80IHvA0DzFfp{BPpwC z-tb?N^dqS(xFQ%;;7k;P><4jV*hU{2<>%yY72#!irf6lt-pM2Z<`VnJuj&*xvsk{- zD@Y{bF5n5|5HRwL7~CI$Um*}}z1IRBzaknUWTa1)JZ+O6(T=uP_09cPLmG{svw&=;rz3qo9j9V<@Idpz*iMhvBC`Xxzyb$iE^0GK~xz$?rg^^hg+? zc2+?kHhr&ihk)ZO#w=-vox=76h17@5zExh7jD;uF)?!NdaO1eq3x zj4Y{a0ZFoyNI-kW5lVasPeZ>;Z6Z1|e*T68LSp`TF1u`>y~RY+qcq@%x&P+5{{*)G zlca@s03*a|TK$bb>JMF)1<%t9EUar5#h_CVh=D&EftMwBWRg|@#S&DPXKvRcUs(FC z)5EghJnc~%HNc&&XRfji8c>;+5izoIvV7t_5BcA||G58uwgligNYdkfnW=k>)r#6M zwyn+v2ct7&B@sQ`lkHcMgGFm7NJ*Q$Nsst>0Bm#HuAr!_#ReW#BJAoEEH+-T#pkJK z+z*8z{~+#qd_K}ZPk7h=g{ot8q<`}PykZ^5bFXglS8oFHy8zP*qt>0t|Gk#2eWMH_3sm~0k=V2;3h0X_Gv795|RKA zkc_Q2{4$fZ);l=AjM>zj(6&|JMuB<5y`KY*6w!isYg0o;Lr2u7PU5RplZ*wanR+-- z2c}G_Kv|@VmmGa4AeePt5?%3eBUP6!*Avp)o0Ttw-N2=P*WSu*VO5(qfI=dA1bmIJ%G;;J z=>)&$vRu;3JHd=(V2>vrsF?U6$dUk`(=PPT%A%pWnY%~a%L^Fhj!5G%FkRYz4#cC%(Vr;|i(!>Xbr^D%Yxn~a=8D2Moa7o2sH8+QisfG@J|5n?S zhAR>Ia*x=Q%Q8O1cQpnGF`&(n;oHTRS2d3y9}#o@>O+h={T_$=x!MDk_Nv`cvw<0D zFCj|&I6dAE&GKrUL%I|6+M+#HUCCjmhA?kIzvv{J>GuTQJ!ta%pU=SQOLWqA$${*( zj;rR6snu@bS`1DnPbm7@oFnNY(*889eTA#YxJj&Tcs^vkN8{urh%~&5t^{za=NU-4 z*QJpRmHLiQ;tDuA9QSPahv+Fw+y-+Qrl|BPm9}vqY|%(AFHHak2!>1eo6FAvPdv7^ z-1km}%Nkg^oF*XdLc-2&Dw;n7Y8FF}YYn*K(vr;W?@T&tT~NNqFhVDgRZlFt;Wyp~ zjO(Q(T{bd3EQ&z5YkYbmYe~PGshzG%$YG-YnY?`|Aoa(|15Z;nb(0UK{-y0f`2wb@ zpdGuyr5UXCt+5P4?cJ~AJx3Y96?37;9_*`LJSz3Y{!lto>INZG>pi;#-s(cC@ zstM*65icD+v4ITbu^N4of3Hq1%fcdOg%mlewdwDh%NLp$pQZLajl1$nDe_xFqJ0L~ zr`fzMqV;3Rn2$W8Ka#M?$7SE9|Kj_O?{ZYIdtv4RSkCEz4ICZ=mIhJIa`@*E@EFnQ zf!^!z?9epky+3C!*dw7|GaeNf-iF5U>dm#Qyb^v&{A_lMa!UUJLR4u?{vaigk`Qp% z>TFGnB+CQZw^}&;h!ky?Wo#W%K6{F7op%oji`flx%M4)6s&d$G(~M{H>`ss&K7OoL>E!*G z^-v?=e*kGfmcJYko&t!znVELm z>gx%y7fA$fhj!!9uS8+Y%iPRpfFUQtf$6AbC93oQ8Mwvi@dN@p_a*b3^PJAyA;~PS zbGh$L-%@~3PVOoQj}E-R_m4>fi600&eeWvky{%LL8P%+BSDkdBi7wr18lm7p@Y&HU*1DT_&1D|uj_H4`3-<&LIQu zA|YdT#=YzV!*gr|^If5?xeg$WP5VMgCU=q*(JIcG%&rv-W7)HLy_E^HEgc(U!F9{W z$>^pr^Fq8K@boukxm0v0gh2NDuJIwX4m3d_Oo2-zj0Ma=4)7bW-v%)pSP~g&%E00< zQZDltcJs`cmCIylK*U_K@1C{Y%t-SyAdob*sHbvzG~~d5qJ^uL`J7(v9Y(o0HiTnj ztU5Gs?!QYtRbZz)6wdCx3UhInc$YXNqGX6?g#H$Vb))0GMilJ4|}`2bd_yqXyJuNvfl#f zwXK@>E0x13?qRCZHN*n6Fhy!|zRT>%>n*-FbEhszZgiZl)2CU@zOePYE&yrSvc~zo zX3g}!MFpK@2b{l2uSS!vKxU|5&C`QuYOYg;2T9wEBJS)17=+pt4a59COqJ8LI#To5L$QZ1ov|CpS-cISGgY zfQm4Rto1^e0HhStR@bY#xc537%+5KP4#9U=4oy4q9!xu0h#mM{4TsDxJnpzA^hh`1 z=6nhFuAf}tZ!*KW4F&{R*0GLj+BcGFM%#_{=3{L>v`NlHt!j&c@Ok%})=f}r!`|$> z9oV>+)_cRy_g=R5ET;T8V5!&6t6BBRvw5{@h8{z&3C@ZyW{D)@fj1Ip)|(67QdHac zTRAWWd~gDA3Bqwi{5MmSuWBdIQ|O{)#_GJi++PICYO}hvVAlBIeC2^OiwUTLBt%9) zrbXDg!9xam`bR3L_8%L6BGpzi~6&I%(e9=W{*6d$(Q6hFC)CZ<3nyXkcu?o)a^VaSpS+-~#Rw zQ|}oYMG425V{?#)Fb^&`{JcjSvWeckH_l0Y@;vP*JNI&51R^6~>lc}iebRK?$+AZn z4bu&`B$Oy8HS4VFV`)@kZr+F?>5PCx^WI^cF@f#&20(cEfc4dlPqV8mhs_;B1`siL zNqN1azQcDY^-nj`*k#|Rb2+Zb#trf6r;oICj7EbLYSqpLuEsa-dKU>>N;B(oB%zu% z>hHS}yGtOI2bY};SMIWCFmHmMKRxgi4=flxyoYH(ja(JM1C)+bc!d`4rx)f24nr_f z0W+ZyVBIiRomy2xj`ajbW_M_iL0OpmLOwT*XI-IDK5s

TL|~N+!p~uXhVCuVRPf^zi1#5mHV-) zIlf#yweL8xbQ|lD5X=l6j2m*DZ#yaFNAEy=qgcTpv29zOTVRN|=@Yh=-+&p+i6~z2SO(1%UX;CvLG0pqCk4Wl zcHFm%GD)o|((dik;oXCFL=#K0&Ukx}VOg7Fm$Qcxs;1C1NwRm@A+y&fdP}HC=@t#@ zyXjc~?l$O=TQ;*#RSdwwA;G@UQ`FvOUu)@$hAk4n-(;Sn%o}ROi|rfLbRg^iUAj@+SE4l^P<^L3;>#Q4CzAJfT=v8- zL1ulsgLMpN>N-}~`zF*v3$BBENEl+jWmh1=cxL8=5IyO%G-{$ME_cH+OrgN%QD%lX zD%Vb;_HN&W3Bgditrx6OP$EP)I=ZE;^E4~lHmgM131;-?$>n!th3{o7^sDrzMKPQY ztUpYx9`{LzoEi%r=;9WEzchY8+PuQqb&nh!Cah?B-3rkP?2$E0d0JQr3V4h_-GFDC2fJ@N2)sdUq4x{uc^#uZpB3Sg4GMC?_7UDf&kL)tW?cmkbvKQO!xz&~c;g&l zJY;98h|2=9A`2Z_=PR`Qzw0kGlK9)Zbw0wgd6|uMU~kJ?i7sGZ?D!tVmU=+ZIgsoX~i^3`$k6OdUr! zJer<6Oe)IL032nE2X@CH?Un`i&8>SA_Vxy&L&bmxReIp}4SUF8!P!!9d%PpgS&^T2 zt_4b!jO)H9tV;#jz9>Mw?_@$7;cM_=eIIYYZb?S~)vDupggg~gHl>Nio#7q7fk5dwA3UZ>qMQD9T+D_js6bo{KnJ-#f@B zKE7qnv7@+YdeP_-Mcmk5h;R=fYgg4@Kj) zX{cF)GBI(Txu#E_qI)il9)g6vCJe#4%v>J9-W%0KX`phs%b*!cgL7VP@PQVh#u*HE4k z=$S(?)9|#W=^RNo#M&AuiyO~I?&#j;8n08>w`U0(k!%|S_N!j?)~aJ6)X$n#yI3csKDq5!Mbz5!7GI0^_X0RUB~2m-J8A^@xYI4A+_? zncKw&|d~W!SSQ+;Et9GXRw1r5T6!c3i@#UQqwI#HOA$k4(X!Ak}Z5y)^$ zEpwF?{_gIL-tA_el)WEOP7OZ=S5@X-5-+NaUK?45^d~_cVc4^U+C1qEjvsgo;yEBN zao?8JO4#0@02Jf*BzSnU+>ckiQxtWN%2AT2;D*a|dvAK4DC-y#YIgeTGnFymm9kER zUWwVCve%TI{jJV#VR^r+DhDQsYEt2S_1-iyLBxGmB8<1Q~(?JyYB)PV*0k z2pHj+Iw{Ll?F7q`t)v8%I z8A9}Bh{aJnuA9Dn?>V`Z%F@B`jCvxhwNU=qm(6+K>T29h{Jm8trSpc zHrs!ch$13rydgN?i71dkhw`6Sery*~NhFeOw3B4b=99Gh@l;V>cX>ruoySwnB2nje zRrhywRhArgn=>+e{*Iq_X~(;tNaT|=?Pi^T;tOu>`sz#Au-b!%+%RCTru{%?mkHap z2j2yud)b^h3=n)kZimVe)U4d!Z+r9Mxs*^N>Mq~;Zy5e)b?c@K5Jg9yz0PlKQ{+Eq zcyhx+MLeB)z+_qW-8m*%4Eb@O?(7eK1=o_dYN$~*kkTpRhJ}DNxv~ui4KG5(Kqni& zc+h#9Z>4;~ghbY}+4reo_Db6hIdmBA*`fBvM;%MY14+GOw{hXCSTE=_+OYUA>}3?z zP_bjgpLk1C2VaE}Av{75Q-}~D0T9hDxGD7JlxH zMh2Y93?dpA@jvB=j71Sj6GgL07HmE5XUBa0bHT6bsej$yX9QGKK~aK?pYS2~+|^gy z`+sB-&$NHOoVNMXm-h$&3He4Wj0rdqDhaC}hz9${zyQc9RKh+)3?d;=0T>0+18iXs z0~iWWLPP^EzVJsxMKiropk(pP$TjJh+`=8+x_2+D@Q`{JQSL%=cvxl1&hO`+{$LaYaBBRv@ayMT;k)C*!);+wrU1?R)+4 zJ@-BK&!SfXNdS0^RbVNwfh*y@&Gm`uc|~6Q<0h7>gU)@?fMrq~M)}uWw_e)o+xONA zER>XuNJug)k|dHJC?@&i%Jm!b4}kQ6A!5N`u*lSAe}=&-Z`6(d^wG z9Ch!Y4^xtBdW0uLfFOwkArKfNBF(h4+TU|+Nv@kEw3ei$brq6ku##ANX;HF@6-^W( zMF=TOH~yPR_kyB-b9I{J@>|EgxsL`@SEzT1b|DTr#Itbps@k>te&sBfQL<87Od`NR zfQX1xAWZjP$A&F+dn4L?a|- zY42;9nkd^E!K-~$`@Qbo)}ArLAt{?DlEN{U-5G#XXGnrt`u)XXA)*sYB1xvG#dWsc zemwg1-<~~BJt!oU(lAyc3Os>2bHDBsf4TlMQ=hfNIjQ(f`NepXg4rKAqdMTHpAL{$ zV-NxftF3L*ZK+p9DFP+!c1=}G2?-UDSp(x|v>n3tPQ>gE^SwJ5?zynnwZO$WP(C~Y z2?iu2X(5qID6t7?o~vzq{raz7I{N$Go8Q#2MKO|6Q6W15c>UfURObH0vh(ah{iG`zc@KNV<8I%7 z(`+zyATW|C86qTXl}0jbn^cix zup}WQk3gp+Uk;`@@w@X|z1{M0U3Y$Xhu-+#-tBj=I0GU01PWk4p^zZg%ofEZAyzGk zqt1|ks}v$2XZSdKxrEH4gaYUf%@^N$UaxOjwYRtL=4M#Yf&z#nESeJ0YBnlOiwF}$5Nl0VwSDdm>Samz|a?YoHo*nnjyXfO!yu~B3 zlvRP`WJp2;>D2$3^%*MtVXsD@{je;no zq$^W0Yb0z^SV@U(WSJUdRg&9Znt~hWem}0QyGJHn;Q{|(nkYu_D$s-($&v~yt%8C{ z)eC8$QX%04=3+}STnMpCI8Y$Kt!h|lI33C$cO_>VaioQ^Awfi7Bq0zCjBKa`K%-L$ z1R+wATQrv50R#>S2z7>GpeO@Ej*4*6tzLqGF3U6`z2_I6$Jt1%U)aPRtPCIB~^{faMI6W5%ICFvG%7rXcM!LT*tq zP=R4KK_-=e3Xw&bY=Rlq&bG#lLL^{RnI>ISpf;5eFhodV(&-8f2~ZGaGBc@B#6;^Q zskI`kxg{Km)d`Gz8(>r)G-!5j&1**+`)OK|YR%Sbf~N)SFtLnNf9m5?lYeqF=$n_L zG@9PHbiuq8^s`|Npm zpK*V6nwx5Ul@+{|)VsN1di$gf1ocCQh|BwiV9do-A+SpP=hPk;=X|xOgv3NSgf>&`5vb4opY#Jr_ZXGki#BcPpzBC-i`%eWp^i?nK)Lg5eY_%<#*KkJ;IDI+?Z>- z_i<8)0#YqiX{))Is=DIswvDX~bYSe{Fjx?_Lb@p}>eUvCsI1(y)RK}45VbW$SE{@3 zdb2mJ>^T>{WdNjv1tho2QXJgXW_q=)X0W@WdXR7s4d7t>^c6;c#yK~@cauvax~=H( zhSgPq9u^9e9;J}91Yp4DzWdnK7oE&JB~f-xm{B@Qgh$7Yo$oEXygobFzjS_~LKg!N z5Mt1zIqz@UOsdUjR|281Xb}!tEng|5Xko*htkT`*!Na9P1_enZv0N?>dCvD&cdc&% zbFx5XkfM=(yxLV&-@f&H-CgIWh>DUZ#S$V#BqEXQvfBhA!BaQaGmgnws@57C1RMwK zMG=7n2*L;yc`H|FLPc)2*287eq43rGRozjqbEUV1Yf|>9@cThb9T&~*W}C{)JAe=3 zAv5!{-(E`SH$Pvy%@dGOP5jrn^131I=Np^2G&SyfwY`|*+@E#K&!lomySuXP))JT0 zISqQ;=c6lv4h`EDC>!_-34ALD5d#d+?D$>$9Xl8IJ%cZg-LgD<`*vbgTApQQNGgdq z1PbMdq1%xB1mqbckqITUyYJn+PBMlsLC$%=o`(MxV#mD&@2CtSLBa(!TU*fa#w*%; z1$n))ucpK1d;~u7Hr_kYzCwi%P^u@(e(!?m&qI|69y#qoMKXKL2mwE<4E|mFzIFrq zfl9gH%lOzl+8xpD&w6{f1y)h;8>D#A%#Oqf2s0mnt9L~dIKb4EaylE51W9;BH#Ys7 zefHbH@u!RVFOE01Hf1@>hz0Gt_)Nlo$_z7w1;S&>cR+r53#x9)2&PsJ)U#2Th8P|%|_LrzGASV(H8 z81XZ|ug}ki&+SUfFf6d_`n*pa58l@G#*8=jbTLh4TWGC|;#DT4DpJX+O_MCyH6<^L zt+we>ldsq;#ImKCN+^_-!h9ChF0HtgBPgn-6O&f1*t5?6j>+Z?={*OPu?EXJ^})(9Dy={o0t;UfsM!l;1?yHd)NZ6&oP+fr>((!Y-K66`lO zdDl@FUCp!^0F^+bfzE(zArbwc8i24zcA0`GVnARbS?kscVw^fCd2ATVj@tpQ;_fBovTXq{&(~OBRxr1W~mD8#1XZMySTJX_7JthzsA} zozJX4Jh~M3^bg8pdy0`LjV2^2Hjot5z`J0biNxZnLPrX@H^yAx0B|^-yz#Bw^W6Q` zOsT+UzTUCT89egNE35O%=QVYjmB7>y5nwPFK?F#a3<*R9V8jFxh6xkT;!;1$sRBkc zLf{29YDu4rX!9I45IF+Pwl*T%+eMA8nzuDkW*B9(Q6Py4Wyph+5d_IK-MWih*tOah zXhyo}l1d0%3;SCUbO3(^3KF3PkE}+*5nD`*mMdz|r`8K#5K;pH2q9rY6ods*3=v?e z@OD@YkPw2q4v*k6EQ=zt4Kh_4k}YFqQ6))6ii)wUZKTyjWU-Kv5R4-Mk;Os2{sO$~ z^Yix4&!JF1hu7=Dz{^DIIf@#xD1s7iVg8-#-!IFkeseFGTG`F&-H;?YBm`Mj*Yx}_ z{OxtFj_)?Vkjl+TGQ=d)y0}(0Y?6_XQlOF{ph`#zkOj>jfe3Y>O#~GPAoZT$jxZI9 zBoUB7f`{=$9IzV*Dn$a<@UU%wBoVPR*q~e#AfszQ6#!TWP>1Jc0N_9XfTkY-Virqn zm21Y|&3?p4BSjlYw9RcMwl$=y8)=nHt*ENgHnh!ZDJ`*DO&c0DGZbo>q_ul$we$P@ zK7U8+*!T2r@HY8Ak?lmxs-je_LX|}cO)OOxunF|!_xvCD4zooaKH1$~n#$kr9C5~p zwFg93uu{KXB$7r|RX0~lyz9d4GfFLF$thBT5+mn35y%Qf1NVp)EsPa{ndiOe0Mi8` zj>9Yvu?yocL`)#0031xN@C2d)5KzZFp(tRX3f}isbgh=svRhMDRi$eFuq}eIL$~;hAjTmhAdrM*sWE0~ znQY3G%+(QDDUwvCRAI6fWhF^$RAP;jDKgiMw$=Od@%nat_IU&k!|Z|lQFY{jB#?l0 z8jM0pWvNW7na!k|Dk!2Lvz8o_MP5|tHlrqTq4YFcX~KX$xEsEtLo z7@|r7NYNr2B_O24W<2?Y0>}VG1pVzSM#w7xaO%J=01yX2fPG+=5JZZ-bXX0c1z;|p zYztrv0JRY)QkDWS5Y?%aU^u`63TGVX_hOF7AV5=mb%NkP1}gMuUmw(wAjL|>lB8v0 zMk2+PEhUO7qLj&LnWl}Bq}3*}YD+~L(?d)GMI<2yLIc0e`!C$7`VQZ=Mx{cu)C#1t zp{j|(iE3poz3R*3f(ypH{gidnt*SkN6kw4Mf~x-a218T1 z-Ei!eNzOc?B(^O@6jesXHb9ITR49#vLnuhHm+^f1_^Zv9$rO0hiC|a|QY%dY&_GxV z#ruF5K|(0zK!^p4V+3F)r3*m?2qQ(k-~bp95(tN-00jUVC_<6|#7(p%K>`YRt6O-V zpT?6-EhSV%nG$3uw#Lz_BBCoon@VbC(pf4s6%=Y_N;Xp^OvbWp=G#}swYBy9FXbQ0 z6aBCz{QMUFzP`V+2jS*ll!|4d(yCh23o23zmS~0|ij`DRR8>%N0*l`2y5{wBdEEB* zuQ{VX4Jo|6^-axp$2-HKC?|segjNEW{|}G9>{y5vT8U|kCbZwZ0=>3`q`6l}Ez_b{ zt~Ti{BPPjGh32){YHeO@?ZLMf1B` z!&|bsR_s$%CZ#4Z2`46mZGsR}^mwprSRh49RG?5PATd-ZXjX(czRVTG3wp5|2oYOe z>_D;*Li>e^TmmaW$3_6-2#$LT7QzVuzYo?xqcqT_N==xWN@T_+Ei#zGMAlIOLj?x- z_EmgWa`6N5K+Mf)%7z7nRE+WFrA&60kCogfL01 z27xFD(hQje4OClhwiE@1fKG<;Lhd(Z7X)xja{(|`NMKf>3aVjfM8-0uEDMIBtF{4c zPzz*5M~o7PHpWAWirAtU!XejiczbztS1sK_auc3|vi90=0(G{kQ<6c2TscuiVavkq z;ln+2MX^L|%PNUCNf%l$rW|yf-OJdz(cE1dqf-J2%iYdI3b^K3>yGVk+a=Yd#HwIi zP=T;e1ou`mgNyquogpw`NM=^y)!R&3=b=?jr^7J4Eq34pviKg&oYCEz!+P&7 zNg>F1(Ud~v>Y;JT2TseH-r(YAY_C8l0K6GM1>VmM|GfD#; zg!@;>BTYZPThEPQAd_@B*ebbDWN08W7Vab`$9~&c_I5Nk&k-M04q}0-gb%Yz2`p5w zeklD@3P{X@&>0j=Q*?eU(}=X2ERtl1>zT!UUXjA-3`Osn$M;cwygJ|96{xYcI~8z` zB&c>zlSaeF^pI#8pe(hYK=+Q+?fGlyNSB?7QIx9u|Ff$$b9% zx$LYt89AbfA5jnL&98~ND~PP27I-FfwuIoJC9Zh18Sl>feX5_@yO$V7gcdjNtQV{| zqLE5UYqjd3y0dzi#}G3Qia%Zb5eBR+G+GNySVHpl_q9|~31UGaQbM-hzTWTN{rBH% zRS(gAPIKPpsP4#geqoTwYL*Bj1PXFUPp|FJr!C#Wa}c-Df!ZG11A?e8#V?hNtAd>$ zf*mJ~_;;R)I@CSku71qO?2K|B8!M@IeaEi&eQ>Si2Vkvmnn+akfe>pRO2y40>;0J{eJRgJ^d~`o+dzo^pskU`n7M2^bsaP4YdKjW1`QO z;rM(IU}!_|d>CSc2ynq-_qB{P&h{Y&Rq`qr^-rbD6aYLd+zVAjyYapDIW1q(iBT%jWn!cE=%tUxyn+eZqkf{@3?LGYw|z zyZgK0%f}}yMZY~&s#Rv#f)Te;st^k!Bnh7yX#jjRV9{@~cn}2hO{7l6<2wE1ueKgY zEWT>GVO@K=yXp4BTxg5;r5znOhia>vuKV2_;X*|^lh>-TVG1i^NIQnF9{oJPX`%25 zL=FN;`1{(!zkSGO-&MV69@m&!A8u{3xl-Gt_qU*%;YRvVj=QfIVy7&i<0wNDd%tEg ziQN}hAz4OMD-x(a-`R6TIu#kG5oeOe8Vy7OGxRO8;D84fT4-X&@Th_UlTdK^U%77ZEauQbX@+@)nhn@A!4(inYzr${ z838AujcN*+49H*GY~P>@z^C$J{PAxH@}m=}Mlm2`L=pi_rhz92mHtRoMx1hqMCEty z+d2N<#*N$rY6m9g>Es7Sk4pr6MIQ=omkv-F*|Xb1EU;4%R>_JK4efmF~yMi4;;5KuoNqMCpzfx3poHivpqQ4SygDLfzF z&nPR91C2+;)?0#SX^CJ11Zb^C%i!V8%!Lc$PFs1ynj4!{i5K5t!n+TQY;Zr{`S zlv8CfC?jaH+f>k~jiscdj7I@e;rZgJ`}l>Qgb6>02>s9DRS9aMSW1@r0NZ}Fe`n9@ zi+Qh}zWm>ZAe7y4v&{XyAS>Yk7(o&V1WbMrvG^g842hfjDu{~wHv;LC9GcW-Cty$% z5AV|(fJ}q{C{FB4Lehbtbz{b~27?X``p}wT2UlR&LM^;lfLI~fheilswsB%MfzgTt zCb`h2m=PTA)%;5{2+1QPl5Hi0l14!!WWYf+x%Bw%pSAjeENhA*Ei~e!a-jB7TJlLk0m~6UxC1U=bdI&Tw235DeKna8(RQ3=~b_r+ytA z030w@D(UyE5iuYFL{}526EIwW3l(0CVS*+Q1&9u{qW~~S06-eay>H;MXe31$F|3kM zLJ|aGNewCio&I_5efpxIj~>dXnUrZ=OGrftLHWMFqx<;!U$s6mZX2NeJvk?|ZWd8T zPcy|-5Dy3$5H=A2+a7ECiYb~!2|hOe3s$SzYO!sKsI9V9Y+G&3wzO@wsM^}awy?{Z z-~a()(S_JBrZya7oE!*=MzZ6!2zJt)7{E?85%L3*Vus)VgisUsA}srsZ=;^>57d;fQ zEKd*Qgk%^(Owwa4(S#FGCX|U1Xv&sWiZU^l*tSHmLFxDMxcA@L^dbCIL{fDP%8g2c z6pm4-nNu+8WYa39oku7#JFWyfu|{0#m8t}z3ZXisGlV9hKvp0!cX2Thi7WG7esAgg zeRC{f-F%zUF^Ud2qO@8-HKX3BDoAdsBOLLz>?;rV)c`x%2bT%^cmA($}4`ZF=T5{lPhfnRHl z==t9$Y{l06GXew)a=j6L5l;B_KUbI0*O#qxBqX0QRT8ABDuSZYRYjtOEcZLhJe~Vm z%^WJ`iZp+xw|&*O%(Y1*mXef`Ql%uRw2~r8C4!{^B$ASnOo5XE**2(UVm1jZl9(c| z@qbJ#Lr^Py0c^O%Mi*{7xuQWUy5g1)3{n6@0TSIyyM;1Paw0kz!$cyqG&!l3T12X# z=i5(S{LVYs@tj(4QJICWv>3J%Nnut92NQhh(VMe(t6I%fr)V#x3?H8X_BYx2`af6i z&#W~FMGO*RYlV#Kr*^Jrw1(y)w=gscRhL78O$ZttiQ6?zB?*wSk`yAf2(5$cJ^CNN z)i1l}Us(JZ@@;^?7xe3A@Br8}1p)yAZIdJ-S%yXwXs8rZB_$=PH3vBE3fBv2%NZge zA_&0pA;Va02!aGKqC^njoG2m%KfEoB6xzrs8p%R!AOeX=InSaU(IFz^BC%Ak zvzI6%fpGTRcJ6>ucIdNHMS@6mcL?M}9IoQWQjZ9W$#sV4lbmu?5&Qf6#uht)zD=HQ zz0hm#ta3Qc9;gec)$kWVzIx+Ff}r}Ky1zc7&SzZ(LUTl>h){zO8Y!g|7J44mHN9qp zq@+3Z`}v>a`cC8YA7W$a1qPVD6U+BbtId+K%l9IXrUgKOX`!<4$2QZ zq@l`q2oEtYBO9~fe5zMO5|GxL>{amNDV+9AV)^$ zVqaj~JfaT~(RhcfraHQ`OVBvsaWc~IN|sXzLIfJ1y;2zE)VXDrW`i&&S|TziYayp% z(*olS5uKp|u#yh4sjA52tVmhf(+a|llTKiyZM5xH$U9J&T_Tf#u#VMOK3#8T_ z$8Nh3mn3x&$6eB9DkPFdh@nmf#ZJ(!v{XdoB~<$R_4Z|bSD6;|^Znw_0PB)HF|uew zRUM`{(kUJHn7bJIQ}jt8z>yCil0Xztl`E`MszKo9)pT${y(y}1c_APntrZ|#KsLe_ zfG&`mKq-e92U%$*qYWVr41tU`^8MZKjZv>Qy%9;mNFGSCK$G#O>*a2V*VUhEGgf`N zXufNG*IsPbs^|so*_?MRlRk1|kYt}}A8vNlk9<7#+L=$Pr#r!7il@i9VFeKle5ySi zgFT{(`@X_V_-}a?G^|^65WI*ocT0N;*F0xks}_iLA|Pv{kKa zgq4DnKspR4!T^LIs6q+^AfpH?C0hFFbrox+t%%mxEwsZ5EfgdX01*OJEd)2)%jasZ zS(?~LhyaNoA`%FM1W68Ut!Z@H!B$GLRY`56gakrQsc3*ALLx~nK@9IHu1o+1_Q^u9 zfCM0nAc+Vfm1MP~wMtuLs^0rAX>GQ=O01P+s*>80wo0{|yxZ2btk$$_31UbhLLvZg zlf_;oQd-GvCAB^U*3w!^)Rm;Rq_(}OTWh6KTSog^?YDVCs7=Uh;ba6mUEgy$OiM>K ztRI5ucv;{Q!7M+$eY|$47g0H|={`m6^TiFk(9dp*%eT zPZa6%D*D%(ttGD2d946~fXQdGD%{uFZ)@1VY3p)?GE^Xz8FOY*F_% zRo$B*F-W>JT?mZdGox3A1BAdrdLkfTKL{gWGC0~0HP+?Iy2JVA{5$0HnfP0I*`ouF zBfaaK_cLkVCr94>arlcE`*BVc*Oxlk8Vh!MPkYC^EnVb~<~n^;-@@*1*^7Sp{UjT@ zPJDinGd8YAcq=pFWaB;?j64JZ0QdwK-1E2 zKLST1y#g?Vf@l^sTU^|@At1BLK&Xs}7o2Yp2U#gt+kCmKR)bjD@aD8?lWpR# zZ-m=oI-RlI9PDt&0_+M%p$ao+dA)>E8fk=357bhCp%q|o?H0%l8r_*7p`R6OfTR?G zrjR7IkTzT{O=H@@LMc^BsYwYVBlua*v(lyW ztya4`b6Yj2WPAGVym+s=z2zo`U3DY?qAbCK1_^7CuxpA%h)63YOKKXP$3`$hhr+>5y6mzh=fA@(zaoA#Y&cPBVSu52O^5JD6Z-TA|<>i z+)d%Y*ek)~xE$c9oTgBdDb6QJ%64MtIV9+w1ssmKCt_@_(+DUir9DZ>#}NJFw)y^n zwWK0$bK&NWGzSoQ!iF(Kh2|A!C?fesVjuCYqo$<9bix+|fj-O@-JqV>8vcXMnpsW74VOaLq? z{}w7D?XbH{3n<`FI#oJ(``44>>OQ}F-^KDiq9Y}9j^M6mUAGKXI0#oR%PvV>AfY;` zG~z;MW!P+6PHkaTMa5NBQ4tXYL{(3v>salo?!E81emsZ!Rm?drUFBV)&yJ9j@Ra|l zBveI-j@=gIn9M4bBQ)kp)89aNFgG^DR3$jarcwlt{_lDQGP9;ApqXn zOY#?OT*&2OTKf(|>|8KJ;%naC0oeTl6G80V@b#61`tR`(%fD-v4W%N98rrn8HBm|^ zvZ|o;DiqX0phNScp4=gkv9-$Oa_MOzcT`kVZtEO?q$cECxKTruT7r9A zqs2Dm$f<>7jbgqp8|STcispk40#0*~`=0&r$6xNl{m8KmwNxoWPKGJNREtHS8io7h`}Z{Ox3E6=uf-cE z_8vcNyx%9__kzQ8xe#=>WL+zyl3EScms_N^Nh`SO%P4-_i^HKQT;zq$aeQqZ$1wMC z$o0ZK4@B_7W$ZTYpqzr0infObcO8&%AfTZMsB_#o?q1iZKN-pPJTS`m3)e1i%uU{l ze0cb_OgZ%d_pR~YoN{|yMFOC#gCH3CO^klOik}NpETbVaP|BqgBB}V_2=B6y0m5eZ2-G>TTTTuD~Xvo(x9`dxnSWqLV4jQgi#SwJ>9~uS5&T( zs9Y)zD$*5AMUpl~`8Y5yk1#=T>HFK@3ZeJD8rX(#764blt=ooEq}UY^&pilE_b2!1 z{i`&8k#vg5O*DeiQ%cjBs>G70%&dYq6b7o%QKqS;s+OvXoS)s-`9IlXci(IA`jIK|8oh;lvzS3&?Xz}nLBFPa|EE>N8x@)Hmb#-+zu!2aTLg4-ZO(YnehstCbj2VeiF^E_XRGXzS~31%9HMq^QG~ z{jF;QDRsO!!vN^)5NkXDZ$Oa0I=^lA;`m09`#EvTj-1?XgXH_&{eE?)VI^qMhKi&* zzX@f7(Fe8!35_rj2VS1y9+s3RT(g@8lY{SYs913KZTcYjSvij-Wrg+y zQis~!)xDEQzv`xnC}~oup(rPRbm>k0|8;gB(N&Ss8TdY%U1GRDsD2ViAde)pl1VM3 z$kqu-KoJCRe&3N2!&}&e%8=@)rP2hsbhTx{AkYxN;*CiPl_aFtMd}!IN8d4i5HcaG z#=%3{Xi+|{OGOGGDnN*b5LKcehiWI@=_in?zWkM%Ggp&ZVN@b)q*){@3=D%A$P}<) zYbY_c&IKT-xG|=fB8dwT5J@1A2___>)`iuaJ68nt!3D#D2q;JwJ}=2tjZR|P9cIE zhb}jbNW>_aVUHpJ)>FZSs6xa|0gy1sDimf>QYqMuGm1#x4*>4;?Y;2rH=dZUPC*h? zD^;>YB&bM@k2<(2$^sYmXfrJRLek{3_}B1(p8dG&1N$SImuFzhK7V`770mZnjy}_Oc59RNUuA>bDmW6N zYimLIjQWTGV>nLldARP!T11jy`8{Ui+!tC@!&IEpBq)W^kPh@K60 zF29o`!$UQUAVd@o?RvF*R3QXXBbq+_9VYm_SlWBu-W~4x2tEUM^jJ(z>{H2y!60yu zSQQ{gC~>8Tu4$rQ!MIYn-<_*gH-!Dt)QD%>7?ga#rfbmbC141>|qYzhp*7Lq*(kI_t3D-{*k%u27 zKSE7H%lRY9pE~E_-s;7?wfg=yD#Z>bsRzGFJ@jz^2_XnpVFwAzSB{v<7-FfUfmRiT zmUe3qqInNIQEf|iwn-E?yh+ID`~Mi4FUoR$OSp^O)1#|CPRN5oR93@?Ar{KOR2HDppw=P}qD zqU0O#qK5+q=F;rH4`%`l_Y4UUs8)m+!P)@?O@|LYIL=PwXG6oh0DhgYtM6>wyzTOusB1KP1yWY4fnb+tE^154HQiX(J4 zXDXVin5!TiyDGF<;GqpbJD+dAV|v!UG>)CTp{lxQTNDuSQ03`qF2~0#&Q!Lp#TaTw zgIX9S0u=%$H>=xjH;J&iQ(_`+imqCOp0(mt9Rq+oPb89HG|@&pHl1%c^D|lsnW!ZVdlVFF#g&0^> zQq>z7ohpQNJ=?D(-RF&%d`Ha{Mu99GS_%utm3_*x^C5@D2MQ?QC7&AKJGS#P$HHi{ z#go>llsr3YSJ?Dp&mFv#r zq0i~sU7^_}Hbxk3C1YyVO9X+xbZ*Y@`=8oN@3-#o zJjhK~7;rpcpn{F;mIqRjK_vOVrpWX#<55CMME*&o-(BP540&B>sz!Bwef;_FwOS&8 zl1Uiv-<6sTZMPyZBuGoevOqNoBopEY@g)666}g$)y&LWOtDwC(jr~57LA$%^*1qjc zyU(ZFO^ZAk5zEaKDuT|^C~b@jMvEQw;F0{O1{Zz9h|iw)BpVOVohqy+9IUAXEMblu zNKgqSauVILgwGSoXrFwj9Cz_tKv=t?Gv5RrY9GER!*rn32gpJ`i?+T6p##1?`|Tcf zY`aF^ICC|VJ>t~XLzl4L%WknrAwKRrHE|`0(ica3G;r#5hT6-qRh@m)Q4WC8EOp-& z6q)x5oN5YuW zqwWw7SLLEkszYoeW{BGR@L}hVVF!-_B$E^nUlC4^j&<>;7*YC0{ye*JO+eTi!=CXg&2 zCLe$%Pq#E`E$a_zXcIJ29*__q<}bd3gx>P;sV$-h$V3_o7`~VT3;HyYID!c(lW43; zkc1&hQzA52lX4AlH#w!w$47RY9dx$kuE{H$$OX>s?93zlOgZ0yhny))vBLZ9ci6Pq zs^Q-cfgT|wsVY`VQdFg1uYJ)fAyU&Yxd{t1gm%SQ^Euno$~og%Mgdgdrp$ z7cPW@~iVeQyog%v8b?1D| zXNN@Dm8V=yC*GPB{#3C8Qk7Op8HXcUmI^8HoZquV`|BtBba>SCGWYRENTF+_yQgrJ zrDV5Bbm2lo1VI8uU))->t1{H*H`c>!XvpAt#VD)4&uSdu8tgz+=n<*bDA;4 zOL)POj-qgGk{!KSmU-%9ie+)|i4V0wMjrKH`ba?z{(5h{uZ^$k6AJ}DXv8r^LPXVC zf>mIDCVD^T@5!QhK2wZ3cC#~|sV;-!BK{qfbiz&wo2O0Cy>{ewjE%j+%j-@eC@ zQQC6G+)a*GEz-GivB1XMxK}xX>#PzIE>s;m1epxd9UOQ~pZ8zKS-A^Uk3 zD-^R3=BD~LZW)}rDQzl`ATh1E6IC#f3Lw!3s!u#;)p*4D({=?z5rJnLJuev?i8se8 zkH;FPJKdLt2bD_7<&k8DA|xhS$}K4?73Agq!*w~{8J`-T>^=T99?Y#**KFE+`S$z2 zEtE{MR+5tVMe6R{E(U2e&>w_pJtYAIhuy1 z77SB(8@z)l-jhLLH~fX}0SdRsK_>jz4e{sLeg1}|tx`>iDVZ2mnmxV`#MF2-N zB+BYwijheL%ci7Nh9<2liL#1fa4_0RwG*aPm9})YpT3%}ou6m>uKDg7-|F`2+3=u= zA`nMpOW)Tv=)}9Z)12faO9FsM%*0GY`-Q4jws1>KrDDldPzqs5vf;DU9Vgo6fd6ie zIHfX+mgEXNc$Rc3d7bmwbn%oSN9*z53qwl^mQaRK%E=)Vv^sVCKAGS3YgQCzmV4)! z&irU1BtJ*!QC$>NBUE{cfgI+whAfEkSaSV#9&gVvc=wra+umW7eqqU`Yj`}GD123P z04OIMRNMr<>RhtlH|qD&&`|To9ngEcQar5j$dTA8wn88%ylsL-6$)t#grGn)U~M=c zak+^=va^N^Ni>T?9Es*)C^|x3RMR18qzs~_Ftx0*G+tRl0ip+h#+aleQoxEBO=vSS z974>JIz%8WE`}sP5EMk@2L+i}jwdHwj(kA!;**V!1r$+os;Z=$WXXpGAtr=@90H09 zU{L5x~2reyzDs~kVWhR1)NK-Pf4iFI!cmPkRjQR}Wn}56fu+!&dy~u7`bm=-G z`hA*D6@g^)=7+iNZ$~8LJAwA#C+eH+CoiGKcP=KhVfae-!4ca{bQaAtUcl;*{Na^@#yW_rTh+r7U}7u~O#rnQQ#qkQ-Fu$(6+&*1mr z_tw6-Fa^GYsgzG;u@#Xym6=z6US8i`e06sWD9!rtSt!@ZZ0>Um$X3Z+HqooDco^3H zj!SJWGRo)E?|smA#QxHj-d!qgspga~YKhOc?V*6|$aKo8?BA78r3~nksh;Wk_4w}a z^imnZeXGIR*XzCR8%mhcuI;$yUEX&+7uX$!eScIod(?+*Em)rPl1bRGA8ys!b#q1g zf;TXlRxll?FLl_#@FJ5G?+a&rXi~Iw9R)c3fC+%$Iha5=1pI?t;Fa>xv2AvII?h*{ zq+;dD&R*8nYBzQp)w~ZR)Nxfvmhj@unjLk;(wX2<+yrqun{;!7wq$i{ZQ4SEHE8(g z_JKH-hdO*H_#wlA6nkLrVuM4S0}CKSM&}KI2ix25suFdq-3Kg7rH8bS03cOWQgjp| z^EZm6bhv0NEXS^v%XdXxb+J`c?y9!voVgZC$2G@&HZ|1{Tw~#PeXn2}!r9pwHI>ch zf^tL%ix`3ujUsSx)vBtjQHUzdK`bI#r*~z`N-t&G6o%wYq{MQClXdsAtv2b+S=eDm z9HywV(uQgh?P6-EYfHSg%b>bks=99Mvr;7<3OERC(LH0@8Y_utQ%Okh-Hj2UhQM^G zqk%^=em{bWvAmZRy62vGA!MIPf zb^B6{QAyw?6HR|PHz_Pmu;PO(G6X%s7c zxp!Bp5fs`fNQj7>7?)z}pL{LMD10OAC`kR#$-szkhMkGF^(3olvYGCp-Jyr~uikxw zovYC$-MTw`Qxt|Zg?ek4Np}0n%qA?N`)|6s`#MG3e^lSw@!j9P`{^V}FKw!|Qc^zE z_6KfV-gJ&ZRz9)aNI@!v`0Wpd4g_G~)vANb59$;e=f6{3V$jSuykiQAgTz4Kt7S$j zg31_ICL~x?pB&opS5-r+ptMotO1;+bqz#E}oS+>(GJWqlem`?j1X2VST^fW%D#Hea zpon<#Kx;uAHD}F)X$OY7Cw^1IyM;804FrM`1KSu_He}i1@$Nn&ky(hG!H0_I6$$e@ zSyd6BkkHwSIdzUmfIK`+&>hMl>C!tA^KViYemD@wAR5%G@(8jfchx-dHfbm^BMgg2 zmTU-E=}bVu8)Sr(R*32wLc?xiU%mUb{E`(Q-@M}issds_S&ko(m=U1yv>{p6HH1h+ zKJ(M=2_5n%08zC05ke3J1xHr5wTBxZ09*|bD2atkT5|pN^{kTj4{pmKe{p;0hFqNy4ICjA4J%dL?Vzv2l&?Kd)YH@!)KSo zH%2&cP|?2&9P(3|dU%qm4ck|pKMM*_fGNDj{wJBEEOFJ1@kx7G|1ebW*iaB$}88s?OPPxDbB;71>A& zfrJF`+Vw2@-EhCn{Q8DZC0`!#-++FEGGs(V{kY${qFhdGvoS*+Z3M~)HbZH|gqn#^ zLYn2LlIo!Ob~PaVrzTE!n;Lq<{x}>SJA<~=nsB>hp7A&7NsGX%*;>U$@Fyn z-u#AhUwyTDsB)ee*Ei1jq{#GlzARMwrBp|EI_2|Mj21Lz#?iEGq$C9E#V~jDfM2*4 zp88p8=B>A6I`qW1jvFlk4BQv1ZpI#(!vkk#2w-Elc!D1D&wY2{_Y$f?RW(IGlB$oW z(V|`&`WW(e4E>7zw+C|)YOBMCkG8Mh&PR7gMftViO-4{g$OIyZL-C>npn*ouLoH5< zJNE37;uIwDlpQriRRLZklfLgC*gvY%+t*sURr|d*nIvM0Aco*I8{9H z`;C+8vYVGY6Vu`mf{2V&J-hr*_5S!U?)fnMd~E&I_TRbi?|pr3tI-6Xb;+_M#x+Q= zh(RkY*qOyDfuM&~%{t>B+9_I#bu;EL9X#K~WYcv!`}%{d~}V zx%T<~)rakGnWymy{35ELWR!|AiV6bB5d{kQnm6<++3E`oLj3nd8tU4zfTEqtPAj2P zIi1ewQ0+Yu5Q4?uH=nQi{eNdLKK{%d^LX#`e?G*t_Zg8*hi3IRZIVes>`oaKCrrQUH8X?ouI#}-_X5Q8aH+-xKf z0=VIa5x^`#l5#X7NZlNAOFsnBi^z)2ecYzT>u1+9R{faO_SK~Qi9AWVWw3_(Nz z5Y0fWK!i=ef_T_ML1iN$WmzkfQUD}lik!$nZRTQBwS)^4)>vjH6j)winUzvgB^8z$ zQm}WTp7!^FquWdn{TL#hwuwbZwemljlx43<| zrt1@#*=4ubLKjB-*Z>EVBVldm)m4>-mP)%Mk~}?K=U%kokT*^4kEhv#Gfahg^z!$4 zKr2XDS3AC5=dgQBDCB|*0^r*u{8Wgb7HPs{s($mkd${E3GWg^YeZCz=>>_?=uyM=J z4w_3sx_2+_97OB3gtTgo>WfUSq<=Zu79X2Rma58YzORXqoMR{wa-q!csUl4(A`YS| zhh<$FL|Qz1x+m3LC)egt%Qy6xkp!CcN}y=>Z%s$&gPTO{CWijlAxj8}0z(}A!rN5* z+xh#%p?QywMRK_IeYgnkn;3L5>`$HG(Fr?l*_rQyhhuxD#&1nonQ+^*g(*^~=+nNa z?Vj^u>s@#EzenBmmd=P%8B2$)?p-za&gT7Vaf_i@R1dn%RlA@_E3E7IT|-xSJklvG zUpJ?r+B{V$cE)8&N|X1;!>Oq2UVxn}5Ms7MPvVO=OhuAO2_SzgM=#B!i8-fTZlK9g z50%l2D&nmmo~U>nHO+Q+eB_!i-fr+P*Ki>4Na1X3>g~J(gcR#|~!`hiBGyx9_dd)A!$e+3d3W)_db86A!<2{0i#Ft)z`i zBnRvSW)KiS88VBe{vT6Ijr+9k)m6`XeAjU}<5VfPm}fpd^W0`sG|@RMoMd%*Z@P|_S)jk?&FnYI+F5>f0f4tfxxr>Y-4_EoSj{Ct^F zcyL&_Q1eG$gTH2kJSu>X4g?|5kAn(!_udPq&1=-19MZ%+1p&`HJQSYL&K7Gcjf+?7 ztEZB(8@gyCS9NwI=icp|soA+Cig%u9tLwb)Bp|uyC|HnaLOPi(wOHgN5O z(6;qd1|ovmRO}gM1P6Xy+ymKWOR4G*l1VHCi9jUMO}3L{2KF@E7^5wh!!rm#9LS?; z?t;jx5JVF7zWaR3*7v>iB+)=JP5a*V0YLc|J7iruD>IY9jp-zk1rkI65HaDZ@E8U3 z*#|8;bs&i4*SYJ<3!Aq{fdmrJkpbY!5CxO@`27-fnek!C!m&~AmaGKSgwbz3?e}wA zy>EHZlm|p74)VE|c$t$?Cv{awmGN9N6=i%n^T~PZN~`Q1cbCV6-fH!%Az~<{P^}GJ zEr!ss0TRIh<`%+R>$lsYn=a}CGI0Py96{_M1T!!YMrJQ=-A2o36A>s8%Yz{{vJi?P zW)!!~7~IB5I6R73oy_a??t^v5-ONNu5Ck*gPBKftwNJaf-rLi;zW1}nB7i{9WF-g= zLP{i%n5xv^ju6Q>Kp+r6{DSluAmELc>y z)5@B@mm%-7=*K|4!Pvh9Q+E!u8AZU{pIc$v?)Iu%^N-HFwGtw#+FGB_Jn(R%<5#3z zHfa`T#^$AZqe0eqUSC?QyIGHMeCD?Pi|+2__uoe(%+1}!xgmYmN9={tNbvZ4t3$tF zW8nJUdj^i)B0Ugb!6^@ghxfkWTrpQ=-ckz)MG1q|NsujJlnH{lL=J#b1Q3Zh3IRFi z#u^eq4QVz**&vNF+7jy1AgH6sSDNSFUZLLfv^!Z^?|bD_9eLGBndp6j=;lb7BfFAV zbqb;_P__BLeE&o>Dn~k)4v#S8-@KoXb|Zlv1zcUrH0~Yz(IBFaB@m2+PJIv%S_g=L zK!mVD5df5NE`1PmZ<>J%z0Cp>l*maH#NPUiqe?niF>s5`O-T!hjYc$H7#d_SX(mu< z5>GX{))Tl>+(M{ODC8AHlrrF=25A*S96;O!Nxt@I-8yg(f++jNx>^QI4)|5*!Uhr{ z!Vd$pz5frt9{Z;Gns@Hq_KW&*K%bOG3X(+#sTBZ8 zTjhsfyfyx;h1YD%=W}RtwPypx)=*b(Q}4wb^|F5|h=`z!QHrcaFxF|^^M7VmkK8jo z-nSVl0C-6W2$3Nb_q;jK@6yK8A=T5Yy0Iu@U1gLsLg3kCSY~s2^RoQetnvr)#ww_& z#D;6Nv%JSLt2LU<2Wq|hpJf`d0r*5jRfq@F58ugjI=WjsYV!hzFtfOstSZozPDFSF z19c?LSlCq>!jv(Eq1Sv)`tk3ID`DuWj75qo5k!aD{?{Gl^D8~7N_W1F4ruRH%BkrX zNHP#o(AzDeZ>IV*%kY{c4TqZy$*A(U(Qv0XZ(GtE1YCE=dP_BybR9IpyoIpqyz{+x ztzka?FRxzaSgMUhGg&Q3P-xM%jRjO#Hm}d0ua56`-)je^-D|&7don_JVjzA-1XU3Q zgceA$K~WM4C~qv6eQq8X)C&tG>t0_*$J49P=7X|4cR@#Xae?1+uD+_~|B1aKq1217-MHqok0oKR;%R|0KH&4-%q z^k(>Cd)&b9;MYU&q(v22sKrJiC@80YcQv^8;|#-B?(n{*j+byG{0OKjtP&HIy}4y> zph>&&RC&q1PGSR()69a3nt}iU_a~6(aycehzo`q}5a!Y0XD>*(eek(5n+b1^aoA zumAv27TNfSD-=Oh0jJeXKA(&3Yr2=N^Pj6{?*LE2qQqDrMs)6BfmcOU=9CR*sC8qg z_H}KCQ0X23;M9DD&G<0DvH&{&5Qwb)5=OYjLQW@%r3w%|;_ng(_PAe8_q87PAjhN} zAdS6FH+Nq7B`U}#cXm8`x@HUjM=OdzL?8l~AsP^30NQ{+utqVKf`B}t<#JJGM1_M2 z5QYI5Pzj<_ND7!?91c*d8DhW-4S>r@kYo%3A&&_FS!@6(7E(l_z|j%4V1QX<1Q-et zWN1c27{RW=fnYe53}|Fg1PvKRS%r|*<$)@C<9c{{Q0^_{K9(oWgL~rv)vU-P33|J_ zvsIB2%fmAgX&AuKsvSm*%*ixq)mxO5h6ybyq?C+s(Wua_M%uPmqasczB^GkxT;vr3 zsF1SBQcIGEq=>n9GNd}{Zo8vdgk5T~M3q+e>*Ici^}Ju#&(GN0K%rW!Y7bOnM%<8Z zRWW;2a)BjSlV;13lV%>Ltsi^wyn%S%bp?OkEyu46A+M*K6u4 zMQO}kU0M%;4pAvm%q6$noXL0ZCts$8vs&d7FC-x*r+{;XZ7Wfr$-Z#FpP zXV-pgKeMpM9QgKjubf{~h3?(iJ9jHG=r66trqmuz-lS=DR}p=sW?9wta5L-; z0urEV=q_`kzpdvf)9uV%j?m7n`t_;xYb$W((8nFlu8+~K^q%|Y_s8>uBW-8P7Yoy*X027J`yJTORVi}=6#PYyvdDvk(1*i;qi&GQX8YaF$vzmy5&-b2 z+RZKa3#e;3@J5Yn-yEy%4oEJqELg=wuBkGpU0#f;DqJWl8|vW{J`@H9^;gxMSM^OnVW_Q=TZ!bek9noAK~+Y4G^vFYbgg}zTfBjQf+4sRZpv5UgsKokt=`=(OGqQIAcl7$ zmSPhG0frU**VfA|$)O@iB$66Hq!9 zRfkoDJ65Qqdk2b^F&o>s?zs$mYbCO4SB``ZfQ*Smpb{jm@HeWr9CB8vsu99TMC(fm zz=01CC+|2q48^f(ch!-fMaFQ10d)egNZcXfrLVeh!=r)McX1k!lRVsApH*nI=t@>pTCpy>XaAXPB2qW z^j+D1P#}|Qux1ff4PS+;4|_M0%#U?fB)(Smwokk7q|D9Sy~9~j9V341baQhvUtiGt zSI_F9!?;2A1)(ul=7XUKzh){Y;J*7Wef!A0{8xQ+7+3+P(ej3=u_F=T%oK?0LOy(>={#7!pgbb=rw1QUu~iYD3`` zc;#pnRBE?b-?nKc(BfURDaxU4s6|2kiUlx<9tq=F#MTt!@E0k15j2CSq;UdbPJ$W< zlxu`BAjO+mb)kz5(^k*Jb%d7|^_b9tVJ349(1{8N$hC?pbSV=gw>yO!Yh-c6aB&tP z4UocMNsB}nup?e7{C9LVG$JCyMzUo0zTJz*zGlN55_5iWPpF(IBep6jdR0m-4=7+p zkSVQXO!FObHEQLW)2Bz!o#C!5{IV*7#ft+-U*b$doKXD0lgE}mp1r4GiWYtEczyy% zK_Cn(+8`>GS94b5d3AI>Lw&HF6oWtVr0XNur8G=D*4QB+Y~`S4AjOc3K=n3x)1viEjX*fuX*)Ql zJl8!HFGFS07LlyqURRiE&iR6MrGyiZ^+pU-ScbWIv-_W4*@t#~b5A?dR%_kyvoC-{ z@+gA{GjRI7lpQ7Ad$t-Oo!jq}m@tQrg_d{brX~kS+*63@4lw?RAd5e>mwRgeyY?1u zJXbrbchb1sVlQL}L3hcw4P6`@UadCi3JG^X3x^8)8v4U!AA9eneZ1N5eo+-7iXrzi zzP`jnqji4Du2mYCfe(dMj3CVkt`!5H!1DXb2qx-L&ta0VrMNZ4S4RMVM!2nEd-CFM zTFJHYBo#<%BWX4?V8#fvP>KSq1MOC|E1$RfD>jm&&wcAR%EU)wVFUDI584c9L zIQNuy3WZe-Fz+=D1{JF}00WYVqn`2i+5)@unV|fTSrG+dczImZp8% zD?Yx?nk%|UPr{-g6|M$Dpvgy!u;M+(-MX;X6l+wn=Q54pUb-!?d2>q*W;~QeG}tvCw1!G9`it*g!nY z37GS&|GLk_C$}OOR1<10Ac*~Db9o~6v&P$tfi^IAi5eVWG zOqgIG2NXzCl9VveoHnv@39VHLVuhwiAen`%EnN*_;jE9n?}9${-WPNOML}%7FGl26 z_t(!h=XagR-d)YxD!QP8BNBn7*eD@U(QOFBsTVF0A2!e6 zH0X5TsiwgSrKwUZECq&?WQB5tG!+CSj8LeEy+p`~xx1i`6IrV>J~q9dnhK?1eOTt`wZ%=fjs}P0#7QT=}e2Tsu-lO5YnS+9>P@Q|>je4d`z54d( zb#crUL_#g>$6}Y*yQ8xP=2hug@!j}#Mkd}2l1$P@5l4^2P`j~TAF8ZT6&vrd42m|GqdBs znGbY^Yuf(^AvM{{U&(PhMp-HySFGtt+BxpPj}Nu@UhbVuD`jTvfNUNIwno4`y^f4t2ky!_Ux8ToTWC!8vE$SI;BmEW$qAtW~c&4C*7M< zA9bSODT0hDXk*&h@%vuy=^FSI$zuKWDjnCihBFuzsa#E;IGf4aq*dB&F!-o~!b$Q# z&39V9fr>AlnXJS48q6iE?WNu3IWMSIkcqxuHvW<;G&GwYt;4PAOZ5%}IYwAW!1iy8hB>{eOL;`bMjKx5A0}Il{V{=NENL zNeKo5MnDjOAVI^JZ~@9v+75<+y)UN;^BSx7>W9MfJEQ7iX^wVXl&V35FipjF@3S52 zx4~Q1m$z#L>w_393tH_j1@C(6G8#BTd+fP+fdy0y&bSK8x*em4NLZoIX9|!u;80+` zp#bZJdjXfB;x1lG#*cddKxVh~zdZv9%kUC}q5{1rrp;{KdV z#-2LwQy_X3+>4_6u1A1eBn(n%sMVTVH;<#nuexP2VGcmT%mlj7(%HFhy@tzcDZ7O$4JwEydRZmA8ls7T9s9Recf0l5cXsfU6d-UW z%npDwzbgEYBRYR490wtEvDiK%;kw^ffAc{oj z&{zUkK~gEL6J2x8^}OA0Ti*Z(bOeMD5<*uN!od4G3YB6C;RFlszW0*vG$W!8%Gn`B z5{e56EDP?RvhK4eEi@X^-3U<0VG1c2B>-^GwAoggMLGzDabY3D01RM>VA)^IEkHPx z)&`Pr4fx~zm)gyG$!yJgzjJVh5!%6_M55APK;|t`myS1zn*(_xiZvUy6>P1N?Zs_& zR*|+hgd`Y#_w&8J@P`L}UupU;fM8H#gd7Ob0T?xl;7%H`l|JS23+lw?bafZQzCxpJW?AaH7qlwVef=?mMI%xqWjV(P zp#e?_P+xcR-P|7{ek1Gy8WNla{blV3vbSf!Hu|4BGzp+oQR@=I}q2Adi-1 zFPV8s?=hkM-OFZAnFL-wb`5YQ!OE3!% z!GYv!_cJ-}oq!p>@~WwIpq{-NyZU!z>n9kT`iV^TNK3v6*~Vg8RW&o>w*ont?&igH z1@F2Jy1Oo{-BE%kd7-gTt_j780dW-G_aR^vpdY47vo=6_7@?fCipMzW#0u+vCtglF7}{8#vs4qRddREDp;E z(V0fQ%^^e%2x9FFE;SO?U0K{PUD8AjwuXNMJS4Aapd4gX}8a9+yM@fmsW@lmhdNkI9 z^Za6~6ct1GuNwC?)AmxCTXTOJm95kFH_mT7d-ODo)? z+p)IGFtzSHkPUSx_f(gsz5b(os)vW3{^@<(Kb8oco>f_Bf?P59Ca<)|7 z>*oRKza)vOPr}G+2_iOo<>WzyReeE%9PL2W>cZImHv9l<_DS?aL0GMKJ}l#>E&0RW zjys*vvomMEi_ZB~^$~`Wl-iblG?0{rNi8+K)qE?vy)Peq+G_TUkR(laH>x|I-tl>(Lzr&A zVVuH~mEsWmD+UNb1no+iD9&r^J@w6oZiCvDeytikTCQ~O-k+lwF$EDnYfm2i&3#uvuOT_o?2ZqLj%Wb(brW6md=mtRV=pF$OXTlV~gw*UjhE z>)*z3)v*0(qm^8@PTM!jup#+}G7<{_3P==%0)l)W(TWP^@qXVtw&=sW4o`vRsFHp~6p@8QpPAq4CRb{7 zLFSL3hD&H1^@Z{0j0@KaY5ovDk)b73;t}9>2*n8kQh2~np$J0^jpHD&vfF`$TfnMd zla@rqjU<=?G|WUS!YZU93ke2egfar*cJgR*@1@4__i#&ho!)T5XK#D5aV~J4h{q9a zz~iGWw~;Bw(`Q91^Z(FUVCKo)YE2S~CZ zO4|xEGRQ3qSZy=GMmmGxm$ZVYRC`1(~okpa?abW zMN+$yv3%_PPj&r1`o426>Vm(Pb$wd;y^F|Ry16SI{U(}NfwT7hbIOT7c?x_^-uJ~$ zm4AIuc4oMzEXiWA@RinYkKNx~M^vFypzpW7ufEKxm-edex!+io@$AM-^ZUJOmq%8E zRrt~wM9oW2d|}&8zSlmINM;KuH&1A&EAObvvu4H%uDZOY?^l;p<>hMdMPLUYBossd zKuAQ9g2ES3`ss3t=IGCRhc%eG^wpCT#sLNf+pew^B z8}4&H-At_B_p_ur0YSl43!3HSq|gumJ^?}rcmVu>-Tkly9JCI*`)?5wlInoaKqJ5a zLi^s|+aq%690mo0WzSzys;Dp_fhaCb3_@TfYi&{+kceQSA|o+ba0Hldy2E#Oj$y#^ zDyf1UlJ8Ac1=`hIT8M}uAc+FRFat1Wk8{g*(P6-MYelxAk8 zVzY}2Mz+5Dz1P*N)@s6}kWh=Cfsd<($ZA*)1VQ0|_UI1pU$jcH%dn&f;0Rp_#xMv1 z1o;*2-#1NOSXjeKf^Mps*nCi6F!SA@(_#V|qCnuH4u6O7Z|{7jLz#Z*A8#5vyDFW&7K7&qz{?6P0qMVzl5@@NW<8vYgrbmIqz4|C+f@dH?7JAL;6G;b_bE?9){ z`9Tr`@eS`zBHBM{l7tXzK8j8KyQLAmEQORaC&*xzuFzG|s>)^IMrV1=+IV5ad34=e zq0=ZMlwp49?%Hovgf}_}RuoOS@98mr1E_=^z>g}>4SNlk?{w7|QLxYKRYXx@ zD+LinjAF#w@tWn;=>E&D^Fv1exx*~!-(NMANogd#aWuwCWt1!xd!nI#s5p~@Rp6H) zspy)kD>Q}mhE-AC{-f16U+s8L(~7EysId{4b?(fE-pF5!zfPRz3EmW$hk%(NR+7yI zj9Y!~qE!zhNKFzu&3`1t#om`hclqKbu@Eze6PE& zfg$=TD37XsdLh_|U*P`6@O!kNU@(FgOSxhk(&+Lo8_4@d>dqR@elUW7pol7p^YQ)7 zxxAXs+8ugdA+Bx8=nxKmU?UL{5I4(A61*aY~5cz zYr6`GN6ILIqAH3h5LH$EhB~_LcDwq-(ZgQ+_?@j@K);AV5&|Rvf%sU6phbYN58(j( ze9Nn{ocqVOCXH@`wmXBD?8kv%K{>*Z&cWqzhJ>^Z%=_(V*VyY}hraRWyY}x#i$5rARHoK7n5wa+S0Z`v=$qj#Wz{%t`R*o<<8k3;S zA@=?HkLmoNs)`~>1eN#@M`0s5ixdy&QN{DM?0Z$4ldDR32_qOpjx1tdZMH4ZNqVrb z^|Hx&U=$2Ks8qB$urPspbl5m3_rqHxAHiWKD{P|RQ5B7=P_HRr7+PXR3BqI|1|T6M z4N!-G<#otW%4<}nfG9jf!66xNfM8cM9A(i}cPOk(uv0^(Sc0xq5t_VZf&o-`1hk5T z7aV3LMlw(^Mj^~1vs?5S>in$vk zqe-D-u`x)Dw8A8)WkO7hytqySk_MB4(T-y(N*g%~f=J7%`+JjPHGAIq;E#l^A!Za1%?wISBxr(@Cdg%JF-(&pq$Q%pl+6OvOrvTjtWmZ#M%dQIH5(cv z$+09N7)g?BsX(PEs6r5k0x1-X0ECihfg4e=tp+i)2}3keYGtU=t)psF281>+%4Euu zVhTnSm^4}gB54|vV0ZJsGW=7E3 z(N?2VZ3#(OEf}$>H3};x17h1vqS+Z*MVe_935v2|g|L<^nrtR$!bMEV5;6%;%2>8Z z1f~ihv?Q8j!J11NSwRw5tl5&vSW|5*nHozpl1Y+msU<0FhDkLg38c}fO{CjNnXHmi zX|ZNmtji>mNm-i3vP&x}X&~CkrdusCnl>!5O=y!=md4GqBNAH}qSj2(k}_npn^=Mi zV;M^pO+^Hl(rqQQQJ|=VEX}b=u?EFuENV7{&_;tuCZc6VO-Uf^{mU!y{rd3T8h>*$ zt=_-XD_qxitjX=OMIfE99!#zod7Td8Mi%AP)mhC0Ge+oVUfXprl&_6w%(EIm9dkTy zrb=7{SRs3@51l$3Ra~l$+t!~qsB7u1rZgsg>Ujr9zaO}wj1I>SzQ1%2e(HfUR3l9A&l3Edgx{I=Q5%ge7>_|5S0`WFLI_?5IsL`uAqn(D#40VJyPkrZE z92SYnL<_N%D7u3orzxun@z}wMo|hB)GVOSs(FWZZ(U<*~0xqLb-)OJo^y)6F@JlZf z-dai4`cBf+{30gyVXHwCLPwlYE6K*!P8-bc6l#+hZXF6XQ)HYKOq;txT(SwI-M^JS z#_?u#HFmAwuJTMiOMa*&&_WlZsPYj|P_%%wI^h@H_avD52|oB;5G0X|M4ubKKo5(< zit_FrQ4x8~tkLt_zb;s3eTw1j?<($?jLr-t=s%`ZWcM ziBLpGP~j)-X$XoP2Dop~@~tWO;zOuu!__nq=rgNb%~tg6&wK}g*3_?qI$k?Pss&82+)f9i`rjf32w*@4M`G;cDhm4TJHDFhbQEW=-8j+A4?QO=1gK*btMnY zM_!O8oFV7*TnT zEpjIpJVC+?hIGJC@#g^8K`9wV5)Jr{QFfrW4pUU5a`*w>-nXrpChiZQLb!`Ptld$}X2;&|V z>LXT>J-!$teTT-pUF0xfI7FpusL4PI`pE8%x&8X0?N!dJ(9>&}OlQpf{4IJ=;z=nS zp`AfQ{0aZYqvKr-Z@tZz;f~K44E@=8&%TO{87T1OBrg>Dly#@nFFT562HFr*3>_NZ z`Zl$R^(}6#$q>0_pM7?+-XK3spY)43>FLQE?>49Pb=7e6SQNkdy7}^#T-w{A{8a*` zUhSR+Y2?Q&x?5!$Uj+htVHB=3OM%D7jMY{F@G>hlk-#M8f~F%##E0F_e4h0Fd``|J z^=s1v3O;gQ>9H!^EQBtcV*HH6jw%qYWqIB|RcUg#Lcp@p9Z{gz%ima%CXi1Lx~-gUAf;dv0KT^M3?hKo957+j0c#k zLyGR7LOO-$)n)XNOT0H8s-Ls;x8(JCwUnT^J58bv(Pj@Cp5 z`gsu!p6uaZw=64~P?XPgaIB`)Jy$p`IqTVASr&APw#97ln=IQkWSsTfIQBy&k_rFZ0v?Ve(2NA&3=xu}8{6nUU&HwJc{YQ$Ib3hbb{UzJonsZyokv_jQjuM)8Bh{2sS` zZ-5?Ij$^+Httf{T>+tvUa~?nK!WdT-(WwEG@t1kxvR+~2QHpH3dNMUq;rp*mIYEaC z1h_szvGSDIrZ3;unn`WFuXsf0E;!7WtvaDz4!9a0eNG}AD@LKc%w%e3;k=@de*?ir ztarBs4wTdtdCrKBB*qy$Ue(1J0$5-}c zz{1pL*upJTYsN`%M7E2B5#e+D+5=0EsyDafdRZStAuuA{+H8Kn-+>}qov(OP;KZF`*`p{YH{xkP+L>v- zvD=&D_U)Y@mz-any3dB(_sQMhlI`j}QG~^+<{Q|YFHL^L$V?P;Ct>6CmYSB9*Q}pf zvi0qP*Mnu=kQ$MgXZFiSn;a#JDukzm5XWnD_wp8`uUGj&?J%E#eW4H#*gjq7qpiv0#{c2dc1-#WBb*6Bfj1i$;cPFkCG`swwSNHSP?P*si0MPahMWzQI>R^c-G# z6hGmNn6&5|$|nR%2N(nm>B(8Lf51xG`I6+5t-4QFRJp}ZKl;rj@RD_kga94>ZE2z( zhv8Yzn2I>@%U>eqj)?oaFDjOUL7`lyzu%iH_;8PG``+H{I&SGX#txU<8p}KpIitNT ztUgrH%n{kHvFJ8gHCE1&(uuPUY(!kro7%8wgT!Vf&Qht?bS35aldQ}69bY|jb$2uo z>nvIE@Ym&z%`ddRxiT)i>C2xL00o>RJ@~CC3}5B%agI903hNuwl*;fCYVPbl;17^G zmwk=VSIK;A2|LoHedx|KP%I#oWKCp>wlg^=b~jrpdeaI&mTT#SWwp##Xj`lpC<^gA z#DYtuXbAVwO1o8@uIxl)@Z7)X9;v!HBvHUi8W4ANfFg@P1xDqYBfSGObUt0K;tw)X z44jN#Ek82IopcQ=$WXs~nLq>P&=`PNoQHHnlqxo0C0t`Wxy+}pUx*ETL)RUp`G~Xa za#b0vuCVh~teS@jUXRkPvoNHX4hz)f#Ny%`C@r{TY%xRZj=E{ax|UsOZ|KP;WF+OK6@G4j-T|O zqw*&ZjeGzgN+s=b;F&9Y6VN**EqP|@`Wb#yBlt{4cjTLL979M*pG5r9cx(!u@3fo> zMq@a$(lWDH)Tr@-B!~Z;nI(FJR*l6#fCzPL{XFhoa0}NPr**Eufl7zFS&<|!Y%#It zMxx|?pi6OW(@0V8@o}HzyAfZZ=6U*A2Zv{iWp(KZhP)*)?(yXYm_BZI*&6hx6n@Zi z-K%!-+6!9h`B5&QXJ2`Mb^ZAob&mp3fAMUD_~%*ICb<%?a$#zj_ZHje1B&IuneOY@ zsGp}H!R?KV(O?4)+bp8$j>R><|)$;E2;uJzHg z3w{r`Oe&+xm(jSB{Vj2IFcWib<4=?P5KF%1-kzBd+-KD85MsIIO;%q&Wh;3t{ z0>#BIaKr3OP%Lnfu7`~0$QZSilideLj?U&n>t4nS~Z9KQx@^ku* znPXE>BBpL6_$@>F?9)^tmEBTxL8}V-n zB{%0E&VME(=wW}d=wZkRiT-b6{*E2~s6ffVv?d|>$3$fQ{}Ir`{%zFXLVp{I9)`jQ z0ARcTh5-Nor1k%!@VAn`RWc&wQ5ezxK6xbh$0!gZk_8MyVFVzt)d0xw&-wp5A^FE{ z0D#(w#JMt$#$mk!4E-baM-YSKpJMc|KaBqf|A71l=f5LS82>wo|GS(-0{~3@zu8F6 zqJrkX`HPxDfK(u`;vXrzL1dXMAQdq64+97AhxI=UsIsWC0AytV096($3j_es_yJH^ z0J6QO0#lJODw04ZP1-PXy%K!iMahi!U3SlA`SRc0SEA>2x%Zv7-{DprGFA62k=M5 z9|+`?M_#*OdE~|XPn(dY{AWO((tl?Ee>5r*1qa!pK)?QVkc#X`P9p$yzXoQHF7MyI zKV32V)kiS6@KQ#d_4n}mwL)H~cL4Y9P~s(F7fVr>>8X4rj}ui63Y}N5-G>l~43#Az zFy$AG+Nw~<;hOhG`V^B2F7yQqmM*k2TPoOL67gCVA?#tzz#Ko?S#Gl^T=uqipZCyQ z`c1vEsvz69FX4xe=id&W4BeWX4fJsD4*}SQ%aEURswkSwf zdCBVuhVDQaYT7f%rFQXUq{9ZO=~ybSOv(SM&6ct>|uGW`cB4JH4mw zp^4zY$f!xe;9Yy#N*MB!Z7T!`@0fno{4;$b7!JDKM#-QTK$)2DV3)q2fABu z%Y%s?<2)7O9a)0-4u#c=GfRbLg%Cti52K!q5|b+R*XgG!Sxtum<{r=GI@wW+JCwY} zLZi|vu{_Wxi8PfqH7#s<&2sUg4`5s+ak=;v>Un(NvPD)5lQT!{3l_@{bQ+3s@~J#% z@>n`Tg|fWIi8xE)L##~Xq%nwynYkBE&j{iTP$djQdBRi6@m7IZibpy^22{6iFC8+yDKMA&~kqn6OW>tolbLeP!u{&!6-n$i5AX?P$xvtRkk2yEJ{qKjQ@qiE=v6IXVDkS;x~GA$&3f(TyHB$;)87|IzKHBu*(=PXkz-xWC%X#;)n=)R?ljmL|}4bRmx zIf^T#3NLP1ma4~R~#{$WphZ)r&C z`IPw%-w^|Mq53vXL&E){IyjVON$Y2eG}Zo3vmeh!&7^6b3^&@-U~uh$C7|WA`jJxF zgVFB;dzW>A^@Sy_fd|GOHlRSojoPwUSF>z?B`TiA_NlR&YpF8qXalt zwPeMm0xN}P!9tKW^Dy_of`RDv`PHm|`lY#2vb-|tofEtA1nYu zQN<4wE#vsUxjo?ifgVMlC}u2DiCikZ(4}Est*fOglG>ko=NyUF4?XL zq!|Y%i?8Ii4pds=AEfcIt+M9G?ib5ZcM)F)HUAn}8)30f!XJ~E%g}{7oK*+W6ORMHC~eEo{_AR6t$cU;BTp{I&3LBM!AGpA^OD=f_#AuYYN$0SwCe z{t}WUv&KekIx&CiAsfcIfFytQp`#f6RgI0>fSkKM4m08oAk)`(L>QJ0$lt$$k;vn5 zsP#x8OJ+dbzkWpk>c)s#(9CP_4xafELp(Q z^kL8MY7F2l*gk8engKji=h=g2BZh^+E2p?V{YCwWhXx@E zo_o_EBPR#iU*CxVF#w8dggt)=13f9T4hLcIi6m@peqXvB;o~j<4^Q*%xTODHqe==O zNg&}=ERltB$TO0WaRAcvQ&9ncs=4oer7@V{YCsguQvGJI8Y@t*B@=VQX^}-=2te#) zn1F%Jhyy^8)zQJ_z-W+fFX7?Rk7vcuWmdxB>)QdKeL@NNdxRUVHMIdLhU+phgGj1D zav)t@QXE}C8fkfjT2nG2gA_$N^pdvsGNkrLN?03VXoF1TbC^Y8^Xn>2i7L0sjh-h6 z#Q$H<2-~CmY)~$M4{sD$bV4iQ*h}1&=YWLR`_OAGFjMf8op{W?Jo|2 zEhGQMMB6I7sV>$J?jqZkmc?nNzY;sq10)ZO!IMQgAi*iT6pa=={_Fl7v!*cW<0HUi zYi9_`e3`V2SnwhYz>4@9n&)dY4^QIrFb70o;|4uNS2xCrZhhAQD6}dEJ&B+xHk2Es zpg@XTE7z$@VqGnA{psLd#3~*>x&)&fDR1I|h-I}#+ACao?cVKB$<7eAutNNHlJpf3 z>tfXtxNT^sbH5tfHV%NLKI2Fz2-kiG48(c{YdkmeYwYzLPwpKgz0)3$(IF#=D4;>- z;{+p@BZGrmYlGmP8K>`qXTtz0@GfZf2jwDu_?z#j2)|zr=c~Z2)FlHvF=L zkFbTp<=$u|c>_vL&(j9^GXcTBT}n{nNKFVUt$anQ}WBsTo~jje8*{+BhF z%~}WZ3TKH75ytEyorFOo>rKQ29y-c|p z%|zHt8K%6_0xq*z<7sax9$^7HEw^yd#|DICBqW2zi0cgMQstVuypEmvPU(ghEs@b=x)N4YPqyW4yXn^f<$ z`}wUtl!pjeGDd)a5$ZpJ0d>KfIov;)MZWtx4dq~|sJ?L%2kp1> zDC^rZa|*w9@tF*W-)@pQIF2qUp`jAQE?2vKPu<9FMJmP4_0i=>VI<_uOmd+!&FdN9 zxAcR(PjeSVhfiPMOm)faJdh0?vc4gGo{7*vV~E>Pdb+p)ZT@%~%dGZ!R)}r4`I5D&&Sw9qQNY8pgKjCa9+wV^pEh|1rS<6d4rKkH zO&xGOw5I-9JyFW#u7(Ppc=tmkqeK1m;mCUjw}*9lZAX?5ZX2^Uty|hJ`_GbFxq72( z`mAq@DvkJZBhNgt6ax>X$Y;2ga_!3}i|Y9U89i;qqnzgZClP~!D;}>rdJkpHPO`^2 zLnPECcFUY zs=XksP5s5<~dBw(!rBF8q(|HXF65OB0n>NU&uAybqKLs=OfV ztF(1b2hU+FcApwaFSPx)OUm4 z2Yh&KVOQ&zEp9L|MViBUwAyf*rz9fqrc6k;<)zbnnMP%Tx=5x=LakNM+D4-CIuJ2I z4EM{GsI!~$N-j`<_Cml%;y8vT>Rv?1HPWJAXXUmMg4P6Qf?)KEoxWYYWfkyM5%e^w zm#GZg5<5iX3Y5mGzsT9zUhC@&buyI%4e?{IV>@kSI1g%xPkGK^&rzTOxvQy&M^kg; ztWn_W8IIm7gaZ8>XA5G50pUdjgDPSI>!h`RHz0+&)m{C0PCof!8hpueUg_qE^s1pDygMGDIjTG#W^!Z`%|serW#? zd{72%kys5pfUQczX42`u{9IAGmU{>;#L1nZNhtMReaW*>;%jH~a%Ea5f@g_VMaV5q zbs3`SKRrJW=ZL3@=05ZgqNn!ka=Okku!OBI%W*OJL!(NKmK>*(c1i|~^{`CXK<_?g5+Fwx znCeZ_n=2P{9s@j9FvJ%2sSBUU1q6Tsrt2L+X0Ug+-8>6*6b=x~Sv9}xw_vK7K7Kr}xj(W9Ig51XKRhm3y2_A0rZ&MPb zw+A@6e`(7Hdp+NP@d8ASR3QMw2b0Dfns+$#h@C?d5|%jBXg+ zAS`bMgQ|kc-#BXEC}y=ye#F>!TXZD9gLtS@giK&NEmPx6)dgtWc5K zu<5-isM18f-fMIM<2hig6F@ok4*&HI5SI5D#?!tEZe68;Wm4Yfv9$UDQCDiEMkb%Y zZOXTG8&93753v!94CIw{q-^5@D$DMRotM&4%eCTEUN!W&tQ5XQEs~|Rt)d-bHXt^O zOC#@of?E(fZxPt#B+K(?1Hs)x1%oy5X)SYT)`&uaqo5!5#QC>*v$>u(k^!@I?2@WCL3UNL-b`0&!Y=`9e`&4$Q zR<_b4CL5R@>5}wz=j7Lgu1cuxR&<$g`O!A$RvN%_Iqgz7_orsQ(ju=@($J{syN({@ zvi(yLM-uSq@r-+}=~Jy?`35i}-u2~@8uQ|2qR=0Kd+=ADgo9Qc^juG5C_bo z65;5fJi$f|N)XwHf?juu+9im<9DCbuo!MaCARrRm9c&TrdthaM?*}JwZH?S(=&;wo zxL}4yoK`%0#zA>PG|Q8rV_NBdUV{N|JkgwAfzGp`1&a8@mlArfcX``b$d`paxSj7q zTuP?$SAyL0QwSa;x;ZyZ#=I7>)J$IJPx|FNd#;(C60~xJHokEtlIeqZ3DG#8Xy>@Z z&F>q_u4B=$X#Zuek++91$RAv%i0`qzaYqo13z$hGYI8UJQP4#Rd}NS|cLhFg%lv_g~` zSW({{GtxSX4&1y>L&vI|aQ#E8qkrq7Y1MV@Lr{~O!qFvWjw;(Pnld7c(#CmQ(Q6o*fU|;y#?Gy1>st5THL6Vb z1xmG?roZ%?R#OQgdGxFu3@EO3P)>p}<+H1OtceuhqsU#jR2RP^yyfm5r?=^llK zUiR*pg3l)6HfldK-Xrek($Xht%v-whHp;aIF0&VnCbRicCbM}B3=Fi4(+vV$9=(@u z4kis7jQm`dYpY8W7|Y_TOTAfX;*}?W+3vUQ;LoC-oF!SDb!WK-c@T#W2b=CJ3zhRD zC>hI*g)pbanL z^T%>OUj??X<%5fAg}|nIY$wYP?#uSL`JIp!@~l;M)T0n4KQlq$8=iv|^=XhrUfK(8 zjg?8FO2f=OJkV_2Y{cVNkE+l^-pdLzF%pNSt9DF+X(-UmJH3@>$4 z-h239MfI^Sw=XMZNV25SgDl|m%b&GB$WwEa%?#n_2;lGpDsk6VS7quN7+7FAa$!{n zzs#E9J@p~0w10lDn_C8KjaV34oK%y5Tk-XCvj2DO}eZ{@&sGst9pEK^&S&LP+g9X_IdS+^6B^MnU&4zvnyjzu`%omXNMB9rqR_I^elS ztk&5;mF~Q_boJJDT0qP>`nnTDz)@>G)Cea9+@uISpOal7X==G2m?IzLfJ~gV z)I?z5j;D@=0;*O8fi|d`#+URS#Ki##FrAz&Z9m;&E~nfsokWj+ zy}R=R6;m<{F*&tmdG8;K`b$T9cyNW?ud&R)&2KoN>3i0a9D>Jo)idyIM$PH>a7-8 z&}Ao4>3QmvpzK6kEcf<`tTX<3;(YW=WYnz}Lf}3>S}6$7UCww5ZPNTGde_y?auCb& zLIpsm8i-Z@pQjUwB(oUO?nNC}@|NIk?xXMC6&m(h*tbJJI~pF2&q9Q!yYW@EG*)^| z61E=1zSYWpN>FXz7;`=GsR{$JQX~6?Kjx~!z+LgcM)*3j-PhHIuD^#wEd=5a$%cVDnGhaU zUh&L!;7)33_*C02@&<^EN`og@l{XgLZh2T~z<*F$xIwHe;8Giq%Aesh^#S6WHUUga zFV87+7WrEVQjf*GFoa`U6zT613S#KLOuW%fbRI2sQNF4V7Y9Pc9L>Pd?T+q9N5sjX zGpCQ>`=?(2aUiTGxVMKi#T9Xi-=yF#xcI#$Y`AQv-s z?W#F#`DuNVn=rde0p@-29GEWlz-D3b012+m{z&rLO!AMVV^?MjX%fMT?3G z9K)hazUNuNoGeOZqqX)^(`<<$Gei0^5X8I_bb zF6&#U2+9~Wb>*AS+2RMwMW&EQGPwoWxd>o^T2!p5_t9`b&`@bG_HEg2+3vTioYe0; z*nH}!Z?X$xG2j7ucyWjVn8(R&zS^9 zfJvRevKUh`ej56D;5h1BaQDDQIw-nyuZXK)XSdP9K@91*$PCqn=5L5Ri~j zpp7w0Xi;X(a6wU|_=`P2O&+~0vdm?LI7(Jt1aS?F`s(I0zD%|Y@6^1+PbS|>V;d$a zT0tQ0`;|}RRB;rc`f^aH61kjox2HMX&fsj0Nt(&|q2w{o=F~j814>wm8bQcA6vnon z{4?{MgBXlqC>y?X?}k`Veu1|%15Y`^UA{tue(O)Y?=G7CT)`U zTtsMk&A0%=JBC;a`B(u{8BF!$R*FwFT;jpmNw))3`D3Wdg-0Rkv63I8@(kZZ1)mNm zNIj>1*}ut8Z#hnN*}WlIbK68+6yUpE_l#}nNB0zKR<~WS@`MfyCyS-WvEVF7=BRbb zs~$0?XC!@hkUljqW@apUS#sX*&^sROUnmbKor=OBnwpW^yfq(7E zS*M$SZOGT7cR{Xn?Tf2~r1F3mq83@tK}9?!Ou%R|DlV3zibAVb=*{AL|7pk8cf|RH zY-!myhSB)2pbd42dE7+02kY+>WYhy&XZoa6J&S}v60c+fgppeYp9xb~Z<==r8)f_+ zu~npISEjW2y&XlQwnlm6d}moe=$$mIJCe%)oCxr{@LP!teC=v4N#;Kni4Z+by~gWfqB;B0m9q=)U|vj>-#j26 zSu^{*KH7X&Z{hv$a-c@V!3b?rp>;?a{&>Wg9|QIOuG#0de6Xz0{o+DR*c+RdmEZKZy#-6`XcY4;r1=tybPu^JNK2+cLMD4p6H#}m@`vwQ@>SGYwMDx=cv8po zU*xCE@WLC}lBsy5y>0f?W zAkq;1d~aLUY2hoNIcCgnq{BE=saLhSdGlbxxWS~p3{N4Kzpzj~yk%hEUfHfH%v$a3 zC9hQV8C4SgcKc(S)8gAl```|otklaY&Bg1ge#E0z+B$<<2WKbS@dnB9wuhQQq!Kua zn6qu4eA(AIQN;kR_ZqCTqK&WL?)v2@Ly)WUG@9sm);quIFc$i`+^q?oBDUsQzT8@mWY0xZtbz=@@t{B{!M# zU^VZ;g*nAw>%hVxK1x*0wwF7(?#tPi6iLa3J%U}4sSelfo4VQ5`k8V!n<|MSKkE~> z&4IY0a$-erEv!qj-LO&f()ciIS Ms=liTW+LtcX;Q{il==;vm;E%nkKgZ({reR z-*IFFYtTCMsNxlGzv!iV@*D06`Nrm3Qa1HWzJsZ$NhAEZ;BF_dr+S;rW#R1u`{}Uk z+;>8+ZVT9@#|p&sd_0l21l9vFN4WUW2GD!XjOaEweKcEmAJX&cwbDnfgY|KK{q4H% zS#vsZ5oU>OfH5q^i|bmp8e)}dwc?(h*;NybE z0`$z06B`-C{I<^eUEFVqrT(34$y;ot8_K@aSFchOs^2qkqT(kp=t&o-K1HGphF=-- zm~9b(zoZMin3sO7scwTnJ$+(BT<8~$$eK%VG@s-)O-^Cvq4(^h)?Xr$@38i>@q4^tYpz%U&)M!kUPvg%WsCdXG(Nr&`Y`_P zE@q@^?s%|}+`#SQHc5}eZYbqb{;u`C&QGzB{)qvjuXkrCPhsY%ToA!yLTPM`H+>du zRJ0TjdsM-_Cw~uE! zjVT0qZ{g>i16LMR`tw<5m6~uVT@O~ctR-TLEU@tw7out~?j+C)jrF$YU2MmdG<;^h zN`Flj9P|?mOXFFK@|}UyFa5TB%GP>2>)B))-v~Q0V$!PfU~rNO6+cz_$b{v4(FiMO z3IZA8V!qJJvRHYM6RY-kaH+bDU5sG7E(^Zv&-cE!*p{8I?qJJw*I`v3Xk~`^D<3+n z`0~@3H;z(OL{_=Vta26E7E9mkJT6wsEzun80oRQ4HmSz5%zH}w1*C9W*}$T{ElJN! zCTE5UB!zxiERubIFz{4FSTC&?vxQ6UIBumy-hAOA<@p9%FKMZ>oz<$dF;hy)fA6_M zYxB5{sU}`<$xmwF|By#6*xi!6>bK%j(b+^|e;qP}aNeG}c2nqHv0e1uveNVaeDm#y z1ttm97rPI1wCs7>e9sAEU;N-`w5<4ZPBKR*xJznk%LY|Qe0P@)d~f|Z3CfnC&jcu) z@53VO9R3j{t|yOOXw}ft+A|^S^~S}%jXlFVHCSQj`it~!obAJxg4`UQ8&ukBK!fAX zR{ErbilL%U%+F-VXh3j7r_Cd_sKc-KZocndw{0GOoun^?94h)DSk9i;0i`}jRJ}bD zK5}g744$}1hXM_hjH#rPAxrk@7c$p+KDo5^8aT^Y&@Zgx?_MJu#rr0jSGVz~mfq4~ zGUGCj8Ov87iW~3C-nCLAHWB2QBqf~ zfRt3K94CNP&?3>@c4y@Gs@KOqx1Rc)hQ_k{()Eb=9RPa!6?W-8TN(K2IoQnrtgeV) z6t;;-xxq;P=%na#+EmEt$2p<{r9GFrrx<=xe`!C^)Qdn`FHZ;BH~>ol$Im z*6%MKCNKKw4R>;Gq>TD#jfpsYE6CTC?||@MpxTP}IXdE$v81 z;MG3A0}B2P0>{gYJD)sNP!M1Qi5Ph5T_Jg}2|YwQGL_uu0?sR+37RZXZ7y5%_SUpP z5p`b{I8s^xL%77j?=#@Gw)6GYT*gt&9mrj8Ut_p%DZjG;U`p%HSX8(?bAi+O!p3vB zFUYU8RoIu<#Qovabg)M0`QC0pL-;d|mUf6x3K|UFq}1CJJL@bc_D;T1`h==oiu!94M?Mj;rjT`7l?%+)PLz zewC*Jnsjq%v`wW(WZIJ(;`X4hxCJx#hKk26S}e4Q^Hvp85mxP$gmW?Gd zuHVj;uOnbs8P_lTlkSvd3+s#{2nzf6-aau*8-fj%czuE)Nry_JF*I?asnRyh-Y9qB z8KjLk{Jow+-D+}Vh<4a*PARX`xjA0`b-nkFlCi)?1xNE7cj>j08gQHC7|e( zecZhFn3BA7EBV>OY;Z6FvgEV4MiLNw;T7XyqWKa|Qc}~@A_5B^p-rknB`(e&l0(BG zy>5%d$vlq24V0+%pCC?+8P>(#Bw=F7XLKoZq$;;+Pd>1`;z##043foka4&X`#v?)J z$37A$*lU>)O&C^Q@d%s|pHfWW700Q`|9VGVZP)TuXa0N&Ysbn~FvM0aj4z+`Wfa%R&M)2aECC5&2jnwm`uhQ_1=FaF{47@>1qd&dq!hG7c_i<3t-)jHj|A0g2q>>tbECDq%1k;lD;VdFS-x;=`<%PkOteq zULPRL>+u3T3SAE4dT8gVk$!3+6<{t9UF}d17LNQFh0b_r(Egg>VNR^REm%jYtC1Ev zRn6v&Gc_gP8HZh3sEOGoJ`|@u$F;=$Tn+l$9N%sp8gN2i^!A6bD?LU9W(yvXA|}dJ zM3Y?U8ybIbgj106S2RIP{F<8AFE>V(L2t9)awHcnT=e=ThbRCK0is3;kq4|U39bBi zC{WJ(!f84&|FivBf^drniB=Eg)%h}Y4)esbbIeZ-e)C?G0D@1|b#;OexgHNIp0b9l zbGiB${|7bkh|IkSrXy;QysKY`25p9M;hlCym9?SsA%nemSdx#Qj@ywwmo}$4#{GHu za76CfcvwPbpk!~a8?@-gqj!N_iatbz(3TJ-0_Pq7?`nc6eBbC19lX|~@> zi~CKzN=w_r7t+O{q+J@ezh&JxCp<<|>P+3M9M>CgGTsU4R5~gMlJ(G)ca~G47H0n5 z)!_Y_KF&|271A;l2p!oHvcd});RGja9^7B_bT25TJ#!k(K*X4l>X<^57;aXSp~G>b+Sj@vwjn6Ez~?kQrO{&-G# z-~go#aleqoY=l2>e<_XO$vj+t*S0`8MJeehYj^;zCX0WEhSr`R;(g)YpCdbkW_lo$ z@HM$vmJ;P+gFA$scVUS7$itw&sbY!BXxj4d{L(}q_vDXisHmi;B*Zs!5#xQ=05()J4es*I+TU%w*wBD(iff8e=0J-e0@Cld;h2-Sh=&D`@~%DJo( z`_1A(YX_S(T^1-0&%Ja`zd?}iIh9#%XQpHtmtMPUvQ^H>`8L* zLo`uE?MviIl&eLwEH=SdFzF+ee*16N2oIi)h?Wf30D~Rq#1&!I_S$XRLy9ffK0_h&5nNyi!hNgERn|d_9Rl5Ty%@?kQlEq{~mnnoT z(yL|42fpxu2P;Cqw`aZ6^IeYppJw(0s7Q&(Cy9vSz4mEGP)G^5HI=n4J*^`ztysR+ zP2!y$NJTvKNfC(B%k5m?=*7-UqfK6koP{i*iEu`4e z`Z0K{H|Rm(il3fSq8~m5_#;|w7xN_1SOlU}zdAQA;~V|OJ&1{iwl&MZbQ#7k!2CuJ z*Np_{#Y;l|(i){7Z~3;!JHt~fTpK^4eh**F?mww?nx$VY1(a*ZdW%^Hg+s-TO;|{~ zczBGI=;d#U5HJP7u$QgDDq8tF5_jj_GbExDe zmC&cDl}`#8u(zvySAG^VyTR|(WnVSLhHVpg;k6)E9-LZ86nD+notf4-zEg3s$G^2Vd<=ayreD47|9SlH;*OQq$l3cd+k0vk+_#cgpDY_*prb*;=vK9-`PeMH zH+!VeswDSg(Z?ePeV@sq?TPaE=9^$zEQ=~$*v?MAvOv*XHO%L*SCpq5e# z4~Q~GY|&Nn`ZD%&K&8CHFRG8m!Z!nl!8A!vZymTlOs>3XDWv}NBV0W09e|nHsINF? zU43HPXXl}8V2xeAv1U>tC>RR=sBFZueO zMrQu2#p3D0z}2hZ{*QsUBGd*^!_nPcLJ*r2@o}grUu`q>)GTtJ@|?YH)BS8Ynil?g zJv--|z2QPMfXv0|nl4t_slmPG#`kKU^4*7R5BZoahl^Fh7;ChV#&2|=DrsA_z^30( zBH7wpoLk5I>K<}y3AW6*nSF5)UEy|UIgAh8j2FwJ%(aMBjGp6X2yK6^$=&hzQ3fMVa5BgX;YbO}i~! z{Os5&_7HEsoSX8xdLLl!7Yz_^t3hPg_Ygq(`=nNf8w3+7}1kSfMd)C3$d0N&8; zw*}s9{1k{}6+TrM3S3FE6+o39?Eivd+Ud#1J0KXg&^Z3{*YWd0$3XQj+pd)S7=foG zAfl;R@S-`B2dsx{P5HC12|cG-ERffmrn@i5uBp5r*7rbE$Rk8Nem97?zT*+APKk#{(6>1{=fJ->!>z@_TSUu6u06U+#O1x1%d=C1b3%}5*&il;!-FC_u>$& zSdgH_-QB%~lC)3?McSM9y}x_z{p-%zlarIl?#}F&&vQ^@v0QRu4w@JkiN0#)Mv?42!p#Q=2-ln`;p_&E9=x^Ra;isJGgcTV-T;#C{HujJ ztQy8puKu*!d1V%2h@VLoZqKxwV|(&^GqF6~*sy zp72#zzvu~t*08?00I#4{T19BSX|Uo?w*yjGe2&Ch_SN!Q>$ddI{9Qk~e-dCl^Xl!r+@>DD7b%2yGx=-&?_DHxVATeORsIpW9C$SQNv&Oz& z_M*G=W;`DSguBd3))FSo2;yYW%ishJ7K_t?Y{xi(`5+jzvl@LW51kz@Cs20nBe`J3 zCPg!4N(TjTwz;O-K@5lqM~xlQgt0=xfvKfvBdB%QEI?cU$d~>263aO5H6dPYuCiQi zRX|D(rC@~vTUCxr8;2$(Af6A9T2=g^DIKUnCC+W=*@gq*$fHohWI#E7f0L(5) z&4fx(+D=~_N!kE_Yzr>f0TKCnD#F1Pupa@UcL8GNtFVd1aLAQ#h+nD@iw=qeFKXG%L zLZk>kq#q_zacB~3*n`+TM*yk7To5K@4gx^R^7(;>DPt6#a-3eU1pVPLr*?ZW9LH#E zI-#=t57~fZ>T!+CP4AZ&i7+>}86OXhDy%p@hB2v+jsyA>3E`p;qN4ghtqDPlxyuo~X)*`Ph~@xDqVm1kHvtiB8hnJ_ z^i!`zBzyvG_#4kEKeBWM{5-()C=w5kO$mpbGnSP6WdxI~UNJW2O3;bg_A5lM#1={kNz8p(OIzB8Y?6 zs4}SeX@fiJA)~I!-p;M-lg8H_BjsQ`09dttS>8s-2w8Qdv#=FPX?~bimNF*Ru>r_m zGFjqEAzsVv2Chj6_5B3QqbR22Iq``SG337n$sP=ydsQ+$|GFXz@24w8NHwCc? zg!xEFJL^mipK6rwVp6#vlu@l#DJGAeiWoET)1>0s2nI}YAx=vjTM0etop-GCVXE`~ z6Nj1k)A{xA8VBc$VV8hG3%N>yS-&5dY*7JlQHZkNy%C$^G z`(UcL^hOd32Ke!Wfn1nY)_svYzAZ?E)wxQ65lk}q$|qhOfI@9kVw!3QspFmzpVvoh zU^32ml!Gv^^g1^n9n&-zhztq^F~LCe&oH258m9WcUE|tuF!4^h44MNI0#e%y|EG`t zt@__z`2W5-I}1RY&Q%41oi035CtEx83$|dSDAYHJ#~>&lBc$gXnJDHJee7!-FDA!< zLTR=B7hU7j{ZDiLyJ482|7i#S{(srE_7(Sict=iGEo!dkJJ@Fs(dzb5z6`_%fJwtZ zw6L!rx5DFj%mGjfJf5#5{sSAmOpn*A9fYNhV~z{9gy}47ejbyr2LWP0FwEV=U=3>+ z3?c`^Lts$cR1g>hNG8ObUqS+))$SHW&qyx4Vb@0bVK5T|>f>6pS|q4)z>dcN2N)J2 ztqj9XxWRN`+Atupk%K&Sn=fFTrIf4J}2=|F+<5oOPHIXubj06By2K#@& zC(P20`W&E)4P<5f5@CWGNQ{e@ANgU4CTqrY2wsvA83}eNv@@L;9AmL2H_$&#p z$|<fkD0dxU+R5AJs&V1Ts??5Fk=4f5hkqEzuuKo%qLhpo9rxm5*?ASE>IiMcBj zBU7wvTVAi-M+>|Bm_NMuIh8A|U`|#EHR>Kt9Qf#%w;a%GM!rIKzU?6qJmUgT@KG36 zoI!@|{|-=#fNqQ5e#cKQ_!6jel=IH^<#sPLdc}l{O(EtZ{D+<=yEoSBR{|F*8XO&F zyVm~9oH6IC&nWX8>ooSU^~{?kg+Onx>yy-{PM^;}!GE@hCO}IMKbX65tug$1|2q`! z`_r*ck07}3r@z_K88IGj+HEs`#RM|;$0c))ll1*T+q#?i1ACONgwM8jRgTTB{n_LPbL{28ebZF4Z&|FFzr>K! zzx$)iqu2L%cD2|ohs_kvhZf*rgePcv6C%sfY{~g-c8lZJ<+;x@daxS>#ZoB?**jLv z*nZh4C6Ip{j`t!_WmyC>Xs~cWsFFHu1|~(NaAci$FNgw^u+XBIeOmq zQRuQO_o;-3s#a0xVko-U;pBIdl@?))xZelt#K;C8WG>ZOq^NCV>#6?lPoKZFVB{l0 zWb2`-S`v!%qh2u#tTUp-k3F|=<&g)IZ+-x8Hal1UJlXhpmx<$3*nM8MGee%<5I8OC zO&D?e^E@aa$ox>RoSN~36)k+Z&Gg}T0ne+A=&}&jo++i66I!2_URrerkl@3*$ z=7`T*aNb{X!^9Y<7%O?ivk;Kvv$Hq+hyN zgEGzq!Hm%6tn{{B+uAzsW(-A^T74BUBDS%sT$PiQG+*dfjx<%slnRDB!Lx5?wK*XwLO#KoK!#|877CW#P+0SXk`M_@4Z& zbaU%ifiHcA30EO~i|%m1?|kZULwXBiv7wa~Yj-eRyTy|?uSuO2<;W+<4di3u21G{- zkNY_chriCmZ&C~VtiTl@LXc5ECqGnJSM;%23VURr0B2H@O>3TuRkJs z-}W#^C#>Nt3$;`e^X|Ejo^{ud@MLxOOD7WUI0vssvTQazWcpqjZ#h+!*1^$E6U|gLV9Fk6kPi zIdC-)=b69$^)^3g4`(Pof+(TkxLUcS&VEY1%Gj|fK`3b^Elj1zV>?p4$G=z=7=m>} zN;)JQU_r*(2Og}Sr^^UYBwpH1o%_BjZ56{~IfPA=f%LK9Q)W5;)D zDL-*p-kYx}<4@h5ai?=`)CbftZhRq&L(Jj7eKzy9gvu83Myq25w`T7Lt3hno@>Y8L zambND!*+`Nk4dbkNQSR=7C8|gBcjYgf(X%NEIST(>|Y;cJJF>#dQ~c zlMrQ$c}q$@-;65g`L*eDE;BNtiBK*m-QYeEbid2u8C0AUOC)P~_|k7<{UVQ!zUlXR z^VNJ%kmH`o)g#b_eCOPK{26kwm@W7?N~#1!Fg6XbA11) z+VfY4we_?smHhKozWu7iQ%BqJS5WUCKoVhM#mTw=$Ew(!N54s*M?iCwPqpw}iKVWd zJ>_Fh7($*8lUo8>?HfF*&SO8~Q77+7vocZYVuHq}TBW&2vK6kSAJ0Pl`Z8_%UJbI= zuv*Dj?XM`4KD6WE$KumP9y3~tCJu~c72n$Skt;sY1g!l^c$@j%cchny_i!@l$jE@L zt)^N0E|IKg&4;E`5qtNM2=tKc!1;ht(z7tpI|RU-oAbv*n@)^$kByDPV|z>D7`}E@ zB>lB}@28j5L9OjfTQ=LuMQ2XS&w%J{a-CmiuS7+$3sZhZtd$lrA4@~&krcA~C_ zZLxyhUOIiOK)*p%%2pT$7`OJci`v?C&&ix$i_mcHDB)b~Hk}oD3_D{zLVj{6Ae z?f;;qv2_!AIeAWBxl6ijiTJzwYQEtVSt?$yz4=U*vr(t%`r`nW>x~C=FwhmZ2*w2S z*j8m#1clVh^zZ;x^tovgT=CUIS2_ja2PyeYLgPakl4DpzTC6>nT6R1;y(=?ru3rWH zxtDf*0^e0KvssV~dWjypncfcByzSWwwW*}M4IZ)Uj>hBZOT2QvANnQI9jgAR%xz*f z%)-uwG4DgNOoKRArR!U2D&07B{7~KPw7w&Sr`IHlQf=3Y{q_|ezWMSo9s|xUMW(5k zD0icZS9{gu`FO z{-Am*33*XNvZ~T59UY@4rA_q7Gw15fK*6Gbhf+swfZ-?}6P;Wq!;{57xj~-p&u8Li zs!V1|BJOf)r`uVwJ5)N}`J*E^wHO3iY!XKHvjS)D6*xcIr7QeNeY!Ma+;*X+Yy{8Cz^)&_|!Pg;bwmcQ1{?mA`7I#qsJ)cY`( zwNCJ?puhfyqPPz0qidp@XwMMDR~xJQWBWB%=?=eSYxhvzn~S^tv7v>HZ=H0}RTI7e zRy@0zEG%&vRrvgGa2a*~rQxTCA1>xhLdx>H zS5)pI@&apj{Iib9w1W`O+^m~jQPbHB@3;6FmoDj{VAHMEx24=A#U(DMT}d01>9}ae z=}8NB0_O+(sQ~G}EZ>j26miKAuLTc@T|cG|5u5$E5lKkQyjoW<)jv}HLou1UYK7fS zBBc`T6uXSXn=NUAfh=pBSM7V8gAF`?KD*{AL%nyrX$Tqm5JOx4f=!10Q_!khYA4(x zH9qlu!H05ES_FmJ*Jn?ja>?r?BKvE3yP4a(KL%F+4iHGUb_qs>JR_4NR4oK*k|UBL zXLjDC?aug8xa+|dS7(upy>Dw@XeGYG{Bux7?v-)ebSfCWVCy;N-6>iW4iUJrO#gH7 z)p(UH0v9{I163J{n_SxnMkdr}1~P}^UeEoRlTnq8h?CMg4Bp$PVG#-52)H^u>+YB+ zeE5Sz7lvGgW7L<`%B&b!W>eG)C(7stBJw?D){h>&$cMl`msxoi9d3NcnU})f zx1JCt{E!+UdyW@<-E|`8ZadX)CYBYb7HdLrPBsvoyocZ1S9_TG)qgGLWzEs{=ImFk zRIcNB8nz+vU%_ieXvVeyq_OrC0 z8yj1)+dp7;@Dp}&o7>3i3wlAl!Q?l^MPhbt&EUP&3pSw0p9@(NAI30;Ts@j;o21y^+7_%^QZjz zhPfR8PB^+#glr2Uygq|Gh3xfMDi%!j^QZ+S8nxc!bk*Ews{~T2%od- zYP;|@n`E`Tn)~x#aILyHjBF@Bb~AEj^bsW!sY+Dr$Vh|5$x5%ZOrA%pI2B)>rY7vZ z;nm1NOo2>I=z&lDv25e@beMJbpM@@|<$3}4{cXzBZz?qD+Y_DjB6x2(K65Tr3@1yk zcNCi+dUrNOhd!PQvi>wIG(Oqb%E0?t-lSj; zEmdmCg9Tt>i$5p)fa`|L~s$3~5VL+|2z zC`KQBq4uI+#7EY-yDcO;%a^_(&+*9;@K3herE~TvS*oouG&~EjT+KFfvtaTFPx9x4 z7D$i2JMY7AI1x_tP&gYXuYN!LX?6-;U8Jo>qcTfAZ%H=;p zQV3jd;<=>h319p5Qn%pBN65hBx0k6(k(O2t;s;OqVd+T zsB}osO=FFNs5XhIT29C>;)0{jsYN-WWuH%N08b4!nUc-8oKmACeb|B{{xKb|Z6pvU zjO;O;eLoJx<2%TXU@M~V8Y-S{1XBNgWj|y&{zTe}MglyN99Mr1M)i-3z(bE2s0FW% zSJyMn9OC+vsLA7Bv#lkqey8*C(tHyXa}w~Tdw}D*EakU}XG#WgEEv}Mb-z?P+W75p z*9K(XB6m+5#1)+E(Tx(9PQ~v^cUN9%tC@#c@W4sU(7_=gxnCQYWVRGeg{nn*q0sJ| zh_Kh+i;e1H^nvUguV|5t)w&rgxO??wWA#X5L$2s$`arc}F5Yr8P<1>tx$ONRR#`Gl zrQQcfNCY55P`v5y*Nvp%^SPSfi}G0C&niU3l#l5*m|}6*VBSpX zbX?V{^7P_epk@^v{;R4t@zKRro!Qzi_5Hrns(a?);5f#&V7W=b2Q)anj?v%sV&{~Z zdbTc>mzNiuqtl1`=pwNwFqRtt+{(K@X&q>kpUgS>+YS?1IZ$Xo5o>|`P3X&|z;j3%C ziv)$7Rlx-uAhe5)FbKbf&1xSh`ghbiR%0dbNv}c-(iMHzGq^`Z zhN~^BsjjJ{=st>&Yb$Xxha0a60ZNo9sHj(ouoAdL-^JXn!*`0H>vmC=`ZTJlzI`ux zWr})w3pSGPF7KA0;T@HG0xLZaCuzY`_rZ@9f}Jw!5IcUZy@(Z&%p-=2zq#536g1`O zQ#sOF2Kr4-rW+1s881VOjBoDmwi+^H9)n$!qq5&c48}bM3>SBs-(Rkvm;U|<``6vO z6Rxn+w$prBvw6KU?K6!$`>nJ-#s#i3geAI8nQTi)VDoW34q5+JMg>VSgfRTGfqbhu z?=rgCG|FS8FwDyB@pfIRS^(!@Re;6MASNfl`N<%92Nll!&j$Ih z;}LWp6#J2NU}tOMq*(%MaIg+++?0VRLsV>R7N=42z>$K^5Y;kDncMEf8s^jA)#ldv zL>E2IcBP;)gboRPIs(Fdx)d66cBqld;h-EvE?{Ih|DpkH)5Dr2cv@hyvCoMXs9v!+ z4KEBWLQ7rOx%M>7@=Nj{msa5d9G`~nL_cdf@2@b^3=F+(rJ^*a}!VAn&0%U zhZ1TLMh#L>t5WpO&g>M0L+_@0-`yb}PDoj|@3(XAdVKOGLhr6NwH}w0#rfY0AwX1Q zd62(|p5ulsr{I5Yw5ntc`%T@VM^*F`6C)R|`9M5&D+SYs!v#NR})M>&Zl5!k9WRLlZzCh&Q_?xHM428 zViB`;K&Xw4?}yoRP9m*~R@AtM#I2b{gZ%HXhvG1W+pb#1KigyWk$UN%xPI*2~UOU-2C7!&MBp%kkm zv47`DTbspV=aYc84Adn}FJM_7ir%oKA^_}tsp&I)X=pK--bxig=e=Rc95{m7#nO5L!pqeH*9f?fr zG~1l+%-HnRj;r=ZB5Y_78xG>r0bzmJWGVElUC)7a=fQnw`RU%_rRd)vKb;bkx>;5O z5azei?S2W(col7BD)*ydV={Ce;@w1F019Tjc+Lm8WwCr~v84?c8S$rdl+U){-?;o5 zIICNHWtzBAaP7r%`HN*Q5c>V6$d*-dofR>$Z9!W>kM1|97s^R4w=tO2NN}(EI^c%| zT&_oVXYEx_)=Q?TtIN*~F;M??>*_(0;#F%A4VcHKJTmW>E{p~8r~RE`#@Xb~>+~$N z){go|&0Y~G^zCI*XD3DgC}Mk!+`jJG2-9p60N0kq^6NzAC&Wi>^f_MSC>!>nOv{T)|1!zf_uE&8NG9i~hj9MI z+mBkPwDjbh*FF1Q=yhph;#$;~a@<}`sqP5sR% zGs~MKaQnUF$-KR^`*gkGHiasdMn(qtYg}>WaRPq_=L_#}U>(HX6 zV(tw*n?-b^gu_jrAX#sXfP2LPiZL@+QP-!?_5@_3_3Nw z&JS`?D@Sz9)7vd-ym982Yctdf;9 z8TWHH`5Luciv#LdHo5Z0dALyoTVQb&ua_WxxIbNUs-8xKTwNV2nb) zD>GnIZ0oeyx@=X~YnOy0tF~^`W|zG8US~N(P^?@);bI%uqS?wN4!>Jy3*32?Yg(yb z0k|#hhUQb~8|t5l6b1%v_ZWOY!S;=M0#6D9>L`T+)pJZSI5DFOTZ&|Tkbe?R5`&r7 zXG%tdk%byZM5%$YagrppLz#?e%6a2D9WL)#L^?S;102SW!Yp10Ox?nFvr{Xq@EzO` z%HY*gDR1J#VM`(aHu5Hj5t3^>-%18CN|nc|)W@b)<#W(Lia*7a(UMybn_$ON9>>Ql zKA}C`P*KIMQwBzhXA$wS4#k5T^^Hs`()g<>%W~l`{RB|?z?8PSghJ6)*k78RlH*PI z{b0q{$8T8KZ`KLO^g0Q5I>R3Q9M=?V3b8<#=Z;kyn44#mH#@18yHGFYu2+gqK2ZHI zqmC~zqqR3LR~W5Yl}ZFU0p1a*rKwVv0v`YAUT@HBGM7#_hG)W?Rq&x)Ue7N`jWgip zI_4i<&EHEhvai&Eq)B_@CDjJ?1=9*^{tAT|m^PWiN|vP?L57)&d1^z{d9>2alJo%0 zgoIMHk~uiPd7|xCkm6tDP1l5%TYL2fb3qOM=YOUf&5o0c(2mY6Nn=qeLY(Rvn_?jb=1RX;TowpvyE9oZkaU$|1i=!t z7l6RrVOV-&6*tHkl9Vb1Dk&LmbP}{!s_X4tgCzcC{o568a)smcsb3UB?p_1FC4&eTrh_4!@R zwywLhR)-=`vAC(%FEY3N@7iWt#$~n?`s|?HZva#bM zv$3;n!@}F=9K;Mr$me($TMkrI2xPhjJco#B8cn6E){_|el{B?8?HsW1aHv!hUwa}G z%|F8Vy@mOgD+N*xWjmfyBg>whYQZJrH9pvLYZ%hty^p7h{K=sdPcRx+WkhJ}%42e$ z3mfHg9HIrKqzurOtsCfQ<~Yu~2)%XDac;C=Sdd=vqWQT~RPSkNjgy$NTDz1^+#&FK za$s+u@6F5#`sVHZ&B>3yB06l%MQ{IX<67H33OBsMD5}<$A5IB>eY_l>$Z>WS=JPp} zp0dvhPblPX)izEf5m3Klk8}KBC&tW>tFc6>#m@LXrI?yaqgtPu0e0qIURVA$_#cc* z3ZTj`?A*;avigo)laS1m(tIgX=h19qbLH(Y?C zO)468rLubc(K~OWDNV;3wb{8)k<58Xgtl63x{FSFE`$bS*{H?k`XRlUOB*g!Eyd^} z=m2(2NOY{u$rXd^lw3kShyGJ^X6fC$>%oN9iCS7fE<+$E^^4-1*xP{c*a>v9;`ROY z%ym!T+0+*;lCJf^v%o~eo`+^U8LvFE+*QsyV>neX zVy^lmL)fUe+Pp#%qp61(KC`tqihcE)vf9YlG+KxeT-!T4Ze zjR!K__ONqxbtw!}y0kgAl--gqJzef~-QsGycZYv(S)QawDDjKSp>kw@H_DqG(4pz6 zBVdp*F1ws0z+bwz8lD1PGK3qpxjxtwHRS zv3Ha-XBn_1XG`-*qfaiT%|9kd?yi@9tXxk#T<=_;^b(L=H6I;l(PxVW|CXPSwAvw? z5w(5%i@+g*+5#im3f{|kF z229G)b3VdxOmP@*Z1ilRYGC%v#%1Sn0?$T&chlxtwZVN06 zb8FPJ-5;No7G0(xpw?50=_?+lgXgG@5SnTTJ$JI#kV+I(+VwlEGI671iz6V9V=p#L zp>}*HtKnwooHw>4rs3{VDPO6J&*|d>Fx^@g6kPBvu(Vtq$h_3sW!3CceO`-C28S-8Q_(at2GKoz}O64rhTE(}@ zfRt9J^faHCnKt1Q;^sfWOVH6-9`N*D@PleA`G~LPSxu6(LGry8)AKhomN^zJ#K(}W z(Xd2No4Oq{^!n&v_>g8?uHVcnj1oERpCiZXTFSla;3F*#$)P~J=+xMp_}sUZ9*dz8 zXKcJLAt$oGN#iAV9!tX)@E8M?xix%TTvw_)@t3*rv~PA#PT4UiZxQ_i22t(T zBwZPbCHHJf$vD>i+E%N|c?^LC`KImb*09`MccXbYB`=PHu-j&52G#y4q9XmQAUhu2 zu-5#UR{?^`(@yTT^;?B41x%`x4JoD_8=vX~8-kJ)I#1Fbu7VmTx69M*6^;_%Xz{x9 z<>}eyp`+{}qEG^E{08sKnElDv2|UMqn5IT1m^zvW-!-p6vP(TW$oXbr`an3y4*A`} zCe-Uq64mv=V^Qx6Qj>|8IK>3d&kfLTB^C9@VkfqS{OG13zv#T2rqqQKo^CWDe_1Nk z*7gfZiu|oxe2W&5W&VI%%b3Rx3JU&!MG#xcf~!sO81T9E_i5w+Zc=?ueQEK@2XOE_ zW+J?>Jh+)%s$u)JN8zdYh=jNM9Zy+OBGMZKNNb1s!lXCi8Dey)95pr8DWsLy`=_?%VwY~8uyEa zV2;;I7FzE&Fep2OSZ>+0h_9m2jrK2c(Ea??H-0^Jnywa9L*Zt#L`<COd#0 zFSSWlcOw&Zp!Hu5lH<($g@m8Nz=Q<_bL;P7kjLV1usB!ryT`J&pCnD~3D_Fn?O4$K zZbiuG*Na7JW!Iig?VCLtHJ41J-CHejUqT6~yMTkt`ykNO{JxA|OIx5q$w;%>^DW!W zC-`O3lSZ@W-Jzg2MbHL9KEy*5TX9(^x~*|;I>sxYtX`#tpGJ7r1adpQCt znPp1Si-u(=`2jlO# ztCQR#WN8d#yGDgIeZ@RMHewLwVcy#8OGdF^jUg|Qd(&u{Sk3?r4h~sgCUKTV)k$-E zOeh9)&N19g>OMY4{E}00ABV#e_&*O64EEb80fDMvK;2R|a#;q@>)E zGL7EB$0wL%_%DP^0OxSFrs*fWwDQD+H{Zpp#wUoXR)Ck*L4`pu4F-MeWj7qMs{@X*}h`j0a<WDF#Y6~uKA)ZbEq@{8N^7vY0^VAHhqseT#(ZSnq3ut8xsWCQd zrM}2mtsp0sOw5ExkUqYD5W5L=4FCPqzI^QR=HGzr7H(-(>E0*WzJ&Jh54_dgUYY` zJDGE9HV7j%+}ZJx${@v5;!)AnZCvekpXnHRXuGn^gVMo|ugDYOGUj@`hqz_$^^!gx zk)X2q-G&rns0)<1zl+v2mdLl3&@qk%^a$%`oAjmBD+zRNPd3 zwwOrUQ9_bMX&&=M?k~=ij%l9sfD%J~fNA`@)Hqvv&f?s=-Ft z#okMZPEHreHuA6G%Gt3A-F%q8Z9UgnhNX@cZIX~`)lY8|u4&MCJ^N^T z5lxscVok_xeBr5*$)rs--?wYjiZFyGo>M22Q;2e~HGMHzr+wrw%r~^W&~gG#qbnQAoae z)TE?bQkF^jZ%Sj{rCHC7+n!j3dF;hFKYvxiWWND>w~@#7tx)fQ>r&FKz>lYtjky5$ zFb7jc(+l+<|M25hdk-s4ew2o_i&=$zyW(cVxcOY9rVCfP6rHoY${6c~oOj*-WEyCW9SZqb<(-8R;1%OYm0Vt}B7^ zvKED>OHM70h+N<+^vVN}++}Y-5I#N;!#_H?%)y^VYQO;iQO{=(I_~F4)^ZYw=7@s; zV-heO(`5njW)66(gg{(2^Zm*1#J|wr+u8QvJ>h-Zh24dIcWAfE?H2?vewe&;a5_95 zVDMMqLL)p{h+s{!y@X&gkzPuZ&*0e!W1&I)p-`z@N0Y!C0q3PsRkLI-3fc`qMC%lo zQJ*A2Zp@3`#e!eQX==jqOCIhNxF(moDkob-SRXJx!R8dtmkm7e2P^ZfuUIYDZUF>J zHr*{d+Jvfv-L2V>hD(x$ykYSXj+zl=hWsxA=A`viJn8ib_0s6#MXQbZTg={=8y!av z8Jz1ctmme5a7hB-=|I?L#0#c>ACHe4UNp?)H>?;WrQKc*T8F^O5Poaab`ka51g2KSsKA2 z25sY_D>C4X@w6^ryXGH%6<)mBy1%7kjUlWHdxCbyxlD79{G0#y<1ccID|x9fpQN$$ zI|i($KVn%&o}fTOrY}BRP=*5w!~WWY-8Um)^#Y<_3@BR+1YwO7w_y)EGI!{clIz}W zY@8pQq3!m6uNxwFo`>)9Mi6OGQ%>Z<49GTLwB`WV#+QXZh_H$Nl^`A%AfCi-jR7T4 z@wWg+b&2>hKq<%CdMY0@c83I#=nQxl1tizxq8ja$H8?&;_~4O6W%rU@UL!w;6Po_S z_UovWz>@u|nMR(Hk)%bGkO7%?_wo56-qDTDF(|ZRnjzxZE+x&zdtJI*tC{Wy{&8aZhwlG$m-RtTH0uNER72$q0YP-vXT z7m2cG)nm=l~c{R@+vb!=4rJwc=;v^o86s(~AC344!wX zaQ-Hhn~Z~uW)RciQP;xY>l?x&G zAxjJtlV3^e*5^nt84Jkb$Bp~!wVN0#i%qaYI2x_apo zCI0Pad;Q&eZ*X8A7JV`k4}m13B*DLVmZgiO>mX*T1G&acf9a2SzD*H;+bmezuL~`? zRoYSOl%mKdX--T+=U={6g-Q@1Idfh<2a>U7POTSV~7t z8inD;4cjK)&rn$|JMgb=ezcwPl}y=Z+J)qVTEGdRAo;demKvX6$PU(~6F-uaHyKA; zglm|S6W8r+}TNm)304YE7Gy+H#^(mT%^Ly znHN;+|Dkh5u4AzQHc9vJtG_d(Ja2d^wokRRlJCNuL~0$jH-<*Ita;*9#r^sv1hSpBW)i<#Cbt@?*>t0P&aYQ= zAtzf8D=zyQ<*EthW=wvNMX;0rL4}Oaf|zqDHQO;amoQ9@`ry->57N%mOO{-QS+veh zJ%d305-CQ+DIBOaESi#&kN__?+>`-Bfsa065o6JbVquCK)}x4iyyZxg$jf}2Q_6_hFg)ZZ*SCdP5rMf)>Fg*4 zqP|dYiM|C(?yq<2x^D!sMOPs>B}6RO2<#)J-=ifbpEwXtQ6!xReDK~T3m&57U~}By zbB=eTnRl!z=2q9ilVOTOM7ci(>sJ-008C3_UCYXbz9@mEk919`;-na2)K-00ZEG1e zgg8J_3-R#+UPPA4vU9G*bargHEvAON15xd4O)|DF?VQefLye+y$rISFjY4?U+HXqZ z*Eyo$8RQWhnsZ>_lGC7LYcaJSFJ0qogdZN4V~InK5I=d->ME#O)i+jC$&C0ZA-^Q0 z?lTK=N+sI}g6MK~V(A*7DQ80V+&kJ&(iZX+-xSc$uIU-cPP=Qhu>@5(f5lKPh25BW zwUc=TB`LN3P*8Zmk?>4CZTtH&i$AR&XM>e&-l30v_DT3{?y7r1gPI_k|Ja`hHSvQ5 z(<{E@vd>QbX07xMeFD>`krY>M5sViSRA(u8`0M+kCkq|kM%Ie{960*za)z_;f~@HI zt+U^opM2ng@g6m9Q19tamq@y^8v;%*!_s9%kbw6jjjx z_WZIaPowJ5PnNYAHTc}46^3S-{Om>=k@@k0#{XHqvAgD1=-G zADsPoz*ek+S8?3N8G)U0DVfaRWyV0eKQW+|=og8CX7Xy<=~^`5p1!lD%-9l@VkTq? z;3VaF?b)a)>hWe;6Ew-g?IpTx#^SnYX9V+*sI2U1VEOguvfINZ>q?cQm3#n7OspKP zf5M&TXzm9S7ZNA^F}<&X?p^yHq@@Flo63}JS&-0cH5MLvuYCGAoaap7Dy;e9aaGve zfQjetF|Ye8wC={v&cGf`lEf1M4)As)mS=DC;~O?+nU#0=z34E02_qrxxXHN8kmu;4 zp4yGe@UA4!G>f#e<$s~;4bYQchh9*Y-(3jt4V^HPyP7{~@!%YiVViSWXGeT*DzyH? zpCV@0>P%|8FB}{()o=83YvH)rxwJ-VqnZ31nN@I_S2LA+1BGG#!opbPFS{>q_jY8K zWh$;i!qB6&s+vYzsxWNV+qN|1UhtVPxn9v9*o0iF9;^3;5pfdDfseHLtLh3_3;%W9sc;oU8i&;dtKe460& z64;zLw>dWuXqr=NKRB9DR_`M(15O{1uum`No34BY%Rlw;;|KrmlD>J0+R`rP`_G@;(|1JjsfSOBBaUC}326M=OFbGY&p} zK8_B{E?taYb`$6+6lk@g2?So&17Vl-sQ@5MQxgcoG(j~`V9ZMRe1)T!pI3u=R2!&I zMXlG8Ko_M6c(Y(f1*TZ>U0krID51>K(xF)V+4uKVvfZC#hwNBStiPgUg(JKB6kH^! z#zurXadon5MnVbdF-0WjVe!`mDtCL~K^~zyEP=bXc{2-P%qO!X08*t&IXr2!fOzp{gD~zsOx5nj7RCk~ z>HOiWqvFn2&HIIRF&@$WPe=l3-E8kvu?PXC;H*f{lZCC z?$&BP5OLyiaj`-81>>GLuG2qkqS}Q?QRh|)?xzGFGToA={Ro)X_fdXF4MPpr7-h*M z>tjs@RyAAAwZE*7|6HD~WQ zx=fqW5>L^-i2s<58n5R4qO8^QSD#ecSI|mkNz3DLd`fLL|CsL`HQf$&?31y?sV0_l z({pX&EwL@|Au63AnV(oxBM*@Gz(DToD? z-`g~I(IeHaHLq&0pIaFze_}FZYJIXq;{CQyTK{G<|xoxQSN-_~v zP0WSt?j+Mw2L8BAeI;|(0b+axulIye48|p#V*c$N>1qWs?gt1^W3yA;l#7(Rh2@Z{ z8?s*B*^K@}m=f7G^nMCDk`xYj*)>`)5<=AQ(fVy6H0fZ+O4usuvKlOnXFJogMiHkm zvhlwFv_MP0p@#Y|Ac}A|{*7p&MSW87-ktkBm#Xd2FRt%vMICM#<}!OMD;tzM9q8l1 ztEpD5OX1mA%1tTUqEmfa)5o`W-l3X>=XbY_?)Ifl{LSeUIA`AVGlqCE+B~;wH*jZT z!KVe9-+N>3D}OMJMI8I`jxo){^$H|Nt^AQwe|x)RZN;j@%$3yc{V=NocWQFTH)Xs; z`ujK8p2h1tkb^~LpUj0O{yeba}~lINfeM2hgvg?ANjRo|v zXW6!VSG^RKCVMm9_q|@>o)0s0Z)iF5cKP~=c?0iHZoGbz&DB*#NhNo8a*d>ykG9CV zkJ&Gw^N~qXXR|%;dTx7b&V|vT-PqH|PIqol$gtOJW4fYuo|-vWLzi#8=jkNP%x$up zayH#l^pbnhNhL1q@%?C07PQN3k%y*vTjzONB#J>_?X+7u4yNwz{vqz{={9K7eFBrrp;Sz0du&qa%5r9-#Q z-#m2VkDp0v+t+II2VL$2k5pZi2`e$>>#fe2^@vsssvO_fGWT9()y=6i)(e%n#*FIO zuBB^PqV*iXo8NAOu&^Jm-SsU#b?!<}-ovxN@QGHZfZMlqp)bDs;rGD{1xPx@1a^p| zh1D7p2Yta;&SUwIez+xQ%?WL7(Ai-N!F{fEwiLNpeVAs{Ref3wY(q5?JKgR|mRT(n zCGg1sUMixg5)`Q=DPH@FnntRrB~pUBxVdz%R;_ixEp0(ml0x&FwzqX8BWl!Dw#pc) zg03K4tFK?wf3F5kQoZRa6X%*Iqp~cZ=2PRd01KJR}hep8I!Zi6z@{2+X$$ z8J6NCaFlMWW*9KW0o~QKz{hoM3@~ow9M+LEmevuI!rtN>>LE^@5^2Uak^d%b&c zUAE?(%mXYgEy37gmhJ)4=Q~#Jt5YE=t5VeKU2*SH;CbEM!v(^)4>hxP67|t~^5eU_ zW09bU^@QT)*DBaG!D?EScXxMpS2I}d=XDwaKmZBc>z9^HRc*}7m1dJwCOUMc!BA&9 zuoyxBVV%{2-K$LEE@Y}mOICt$NfFjAB!+KUb4Y_~)I_R~HmxE=+{Mg98YX5UNTycl zw#JGn(Kzv_!ww9nU}Y>~>f2gw?V2G)Fo=ZO#j&Osa$JQG)}XN}t&VPHYebSNs;sMh z>%HT?_teKR9K}STg(oJ;m6@8RQUwAEDFC+$EQJt;DCBUtBW5zk74lm)k?j-bCfW+1ty_q?A7H=?R|nlJ2)jyyDtLHso!v zl2N{<>ZiPY?|P_vx8C=>WQ;v?bZ2H`Wg=>i?cck&aYc|q!k39n2xCZz5HP|*Jmku; zY$P(`$t&#hzBL?HERw?Wx(t%rQdZi%uYSAK+g7>DGge;W&| zFFY=&8OL{OiE%iWFwDw;!@=E*!mP}~tTPI;GEXhpBfZBnnuyN#o1BnL%n7@?MrSPU zU}agDsWxU=yBp6fu>I}>Y%g%FTldHRl4P$xMZ%`QN!&G&a+jUr>DJ&q8 zl9kgULUi5jcPZmc1MrLUY!v(Jf0B(n;GY%)Ir63VfPEz9{CL%2cHOpH9%#TR1CL75dQXMSd!E4x( zP^6H+F)15FC?1CMYDrVN!-Z;0ug=&!-t+; zA(@zWN4&WCjjJw^dUDNA#iDuPyGnNz#(o(9}#1cObpEmRF59SB@H{>UWIM)%{f7j57C7Zh!3N!W)4k@av zixGor{Su?Yo!obH8?L*(TJvtU;Tvco(NtnJWbVd_H+NC4?#3wAl%gxE%Wv^g5gHjM z;-AWQRZ;UHe3B!t)p4AoGpM6qHA_xbz3wR|ZYe*`?_{~I(L{RQ*U zm@t2Z(NwI$s*x4wGh9&|98np7gd`ydK_rOAk|P>5SI?ENEt_9d*Q&O@zc1_H$@SZ- zqq~82QWr5Gq>zxb%_&5}(9>2l*eWWx(&VuzRZ3KpVKG9n|4%Tg;- z3-Ziv#m-xYHtEU|josHSVu~OunB3T+HjQ%S-P~N+OB5K}{XUE({b{ImL&K9PHb zpWS{wSK}*;#3Uc>-L@=n&bkBfXRZ%U(S!5iC<+uPC~8X0 zU>hl<)Rs+?10u3hSt%+DB>o=pn2JWFq<$2`D~KtIlX7InD5En)I3``(1z4gbWYA6@ zm*bg^e6yLDXTM&2k8j1HQK)Q0q>740qLx)w8CJr+pNEC9?=x%O{qH?_ecOLMWWGMX zE53WXlEEebM0Y!|StLj#(J~^_xtyx+*t|J(_n?z&-X zcSS9=WvZXL&+Rbp{NfwBw z`XVZZ8WF0hqOO4it0=Bo>4?TujRY9LM!Fp3a+8#fZZh56j8_YYT<2Leeg9jl<*NGl z*kRM>zh-G36W+dH# z5ZVO=CmRvPz>HDnR9X_0vQ|x?#*LC9P0O2W@m1EgzCN=L!`bWG6;P~*B2vQQDzvL9 zEV1z6@a6R8oOkcP!{g7-e?9j7^Pfc}zO%c#rNc=|+i-BI?f{ZfB0+BJxZ|Z0ew&Uh zMJ-BFPopTSG^!+Yh|JAv0wZW_N=a;0baZu!x!Rx0Ke79Xu4G#d$e+}K7(ds(z_oRO zfs~pYO|b)ZnF>&_0K2<9b8Mc*uH*y7us2?4M|+{(DI5w|QiBO~r;LCe9AMTYXh_xw z=59T6t{7`2-fmV4nPLv^_q_;EjYkG$AwcC6VYD&*s3Bt*NG72e%yF>M1!hbnG|P5K<+PUz2X)*zcW@0Jvze%Cnw)h`Qm*Jt z-3;#0c2#y*tw; z9!(dCdV6sxcB^gi%6oqH#FDDJNY3obqY^yZb>-u@-YwsAYsaD5!H_ETbnBm&=epycop;xHZ;2X(g2f6SSHs{icp;;N7#Kps26LeT zJ$NP+XGJlxv~z3d5tPLXX6tdLGQ&$o6iz2A;`+7lLB@HUb=!Au1Q}KH>{)91Uv9_& z9WRWw?@5+$=FKdHT>jeZ&I?J5n$7m`HiZF10tarugVbRqkF`yxdMprpA#^e4M{^%F zC|MuV=l8v3SLcNZELgVX2=p$l2Y5(=(BoID236i}9^)l+ywr{*up7XZbQCv0fnIHs z-7D0sNXoKRTC*cAt{LUJY@NC0*kOr;3Kj+_%ZQ9?fFWu~~Q?5|qoc7XbCfB_R_50E+ zLvB^yuaTX>`EeE1-N^Twbr-vP-Y4GllKp+j3sZNwmE=h7s`ozI2P&HJp7*M~-uJ!k zNhap#&dkWmMC;}mu&Gtui=nrfJg^8vIgmIwBeZ%*69^neVP%|*EW!vA0zgZG$ZS-G zl&dON2Pk1i?W&K3FH5gZcqg6_h~Y)&o;(E7idiJhCAlz|X2GOuK^$Sn3#%H8GC>D5 zZmU!zvf)9H2;SI>0w_6DER2H~=XYx+YMY2KY8yp$&%E_-e_8ab31R(gj&N z@aO#r&`C%nP)4GPg(8ZQ2P{d8BBhFvq*lpgg;5~*eDmeLz5ae4{(9X#|9kcDe0+Yz z9?njR(;{T3Xr&c#R1*EMB&nHlB_)}qRa#p0n`V@`s0|4e6*g|}m@@@JKHu(8Ns@87Sgal8P)rEJak<)U>6af_v}b`|tP8=dII!W1Ic=+kH2wetdVa^rx2J zx{TD)D^jdR)HQ4S<4|_#&XT&|)fBEIRYgjuvC}s)C2JF|>Bnj{bnXa+^>5JlmZ=bEC}u ze*S(r-#X@ZKT1VX$dassJ}O{jA}N>b!Xs6Z(Ka>pwq9B;>{4bFkeV|x?z#|cWDw9i z?pQNpW+8x}8_S|yU)0z6O;#2u@?#~Agm*kn@~vE}iy|d0DSgF-d(@FH%@Q1545C`NhF_6=SdMHlR+j0lK=(I#_rnJQ7TQ5H6lr5*(yY~ zfhw>7DFP;xQ&~wxHAtG$RHoQUfI=vz;EAatEF>yX0Cyi7P0#`7ap!UbMqK0t=XTyI zdKEKfaUM2AhKOYC) z+G4)D@4#pyFak~z2*5;|!qxjyBvCOjA(0LAxwSIobf|8PXiG9bv_Eh4*h^UGvq9@_>{g3Wpyx+dRugyQbcY)Wuci)}(@85rK-G26}v=*&NEmd0E5p9UJ z#9Lx5u@=~iVk|^S7x2VneQx1YYLcj`Dvey*n&#I4EEx$^nN?D2mQ&@~K_l9<8%%h=O5ENr9z#Jzsynz8CuCarf)dr%ydy^Uq&-r`1&y5phMYl1njX z@;=D?uV0xRZW7bU3HV9ACi>s9nlU3WK4<&$$5Dkq=S`_lbd!5bdW_L2UZc3OqbEFtb<^>vTp-{|3U~HgB1=S%9x@&+kax^8T zh%i@UnTa_ZWr}S;!m?F3mv=av=5DJ75l;k8Luk9shJ@P~#sRM6vKcx<*I;j0wN8UW(g{=Ly?9a1zV>OD3T0EGninOSPDwn4M9?q zP$P*zgt(zZkvL$6D3&f@RlkGn>#N`MjlZwD&hLpm=^BK&&v+Ua03HEgd{@IU&Ai-D z&ro-^Res%`R+V+#(%!yQLT7fI%c=Ui=~>{x@Ug5Pe3=<5bX-Y+HX(U*{Fysgh@TQm~vSi8>mcTLx(tr*$A zsda}g;;h>UA5~G%ZtE~-sO0TQVoL7Uo1TZaV1v8L+Q^n&4pL?2QGUN>_gl(+xxG@~ zpP}c+vufeeh|STr-7+ona&(nad*1h@Ih4*N>@12^Mx7s2Tr*i=KLV{L!Skg)2$y{@SLP5ppsN|?!r0Fesi0<&T$=;ci5qh7?_!iaDjvn@b-cb zfejRRFv9KnqBm*4?k}lP=gO4{cdYZyu-OD2l}g6}z4zK{Vlfg8F<>cFGIQy2TCA1} ztwzo4OrC4U(}*B_5zQwsd3Y)b-y$p}eWxlbH|pr{5UL^Gn2)zbBpc zpj3f?0l;%GfGQ-F3j)a@>mh!&#p^RL#c~zNE6ev+y~gi3CfifG?JnD7w$^i|zHDn7 zBguTi$ybF%DyoRD9csi;IhoAn%}UWt%8PnrF~bAF0iX;h9D)#59483Lm~4-CP3fu2 zcP(yaX=14dbEb}QV}{}`F|SRs*P3wdW;xDP90xbAHrIG_6=6<=qKUC^(eF8?yf~*a z3}x?B^l5_!ktyrE_Vwp@?;afo2~h{D0l01uql%omZ+B;S^ASflt&5!??;@#8a&Ub7WsBd}B8@tXNM0KkgYZX8>=GD4qp07LSmoq&1Q5ed}FqF+r1W+j) zOIWfbBPtkCg(O=}M%soZ$c%^)VkiuN$dh>qgs8zuIPjA2mnx%4;&YU+^Ilu*>Fm-z z2qD1=6bStS2=GDB4cy;*&$;y7*uiPPd9KXqcTq^@6CYlbmyHm8qF!{FuXndA!SXBA zFhQdQ+uHF?S#6(Zsjk!I<>u(PX4&1|g}3P^p(M)oY*^ubW)pNXeOJBFzewBiTe5da z?@2qm%TmlczJ{`F#vWBYF?xFI+wXhc_nEU|v1NPO=f_vw?|a&hG0Z$ZTgM_<63Hl# z0%-}(G7-mnI&fO5RbAZ_+jn}C2}G+9NraLRXpl%Tvoa{;0kB9+q|#)R6NtH;B!Ggc zk^)iCnA4VbnmiFwS@UFeRnoV+cIG0!o^Ks-`??2d((?Lx1s|uQZRVt58=R(gq8zFq=GdPXn@9338<_a88iq*8n3s<-`CgF z``-V4J^Z@-U%snRkTk$xhBjNJZRFSP^`ikuI0?XT=ZEjfdVf$u5BJqy!=7CJWzPO2 znp&|vEBcWj^AFoMtVUU?nZJKIG|3@07)A+|FU$J-uE)>R@2cJX1KQ*=J15%94 z!)?dk#>cWgWPVZY^Lagf+bY>@UO#z1Kds>F{tD-Q+u=Wpe|PaG2>28M%mcGC4}5-G zdewgVG?@^Ph@_Cw`}lj>N1vVVJHMOvKRCSb`UonnDz?8{`B#4Wujs@vBMeEtufOB_ zyZr1>S%1&-tlxZ?-Tow#gpf!l1`;y(sd+Z_`R{(TL{dzX0TpbvTNQ1zwe!!t@66}t zJM;6T>r?S&npjF}=Bci8QfrgqwXKPtn2I6_;sPPhT=etNvh(lWbDQ0MbN27;TP3w6 z3jQ+)=X&=u_nz!?b~Yn45aTq%LL^ATm0*CG7y^cnO9Cej0T517Sd@uG43NSV%5hAl z0^-4m6Du}@P!TLl((=~8B!hqhT!11>$_T_0hA~K>*(i<5!K2+Q4tHK1I&qMSGb^U% zf}Q27hc0t~rw$x6Ia)n%H%F7$o-GQ*i&ljuG!_c87?QXHwdD%9M3BJ+B;d8tQlyxe z1i0BYFvbdGq`U%{R%43;k&_b=VMw${NI4rx#zR)%;k%}xQWrOy%nZXdJ62dDm6EiT z4OGCxiG^Vn3z;|&kxQA3MNpVd3nJ6iow<>UHs+#>blSS6(E>=}Bsr8Ip3dJ)=hv7V z@bJPi`v-Z++~=CTkoJ4~nV7@PcD0lEk6PI^CF=C|wfMf$kFS{|l-~}WeaPxbcQ6~n z3hsE`yos`LS?(~^o_ThVEMDq7Mku@>3=|fj?S4L3NhHZ1XRCFyFk|Bpk9`hhOsyOj zRb>NqJL>GQmEl9(lX?1#m*kIbdvLHtU7vG@Gdq&!c5}K#9o@Lw-%P81i?al}f~&iI zGTZTKVl_s2&hFoOM(UD2MB>bi#7HNm*_bOcW$3(pzV%tWC~gXv=d}5+NiOaZNis&; zs%}qv-jYb~+i~yAXiQ(v$-QqK29*^o6=a<{I(Fm7kHLR9!X0A9y!dWPp*WN#jLw4Y zXw9#o+gnndGzp{j95wd+7@OI_+u^-36mSl4dv`wz?)*LN}1j?GJ;=7O1WgoZq%Rbzpg0^ifO>0H3isV@Lu(3v%A*G3= z9$L%IYP{x)<@4p+#^;^n@F|9xTi#xi-Q`U$E$A8oEE)h*dv|pOw{YXYR8$Z_&T~y< zYj)8QP8+$znK`hsisGX0Jl-R`^UOvu6h+D1C#{VwK}2}l3N^cEiVBLz$wP`c%mFu# z0o|h9-9jgKbs5PPVUk8jQOd~{Vdi6!Dmd&+jSXW$%q<+)ZL>uj;BJDO%O+PbWzfMG-_%6h$6e%e+w}Q75kN9J!s|dFO~wkwlS1P&6VX zOd^7a%#f2Xh=}mRU`J<;+pfYQBa15_p(PP_CvxUJX7kSHD2fFJhNmQ`P+bFHY{M`h zKq4_l0@Hc8ZMLcu4VF$UlZ@nQRTYIK3ZSU&?%}(-2B3|sYF5_dh#=w;4FfT$w$6hj z4ko1#A_^L9n{;=1cpBa|D)1cFbAv)I4k+d-qDfAhx<)N&phAcOn7N3fnT1ulWY&(Z z0$Ak=8aQAVaY<;BdqzhQOA)Fw@zxu!G`0IZxzoK8Z^ir6myPzA z1SxdjuFV%;W#%81EG7FmI;`7bi7Z(xf-P2c*4kA81?+0!as&kT> zsEfO%xVX5oO5BZCoFi4m#v&YZcGB-Trv{fQSs@aM^08E1N`{rWrik^9ay7**-CJW^ zQ)?ZK(#x+rcbm<_2TO(x=ba_s!ON6m(&w*UJlrsMag1P!G0TUg!u8&-E*UVG$7RC@ zOMq_k&Yl79&b(mD6^kVFNyW{nCl@VGIm3x(5NQI!I^H^TY!(uQt0b&rWTC8;hU*OA zBcpiQnC(kV|Xz3IBz%4IB4}?wmj4luTgRYa@GcdZ4Bl!TF7B1 z8H0Pd%yD^myOKp>-8Wvv=GNqr65QO@yP@H>F6ncTRlFU}Hw&GE*PVJ^z8@Z8E8*kg z%KaHL7=$3lB6{Zj{k?wgpT2YV&Kur(@cipvsW3*oyK=RD^qEGPM9?J3FhesDf@^2z?p^(U z@8{+Hd)|A#_1DI#L-H9dSgJMy8Ah%4uK4P=&f9)`do+uPiYlXmsEO>;+uy%_M1AM4 zyX&V_-h0)&p+uofoLpQSL={hGhwpz6-TdL+ zUx%K0eE5C>gc&epwf3#`_4n?-5sXK|g$l2*Nq?*>e+v8*@n)vR2c23Tixtl}&U`|C zdo4>=AlYF3mUKOSoxdk*eIP0zkWEDyF{2ob5forHuDxG(@2m4WyY)NA-=966=e#=l z!!z+vR6!L)3=^AM)oW__mfKfeTk8DyG{Hqt97V-N&xe`!@5=SReEaa-JUQ>n<>$}G z&&2ut_6d-hzSb_Tx|3wL_4D)b@8bPqB9x3k#8Cts5Pln4ujW6){tKh&qj&rcc)>mB z)q?)S5@tdhZ|1%0HS_KLUlMRtMNtvNM?D+w;&>51N z)jX`*JD6q{-#rKc=nz|kt?!$|VdcmhQ>0oPz^H*M8dbn$ELJ5_m`NxsuE8=JV5SIY zB<4W`u3>T)02MHmLS`0Pm6t`sf<*vo0x*`tQ7j=4uoVHsz>SwPBaSlE2ttreC%w3L zymOZh@Zqyqg1m6iP+=^RV=FCW@0)SBwS%yevE@oj^Ns|+TkVzQ{CT;=GjrSCurD3)toIyf>+;20 zYs{W2yiXKNB=Y+AxXM1o7X-oMHE!ips=d6#D(P=-(Ai^l#dFN|_8Jyz%Li^rJek~& zJSO^{+J3paQtKw=jqa|Q9nX4bH0X1~Ic(jYFP6REH7(`ckEtBp9eBDr%Pd$T2sm)? zP)~c8vV+w&sZGw@xs0Pr*AnjTie~Vx+jf=Udc5>&l4JA8*`vL!;0GaSde*wF+*e!G zTRRQadhB3co1<%Q!$CCGn|$A16_)4+%Qs<$J8j+DZclsLvU>fVbWW-#bAYR?@)g;c zGjeA6zFv65l23cjv#@37yhYKv^5Sp1 z*IrZ7CfX<7Xgc#rE4xZ4+ijA1UFpEJMLEZeNhJ5YZ`dcc{avexF}beW>Yo?0C2+5~ z4f0u@{NwJjvZ<*>k#mVGJT z*Yu{xB<o~+CK>c(JU1NkwpTER!K8Fa{5JF($(u( zrrKE6S*lVJ#3dB39-cjR{Cerzp6lqrIQ*6(pl<6)uc9fyZX65fH zkES{x?TyFqtGuhK-7Pk;=qYYl<5hg_+53CE~XfL;^sRr*J zmzMl00N&7t#o&VBPeSHJE`++ED!6D}+|PFX+_FEQ__o9hc0m3)yc{9$=BEtekl{)y zeM8;vdTlu->HFKs9WORBqz@c=SAoNGoVS8pjd`Z zE~18RW;v0uGz6-e9tQE2d_`kRl=iG&V*y z?8%BWA|fKF)ldpFG&xgHtC%Q^v|_A{3P{ybVYwud4(@kul1QQ<6ckWVaGYpSN7tV> zn7yq74=Rz7qN<#hswRj@X`_JrglGIz*F}`2l1il{g$Y90V=4t4QKKV7(AyBhiZ*3V zn&e6n+@!lH^S?>YDAMG?87rULZ;~5*C)N~yCw9w-2Kvu zRa@QLcYW`7-tj+qv*06*h4I2iC4_=OIF6QW27u3Wz?{tG1}TOvVVt6)1q>K*J03Z% zy?X1)0io?D&Tfri#16P|4@jnU&rWAuPPiJwt%{yLn5E@As&g%jgcXnyCq7~hOL=i^ePh@9EW)x`Eg+`-& zMHS>-^JEqx&mFE6z3({q-W0t&H+;&LX`D#9>bm7NO{BNO)b;V#zg*uQ@7Xmbk(NqB zW|)+qsU*ac42mktR?9_MAHDu{-=CkI=Uw=|ProVpi9-xgn-WA2P4200wO;hw*NbcQ zBpM1af^Hk%Kj2P}@4rvwKA%o>Y#pWz&*A|j5py#$W`ZL4Jv zK^RUPAmbmvj{47?{(p~uZm2!pq>ew{$|hxB%KTM*de!?Rf-uC%5LuX+iIhf!RSyr> z<)^Q|PCsMJ^nT~(&r|91nVFb!GL}w2^&jd=~t)Tub(f>h|pkgfIue+!f=8(Z1?H-dt1lPso;Ny zhxc0iN<~Ciip&E+uq=TSU}yzv^h7~MgwaOAV@gO<3q^_f`7`-rmVUn~_kWMh+?Kaf zIn8r<0*NT4$r!*XD%>fd6^*JJ#&Mu)%V4$BjTwMo0pMm@z?e`@RW4<~U0BG#NiYTo zt(0UqmK+2~z>eAA2M)W=C*ZU**G^e%{PH_n&#QT9neG!9vbsQgxK6IGj`0}29nA(+%>>W zv@w8YLzn=TM5;kJE0K&!tOgeuW(!ytV78(SZJ}TVtO&D=G!W+_MXLw9Xt}1g+m?%o zyy42zoH661^M@Qbm~L{+f^key$wpTv5URr{XdFyti7-(VP(q|E z!fbOS!a$WGGbbpdAg@WM~qAF%IdgohN8ZG>7AnaBqvBpk8> z$rS_n*0Ubv_9Qo*`;m|nIR!!gbpJVf*Eqxb%$sB)`rlu-ujsSar9wf7t+^X*rreW> zu8$$JCe_z>W3PET&@AtuzQ1^@=Bs>DolM^O@s;rh&K17O=DW1QTGw>Pp92O!>hMwT zDjpWSf=PE^gIV?4_bgeKidZ+}Lp3->OC?ULx7X#|twE13B$3G`Q%Q13HroxkB=@9}9`P~w zcp!cv7Oy9yQliDORgly1+P!PldLZGx!c^x|n&w`&PH^bJ! z_mdE6r|v~1sLi5C`!w@nE^JkDot6`|k*bt$PhR%sz0xV?-5KY}P^_>45Z#xY9RyoO zvqc&dfgHSecfOtx2n+E`-wAW>bTL@LnYb_z4gr_}&J1>wtLx!!#Cz!V;VPItYY;Mn zg7_9JvB#d>Ivaa}eH!k9SxWQkcUDrtvXoQZIO+r{gj%#a44HVN!V^oIbZmyGg zxbEU$aOQ4_M46LuY1d7T46Z7iY-oox4B2$%+f-v&o4dPWxM=V~Rl2it(cG|9!mlfI z+g`nR;&)j#fN!g=h{1Wz>f~x7G8kc@qcB(-J7{mB4@a)%DM+c&S?(rFryt{{yiR5A zNeWT=NTN%-WazJSjE-H|;~S0*9b20ujmaQBUES|_uX;&0MPzO9X-3*zxfZTb2RBCU z$tS&-EF6wj$L^F;>)y-myS4AT@6>O@^A8Dsg8krdqC|mfuB1Vmte!npdEYlVf<35a z1>l>pEi5RMcXw%otg7+TOf7WN4L42JMICP#*6!vXOZZP$nAp}Kqk`kBd?9k&n$}NX%BEuQz3BwE)XpkWddy8DqTtZZZ7Lt+Oym4_w zuvd0oAf4f-ch5Q)cp!HDL{S+rg9amg-#1@(*U!T1zuG&$4tlhTu>SDp*Z>3g5J@8e zCPv#U#;;FpZ?C_1txNajG7$kFf^Zxlj}87G$N6~=H{$mE?y^+#y!G!~&cr`0vemU^ zq$yHZ7u9OMRb93D3W%c-kfMqW7}`?7vRH^UDON?Y*&)BLopGLTTi4t9&az84b>Xk5 z8)~n-BVbvAFhsS5WqsA|%QK7JR#$5K@Na(gd~arqGBHf`A0EEE`}6hr_oeB(&Axf* z__D34?N6xs#NPP5IKMx3>-0oOh9(g}WWKM@SDWhl{a+XFr+W8(O%TizYn89oy-j_6 z*T2isc9?q_~+Zb<@0&>=brlZckq%+^J=}qQb>_8B9d0szbU;nPoJAw z_xtnF0t^hvXXEkCdEK11YxUOi=31*Ps(xd9ay^2h^Q=d9C+~b8t7@&Kl|_}LBn%*v zHTin=^ZR{2e{%W0K0beMkFTGvzdG-~-jY)xfFM@AeD7MS^4rfhX}^8s$jK1NnZJL2 zJ>Pe~$H(ulUmu^pzeEIt)@xss7NwFFBNMk#kIQWH%ucF!=YNpMKQxD&O0iBPNwnmI z0?TL%T}Ci1Lb%ySAR!V!K!FU1lZ2dkBya>ljxcMuAqLr4%%YS46oG)GSu9I35o}@- zSpl46U~mGK2Hs-A7%vm4oq3h6^2@QhF}Fv6cHPc4*msfMmbsJ4fE{Bn-L`X`bGyXd z?+fQAtHoRGSiG852bmV`QQt&@7snjA^A!tjek_q^)T+5k{gYHiSx% zk)Xy(iYV4*El?C;M7%VS zfQsv^4_;UcD-F2ijNXG_u?W^~uB_t?^}ZpgyHsGmEfRD4*9Lq+xqEw{(eEvTXRNO` zDZf!Z%F{lI^1lP*OurCC8WlRYbQ9~`I&@WQnXT)gTU~Q6=XU_hofdUn{0I?nL?17; zORks3=Y8n@^76<$zU2bkJWTFvO^X)JoTz@Rh^~!-AB_0~lm?%Yrzep54;CucqJ?hE zRZctzYqGDYYlm~XD?ZxJb~-z|8hK$_Zl0kfuG+aEKpGQpWg3zY_o+Bi$hxPsXFJNMsJ(j<=V)MaIME33i(UX zSvu>V8P#XQh-I&T(xFM=~Aq zzMg-5v+o0BDSXvgz9B$nuaA=9tHf6*u|OmGBstV5j(S2y@6XaszZ{gLZ{0ri^W{nO zFWOaERQl1$HLN&?i%ZP??~Ap-*~Pt>7EA0MPcBq@BOQ2<&9I#zNo;qt_qu~vy6BGB z2-=b=S~pv-nI?&NByd>=w|1`R$TaO7zpDZW*5D*{yvY0Hb;0*geIGn>A@TV4S7(Qq z_&*6lm)QHeY6;w7H`>LCg15V@+^j9F+^1LG+HHnLA^8hqQq8N~-c>kJ@@PWOpWi9J zEnVUP{>u!mR%$Hne%w$OZ=kpwp27;y5 zYDOHju`SwnXI==1tF_PWHCti80ITd>1iWIMWjrp9d+)d9MRI%3Q5sS48g&MCtO^Hs zIf5X86zi*H{dM%E*Q2iSN{trtHZ9HJ%Ib?bM-|FXC`D7SZaW!TuyOhKRX}ppKGWYW zcfRe_@|@F+EXC>^-78g*R6k1E_y_gLc_#MXU{)%|{OtIklOZbU^1M+C;It-sp*uW9 zw2%sUwp^WtiX)547pq`_sRn@Y49Zw$Xv+ER^qX1@oXf=)nPO(;)B5@A9BYoQOnGZ< zv5D(5lOC(+E-m_cc?~Wn^5NQF$pT8|x@>)wh{)-?zJ9&WN%eg-`@Z^IlQl*HH^qcg zjUltdBlo+NwET8$nC!n+B3}9g4*RgH@UuN<&)A~fsJbBZ8yFEnNC^z4NAtI7hhnPmcsj*+7=LMF{Z+phVF@W>+h9g zwYCOOTWs2?Un*O9EPbuib%AOJMGfC~-R^OFCm$FaN8tU^=~_wXykTJ=YLXX}sF}@g z%LV|(*!$tGV3nK6&OKe&YlOi>ObaYWD)->!iC=y9zz(VmnP~Y2JP<$}2fmD25Fm=M zlO!JddCDZbXWb<$tQ|B=f}|JQr{Mlxs-hw1Rf$>E_Bq<>(A*Syw_LQN>DIpPyLMfR zNN#5R+L)D;roNS8wMskDVA0nrC{sivjtAu)mReRKN45G8K5G4axp@2}2Yukd4gKL2 z*8Z7X1dzzV@d0b{;H%;B-b_Ako3-7SBx{jk81n`4%r^cah2t1u1&E#LOH8yVjR>h# zxpjjeQ=oXRQVN^wkl>Zy?%y#rNMb6ocrv{Sv9|AhO}r_J%ea@2iRZz8RPjymZpvVXx5- zy{(JTZ;PJ32jzcjhjcIr$BJS&&K_5J(xzoz(56Balk2&c^G;G%`T3!g5QZH9u9(Nm zn3nwaMcy7*$#sai(f2Vye3RGSOAn1v_~^qA7<|+3F>5T+f@=oU3E{k1ftE-o+2VmM zpvw@WzIm`{YWSAiVV+uoldrq1VkayXHt=P9DuAjLc6VcQBin9B3JOUeqTr!XiLr9I zdt9QgYtpEwo?TZ!44?&2x*J2`C}MXAyjta%avS?9moHCVsx9-4@h05&&HH1p1iP0L zgFHYr_b{&?()GuXaygrVR~!>-Ggj6OAboD&>KxV>(BdwtLwL`1x=vQHYmAqX^VJLV^N^?JS+@4kTj#*pC5 zeHm(fa6|C`m{4nqpKjgznTiqd4DBByOAxd7mWo9MRzBSp`^j$#Y(W%^Gh=?*I4>}H zdIwGqKDT~@>Eup=qLxv}2;ZD%P@FF}?aWndthxp~4)3UARAsljyoQav!X5i$(q^)K z<2+*{yxaQ_*Ub4I`I$FnWgGXD1c~w=9HgLt<2->ed*GCfRL^n)N8JMOR?O4!w1xJp zAAFAD2z*2OLqPY#;4cpPduj>u@{TBwYt53&q-|WwD?u4!=LK&Y6lI0>EHbujg76(0 zDwLYG#`WdhENi0r!FCvg)7%-E8l|~(E?b6ldM4?+K3hBn^%w4n%{NyA^2@vT-%E{e z)^sEw27-=!Va_z=i3myunBS(JUEDpH;O^|n@(gvNebskP<#loq&ScxV`i?uv#pDB4 zRSB4Tl*CY6pu`d_%dEWVg;_hdeVFJ2QiLe|i62jFJnNd-+8Dw?^_V#QKT$nEmN} z?|O0b-wt!xrvv0O8NiN>%3mAgeM}w&_>?%p%P7(}H3raYnK`A1{%P?&ejexY4bVo8 z5+lES>@9is9p?0p9&cZ}wML27AwL|SD3E3O0D&`17wI;i4>lO)*q6Yhq-cnPGr<=} zc`+*t`+nF0J6L(@vpG^b-KA-iZ`AkR(C8>6H|EMke1Mp7w7msf+uyb)n&585p|}<( z65NV=aVhRW0~8Ao;Exq44lP<}@fLRv#iayq@ergq1SnqGb0+`)otbm)nS1Bm_ukA( zva_;f{r1k@`6OB2C9G*hS9_{Ie}x=0bhgT#LU*LCYzrcel>VJ&=N2mXc!->L)X2XdBV2BFn8l}Y~sm%j+tc;7I(xPIBi_7}6;r}pE z{r83auVQhc{;Jc`!UMa+MRUcwL~~_nQGuznwAub@_@@FV3IODa0sw&QJTCDL01V;s z{ZF|}k^lfs6sGR~nQ)@0fNa#2j%-xg`D}l62eJXVvH%zjAR84<7VxjS|0(#d4*$i1 zA?m-_@&8)4KPLcW1K>mf{(q1b;6GRhF5mxmp+KGgWHy*1|L3-8{dxBP;{H+o$zcxU zpG`nE4F4~L6NRbxvjDQQ;kiV!0oj1;-2B}9YyjgZEu1JI+yD4H{M$wXx%srH0GKNQ z^8m)tY=A%M->&%=`~RZA{yWj)>e?SW5Nj{U?fL!BnaN97&mX;I8egt6ahl(Lo*YL# zHQGf_ecpx5JbH4>E_`oyMA^QK9?r3IL-<(c%8h4!lj`O4Xg5&UE4+<7N9FgR)>Y99 z)(RKVjpQ}ZaXiJOnb(S{tI=%6(wRc5f?O%M4x@_qDM0$5#R{wul*V{QH>*usFw5dE z#iP3jrCEQQcXmKiN}|9cIsVGgxy0i;@+fNFfI}J2+-s7b)%6c&(s=I^$qnT8Tg^4% z6*)m^U?2guC}ker)wt4`0OO?peNicn?tANtX!1AP!Z|APO1BwzX`G{NqhczInbdpw%ZKOW`(I-o7XY<=m^8C;}Gg)vaC-U z1LYl6-}yo~2*6=H;OIIDG`HM@de)tYKwe3npoYo)lo=!wI~(`kif?Yu@7%(o*p!L* zx74w8pD-&0`O(~rgm>77scyRUc~&2}3{pHTzpnUbAeW+f!ABnnJ`?VYzI~;Wd}Gk; z|K;oMO}3)qv6YMakG=TtuQcJls~yAU#E99UMJ%?6?|q<+505NKB(&B6L8CA58XZC$kx$hSf${PAF zn?5~V_LONDmCs!ogKk|GZ-dpYb5?C)*p~YV*ee~4zUlS7jsu4;7rj%Hm7p7v!^+o> zA6XNlEGhf0M@%@=S9sRt&ahL3P4XG4xSh!RDYATzVJm+x2%hyz(rebI6p7 z@M9$=?#8%TP#-vX0fRKEC`4{&wpy-#P7o05a7hUq&Lp9Y?5NesWlk$5ruNLjcTh;6(3 zrr7YrStDi0fy#zCTnn_5e|S4?v?boHICn9Iw{W0!ALO?BLbd9n2G-wfvUHmp44|d6 z&yiu&Kg#u4TB0_T_J@;d4{l0v8QUoQK;`{BtozBf|f32O|CoAJ+ zPh0j54{XCqOb9-5*Vmo#y|Md~)Gq|{t*H?}KgkQqY^6Jrh6EJW70~MLQFIEYmDI$p zcf4OVLDc2Xl!By3N~8EBbg1Bw`pj-C8#3Hf>nxjI28HT#8@>J6Xj-#!sUju3?L zsZOXcW+dFdVgF&6;7SmwLvdkDfk~G;LJ)ZsC;x^Wosp2K!t$Epq=fuq3HgCxJfG^E z3d}l@;y10jv>Xp zeE=%}5d8rlUK%Bp-V4xHi2`JOc+EwPr505}q+~`wSH=YZ00EwI4l=2Y08C&56E;$y z5}#o$(Sd{(kb<}tXo?dBFpmNN@S^ad#EBh%8OCz%d_bj=Spb0MEfBZpEL)MJPil9H<3kUcJdIK8FauJVs33qCcSd}avwX6LjCbhk?XtDFOGu} ztn(zB))k}3R`0pgjpSO|AMf*D&Cchh$H|uJ;9>>sX!iHiuaO}Ir3IiK{bP=0CEY!R za5o5eaxKs+gyGSQuK}x(vYAw(V%EwAaRU~&5KKQ%h8JXZ^Tk4vs@($?@;L0R&pwp# zhnBoS{g+QPT)0y6ntkR~VMB8>(P3M+3)0vlCufkAx89N~mFCNEDCy~2g?7^qw?0*K zI3*6p^I4Yz9z?NUZrAE>%vTqW(-hq5Y8UyiHG5>PO*uZcGHxW4^^7! z$D1CFUVw<(5W8}k$&;fBI*k%9yw?Kz#h8sqfJXoT?f?L0o3NFzl?*XY&oLY0hk5)f z`Ca*Z!?bgo@&d58(2 zPYO~n4Om&3kJt*bQVIY7k3*aSwHPX$asVR$@OO)wOPyB+iEnBihAV6`jCk9W`M$j7 zP{69z{bhzzc9VWgJL$e6`AM>JUMN!%qA>t5%A=trdTy2KP5+Jd$tTj+613u`UQWwv zE@ehdZLbAhtTr*3zg}MRhB#ZRdntK)euYp%Xi_y=O`RdJM&4ddZCNSS>a^8!br5Y6 z5ASlwBbWB}$}bS}e#j$FZzgR?RRN7uCZjfI_ixT-?UIgWlr{Sy#pLX{yxQcjIQL?%I`#E(8KlgKNGP>5wS2j9!ISnYq)Aug+v|_363*_+ zrKM%+O--prb;)LorK6?oO?9QKPd?VrFbbunST%X3T1j%6yX>+PGa{6|Qyu9sS{Y-;t7r(rki@m$!wOP2a7PTCWRo z*?ZPELveM%G1z8i5=y}ABA<0#yz2JZkNL3uB6hV_H=fUKeU&N{)xnPZ!tADZJ;B|0 zbjj0?qT4a6{wZL!SpCt=5K9Xm8t~>t=?FfQR#Hi30J!G+rQU3@CaeRwSvdFdLSBzT z|FNE_WeyE*#63!etWAm_EJ4cdciq9(9OvXxPZTAOewSX{k!pH*W>l8r^d(#WV_CWW zZR0$<>khOz?-CXjr6;*N!$Cc}o+$3L|;>ePyY6}d%)SmU` ziu;|=D|d#)f@Gm;J4$HH3{gbmvpw@o1AVoKcWY1Ve#lK%$PV$pP)aMk7?$`IP=3dp zknn{4521VQwy9n84Nk|r&0S9tu8QT!#`>1RanF*_1~h4Nd39s52CZoj5&V|#;Gv_t zQ=P5$G#|RbGC5~)MV___Z}DzBQykL_%W3mbFbFsIq5K3oBW*CoKI^0VJ1t4aRk5sE zs~DLgQ%MB9ePhI%NP2BN<_mfHl|;8%T}biOnf6o24#49AsC8ASa*LF+y zak3(*gFUc8J#s+1`2N+o<|!R}zy_l}>Ae(kvcE7Wswet5c3n$7)to@JlIrnoxj{fe z=YGU(*l8b?HnIrwVU<6M3IY>7f0__M9o0A6^de48*xZ?ZvF$Kpc+{f)guwZWujC^J zjsb^N?4IauOUuV47;G}8zjjz0{=Hz(wT@4;cMw6tm@}G=&%DT9%y_6wNkK{VdLo}N zo6jZw4Q{4WN@5vqd{NQkcwkKMk0N!v#MjjHMXsX6_3DqfjjZ$It#NCgR9gv_S(%sh z4%u!v#=QNC(9X#fptdm@`ifP*}^Qb@=G*v<>35w-{06xV@8MB zA0AnSj|_xSWz7VO5(+)c$n`XkGc5p%2RlP0;?LTh=dx_WEEH#*L@;g?XZha=V>7t5 zkew63-dWDZ+Pv?p+8s@tAlw2W={~2zT(;2I9(374C9A|V+Cfy^BDs>NXemDQ5+zwN z6?j-ob+;`XJb24}6K2$XdQ$ZIEyW^Yx4EP0y-cH+oWQKo5csm7J`m@jMosnO{E9m4 z+hbHf7=>EfcdM(4A*M`F@=BaUF`ix|dd3=pTpypT4n4IREgT-0Cq`UPI}^RN$S-^& z0!E`-xzAuLXIQkMxrGvipZ08Ks*k@6ZA_2s2h-$B&6pH0ok704uM}vOUZ=1!fuLeD z&ly^UE#LxQ2}k3GJJ*?~)6A5v6s(Ws!;PrEo~{WgRaSzlHe|ImE%)prx~f*iJ$aQ3 zh1?-3>RsQrF0vqK1w!P}q8?GMSC^r1SK4|>Y(=!e#!Ftw-u3C*Mw^O#yS;}FF?T!o zmchhbx$c$5yNMRofay0Osfl>8pLTnXp03sV|%vpfpOnQRjNNd{ z>EkKc(cVzbr%NuL4(VOWc_60u9p1UjZV}6uT~%mR;hk`SbymG4fe6p%e^1P?QlX}9 z${qiN#dhfI-~7GLbMuNqr7B<>BBQ*@&b6a`Y1rm1*XNujNJ;|U9aQgp)z0M7u@<*? z#Hh(+E(=9=6LHy?EbT16ZNI;WFIm3rgroQ{ao;@p7h-rEczH-y`VfCQBts?F902(B zXtzMb*TNe!?ISU9#PDbX)L&{Dk-6WnSf_hw7wFBP!O^?xJeI51D)rIRwXdl7g-DOhJI$V)`_TK7qj=jZK>ngMzPX~ZMj>-c0CACSC|MDw7ed^d>orzG zb@g?{b8#o6fC<2;%~hf>tH9=sdKWVB1BqaLwLRlyne+^1bMI=A!LdKSYUO%VZFUpt zQ!wmm36VUkt2%uh=KcKvQvUl$0JPTGB7YqD#O}7~>D4vFHglhF6{WW#42I_WoZLJ| zd;&Lwt_Jzf$ik=JVzfgSZ7Z)6J2tX>SE|a_#9(gOf@kdCTr-TTMB4&q=)>qqJNWr$ zz_3T&y5X=%>w}i3r-K3b?cd0YgG5hVhcOoTHS|}gz#@PBLt#zs?=F-3#rZ=DUJ&Nu zqP40usq(kBHo0Zv?N`>GIj2v~I?OBMtDe3ugn+>s-<;qJcCBDWub6a#NE2z7?X}uE z2uESl=P=L)eql=h_07Sg&%RqbkE8OJ+9ICti4(gOk^O+kN`~1>PL#>2fXEY8?-D0E z>XfMQ5LQmRR9<{u{2Ylkvwb~My~X4~|BxnXUU8pdO^S zck##fC5FQcr+Xwi@)!B~CP9@0#pMDb)?G&{HzR1}u2Aplp1cKDtPI^8e1hT0Bpe;a z1#a~nxAds_w* zH)Udpk%%x{VXAoUck=0dReyY)e zh*qve_36st&@yu?Iy&Yx0{h?n=Sym?u+Va%r>eb}ojSwpi?TzpNCN^jvh!f+#X z#3dE*p{T3}gj|gd_2xXyDc_PJ6w|Z*@}B2*WDdR+t<9Q)~`S1*+n87 z1DqY$VBK$CuUfh0~RdI3JbTs62$TmvkoGyf+hp`p{?^NaoPhq0=+YkpdMx<4)UHi3lV=+GRiAUpJRq*BJ2ig$MmHl4x`!p0Rx3|%i zcRm;lk)O_?u4f7^>FL{l4F*Tg(OBX4hPiy!@OG%CG}V47a`VgRqpfvO`M}Qfp-tOQ zH(snYScg7(uUDr-)2-LbgAEn>`5Bg(9F2(#EqeF7(my_=Oy?Odqw{mw=ieH2xL%D; zW)dL$cCHX(F6*Is0>j{4`BCtr7$-7Njz&-8t3jM8Atdq#odl| zZS1Sm+^Xf@1yX$SEh06w>yhj5A22aCFDO(EgU|`X5dCAF8(@V1ObUCbT9&pD@-~*P zSKf&Uqh-KvqkCx<0EN;76BXEx@=3< z_*2V(GY(eT;}HXUEkLbxd?-(^J;)dU@f~R4 z-RVxciS3eehlfq6Sm~mkQeJA{{00c2n0GB8L8%7C8j7joxjuG}xoFG7)2mr*10*GNm@nA+| z0RWf*vw{E-?0))2GvZ$t@Xyo6!pw((4M4yLAjK>kAdeB&{|}BBQyT?PW&@B!0RZ_JasN9a{3BfPBgnv1YUV6r zs~8U-fhBJHct!5i7s$DGgMyc7L{Q!r)1*b@MIwAq<)xsf@LN zsY#r7ua=HTN1G5-K|Z=`=sFb-YU0I_h^gTZXO28LT$=%*qWv9%ytcvm_e-**xGEkCZdyT8E0bv{ciX0R zIZukdTR**e_|A&mt8kMtDu`-Lj6cW&0-v5d+5{f?9R>fi!VX8c$h%oiC{K_uG!_l% zcGFMriG2Ox(WQ?SG^Cg5!plIUJN?7Ce=8k;HGNN3NqG!y38dHOmdw3TDd{ zo!-u2kmZ&7c1+GO63WHQb`23&F9T~kv#j$ps2tD)F$9yNz|FD4u=omlj-IHO!0?*JscCjE(TVIrjc+sNL#5)J5tOdi^1n zII`np252lvq-eJw1>+f#hKYy8*~`mJFW3XCYD)#YmXglGwouYt+~j<1g+8}7c2CAV z1n`BxG;JW3FYWquk|K=$cwr9teLi|3nN#S8m$7X(?+M(MU(55ImyB&Iv#>j?b~)Zs zY2##95G)y;G$x9$=|{|1xJ#YEE1oicNVI$E%uG;nqd3!|gA*H0Fb4dQUjtiB?39jp zZ^R6rJ7g*LTCA5#kKsCCmOwel>d5O@C&Cms^Q zz7-o!!i-Jf?mVP{B~LLM$4n8cjAL}x(@qLJLv~lAj8e7-p{p}>Z#nTm1=SAw+-VWn z?+K*h%LO;ac8cu=D01!HqNS9*scjc%-?K;_aE_3Nd{I~%c!-=@FT}GaQ7EFa>bG`# z7X~FQ)htkbn++TL`mFv=k8{Dk(e@z-lpLrIpPq~;p#wqZCzsT;8Yt==o3HGQoA*e# z-?kWWYNtn7H}QN5I%$=uLwUHOk7!9zFNaj*h126dOv&;o)lb~O)ecsc6vp~a31Fj# zROu|t`CeqtrS07~>{!7`hKWJb^kU$2p%spp+N-ObFJcr{B7Os!yz;+e+*k5O!!Efe zq`y+WaV(blCVp{3Zk=QBh1zxGrz7cyyFnt5TxFgAPg4%L;)~sq2T=Ys1fGV;(E*PT80dO!;q*zcNhvgJ(7+iL2&5i z`)MzzddH8|sI0Gd8-t5FJM2x(2gpT7gy%o{E^XPCU6si>6VV`V-}%`d?A`_qH@%8D zS>d@8ubdLyQ&z~Z#qaB^$**f4PB(*0v2b!k#C|ZMvs_QRxi5NpPjTP7p59SRM|Bkh z)0k-muHx|SM20Am9&^&3Dcq;LkW6RIahR1ykWTo^c8S{G(P38VhGkETqX5dxo zl<@Rx49a)jX>K1q?>BX0rRp_2@-nS6FSHKrczBrCL1q>7{CEdxrYqIb z9ZNW?k+5Np)QBH>$OR^q6WHgP#`6&C^x{%rPD+ArWJ4r)ul{(lI5!_Uch?p!wAa#D z+t)YrG+vBZg}y45A)nXjD04CKMWuxS<;Z)lZrbjI5b8SK@cf3g4zBm z!U~q6^+Q85PCBHYeOp*dB#75wMfBlUurT7}*z3%vE3c+?<&=eZZlQRAeX~I_xso24 zhd29SOV*Xi>-#xx#U;X@_7o05YzoFs?jPa>6jV8zrf$8jeoooOF6}Pa`=Rp~q93E4 ze)%z?u)F@-E$#$2b!^Si?qOm6xSfI3UyXKh$)$Sy39>u+Qnx2KIAER0Rk~BV!}?-%dSeBOJRq$}| z8;`uwYi|?0{vdgz?mQbnlWL*Jf3adnuFFu2iC!hz_xQaC4<6mh4ElmBfi~j3L7@n zG4+qnBunR)H~ef~K=MkM0tuop{3o-ez>Bvf3(7=j@gI3FX3G`=$f%#$*0>ZcPOvHl zj5@s=g$3S;p4glG`1bhfD_PE~N`fj^xV^%0b~r-mNKq`-yGRBI1wN+N9phiomU`oh`gefwGBTxER+qq@zqqA z4%YLHtY${vWI+=Yq?z#)KuJ_X83j+{Ur;vypU@XrDOpUpGWYv>FypUkKFe_%raLcG zAyLIIj@L%XVv-AFMDGWp!f+05pepJnUQ1oG$Hig#nQkdl18)j5yxriB8V?p9Q%%Ya z?yzjw@iy|3o3utBZ$Dn+#Ji)sT%VGAnV@B292LF1@QGMjWK_vWt3oC4cFgXlyfDl6 zBGtO%%o`{>UV@5bw0`PP`8TQ`L!8AM^e6zy$X7fS%&mwUfkyncqF^6dG5_=h41 z+6lbPmi@-CaZ_2j9DVu)*B#kB6P`v27KDopHsLHGnOZ#Xd|+wT=F|?4$r&BG4*!@? zXST>{5XR5(>8t}@AWhyGz_Lyna55M5rp51hp>%{YQ^v*;7Yw9FUG1MpMwk!vcLz8r zhbbTnzn%*o#9tRJ;iJf;RR(#Bnd%nut`g)4RFpx&?m^#8z0d>sYV>+kn~2bocV6l% zH7;fQQz<7_=KF+~med<^Zh^_NV1aj(L+$93cliBR%Pc7cZZ;!534u3oF7S!V^LOo) zMZVBhTS7R>q>ndD6(A>nnTe8yd67)m(|9Iz zzXKB0D?ZHK&QV^eNmo#2@@#~tp!mri$apo|m6F*^x90LJ-cw9)w!!ayUvdI)`ifcT zf+aFElE*jO)#|O7(rK0?=W4_?oRAwQXx&#uNIyVZlR5Y&e%KRL6$EluQ$I|D)lEUj zH-DnAjOR0X%vcLyW^TUSc+C-r)n@v@^n2HyG>5v;#X1$jNNK%!Qs?D6R$yM=m*1Dj z+P$A-`Zp9FZgQ2GN`oTulTgrGvm9q6OzEM7157%Wcs1F>F1NNd))5g5+zNVwb@GSq zDDHxsbM%>i#<{JO^W~LV5#JR{#yT2(lXEE_{=~$wbi}1xW&5(vH%y^O=Q(ayfhG|F z8wK{AJ6CX;foj=Dk0L#G_HVts^j`A3>WvBPE#>`p5f^q*D!@d)mWdl4e|Y*y&1zfR78KA`S%w8-dB=bRLnb;I(LxuO|s|vcI$j&Uc*< z>#toWKNzYlf<$|21+)0`ODpR_3A0S13<)^5C6^?SOTkmzyBl&20;fxJ0jt5b)7Cw= zgHvn$-*ef9E}yP^_Bmh|L@alpeL-aBOGVd3wU z_&m?W`Wc0v4H9*h8$SyMKYho>f@WkpI zn#0_?IFX<9n07Xl1OZQXMVfdb41_(OL&x+_Pkz=SCO?EDZv4`r*W!HDdJ$14G_mamSuQS9UCbPE`@Aj)2A^2oCcncS=GqrGjClbc) zs6CjU*-$igA4#K+&VVVwNxA z-iRMCZj?W_{Oxlxfi3LY#?YscF=qiA(sI~qu^f`5WfF>rD^`UV8^IsZLevnKouO}j z`gAQ_xt}1j#Y&#Z&{il{t_|~KM?|fC@W_6CALid{Hk#*WP07CT_oO{nhHr)42{1T{ za&kWR%&qUXwo1(BB?I$VM{ojlLr+UJ0S)KGdbh3*l&T)N%;E1hFtcqa7Z6Bd4u&M| zBJxDh-21pPphLh>f|;dE-i&ea0$>4o~K+&EXP#wJm$%t}PeeP;>4vCYb53O`>XIa<0F zz>3RUyRCS{c?sB1`?br>ibtX2BQcdSRE}New@DUDF+_Pdi<8vT-Qmd=P(}Oi$egts z5&z9{8h^ZM4FW#_{)trjZ2xuYSNWn+DivQ03t#JvU91t5co~2so|P56LLx6_Ix5k= z{P3Amm^GAA2RLsQp>8)-rC%+2AGd`1R6Rpf(SL){cob<=@ z+tCEEJ=H7k5^Uib$eopRo}bJQkaORM$I2yAFRwnM@KF13X%}$Pil*z`0DJMW1OO@0 z`>C=Fe3JYGe4Iw|&E@a2s>drrl-ne{2la-0Y#0=BgFB{}<#?v%VoOh_x&!y(pe(2D zt7_v}V`*DVF6~RMr@hP6{y(NwSbl0yaKg8m1ct*Ch+d{A$Q)xmNHxfv6KGcwo@p3> zkkj%nEF$Fsq%f*7o&*{XDPJOb&a*yFpyE^EN}rw^8TXmk3Gv-jB-;T-y%cQoo__rq z#tsTFTH6Npx+hhU%MOeJ07zj_v-VXH@+bg_;GUW20Xss~83bjUi;6gB0+|XA`!ApLT+;i4-PX=u*@>Ym z^yab((6+PqgOhpASyA}NX5_k#bpe1iTyd@$J)rDkgS~Y-Oji>!HMMhbd84{@@VkPO z{K?&`!tc%S{6b2Gx}?KQ-ri5}iCf?Ba09U3@)L6#dS&W`Z3-gFp>u${DpldBFk;sRwbB5^2 zWd6a5PIqh`Cq(;-UpT;FPp^~3W+Y?$Tl05mMb_}A%=uY`LUUa=HWOOSYv*_20G?#X z8*a#(i1RzZ*idX2Pm6E5rb+R^6uzKL0uj9dc4*If#2=oCxd$d0&PjriBNajoakZ1d zr}xag&+fw&?||p5_}fmr8*7}bpCga`USI3wEecF;7j>guPXu`gfH4F(Sio&O^d2f6 z?25SC9?02wBj^bxWd)Xr?eQvCeu=CJU~$4xCKGgYok^6&M_KKbE(u{w(s_Qn))Nu2 zO{xQcGu-2&B%v?&msv`p1Kp&+rAWUMJdtC>N^}ffQ9kDUb&z%4X+-~=^W`plff9Mx zm~n9N1AA7+LZZQX4_*s7E-}PlMuui9+`37#7v-J0X}gj=8S4g5LQN1|o^)cC2YV+g z0qV%EPmYuMLb<|2XciW#1as3ILlr*1`)lt}k{jGUOLO*={CohL+q?79LHnWMfJSCx zm`j!~cvrJN%uS}{-O{^*qae9Wlb)@w9|h&5FJ@RA$$AD3a4us)!csi znX!at@&3VsH#etlIA z9Pr^ALGcle??@y=x@7%Z>})^NENR0}}vT!aXin6#xg$8Pr*0#cK=S zw$6%M*i^dR@|ADvQ|Y9jn?dr*QE`!v&Ia&r$&n3X0{efED0A!YZsEu4t%+7$Wuv7v z_A++*OMIa9=m!OsE#Ns>N(0=tMHCeaV3u6Qs~wa^vCnd&e^=c+Kbr~6+E|C-<9GY{ zz7>Wy!n@36p7Y|-SXl&8JR?u&#{z7e?#@w~cHpA`iFo@R`rDTeVg#cDKF4>z@Yl(_ zTX?@|`-S62u>r<8#i3Qby|)%SU5br83soV&+f4$@@1;A6S-0}D`i{?5fx1O@T}y5; z92{yfA{hWoZ1I)*y2Zac{Z8~I0=ozsV1fKS*XO5w;N3UrG0bjfxPj2Bkp>pA$NJRo zSNQQhR6k}X^M!5WH-a7F2_FNV;x$G0PB`jVxpOu;ba}NeQX6Nvb}Bw>CQ9Mkt_M@3 zh6I2#Q4!~AEDBYjG|1HNz7!w%S^~7QdC+965$7)91jHf8^#P`zi42q3EK!ME;LXa- z6p9+-O;++g0vj^F!X6u|FPywFFs(peNaLDFjXcah_XU zm&I<5`H$sSD%=%M9eXAEGcUvE<01Z2?|H(zn!NZ1_M|YwVP>=JH@F8StBlR z!s+Bm)-6Za zV-rBk-Qw^`sGO$&>;c$PSZxt1FO?>9Qdj|_+fq_$oFdwG?yPo*ykgagGaMpe?$9~U zX~dE7+*Ha)O{bD7vO`KbJRbcRBzbH(;KX=lvra6F22fvBjO;B`TAh=(o#MoH-rTRe za~_-XP}R|7fy(0&-iE^5jKd`b;C%`wXxbQZX;s?2!h}fVYS@e|fDIpsgOaGp+xEwk z5J(S+I3GJ@yxxz&@#=xPeI;pMiZvQ#0lO2kHVPGHO%teBqSE#-35q=1d$DS~Hffyw zG}DzS2@{^W#A^0Gi`Vm_U!bZbI{w39DRW!o0e+lcl@@zhSJ>>xTYqxedLP2UVJ$4xQ+Wv09&(20*CRY~;fAJC{07%;q%rL}0`{G!{r5k=!1@mX`G#a1Rd zg8CyLF2Ph`OB6Om-;aq#m2rgs&cFvOMYi-u@;Z6t_$QVZ1I3-e&*zT2q02W9D=T%eSmVn$ z;wdTkEddZ~o?yC!mtbT|JbyJ|fHmpCs$61yr`>5ph~Ne~I~Lbt43=wmvO_NZVQERO z*-&v)W!SK`(DX$71szL%VXIyHhIDtCDcZIozwg7-4n-p27@-~JV68njFeCBl*lkr1 z;&$WLtvpN#dsaD#{z)d8_tmB3)Y8}= z*02$rASP|jM0C9xUGqn~?|Hqh=uDaVVmjwT96*)yoDwlNHQ5y)>DmFZ)tHURf-5y=z`-C6I}VxJHa`_fW)_j&`1d5N zIEMj3c3wt*mBB2L622@-qxQATSn`p|vL`Ag+S*J$+Ds6hEc5jRF`vD{Zl}Udhl5=y z5XTy>VEX>0<6xN*PqcCcr}jr1eXKr6k4NQJAv8b;*`~7vo_gH9{S-{#d!U=fQO3pP@;{$;C`cj-GrT1y@J@+@r} zN^UAG5Or#nj>B*%?hxa8n(Jh+rJ8Qtg5*-bOUPtE(DN0pxCu^ADXt`bu2c>x-1Z3^ zrAhG$B%;#?UD!H=Q!y!}S0_;5bDV~@kP?fRwr$VPGdBr7D3JY*tbt5Eua~H|3`UYp z^~B~mE%|*)(s`ZtrYm?7idSGAAYlDm$hUoucfu#d9VO zMzLUEV26Kj7>GGq3BZ;Cz*E9N&%+pq`d^^ue+M`x@&WMv1yTP`uyrga3`G4e(DT0o zoYkoRS490k#@2zN7>N2`7Vz(;&4B^e{}oaHkFj-PL@fe<@u@+^0|2YqT%L^Dgi>Z| z)nDJ%tY7bODFJn%5m9lwjR3*+y|^k<>;dm0LFoaP~)plNPgPQ~z(I`ohi2nsrRP)zqi#*dHd zQ1h`xl?>79Rdf@A!Co%CubBFS9?yTP6 z1yhjk1`FEl6$Km{q>pM@H_yK~3;W$+s-?ww!Z?RSiAEuYBl-q#oh5h995zy5hR%a& zU#dE_TEey2(dP`Q71dy{V|G3$j}hbb9dja2gmHYY@5h=4^5#e9dH}fN!Mhu$9jXJT zH31VIt}loBiqgQ>#~Y14$8RkQebv;z6=suqh%A0T{az07km*)OhSZs8uk$=HIq0;2 z#pidh6lm61xf*xoD*?pU;Cw8?R!N_E{huRd;8k$N+w>*R@a1#Q5JLspf`Iwwe82gm z$xe3y%k;p24;?GfpIv(u zm%iQFy7c9vgovddF}9=qe3j?&-vFByZ=u+*bCmNPIc%tnH6m|hc|@-3CIl)iXWKezUsOd76H(v-`;j`nu@joBZPf6CLIUj*zatTe|Fi!m#$39jVcQ zP2U3-^+4W_edeH>GY3>q(N0>od{xrn#{K!})rO5>PJQr25_PmrkdPW&E^&i+>z*&q524Y4 zQEa1+RwNhlq091GciHD`6q;S765h2|4K3oou%1r@yxuvfB2Y3)BzmwmM z)~-^mZ6}aL^b82yz8N^G&C=ct|DCemX_)YO$q}?zW$(_BW@3Kf^!jUUN>h!y-DJq` zxG?_trDTa!c~>;U%-UfQx%cDrW}zv{bjs`ixiXCT;d$K>)<>57+QlE$YwCa8dA#@@-imRwKysp(GW zn?j46Mor2Sg@sjVv~!P-$hwjI)Z)lP5Ts__o$0U;TfV$F+6*SQ&V@$zHOhSse}r;_ zAeyZoo1B7{Ry$g}gWZ*0tU+nzPBtuhI$`@S1-WX{n4ci%S7jWDALZp3XecuT*=Rnk z6Tm^#*P;&;%s0-+gvCyJl4|Q2#6o*z%CLC-Q+CvcTZGmaVp^iH*V+%ZyM1gESnNPq zUjBmPGlLgX<|92MI~rvTQUTE@7LVYI6a8ejdOO>N&}6gqaS80g^6u@z?x`}W{P$4X zZ}q>VO#w@%D7@ zGO=o+>@=H3n6evBJzaKu){u#dh1Uz-b+2ba-o1eLAx&trm%R-7hOH6{B~wa7&jF;I zP)VUR%DZsc@b#tIO6=_?CnFVS2%u=OnQPrRWU38p5y3sURa2g(vAP(`;LWZq5T~7>bP5CodQXj-uE-zve1sWBx0=xp7HJul8>yP z^NYjpk0>6!J{kB(&hXzDd#j*0{x5nE2p-&myA#|cxVsH5!3G@&Iyi(7EWzD_yE}sf zcL>1(!$5$*KnP4=fI;(Jezh-K|E=2Ee(A36r|!O=?tAV%_Z;)M;N+9OlWz;lGO!I@ z*jXuY^uP_)I`}Q+{(OEZnv{`CuXk6<5jtv=CZ7?A1q3(_}zQwmgrTFSwQ8F8!n-= zcI#>4x))T=W6xS#Qq%KuT3yjNDWOkxFb>~RpR`dwf4P`0jZPRL=^1RxKMd^ef;rXx zA$tvsJHr<2qO#dS<-I>21SRXsTXkdhXPEH|A%D9q+r1a^=Rr@X)bL~eX#5ST@J(&R z$KOn%)gz($t!HI|y`7BmVJ%;SmWpVWI)!82?uLZ{S>%P8eGKy5v+!P)CWLKD=EO$c z1q+7Ipi<8J+TI@rX2#vX-`Tr{51j7Czco!v71fy`C!Y>`XZQz=n5`5CwTnsi@RRe` zwOwopS|-kH`SNi`9UyuuD=mikmW@6_G3G8rgxx^ zLo9PY`Usv*5m7dOx-s|y+f=?ToRkRPI3JzCszcmfV`XadgBBBs!MKva{NsLP;W^{N z1EKls(b-MW!(Pqa1#<*a@7q8u+u%Z)tfn1Kmz(6f#V1d-aW_Eu9R3F z-rH;bg}K5T{)-_o0|gv}K_E$(ImmWOl-Bs@k)ERy8wZQa{7ancHk>#(80?`m@LnV2 zu&4tOEs%2BtHwlc@lS=47=7lVw;y(pM%-ce;%$X%4>gcP)ebO!u@p^&g=29!YjVR~ zaJe#aFja4csTv`ing807mir%W#py`LX|rk2`6CwXMMh`(j}rfUlq!zAdvO@slJn^t zxcF+mi}cOq!coB{JXC(s6H$GLBD|t|IXjhh<@0;}4(IHg=B8-IQFeLXv658_vC9_OtU- zSwOH*{2$cV@;S#I!Ocg69;!KRpKmp+g2jgASWwI4+r`M=hdrgTwz0G;!tyqZK!Ho7 z?0d(*se33-VYb>7z7B?OW$~?)G3kGrW`e4en~>T;EFt47qCivGz*k946f^_WJ!Fap z_hKRk8H6-gcpkBzytEXQE)C}VDKGXZFutS?T<|5NakK4fJ^aL8=?DlD2Ox2g45|~a zobHxHH}}c}7JG%UsFr-$5*Nn`#onW4>r6sN(P5H z#1IT&@n@umeN4#&0uzUbyw|K8jHy(2!*c$Jf!Fjm;jdwV@{^utlP~{PEWFdGfA|(w z7jq5}<3Hc{)7^O5ADWF|EBp5Fs%aht`>Q~lI#z_wR~ovBDUAs0K(kh2(EllJ?|b%Q zPf>w{cqM*NP2)SE3{fY|tvmMts_snGJ}%CcHHN0G_1%7Q%bN{E3iABCxP%!s)n)tR z1xty7@424)z7h>M!@54SEcaKRS$vAPuqnnbPlV(Y70)n^de95-VXmAsk@e}ypK^>s zMz|o81v88t4ewU2;zvIeOq5zMavsl$MMX=#GkEis#M5UJ5t6b>cCIqZF#}j)whA7d ztQvVT{@syGfE==;P*6Y*tdeh$3)`9Ri;=@=U;9lwfH?x& zxDNS=D`dOZPV5Ctq`wigwPVuETl2D$YBJ@ivlf=6L8`N|ha1eii7dYR+0S-^?V&-phwLO}V zM|KZhmW*|5F0rOgX-tjoee-+ztPFU6GNP}sN_bcH0UEI>hmyKPa@4NTzFF~R@>UVJ zC9Y0+u=PKIan_>iJscx9A|hR!{T#^U@(~e#i?wcCySKEM&-b<`#J>5y{IGpwEgJdz z9S<0{WU6ncfOf6P8^u@L@k0zWQPV&#Y6kTAywflkb6Z6;6W>)lFZ3C-x46YTGWco` zQGALrDVaLISc|#K#iCFOCT;!BYj>dxI2%*$(c?C7djYz*x+W8p@{7%r?1}WmziG7^ z4u!^LaTYl`DlkloFV&8|_*=5buF3OhXy`%mFn;S5WLLra5ywK4!oDr!NM`~lr&z~l z6xIOG=)MvB78ZW!<-UNbkWZ{jpCbtoiuhY0V9X^KQ9yZp&u~y^7OF&K*b^T*2SuKd zfYIv(EpkRX}ky0KF#12TG^mwfV;UGc1XhvHPi}kp1!;f2DbNT z=5lSL-EcayJ}CZBzsUc2_EXWRthg^v=!^02@$el|~MZ|mz zdwZKYk6{k1S?rkNQs^(DmuSZxF(y+$%MfW;HsRRpGZmiXzN zu^Eb;Qlii300_o&kM66%)2V%=ecN`f096}hKiOER6Y3A+{LS4*>l}S#_W7^;t8-7_ zn?v7|q`$I)1EKv}Ny)L2;4N=L&6Z=9C*L-4Vzz1-kWBEYBg2vWspcSTE?5lj4$Ly7 z|L}I7l|nxK_K}W7W$B&E{abqyb_{^0q9-7z6jt_uvHC zl5qDCm#5!jVM`_JNIzKi3Jt=}_Ua1WeNv`(?>ubgPIa@kjUISnhKdOGX)9JUXG}F? zC7^gTZ`+=py;NMnel%@rEmKQJd;?YPp|5zGRv3z~KAQjzc6L!pds^Tcyx7SXa9=Qm z9Uf*@1!>fs`M9#O?f6>`k0GCuzg9!3iREF&X(mviJ#I)pEK9JYoYvd=bCk64}T9jYT zCN@|X7sz>7W8E&IA6|?cB6gd3QXbFO5#3LLvVRM%t{pke148e;5j53Bjbzso|KypTS#dr<9pR1SmW|SSZZ+-k(I1g$w17fSn6Ab zz^gko7sqKGdS|u~y6f9(tB*l{zqYAA{Z)v#xLYy|?mOfU<#xqi4;c_EzHDbJs=Rb& z(w_s@p(-!~bygv-{s#Bx`Gc_jB3v{J>wpY;&5EOflMlGf)`t2Pt>S67uP5@W5mD(HUnSNHdqu z8!f?Rax)HS?a`|uK(&XdJ4NU5R+(eTUsP04qKRE%&ucF4H05X^pa*b!;`Qfzhi`kr z)RIyapq8$>I_7h7r8@p8zk@GVl$1wsq2|()+~8;hq>$MxP48TMoAh00KTEGW(b_r* z)l)QizHnIO^*zv>oWBWRDzZW6w=b|h0kEu`t>;PV(eV#m5RF4fS@nNkGfrTWmd9#> zjN=KFVG~|&NRJ#12mfWynBgScZ(-O!-@xO5ujGP1Qv>hU0Y8JO@rT|6%&uwxAf6>3 zxeK^la0kaERJ)dU!ZNhiI*pVi+nqF)-%?R^fxv$b`{=|`GzTdvJmLp+A!#<-Z^&-* z>(rp1*J{_QpRUNt#N+NXWd07-dfd{&#N+8Ko$oYXF3<3g$irnSF!$#%wqbj9R2U`F z!KNRcC{bGw#aUHvcBrX?uf@miEuzKWnNK8=E=-ZAOXn|L*w-tq4r?msZ)$V*IOMT7 z6Q}{i7HDZvB(gVxMSjisW$3@w6Vnos%%%FZO4Ab@25m!NYz}?^>3Rm8?C=@s9zDW45FkC(NLBKaoB5&Y5cGFNIl}diqCN zIX&{+WyvDOdhAe+n0v5&Js70S7OrqCPdWvec89%Uz32kILd^q%9Vi=b%&6K{k4f362DfVauO-h z!eMXsZ;{#(iqG7Cn_FcvGJ`8zO)VKY4Mc!wBR+b&3maNpZKa9sC#;0&`Z}_|QjbCh zk%8N%Exq3K_jZqP*&!SPcx~V|3(HnJ?{vLtVEqS>Qdhkd^LQFIfd-_hwqCfct1n5o z8ARE%V6%1p$L#|thm#^Yo#SK(>cJbeb+qesit(}P(jt7MtToS4QD)YeMzH0Ngx5mn zY&ZL+o*pnA9bJhf|2X8bBz!SDy8I;#Yklj#_^u^|u!FsyAt4d@sR+UFNuzU;KNhpk zf-xR_(hHS`S#vyXx-P<56CWF^XMrX(y0eqwmidhyy7j%FMl^2mhb`Vuel@n;No`%U zP&y}NBdSa~c1>I@ynHTc?6+F^>@-@m*jE9Q*EMKZK;V6xeGuPdN?pX#gwuwt9D;>nY& zFD~uiHtWe&=$RyvPovu=;i2v|Cd#S1-t`WfPy^PymE2r#wA~EpvuMug>uXBxS}5UE2rP^!#i#T=(#u1x#FJWYT*?tt`sCgN!I8S5GGWvMEMZUoKp%95EDhhVa?3bb}CMy1U_ann1QXiwxhGJU28SGv%qM>W-Vzt-RTUv@|dg$h;HgIS) zacFgJZR{IjstcN(l~0bOEvS{zvZ`ihKW*K%OzK2*KXq@~)&Fa+Yu$9{%4p&Mk#N+m z>oCuGm>7$CDLH>QVUeE>k&gn>{IQY$_q4paOiE3iNPrQs`}~|9VD6}AgIwgUe3ZS+ z_5z}(MMZkIpUubcR@sl4ousteMUQi}5Hw`|7B_+M42rvT(roQxHr##HQa1#pI=wkV zz@2+wPpqp2`IWjkiCElQ9(bnJm2P5IW56vaxue9LX$kR%yJ0&y1%_F`Go#~`o2O8>eJI5ABtGoP(vC0U7g=-6g6Bns)edohvMM_OjGRY$oR$STpatr4}EEll&;R1=hPT81?7IevR)AU-3 z%dZ3(_KI){Kd8Ey?hPD47GPhGw)Ki$FO*IC`F=hmko3cDcO~+d0{#^iwbCsk5Mo%g zGf&%_lAg*i$@8q*aOKY=|M-(eD%w9l6ddqzuh)aQ=#W#HfO4-;3XWe-D|A>U3eKO) ze){AjB)PlH<1}nMBgH%CUj6(PoC@jC;wx$h16!Y zKVFvZh_l4^6xzb(Z)yn}0o$v6St~YsV25&wZ+Qo;*0;#m zi8K`yI2qqY?&@6=4K6%8Wm?A0N6}G_d9-v0-IX#=hOth!^)Gr)=yBjp zdbDtPn$*7&ZDNP@uFEBmj02O^9AaPNqU02V$+8`T7RVZaTr~8&0bxATZx<)M+p6}& z6?#*aB-#txE-VnqAEG zUv=!{3Nq<}H@IXgmS8VK2k}tU%Et9BYLwp_EtUd+^|BM(sBHYUiLIjpR{HbvUQ-Ps z&(H^HP5WxM#^h`7{18T#`LH8UuKMb9bs&}UN1_JUD_T1R+h51G12;{uvme$?@_QN2 z&XA4 zk4z-3R;vMmC<#Gy2zrFBrZY|_n)~8)+L+dUcbippj24~a$LSWJCl7q3&mdj^H~q=& zO$tuou824>vSVCf)d70*gj7}t{%ALQ9OCo&5mp4Z_4iLRd-u#ELD$rr429H$EtRH8 ziV``0c5#*Ya9$5k(kO$Q4=o(bhV6HZOpEmG+qc#8jr7c^(!HN$zCr&*u-;DUgS9!> z`)}Bz9NTCoLb0YzV)xCdoV}orC17vqzvX(jS~(d z{#o5e4J<8kryN?A?3EeXCpMDbpj9^CL`_ZTUPHy(MqrcM7%@imqs7lGRg55!d4#A8 zBtKg$k0skJ;q&xf9=`~0CMGF$uebL(wD3jMTS`lzJ!==v_e^LctCtu><67)b|Ctug zRZwv-F6F9P@ zwZl$#byK>Jcb$@K>+gH_qH@($83S8Z5mK-m0}3xjIQjQ!}6t=OUdU>8-=9IOMU_u3I}ruxbXOp)}FvlX+u6W+QKN+;FMoAyMvy;p3{)*arJh~{SJ2Z}dxILgi(1L|MQr^+eu@&)5d;mC# zr`P!>HPh6$H_kr*o5MhN|p?c>k zs9vHxsdj=i*?NIYr5$JYjgqRT{lMMF&rLa70A*`JK-`)l4)AR733P#cyx)}+yp|5< z%D|M~z5DNt|J+ji`ZJ+@w^Y&Dp{?ucYX8`G_E07M^`wV>uJ_SDJ2dtcOS6Sr7`#xB zGce}J?vZrg!Nu-rV?D?`#L7UQLkd_Qg|AaH=KcNL#W84)KED=)6v+5ZU0t_}HIcO@ z4KMG1B}GJDA4M6SO)=-8M`|Me36RvyC#wEqQ$l-!!+A41ALOK$>Cy!=y-Quv5Bq1| zl7hT$iVJ$>vQ}v0FYer2tkmYu1-8+ZUiJ@=pak}#2^DX_b{U#s(4ehzttGwxYX6&h z>I%P`D-Hi|NI3%S+^^&fjrqwU)sx_GB=|2II_rePRqJy_fsig}ccsU1)tW)nJt>-K z`_R@lY)!4a%Z~PFgbc$mLHmWBr}YBpAMH>9Ai&&=hCVn_mb}k)$@XQn9x->rP*OkO zaJ0|aBcD^aK1e(G{(gY+=S1RzmAc71>fTG&c_t2M!dapIQZ;YB-NangS_YJ8ES57JPuN}q-`8MQa>-p*#BK1ew9v%v3UUYjQBHT_cZ3X4V=_@o1lcJk zj<&DOyp+s|x#4fMjfJiF0Gaa^D8j3dzk5q;p+Sm`AeLUS;4|U2v znI@xPo>onBepaE`m1u%SnTmFzNxxoR7$UEe5H9ANKF9>?=O z+e3E0NFZ`4$J)gGvsZ_@ZXTgkleJoV{Q{LoPU{cbsyA~>OUS=<_X7in?uA0B*5$@$ zinbe8=kQM!V%fRB(kDxQ5Jq?Kr_J>%J=Ey+kUwg7DT*Nkxd-`ebZI3rQFk>`kg>_n z ziE|Gkmjgl_ADSrX*Rl@hxp_BrWeL(7$EVE2J@(bBo;}2$1BZg9ogPutv3nob`R~u7 zKh1w3@55y?{)3UE$tirqjVZxh)&61i4ehrh{oVPTH)0(M4uLk10}`fBll*Ki%( z>Ge$q1I!Ii6Ampo`6d)10mz>vuRTIEPA(@}t&Q5c-I7T~UVDk~3j=dNx+_jJTe-RL zGvXfb`r)Fa_g625s$L@yfIK2}n7Sk?b(5(j{_moVZ;!b1 zJkj^|#$Ww;6=qaWQ2AmR3o&XD2n;8``>)JraR@0FFP+OIH5TQAhIf_r@Net;y7BXK z?A{FN^_}?(Tu4@Tgm%%_oudK-a;RnYi_Fxk)w09yj*E4g`&FtG>_T4|e;q$j5JPST z$;-MTI>>>A;=oMcv&Gm#=lDX`{;So9@PFk)ORuUH_}4j}1*R-Ha=uY*8U9Kue)53~ zqfkbR|F}v*)_sZT;(TOU>XAc{L&e<)iQA`WBIk4IQriBOgX0oj)T4LynoKi$@7hNf zk^aH(n_Q2xy`$@&C4Ay?QUYvaF?;??+JWZ7j9?d-tbyxAA)66i<&5KNWmOL-v&tUy zYr}pH`PqVcWdEhw>VlM~9zg&Dp?j@wO6R!sqPJJSw-(_MeXh6h8GcVlNJuJ?U$x>& zrf&z>H?{#RJ@Lj-%MWCcVA&}NbLdWC<`_IEQY4aky`H+5UqbX+KrexgSI4L2YE;*xD zzRTAxXxkCg6&L9+>25e5>|Vnt7sxsw@k=zGCzGb%{r$rBhiYuPHi4pgS@QxUIiUb7 zuwedUMGMh8at1iX=8RN@wBCx?R1w`*3CqOU54yBDKN2}Oj&T@YB(y-!vUW&7eIc;`YD<{pn7X&gGWRY=S4}+Nxb6MUyT!X)zZNQ)P zMlO*3xAw93xApRc1zZJ~?B0sXbr*<)U49k9w?VFw^_Z*~m`U_Y#d4L%?yEIohAn5Fjh|cJpc}?={uk!nckgw2S6As&`XRhwDjx{+w}^;;x5#2q z`TI;-2+?(bg29;6)O^%Ft}+vmHDZ; z@}1yh1g~Da%jqE^2WYCGMXJ@PNyJh8IhL=Z?`7 z5%Ef}1b85P&)>C^tmCCjoPBc;D8H%jS`zBJH47P!OcI{XSH|ZxAoJ0N3Jbu$G#r7Mf6Oo zK_QwNx|f-7>>%O@lCy(6PxI}XDF}R9$9ln3-#XcMzVcD)79Z`FkXCrio5R28NKKN; z&+I!40^3O9riFpg(7O)!N(Uj3Xtb`Q``!qb{eyfzl()VgKjvf>qK{m-Xhs(GsHR9% zPUbA`Q!{@q>=B;F7h0vWbFnK)2bkN*1z!M;DFNC^FUV|BvZpBsX)W8PrY6$j*T=O> z7^tEtk+&5rRS;{bx}*tfM(NeUG0(9n*=Sa~qrGg0awB#8j&Tqu`t4#WuK<$HIS1-S z59BQ$cg2ijO*6*Bd{_IO+ORH_zq9stdwr5n#mMCPJShvQaQAAJ`b1-Ji4P-JNRto6 zdYkUyiX|yY{dXO+3{4Kd9t`qq7qY^zW}0$#!Ujse*P#>+B~b6*8wH(f&CB@pMfzag z-&Rze{O3?tjoDUlizGSo9zKAnarkajKa&XDF70Q1eavV5Dgd8V1@HH81&ON;^EhPV z^(Z~@3Aq=yvake+vIaXR#!r$MYJHLNJ2I0LEZTbvnhgY#$wQRA{U(@u@ML`#c6+EJ zKO(uA|4{g&^EFcuo5T0b5^JL-^Ut9-nE#(a{{M*looET(=JL;>t(&kPq_4oEi$kei zf#40Y4w(jjY33I@)lgWK({pDPHTLEq5dJG0b;htHoJn8`2!8uWF(h5u?DDkNEB-*H zJM*yfEuMMfXGWMqDJvgkEQO(nil(XwYofO92c61#?YcyMEEz|a2HS-3L|(0)LfX89DlSQ)=>)x*&>@oY%{5<57fYR@nFOco2AkxxP zz|be4$vrY-*Hkd49=CLeH5tYjBBB`Om@|2e^|rbb_C?gNv*2&*tY5#_4$T6{TbkcL z|CN7%r=&_8T85VLw%Cu8PKdjBT2*6xay5qs=*O>8wruvj+fR1F9@%)T3S>AFONFG9 zmB!r>!Fi$3UT@WS0Yr(#7xgbAuhqc+Gw%jI#m?9gLqV zz}R0nXgKsb$doL8d9YTRnjWWpIZhdM#H*&w*3!LGPBXrDB9X{bqnaS>wo{$OdSrf^ z=V-5Ps8xQJ!mbIz1>w}j%G=o;4+UyQfJnzG9qUN^1P^MDnx#jhbC#3^*6 zR6aElKFrAIs+y0I)PW-cMNJ<#_vK2G#MVZI>!HR$~V{682 z$k_aPVH^xbJ8>1uLG={$1cP#2a?Mqp@}PMY4s32I)}nfBvD7`2*9nW!c>mKe^}Ywv(CgsOrw= zIT`_RoR5cy8&E;|f1FQSB&9cPTMObD7;cL5O(_3f9JKx!(ZT3{C+%pav_a;#!1XfW zmy4Cn!wG|#Gh)~t;yj;cNS&~3v0C+#3s>=p7-c^(OkBtl6*Z2lG8WZD=i<`tJl|1h zC8i_O<>evqoc-oRMdQgnKu~WK&LekHR$2tPHE{|f&-U)1B_%7XcM=nILmd zZ&+8;kmr4axgzFDq0AsCz^N!<%60<7%d=04JCS=vjrOC`mjryh7-u(p5husbPU`49 z(YDYQ*58iU^^61h8K>;ikvsPq>VVh0_xnZT4J6>NMfopyZHgIi%#3KW0!RFu-K7xa zfg<7zT)CQo8C@o9uiFBj4JYzjSFYMn_!0U;ayXE@{;5#JRTpPa&@(BvD~6QK4|zne1v-=S4j znbzJ+8__Ss;O@EbAS8$(7vL>p(Hv|?Y9qb(J^7$N-BEW&D^0l5VfJ{Ysd~Bn)bGq( zm-SooutPvfqgdY_Wq^i}qZ7MFjmC!RNu2qTYs6f)%H3>fG4J6=alVOzyB}aCdJTdE zXN_j^Oddk^@Tv2hF;B4{n>1Yo0j3uSOQ~2{&^jLo#QTupZ zxZ#myag>IzF-=m1XXBA}^(>#eWu-M;VTMH9_aZnM9lM0ZnqKr`1t&Iemd}28svjDb z?Ui}3dHKh7<#Z_PBs~iyca@UkjGV9;oe4Jjx|iTwYU`bJ$~y~rIMM%r7e|{r|I<%C z!7sjJZ>oEwKxh%0751-oV}(T|3< zRDfgr?d;hl;2H&a6Qw~sa9I2pLHQ<@Gs<1}BI=V@g$46kS9g0tdi07ciwzow&(iM3 z+OSG|_J94Nd%GyPm#AS!zrp1!#Ehmw0{aJK^VWtrOh6(U&33&%{G7+DdyHPul1j4@ z#8HMv5WiUW7*WM0(^|5yDOB+FF2j;|Z@ZoQRKVs}h2Q>=Lj*vu;WSb~8hIIVN=Ii@ zE!&V%4nre{hwT!d^!R^#8bI#;IoO5O2u98$;Va+%Mn@+Bg}8Ke zFV-9;n=DL>27eC^_{BFQn=&lZd|%uz>v0Ot6-=mUGjI$=t%$jeH#PDK^O>zSaZhsx zxfO$4_ z?|i4`vM+BEB3ZcJ#g@8tC^zxBWM|VEZ*g=(pJ!4*-K$ISqOhlRCeepsgaYH?oBTrf zc;7e@Uegn@Vdt$!a?cziq@K~&@CQxUL>F{BAbz0TY3(kY`;x#phiS{;^BK{Q;eF;q zJXcBGP_cno=Ni)RUiILJD09PSRE_E$m!Czy`iy`m5P4%~HXt zY=dG_&O-O$WGoXs&r?h)O&)$0MO{<#Y3}_LDSqFVsOe9(0UKCO@V^0q2~p~Nn%q1j zT_ncBxR@W=0Ex0i{=;?(5DNbjI3uPCxY-3f@-oIV3I2x5XprJ)_N`EyRZTZ z`YS!Z`pWw}j=rt`SMbG%(l!v<_yPbTGgQa2xHVf92zUH4n+Hq;-6kD&$IwWqsNJXA zzQ?f|Hlt3nW-GOR!6c>p@Y}X7HJ>PMByp3+l$49mYs6o&2u??E^zNYf>Y8bSG z?LMpccMDsfhbwuq9l1<^Sj5`q5g)%;ac=G+`Evmheo2uvhRyk ziSYpT^0d-rqfQ^$AK_ty9dyVwtGaJamF&{ zCW;vv%m4m+dc!y_aDU{gFoyn(8s$(N6_&YpHSy&dW8re=Opa}pt{2R4zt&*XJ6AQ$ zp=N`sPF2gLjI{2(bFKC|{B*SwX-g396&qT*8>g=kK2`YSd$=yJV@{1&mhP4W>fihL zc!moG(mUmfi%XXT!cy9~g8Cl^Lik}RcM)>?y`ZHG(GgRJF2D>1RKvzBc=X*0E-EO* zm#M9drt;t8e{}aX+j6HJYa~&rp+(+Kac>Xe(uah?SWwd6? zlcY})-SsjV6`>#{C&m3J3At>Ah+Uh1iKoL11rFml1IC1c5++-h+W)001Bi=n3Vm4Ia2ekpACW_qyCpNC+u=E-9mH zi3RKLt?wr#H%zjF*M(&p=0jOVGF?6UWl19d#|aDda2}TiV*4Dc40=Z6bt692Mt~YM z_TgfOx7QlLS$Gb_PoW5K;ZJ-Mx;!tWNzwhW%h<0;s)34~xAjyy=OO5JAcRH4E75Zv zLSy5w;S12918J(iR;HP^&a4Wy>ivYPXU3bBJGz$#eC~X^mE(TtR8?Zgu+%g*^P-`#;|Q`T75*!5P32&vEcS zad4UQ2gu;0hVk|Gu;UVI10k>XhP@@RHlqAswE@3r{#P_{XrWI~b!1Y4^{zVoY1TuB z?rdG{@1l)AXGlM@$*>;Z00ze2#S5zZOKR4xH=G5ajF-pkpWuI0_QyVviHJmc?7SJc zEE)J~-Z9!_UeaP$68k<9^_Xn@uglQ5mmB>0AgQ7`t4|5R{=OPH>oL3y6h&Yk@AJJPN$GLY41iu)B>{8J zC>AHJu@X;ooN-V)%uN;jZUiHvJL6tLN0>#8SCt|;T?Mb5ltqfp19uFq`X#}TN#J&J zHvhh5Q6J616zGTa`*Ydx6(zY)iEK!IK1X-sUf6cN_w0UoZBZZzl(|MZoi$_FFh8#P z8*ZgP#z3GiS+f%Jlgp7>0GWUfDsbS42sXO+jh?Xk2fbG@Uc4)$`B)T6%*i7~B$ zLkwbWR#PbA1m(UaQayf}wX9WFH1-T8(to%AwfeUsyrYJD1P7m%-`ST$-hg*~`3;}p z4=47=bS<-PNYI)sZ0%;98BMzp7KrNa>uUz}NWP8>=o4^~@-s?*f!){VkW5nk_1(Wa zUtx4+uuIM;IWuVnJ%+&vhCw*a!w{S#ILpnn!N@IvhyB^FTjVFxPwGbn#GUV% zzT%y5q&y`BseBAs0&m0p^G|ZJ$>Y{+i^Kij>({KAWZLW*TY6lP77@}a2JMDrE@@#k zmj)LYpc-zI?_^AG^{2@UP{VA$4c(b^pxPKwHhyedOsZ% zr>d~p7Jv5oYh#+irjQ0cH-T&#`;)vv^ix)yyOkB6YWbKgAKHucVR=*`5(2w_@_{c! z_4D*?1YQrH6W;X{3$fpGkBE_Fc}n{1d_}LVUtnT@E9xxg?awz3b-#QB`pEu2>QS2_?4>v~n@A@2UxABA#! z*oX|-eOM74u4H9aC3P~h2V3_C8taq?em_6R$~8VQO>^h1tUv9K`tIs^@EE_ArW zC-?O36!mb$5Q%_YhD#ThkQv01k+J_H`$*yLO__xz*1?l&FCVnt<=Mk|$eJc%kwhbM z!L)MrTIvXA4A=b^h91FXj*2Fe3NbWJx#XP5G4O_j*j44`TYdQaXz6lO{VpAsso$@! zXipLUT2iMr5D0twuok;utE+(Frsp{Hu-XhEaNxx8qOZA*ljb3UazcMB$syP;F-zv3 zT+biu2d{@X$1N;$WgGByenl$%Z`q{Z>bS{u%0jv&z_ z#f*+Yt5&CRBByQ?YRk?P&i*{dlQc#n{4qylBA>vKy3H~@uLEEaj3si3NV#~?EXWpua*Rq5sblQBD;etBfZN?X^mJ6%G`L z8`PE`KKD*cHt<6Wpn|Pvb*39bNDZ^g+Sc(pVT{R~iI43`FFCYhRwsc}UnEA`9FMGO z8`z8+Dg5SrEt-u@8yk%|t>#C0e%&3PbSS)b9O^t!15dFX-_69nxc`_IBSPMdGp!|y zf}gHV%>L4>IikHI`DJgY%+WcMU8Z+e=;&64jKg26YT(ly&*oPi0?E9jq`FwwXJwT; z@>g!-%n#`zLyFUjy~qdsT;uol#bquU_}Yfqo%4&HgxO!FJDEFxPCf$Z);wK z6nJccUP2a@&G2T6M&^TQsoaBIAblYNgwmhJ;x5Y;7O32*@NK_1C5~777xowJ___H; z8*yjjS@XF;oU33-+xbvYI)8I-(D)~C;3B9!!-TzdyDg|KW3KbOUD6vY5Y!K6ssDi1 zriyQo)x*{wSMMZJ#c6dR);-q~5r)}PexYQSl|A#@7e-BYq*)$Gi6-yj{?!p_dpe*0 zYK(hr`%tyt8)B~EU>X#8O(HHoGb{oO8Yty2^RO(qq%^7gG8}d_QL-Ycb>KL(7Bi1C zHjsMS#L+Vx{Hf#jafn&}$fp7|a1P_W4+y6I%ed=WcS>aMuf$bUmBE!EtEbmp0DgEm zh4R$N%L-b0;zW3HZg=O1KP^|`V`Sbi2o7rS?nlk7vz>9_UBR|cZiRb&-ej73?dN|8 zXt+KqQK=t=*skkJ7h1=Cg@c2{fq;b@jml<}zpHgd5i;(i9mv-Dncwoy49R86(z z?L>1MYiCuT^ZTkxvgh$cu;+1|6QWyhJjhC=i~5Ce_$#gvtBJ5K`tmb*A(=by`B!aQR31 z^n<^h>DSfK19VRt;tSjvc>1RgDbWXiXrzIJB)AIL4}(i-0D>C>v&TmP!Xw=#NxA-a zZ+jrLv@eS-uaVUE$vTGb!&;vQqxG#tu^F~+iI~FW?<~Gi6!hIU zWLAym0@kTJdTF5mRzFf5J}1BJF?&Lz6hYcz%NZi+f>*)%0zoNe`vk{3$lMlEM`a>5 ztitWZhyu}_?WVgov$~WD@n4^Lk8)D179^<2{q0ambAD@&Z0-7b$0Cyh?{j32-({xm zbU~7eCakHQE6ecBV$%?9kP;DFn!oUTHQ#H-4N*SBF6D%5W7ejQS>%$ez?@mSq}6&l zsd&@i{Zvb^VAyPZJ;cFdfjzj^bb`u5M#HHCH2J6~(yp~I5_Nf2885(Hi5C01ePe<3DuwTS1NxCYCWQ{z z7d<#}IJ#3kSpC1hAbqFDmibzSo#q30SRv5?Sw3 zGg4KfP&JX2uIlrN@Gl#ZyX!h6W&gj}d+Vq;f?#iSaY=9q5;Q=7;O=gVySqC9f=eL5 z-QC??65I(MAh>J@!DWF37FZx}lY8$w-*>-z&U@$m{p#$Q-l?vcp6Q;Ms_IkyD-=Y3 z;fe#*G<(TX4J1l_ug(uMuXHa5yYnGWOKc_w+%2zTm~dru4Dcp3tDUqp+G1dy$G(JfZ1y6rO6ZF>~-ujDy)z=MwZO)6} z>7mR_pgy)f&Nd&W`vqoJRegNe9V{A*uUJlZMAL9xVcyRO~IFON^Z($lW^L zHht=BcE3-etG^Fa?XrsdB**tGOC8-{3Y3jp93G7Tq+CNi6*#F#b>Wlk1PRXqFwi}<=5 z$%%S7+(ThwAExLZQ~rxu-oK0r2_>nsVtdAn z;)uU9zHa+WFI)CWbGQY)xo&8~UYbmjSxR|eKB`*LvE53psTe=!RxiF&;}!iEY{Z=Q z6nrzQ_oensqj<>FRjx}K2^l}AKgaLlY-RrBDtV@U(}BfJVpB%$t2JUMH^!zBMiw2$ zCGl;9RxO1@Cx&R~ckZ&cXZV}C@Yf7{BxxPa4=XHjJWf)yTJ1?c_?pP6P&arDNbstN zn?KXi&?f6^{a}KfQNQ@v-mVkeUX$J2*3Ai2)v3iID!0mNFM6rmRkJUfZ`cMPnekey zd{Wzaepb5Z4<5ez7(g!6BN$kSgY``E#~XG>zSY%`UXux=$20km`C-ik6riW>pv)I5 z%K>1nS^^ae&q5x+x@R3dH!%i;n=Oh1?;MWHW6_*0P*mz=3oGg@mB6VvxYc>bciG(1&YwTi8lLkO(jpbwQC9 z2vo?f)val-UxxVuUfNeR+^?2ZdutlTwWfVPs?o+AF(-=bP!plCkY5e3o@x208W8#$ zoeD$?ThR{=y~~c*A&b!|)iX*mv~6z!Am4AS9PIi9_Sv1AesmSzb~Bo@nJZAa&yzll z8bn5OGBN@e`m@!AAl6kI?HV2#H|@=@c-wCAHR!lzgLoT}~aj0g*>oifUV)<0>n>#WfCJue=ZBOIhQ zhMsP?Xx7vbYZ%$jrmyHOO&&QqCOGGib=PVh0@ymbI!`X|?;ga1-DW$_z$cLL#*cc5 z1$~bJ_gttE6B6XkIVZZHfbFfGT9zf->;XUvQx3EXVrUo}VOZF+JRg%HC}m{M7sv3s z5A8$Y^gHpz6a>48S~VIvmOpAZhkt^GXN1HPqgV|3m|CWnYii|=XY>JRqTwfV<8z4_ zAgCPdKyNX#G&^8>TP+q}vS-SR>756!VW#7z0AhWAVf#;jRdnQT_sI46wm)Rq9C z_Vb+VUhRS-cg4=kT-^H9YSlUlzTtaOlfo_va}75LOKSBEoLvl$>Ydv)sOf9sB+nI&-Q8a=-{188aezX%TZOvMdU0lhc<>^RNTNn*uWoW?1mI$Ig`%AW{MzZE zIwt^8lGZUb)e2=iaFScH7-@6D z<(?SDX{B0H?28DrbXOcu9)Bj!MG>P~N=%r462jVdn1}#l?bHu8ZFDScH0@gqS~fq1 zTcUTaznCnzw=GjqL9yNEgZ1hM-cfssc(N4-7<0mtZ_a zTVu+%Gb-P6X4ls7p(!uA69v@0!FCA=37PpDe)-u>dhSIUJ}ZB%gk^a4#aBT=fB(X> zKmIr7gzGuj2O(SS)CmqtRcb2+JBrFmEd41z4$hPsB@+oTs3rEtzS{{%e24idm|+!{ zaplYY%hh;a5t6}DfB#-+&1`sN^GOQbdT(|+(T%gR0F7x+qEdVD!Hyf1lo>wQf~~^n z!2ZJY3alp zNx}O*V_%t*puJ6b^XlBh2cz3Ble6?YE`fA0L)4GD9$u3{#rGi&O$p1N81-CQmUQrT zzIfqqg?q}|f6JeEvCmf|hLwo(a+;+UYr`eA1bJ0Qpr+cVGg0I+JrHh})^2Z5Pi^j0oMT`2Sv#HF3AIvwsOx&c zGZpEqejxEUB9|pJ{dFF7SWubmpQB1Sx;WMzaLIRUe7!f>rK?ikqNb%ksv|LV;%aVP zQi@HkFEo0U3-?$HT@?*+1A{|e?rSjx7k zp&e?dEXeHd3aGznI8AP#f4wg_!s>rxy6SmooSc?3F|6mG09~wNWl!Mwz5HC(q8Sjt zT4Alsim|Z?AwMz*+B}YuUa2aNo(FtCe&zE#I0@oq#`)-CzPBWcq z$C-yjgvW8tIUD_!>*kkvt(P^mmDE0?vRBKZVlUG7Fa$oQhX#vY%R~@5r`8(Mr6j3q zzc5Q-#m5yX%s`V=H6q&3kR@LD-t|i$-+0cW$$hWYh484xy>+~64X(J_F3a;UR&9c6VV|YRvYEgo; zQYezXwWbxbKxiU~6gvvHQ*LCyd`M^pu}m0CA%k^jQ?cD%FmH?nQQNa@COUn)0}(yO zCk}luKr;2uW-5tIiDHHMg;A=kfL^`68{two;R6j(+X;}{zJ6`$Gj3B zO8f?>!Bhq}oH%Zo7&)1Il>yQ)>XfSV*Mhb9R|u}(%Df;%P8DyB6Q)ag2;RQ9$8310 z$d0pQQeJansX#&SZZ4(O24J=Z`Q`YCK_N(y6<)A8Hzx4qEJ&>^=`koG*3v@vO9+Y* z;oeE7lVb^&25CoCeI*3a{&czW?z}8cG>&obFog=#3o4@0d#AXtynwy@RolZ5fCg&p z*Sg()ItSkzke@qs^7nt9xDZPPPyIF4T9!(?_D;z7*6)2PKtC3?yUT<696Y6iHQjDR zG2RLUidK&Fd$G2(JGa@^y92XZisf1cRx#+{@5gvB)!N6=KWjUaf8s&Ar%yArV4Q$E z?5#EEjgvMt;2q&-Cy3K%6Scm~B5j!hatZnnkel#Z5g<;=K} zW3bE$`GlNZOrio*ne>pyrD*LQk;BGF0}lu!0{>%0*W{eu&I_X&tj+Ju0A zUtj)F_qL(1{wlf9NJJVO7AE`{_>6~4Qbi4fn;Xm@OM9Qu#801zYNo%#+JgrpJ8YkH zbQy<#1D*g6p{b=MNk7is-qzHsv~C&p1@|ZR&lLppS72a#LdPhRKmp%xnO1%Up={4T zKgF5+`KqV1WP<@d0sq9MMuI*nP$MGJKQ_PaB3a&Faq|NWTRas8+mk;1{2kep)PnXC zeBZx#r=bx`s4c0Z>o+PUdF7X5`*{7admAJcFg5%2DFe2WCl*iu<35xq?5nAX`2ua2 z(4J3Wj7#C9Bht}iENa%L%6gyl{1kcNR-7`^qAQ)R?}M&3LPPVmhSF!*&xm8@w|5*r z!}(kORJz^h&j@6MCC22KsYIppDpSLG9z?_ZdQ8zy6@$EMpFQ@;hdr}>U%DP!73Y=j zO&5`>%yM{dQR=-ywD>$TZqCG?b6$t=yJw(dJ}mRYkRql)?#sR3%42&CCP|#8uB=}L zB8g%cM^R#FX&MFAij13xkvCZ~cm`wetgwVMnh0?l4~cLkNlJq9zOjrDGiRoa5`E%& z-|Aj$>y-9uN|2ka=S$w^bj0P>wh~X)pjG9|q%ksAYa%vJfuG&kW5iO?3B#U_Ilo)V zYtd|C^_VtI-U#i?o2)Z-vc67h>ZnW8Zpq*z6^|kpkkF>Zvydv}!1yo?hD|+z**T`! z`Bi-Veuq!5bq@9#^xae=*b8q#K|!}c7gT=nHfnbkUo&13jzMs_`*GB7F!shTxAgm+ zYU9DY;qspptM=FfV(VkB{g**(;1A3)X<-_g%V| zvbuq+U`+P;)b6+MFW@h+ch{ zKQg!?e=eHVX?1NH#^*%EGv$*z5Lb8*L5G!%dpG%EB#0_ z(FR$~ zxjzS(tIpBMUDyM*PyJ@6INT@)kEhEuIQ`mzwDh~Si!MaqK`zB;0#>1eVZ#=@xoDlWwnF(ZH`|~fVV$IQk9fyQ?fwsQ z0cE!iYwYo1X@fX3`1ei5Bm|*cUS}eAEaPI`(b*b0CY`^a{7rLCNPwEZtBtUqJd!%qr4K7iR5zGFvFNSxJ!<=LI(^Sbc~{ukTywVhaQI zg^wb)J*E>U;$iCp0Z136_&mmLYcvO@0mqf_0JWgCHM}?yAT8h%iev4CdQGuZMtezj z_v{(U`Es!w@;Ca>S`#rrPmWYcn!^Z8Uw2c~BsrN1>{ofwU9xK&l=TD}d(CJysW{zUBa1HD`>Hs8EW2A%TSfcvv)xUTURli<t2Nk*||VGU-nn;hL&t6VC|Pi|B}oCi09JQ zw8iJl;ecELuk!84vHe$uj~fGtfsY-80u6c5v2nG$*UNh__LZcf6t6X+3Wcg-(8>8ecIjhBa8F{-*zoK zIOtCH;dfH-QvpbPCUb(>e`?nGBRddAWxKloJ_jvA4}s;+z0hD;D_}&wTpDNi$_N)fk!V_YlFDpHm;2zV%1clPuG7BWO@L7FNmAbN@m%!|UqOZ9yT|+6@g< zE{k+=tyQAVFeJ=`s1hzIb6J-VDYcC;@d8Fvq>9pUkHxYtGpXMY+2#0Ia8_b|`FvN$ z!sRwmosx0Lek%SZWQT5njD~nDuuef6GgQ$2qn3I-K1qFEB-`0fDe1oL#5y_V7#2cQ zO${sc9Aqw%6vY%K6deN;!p%$&_SZsocG2S-e}3*@w3$`{DA@6lG=}C=65>60rQfIVAhWR=dN4j)DAGsaM$kw4^9+3Zq@(kR znX!kDQ22Mn!B3jxI5j5GNu0JiA#ecn@{Mu}axy(9H4;1bT;!bCGdTD)7z-o}&JPq* ztEs6e8j-QWDbN?W56vM@#n!Yae|v67<$zreIf0nDgoROOX#?6WSJ+Q zy)k(UsBnfy(lyLSbYf`^X02Py@)PEo1l}vta(Qh?szhc+nn9!Go9Hfd%y)i36>E|X=6SyP!G0NU*@*rVz-3!3h>(-VPMTu@Ve z1W1tUT$n87K_mTm&OGu)WK%+MIimym3)1v!8KJeb^0Gtm(f3Y1L?zs#MHkEYQd9%|9Kh5 zi3wCrQp8Wz*4ELnXgvT%uWS-*ch;`x%_WGzpXi_(AzUNzrWbV63 zy8=k~4w0lK!>(Vh5;?j}J?!}N{PJ3Dx#lgEg4?Q`sK^Q@4CCw2HE4_V8}Q^u1Qpn7 z5!w`@sTk_eWi^=Na{Y2n1S57B;v$N4k#alv6ohB#`T4VO_XWc^HI1hYcqoneGm}xG z7o2dP7|WiJ`R4JOI4`gbg4^DqcYlGHYO)%CA?ltU^_$ri0U{t>Q*$A_J-9&>RF0cV z`@p27I;k~`ZOYWesr9Z$Phuq_Qc!_}&L`{q7~&xni9Vt)ql7q0?t&dPF?OKgKHKWm zu)pD2o+e3Hmr;*f8o3oVej9jovtqpJ5X-*NOE?|Su1Y?eq3s_9oo_H7s)%w!`qf)- za<0tfHg|MX7m&yvbb%!J=S!8kqk=M0p{=3X0kIc%5NvH^{MAmu3B=o<@Pl7E>ABC^ z5u|$dB;3o(>vx38$o9xX2XWv-`MF#y|GT6o`W<0?CC%2>dBKpAWWCi5kB-sE+?Gbw zzG&ek?bFOWj z-`95);U{yI@IR#s5JAyF`=@iw(cmD7=jT9Hctqi?FBgSOe+l7;jPf|h;+P@1lAbh(!?duXnrqG?RtvWNcuIo_hu_RvnkX z0esMPf66R0y5m=UIP)sFUW=D2Q>|)ogsOdhSD*p}+MJ+0w>bL9$Q?OYVPX7kKksJN zye*kwdv^N8tn%CG@}AK<58JCwbPqyv3l3yVeZh>)Yp82>_WXnp?x8HnFlM|jUy=fy z1qT~8z}LdkLE+I9TJz&)l;D zSu=dJkOWJqWssTf^6WUe1`i3|E(F{4kUxT>D5EZu{ASb~23^^$kx9QJf;9GHxrf07q(E(&dU&NfZfB z#91hA(U86sN&~%nZf=+PqW^H-R92=ZQZkzhM}!320yTR#Ae*d=MF$9_8ajtgJE*z8 z7wS)Y-h-4H+PdvrJdEWDKFA7=n2pO!V~PC1 z=y?x2xW9rt_FL01;&DqLiVCYd`7c5v-d}gRo%>CJ1%m<4I{LM_To1!wwrsItlb(bG zuG9PW#`2DpZqDSe7)AvYEhM;RoSysI{}n9a0*0y@om6&~?jW7XAweValxxHG6 zoxEyH=@+~0={{&I>^ub+NXY_HB<7u-U@)Bhk2+h8s+^;suOuR9<98`_+IYIEAV0VUO}#zF76S8?$h0Pd^wz!yDkUW?*sXyEFo!@YW?=R{aP18oo0PPR7^ zY#VB)oDocVfgUHz4|aLjtUV~`3H0iR<6I6La=f(n_PGrJMSf$BiIX)SiA9O2X?POr zcRdfdJlr^&3vgHodN2HS=D^UXz|${n9`c?01W!jBk2)yeHff>>(A#v!!95FO4}L9U zg=ayX1oxyr){q``?|pQW%!(0ys`L3N2E9PmX#b`2n6?tH3*8MgQwom$E!va#NG$aZ&n=c7NfHkA2(dI_^B zDw+Cq;ahy2B3W;aT2$Q;yajaUOlccV$!cBekWbHdGQWuo9C#vFc>@nCh?E&JwMzJ3 zn{Obr8KShOLWh#k@6Adjo1C#0Wf*t{JF#D6F-#E9bEhq`XtKTE)?(c%{}ld_1}hW; zEAX_AKh42; zi5>rDMWe{}{gg=1C>5U^vXIIl_b1w(yFl?vT!8dd>@`Na@R4BR!+s(7JoRI#(Gk|$ z*4~v%s&2BUqk_yUBQA<;$#)>FMlB=JD~fw|P|~H5Q_W$IqltW;85dSs>QRX|S8Sus z>mx!Mm%c(N7>*Ls~lIO@^3h^c5dT1nUQp)WK} z+$n{9>q;5+Vo7?6&#vvgMSu0zoC%2I=3|zwHHLO~^l2 z=L~V6rszL3tV9!Y74|uNlIt9YZS(WhX{MY0%cpa4w=IysWHAlMrH>%r5Mz4w>uf!b zaB300Br<>mh>PwyeF-w&QXiAvy?Q^4QGJjpSP-z{xs*UKW&3ggD0*aCpgX~=2xTH*gto4xy*Y_@v&z#3X~w#Y|u`B`g5 zNp+ct($kFAEU-C5dd_%&In`Y7!~;i!z-L<0tz#)MQfT%Ol6JzbG~U-k-j^yHM$DN+ zQJ*_woY&Q9oeU)MQc@Fa7U8PQJK-0Q=eF$5+9uqsTVu^di*rui5X^1*DLhl{RiC!y z>6vaa(!%~S>}bz9mzJ@JAZ7?CV6JHQ!C_Dt=_RAH1mow9a2Jl0q$~u8)6ZbX{$9l}evkcxGP4aX1R@brEG_WOFkSTerUHP-^vW z*;Jts!Ur;7&{47?;D+1UsB(yKWLTfxTgwsToe0fFNvGG>*V@;px0XHgzkYhH z7*&m}`6(o2p^Wat!-xWF!7w}$$vuX;keRTg7`@^L)AVc(@yS47E62cMOZkr@3xi}e z%RQ+ucGI!3F`Fy*&TPuQYq72O+kFoi5F|5V6dgDy0G!rQ;J|DDY%uRoa~*Yxf6O9% zB5gFdA;I77#Ax8xi(Dgz*UjC_Y-8h76MkB$6Htv4(h?BqHAe&i$-iyw_9}bdi;hhB ze2eMX-3mRSkC0*C^$Tu)Hsxkii4t5ho6Tq%L%vDcuEO7YN39)F7W1uKv(8{Jm+FwPpc`Oq1 zrSNAW;rOmYT1>P z4v3|T8d5NDek*AFb&@@x z4ck~fJ3}fXzEaRLtxDP45nG*JS`M|Tc6x$84=kIV29LN}@brIZVbKIKWoM8|hP8we z(SE9_Njd>nQucrwx&1{?+*W3d{2SLh`*Vuv6admZ?H_}15)`aIqr>=-k{Qu`sD6kJ zoE`@SnX!}KMyE(~Wb*(-{GgdHV0lB&@Cdxf(=VEjw}pu4(c;X-w8N|zW~0Hi_Xmv~ zefyoDhDJ~$e}BLg4M$iq0|0}n!p^Ep!0ux1>RG8vk!uJhJ?{gL$XD0V!6QrA0!~a!oC^;2 zIorH>SCM&=(|SP)Z#zYjE*Tn%izH&+1nE*aPJ*F&L2!g%vk!ZBGEvlwF||aN%r)Qg zQDI**CxiGwy;En9zE|1Xdf$;B2H~!7od&LG)e38Krw(KsoEY436`q1hQo=%{qrKQK zdXPCM2muSgvJbxOdjy;;JU;aWAfR%K+rmLgUHTn7wqa1G$y%SKD=1W%Pfq4r40SOR z3n1DF)Guyk+8_Azd>{fjgKXjWPr=~>n?>isaLVo&Lu!~Ma3u{YdJMWiL9Q#^&A+I! zf8B+j|_S`T!|m&9@v zMuf6KCRS?Q+gVPzJv0Kw6Lb?D=WNKDu39v+4)1fE*UhmwXVz`a?Z+G{2y&+;n z-7g}v2<@d;kBoWxT4-ryXJcf(<)H`SnwPopu$e5Jw8^sBYXJ*i}>7P+Cpt@s}`i8UttMBl|om+q(*ln;bvuTaTQfUHF{>(^e?G%i|KD%A$DFlbrI^e5TwG#=P zeq$xl(YuwEAd9!b*B~f-vt)y{7`L`=7!5T%bL9ZK>1p{K4d=aM06SK=LVG`yd-*T% z&IzZf+jY9tM8A90y>&c_w@t>I!MLgiJsYz@d2hI*`j#6fDD$_j+rwVn3ND9=`)Sc$@ZIy z^zKan<)PVH7y6q@s*sO3FY*D2%}K)AhHk4cdGld7c&T~L3r{pFsD{V>`I2kh5|pA4 zk5?^yRisU2rBd*A2WHx1HTWS6RySv5`fiF@4APGv0aYO|csu9`F*xG2#W=`5iu4)x z+wsd~u1VO4spQJT?eyMHnVwV%ylmT4jWsgm;wM(dPxKQURth_Qb&^C1MsV1Il|U(b zGy6PSBgD)CAv55XmokLW$Rtr5cj~zplG+8^EuBo?KYXyzFpuNTUg}KR$M`-}yXNZ` zVaw21XJ!$Oot`>En9Gp2-!YZm5h#eHeC_}9`%l2QB0o#|U6QzuyqG^fcb6eNncSkK2L_!$8?W$|SYe@)TI&}5qE{-nSr zY=}pUBGqA%!SmWx>AA`sV@vj`|CKxb4PvVho!Q;x@NW93ido4NS0RL4rt}IK_v1%G zP^IZyFdRdgJz#>}_kS6izdG?>8VBrugD5GXqmJec_Q^Mfx_Yy&=m2T-mExRJsvq8V zTng0!`vOq|Cj4x)SLTzw6weoxbONg($2a44mD&-lt?#Y3n77V6=b&vJ>6WwteHcVex22KdS&rRL>?3+8}|ahBI)z~BpXGH z{yw0yvW-w6293m9WZm)VaqlKi*_FaKpuN>au3~|?&P1I)Np$dv~C2hoq|9iw|(m}pC&?Z zE+1Q|0_!&Ne~HhW&2KPJ^@wiWA@q-=c+b?@WGejn3X<3Oc~Fp;QegzgW2m|3bu<0L ze{4`RNP;Ab%9Cu(Gr-8m%qWAWqbqUHuh#d9yU@?a`yRqx*bN39_&+snrRVBEl)nLx zF-OhERIXVBk*^dcN=2keIqA}2{x^=3klvuDVmhuQP0N~EG3fMlubtZzXrcXJPINyT zG>{6aflr|}lfIoN2i`piPl#q)eD}i%=Jma7cuI2e*$jRDzEy%+U1M)!o4ulTfsi65cH4HbO7|Sm6er~x!hooVb_2M%5ZFV+Rw93z-tx04lM9SELOLoERkTmv1L@21VM}+dfoFTWhtr&e`d-wbpUIc*vI3{iZvC5OWJpFe^h+>nYQY6m{^w61pF$yy zO~^Y?L}GzhA$&f!B$iMz^!Rn;P)ZY|^(Ah8-~>m6I-{3#VV}i8pE&>AY|mq3ykrg; zU0t#SkS<9=e82n;xdAQQS%12#YI%Qq#j<^Q#U+7jxzY!okn6o%|7jcHiU%xGOPu*W z5^#c`(Lbvk7km1wXwdj6(EQN>; z$S)%Z)>NsyN#3B5vx-@;hDS)hXoF|=k;)IcpT#BWvYBxQ5&I zPQMuc6Y-Q_ho@k|Dun+9o6St});4DkL$1s_b^(rGxi3_^3*FJ*Jd*j(xfUgm+GD&)x zrb53NJLP%rd#s}BWw~*4()M^V%Nlxe5oE>>)faO?yvwT7ruo@vQNpq<2}^#q?p$Ls ziBakPwgyPE=?(Zz{;uGAJ>xasv4M@>lJP@*!CRN^K`k9k^9%_g2ipK_P zJL{TD-P$a-;Y4B0Cyi$eCcS8l%c2g(HH8^l?bQtfzIkVt`lxt0AnmA?v*YS=QOCSa zyc3p2vbBrl24Bu48q#_yTdv7?LThzQhg6-MDdt61L>I16dS~WRXZsQ!N4}JH)|_09!7{Fh zYSOv|#%9?Xn+_X|R7=fxg($M=8k?N-TzYy2Mdh?|`gCsHA5!>Stn?N(rPgst61JLz z){7eS$mNWVm@aZHX%&ibF6E5htvQufH{g+3xw7=7Bn$>IlCpfZsPPK6DN@9IC8LT= zr5gGw=A-t-ZKNf9>SZHo)@5ykDz>)7b&I^}OXVuO9c$St%IafDtybD8tc2>rax7#i ztg>!REbwew(z2>8IKBwM5U~7w$8#6|S+Xm_k|Az3po`lZazwG?^CdGwo9OES z?bksV1E>iU_tuPxQs_}hS`i30_MgTiVlZem@FBx}1?1m?R3jBdOWO)eO;2Bil^DNh zcb!?a6!5jGeC%xI?*$LH4tC1*os;x$jTYWRuaXE3hT`;2RlYH zwt73_{rFX3y2XNVkY+o`R8ov?B7AF#lTI`Evo(fSkjNTAHdL zfDI$`C8x52-(id2t(jq8G?+0)A^_JHpJ@2jF5tR?R51g&&# z{q09LYOQ^S@i{FEH2RzSOh+j@OXaan)zIBk_{Vh`rw6$*-UqyYUm#{hQ4pGSUBc&E(%gEF3!-u#-a&vhCic!6hkJfb6DQ{>$X1dF zIu3H0oj;cA7k3rwuJ9n29&f)Xw4VmGZFt@K=7K-t> z-7?4<_^#w(J}?D2Pz<54k1zsncJei_j`V72oB%7XA4jh?tZ{Lmp|Y@|?)JRA@|ZYN zUxw=fhO)h+a>nB`?G*fttKoL`S}?Im(*1gVTW#6&>-;kYDX@or+sZ7k}or zM=0zx&ivWrB#F&K$$W8Oq@T?kz)_YJQj(O~;1ONB#2P9V3X!Wi;oOqFAk&5J#RLsv z6-A1xOY2YL$f}50k!Dm10;F?+UKJ*J?Eze_?JOOmA0cStBUIubY7f{ZW`Jr6C zJ(gMG@m9F(+5ple8bZfSVXXr`fR!MKEfQp@^0)jNqDhdhTM*cuzuhW4Pc*Mr>kO%q zDuF#v4Al|wHBVyoo%?MAvOA1_#H@E` zmFk_WE5&4NK|Hd1o~M?izv}74YL3G4W2%#_!fa}Og7RokX|xay*0|+V&ep53iv~@Jxj@Z(x*nn;NLTu0-n+rIQwmO3pJAdoPp6}KSW)k3Hqv1* zuAPkxwRRAVzmrT?(~uvlM6!m1Um^|`>giEweo{aviP*ycCEje$gBK=do;cF*v}`oN zD|gQ-8N%vTGlMV-l5#8iq07p6Mfd1JZpnx9%}vTds=4h{tf}p$pzT9J8pEPb36$St zM>(~Ad74nC4WfVg(D>#X$3g4F;fce|1sdD#XI^M6IBi{YM(Fzfp@^?d8-Y<{m`*zB zMxrKuk<(}@s^(s?ge@TG2l>pUUI6tW^}r94zVjPA1`CvhY!t3=4z4GWjv;rhTiM?w z0;-LqdWprgXX~o>omH;>UEQ4ZIKEt=s#iVyU;OS`6C{a;=8@eaX`v&@^DV(lVUuGj z2aqr=Ui^yM!q)?)>=^vStAg(--y9pj6kwHK_Uf|Muihq2$Ft*=u^EWTzWx279>XAY z?w5Dmvh8E%{9uDx6In-G{{H;1WPi_dvE+f^UmAyjh5XSu0fjcp`Qbb%D<12#Lf~0P)l%u?1J5FG9|$jK?IzFI)rk3jv(?^$X|N57L0hWuoCXXt7v5w z-37$%SrucJ1A`y@*r_#TEzyaS?vA0I{G0L_gK4m-hy~~DzCkiip%;ZJA=i_S(rna6 zE59hv%!adGjNJ8nUWkWfi84$K?m5bFM_`}qtT9oN1c4*4t!4rbhhs} z_t_CvMPzSnHU)a23S3Y-y=isbFTH`VNu;%_6`v7IAV4kK`P2HSyO7G}x_4R+#`f!NqXnJcCPN&FG^5EyBU9W23g>S22%oR09hoywL9)2352gg&D%9JK%ye_B+UQ;QpyE5T#Tbwx-^%uj z_(tdV3csAg*g+fjweh}NVWBGv`H$$mf<#WpfyON)Hz>;da1&`5aaw6#ByT!2N}Wcw zK(cCtlR32^s}1BROZMqy-H!?CB!xW##v;7}X!jWP)Awnz-i*U*X{xQ(zR|_u<7eZb zL(&2Mj7h54qea;c7&{%|bX&@+=m~7X4A!XrUTeA=8CAxEg_ZiLpy~88QVS5$h$|v+ z7QN!!2^v{Ox3d2hp^nQP15zAV`*!hgP_{70FBaMusULJDPUGh`=eZREHa-rj+z34H zw-91?)dG9@>pnF%>qJnow^$C0$?}?#ri<=N6`WFFoz}C9J6%8}`RX;@K3MT1pKrl} z8e-WKZ0Az<@urPGbiAtI+^BQ4W34X#c|m0n+qG#WHrbF7v!dB7??4hyg25PBt4v)OW1J~Fic5LBTXc7zwc>8{)3fhJ zs*JZdXkP$Vz#2xq!cOhZopa2bMEN#yz&>iFiyWNsOsd`3tOr?~kvxJk4!2a4g>lQJ3W0^T}yTk_Dd+eur&I zDg=mL@+s#>EcTAq&-RhlC0tWZ_?{j&3Coc6wW88gCXjLWlD!c-Uk1$iJ@$N#k`hBL z`i2zv$}MX&nq4h&d~Z)r^!#CeEBJaXFmwrzpGvmOR+-9 zwR;n2(ZQN&@9yVyQFQ1-g=OR&P!DZ)n0-AYN!&)9@-gF?etE{WAE?Bh(Ir^OP6MB?7D({vE7r_NF_Cw@0m5R z>Uy=XGg{r}Apji)qeMr~`<_8UO}mbtyo8`{X)zbfiZnnq`)flBwDI0L_vPfLZ7^{6SN9fbhGu`}BQQ2;lwn@KOpPWdST{H%4iv^6_ z2Tk}_yl}GQbup4pDKm?a%>&_aXWSN5sLWoT1kZih{2^v7UbeM&7RLS|F~eL;l1}7% zcOt^A7WUP+FF2>Yz2i@Qt&x%2p9aAHPw*bV#|P4d{O>)1ZwsW!Rs;Z$|98Ga5#T=v zIXi?j1OYDaSA?+WZ}}gDK>fGW41sSDsQ*?XP}|xnC@2t?r2zh)2^qfJ@89p=ng2r` zA0L1~tpGp{3k#)2H3#6suNOH4ISk&uf`Tn+Sc)yGxqUY z5?uBlAxGrEMgHFrkotd=L&*9c+5hdV@at!={&xd^i|p*|zju?J9Ts67f{(9&52T^V zrVE8L{&N3{{kOya$0q(U{|YMny>$QzBLIOKzW4uu{;M_Qun_ps3h<*aE(Bh}`PA^uf6#xOR{=;D@|S}^4d47H z{a4+8?f;+Ue@c+q|DRR=IH);)FSH^AfItlZ;4Azs;J^PQ1q2#u_}~A#6?pysO2EIB z|0Dg!v-__K{XYf%WYoL3^dC4bFK?Xp1&JsB33^L)gq;xbF&s&~QXbaG<7uy%wOt=+ zb`ajzo6**pL~~}wJI<5Lmn0;?8&dW%=k}ziEK)bc>kN@eIln@|Jw;lu;*@9)#{k`H zX0b%IUC6Pw-S$;4Q=6LD7a+5Y6yktt<~RmQO4DpLAj0Sl9}GTtn)i00vwHTlvpqj9d-9kb$Nn1CFa#Ol=l8;wqR0O8|*3; zJ*Q|=K2A$tt^MYgTB;-cFM=yGp7-Iudh1iDXML{*Xke1iSe&T!Xo(oX{tg3#cDCyWcLP3^V(AvHU-Y{aeXdxe<>v*kH!BD zFUc)js2RN2;ITP#=fq`)C=kcydz`6xzB8JhOKA_Z7cgBqDv5II3Z#MUkj=ew&F1

p`R2F$cNaRELOq{3{?UkR*z9KlnO_hJ5!v17;n(?q*ybm&UO(cu z-(K)V<^VSk+w`<&`2vqU&`xyPeU+X7%v`N@iXGjUo$bffDXzpz&id(%CPoALY>@6lw1FzwCYcbClWLzF0+4 zrC|C!CFUtHHaCYi!RE*WD}T_ct{5A!I3=4lM}1qMyM0SjlB5972p@Ec?&tPBw4&&P z{oPK~FGE>n+Tq`Cdj!Tc9t!gc1*6h5-u11nVuH1b%Fb6l-(EQ zv8StPK8QGTXZPN5)K?PQekUV|$laqnA(cJg%0n*Yu?PDUn3_I2Qaz|2s&jeCQ0V&bn>e)T1H?#~H1YnCu?G;nQSf zsrpxLGSevj$4l*F$9tQMTLr17A$`v`QcPVgT;KMLAafe(uMd9qEdDX_U1;QZoj_c$ z(4qx;^(oX(bS&nzn)C3A#y4&BaBy@niKB>RL+7t@ABnSamGAdwAzykQFSdT@)V}(a zZ1C4QA}@eniarmnQ)`FYpqShA_h<9AZ(xIAV6CG^ zZqsLek$+zZTmRd|yzQ1gFC1(zH2K@`*MHs_K&s4JakifgAcwf*F#IC3!qz`^Y8`Q= zZ-uRk`9;1V@l3M-m(gqvfrdA$UZ1#P3; zB0>cJ`A!E&05E^Sx=Gg2sN!B~G?91s1od$0)zWC58Q*lLZIZ;yMuRMqc6v?vhNxVC zE^RImtp+eRiFgz*#oXKjn4(KSSXZ2fhuN#rNf6LAb*n<#fek8kyxNzg8HI(`a{-k; z8w{oZ{8(*h(1rbLJI{*6sAV<+b)rFQ^x5K()gr&$*Nn6yKl;JR|3W16nJiecj&@XYK zY$9K&Q}L+(Xb{FH58BJ_FEg7c!pK;iOub!PdbC=MiO9?&G;b>(TPp=@MDld2as!Bu zB1hU6ZzeI$lS@a17gI%E<%3VJt13SkO*=4r0d&U z;V$u!`=d4cF%N?4pFeJ(oenqSPd(xHgY))2Rp_nW9HRH;*&;bUB@rKoLf^g6+}~_~ zd}}c!dceHW{kDu60i*=)i;na{ZsX7R%t)&8z^`nUxf){Bf0~rG66P=X@zo-lDe+6RfYmvwv<0KmsCfZU)<2e?J*mBpG1}0};5c zvDcJ-1<^od)nJCit6=2S_%-@F{{Q_D?1fJ_BfX+b0R;L{cno)A2DOAvQDd^6QF5x> z<~b0}I9B2`d=KCp7!-vB5NH7KUs~2gX_|ZBk|7c%qY^OF(q8xMPKbSJ@vR~U=gJyv z8HKZYzV`QDe;U*@o@Yb;rWff33k$YGghr7K8I#Yv|5c7edwczd|6f@(Wc+gMKK4v# zw(V}aqz-%B>?Uz`w%HbTU&N$Kr>}0WczUB;Lrco`2B=fi($ZTGO^i%g@wO9p*-fuP zQZQ=b)MH-z*xSi@Y@=VZY&NVgdaPU8dkOW*S>h6PX||H@m2b&fVc(bMXI+u9L=_U*HN_E>zH{0=O(XS33Tb`=5-nHG1jf$)0;5!A*CIohU+{-w6788TcT z>GUv^_fc+C^ELO0ob(a2=lEWJDKudC=ABs91q>i;^^}OOc63WmM8I-~KdVxbBS(%5 zb#IyeN6s&lSL5#P(<|6m7Fv*!Z<1HUDHJY*RkL(h_-8`6{<&-B@<-4=l(_ZQd@|_L0+UwwKa>II z+^WRyDaE4H4k6Cxi}GCAkT6?9xoc3)`AjVt;rAMdvcj5NacFq@^$Ab#;(a|aZ3sOW-xuYDN zglEP|=qyNYh9COflZGBC@#8N~A_fTQOq?E_ZkEO?xrG-))IXXD-VAOPsSNd;p*HaO zc$-1MXK74jd-cc!q2?EjQeUWm1(N|@@)8qBr_ZVAl zkcih9$rZMNveg84+b%Kc>TtYEoaH!H%?6&YX~8yODz`tNh<{MUq(68;+z5KwC_GX^ zLfpR(05`5!f&d^wO?quqO!^sLU)5QaVXhX!jCc>Q4?6i3x`Tx1TxF$&JV{A3NGE8|o?&oJ8R!p%L1;jNJ8e7QIHf7|*WDuJK&{8c{a~8myJ-VyYrg`#f zr5+J$Yio8z$AO`#iCL;352a}0owQem*o@%%cK^jJox1!t#aXHvDbE`DJ>oTKnKVAB zEM1ph*$CBn3Lz0yRW)_?F5A_5DYeDh8}D{nBMKk3V(v|sQd?g=C(Y(}MRIY}q~JZb zqpvX+Nd*>tlE8W_tfGUlTS+8o&GCf1mfc_)g^4w)YZ*Jrw2f!E==Jh%Undq{(we^{ zcC&EjF3r#n=9=+Sv>-dh69r#d8{uhr&plp6sPQg@PEZ%!ituR<(U`0Xzo-scl>ESm z@V1QyGoYNMuJtLZ3W@$k&9dWC*H=>1U!sVX>RIGi4T)sb*J6ahVYBj9a)nz>vql8@e<;`nl z>wI#hH=phisZ;&~y#@n1*5Y?f`77Q9IgHzT*OfyBR1Dimxuq(AmstWhHWR!X-GaNdXGpx7}9U*RrATi^M!*%6Jxb1E6xTGo`bo0m9K=jU`ioSn^Da_=+rW zKwbv?f^R5mq)VFljR~7V=k5N*A~prNC`#yj>agEQTvlr!Uf9GU-n4W5Wybhw z8&|>Me)f}){~4x({3nICsg@4%517$b2jZ*)`B#jt^@C7K8~XmoKbvpvkAD2iIC$x= z{Qs2uDg48b`hFwUn2iCg(4*4;9V`Q6uM$MTbFp7(m#!E}mhiwNnwf}YiTgb%bJcYx~{3F@Q7 z#@*Vk=+Mo?ajdNQ1tL)b%catT%qdFN(SaR$UkDtMx$V!YefE+J`9g?;Ps?YUe2A(( z;ZNao25xfkRgD2K%xmflA~>9AmasCvT~ULw7kP5&r5a7p|pDU+POOXQe$ALS|~>Ypfe$PjiTD)2f)Co9&J*k0f}D zlNmI>%^P6(16tT)>F(%ASDf(3nZR(&hbosYY)TZ`m+*s)nKN9TbdmcPFb(~* z3LI!~YYJD&m`enps?4u3t${`yE!XUo9kzkyB+$gNKsH{zYv=SczK?Y~lV1Z{N_B2_ zuRFWULzLQ0T8l){l@6hbqVwd{)0G(N!C;uJug}+(;G-C%_`K71+bW~^V{>i~a}RTV z*LScCpmEJg(l@NWm+4FP(V>*iy9>RR*UVrbzT}&Ymnuz--lyhZC3at6bzBxORtgwP zQ4o-pL7KHs?T?+di{CTrU}2ueOStEAs`qc)X1zh%j~}FEN~*AThnYNWoT%;`z0wTufR1YPtVsr znG@EiMiEltF%i00w&VV9tOO99SvxN{__&~@`0p)|(TrZ;eMggKEr;esjdoIO{Zd7v zRg=)`d{f)gpRIX&dG=ut&0C4^b`LO4^~b@C=XGyko$Vtle4cGp57zKc*R$YAizXW- zbKY+pjrxYNW{*~rOFM&XQ=aI@({@_dOL)T1rIjI;Xwi4`zAYK-g`Iq%ko;XkBI==Y zA%aqtf00``E|rA&sIz?S0aG|WQ#Jdk{ zkxG39P-4zwJo)x4!{I6yaXGbpjFKz**n@MfXlb61YPvy5l^>(}oU<=YWqABYjRImG z6FK?789`AM;&Hj)6SzB%u*Xzq*k(?aiqy><+GX=@hJPr-(~9Osc;)HhS3S#U9Panr ze^S1&&n>e6@rIe#9J~X#1*I7l8<_}8gMkU)PB1sZ1OZ+J6C!*N!1u40bcgq(-)maH zdu)b2Qzdj3h%M|XkgT4kp@i1?WC}&xgF9si-s18R7?@NdYr<1zF1?nD3g$10!(}hM zS>R;N?@R^;F5p(dd^n{U+%on8RY3+ss2(ZN;hZcej{^OSXJ1gmEp_EFmvYFOGn;;u zdYv+3i4VQ48Ktpdq1#KC@~+Ciw6DV~W^44yd840{ppN)6^266~^O-7qw2hd79ZG7W zmy0jT^vFOOzbw0RkI{MUyce>$(C0Ec7a&^2X-K8bhD^R`S{N}EMW|woN$4SjlCsf0 z<;d~m9)q>w^7Ru~;u}-A3esWRPRW)u*&1TfG+6KU3_NMO)7fw_>)L55&V-bikR*z&Lf`MES z63oZY0jyVY_k~g2m<|v3^nbA2oD~>!Xr84K-}ZOwVP)!HQB60S^fO)wH)eG4s#{m- zjN98K6bbb*Z~{hpwuX=~Fw~1K;5>{sV0?`b9*e{DZdkF!$oz|48tTv2szt~67(tUo zXyaR3GydKkO_s+N=`d@m*UqOVKzg?UabTBU5U4N2+qVW#5Q*~~*})q(xcRmCD^^rO zv%l(vvM|&6!Ww#z{$<_ilJAHCV`PEIXhi?sx!nB$0HBU_7N14jkt*Nzs_4k`#9fvo z^d+^QroCYU*~S?Wb&l*J#>rT~ldxAVxi&3gYuF*qA}C)5=OXcgi|LH*1)#Fq+JJ}E z;kNNWrP5t=(BGIixv*uu8+ihqGYF8Lp#>YyLCpP8%&?nwV^SQpgc;0TTAQ_2o@ z+a&tzxDZR#aA0MC4oMh#Nu_GE!*>ktPd$KWK$Ip_pcXs5M%YFaBlCBUE=TJR9K=WfrA*G*D~;{Mp6&Uk3-+ zNBjVg)5V?3K>}4BUoNfj1(P#LToQh!Vw=nCoFG{WyYej^%om3~+tT(+^aI988R|$9 zpeAD@iuz=CY)hKbS0X>Yd`8R`o)cflLCgQb#YfI;Tpx!UQ#GL{6|Al%m}J@!MAGqkY;y>p~*npje7z@#Sp-9cI?acRv2ld}8^DEf+|8(^v3V-M~0wQID?hnVy~@knnq z(N4Tsr>Q%_&lbsSj_S>9r8+6`33VpisJwMs+1{VEZT;Bro$p$mmpjK523@&RuXe9h zAEvjpwtNb|mB2O{NF$4yjM0dipx>o80jFILszEp)EX{=raC0{0cKd7E>uROlgB>xB z+-%wNxUy~TiqK;ZU(GBr>-`~gkbP>5+W@A-MNsMGlfKlI%%N|<%I12m1>oKaP%xjT z9Y|e}ECA$IlYGQ?dR)3|uu7-T5iQtK%MQu~Z)1aYr~#SyXb@Yn&|cPD4(O5>^b}0` z#T}R*yU;#I)mj$bPv-Zc&@4wKXtId*lFs=>rj20m9l7EP0HAc7lYYVAVh(0^Qa8Qv zwaj?DtwTqoyeE2HqDw1u&@#-)Cofc;`1TF>MT)2d_MYAZEZ}GWE(D-jZOUfzAES1WtUXu#T6Bt=S&7+X!X~;US zwUFaR_6pps;*bX8deeZ2V?wU4rv;xU&e%-rZ0f1vI`94_pZm38Xx*h zZ@khQj#H1*oqZk&u{HQ)yaq+Qup)EI^+2Cb^yuY(mu2>)oF=ml$h5r=hTvoo*}b_G z`kazoa#EgaQ6LN?ve~kcEw7*L-{iW}yj>m+Ix|O}SyJueG{l@G;M=UMmhBlcz^_^` zGUzrcdwCOLFgMjI|0PD0ft?d9ZL_<0MPtSn%DN=p?)93Vm04R-_g0HScI5>-|D1Q2 z+tETY@4C2lXPZHg)aQ$g8-aU>yS4E24iu=i1lcnIW%DDXTk059r>13-!)pe3%}>)D^&?$g}cbAU&>%QpVL)#<<*- zgBuU48Ng|giQqC7SfUkY{XbdJ1dIK>BTyP=Mu-T))odVOjw?bNI15Aw|4wxd7x}+| zp$M2$gCN7L^8gX9xatq&iU20jbI%IF1B~@>18)I1CW}>IRspPP6pk=b0A@Jk^z@F! z75*Yya~;=qMc4*hp3dU7BEY=K!0a>xSehOzfOC5CZ81In`1esjwMJQ4J~_Z_9fYy1 zAcJ78ComSl%3J20F+qt-{I`i=9D<4!x8yN5hp8&YwbuBh9Ws<8XS_-gdI;lWisb%W zNr6;pQgm8FR=glbg6wfx|Dh3Z&3}M_=VsvwS%>PqrSsgx+~f_wPv#MBXR@SWQ6d5C3wh2I?Z36;|Yn+UD{W_blZKS-<{9(*Z|Y(PeaX+^*{uf z)D0SyV<*sEj>Xv)!&#S>uDNNVxFsC2fzdU$IL$==brn5)ye>>c?{PMW z0Re6cY3q`<+yWvLUFDHxoR}tVf($r(!c1-EfOC|7np;*`*@cbRU|Bi}s|;R+w8g_5iP1ui^M`g(K|m=&eC{e9I%%?OjeUjAV=k}RXXAj+zOozT zop~v5Y%mWQ`II22CNGbd*_~X;tu$Uu0`ZtC*cd;d;*x}VM#TGTj*-%r+zYmA#N6mp2}B^p<$*ywqX_K6d>D$*HIZ>R|!^{ z)Mvvlv;`8&wu{CL!h@(WdB$U%fiIkucnv`0w5(#-WU@Ao5b_!Q2yD8)vruBGL`MHp zVsVsf3!df;eqyu%sRZ2t-`!YDK?`MKu~K6By|jNqtTdxUb2&Fj$_(v8TxlFv65Gjx z6uSFX?ez2`MTqyxR6M%uR;0@|{NCq~WM7@@t4)a7gBVSHIY4?{eJQG0BmT z%HAK_zyH#rCUUzy1oGLeKzER8Cxvc7M+!dk154fxoY&=S%)-obP+z#Jn1S_nl z-S=Mqa5`MkJx~_-mD;_TOVC=p3&}0#=ZQ^{cuxtDePOY{rK75Iox8INsV*Hj z&@{I7>J$WUk|;$?*p(Ej!-7UQQ^!f!KtcIb6*HYp&zor*i4o(fLt=;b>hZMrA5A~G zr_bmPKQ8Tgt+R{#%pmD&{=<H7gl;>4 z6yzXN?q~1LW|qZ?bYnO1>`58Q-|&7-J|fq?>PS=qjam zNYRAqL4$)feW0gtqKHeqZ-Ft60oHWw#e$^A*t@0U)suNtYgXwmX39lOE{%mpIjOF@ ziNvX2yBnsfDHh|oI9Ybw9NbOgK4$YlWHg=A9^MjW%N_iAkU1*lX!eNs+UHUmZ`cw2 z(hym39n$xga=SnYzTn+-P^zsD?--H92S)SdZCNY3{I@Fz41tZ#)K45w+(iWp+->W1=tCGn;OEC0Qw?CMfgK&3_au%T&d3sI6>RUPLW& zHIUW=+bnEEHJ0mH=TnwtqXu3@+2K(ijFGrN&`LXJ?VCNFJQo*aEY{PN1)huEVDiP* zr`c>8Ixc5NCO?O(qBwy21@J??MMTNH6Ug=x^_$A#l1Ds26>*iCQ7*P_>MQc;=hPnY^l~6i&#ddW}Mi$)}61-=`=SJND)vu z9@$9~h=W9?ybh+8XU?EKc0#ZG<5yKan9WY;LOfHJS9(Q_&6NqYL&)&@bnM##YU5LIvA z$GAOJc5U(Dx~3b^EgqY{ z-cyyq%H_Yl?m5T1JAhrJl~>3_Mb^0eTFQzXZBOGYUnO}{kwtx?@@|SU%A4IvRqqcW z4Y3VJQ%bXkmwJI>wWMiEfMUFx$56Aob~kBS#tNjyOF}WpXZRO8&_DnD=zs8HZpOvu zqiU~y(3)b3>?eDbolil`j^F!HRTpx#>^r3#v-3<&3KaDd7L#|J($~R7dtXCShU!Tt z+}MMS@~K2R`;)Q*3?9-L-VQnJ%lakQ6Av;M*({zCncGU|9qbW^z;(0=;qnc-<5&3G zYeO0?%`V~bh3JUsJ!JiSQ&WyctHy-ai7~ogdZ&N%qMC}#wz;;b3P!R8itmo_!zW}L zE||U-lPx@b6nAg=XX{DK7PO2!zP_8N$Sq$W2%Lpl{Rm&GE^ttVJyn)2F2Hh0lJmdb zi*R1lQn5o;>@Y4naH`>%;)5=Y+%Aa{uV3({=KPP|!3v~G@8UJ)=GY?zoAkca=f$Xw zwPkRfPa19h{YF3Nw)*f-IaEHUiuF|xM8{Pmyfmh=a=+_OeksMpC-kRhWpvb=8G>Ys z#ZRR}Mjy%la$NoP(X(Ug;2)WfUC@ZcAr0OonKM#6oGx$JR4y^8jci3zf<=)oKJ|~p zH*a3=#RCdRRNTV|iVjCum+Hww+toA}p=z1@bY`}!^UrZp*rS31drrrBqgYA@DM%V1 zneu>lQI0yki?JFtwxFMo*XzW`jcW<#((nLa7|Ab&*9ykb`*1 zu4Nk&XyGMeZQsVXWz*mrN*?jqcgGcf<^-oESrh{RPy)4EKzs)wEnH9L9rvMvX>dg$ zw|lJhNDBk0%B_UZkMJbwI)C(^U$V()Blb5%$O-1gmVbn$Ydg}&Xk`gX=Kv%DH^_+3 zV?|*uH;cb^Xn5Lm?pMlQG}K_8{P)kOF5yMf8W+R_(a~3)9gcv5cG~<}2ul4iILAp+ zlHLM0FNpHE(UI7!oa4SrXR>j%UF;;{k@ zx1 z#+k8E;;g;il66j94S_s5da+HA|b8MZy+sqmk2T;Bpg$)i5*qu=1o;OXY&hnX@UX+Ku z)THvtvyC@jC@Km&W@N7TgU0!(O2d=u?oNkPBDN?-C!iooW!8+qyj7j+F3NX5duwQ) zoOl!J?l#@5#Z~`WX%;MZkXdeYCXzFIxE~4&U0AtdT|UIn)PqbWa@L4XH3^F+cF9`c zfzR-C4Wd>Sng-n$F%C{HT>-6TsKHJ)`w=|%iH}>Ox9-+BMPA7{mn&}yKcj}S+9Q;T za`0{1#io3=@2_v{HWp`DCb_^`t z3N%Yf18F;z-`_o2w|^dj1e1ogJM?NNy?1wQUU=wMYI&s!tA> z`Su|F0HU(um3^<{YELpwZz>*-SB5)p0?titCtUG1e!Y8>*y1RSv?2&IsH42VnB4Me zkwNCYaqdy$)48~~nBI}G#gqP8ur?b%{v1qQVCq!JMfDSA8- zyiwMkw0aTd#8#>GaIQ|sU7>yy#vBFe?0|if%L}U=>ha{BVIL^USb5M_RW)N4zCmE# zL)Qm&O!dCoj)MkkUYc>265r)KK%r1skw%ej#F8Fkz#zGgM%Ml?6QX}|LH zZg~`S7Sf(`!FaqocL+%|{qxdk+}v_zu>f%;Dfl5mplG!#$sRMcQ?J)`!~d*o^f8}y zS37$=&O_2A`FvFERJxLeL4uAm6o5ZUyR0Mj`2+UyL@N8TCvi{CiF))DFcZg?*g&jv zXDZo7<$j+FgGBY-&MR@3O1Ds?;oTYpUy6;N0Mu>>-7rpkJS_ZsC=dquR`HrYl%Tg7 zH)Jj>OB*|`HN{Ror65%NR!7q5ZnnTz@0dKXn-+lY`?^!la*^7dy(lPM2Bx6p=mC$V zHL3@gb2S(yXE{_JAd}^rJIE8H)D9zER89lJLSJZ?KkEs)cTbF|H5Z56;yEXXI;i@= zg_bw$ZMul5{9*-9?x6BTP2!X?Nj06j&Ln+i?mu{gPB=`Gk&J|w!8(=T4M8E6Jp=lp zK!DR;hs*nb9AsmW!+o6_5%R&Vvj*67(v6VBJ1t=6nUDjIedeCSZ_bD(mBXA{^9&1#7p zd_g~kLOB%T!IDvK$BR@6*G5w>sA7BD`~`M9y{;iJcZJE#oiQE!7bZ4yTE=QEmrA+R zj()15&pr&ZE`+5GGQ%Z#!lTP3LC5#s9=z+_5sc>j?jk%Ct~PTAVw86lA7iJu`>JZV zhx=t04(9XyLqj9Rt(7!iI74PJj%r=x@17{q3iJKkgK*eMS+@$#q2IO;-r@C;Y1v4M z+CVLLZBy$7xAuz=Y*`|Wm7&AiqfJ(_I+hOIT$>mBPs7(k5it{5SVMyqruQkH_3|)u zZPL)eBlc^1$o&C+ND++z;bV-6Y`zt4OeMMD3;9CxJQwvr0u718W#vYq5K_0dO~5UJ ziAg)+O;XQg(YdY=OQ>?Qfj++a`WT0!$K#EEkI=7d#;f^(!y3x=I#V@?mW^NhXbUN4 zQ6de%-E?@5O**pfgxKDdJ0P_jZIBqH=e_(BzJMJvG9Q(n6vh(EXbaFnL zDEw2<{9%LpPM;dlC+LZ8N3iR$l*CQNGgL!OfjP^1cEzf%zzSAjAYcm>6zdS=Xj&(i z@Jl1>1wLIDJ;88zy!amPeVbm`{;A4FoBh`31A7^*yz_GGWLXk}+p8e-ut z)m}o^j)^%^v1s`;k@)MO@cRv%A37hkTp{Qich@h6Hq(?AO3`sYhlvm3twj9=gy`?n zIdqA=piNaCcn5^L(;*nJftI;!3gj7Oo04qyaLnbz(Lny;(CEFK*$P_H?D}=mAqGQ= zrX<3v0B$ra6Mp%q`%*elG41x|0 z1cO6oSV00+?Ps}SN-@<^6=h#D`oE#Cnok?FF1D?2=>d=NFGsPNc(ii1@(}4w$^OWXJZ1V1?ZGwM6L}QjtV_XF6&qIE}$l4(SOx#YW4o5=FP$MGNGeyebJd7 z_U6oe1HxU+;6z%YwRCig1~Tg%AH1Y2fJ;n4Y#%6%HgrmrIttZp z{r&1%S%{gQG&H}b<5SR5KE5Ehe(Dsde+Az#7OCuN#T+E_80swIPAVFjK)kZJ@VKmQLI27-&(l%{~ybJ28f^WLk9nQW4ay{7- zISZuY)ly+3?=8-~BvI*yey~C|pUZjOC>F)XxP2&=-+=W=DYr=6%gXH@BSzosI4Efu zwRlJi;$*ROU#F&No-}HIa7m2T6bf;zksuNvQ5)Dfaph=HtJS=z7q{qE3k2X#O%-jb zw8;+X${6fKI|9JJJnoi-|DHEOL$^IkGu<4|KRY`3gLFvuhqT%}i-RGyOggN^amERz z+z+1B)}@yjb*x)$3Ja=)3%>frlr&cX<@H2z%dn6F*i7%>D+=7!KjM4 zo~c(y#9VAR;siMlh$%vRw`Wc)YPHyz1BT(8&>pWt*}q+3IBZXTc|o4H3PZeT$W=wP zK*L~`1VU`&d1YlTklaZGVZEO8$}n&j^DaXdKOMGu=lPt zLuMd2H88{;A^uMIE6V(DW!LO+E*qZZcTtR@y#cX1YoHNKzrC>4r>M~TqGvr;-LBgg!pOoF-}HXsUa>bd<<<3?xWvJY~GXskr=v3|LI5yp?n za9gcQ_}*pPu|jnC7SDB``yC#suZTpWkxx5qF{wzKF4k)hQ__P1;hBayzZugz??ieG zx5~VWML%#H#p>Nfy3x=HK{5&X*3ey^>|@qN#Uw+34mXcf8CkUk{*%4o8QA0D-QC?c zE}Fr@PgH%brm8fpOZ^t5jt9|Y%j77#A>}&JMK9BFowo7OzZ6qEc zbHvC8MD~1+z`C5rXW^R}`ZPq+Pg_c*ZNA}Q2b!rG{}{-rdBME5En?hL`tM)2 zO&!zmw%t>646W~@o`zW@OnX8d=B7O{t_1r4X=6pwW;q0#MC*Fh=-4%BB;*wrlcXo4 zKf7S|QQuaqeu7A-Znoaj{ZN$z;4SPZBX;sR>;=QjULj3l)4wfiYFZ-AFGA&<*4c@7 zskZz%Mg1uOOw(W+I!P8ffTa19n6Fe!vrA=~*=tG{OXu8HwhOQ@u*uxcpx4j~=d7kt zyrm|;CXe5)QM`9n*vrt)K_N;bhLm7kvoYLG*`+D+Tj$rf$%JckNotwm`o1t z*z!au+L@!P$PyRXC4cDbn8l&IIR298#rR3w`|HQNj7viB^70z8q_WU|^H`&_=|~VDqc@B=du985Han{{ z;EOYoDPQwI5I?pgOjZ!?C+UvSd)$0?YKmbgNwk~IiKs*0a6Qnz96r1xrf%xm^cbV< zAkx6;VPKov$}n^8H_SSQfS=233dgbx-Tpc{I-1dR2rh5cufM`h!;YU&nBZH9q56^2 zVIw+1Pz*jdX;M@SX&f!)4CtjzOfn4_3$r2uST?&w>ZXn@vB-`cj8{fWqw^%kFdWBK&RhsXze zhp-FIy{EnmafTG>k;-#Yf_*O5xGd<|{#7{og|Zp7A;G~?loh+Wg>D5*rVak%_RQWRCDY0R%1PN8{fu9KL<7LZ{ z4wB%Vee7|m&4BsGHfYOd3@o)-doW13fKq@-kH&19U0`m!ZUcAN=i<$tW&%)q&ggr3 zlIUd{>c$_vm>f8T{Eh8gOIW5P`{2Q@zH#qjFg1JpmBucZKc=-G&;uMI-baPq)aj1F zO%9@>028M{Zqw#Vw-coc_lt)ghHoQmfwGd>tlXr0qxdvK9~@Oj4(n5^wTaGP_w_~4 zJ$3da#fLQu7{=M~sI50~uT9DM4uN3u$ip*JAyZnp4jqvvVs?G|d^8}@Xb zluQVsqodc+6iuoP%D%Z&(0M-+TtOccLP3CR0sz*~>m9soiHeqKK38SW1tog(9D`RQ zgIJ|j$&m$#G5F>&$QprSWIc-$UU3k;LgzgmuoO9EEpmP3Z}p&G77yB}F6w>T{dpbu zo-J2YG%*M=3h-*Wu47Jwl$-=Gj((s?!x!!fX?X8)cmay;e5npe4Et38nCUP@d-iKLN zRXV!!4OIoizZO=WpF`O|PTlZXC<$^%;nt)*?gu?Eh6GVSOf#8^|IwoNyZv&7cVUaU zJY-9gDWUX2E--^X zo@*03c<)Ggvx{-9B;y|(!CHFDW%MPCZ#6af%ECE6?U?=piK`@biS0L$oou}}8ptr4 zpV`V?y80LzaQCEILq?9Q!fCg~;OCeDiHO1&1LhL;?~j&$ zg-}$vs0L#;^BoT&raGQ%$h1}=tIUgUo{ zn}i!heAKEo7RaS!`g_-ZjKfUmO*N%ZrOr>(7HTkJUO~{w-$sR`J%VHipNk9(v{=Zm z($qOiGaGky)29VaR_e(gX;kwNYZ#^IQaUERIub5d1 z&Q={KrJbbIB&5}tB-F&G)rg}7X(Cwpa8QKr06Wzzu3{w1kUzp92wC!mZzq7+{6HK+ z7oay00Qy~R`p+2o&+-~i0TJ>?FfhCG4EpW(VVZnSdIKU$GFym=6eN3$(BbpQ=5rBn zAQ^ZFv<~|QuSY%&_^B@l>+XLf&N9cPN13{kGwmi(S@z!Qtxx`u{_Xu=rjXsQc=nkE>(A3UK?} zUriP4@?e&X-$)XAjsCcf-UY%rjYwC9;ZD-95$N0J+ZkHQKg*Mk5KPM~K?Hh=p6I_7 z@=q;vKU37nd2Jw{EtEgV8dtO;2J9xs-JXCN+!yLMNZa?eIeWz9u1klF-vZOnd$DhA zCfM^%V5NCM6&~<;8S(oz{5Ql!2Rnh;|4WMC;FUnyVrBXPIbc>cFbzki{DyD;3!?1c zP#0+&4rGYi>Awd-=zw{3xvPsj_QCaO=A1(T=X;z4U_K@*w&99Rpiy2N##Ytn|Brn! z8~|oX_tDo>(;LHz!FuQ%d)GX&O;!L*e%3akn02_bZ$O3J$-}Q_QtChhvkxebnaMpI z-=xZGIMaEZa0y=h-%I-Mh2dsc|KBU*wLtM|K%;V_0EE9IaMX+w0Qg^M1_5s5=YED7 z)ZhgW)(rlpc5u%r3jp}v0L%vdzMlv%Lt_>-6CnbW%uj)TjIRS00`uUQoc}#sK7ivl z?V~?*^iDjB9Cg0V7~TIrWLONrG^=KJT&}-H^g!R5rR&n_staYA7{2T#KKvE!aXKx4 zG~tD5!G;= zn?#i3D>GkbOiN2kK#e5=U&p9%@GBZ-Yi^KUYseXF(kNot#8N6NV&Rv^)hJqr>a@U} zA?XkKnnWMeMNDg%5zGbo(Yi6nk@yK6|%;8EKEuAkt9^go?r93!Tm* z;D8~8YKihEYsFpKBF?0!2o$9ms`r=^`k*1jHml4qdb3|v6y&b`I%-`W818-c$&C#~ z-4Q5SM5hZzV}m?SAyf9wbhbWavu6oxd(3Yluc0M?$G7*FC=@Z5I(~w9(93`))ee)q zL*?g|Yx=sQXUJmKlrgECITm>Jd;}fOwwtnd0@A>HkHAw<@~oI_0W&x5zkip5$wi=^ z>cFZS2uJV8y?8Ja-Vxs68EBeM`EK`XXYriWFo~^hVs13Lh#OY!8U@!a9{zIwT^kttv0#D&FxGS`PTCI1TtHL@;p^)Dxq3o1H zwPlXI2MIk1d72Lsp3UCa=`$7LJBdDBQ4Y=Jl~}uZ-1tlELE?_1Amlyg`OSgs_uS$9 zE0+2wY(MQ&(w-8EQ;kpacX5J#0EziOX!@N2_&*iGB=|qg`=A~QN((_JK(Uy5G=)_~N)jN@}E5ySpbRD>PmGu(c7^sezg51CU6`W2Z1k>b9 zq956T!NR(ZGlWWtteh2@TV*R#JoN3gLjB z_@?fI5aErx!9!M>(jUgQif6t=Ew*a%7q2UlbWdFyy!P2tg3J12SC#$DsW&zUIC~m{ zPbv6J2$*2TWod5Jwp#*JM{;ki5CLxIbA#`NhgMJy=HoPCxZwi{gJDZ4uWL4th2c}w zH=RbGw2$si3%LfD*nIK8@&6q23ZY8-GKjB9|Baul?? zKZ`!AsU-;SD@5+jLV^1s-`SV_q%5e`3%KDf$B0>S=gakb$nD01Rg~^|#g;^vN9iH; zC!SHaIAJVZ2(n&^`+8Qde^(opNW?EVkH;w4a$RjLBr08b-bCy9q#2G}(-)v@)dt(_ ze>Hz>cu50bOc^(5-D)AT(#cDg(NDxvXrx3{ewFg+Zp4Z=!dVB*0`x8)rYam>SmZ4w zM|_l}tjsW`zL?vK7o0a{v$-a&n!XX{+zv*y-0Wk{@u=Dq1D9AQ;y)^2exRt^Q-p-X zR6$>qx&tHlFW9J*ufRBeF`Ay@Z3G$ zV(yN?YS$n+hR)9MGsd>bD!!s%h(MiSpYU#fh7gzVv`6X7U}+FRCA|9T{L$=NI*0D!F^KGqR9CE7xHxTqA;orlHeEf{D#j+o48l6 z@ZFGm!E6k_M80)D99_&;^*}+|TYB!#s=kf^4>w~rNd8bevTgQylqm3mz&4!^WVTP{ zL;X5AS(SD;$Qd_?HzVU=4S)LNc?1Wny{_X8U%cBBVMr+D|33hqKw!TomwA2A8tw23 zjyKtiDsL1$#*N|ZdvZxvMzkCpuoe z1G&BpmEZ&0ejf6O4^SgE*{pP#6~5iYR}8`{LaM{GWsvhLZo6+fUO$O~kv7KQ9KHuh z0lifmvl*>fDN#5j=WbHrV(0({pLhX>!`=edjrTE`(pfuu1iZHT?xL-wt1vzW6h=xMG&i!>)IMWeJ3}Yb!kMWz zjn+7h2E*Tbz<9Y^#_zMMg5cY>xzhvYYqFu-mc6WgAaF5 zq{QJ@Nxwlb9i)~~+`kV1Dyu0~B)A>}9f{i5tQFC;@0J@F&;WSZyRiqEa*tgAPhXb@ zoq_}vJQti8t+ie1RyhP~3R*jKrz~fT_In<7S0Y@d)oyRc&G(Fwc!gmW3JMWKKvfk~ zSgJu_0>Tb^zjL=(b?w%7y30XOu=22V+E_N04pMc9EbX;;orQwr=`q(A+lGX@&DJ|` zRCH#)k#8>L5pZ#Y>gk5pR26k4-cokEjV9P3X8IFCF&@rioW-!z-Rru+$Afv<0?b+# z9Wl6Vp<3x{LFDPXDJ|;Ms)|(WM}0Kb?A%>dq&_%@Eb=Ia&UNj~@)tMGYc3N1mv>aXmpoQa_Yo5WwE|aejT2Xg;RaEP} zYO0JPkl5gthNRxJZJ$-u7wc*xSzZD$d%2sC>%0S5_Vq=Gf`FRj;26+!5uxVR)bW-Qat9@xv<6yubLh6~W{$g@Us;-1%XQY~4XG_nLOiJ! zW~1!ZR(K#shn%20dWTg4pQ*NHv8X67DOV#Zjp-aOY@yG@uLQttvP*|yJS0O z1%*Opu9>3NEbNthREI@%y<0Yo)T&ba-?;ET zdYA}RTQ4pWHs@loS^*%1!+Se%Y#CH_YNS#uZi@_Fc5_215fH0Wv0{fJSPZg`rFEZO z)s5e}x%~@!Q#R~p{qV)Oy;4d%&L$ zOxT2#x3+Uc7+KAf{R0z|&BML82xvS!Xu&eBWz%kjF&`{LU|pv2=4*lptz^@9cIn%B znClw{n+fy225Ji96;-rHY%9QZEY0?XApi@~#z(zZ&xOa`sUfCFvI4*f0ovF|?C`Uxu+L)|c$yVQ4`%V@m;uh0kLOi4kGm=Pv^+Cz)gD&m)MMy7 zMD3NDV;oOj(o(*w8qi%IDs~&gae~7z7|#sQsvQyTGp%)XGbd2TcB)voEZNLi(+=&a zu(=5El44CccIy%bf~snLEGPwEbfD)g8&|jY*ibQ{K{d`|=fYrGHsT#6jq1yrhK*m> zfp5XbXMXG22@{z5B=8HdbZH$Xyu!$)$S?x1>9%xuXsp_I%S;$-6qb(;(iZ0vPV+X!3VU=pP%6b* zL%dM1s)vCtv$0LwnR+NIs(W`M(%eBKXRUU3Te)3PCh*%~k0anb3Gnxb?N@B8q&qgI zshc7&NqXyjb&Y!8eRlDydh4dTy?;6)tNrMTulZ3GTcRqzid2<9)`&?ZkRVAX&-eIW zepypK*>L^5>W5BPgVj+H9a^wrNp>WcwiCbW3^F+Vbo0U4Jh|sRcU-$w9P{3uIo5Uk zyYn^QO`RvMsg=2TcT3lUmB=x3#)3y!jYnTA8of~~j8teyJbowyQ6p0$+m=N+!XPUb zw~(l-?VVR>eHVi)h;1-?zN+l2s-QDrS`*FszU%Xh6wb7w->Xy zYF)p2{@c(qfD^~!4@V`xh|{GXV06G|b~DSsUoRln-!A)mdN-#PHXzOx7_qbsb7O_% z)14sCRn!qyCjj$lgDa)m$)1}SWM@yV`|Qleln*RjpIaX_aU*vR3_5pJt&V1_dD#t0AQfrV_a8e; z-M4sdw*IIIk1qu=xzjmp_*9+{#(6n8O*P_2w3(_|X*IQEp6ja_RPMJPH!}Hqx8A#L zo2k&dyQ594ymHje=kN%CPkhIZdB8RV5+s zS@2D_XfhVs9sPPsamTw!s#kXuIMR*#xhD^Cvz)ri=t>j5P~GD7_o>Lz!-2v)-c7Hw;x`c zgLf{06Ldebju8_gduz^{!ltXITBNA<6sV$#s}>>y&gXXsh@M@*26*JqX&uHXRbADZ zl~+io;dd;a4<7fXg(PT^RaI318`kbKKo_0Uy1pgqdd2`%RekG`?%=pn*gJPk5$|(q_#7JFaCW0mi790YSKsUYC z;6f8*O=)QYVrQG)WyH{%5)OysjR+rtVh{{u@c}~{^SY}`#Vf^A!`xTw@Iqwg%W>SX zOB*sQV{nIZq#%Rem#Df$hrn%&fbZA2c5e#gCca%AY z6Y=AO5jHRcU_-!odTcVK|EI*M z$@iVQEc$!iiDge-_pe3n_r32%+spTj@E(#jlYV~|Kv;?A#@1(TBh}r)M!vh(l-nPA zv+s3}4)%{u3BM{)?y7IzsJC-)c*?-}F6HK?*MXJl?_F=h+&>)aOF#hHA{tY4Q~oU52A+eH;(o;nc#xzz}Jyz`R&w0rkk5{Fe)0+ypjQRypV+3n1_dnRO!VTkZ5Lh^M3R6U_u}shMTDflxY@> zQIx?Hoj~WRnLv6%U8QiY8y!t=ds|mp8>_5MIANp3@3`)^^XJ}Y^7kiqk9gckg9^Ad z=01NM@_2pgiu6GeV+X@gCF+Q({ZSQLo|v7p*R5tVGHNJdW=RbqK>`y4Gzo|XUw+%# z^S?at>(7sERC(+7H`sgVKqnQD09BGfL>)#X1c*jLm$qvqwl>!0t#VDE#xkAUnVS?L z3=6lv=fM2DUd!R>Ui(d?wd~E9@uN&;M;)f7*^D2~*WA>?DhO&@O{AESMvW|KqLMJp zU!Pk1{b&!Pf@4NF|eY)R$hI!6>@#pV7ynFNSp6Z^(hAEMOhFdEw zl`WRbWi2eNGPGEXtWygWg@uy?CMyJzQc_ZsmQ`);4S8j@lCiZLXx1$jf;5t&8DfSZ zf(rpDh{X|`uiQ$nFV5DlCfJmiF(VkL@sKpKlrfZrlPXNbGbE3kno@4XTY38HYTh=r zirZJl*X>D@Kx`73D>D@)pH`~*-(JepNsT6HNX$V&8uF*#emc*eb))z9;Q6`k{O8DF z4)>KENg?3ETGM*V02C*h#?@an<+h(}sWP$(F_6qjOXdYDB#4p#Ws+=$6uFZibYVIC zj8R038xsj>8boX`eA{ZT&yBu!%%d3!0|luhKYxAx{5cQrvz!mP;C=48bMF1}duiwZ zPo(0asICM7{(=s9d>DRYvLWZ&4(O+QeEwprU@#&If};{FWi*Kp$_st%t@&+VzpLg` zX^EyrYz!bkVNxVj7AUTu2lu)6``~%z%M~p3kXz_ zEdH66PM!A;9&WD|PE6Fr&r%XTyR4YA8H`3UVni}iBw~s}Q)P%+?X6!Pz2=P(LQ;!_ zKd+is`{C6*pV~i<;pcvC{PBLk_n!}Ta$ml95=c>!5F#3as4+Gbfs8M{a-WoA)-CNN zqs8*qr9`*yZS$FvL{kF{P*j;LQ*9v{2zIus+wt}B_jnXy42uy~F+*S&e}5ma{-yi3 zfM@n|4(uce;K)P|MT)^hX8~qnnT7T52JCT#ysJz{fwb+b=UJ*%ZTqVDz)eV@Qb8pY zWSU4tX(~vu8yX_o`P*B0^?Uu(>ieWd3l<2)c_cZ1ukY-A&FJgTews=be|g@mJ$LJK zzW+C`$R`;S@sNyGn8rx;q20|zV{QAZZ`9j~FzL6DLr!y;U|h zwA)Imd3^R~-RT47+CDj% zn8O&c6%bWN&VoVxw*P$Qvsdx6?d5&XK<>MAd-k7oufINg18jmMiv$t?9|v1`En4f8 zM9lfFCoOKix9;z@9}xJ%b1V<<83>>PFj*p!M6I-IMWoTJ$k|PlEX@*S4Ml1#V->9$ z#Uhk!Y-p6- zw~)JLy;uk5+yi}ZG1p%w90!E!z{Cg)GEkygkqIA^ji@{lE>oL8Ilv?LNP+YRV4z7AtN0cK8+DnVM-Q>0v2FIHB=gH zha)IbO(9gGlwhU`rBIkXQbP)(4HBB(j9o;+~UEST}vs5e4iBts@RK*br zi@=0xpi(9Y0W`N!-p$IGX3=cI!!oQ*$|Pm9R8?rFXi?Bk(q>F35^NStrz(PuQl=Di#d;;{ErSQCO3Aqb*UAXtEmWQC(-q(E5) zJm1ak`1$vdiPu$#@mAMV?oN34v^Zw~#V)K`RTI~{Q&g_)!gG*<_70hH?58w2sxbh; z!tvgPr@1kfAj!>TYT1iMn^IyJcRcBxJ@U$*6qn|-xnq}Z{M%@aU0&%XCt$Ce)YOFX{!)7$T9kWwhI zVDy2AmnL@5Y$%RhwjhK{8l4*JR^?c>vRQ7*Z(-)xIlzdDgmL-$>abl@rQkZ3@U zd*1X!h6#aPG~M}vyZs>NWd2sXCR@Cgadx~-RM zccrMBt3-QZz*3qW;?&uejWu1})pT^J!SFik$6atQFV#~`N~Z^M@37@xD~VmP$#%!b z7gAHf#U#i^_A*dZP(0r=W@fd*Cahf}Ou>q&94ejDaiKJds;f~lb=}p^RZ8wxZ*}q4 z9I_9}^;P^UFhx^CDzR5XFd67c165hw=Uv_mW5kN8D5{%>O6S#5Pq8iuvQuP zM+QCFcFQNIZ`4v&iNhrTQKbG=`}c1p;#&7gpRY)x;+82^mw81M7v{6g-U-gMVry;F zbZXxnBCiJM#^9lC;`3%=t~}YNeePX#WRg2`oXu$K*IOH#rZ}Q&R_n&5^_Z%7^>MRa zT;&~jJk(XLlx8K}Tuoiuy=_}*gQCz=Z023ggoM`4alEe_T(wNy-lpxg+g!ym+*1{I zZCdX~H@0my<29L>o$b;+u{Uj9PWIuwS_nY4SeaEwVfGql3phX+m~6jQw63Kqb#Klw zip5F>6mh175ZxqEM-oxqDv8?2m?T{=4KVzbDpvKomw|>F*RowI!^~mL*JPAvu`)Q2 zuz{t-!f(&L=gi*R;6S4YDkNYy4d6fz)-UbNQmUdY8cX8FTgWrObXC&@QzDo9Xj)(k zB^Q^^m0x-js~Ard(pr|96|7>dTiCXZ-kU>pd$gvk42L|nRkSwHv||IS`CpAj(XwLE zR8~!mh^;9_79%7Qk*KpWQ%Ox2s#3(IjRjt{ZEwB%{`>lZGE)2EHTV6DrijT(@AcWid496&DuP9p zNQPrsMq+YGNlPPC*(Hjl5R+9REV6{FRaGR5BT~}QSyHv1WCIxpl0pe2KivNxJnt7K zlAq$<2X1q;@Eha2|98(duO#5X1Z81`k&`PHQHClj+bJ{cgZ+rbsH$3FL1~C(VwFUe zvn?N+Zg2tP0CE`&AE8=PO3=|XVUpD}jTo4%RM4$4EJ>#}R>MsdrYsJcOI2z(m)SwZ zRO1br+TOag%B;0t&3r>rXtAtpOtMr)O^q_trL1bwShUMomeiFclWZ(9NeS=x@7(x* zFZ@rW@l}E-$55!PZK9>Ima5fQe-IA;zwMvH!-jr$`RDI%>(2;hT=(Uk90&)2{$2&P zlytIMYvW^Y?8bz_lVC##npq?F?)-44BH_zvZen6K@XGJUNp!)G=QfS7MoN0%Y)#`N z*7Ie%3>vqOyhj+Ax0hDCYrnetmP$<;#AvoLMJb7qlF_8f8pRrt%-9QTlw=}J>e55; z@ju_cpTJ@Gf9OK>Q^M7vrArbbbDYaUsx3-MD?r*+t5%fh06*TRf8jNRTSTm?F%_{|ipy%Mt5sj(LPNjyykC9)x33v{ z%jUf6*RE^lD2MNi+nM8?685a8O%-DP-Q1Iq=Wc`E-M5|A3XH{~#iKz+Ws>~(tMygy zOsd8)U$f5Cw^gm}Evu~yRD01iEJ=d(q-l(gdP_*&n|9atSKPBxW~G#kfW|2eVyv46 zj8<$}qB3g4l_fHY(HnVM+Rw+F@BBy-^X;K&Nm9VHwuoA*S{j-}iiJ|d!ljW~YNl#| zrX*yQU`SO}s#>dR6-#Yes=v}mZ2u;F@I?G?G1;sBdP9HkSl(-2sd)jAC&7o&3KXzV zs_*DR69SGv*%Ke`x-zICV5L&3v_vv3Ln5%mh^19G=H1AMypw@fhZ{{AOo+tA&CoP@ zsx&9=&}oXR6fl@tAhfMUniEwu=-Re7P<4%!v1z4RRuz(X-+WG1|7Ghez!sTgu_P?0 zB(*aUsL^Rmn6YHER8{JLpWpA};C#$~;z%0euG*^=5n9V`%*x#WL1%A}&%US0d8Ok)uvYCDT&kp;aum*0K|xiFiz3Yg z3P^ezQ}uL7pg4K!g~9upR;Af|HY;koI=R5)xJS*YxpSLV)1g$+8j#j`q8fp{8&ALR z!HS5f1|le|D=Ca^q^y{VqSTZjLGNw1&-ZHG@i*(b7yIF0zTFGilNSH)K!T$eUD%4C%G>WYk zz|P7Ou(_;gtP6`25|sr;P+TZ3P*i+uM%@5feytR=mDZK2ZnUPQr@fZO%dBk;v53}- zN!2&Uu7j#=s@=E8^Fu8eX%@s38Ze^}5D;((AKyFLdTR?aL!V{QiVWL^8yH~d(3!31 z*{#gCH3L-Bq$E)4MGvk;DlR*4ksn$W%BluYKC1Gd6$BXxuQe$N3H4NfKWH_ZK#ofo zo4K<<~5k=O<-ngHerb2y>9DserVE!L}@T6imyTu6rC6(s-Z*| zPC72jvD8bMGF-!3uJygR7=gEW3^2=H!Nv9Do7awzWbb{~-N!xd;y}GsRRE(!23cds zgd|FW6TrHI!g?rWI-}x!JpuudDS4JmZ^bGR0H>x*8=+{KG;3PZK+8eVxEt1u?aEYD zlqA=i;oXf-TrUlXPL{UYrh47XneN;uc1?-ys#Y4^9GqHCN*yBI0fafQ6Or5@JiSg7 z?i@Up;N&}kwXM`3c5>lY4H1;dI2hvQ6oFvFDPSA`k{SK8T&E3%zqS4UbaTt{lKW>z zv!23wkP{|8Z$=1jcda|>7lX#{9(Ln1aCm#be4at5?s_g}@^uCaYeC7U zM4en8*zHpQwj}8lxlaxX!(V6E!@@3>4vc+?22r|?5W~b>LAp6RUIS4S&iv@bg+((l z`9w(`Slu+wo^Rcot}I!dGegfg=PD~Y;|rG1qTu0;FI7qHzKOgI=v5;UrmF}uZ5R2dnp0F^$6Z&8=Awkmar_t~rJIO-LaAr;mcnDOli zbP%VB8C^?;Rj5@V)zu687`Xn1Uz9{qSj;d z<$Fd_x;v+0_~*1!5A0%yszEUPOR8t#+i5-kI;xvnFO>85z3QI7d*1iG?^KdT+ikqe zB+voK{U^QeW&6`rUha;&dtE48S4%NWcJHh`frCq`q@^7PQZQFPw|Mt;*Z@!)wY%K_ z7hpjNBzIiMNvm#yltl5<9T=O0>6E1NR3y4Bz+&m??peN}cUm-XLWC4JA$=ab$O@raG;xm8 z9nTE7mo<{1mfMxKwHuIS!KCb&wO5bSNEz>Y!53Xmac=0|l&$?$(i8(5w++MEA(P?W zHf)9gJ_HfsNPXGcwFPGB?7(GK?`LTdoMv}0b98IHu7Zgm_!;049ssPaqq(*=(p_^U zPLjqcmZupvZnC3EWQ?~`Fcwqe#@#~vf#&yaO(fS$(1xI0?YT6QR{=#6qo^6Cz`Qk~ z?*a(ONGdQE5*^~A*0Q!L~CxePMX!NP1WE@qYMP!1Z0rZ!Je0Dh9Wn& zE>PLVF(C;Knhi(N*!JObC3{=bqJf~%u2sCyh|M=Or!}f<;J~JAQk!!MnUo9xq|0sr zKmuqC7mqPFBqY!v5YZ^QRaIWin>DP*Gd5(mLI%4j}hp;6FjpfC?mxnU~|5$Gat zrr5CKP8*x&ayK*)F2rkZ1F;xJXzuc&M~@;t?=(X~>*y5`hFCufJ+u z{q~iAIvHd=;OBn#yg)X@SjWK{3~jBYSc&TeFieUzU@;&ho^mvwfM}$dEja^?rwnPP z#1JtAk+w^aNZ4*R$#Nv5B%+fjG6YKMy+lFs`xkw=Ukc%pmn1NB3~&}WXOKgql3jZ4 z%~ixGo?3eOHt7=i>z?;;HtzepE6dp1e)Ao=c}mCauJw{@7L`dm^N7n$N*WL(*{Cj|VGB~~?ZXun21e+Nr$!74rOyP5yOdhXE`XGv zikQyu1o%AB-Cg$FqdeATr@tUjNiR?Ml0g06TO*_LRM;-RU~R=zedTa$8bWbHT#peB|1u>@qLA8%@}-Vlp&nwPPzy1k$HeTh5x|xW*4( z$&AApV;IG=B-?4I$%KT=-u1-aGaMPn?~V>O=R*{}Kd&!}%Ba5mMUFh;+28RZ2xkBCAaw07!p4*Sz~b z%U`?mzj?1f4R2Y`GWdVqaF7ey*GVmJ#9Fq$zB)^taUwZRGH zn=ufOGEsnltiVYP6VG62#N?4L@)Y^s^*DRZy35bgrUjSFjZ4BI4y_j zX<9LZN6nG7G~d1}hA?c>tyQQREhf9#8<=Gty|y-<8dj6KoY>ujwd-HX`$=OqMA(sx zsG>H=#%4@dw)M8Pez*7I`>4h+e?Kdf5r2~mkd*4ERV^&a%#^}KBoH2sM zWp)P8V+Zm6;~##HKg=->D$JzIHi*itt+Lv!w%XJC_xG9m%+KEW_j=a#+HZaH?|Z#x zhv(&ORJPk~ElSeYAf9{pM;OX6Se-YtTZ`tEsQaX}!I1SdEm+BImrnI{mnuI{zaa_I zNg?~`!1{T%(zeo;!qkykVwgsxnObHER;p1``|+>Nzm@X(ceMUF_kIEWrj%-^qg7EA zYGU>dKor>h$B*+Lz!VES%nU&oOHKQu$-U$gQc$B4R(MDsq$J3yu#l3+K;y@?Uz>oolwwQMwz(RX*Ic@yDbmrE4CB*=dfT}ks-`f zwIxHOT+2-bOAF&gVWbx#kr^VwqYkH7Fo{0$>U)k!!VsPk1pD9MpL%Ke_o6=*iELG4 zZA4o}w%b_SRmr`0^V1AG55B$6(~Jy(@0-J<_zEb256G+^mbJAP9q(^9l(!OQj17v7 zuD;ZL)WMy4)8-vxSY08_H6sih2?^jxA3P6YGv-qJ{LRNufAr#Xn2AOQr6VcByn4X5JGD0Z%no-aoAiY)M zO6!b|W&3^a7$=^i)MHKe-70A$*0;Swc|f;VO{TENdq`|#BIQqzx%;TG5?K4S)4RUo z9oLF9hyk`sL@89nDw_lX3}nWl1o`}3!|37oOWx@AeVm@jJW!|J&df2IVp_SDDh#`G z7EIHZ2x#5d=JK!%lN=ch3AA-+yVmyXuJ+YC*Uyl02aF~pAXZUZ3$&3$s04wtTNosh zV#E$)S%F0bg32IG6i_h(qA6mL3ky?_awv$TFoaA@J6S3xP9(|+SRzMcg%K!Gb3nP3 z5(bT4;2ZoL-)!#gPqo}&zn|>!=Ac=`n=#eb!?-0~}wa{GDn(u64l4dfNT8ue`0s3ivPT*EIoY+!Ts z;(RaDi6(o_nn;pa_q(Utp@|TggAv(^_-Cc`5~X13RoXL#OWF*cXWTwdvlEGUdA0y_ zwp>JgQgl>qTf51TC0}p7wa>QUCoNYD;=F6T{qZq%Z2Qz^qul%}pSMk1^?KOmA@K%u z-W=SV*&M2+t6KQpliuB4k~@!P?4I|#-j9UcZ@bx#+rG}Xn3f(18})kyikfv#dun&L zA$}QlOZS}jz3abw-uJ!ld(|Y3B}&rGxiKW9M5y1cdPv%sS60>O=d~nErLXFxRabv~ zR0tpu;q2u_*n=awKX&dn2-BB0dWUVEx*5>Bp*%h1ZV(N(VV$lRE`mDD8#Mdcw(OG# zn59C^Aqymx>h9H;ELz~x0InC?NH8Ga#);OoM4sI(y4wX*aqSy!s#Lp*beX%Wfq+<+ zdgcux0qVnhU@_sQDzV*_S4hOb+lQKisBt%{>PvZ8-+R0QC!NURe`&F!(bdC7D0qb7$Xm7S0$_Rs;^5_#lnImMK;yk3TPSTt+e8^ zKs>N&Sk$pg8}JXk>c2HAZHF@}aG+2!vsRgQXZKM>Y`|dNMJ<0yv1WZc^9(2P|r-wT<*hWNXcaFNAL>wL!IXy*z|iIQ(zwwGMY zxtz;w#Z_P{Il|20qx_Z~<}M-QC;(9o^l) z2i4bibi1jkRqCmFnrWuG?(UUUS9NvW-72cD-Vqpt)#|t@Q{j|Hk8s3mqPVzX z5{2dQ-OYI0gaH#LbvGYy!H7gb<%mX9@;qEh2zrZ2Fc2U_N&zBkyuSO*=gn;ARO^2& zkHi*4<-0xU9mlsfB=^1D3eT@Qygh33&A0DB1$N6L-Rr-380VvDcyu1eoDJ@RqDqok z=#erKWN+6!Bq;~Fyr>7`ko@|=Z+gwQn%m@juJsDbZ3IIoZVS6L z2qc2-W!>zp$&&DlcdZK*WHS=GG*wWiX+*t80$UN%{C3rCW>ONyY!=XKWDe8Y4KS59 zj2@~Gbz#Hfg7-S_RglKf(Il7NUn}XZjc;iX ziEg~KD8dLU5Ku^!Xk%};Jxa#kORnUJs+6{o_-L?ieo8tYCv*e*n8TE4kSJ&imC$4d zWXw0CM^<%UtE-{3!)PTEK-Hnfx|h{Nl{S^orG_iX_s~}F-rP+3ZO3DWb#Hc#E~O6x zLvE_VLWIdGxZ71)FK~mB^rPFow!8w&y$JYv5LQ^o+Kpqu+qmk6X(mpf;FB*XFR}W+ zuZGoCM3Giuhe=eFD@xV1wp(RmZEDo>*YBCFVc$NtpO)*$PkHFy4>wKIynOecBqyQ@ zpdt#k01O)?U<{VQs)KC?)(xp85m7&1UOCArQ--E#EYwHl+$e5x;}j%fxm*p6QLJ*M z#DOUw6Q!94RDV7GV`CyD_!plf(M*A2LeX-8>;MQKUmu&U!#YW6RH{b)|IfX{&VN3f=goAMp9wSwgoq?X5=2llzoj$OkhIZK-p4(+3L2MA zldh@B8)Y<9nv>_RSiR-j=8VPXd);os>m#$R+q+bJgb$ui567i8l_*+LjT(g&gGJC~ z7S2jps3EFXX0(o=oif!zl?JM%S!k$KkVzzw@K8P(>xg-j6+p+zZ|K&)o$UAfx8IzX z&&K&IlA&8_t+A!GWo!~r8pKkvjVHmdaetZKEo6~s!u0Zm-i*N|k|68py=#4d2LB(h z{VG4>GZTbSW}#;y(AcCwNTK{w`E=*w&aLOJ|{Q<%#e}-0>b3)VX z9HKL1B>VmMg#?>5awZ>Wbksh44QF?wMC_TqA9iGe50D6ZKYo2ZKcd@8f;5F{hdL`R zT4hC~Wko5KTG>)Iu_~{w=>7fupTmCe`I)|O;m(wXm@X1(cc<$jS(*QmWF_ zs#Q{2N@glpW&ZvBpRepL{VAtLpMP@GLhBEk{+lpQ=(buV8D_H;E|$?LShB=dn%ZQB ze?wIJzGU8*2ZWeV%1V3OlHUkG`R|SNko3v?9k!|hs*40li%*D1q9^Yzz!2es_`iGb z?(@qFFEf^zr;nsh%Oal=l%YoGGbjSWr1ne)MU(p}zkhz-=7=WCBz9!Fu)YL`@$UX{ z{Lmu|4u=a4nNg*hV#{S|qhE7(JpS9y3Vr*&bKm2~=n_K}Wo(wgt&+8Vw@-<2-OanJ zw`a3#RYhp9QDO`pann^wD6VcoT;gb9u5gV(C11Vy*WP~a>vNmGI=4F0?L9pMwELa2 z3n}PpUHj|ua|i5Ik~L~tn5j}>$mIS%x9{Lune*zuuU_YO?#yMtc(1?!@MpyP-uJv| zY?h?e1y#4}e4cjXNy#QE^adB5wj{w0%Yi^rxllx!#>UzUMJ0$7P>Kq8Cp8NL_>34s z)AKOMRxx_d6KyY0-Cu+Yr^UL4fK~AWM;(maSRS818-B3QNGK3BnUIB7pvt}W! z*@lviIH@qo*LpRgY;NgI&0}taHMF`yx*h9gwI~}&i1hP!qmKbAku2vd34su5vj}y{2Q292zcnFp$Q=v%5O*)}HMw%4jEGF3Vgs_-oL@0&{ z1w@5a0qQIzQKkZ_bydXIbM$-A;XHe`I8vn_V%V4|#Og(>Eei!8Weu}oAzfh{K*K|) z1XGoel~9BbgDg>I2G){_Yy_w^wx7o5@BQ9xc6t40JNHnENjL1lnSFP6ee-`r8;Gl^3>`uH;w$dLc9_ikbe-F^i7I(kKBuCa>5IF>?7jaj;# zl>ND#Jvc~_U>t-#=EDFkzAflIzHg3OgF?{_^6=oSy_+RA);-pgZ7h?!UzkVDE`9Gg zwmTTbAl01si(921MxO0A-QAgXF6&1De30O*`+c$zxZif?7a|#C9yVe`F=acP&)@O+QscpIyP(9C&uUHR!02 zwwEs&)?u?)vJP_`%t{>S{5U>)@>`?do&N^0*Ha(6en2{k3)@Jxi(1h=#gag8<{SyM z#DQH19AWqh9udkhDN(0VBFRL>Mo|znf)p63RU2}us7k7;k+A60RNV?-*TJ=~mSrIL4R^nhkpps!>LzzeX6_ouiA z6%O|czj>tn=-YL@eY@-M?|71I=e$WEcN-MiUc%p`oZpvNv_pMbz$Oxtyx{OjGv@C*DHOtb0LXVbf6;hZx6BX|i0uGX@(M#sEYkSGJ zE@yh*j9t6SSZy&nn>Xe>zGyQGH*Xp!u7<3OyFl|GQSj5_brHzrrW32o%fi8zl%`c( zjJNgOZYeICXemvT64wfmd*1hk-QhP4%)lwtHXE$BLU~ev_)}R9Ge(8UhU%%6OkG40 zX;f_Eh&651O7d4!tHQBWB}?8)gvnMe^T1W#y%&H?EO3V-5a)!u76-!l9SV~z|p_<7!)_dI<(J-WXSRY8yhcK)y1I|?pR(4v)?s+J+LB`hT2l@^tv z`L(3ZP)8zZBPb{PlW#WutX*gM;~&@U;4t4v5c*g5zYnXrH5iuGT9%eAElM=BYb{l$ zzdrwO`@)aUy3aoQ-FMD&PXhFoefmgA?LS*ZiB{ViRXe{c%V4mUppXd)WFQJGB4;c{ zPkcXQ+$YLbRtNDrN5VpM_CxFR5%ok%Ew&bdB~@xtmA2Z^jkc9@-5-CwGxx|CdU@Y9 z^ZPh=yZM9XIp+S5fPOz4D64HMqutzGPI}%I6^b>DLS-b=MMYvXS(=$;y}tKvyBY^4 z%f@04B>R)_Pe>ED@7X;1G({GSsSbu&Mj}R5CjNh?_prY%vi|wXcpLZS4}l>*&sUX7 zs@|8zt`u=RM3$U9U%kk z*q%?ce@OpWl2ld5vqL#Dxss%cpmmUGr5aI1S|>Fkw$)WzOKrBIj_3Eiem?%df0q6C zn%JA{n?4AMC)g_?`mF+%*sY+dsw|L=D&ZBVmi|qY@yg|LOGbq7RPNZQfMzzn=JU+G zbyQnl*De~gxD|J3upq^uSc?{i0KvULaVQP}3KVxQR@_|*6bV`=?oup3DK5c-l>Tns z@BPj_-#zz?d(I#Cj&bMMd)c0Qjf^$dPG;7c`*|Xc&HsvcBVD4_J2H+ts8-;AuJCW- zEu2-`BH~=|hDvxd>YU!G@=Po~PTlYQ?RctP6op>C3CHoheaU&au$Y=X9=wC!jJU@H zdw|SV*Gnj4*E>yrV+){|xQ}z{6!q(m(_H9GJaZirYDnu^U(K8D6Eu!RVxdBJy3llW z0DQv(MMPxD+I{$Kt2w!(b=;C2rlUzq7O#6;T7qq-=Xk7cLT6I#rDxyIAK}+HM%Or4 z*

u;f)Pw=c=<}Q_sG%$<^XS>-yVEjtP) z$RS&ic9Fc68v=@#SA=lZAg_=|TH(`O&)?lmAj{jYs(SPE{{Ep3sUaWNAL1DlRRhU$ z#?A?frk+tQhG$`&H~zzDNF5b*Kz@L^fBo8R{A1KP(ez~;3h>LOFx*j=f;*z1BDiuR z$QtsuyNBtcRCl0`GCAqjE*zYI!TE8H0mi_+q>F;UwGN5tiUAcFIW!z5K``dyk&{lA zsdtJRUlUbgP9=kAbozl76PlC}4{b2IwyI`7V<^%GX-1%YVbJL-et|Tw(!f&{-;N9? zjU=$@1;{72WAKp3lThra&BKATWe`w682Da9oi_fn0ZUs|Eq9$|t;R}MhJXv4N+@8i zGEbZNF)2u_>H2QpvPa^qKBFlTSxb0gFDCHK6r3or0Y4C6KfBZ~T`6&J7mbuqx2e}P z#Lt|h3Ye|THhwESPlMg*vvr1GKNK>)Q5o!Jfk!lQ*m4L(Rx0D`*t1hH*ORN`qT!q* zWQ2Q`+c$P#+IzQz`xyHivF6$@`$FhUeG=#ejUYUvMnE1)9TcEI{a=j=!A~nP!6kc5 zYs`jke!AGp^od74PlkT??{PNY^m9jc6Is4Ty6sX(ja65;Obtc3K3xQ|ThltO^5vM! z$jW)#5RwaI(COQ+L!AWe`a1|tY|%L6=#x@G+OVf`1$#9G`?yxrH>3_?8e%S3vR6364wlGlO+i5R5mIeXr3vktk@xFIt` z*B>pWoofV_A~2zt)=AEziK5VMg-ynajotT@KEe7F>H9 z=4EpYvIg~1ZDue6Xl7Y^+i{MgJ@_#rLX_s+Fb<0}Mk4-a5}X%<(a))LeSYGwxf}L{ zdi-UIqKh1u0@(l~Da>(0*y#vZfZv+M71nTK^1|MA!NerrIWxVI^9YSs-NJYlP~({i zQAab6a4%gmh7$&4i?pp6(6eiPb~Si5P)$9&T)hG+MuDvM)t^>9@A*3|0(V-IIv#Ct zKRAS6Cwz0ODZR*r7 zwfT7)uglH6muhvUi>?D_`K4>o#foplPl z_3Pszna@NLsf{^lEE2>I4C)a6k+pl*PS}YpXwKlA#oU?Pjmcvuy?W=M9N?tfHJq6z z6hm}AF-s0V5g6i`NfIlyJD`Hzf_)|ExbDNjfOG6h{mUGzDa6)_;!8W=0=5{Bycs$1 z`;}u$4wxg8J73b&HL3{sY&@FUxwzQvU$-xmWv%Dl@{SoT+Y&9tyM^6WAUSvPw`fl5 zbBA2Gow(gaCxO^6Sy}Yd=mH(>*bkA(=_Gj?ORMVkL~lQ;g4jd|u&lD8KnIQAXIZNt z%FBp{zkVN~%hSO(B}uQp_$~86<#gLXY|zCkw3_Et)zwN7f3>a!;_(yOcI#Tl4e>z1y=tI7N+r@<`}X8YnNZPP`F9GCWA^r!~_9vuz(kdn1}`Se)r z)4M^*{)hJ^FGf^ee{6@_MUo`T98f!yRSxUS(w4SJIApumWsj3Dki}1=^JVIT$jBWl zYXs9!p24ctY0&hp`YPq$beD-JIDoQwP# z+|6pZ_<{nDaKU5$eG`L(=18tGH6<=#G6$Wr;xli~0S7KonjDK-@3^zo0+04drS_M( zQlVFAe>gv~KP6TgFbgOMrI;9_;CSjP3wljXfcFj7%)Y_4do2a46Jn&@{{&rK2mjF5tUHQDhD-COQnF=_#3nQO8jmWKWVvN~nkncng`P`hSY`=tU8_U76^TkQ z1&tLqqT>ns$&h$Y>2XQlU-sa&+>`BN^FwUIQo8GA5&+5-!P^?1NZA5|GXB!`L1A13nqGcg#P{OW|9B*@7l`Y z^eKY43mI?^56F8^X*sVUS5Pn-EvV7eSM0ts$$u>j9osxa%c^lf?Tfht{cUSS!FCA` z>lM*Z*I<&9KK=cNL*m2c#q>1F7lZ4-k8}QB1s8|}hhsc6ky3J|C|IAouo;ali+3JD zp1Q%lF7F?D;SI_&OSObzAV##PReoO|ftW#IvG}B6vFz>Bk`2Ah7b1BG(WmK+J=i03 zvow{dawOicDFC3%jYU!1%$XwK2)RJ4HQz&!E-&Cpwtk_fU@FG6@hg+P+=i~Q$y`t4 zrEvHqwxX|?JA>d^-vFDoYqdQ3HETr`^CEx0hD71ur9DlKkO`dIC6;xmCR^QlVhLG7 z=zKzX@q@7|?%NrC%7u^IVh}O}qK+liP15id!tp7T^yn&HAy*?gWYVR>*Ij9?g1_=$ z#Y4#H>!NoVi5jV%UQ!hY8;XBcF?oTF3Ow&1OHP&xkxK{m9TpRcVq9zY;vSj18nEOJ z0&+I^>Mt|!;@4mjgc6qVohzZ8>LHQuc$OMPb8?$$y+B4txY(xg7km{+x>cbrwJw@s z2(UPEIKpZaUG=BuD{f;>2LlmxkqR;uNeHk`!Vb;74b0kVq$j5)Upun!btqi!=kRy3 zI82HNTk5g3r(+C=yZ@`)zrBU4re*=2WnTdcmCK!fKuM4Ls6*WH+RkWvK7FMQ1&4p#2dw1zxY4rxPV6+&43%3oXj>Kp?&q_OR#&`gaN? zh2*2XF3nzlX|?z4!_~#53f9&$qe&Bax6mRfwR};7udzbXj*lmkF#*sd>`RsYP+qbi|2%>4I!62^OR zh8Xq%bg7OVD_0uMc{O+VoPqC6g!^w({(QO-|A!yc@86Joa^JogDGAs+e!ql528}TD z`F$G9o%;DhX{v5l>o7WZ6Likp*Hy-Vt|{x{n}PL_fjq-w3Ju)ss}OvFr~ zYNy&KwPD3bKln!p<*o!J-}-HZ{z~Cn3a*p$;nB|CuAcwCiww_MHT~Q|oA5QW^lNSl z8Th7sBGx`(2J7H(u<(#sdE5-1YhdL>cw1o?QEpeIcQj?Y5sLzhJ@Nt-CsYCx8duCN z=`yx>TBdv#aP?p&-Lm6J`Q++p)EL<4vcQSCKOGT!w>l0M0+pQtJ???zU1mPAcgGn} zsl!B}a@zr%sZJG7$OPyHY~^=~laCpNEp9lYNb^ah9bj_ZTU7wWL z)ps#1K;xypT}LiNspgQ4*9j=sxq;cUF46$qwek3A53YPHnSPnGb0Tf??)d;S3RXaR z33er--YqGILHT?TH0KGB@MyGkh?Bzh!!t{K-1m)b=5MlT9hU#-`$6@H%OO{!HLWoWc zYdtrHwZAB#DrJ5FfkbW0T%_3V>t)y5lcx>O{efO-X@oMn{a2Z9VtSaICA0oa8T%X~}cRb?`Tb}EQ zuUW?t82C=fL!uOGhLo3)_Ub}mvvg{aslL!V57X=HM#4G_pP|-kV%onTyfUGX7L7P8I&TpuLWl?<13q-$tf+*0&3JLI@*28DZoKyGF(8I%8T!$D4Yj4xpJplu!z&Hw~jB04Xfs?S9)&2 z5+|iumX+fZ$BfNiD_z}mOsxT0e?fWVX~XpN*yBLRs&X88jt2ZGIQUBV(X}J{SI~XV zq?HVc(jXZur^2I{!K08ms@hD59j3@-#L5aX*qu~ilM89G8RCkz)>q;mb=yfPvuJ>~ zRbJss@{fEJ47|7bMaK#*=p3{cI|xh{A}uYAM+3Sw$UOCo**_s4y8{B3W!&bsL~cgk{`hHhZ)^oBozisNI%MlGHH z^&N9J?TgF~ZfLw#;dEes!Ag!BEm)gs(ej$^gIDkO@rQKRW6jhZqmPCUl|SnBuTXQL zahOcSPMETXuIJkCIPmw95Tk8eLH>+%6UMaI%6$rjH7n~N^vZT~Lh|BqKgTE4Kc6Xn zVvxo-%@l7P1@+I-t>G^;c{NQ#=;l62Dl6;iT$EEO$zNm!^%Z4oyV!&xg4$P)vyuM9 zy0gyrTwY(jb648Ifd5`cq36lg+vi^Jt-4xV1axs!HC zkMg>V=NhYS9;_T3ursP+WNyICa@Lvo@8a=Fz2I%d3|7L)moWO2_)KrK<_FSb#b|2DC&&+>%rH*J%n^ad+~Sgy zx+Ew2jKah)4kQ;nfwvF_)RhHsW}pwI7?R@HuD&T|HUL)}&KV7-J;#i27*LmEE5`>_ zSqpj<5P33i6^QNmvM`Cj-e>QxUY}Q2M2YR#-KToa_jKm-ujJ<^rt8YSLECl0&FE5#J>J@~l!#JJ%p-z!Mq%hk`PZQ7G<(MS)o zJoH;LkQl{I_j9Vu#hA8@m*{FP^k3>HE{jHpxsmz4-&SutX=zb`I*3=ahR8Xwb&k@* zwYH}2mlP;&*RiFeLB<9*m^gZnDPj=`;}2C*?*e8^|CfCxW{f3Z47Cb+IxwUe$wxDv zaq0enVSqSVl?a7jMTUm4EVfhB)&r_6<`x<&$R4=j>8hqI2m}s_y>)Ya3yYKrAA~vT zZO8E?QlCd>0ySN?%1rB!QxU4(t(TVYIO@S{rx*@sCnJZ5N3Y3XfpxZ!(%>T{ypEHvkw`T zMT#yotGG0uOT^_ZYn@bNXaUUFs$;hNO+24ltN6bU5)h%dE;zr9r%S8yy3F?v?|;t4J$7jPB`L0+&Yw$joFvz( zxj$M7i)kG4<4tk#vY8K)zEiRBrCF4Yp^^FXP!dKga%;>YNC+AxbOe*1B$WB-?zN;) zk6Un@oEhKmRHh%Wf7x4ktS;BYU>tT_1H6aAv7~~LW+7TA#HiKm6`S3M$G0IwKVbj< zX(VHEh+6NOx2RB!QS@m}ns5Fr({w|7DQ&Q#y=!RmQZ!L>+0I}4_p^+L@rQ&jV-H(k zCZf~bK}7o|Yjt>GDtpAeu?}mr3nwR+PRVd|-jZbn+5SsmUA^7%R<0NYu>4+Cxo1np z&L^4|Q)N%70Q;8liO4Ueykil$GPgD+!QhkI-fee%<)ycWyHl3q)CS<>hpl7pJv@vZO_h!t zeNZ$jPU%%|;F*8&augg<;Ctoj#y2XG|CCkvT~DhokcLGzY7LL0O6+zz|8v&}Z9x+@ zYjkCCUS}}EKr5&7qX*(6DmH#m2w5gmtF3+a#4jEBEZa&5ziGL8a?`(N$DoXz(`GW6yEFK%*dd7ruuAECF71T^Vczum+`I8dle$z-lMAi8uMrV7tky`V7h& z$G-~z?*mIy-EUiSdXDZxNeR&7rl&vpCP}-M|G1s%-1LwykWN)Ow+YcItyN-;M&al2 zh!4n|k&MueIqjvN9<9Rvc`b215=xSab#sqg_B1bWpLDc!>p%M&i10ryR=fv9DPY>N zLGI0PfvR7@C635!X-f~;*Gy%zH&VnT??|I#VY3adoh}fkr<=ZCo&X5Dps2-oBZ*P| zFkg{Fg8@XBR_CJ0m05fa7Z<@85VM%oHai(B7N@$pcH*x4^4R+!An>ZK>k@5~A;`kF zZGk)*JuEpXC4FLiiisbw=jiy>Fm#7Yqr=k#fr<@BG&p_<@)vlMEo{-Uzq$IDoipv* zo0r9XRfQoWP2BkKo!TX3yE|Mel}t7dC=P1U#|h&H7sv$3INV>p=fOxs&V+7hR)b1t zqLITj-ATDe&Q74aA9i$uuQ>rs`F4Vs1vreXaad^7H7y9~*S;2f6PtX~(od5rMETI2 zb7uJyjv+-uGA5%3c_PbTF`N6#D4G?S+{n0(;&Ia&Rz>Oz*)ari2NP7r6GkG{&vDV^ zok5b5*%;cBcIBCwMg}T%2iXkU<(;;TIR@;l8s+7CNZ;-*Va43ZoW(E-TI~8cdyVwE zZ#(oGUU=%cJ%+pYz^n7e8OdBeN@awvG0=s;Rea-^wZ#~orf6B=>qEYxx!>WLArORs z;!#JMrn~`LQfXA$wbpGoza{LP_e3kF6Z6rt%5_fuo>9-X)=s#QtvBq7kR>EYfPbL{ zQ`^q13BH-wP(uFj+dl+$e_w1c_l09j0ewgt$Q#-2z4&hb7tuGoud@qO{b}7bDTEcY?w-p1O+fVvOX=~^X^qr}PdD2AF8i+#A}TML zfa=$06BJ)1y39LaSDWY?4Q}*l+1Pe$29e;6z-y) zOU^YJ|Hyc)jbA^~N*2)9+k}patXGRVMtwGHXU37RF`@l&rbuK`yHn7otvBJ8iR!QI zt>dX`y!eup$B8C`L}v@tw(C=?h1S#6e#ev52N(qT2N;apWx5(q(n!LuzhgG>8${kc zhCNWga=SL440Pj@=-S3c!dDSl(X%CR15_H`d3JEU{gLE>k2Ae) z!S|-?k<7xU-$#_kiO*m;Pz9Nr4KM8JzcFcO-~Ot;g^rn=I{^vOpMzoVE(UcNqRV)~ z{{tcDKSE9r&m0fI9Pr>&=$z=9L9p8#=xv3!Fsq{Z_mtaq?bl+_RGmz)fxlhFAa)$q z%dBmqb;(Xd7Eufk`C+4L1^@^RG3%N*rh=H5R*Ap;N!6H^B$E&H&l54w#NW@J^20nD zrD4V4!ir6n(?ky60^uDOk1elmU29D6$s3|HVK|-ne4)pM=O2c-JoW@kVU+crH?h7# zxaMT8yRT*;KT2f7YPES>bFXQcw*ifj@i;9eL0Daw)_hIca`0?p#ml4mU#+O<^P3KMw56L+D)d=Lap^+t_?DHdp>9H z_T3aBMs*ffQ_Q? z>MCjH?#!7h4{={}83fBiJ3F!?S;wk=4LjwYL0h_)kW;j~Qt{cDOVQE1U)vy>!(@!s zR+wJ#WG^ok-$tn&e1t6fO0n`e7N%U(z@|M#cvZpAb!fTLEcn*`oq2(RXZ*vqkAnf?&cv6s!@`AeAn2f0rS9o<%>fO-2m zKupHgV0PEX#u}h%yRYltXHYP&PGYd*fJOKgsDEsgTyFMThaz`(M^=_SDO#G(T8kKp zSZS2P1`^U>-?-o!R{KY}+RHwl#FTk9MP$>PycT z6esyUg2Lk|1=2Qt@YL|t1BDRR#D;DA-hGfh(Y+ zJ5JZ}&&HAJ(^j734lc<=k zy?3)svkzBMTiQ9y@Wy3n+g4H-;N_QbiC%RMQI_QDBWYXse~fs$r#0uF=UT zkXIGxpcamtsI4ok3^`uuIK9>WgZWNJ)+UC=rm~QgfEF0SdVk{|^hX8;4T3(wlOjX| zB|lF&1zwgCpxBGgQ=dXWLkhBFs%#B0ZW|lby&6aG7d@N#dJ5G1vd<6q=aCIz!MWeA zcJ`{5dtaU6UuF)ard?Ha&06(Addz|0P?uB=DFNAIqZ{i|JwUq-? zaRTKXhy-&ZH!JU>{ z-D1?Pas^m$`qc!L=U4<^;9wV6P6_Ta>Qx3U#Hh_*9I<6cYW44QwQ2y)?)`!M zVJitZHd*E`5QxtLwKNT_o}T1O{_{iEr$_CowToT7d00Wux<+U-?c+x)@0PO`M&#*I zcQRdvEi?!cv`JD-9brE9U=aIfWN_bEN~AlgB1a}rJZu=m1F^>2-*mm}WeoZNdmP#O z3q6-fTh!JoP{f=6pe?AZf*p8`w3P}!>y{!RSDuU!0xAfr_o=`A9`aET{4sBEQ@hcu zW!1*_-YghRF>1S4Y+O|VsQZGA9qG7x$T9pZrlGN6Vo`p+17psW6@*g(6N8z(ciXtn z&I^731V-Y40GFeevMdFvYE~Q*kv;|C{M&cE5yZ8B_8cy@Wsn#_`;5aBQY-sI8&_iP zMmjY1hCiK9&s&LJSDAjNm`K(@r?HM(R}yS)-FxG=%;@a1FzJPPG2Q0@d>C)KeukIdu1qva*d2RFvk?V$6ZvqY)jN=$AwfLcdPfGSB25F^%(>Lkgem;{4mF%7R*1cZ!yZ9qu6z zYl52f+*gC-c2nZvbK8f1_`?Tsw@t5{6A?Z)p{yEgCljZ~C&3*KR+F#MRukfeyn7VY z`Ryn=C57EoAU+*W5`Q0s=%urYx6v(hDfQ+7lfgsY!BGBt&yu8WnC;ip8nOr`KdAj{ zqNafsn9L~nd{)tN*$F%&slB#8*yIxYoCiGf zw|CAb;m{5NuX)@*(2Zs3ah=J#WvxJb+py8_bd5J_z0df|KEVwfNp@1*>g~(~EDze# z$+i6`JH}ycy3bwbAxTy|+%)Ako&p^S6Nc4gibL|ny6)xf4hr24{<5;N>QipQc1{9j zgw(rjKf9B;zAH?*Zs*KbuN5g7d(zqogT<-rZuf}R$(YxZW|)k%O^RJF`umPK*pWG|||;)b=QHxr;C&v2DY=P~;?`+7_bI?RN0k6B8)O`a14p zPRvaEbMSW%E*~V;f{uv+(c^l|AacRLKOir*x@xb`951gUeYQT~khOjlYQTt;-k8={ zvz7_kJA=$h2}65sY7#qLf363{yAesA`!n*(A}s>V5WZVix0IbuLm$+u4y={4{){>I zeU5W(TS(+A4ee8=lAKudG>DzzjEmRSemCyYqNy*A!sB!(jbYX5CzVkoQiR_*L$|wn z>i5fY91K;;vmlCQ+#39sa(X3`EO$vW-;g=p!aHNBFRRORik06)%L=b(l&-j>uV^%q z;<9A>lFbIpqcZ|L3qFswiwW+-5dI8{X#iyBfh8ldBDSXZ3SP&63fP!zlTMm$;cH%V zf&MROvRuukk^IvpJhxCU0>fPo4}FmW+cs7>wyf++xroB7OGr*DflMf7 z3jYtOCiyCT-SF=Ua=!+2-4j?z1axsYbH%9J<2D$m3?jn<9jVsyyDAo4c$CWNLY>T@otP7S#c2!EEoB)jXS{XZ* zo2{y{zt;8T3@K>HxJ)v(sFSTJtL51w%OH_<7E-fwPogiVV~b;%qhoPQ479%fB-_mE zkg>(Gcu)Kt2QxYFZBo*l^&fDi_08uNzQ7K|h7{EIY}im1tcY5vX_)`AEWX*f-2K$; z=Cmo}v>E>T1C|nN4Tpo$ygXMUSMbUkIf>Hy@cVCeS{VHbHij>lV=~!|gvssnRYyoj z_4H*m5#~<4K2n3*H}?o=$#ggi$JQE{rx_>9$p!l4;_Y=y(vDcq9`}`pC%!>%R`!)T zNRidE289hpAHywrP4_4LoFCbL>?H|h@%=%X9_Iv;0QYCK4WnyVF!D*t1>S#>@aY>x zuCU9$BJRAZ$h`w`Q-4=bBvk@&1>J81@!$8NPde>GH>E^!5!n;o2TVcaq}K5^GD1@` zciV*NAkNs~pdu?ze}+`eK~?716n#+1VcpYV!H1U=KCwj)dm_h+Y0mH|MtkXgZybKa8dICdX z`A#$U(z1FGN^kbiG+PmtFX4hIB-Tzq!EKTBS$Tqrb)^56y<+rteY_ItCcVvRbKjin z`@HVQ(yIc3y&g2?peSq3;u2tJ!%$Y5jlxa-YJcW~{X%Y$k1LtP1vn1Nh?Ei(8GOGp z-StNo+0hX7dD<7clP5#MBK=4X2B*qdPRpMXmloJu4~o#}qbrJQ7k(G~>2PwNC1V$^ zO^w)xDoO!c!?;3p!-$aV9~?ZB@3-0bhUH$}3I4iz*}S;fSOUe#8!#Fk5eQJR+$>EOLhlzrf`kjpi5uzfR|-U00}AL#53G4MH+5|pwf1z*BgFY_@suiMvDtI zHp9$^Aun`1&$D?1r7yf0+A3DJcTotjj7fCJvUJGt!WB{Sx!GMCz8x)%3_yV|efa(& zg%ztZmRFucuny%&ejSL8$WZYq%FbK}J9Le&KJ2VD{pHp22ytm`{g~^x*an9maoM@F zf$;E+6ZC~?RlmAW7M3;v4{d#rsA?IhJ}93g-|;X z(#ATZ+F}^?gM_ovcsQHE)Gm4>t$4XuB?@)TL&dX3)GN5`X*RRzPAbN_%5$^eua*f4 z;3nExV_acHHQw@fG;AVtEY_dovTdzJMQKVW?6WK7-l>SX#Ovx6XJl6|=+}rSQG$%E zSMwIJ5z?vJDKF6S3a7I=k~m~JK3A&ZOa%)8 zX|+>H9jGH?xN_Nq^zEx{Oeo?fb#YY^DB~z_mAu}gwkaWtWoA_^vyaf%6G+_IcOL0k3G96NP3 zH62P9HjyF`Az)TQ0*|ps$-6hBv^qc_^@O4QY`H_^5;tXx^2CsJ3Qsw~7^}JwDV7ly zOG7U_-;*u)FWe!q`>X@$2oqO$)&1&tph-mW(+^JZ3cp8}m=MBRig|GCQ|buoGVK(n zyqeMqFr(ApXAf7rxbLY?Fu{`TZ7Eky<7apAxy>4X2|cYGMRXO3LABCG*O=}fF#qBD zS%Zyw_-&lKCcWj%Nz_TWv7PMX>8D{2SN|ed6Mbi3)%rMVLzGW_iCR8hfOV^HN0F3F zDhIf&HI4ohFJ|vgs*#|rCYYSc8rGh5AobZO|5*!v4`D@Blh+J4XylTfvA<;cz#p z&mwJmtR2J~@3m&a%@Xaiq%CqBhhe0ue&j{7P~Wxe^wN;iTwlQCB#c%yy(ZPgfVQam zsRJDv*Qb)uSVHYH%b@$ptKP(HT|fCn0I_?Kx50-P!e<~?D(#a8lrz-JskvTzln$Pe zM3);e5vsIXYwe+Xu5VqnWT569xHF4DL!iTSpGDYQ?$7-SL_O{Mr`U}|G4{>4l}#0l zB8|IBDIA)4uX37rMfAdq<~`yZ6xcVlHO#LjI-QT!#ZM)Q)Jul2yWRKH>A;ByA(A3i z-vH^83DSrX44JSxRVThxiE9~Nr&OfVyhBg5oMD-5eXNU9rSQ=L-bs+*4Ac}%?QJ0- zep5NT?=ENS11HIKBYCe9G;F@AMsjzGK2WRfSzlzlVEBobEZ};Q#L~C?Ss)_c56wPd zrL5jB=!`N^nPJe2c0-Wf+msQ#(8lqC>kH)Ddi_{A8a-7=AOoy3elY=>F3In|=&Y7R zmPvPn(k`ef!nINr`Wcg`x1}8(4aYWH%AvcSgIJ`b2_r;wUFS z>C<12ksyP7GnxjTFRKHTLSZ)fU74;ZE+h=_i=!9T_?`P*l8Fvw z&sl=n;J(kWT^z?3cz6sYf!WQ@TcPAQ=j7uflI%MiI2A5mYJ(;m(=v}bg@>03?;HIZ z!&~H91YGL3+2NjO^q;skN8;bes@gr{_FYbWP$vkTXwLJzwbktpt80k$UK0} z6aHSZTqLB04+GB)Hv41A_p^!b*|)oQ$BZr~gw+(kl-!q=iE{9;j}EmvFwYK!AbJ$} zg@3&L#+Iar`jvj5@orR)3kX2`IAn}d78ldZ&~)u36C&gjX`4ZZR!3MitK0eLX>|58 zR8TRcSQr(<%nnjP`3`La<*OGPEd+b{iV?V}4-&?WT+NqB~QreGu0 z*T${7ARMTp#~wR>eokrk=+O`;Pcwg~y3@R-N$Cnp7j&U!PiNCSCDE;--#L~p#F@uU z?78u9@+-raYsard?2D~~|2JPw)cgJ2&U}kS`ZI^ev|=rMb`^0r?~}TtF%J|h=&8>J zV#xg#vBHvEZl%Vc6W2TGlG#M7h8FKH@WO47QFFTu*E2 zlu2M8kH~b^V*L<9h8z97EplfEdNFc31<{s1ZIT8w&f{~s_Rz(X@-{KF^{l}b$!9Wx z7*37@V*dKy_sG~2v*zcW76 z+EHW+sB!Kyl(~Ib{+_EZocp3}_9zxxboU|o-80bbnS@RZ5wJG7Yv>3m%u{swVqNxq zz{LFSucSB0GUEm%ewcx1GV~$BgwJelNI@de=Nr<;w4W^)Yst3!`g_sB`uj9X6;p7E zd16Zmb&IDWwrAddCi3pfvcJ8@4Lr%C$xxLbD!jd&ChPA5caP6js}BNhxXZ>xhu^b~ezi$>=7-JQR$8`;TruzsrG8VbDg}rOr*T8Y^wxLMWKZ(tslUDNqfi<90 zr=^M5jk~6hE^kJw$dQ`;fnTx*UXZPF_f>hKJaP3pmc~cs0R#U*Jo5>EjeSq)kyD?d zcP;tQ%2Oo!r1Ow-QLL4s3l^H>s5#53P_nvjfeoCFWGpDRL@2y=Ha0v}+Gg=~(+uC6 zRe)E-w$h{CuDCv0?(XM0n}zAt@NT;BgNWC)2ywk-wA!sq5h}0~+6YEP9`zA_PHF4n$88U)yko@STpQqTCL||fF%F69iyI5us6G{aoOYA&jl|=2=7u5HN{{?cDY#|M zNoE6UTplUhl^iO3w)#Q>DLy&%_*YHla|raDtcshFkNj%zi!(M@UxRvvm6et>*#Eo4PwA(5IF zl`ZtNuN zLNzsal{+2%HZFL-My`fPOi?^qgxb$5RZxuQr31O}J&9tL;57bEeS9005*51iIW;WF z*fn*ahtk-qs#2B~Jr8AkY=t7 zcMBb=h*n!o1#EU%@0RC!jEvb6`PhVJN= z_{^cO>g745c0GJKp&0efukb~h`O_LrmtP~EwyF|3 zF3;4s>H6Qgp1mQm^)j|tDLkAC^3a^U0P*{ZwhuxyyLci6|Hvw+8<=(#d^SKp) zqBCz-oe>GrMlgrkjqM!x_1W|oiZ8O7wdRjFfCK=r1N?s@m>~ev@gJfB{C62G3jp}n z`9Bpj=KpE)e>S24L;h7lV+H`QI8iAX0Du{a>PlG|b^b>);6DVr{Qn}B07sOd^#8Zy zU!8`aG-*PCA+$OFDq(S=lK8@8VfL#-6mBh1l9UK7iBw??!QF^n4OB^@B1GPI~7z1 z|87(MA1?j7YG|#NpJ1mw!8a@1fzv`%<3u*95K43jrcIYVo(m8oR?< z3BbGN>C8{s)L%G3-uSO_!*gZ)!kJS*U0;gLLP*;cX=@o4P7EYr85$qd+szEWO>MEP z?*A;n+A0k=^(OYqUq@!CD-ex6*UHZ6rLgjKc^& z!QF6zEj|36q-t(?Ux~Kc-Qz69+W#T)2dOen*r2_NO}^B$rr!XqjmQ~nAD6{PGmk~$ zrI3fvmzyA^M05OM+>^-!)4Ene)!UJ(0{q(TJ^)(fpAo}0j>S5@b>X%Ffv!68{ud$V z%~C?kS>Xrt3aX{@rh?ssiSn*|c~ZFMGNQI0;AS{)6>~0{s33AINYC$VU$Mk*GqWgW zT!6>G$eDa*-vA#or_a*JVEE@rvyu$8_pjMA;YFX&YuAVNIdhbOm2BS6<~cOKL17yn zr?WpP)r-z|eyb7% ze2{C`EiuL!U2OeQtf%>}HbMdGO$~+Uwi<2?w?;BHj#zBw;=uig_*D^fmbnw>1nP~f zf{?+pThKAKL|6SS%V*h}JrdCYO8=MI$b3N@1w%(-zi-|T(Eit|VT5#kGc*gZ_hjd( zHsO}0_+=r;3Mk&27F_B*^XNeSR7=8_?+DYVuq#)pi{@5DDoxEX2o{_V#?>eybhUYA zl!i{vHg)L0dpX%gMxCr+=bo!(a|65`V`c4wFd^HAuAJlqw;a)g8Sc5z0DYebYn~=O zVR$~p7XKnz*yK(aHbw;tHA8(^ghl9ii$`)CRdED7mRDzt2d#=C6N@J)!9?8kn^1kL z6#7x0_S^&qHZJxh{04U&>hSz1<>ybP_*XSEFHXP9x>jS6jOhz8ed~`}>hDh}T34@9 z`{X$4U1sY8)`d4e<*hHXnkuGzKBa9aDka;ai?={+_rKG*8K0bc+byZ|TCs!Cdl6&8 zBz|71kAS=AwRBS*M%MMFv=bDALX?N)R^U7JzM&oVHnWZaK6 z_@)M3OZ8-!m>u!+iPa*V6Z{e>QJTUPub1f?xg~>xaEfG`=7=o{>|Tgr9XjmmwLT6S zjh}1FpsoF^T}DQ6@+bzWKeS7*7RhAvtPkgu@h~`_Az<#-253p#kJEw`59mjr{sC^v zT06iB{VTSli$W!_V~jgbI$8bBTleHI=51F2SDw$*-eGIY(bS)OUYB2#;*!V-L9779 z=Vb%N$A6Ds3nH|q<)knUOWG0yY!sdaJP_<+Z7{N2nbImh^7=+~vzGef#8$igjJw9l z*D~+ZidMQn8g>n>CsHcMe%8QVav zXmCdc>iugS)~sIM;?LQWk2^!x3kaz!B>rbh0i7CP@uMSsp!W}>HlT>*K&-St1pRi? z$-(}y-MH=jCdZF_sH2loDC^2L5|=gOO(lhLsVqRdG^9EiJ%$;8#ioGArNfE$8)PI> z+p5Q+jagh-oE|Fz2}iGt0qL*lVTOmLFLGL=RnNv&DYeD~=}Sx-sWr!WTV@Vrhq3Z{|uNZ+3wIKr&_sW;Hp5GW$$v9Ue#(gi~0U3Vu_~ z2CN3Eauz2^>XxRHV*H+Y-@s%ZT6g|Q7P;IE2t2qeZ&W}I3)2YMW;N+A>s0?dsnNQTB7J02a z9apN)W}=VvRyJHiLiZP{IMa_Npa@V;DgM$XRx0z=nb)q5lZ{<<7&G8b1kq+4c0Jn@ z+MsCC?}hU~!Sa8w^_G8aZGE>l?q1xA1Pkt(ZoIe$55?Uj0n+XpcPIqc;_glY6n7|Y zAt~-wDA3*R>v|r}{q~&o2dvMUYfbshxyBe@3t&zI2uCgA98hl#A6N;c#1Z33CtS?| zg2865g+5O7Gw43^52{#Uk)FEclDp#FA7En+nOVIO&PS^MU6n&FNook9ftr=7@jy~A z+&k9{p-!XMKnDiX#q|H*>o)EyBqE275Dbho>c`zJCz|S9 zzq?&N#e;V7PC@JcTiOSd?dV|v&gAtlcKg~fq-$4sPxj{7$X3b;qAhHN87Hkpytk_- zoe@pi+Z(B#yX$`5q6|b;5KKq?MwObW9e)p>mM2iI*>*IQak7W6!#$VIPJ7qT#d_Vs z!nVUePt%wQW}mzXoMc9OqMhr%9Bj-q0IGZhQjv1$&3>$yCH&w@QTLYe?W?xS%*K7B zv!AfL9c!;_{q_cPOF(Vw11u0GW5-}!S#Owby$MX&UZHJFo1^e?aeZwZo4akdg|DA; zt@h^Fw&k4tN?5j=ooNr)usXRtZ`EMEn7PV_&9stk-OonE!a2QiGut+mb$i*OHoX^E zWm{$1Tog;#VZ9k^;p--quu-Nwz+G8csWmm$N+D)n5l`vZC}Pbu$;Kkf@N;t@rCYlv ziKZS=DSKeMH(S5%my+$d?t6ra9jM$O^z4<@a$%IC-xbxe-$Z(D_?a!_w%0Ck9It)( z{@?$8ja2xK{c6>&ce5I;8UaW9^u#c)<26eYiyP7HT1Ao{aTnFeV%wCI=Z}b+F9zZq zB*9l2&9Oz<%^Xoa&zT&&!^;`H_-v^T8J2-jMu1Kiw`*?T*5LK|KBcw{?E&eJOO`vr zyy^7Kx{?fU0c*~uD}m->E?Da3X?i6De$`@}F1B-J!kkH|dKI}eaHn3FsX}eUV`}FM zs>pb^T0HugkMcV;H%kir4o9%OrL*iQ|7Y-x;VK!RT zJFJv>hzT=zaHj~OWg0&66*G_GiY8wQq65LvP9{X9xb;!VKi&a0it(blZu)dK&GhIC zFEKCg@sk4YsqJo`bQ5Kz;SIke7=Z0d=6@of*;XBx>U&az0Zhus{!j?{(aPlF= zi#$l2=HpFXhM<*EngYlW^ziT-Qz}o*v^$;;0+7iM^hs(pr$yl=EW zsRz%-N$9Sms`MGg>Ai&#??kPY?tj6A8)d3A;Oo-7Q`DhA_M}5kpw`EmOq!K3Niyp4 z#*}o)lgq2?87w_?Le(7hj8EYfq#EF$n@prZS3H zmsb`K!R|^qsSWN6VEc4)zMhc`P<+QP`lV{opnc}0n1J?}M&9Ui-=)vSpeV3L#44*( z#MY1n82<{9vd1D7g?t+68l}datbUv%>{g*62xVQi*(`~pcyYNtm228zCOWV}`hI9j zmeRPKqVdbr7Fs4^q39%a6Hj%`TU&BtQfRQl9zQ7s^GH!W@@8rzLIRgeZXb(usWJid z0y;{YE1QkTvE2mE+Ett0DS%{5Agks(x+Zo7QzmtZNe?e;HJa9=t*k)cFM9@?SYpze6zDRhOZgSYO8vWMdLV&UASTUJZ@t0^g(MJA#A;DBI*92Egu8VMoxbxGNM6XLr%A@6!Clm>io2C_6Gpg$Segd4S@s8gv@)E8M%GU0&uJKN-3w{CY=bk~b-e z%*keF5a-7d+QrnQji8&7AGatA$DB_Jq>2>qpV~hWM0Sl9{9H3Lw0?iQ`boy`2z+Ue zT}^2@|IEh?K@XCF96FWsY6cpTA%fBXC*}7`eR+SB1%EBu__^<1QIDxN{cFbXVTT+1 z-v+X_Kh?mm_nD3NujNIIdJ_QHp4s^Sz1A7ONXgo6|9oHj{rB^Kk<+lhT2B9}lmGG# z^|seLd+lCOpAraWGEswDW}hS zakKVC-k5vWN8u>y>aw!0AuX)Z2xcL&3L!j{51^)F*c1l$HvXCvIzBYKcm77~+xuee zF_mE9J6wT*AnmsI&c(V6m~c0mSRMrQ6*W^e_w&>X$*##AFq?g-w!N|&-L&SSfh@a( zurp5gZlP}lZ~TQ-fE3qY`sQ>;6?Z9y8l zUksHAAI|GMK1dD<)02A#f)+x$IF0sULa^W+%p@sNisj?Z!iL?v$+hTlfBH4Qp>b%o zui_59Vz$@NofVYZ+`Q>{{cL?jPqUak!BD)rIA?{pC@2jfkxwOLe~B_@6HTMevr_U} zJ^8FwqzoT2qssXYFKMs-H~S^6Etm{BmZb!6+0}|`W}o(?J1~g@?LX^ z+^2dZ25u4@q zVsrmSca)N@E2;U#e7F#!*=76OAV<&o5GMwHh|C4Cpip*O0p36FY=tV27qL8+zHBPZ z+m({%xe2-88~Q)t^OviA929znQ4c#r8K>>1)QP z&L;aHuRk?K+V&g!NYV7eaCG=BH$pc9Di1^ilpEi`v*qzd8PA)XCzS@rl}dmm6Sw1- z+HN5#j;gjc@0*9HWOWbFo=4V#S$@?(M4nX|N_8@_wzyOP>fS^=B>#nJ$IkmSW#lo< zBO*Kb@WNhd;y`41daGhsi2fviR9;$~E!mBCW#=qUQ{>3Lh~MDWeG)Qs-9(4_%paMKs>jymdZ4tGrHM*_tqa7L*2M!6;if%8u6=(9Rr)#9tO8P4Y*+NBkErMI!C|9^* zbx2Y#h6FiUw+FQPCxIT=XR5##FGVsyrSYH~n!HXm7(IEzeaU|ZJp15=!T$80xsZa% za5ialfR{b{0g(ZG;aW^)7ca!=(!@^Wm=RX_3<7W0LH@};= zk>9$ujmy6}y(89rj!K}!iQ&q_nKm%x2NvXNXV05*du9xz{PHFin?Zx9E(;zVM^~}I zS55)sPZDRG3IlE?j+l5E#B=8*Aw4=5+}Aj3`;$tvbYr<(>$SJ#R2$mw=-Io1y+boj zcEV2h)GHj^)3fM^64+TU|6`DMUl*wXsq3y|nX@p9>3N~R{PZkmUTY&MIU9v1mPw~p4vY)sDLm9a zX$n8PFC}PY&g3ZcO5<`e0?nyqtCivr3qCrkcCfGI0n(~{FZ9jH#osV6fcLZu*V5*= z`%GE>C135Q**uk-9Zdku75o*yxFmP0zLwQ(oAk%v9U?c}R9&yDYc4zdP?W}=_D6Ad zh#|7U%1L<>crc!RyPjCHuhznCX|rB!NV`}@^XR#8{zlQJSm|6Di=KPWtq@$^EEXqG ze4`xF3>}(ILV^n08jdyrd?AhhDfU|{j!vro4g zJ#}7W-xh9Y1l7;I1DB5)2Fpt$E%He1hJl4`Q5);)K?{A>j$_!Y$>0ownkmC+>9MnX zW#^P&PjJMLjr+!pOb&fejDlhlgV>y`x0Vf}T(x9L%q9YF>+gN!BsAT^3jEkp#|CEk)Ax z_SKkBh%KZul56%1C^hPVaxHe&ZB2b9x^GS}J~xsuX~q6WsrK6ywk(5E#E;9#x}K{( zOQ#a?n!OWhV$a(Tpgrt-I1JWT0V?IMt~?KM;|o!?N71aqHrn)I<)XT+j6N&rJ&1MFskL*g7t!>J$v2+8dT$qQVKUM|nHP7#`iT$Bc_#T2%y6PFTGj=`<>1^bO zImqZQ^#2gMUOH{y2@})rQrK0Br2DRb4!mh)!Sv^Qs4ST5UfeED?H=lL)l zbg(YKPwX}&$FEu$Rm=<3^bXs4ov%)R0D1%@E6-H4@{V&0axjV2W~voD0g%1VFh{Hl zimF89@>9+W58wf^s6llas{Lxe5~_wY^Rr-B26!>E6QT=+d3hZ1qPu%nkY+?kCm$-j z@i$6b5sleKk2wMPxdEeW*}>IFKB)GG(4jdjI`~iXW#nvP_<)bxiqIfPOK%qP8RCLH z+;FD19S`YgGWP~!w1`{>WX~h21s??;hNFEWA9{a>`2`j93l!3-p!&-~XYJnmn=ZXa zqRLKe{5R+NN{;9F(hAJ48{TXKABNQ0*K zntAX`9(|W2moh)qjT=Da!et=8+pO5})M;J;p7)&F0Qo>hahpuHv22T3^44k{Ka}dM z9+z2ONC*~(bwLDEOB2njLts^^{U0Z0aB`1jFUpshz+q}s{#y(w@ueCW(H2FLfgiJT zOGl`M)6sYYJ_`ewY5=PJY%{pHE3_9>nQRc#w_{};YOz&x7hXl3Y5k!X9Dmtc>PMWc zFA`L}#~Y(;^6b+6fb53aM$EMNb^C;*SP#j;LVBi^<(;Q@UrY^uVD`=k8NSV=kzK^@ zbJK*u^q$uVYj#lZ!Y!EF>fb;y@BcXOkvx?RE$n8~fu}(SjDEItXe%#qOTUR{onwUV z-qSjLoR4<5hf?7tE6}?@W`6jp+=~^NUAs_7YhI@hvDtH_O7<>5w=^#&U334mS%U>$ zy9Hq`*gS$^)ewHs9(T&ii$3M*C8Iw7 zT4;IzQ%#4-Tm_fT?~X2MMvdi>)hJjPX=rgJ9rB%6G?Dtz^L7NW2Gol@Xq9P+@=+ML7c-8Z(4!$fWBfNb2kS zKo=EWAt?E2?i`Rl4g;I;>6jI>y_=Y6jZW&R7UxPa+vMNet3U@N*QPp~FE)Y-dWN=q z)`dF=It7;-bmBesm1wi&iYGxoA(zMB4@u!D6~t3giQRU_z4120Ub(Y8ivns z9{7Tm!WI{Os}X-{S;oCI`vyKH4wtU}IxBY$#J>Ls5)bbkQ~j|g)HD*Yg-|%5fBpv> z*Y8cV&&dgrd3b1I`j%k+^Cj=YKp9?uSt{*{Q9a%H?;eO#xsZLl1f}=Avo|((f|@#j zB-GGxg+q6Z=f)q?qRNSb^E*Hs{!P`({78kh?&OWlE>}m=@=Nv)iIfu%LFJlb0EAu% z4}YWV;5Bn0^x%8P66xl0$Hw&-A6)HFp#9}bvBS9tfQ|xxuCERtjb8zB09C6iC+p{J z6sivng6#Gwek6r@E;26rcGz6ie{xPBD3h9uI*3LY>?fZg*b-^ZBiHiaBW~12Dv!gs zX^Nlhq#VqbjjGOS`MF*|Pa|GUG=$roXXRT$goh)CiZGNmc61{RALogjV&>m^)dm)a z(bo8s3bp0grYVx~K0FKj#ZoSVf@u7Ym$qH*aS07!Z=kT&sYzvgS9AEGO|eJcM*;h* z(u~dk?J(DCKB!|Yv}c9?+`299W$ zD#dQE52p3C`8t3`=cU>a@H!?r8Q@jG`%phVu&Y)|0`jOy``$vg>s;I2zVbn@qMET( zf4DCJ8Hw@J(-~Deb@N)*t3bL4Q91+kn{NCDSGf{grHo=+7NFN~Pf?Bjg8A*lDn|ePGe5HY?A-tBpTz7X!BM&r*BS z!<&SG1iu#r2_RZ>YcFfI{Gi#*fRARriQ!aaH2{WlktX#x$>iNn=61&@sx1dMBJ}>L zeOL0;LNg-3c$h{iH8v+-X@~!*}c3GUHtxSsuzHtKrWZDcMo+!=CABAh2Z*s0}k zfGfD9n#$5dMWp8?N>?SAGQ<~x-qzTi+-^ona+F`APlRY6$QM;szWr7CO+hQT9)0YFIzs1`Y{%lg?eo z`t1FYis$<_-E1@|5f)Sk?h)4^5tcKsl#qV2{(3MEB%x@Wc0bI|`ZYvDN z{J0>@wOh$cFWM>2yGeOczG0T&9?AERq($J`74GC;>yck;cSOx|(ztpz`S!Fv{Yj+Miy482`o4+X(?^M&;TNgDo}Bww7EDGR}ZZ$lCiqVag`K zV%d{ttVI7g+3Qjg3jm%>ieS_6R$Gk9O7*hvM=X)hA#Dv?g8n1FSXaO>%y3EV zxc1T7+M1gdgzM}VejcT2cl8}t#gf?nBIEdd=;hGijLM__=HNV^%EG#`2PN-PnwNip zHifldteRVj0MII#-nx-qF#nq`ap+Iu;B?>9)2G%JLiFj2SRem219`5i^i6^L5|l`B z(e?^$+odSdu;c6swv?9cFe`YZaB*FmRU%!OE$Mch=-Q!(dODb!)tYzpFOb{-j9=P( zTxgB}Mzv?C^(vJLYx?0=kj$oU36$zZl9w{*H%{hhUcuJCnc0ewBKJR$Q+OXvW@VS` zAYW20#7KQhxw0i=^_2k2>Fn~5(KjU2&JEKTOH7*^jpRPp{_Tw47j3ye&D?We;*%6y z;L7019;^tNuhWhrfg*%Z@M2Cj3I~jkpjPRxY5Pk&a9&9HevHkiULV7%VBn!MTpwTK z93hz_x_!?|6+OWzcE?CSEf}kw{8CjeK3+?B%$R<^z^iEN*@1N)O9EEJrI~$+sq%|V zY}y-Cy)!oU=t3W>45>s&mTxc0cfRAPXIdO%Fev|5ZdH^=y|H6BM4Ye$OV!R6MNZ&P z7?YS6ZjF4Do2kqfo|#bPbLtpAaeDg6mvUt-qAD238~as41RkX^@fYqJ{DF|X5D{!D zn|iydr^Ti$oPtHd*{31YZ!hc+?>TJ(e*&!-K1Esdm|vH`59Q=O4rzY4WvLt}x}VG2 zC9XI<^#eC5_hls+jjv;mTJ|F(LlTXSdoK=$?(AjMe|7|KFhXH(AyZO#JQXJ-NsTFN zsH2a}U#V`n+O@A+IQK^!DR83j@aFRZ$jcl0e^{~?kUq~}VxPzxL7vLP9_Ud1=?x(s zb%#pP&^oj|w=vaK5Zl$GjEvge7BsPY$3pD4Nu|VFqO8U>%jK+*V8@)y`NEu_`!M@Q zd83WraliwP=>nek?dS!e4~Ak)3c@kZ$rLw&BF$Dw5!8@5-1O1EzjI|1_s@b{tq6>} z!-cJ12cHCENQ15NHIF_^5CmSDq!6~5faQuL5xdun`AWDGc9lfVz$5Xicu6t#OIMdR zb6EH3hlrG>2w0zy-~L@MIfcx7y-Jpf^xKxtqlC`0-@=_Hhl8#^e&soBm7j z4tKtfVVQH&D55R~;rs0Dx%B(4q(-T$lLg`h?G99N?X8<}7`l)#c~$>#OvdOkOTLBB zVd1I?Mj>wvbIv4&#w)Moo3^sN9kS^)@B*0dNOadP1m21gw{@{ zcOBv41o9zhLSwx853SdN?H@YFqz1TC&bescb%mBTaetxXd0@Jrw4uMmEIYo%Gjd@W zb#KHa_SgayAK>FN)$=t0;EN3oB`D8MFOT8Ztk zQ1;STwQRm85GVf+%BKFG=J!s&>?v#T@oM{X-5S#PMa&YH$;z9JX|p)`Q@XQ=aBMhW5?vidD!Ld>K_%{5~YLJe3 zPwE{zsk9jEJnWJ|9KS}gH~$;pw84KtLd7RBAfWw#S<^8NCj*Z(=BFId#8l?4&K(bg zp`L3D`aX?D?rnL79Ihe#IsrefYV{{Rc7fbKz%jZJCv#@Im{{z+hIiCg)2a*IGzJ?{ z8#a@^Nt$utZ;h&2IcaBoxE;3B9Sr-zKq+d5vqPf5=`#E0tnM4J8WMGyte1~N1Nm|# z-n+Y6wMRLco<>FgMljtHz#Gm0)GTfh0~8k!^hS@shoT$C@jSlCAWVe+j8pN565C>eU8QwE7zM1ze*$4-uu zw`lbT9$TBjoS!>bq0!}e5|h2NO~H>+05`_wuV9P|illg!zDfN7?I0>u>oAxwrllnF zC{35vU^nXxabORBs1~A_|I|Y0bp>)s?M10G>(vb)erwysp{feT*Yb^{zDo$pz$xk= zwl7x3Hj@<=>+E_XS^MCzIIKNlZsNQ4GMi>ModF&xAidh)QE}M(&65T5hC_sE9@Ltj zlI}HY_Ft7wuM0zioBq#`^EYL|y2R)^Ui@C1cTQ9T5m5J?NY`m4WmafA_9Bt0UtF|d zzX_ zIjOl828UGhzl~&JaP^2+YYhu?HtGW+-pK?u&xtn1y`_eao!QUwAhNlrx$_>jND}p% za~%h3L3h*?IkQLPR1z0*y@{^RiB0jEi|$@KK|vuOdRFDb8X_BXwQp}n-@GZV^?Uyj zInKgi8-cKboc_GW(buf2bF^SZ6bO%x)d6pT8!%UaU6hJaob!M5C?W}mnK>_!ZCu>6 zU0xBsZ2BlpQg*;LzAXq#Yd$Ow6{f7k0GYMPPh)bmXI>_jKz3-LHdjJ-j)jy$b6t` z6>>U=3OAGQ^D7{uk`&y&zv*hybX6fCM|idNsa5vV^2_kE1EY<%G~O1J$b*Oo4S!MF ze4~yqqMsqJWx0%Em-ckE?We|{HENyLb8Zl4Yfg;D zq2@AcuxHRislmsAS&_SXYOzryIGWcXWuQMxfr|&FVJiWSJZjv8AHw0S6Kk1)SRDX| zP?w@!EATB>9H%*v2dW#?un-uPH9i85;99(o6$111u?g1=-uHb%GJ0ox2J)p;pM;a? zu7a-0?i9D=TOWt+QjLUZ2{bin726zMwgNt(46cU%pm46~c({0Id3Z=FNoGdG?XR%N z@yIi!Gp#p(I972XL^|_{=2ks?%uh_Alo+wrU#@a2l|~>^2xFa*+=*I#NsKM6vBXBt zm4Fq8U*E&jiP31{GAE@7HIwtz zFyly?k@xOsP^|3 zu{fcW@a36u0b|q$LiPX@H$HI5D7ooVdo^)SE4i`)a;I2q)6p6>p(WB zy&bf=*^FVTmo$1pJzYL(u%nq0H~q+&Fb*Emel6BNV-U=sgD@id;&n<4Mkoa5C(Oo9 zhL4q8%pNrvOXb=|;N4hGpn~3Ih+Ijp%^6~Bks_1;ZFkCGom!huH+ykDO`gM%23_yP zu1g}tcB28i-npmm!4WlD1$?(x=AnO7eV=)C_+4^98uPFOi(F9RXz>qDieIc}7c?gW zSy1OYhjGhmIA)+Sfpc~7!Pms8RAQ$sEMk{4KN-J@>P(1THJs3@zel-FJG)8lXSnjB zmg|W+KDz|~mTwd!Brl}qfcuoB;ZN8@KF~I28m9NT{xw+IhER!!89+}&A?M%RtJf8C zsYVp$p0#kim($3}4%`*bZif}?ehn{MseB1Fxo3+TCh)&lRUY3txRbcTOBe(%a!D!p zVfs5KF5tKdJmL9WM2_#cGD-12Ru2AP!sGd@I}<1%I1&s0`$VQy_cquqa-Ea2$*T^( z+V>>Iwjtjro-EP|kJ7({rystgQnM&{$xA5ir_Dz)sTaAB&6lp?ooll`7iJI2#>&e+zM0jAaRsXvC{$o)U0VvqBDn9Aetzt_cJc#WK|$>-y)-^R zrCZUMJIiFGMsraGkcX_=dagliyH54H(G8BxPOiHBL0_+;=h(sSReAZayvNw8hkvwz zbI|C>vzxYFiXKxH@!Qu}>NxmvdNt?U@JynJ8w#%XfC_sNJQ*Lhe4kw!@(i1o3cqN_ z-&8jvBtKU}&%Bn1&xbd)akeM0CE{TVG4--++9?dnS>p z{n5?oKxnT|wbJBDiyV-?Zp2L;E*D3MMUGbLmtWkXV8Q5G@G1%3DP}4&G912;in-m$ z;xHUC7^W}2@HFvsEqK6E%ylj!@(`bT6*48=jjEdj z;M0bqCBqd7>#(n-is_}T7q3aDRRZBg>PEnbhwr@)J>#=4%ugWSwY#ef7RC8E$I9&$ zV9+slH34|>ZynvRbB)#O<89{c5)a)0xvGLFs^2PwUBC~Tfwu84VGfCq{e45$d4rtW zE2ZX|Xb)dTD(@OEX(0-y4OtHZi&Q(J?Mz5xc2t2B}Jzyg60VG3Hz@t|uNO z#`*p5BSg-Kg?n)JJ?QqNIvN)J1WSF$&p9%@p^E-Y-dMDMO}_Ingy_2%V55x&XFNk= zzpb^4jd}5?Mi9$Qhy&Wk-)p1nibiX<)>KQpcI2K0H}|ZHBBS*tR9>DZ=SyN`Q_kVc#<;Rhp0 zQ@_jkra=vI*}`mT?2#+dwiVA8W8343Ov05+mDd|LNkzF*yJDL2g9jhueQO=fgD&^r z={Rd_k;aVE=1F6Ln=Xr-_~Q%R0i~42j?>=;ZhC=la9)NYVKMN0JFu@u6sO7#rsWo@ zJ1%G6QjDk6l(H=@=qQ^4M(Mf{;Y@FN@Me!=@lu6{6p0nAN*Zw9Z($v(mRuih1N+L6i1|X)Rj;2Eu$0Lg>eab6bn$0^7i0o1vgOQ(5aePfvDePOUcM>38f*1=@FAU7?0DJVaoy=ab61xH_4^`=!z1~b0b zlulKCks$9~?vw%zjlFt!x39~r9$R+n&Z|xcf3O=arQ(~LkM@DP#18`N$P_6YvUEg%JtlW*T zC45}`WM6UQ20XgVW%cwr_Hp{o`h!k*j>K;7!(CDKZQ%z)%9!B?gtxEs>|LNC2An)) zi{HO5BGC8URPvo?{&^41f$OteOc7lmYZb+nZqZ})JnNM zf%MWJwr+Go|USS!@Tqo8z5%K=xF9zxJDV0nH+y|=bV|Uj1 zmaV6Ff2~u)u{iMWfxocOf$!4oOgScYk^1_+xEe>%wcsW_{2IXCC!m|#yZcg0uD&^= z>x+n}Jx4#*-PPQa-g7|V7wSBBr^3vIHtpIbBSr94 z&g~_F%4#rSI9Xj`mEj3Zi$K0JTV22#0vv{c!|W(;mT)!EC$mtV3M1kuI1c`5PK8#w zlc^D8WD@rbp~r$^kAU}}?kHWP2~uLN)nPI5KM9VP+dUg zpy(Zh>YI9+XmY->=vQi-gN8dh2fzN0s+`XP`V_(?D64^KTSl*5u9x0+w_A5Tx?LkT zi>~Yu(`I62i9w?@T?|m7vDwDcc|8AMU)o}nKJzVnBcBR`_llG|@&~KAjL+Ok8Debd zfwW?`ZFSM_9&w0DKF3xz*6U0+3Lqgj7d!IAWiXX`t`DCM&m6M}s)}}Eh`Fhr5tr}R z*AsG?llF)1%;P&_b!doNpAA7x(m4t*M01Ah`Bq+0jzZE*BCz$%e}2wQ?in-7YX4K! z^C<|}F(yz9LC}r^j*w(X7Kiz7xEzlcl9LHNSNa|_c&MRUUz5p&3isze(-zgwxR=@d zev6A7T->Eg2lZD}1Ir;Av`c5?SOy20`SOsl@({RHIYEQid?<0`kBmE|tE%ter*|g& zB)}09Q&;-Va5|9s5>2ZS>wa;G&BCc9IEDI?948Su zsc}__XsFqkEwE$NdgznT@3f`;{4S6&k zmufP%_@X@Ef8{s`gifX|mjPcrmkypYP%c(-08l0-wIil#Jh(2JmqRE`uO%28H>%u> zjO9;k?CgU{hNxXdC>MR2hRz8CoAi_^rmp-AS_+Gkoe9l9Y2;z++v79-ac{l&#^IFU zIGi7nqry=&@TpVL&!+`*b8hUR+aQQ!-_fhdJK0W9x!me1n3TZO6watu+yQMX236nMY8;=;1?~ymHPY6mxR`vAF3|LW8R7;6=I9g_+NW zfv*lD-W&ZXxb4S>rYi|5lIw6#9SiC{Dwk9`7|QCrYd_Y>g@##qyY`k%PMo<}7~Bqe z<`)JXLNKV08vvu4*}#P(&x>>Yk4Jvvz5O20LrBS^q=rvdzo}wS7~{gg8^YoBO=!Wz zs|E*!PME!oJUj-BYp!1K-?y-h*KfClJ+R{;d#Is_&7sR)fGz=+@tUC4Sr=Z)Y{X+k zVOM|aM&qyV7V5{7H9>ZD(r_oB_IFJbQX7qUwOznMEvo#uF?%~~oxztW7nBPV*%OHM zlIb>Xdt)&v!&%!LOp#qiC>b696K1xM;FNT{j$G-x8)zn3B|pSue4rE!2K+w-YdnS= zSNb;Z1jJx~5Unt%Lr5R0Qy7z3Ul5l~;BPo;2BGs8&GDKGo>iVNl(=JJROoDA1+ou| z%@54=FE%3+bvuMDmIexPE}NP}-1V{@h>O%eOMMnTXPj=K|Dl$<8x#`pzgo30)J~mQ z2(8R@KjQZG)>#|vdV(P{vOkGSC2&u*fmZiRN8J%ju(oaK&sW=XC+{ zF{oSt_oqR=o0iYiK=X|H3#p)So?>Of^vJ%zJ80}C9&_p;CH=Wx_n(EjeEcD|iQn<& z6+N(Iw}3VY877i#giaO_DHy|3ZQI4eWGM)jh`d{+4h#ID_ecuBzh>_X1Jp?$#v)6t zQ1Q7#>I=7*tjUaB3X+U6VL_KDBtr=43ek_3Hw^Nk&7-Bc0!2daS6@ehaI_Z6xU*QP%Dp%*2tj0Xe!KZ5h^AY9 zcDQ-(Gv|K$2&=N|)Nh`1PM)7KSzcZQ$EhJpKkogb<&dkijPqVVP`J?ro9G%= z<0d5U&8BQg;PA*vfz_8M664OV z=a2lpnS3&G)M{lvwY~>w#_m;Le^zv-2-}aeR^mIvk1JBrn{#-Hn~-BdEY6=3SK7~^ zv2%x`t~hkPRCC3H(^1RLRR2`242)CU1BY&+BQg+O1*)FHqtFM{eJTcI4;UgeCJ& zX6gVC)Sp{!zz)h>B-F`V)y|dm9r#9n<`=(3Hpg+CdZ_GGMW{w!bmwl>?gvHZIMf$5 zpV{3}lt-HvuOt_;j`c5z(bW;(qt+}8 zBfgh@k9+|g@6zQ)E_S#1@OP$r5&8B5rrHy)}~Se!4_tvNybE^V#TFWV(anK@#qx z>qshgJlVlcGeIzam(_m!!RL1t-E5rTlUc4r_(G*+pZpvC@W_i_-g>A=d2mSR(L zse(^4x}m~XKKFBs)Vs~uRQswutS@R~WsefZxahoxyh!-}0dPQ%zqsXKU7Ng(S0yWm z3{Kvcl19&|Op6*;48n!9>t6za-^<>sJ!4p()%+BRj28#}wL7W+V8<(VF~VfG(;E85!^k1M+S z7}(Zw8afGGRDo*cW~5Hh(CY53ivq8ZsVlZdv~AVLcS#5jC_74}Va(yTk3q}Fi0jyv z-d!PKRY^{?(iftuF>dd?v%ToyQ^s8F+1(?y=YTEK%H6)oXTvh+6!T+PR(J!KIYDz7 z)}38BoxzU}dWkdLaqO(13_H;VbGfNCDxm2Ms;ix-;D05=USTh__K1&@2c1=&UKQs59C z@Ed1rsz-(}{5|38sy0_Nk9d3Dc7xovY=A%kJmT;KhlijFsA*E|SkNgC0qD)<8Z>IT z_kaLk7UqidRS9{FEMP8rGrUwyc@hxKn_E`rPdVML;Z-g+byDy*9&dG5ZjAMH0D88H zwchc3(U@e#Y$bbvYP#y9T^iTmJUrXzROIcg(I1DsmClMb+5mXgoM4UBW3lDUBZqS; zJ>MDu>a(KQ00&)@Z>jkK;fit2w@7#iKsg@lE?}w4a!0qod!6qqte)Zp&^u3Z3m*5H z78n&~-H6rC01(7ly3ti(!DCET@*>FL>FRa5*&Y`LR}v{MgEdfsidV0_p;T?{fIGzH zP$RNX$~jQBi|`9xI)2?8?+s+`L=JWhoT&PF!QeZ`Dc1{kiAQavVvzMWyFsw4M=dvO zSV@^+92Ghb4gm}fb5ltj-~jFu$oZPL-WMUvW%o|+ z2utr!lAl5^70soQdzHH_JTncrHaXTic!$`wpN^X_H7Lwx--m??AkKJHLcN}Nw;bh& z9I@eB)(0+Vt3KzbA8u6(>hOF^KEvP~BckC{b=nJ2s>jbLTLZ%_2M#K4r*g4LXS@R{ zT%axuA&&u%x4P;JEi#MWVDk?oi3{&`--eB@?aRFJ6?DC9m6|b>hSvKztE%Im5v~b` z!xlRN_D(2>=DO>``<7b1(WTZNsAw`Dj#asJ3IGG-Y)wLLIO_rR6o%rHPl7>h)B`tY zK}xV`E<{&VO;5l8v#U6Rf!#IlAol4pPZ3>LR$UOd&n_3~ZbDPC_ExdwRZ`_!%pE}_ z`ul}~`xVX{dm#9FHSGb3mus?2wJ$!d5C7);&K&}3ofCVX={$zJYo>s)*Xs)UJ# z(}#lV%e}D=5#izLkA>Hr0`c8Fxie@6)8Sl7rN%_IfUtIX3ZO=d!_TqI7BnhgmshV* z_lLQsVAWHpcXk(^#&b`+1mRMUz$3$i;>6U)VM}m$DH07CG-l9xPSd{Y@E#Y;w0sR# zaS`sxu%7_ttTx@-aE?MguS@Q{H!{NY)#$F|yRQAUvo9bnqOznOH_N2b#1xlL$v3qRPDR_lJ8>fb8&M>XIs&oou1z z^S4B5_+7ok<_Dg$?{T~2uH+ZJyL_>gDGvc|g-~VXJ%~&j!Q*zF zJRTK{WK^<>HpNgNEMm136$-GLhZXVKV|T;Xnx1=vL!Gc5qy|-RxHiUGj5(S_#XBJI z9>%QR9rf;zM%@{@tINWrh`npPHrO2`durg@jK=!}4*UT=t#@eI%DCqt!m{NTDM#0* zaNmz;UN*|R2vF8NI4^s{nAgH;VS6c#=sQN?T0D;;PjX?z-SRxjC#rUqrq%85gT3AVA_K>*E6R}A`F!LMmVw~Q8?TS}IT!e6>ZgG-+bi zv>zdHUOa=qS3Mq~1T>ayMX>fZ_M6E>y66k7K6X zjnC^4$Da)c~fZKkp3)X|oGO1;I$Mi^5f1*OG{s{`Nw1rppRT8K9Br3W{RegTP z#roepAM1DclUNF?1BdyifOWWc{!@q}zCzMtUG^3qP{Bfg-xH(2f-^&QFH4^1Q>}a( zP~#n$c5?>z-*?ksq@DrEAR5Ju_q;p+%mD&GAs=4Nwa5I4`&vE91#nLyM!HXLQ2PEK zadyYS{C!(#nIF$3zE^ieI{NhE_kF)3(VMq!cg5iQlW|OY_RLl|_4)Yw)L9+^-?f>U z-wyikCHPHr@|&D9uN~*qDwk_P96(9-PeO>E-puR!=(znK+dgec_i`jo)!nF^@vL_S z>Uo3ZV}mwNJl=_0u3<;lvZ=0wJ$>(ax2N6`DAunJu4hEH=+WA4uBc!LR#~r_Hz<<$ zErL}xe%;#nbNe-1*>y4e4O87s(7yMEEA!8?ki;nU8s+rrDV-8yk!qz#F&4yqxpD$i zK$o9&U88{U3>MHQ<6Lsy{b7#!?boWlnY{(#B#z3s4Y%F%&eX&@*Q!-+S~P<2zZ*C7 z*e!f7zRb@b2~mlQ&(c1KD5Xaxn^xUj=J(yj)K)h8Y6A@G~|N`Bz$)}=EEcC$=kKK9xt39ojb4zB69 zwOLh!8!Ir2%(z#IV~3H#AZcU{=+Y(mySjSnsAe2#&969@i5@mG_RA$GHVs7?DlJ4& zDGF&T5p6QXGK3NUz5AUwpFHD#L)xyNN-1}+)diYNeWPOpy_IMPd@O`QKJp@x0O|t{ zM&7N^m1rDf?e+SB9j9kyvW?N{S-~tc6gVdC%EEiS&6upP{RN0;Wnza0+M~3|uG?9O zioCwIXAyvrnHcxHd=G#l$H^qkOBWN%w6b8fNC24YCTpduEd$6-FBs0RSU6)Kzn0tGtGm(A5>m}z}qg54TDzj^Nr3$XoA01DxQ^ZU88Szw6Ti2E zvzdYdM7k2lfa>{WY$^O6V0Y_-Ga$y1>#=((@!cg`p@)euAhGe~7 z9HwCVEsve~i4blu?jboqv0F71WikVZPE^;bf@OqT354su4jZwUf_h%IsP0DPRjtcs zJ8+X#LBY^z4%W0uH=b>mELHlfFov~&h-h)njM0zTlfa|^vd2&*f={s6uLI*8OnQpv z4NYRk83-`>0wRs;5K6QlK13LOcT%8NPC2+JG$R34!L&#hXi!SXVf)ZaVpyPtX6{_a zjm-HWRr-*s?0sJS-xpsuPoDMGYiWo>CTIyDW+o^g_dDhJp~>FoK4F)aA9FZx=A#8s zRYoeRG15WmAA29W^O#wm07DIipryf+Fg_YhL5L6*Kqub&x0M~_C$2st`e55@X|iUU zB7nvOPz55O_8gn%UoibopcVDJxAMOdh9D9qYx=JJy#9BGo?ZEV9B&iAiR<6J>oocO zaqFGJNhjGyGi28!cwR5s_lZD;W>65+A+(FWm3zeohbf z>8X7~F`7)m2`MAqsJ{T#v)e2nh-W7?Ke*(V{)nK4(<;_h^WGVGHx4u5z=FecyRyzLS1<``X&CHufZ9goH@S z6+3_ipVL0l|8;q~&&)p`ES)g!9bg|_^L+^@`ad;WHk(nkv9jrEufJQ{^T+jfi@?HU z#F;5TkzPOtp!l3*pUms+^C{MIAb0?tbMKSowT}dczc|gCX3dP`M-S3{_QNtt9UlK= z@_sBkGW8Me--H5G`7g~4t*d34YUoSH+uMBg=v&&uODQI35<+Oc;3f0(58{?U@c_qY z+-365%nuq*2p#0&9e-W!huTp?J0yge(uk@t65m+$>EMBCOknq>Ow&WziKQr$~gAZ-- zx^8PeEn0@kX_}Url-XrWw%Xn=WdH>cS7ayS58C`;^tNL?Y~=|+-e&cGB|({tflO*L zOF+Pj6=I;r(1e;3=Y;Svx$;mvB(aGZXu*h$MIo`a*=;P;aPeuWtxT^ov<|(_xA}*h zDaT(SJOj)>e_6gjEXU;SJWEVi#Ksz03^KuH*G+9%w%);HpiwexSpfYzjO*n%ND0(A zWX2cof23H(wUkKHB#jgp(WsI`8jU1UYAY0$gkmtBfe3$h2mnLp_uaYrf%@ZxGwl?V zm@Jsg>uc7frr03D`h8>$eZ0$$1V59o1E2!@drRrox^<_E#5B}s)mXJGWNNT#W=X~b z^mNwEw%R))kT0YCVo>ky2U|(cEU7XB!FAg%ejf3d)-c*^)?tlI%2d)K$&k}2i7AyM z6^lls$wZZzNod%r(wd^tw5E`#fO<$t-v1Ax3{1Xc)k7`9?%}YkntxfvGMYMbl-zGK zo6O0U(0Pt9d2YW+uGgYzfS8(9}7Z#pc+& z!G^nefevzmZjq5V(AFF>$cVVhmZX@JH&Mxy)0#rs1&YnyWGkwQ4s!{}sA?GQSSTqz zdhp@kdDPsiD`>QB%O)@gV6!_J6uPd$Elhkk?$ z#tXTcg@8RU2a~}HKJd}Cj9lU2$}?y<=mCDN-WWHQRPgY002UA+0I3t+_Cf*SU_W>S z$AUX|e#Nv1r~m`U3#qNSROnZUu1Kn&~q{EefPy3-1|<)sY&poC09N@ zRh!Oz&g!aM!}omh;Q3SKS-g2i(t*KV;&`V4(jp4)@$=yCkc zeP^)y>RnbMrzq*G?*={`ZOhK&lYB)^wq@B}Sq0@iK4Q_xyNTR-YHj5PXqY3%#QLl{ z>*KApl>%taA$N5+{=(7EuIJf4Igwr5Ju89Cxh9XXjZf+E>gcZRB>O&NJ9~-RR{o~r z`lnSNvrYXC$a*KW^OCXr>*YCu^&xVZSbjTuLfi_O>nnQpqyX zp)arJAHnWW`x;ED!_FxL-vWFOfdu#iT2m;tq>NV0ek|^!nMM^^D2WC#D5OU>GU(>> z&iV6^gRfSVN!aQWqBM&3Bz5iO)O!lyhNyc&h3M7kY zi(NKSL@29-hAnjfq>?h22@g6Lqvbrs%rs9G?qH}adj>%i)}Yu}P}kk&LGPmR^&&S` z!;y+4k_ZJo_ANMI=zF^6vW~j;DFso19vs_S0VY7v86*{kn5~8@1p=6MCd~y%K}mMj zr$-Kf5a(k!PS6oMFqFiC3G-J&pjF^-MFd}l2f6Nc`n=rYbA}%;t-LZ(o9hF3EFLjy zDa=}4u9Svg$mIyW~= zP0@u4Gica2KHc2QnVD^l4Gbx{OKz6_Y<_e zZ|ZJ8s&!HOG~dwNhHc|NWU4s+b@H6SdXTyCzV_n#x2bhO0^SX)S*oEI1$nlS(MRgH zwl49$4+jyJNWq}o6}i&*FTN1P_iuGjw4?jv&XEQw9Sj|PkyQdlTF`?O@pv*wI+4o= zolr6e;t+N)HyPcbUKAAsNeLu4D>73p-3NxrqKIE1v&-u9fZOeyMNqB!QD;GO#6)em z97%#vWGLb+L}!v=HiBj_;SFPCy>1(5vwlXHjRZ&)rKK(hn}-f(T=AycODL%8)JwF% z#SpbKGO$$}O{~VzSo{bms$vG?CdxNq1_ZRkK37hPK)`4ckXl)*OtWNMj}|d9Gv*!` z@FVD`&~K?!2DuEotEU2rQm+U$=)_X=3Wy@QsQS-X`_T-MDK$7OjID(lp;pvL)1hk+ zu>9i?2m^p*k&qb){W@fkd+we6r0{j4E8#q$@!!vieE082;RPnIr*jKa*OG?|cUbk^73OC+@lu|zEp(!TbRfRx)?ZP!%$o)GYs7OU@~x~u&C z{dQMj@!)Y60nSf8FABUvy6oW`smF`q^Wd))ci_H{eie8}bMu9A9$n2F@AYQQW-M!A zwMC-(T+yacR!d1@+ALVKYKq0CS~k(FTN*W!MX0e+V#e6XR>8Gwt*N!r7k_^)zhr)W z`0e@Y2$B&&9XVwggc^dX0=PI@88vBY_!Yr^bDMW?m)&r?QH_X#BN?>YW@_2k zoy-h}>^uDIj@Y9L?w^(T?NQlj8bVARXPrnsnSl2%5>(V z%H&^MP~{Fg;ar&+PG6(zQra6E2GcTn=BN{XdxYru*6(R;hsb;&TxDeV`tPKtZ@cau!g>J4NP-eF2m$QY zEsPNXY!FyaWw8m2WR|jQr75J_No133niF6le^r^*Y^*a7$}$s|)p2g_#xj~>HAWex zKv4lq40)>FWwNUA_@%^hy06|P!x%Z=3B`3ogM~SPq;=9=GMOxfU}!nY-#X-S$56&rcPkUalC!_V_Dhtxk$@|t-@t!xHGvUJ6=%T06GMS$YbQh0sSx1%1x=UNf)r}n#FZ&%q_O1v*YRH9vC!U zJ~&QHs?j}o@z^`Tr2XyTU8}V0yZiEZQ^9x~IIE0J7Ypx&ae~5ecGkW2j`C%9S8gMW zR;kLn_&XPDl+j()<9^lgsMd`|DWa0GVzWzV(W(_0sfDv{7!u9`WNTlr_YbqYIX6wb=QYFcNIG= zOpQYUy@R&cMaq9s4NAi4$vMxNV-_@91$Es47L{;xlIcsR?@lGdDTUWH-)dduCMe+O9WhG89egFha={r%$vPKIscH_Y`QleH zCPB&H5ahyX9FLFGwi_D_qcv@2ShhARC8CPOMY2k3V{InVY-%=$){K~J#+ya4c1eDE z^!)md&*1gb^Q&D2H6%2Qu!{+PhQNLNe?PuC{v_tMaXduGLV5m_0`G2pU`aj*A@FRN z_dnRBR;tbKDqApR0Cw$HOckmh!u_rlPAZ&*(4A1}9$G#2tGc*%@%eaE@MVSZeegLh zdf^;pQe+pd)#tKzlBTG*cf_U1OBAw~K7W%kYb`L=F^g+j!)jTqnpvroW}9X+YEsFR zsVa@CLe@1JnrlV0W?C$5NwzGSf&w}~kn_J+{QD&H`~84;Lq989YgCw-iI+sIB+!zm znRKkSiXlZ|byHJAO32VQ!rMmHtX0`0Ki|iAea}*PIxHTFYw^91v){RE3`?GE2_(8H z4}%1MLuDMRjumxl6-`YeFd^vFlez*-C3s-k!fZQjzWto17_>iX=&q6J^x~Y3-aK}P zY+9#od-^Yzl|139^IisVE)2@(k5?7Q;y%-W;fzjRHv^2dI$qJce%1G>u+40nQ#MU) zCM=doG-@(p#G0A4MlF*`WYI|*88Na_Y*dkBY|XY!qguSeJ`X=We>>ejVtIMySczyR zw9Mx&S(a6*vZvxepV#N9CmjE8`MqJkeDk<))2Kr=Y0MCRbJ1{@Y}5pQHsniSZqYG4zoCDs@jOws4HwmTJ-`+*U@MD@6LSt z(KnaBJTnq=$P@=?9x#?Owt3M=Bd?j(LZLeeB=`pb_=^(JLX;6QtAK?B{*mI67^13L zL}pTLL|fM=Qk~g(IOO4~%L5z&+GI46X#$6k_?_?}!3ziN^SyR1;m0m3k=ICcVHj6W zjr@+qc2`R1uB=N5)5bo#4%rh0!9F-HSzzS#ml4dRi1qdSvkj)ECL2RSp-C)gjLJq> znrhQ3G-8G+nXHvEQYtZ;QWj0T>aF+g`S<=K8wZ%ZX-2YIu!}+0dd#oFI)xfs%L?NGR$UXz>CiOm1`qNvO!*rqo+VFQjZ>$a^*a&aU71Rbf;A6ohj8ic+WerJ4>n^71gW9 zi~Ia$N)S|rl9YpOkhBy{mXxz0A@#N)@ZsPj{J&G?8j1#R-c6iAfGH!0@a8%^E zqoCoUye`a_mdnr`fyw}UHr&IZeRj=^i!Z3mmz8@PbthPgbT@MP9b8cRiB)!e91XE5GwJI9>f zFiqqMkPtG&o0+7c-Qc%4TeeIAMl3&D_YhS<7%W zSyc?&#WCB%0L#oY-fPX|xD+<+%U3fPrP{DuP2A?3VN{OohKOBU$x4$9$*%6Y(F;6L z!6dqz!rgUuO2=0&nCG}n)y|$%ok7GToSk=4$N=#E9JXc<$@E;;8P3D|5$MFul2hoR?FpnC?55y@4Q4^!|*%>zx@V_;0;)JsZ-s z>!SxVIiL@CbphV+_Z{u`hkjS#n?i}Ehq=lFB$6@jdzN7DWU9^1a*^9U@E7R7qhRn8 z(2$$G2avK)bDfu*19x`laSpk~T`bylA7r(*6sOYpoaq_mwJu~+=04tnUwn?rXLA|B z5K4vpR{p>^Y8A6`VlzH}XD+=Q9O<7f7JE>ybw-0PkPy-?W-CZ(%naR9TeRf?vZ{SM zX~8Bk68NCdDOH!QU_UFms0qqYKal&f?vna_TlTtteBEki!)@%gUwvGAGwpm{9d|Z~ z3o_@8Y}UtIg<+m~~` z?3mC;@4GT*-y?Ra<0)y0FQ?x|8(}CLNnPC8o{7PFx4J_yOFbrUR@Dus^``j(3;G`U z^z71Z>XQUbRH^7i> zvNr{0Tqp=W$GLYw5nVXfSR3GSsv+_!x&?fWX<&|Su>vJ~ex;TuO;l*YkQ%bKwPYMg zARN%9G}@$%`)Cfjjftf*EwPr`nRLyFYg?qG+bn6NE4j0#CbZ1~01^Qtp8`PuZZDU@ z=?y(gU7_1n`xxXK#*T;)g`o+obz?r3G{*g+Y?U$`{t9mro`bl(Y$C z8dpXVK~7aC7RK``OAel?fq|NXKy7=+pknE631DDIAyT_Q!%#R+3~wJaE?TF^hN`Zc^(Ceo1Dq(7e&Rl z7n4y@5Rf<=5Yvg&@+o~XHIi*!B6zx-EL7h+_uDf!UbtGGc?6OrJR;Sl5$SDLCX9-n z)!&QCEIfHyWP5LS2VA??t&>}6UUlFJB$CB&$Oxl4HQlS0xr(PlHBwMb2yl#4g11$X z=6RXBw48*PEKx5?ft_`2rV-!>ie7}l4t(RglK7g!s;>9x1UXliIPz#t=)2Im`ub8j z-Xyy4NNCP3)e#YgcfRYH$%{H9?GEJ8kxk>l7V7amXw!P`?(7&OQi%?4GcIPubkh}PWVV+ZY0!oX$CIcjGD)QrNO-$nUcDZxyu9`y#{s}la!FZK zgM)+9D zT`iBi-rZe~q91QG#__8OH?e2PZyP@~puJ0E&$74VkW#+6_szF1=Y82RppV~nWY4}u zn#A4w$*cIu_MYx;NAPX7;AtznTJzB{eTGP8NP4sBJ@)6(Wo_u6cRODo?tD+mYg}Ir z(9~2;eW8zu_1^treE!&etN7OD2KHUvM9#K==q3lh!~RB71U9#a#f=9fl@5WKeP zde5yPNqXwb1kr%9*Fg!z2 zeoCooRB1AqoD@1n^!j zo+ZS2TsT)D;m<3s(7Q8Hc~SN1K%J|(n05Wr^47G>+iA9>N}Fw_B56r8D55kW1Ha#X ze*b_0Iu4dUmNaE67*dUj+S;hLG%5a)0DKSe^`3vjyqf&~ZSwSs8v?j@>IgB3N3#@5((H%2M_tG6J`Qcu>RoRV4-%9Gr%JEa2 z6Ooai;e2hxxXGcx<8dxBHBWBuM)7QO!k!D2{I8a@lVaH>RElcGr6^M>AjHs;A5X{m zJ;U@r&HrR1Cuirj+RG_HP@zRbVy0-Ji%K<2)e^8NIHLZrY#+n=LwfjwmVd9gvpc+c zX6Ya_pEsFb9+ZF{fF23*AVO>h_uQy7sMRu66eT54%6d4;W1F31US&Y6n#z($lCn&^ z+iA6T{CM-=UNK~Mdg7-Ul;htD;yK$L_2BSD;LAyPyKkQdg1lIOUU)z*t;uI+kIc+`4~#fn50;nEt_nIaHos+;V%|aFsD3DC08X^PBn2(VOFSh%!dHr zJUS;?7NO(0!Z|S(A>?$YMnJ_K|31xRwn}Q7WvNDHN+O`DB-oH^5P7z(`ETam-TeIi z_BIS--up0)9OL5*)RtMrT8mQ|aSSs$N{rT$aBb6c9TMf23yF%=j z$Il7IT3km^s5d@GDHJN`bU zU8+O(iS!TP?>F{DAA!{VL;HuVMp_NFsHhlfNNHuN7L}<{{(4&Xq(|k+X%Cj`z53Gh zseiHnuYk{f6XG%$6j0Eafk7f6&+SyTLd1ybXg%$u%dS(7&5Z+;ox7~u7AJGIISz5) z0C)lKqIHney7j`2VQP%6V@6YCSf*1f4ORHhE{Q~=7*Mm06D;TnH~}Z_;n&Q`3Ex5} ziSqa7S!T5&qSUIkTUw%LU46f{@&5gM()1yXc~f}(`o5_z+p12PY=LR~3Pe;{ zC95EZ#u!-cokwt%Frx~5yFVNxe*FHh;B3?baHcJ~@Q+dF@zmgKCS}gD6Ce*kL!#zG z2(KCJk{<|34!6So??Aao{YYmhdwoJ$u}D%($gQGMDEK^i{C|HP@Lto@;%8o99Vf$> z9}0~TB{ZsJOo$=`CPh!pLKQU^pyE1R1RYtVY6k~a7x;Yv@#-JD4`DxuX|hOnOD8?= zPWc5P^uwydZ_eEZD$zQ#FHdfq^YhE

  • zVA5HGa9${aFF^JAYTEJB{Zbi*Tt?TQH;64FAgh3Gz2$>)d zLtwuOwWv)CD2Y|t}1)~y*wyIR6ttkIrXWt5TonL#;hwi-g=JUV4bZgl| z=>#oQ1Sv@hB|i$ZszeZk-fd9!D7zd-cHHG~as-fHKKMKD1b*zGZ>S)X$t9%n0X>8X z`{&O*K5sZ_%;s6k0+)|C?Nu-yts38LQP>Ii7Uyvm}tlx zTT^+=(rKkNHQr|?hn;suYZejnxZOT*6HSRKH#jm(w-iZ&!RF>ILtA*|VaCcPvkQke zVa?|gQU>nm9JUxL)2=r5igqv{0&|vm}ue z$f`AoGC5FawAi$bkcwi0lUXKRjO5!^twPeu6swyitd=Q_J7RH^*pM$~1NU8y=S<7@ zDd2w2y5#PhDyh#=FKyP?2(diO>UUwMFiW5WFUz3yp- z`ziu4dG+^Wx z95FPyw`m(zWR<(0aX&AX-bsAyHJO%C-AHs#LG|bq^7l6h#%Tk3$Z~C}JgD!~mD&3m zJ8?daT;pdZ3z{mCFY2;BM;F`l74Z7qr}tlSN{9$tN9SFYWX|upDP%D~6?4;5k3$em zckuP!F8k?K+218k=&c3yRnyI9DTaqgHhsS`mY_2AaV+MYwaW+Hl5)pB`a6kkw_^ER z`{vKt1l93e4EnnrtuDjWh|i+KR+r>kVx_2cGqL^RB)$_!TXydm-4#89Y3E0rB^S@T8YX zVJ1h(Di_o=*6f9h#0-eE!7T10crxY-YuJYbFtgO)B*daeP(a$u1mzr=N&2oDTr|i~ zRamZa*hHl*@Y&AZW5sUwt=Cj-VGjTzn7v~d?tW$GQ$E+TDQvs(jg^JV?h{bkONFjo+ zJ9oz}8>&`40oJM@aFSpcVT7Czr%a^Gr#joECrpKyOEM0bD(-W`cI`yVB_?92n2_w} zZQtR28?7eV>9=_m;A)AbMAy{06&&+)b1*g{BC3WXN;O(CB9$$r zMk>J#PkD1LGgzwd6&rS?w@db`tEVa~ykl+mUOk=n-4|v}ZpHGs_syTO39I6`8TEEM zT2+HfMc`t==Y-F`Uk2Jx?9S)daohW|>-oQ+(Uq7PR6x3tvlKTI-QJa{D+r3|)6obhmK&u4t`#eI^LL!p zUb$`;6s>K`hg(e2A%aMrD5GUEl^a5pZbH4lTiLEI!Dw!bw&T;pgkkp*Oq`a`}X|~RC!#0u`hNm73-OO5wduSs0xy`)| zQ>%G<s8#_|lN^K%RnmvW{kwA~nJMG}!mN{b14f;CdSoAXGvRHSOE zf|RIL6v!jN#{_~P)L^KBW{-hzQ7Qx}AjLKmGK5jn6v9rb1Oy5L6+{~KM;WIaO~BHm ziEgKy2-GN51yjw`f;kYV%ID{3MOI0HE@ml(P2YMtc?}Eo8kV&R)~jrEH8LcytgBU0 z=7e;zwxtmVug8y!_@8sXOXqodJ7nJ_=zD&0Zf2c=d?YA^0R*8!pN9skRZ{92Vx*Tg zh$qp|_aLOiz((YY0}>8)1^xrODTsXeo^oFTt0sbM{2wr1#Q+^gb?;Zq> zEW08B83?8O6RH-XMs#Rmm*HCzf$OrMp~Jw=NGUNcQ|+E1tm0~DU+kD*b0Php&TXBN zL%<~8A^9Yp{y7f~Z4nt*P7siVlL(b$P)#D@ttFMylBO7lsLa8XRC5JTQl(|=<2b|f zCvWp#8T`QqVqN*IZzEc=C8W@8Ud6UcaJnW9aITbvr!3HjJTI8D> z8yu4Eb3|;U5&;2%F_Wk$)|P@=SqCFaL`MC=_TqvnW9Rs6?Ykrl4vu9aY_mHkVO1GKtksqjstL_@5mD(+zrL}D^3jbUOa zq-IO})80eO(gBkHe_`4E!;&9g%$dW}Ofy5XE)-+~>5P5j_t(F#tO?g2il^;q2~vd? zg(lJ{w4&NsCMKnY7w7mNZ9M(f4j0?~_kQi1eLnaohzKBvWDpc~5KNf;b!Lc`MX}N} z>&w8Tjnv&JS6VPp3dpb)%mn(+aQ=bX8!}mAEL1F^RFlE(Kn>_VehpU1s@J=e_sA>X4p{YT|HH>~q>tvEy2S$g{uheky@yTi*2;Fo*di9KX;SIeXq3R;AUaw8$DJciU=`Mi3AXo zYpPOcDN0EzrEHe{jz@Nunq?+omm`l`qmcweoFk5TI1zG)oKl^{C<=ltXs@~S;2(Z} z93|PfPG6I#pTZ|0(qd_~z$- z-zUlZlas&?X+j6FhK_XQJL)~^j&yr+u9`WguRSUAPy^>A?w`-5y8X@Fb#q1z?r#@s zrsh+Ltg%r;W)~D3GAT@gn}&lp@&M&HtPo>{2H~QPmH_R@v8EeycGApCY|IACSBY7= zIWi*Qf{K}(&Klsk#21|1sBYa!%yXRMXoxU`<*4O_*D;E#a@?&hWGKR$xtVo_m}+F$ z=JSQva9MHS>8Lj|1-1_Jo6W?Dgfldm40kPaFBd4X<5mVN6LXkdTJtw6O*zfNVh=ep za|2FNZzgkrnlmosd2?-`?oMsOoNcB`XqaKdE-i+z(S~h?WGOjyyT#x$d5|*#=*TsB zlJK)#yM(KGkZ90GD~f1aAnfE8CZ|P_gl&sOB1%dyu3ba|AX1~Mbh^&7tpdS7kcuuy zGgh1iY!eP?Y9~cP=TONcrIcq%Nl303kSY?a3k5_&@PBpobF60F?&D4V{vv$5>UW(l z&DtIf>+yJ#&@@9pX}@^*(;oDpRdm2p-1Ezn&0$*$#84P;1OZB5=?;hpS!S;l2bEf#8&H9vt{*-`|1+2 z34Ct%g1yQNjrp#-%7eKnImaG+F7PgsZo24Df|I*VVP6t(nNHB#8YcDQEcbwfXx|kp zMGNVhzI)HjhB1X5|qvSmVB`9ogG-`i}^gU|=W83LbLPS2x|?5Jzq-ErDXq`6nvcGed*k*_ z`qrp)pNU#}{yNseS4VyF`xkfHZ|kggu98jim_RfI#L4-y~ARt8M=RMA5b$Gi~ z_{oA%rd4H9ndsfdjUG7oK{;C6sUf5VU|t+-hT0v-0&u2R1D+-D3=Z4=odpjt4L^m{AXPLhv!fkkvoMw;?i%vHtkrdaBJ;u7<}UR zL%^N)Jt|mF1mWU50p;Ip^4B+(>&)_Hdpbu@(vngn1c!WG;_!fQB4@>*8^xdm+O&w8 zAtCN92@-_}bDi$G;GAV1xwl1eWm%Jqfzxd+0BD4b`CEYr)$X?f5S#@!rsx*wx+d># zi8^F0r}K-3H(|4Fe9!PWQUpAqks}xCIb^^t1?X7Jz7x)uAP;NiA9gzd5~gyxZ3G z)gg+)Nx>jya5vR;{dxTLt>$Sc6CyM3ou?clMG!3tSxIUvM-BWV$skS;?WgF2r{ZFu zf|Ml)C3;hoR-CV)K;8v~YgRhH8Mn`Qy6wT8BtZPI#CX@&KE3X$sh8a9*!agxn)&C` zihF8RPR8wSx0d_uV@_dfzPn#_PqL(Ee%>|o=cWDiYQfpXTt8oLGo<`V)7K8QzY@AT z@0ZKFlpSSk!PdSy7kwgcbdQ$D*dv&}O5o^z9!85@7kiY<`!ztr7NzXbcUm|e`EPu~ zXo0%(>da?PeJO2}FY8>A1@lMB$@22^Rjb@|=!q;VkdE4_ZSHl|JnFzWx4iKJ7bzq= zVJpj-Bp}*NmM%sVYyc4}81TACG(0xj^;>$20y$wfGjxGj1BYRJ+5z!}KzZ&-CpN(A z&a;URpEJDzbiplwZIA^mvI_|^-g9}*yAJ!^$Ur;Zx#t2EBs{%kKzU?L`zYE!bAemArVTP2DMZ`4|&vd zMJl|Z^+IlaYt=qbk}H#Du;BLQ05PT@018ePek#}4E6isJ;5xSFyx|MLTr{qD0a&6# z%Nse>lfF2a06W_Yr%p`Sh0f4|CT$?~$=6&Cx+xC%xd>K3?91MCcc3C1*kvvqQI<)0 zhC_6)0-bMs+sQa}rgXw-Te-hB1mn%~2tsAc*N+1@mv)eqBph=HUbdUg5QSiLZu1Ua zd%#PQ%&!bS3bEW;M~A()M76na0S}~%4|riy1I(bn0-0=k)E-q=fVP0d`LLAhcdkGt z8JHWGU>9#l61?9s6)z1w15~XD?S#tpNwLoybjEqrI&r?Rfvkk026fivh8bWSZ*(Ew zC>F`zQLqWI;ljz^c;^vhj}60kKBdXC;MQu05$}1xyahi`b_Mhp`?>8QD0{>4!~B&Y zTGEDGpw#B7Ar?esWEUvJ3X~ODXsTGsivemYY>N`o+E;jd`QPHtz4f`l=QpG??Z>m< zX6hYv%*uQLfQlrRq|i$Kd)16h%a?Q=yQ-Ffno>lGocs?1q>9BxL|JKNmce8%d%w{B zWSju~rV#2trGyP77=Ke7Ea?8`?fb&^LGE*=ggGg2u=xO<`h55D_7mzG`r4MosEt)b z&YZ-^s#LX^9Q?0mIDXvknGaJE_I4zPf=VEWKtAMEDq2{SX_)nviNVP|+nLQ=WXRMs zEQqJ>^Naf*o^l5alqvnaX}w!Y2k;M)5^{a-`d>a@%UoY4NKTIKPIPhxreYl;sE~p{TzR#p~{cd+W*uqXbFx3POUR z`6|Ow#i&}nnBf#$^trZFRmF_Ngisa=MI`)8p3dxt_eFnF^3CcNZ{pAI;u81vpF&CA zPk^7H`>zJoHnUMGqEihCK^aLQYff2-Ybyl9Hk^>OtT<{xY(`#Mg1>zSkF zw*GhL=-9{N82hwDsS|3XmI>CRx%Ipo0Saj&5u{k!LMloK(LVltYxgyHdAIcnUw)j^ zu7Tm5Ci}^U!cTz+A5HT9{GvP`A^iQ7DU~eID~iHaC8celR-)8pQAzptzkK(+zsb>G zm#4+*`nx?}kr*o~Un)-n!NXjOG$|KNlc3rO zHcLy9TcB1AEUQVhKxC}KH5Q68Wd3&NP^7XfmYkI@t(GKc&?2biGPx8K9_|z_swP`l ztg&v^#EL1&AmmrN2080UvZRs|bIG`53U!IVs!G-sP#B6uB9uJroQL=C?gq^I8ZgQA z59u{5tULMMbI!UTe@-7@K>6(Y1AcL${c?=DRlpYApJE2trE*E42~Z}XQOsR zRd!s0NsdlM${E7uYr5p_El}{uM5rx7iS~iyA<1MD=o(Xf3LBuA{j)k4P)YI+KJ3U7 z^)Hj;kU8st`}xWH_>|L963PtP8Yw1iRkcv7YZ|?G^Qw6N4~;K7-O%uId6m+xmq~X; z6D83yq{D8mr2>-6ASGmil$5$^Rw=qx>?@#`+MLZQ(xlSUlCMC7bayaw%RuuystT@% zbC)2BnOB%-uC%OC+*~Nal?=?4ub*;g&$I9p`TFn=zdE{Ta-Y2J8Hfwdq>%1=-v3|U z3w|6#XYe$orD%xF3`!{NQWRtz4pO3B-A8EY8J8V{bQA9L^VjcBXV2cAkRkY!lGdQ8 zsZ!ciM%z^^Ri^i|V4NwJWd#LRD2krso_%`rNxyz)pueg8OE1|V9`*D-ksm$ZfSn(? zXq9NyQI#ucLZ?Lzl_{oGk%Cw4{r()Ezc(+JzT15|u3x1C=SxUX5)_OIGx_Z4TB)We zmraM+1<}r6sxd{#(SnJTsb?S?Pu|K;p4rTMeDwGEAByG4o5J(HZvLTu2`Fz}4F~IF zo28RCb38P_H-;IyP{WPONby}wIm0<^(83o2 zgQnmYhclK+T;vImw=X%#46&5UL(r)KU^x^-)1l{5gPt@)G65Q;PsGIH8FsiF!-2W5 z)Y9d*cXXgcfrt=LhcXt`hNl@h&Sb$S3&!2jvKL2k>A3?pT4WAWIkyT;=Ga*EL?t)j zMUmke9!e+SRT@5Sr8+G}j%Ko^B;wSqHgeq*mv@>;oCr@NWz-Zd5fqT9QIl*7F_sl^ ziKxY_+DA--rgV0@BXbcHxsB7fbtb8WX*8}W)tOd7(Gto^u^A|$w5q9Ms*;N&g_k)f z8B$fmP;G{>7X3dGb&u~eq}$IrY5gk#hv;6pq#?Z=I`6m6&VcOhQ02s(ya_%_CG(xv znZ7~Mx#P%9NJIejK>+K)7G*Gi6fZgvLqaH^dW;TYbPqc7K;7PUXS2?Uo>(~lg!KR} z-Tp%y^&{Vl=qv4mT~oJbGrOuD=5U;`W*^4h@<`sfeNVV{^|bew-5Pw44*C*r=XI}s zyCrBC$)QsTx^l1Fy9!?tJHFAiaN$EO?)|)YI;pkvj;-PkakpFFWr27!o5PrvbTE72 zh0tyfn3=hNu5x_}`5r%gHQgPuC*OT|4u!&{-)rMBcet7#4B@$@-_GjC#X8-4Ha+{} zB?)G^{UeL+;!D2cxtK0l&D2eO&bI5+%lo#kOg~hks*~8v=RV5PbLfNzKKb4z!GCDQ zX9m%1*UwtCKKMtPeVd)$dt|+-buY9oe_S_eh4YkMwT+m6Lfcn$QhmxQUiS6HnFn{)sb;o<8F%PoYX zE8Q#*D@9PL=Yw=008`xdz1nK%(p}@~Dzn(0a}IjLgq*78x@U-Y+fN6x!0!2j=Q#=F z2rvc^7!C&+#vK;No|lUWGgybsyf_|#PRu6}?H;7Pk6_LSiUx8P?q(Mm=EdU|s79#8 zL`aZTvqT6cUt}c+`Xb>^03(gVr0{f|(cXOX8;1o1LshEu65_bEiy?S4@3oUoBh(H| zcGAtvZR*=>wOS}?N^Y+L9vQsOQq9fUW>u$Sh745{dW0#(b=9R2t70ryypydQ!fOXd zq6QW`8Z$;;&YHX#hDX3hhV_dR!d^m?QDsK=nC4`~m_vXRm?m(w)^3eYj#m0*GPE>G zau{yf+eH&3(Sg{2=S{dnf(f2WTWRvz=tBCDc25U{SgRI#jVb9$Lj<7c^klt!u4Vug z6pE^_HD1+_yvp8&zNsY?Sc_mH-T=!LN)-^034@d(HT8PolCG~(hw7?2sXdI&bL_1rK8QgdP2Br_`#tns zvX{$M8T^~YZoO~!>|+dFca56F+RFo^?d$n z>cGQwo^P<$T;@p2Z!-wu+EqET=O)9P^6F}+WH)|kQ;4XFr)gCf#|Del!NSB@H>=kC z=-543xmwv+an69LMw|#ZmmzSHy-7OXMI$J&jg#O(A{JaJV{9)JJTcP}+;EnVX%+Oj zZ%=(3+svZZh~^6vZGuDYb67l(O%nS7Z&oxWI zn+*sW4ODFyQGQ89Jbt zR4q3bkny8OZ4X*P!5HI2djs;)q44IoJ?XryF)=NrYbCW{9MaCL@6NkdpnFcUNl7I!JV}R8+)}i$$G(EbohP^J!P*PiMWJ0|V7aQ44i-NlQy^n?YN2 zw33o0L4L%V(#2BL!!b^ejZ+6Es#iT|A-3lV2Rm~)6s@C5%Bs^a5A)#+G41$a_X+gO z>tWRPK%M*hz{9?eWI4%n_L&c`d>La^B&xwEgBGc26{uxc+P?ojrR$lAHSeBWJ^uTI zLkZS)@%tz2(pBB4vRN#f2CwH$Q$tZKqhgc8cIPN^XKsD7bEBsx!acHO zm}W7Itad)S!n(*gS{Y`UswO2QY4C75f(Fe61d2s2#N#_YL<$X7Zf&;aw6MWQqiSBvdDAy!1$im zoXfu)O?k=aH>2bC)EGF(VPDoosi8``cTrCWqioSv6I|Lz#ey<;7|jpnBm?JoVh^JR zmP$H@Iw^s|_Cf~^bF<`01n~Rwp`tSC9XOO_YL*%iJM#7Q`+a%w=(_8l8NE}d`k!WX z)_Qz7(bv*aNQpm`e$}d4k_7d;GODh^NwnZB{yu4t$ahM3&)Gk(^qy>_Pn}b|p^5WT z^Vh_6KQ*UA=U;(mWU`PsdE+)TZHeb(gU$s~u-fC37r ziixDHs4`nvinAmEgFz*wznM&gk|CHpWvI5?+ir9Oxy@UajPAR;aM+}*?&1j^>k)>xby+%1wcR`e`PI_c`lIH0eG_L*eA$AKyFXKK=uMuwo)Aq6+!q ze6;Jkw{lm%UDNvY`{MemdrYD*R#MW+sV$f(Qku!NlB!=fL=r>B<7Z{tweEZM6bJk7?*UFNVWrnotLIaG z{?Fd)koWB-zWsCMQ|S{CkG*DVTW(m|tG3*#H6v@b3n3=2ZTI=}*gn4Adfa>I>F!nO z3a4vYId$Xq8!9E)y0UCV9n1p-e)CL$xx<5cdX432%g(_liti$-O~UrUA(+`oRA9LDVst~FyzQ%4rLYG=91ma zcH_flq}FEc0lMK#g}~PV!pPim6_VOxyKUt%^KwI(%PnqZP}I$Cp)WRIyh*HiVIAFc zo6W~<4CX=RvjJtar#Av~X}qMS>r_ezmJI|7v^KC-nO3xuS%rZdIbxXrk;JWR;G0>p zB{Jz0%qdeiWTB;9S}25VLxh#cxu}^2igGq_Lxn6dLJF(4(M0NWDVCp~G3opc?|&8# zhVSM_UhzIe3hP>1SWpxg6Yr#>oC zeEL|K(M9S@cF{EcbG6+^+dJ&hdw{=}E@er$s*KGA1pd({*T5T<%RaS1?GbgxeR&RQ z$M&r}xEy`D=vGptJB-Sfc-B1nbw;jo6GeRaI_m0feFN3?xAxv{&!q`bquBC&-)$c4 z8VuDlq$2YF7~mkc%bDLk_KnR;?PY2(wrh~lJ5v@(gki&3HRz>?TvHwb(sn9V=Jx$cRm#7)`*+$_ zCQ?;@V%ydAJY0U3zRvFJKV~=fO@^qyn@gqrw=?G9thThWH16c-+Pb%M7E#Ht@oi;o zj{3ga*z4=NR|vzFs-47Y1cklg$9yPm{B(+`KD7kDf_URT77sk}dsrXGJ9gN7I}PO@ zd}{W(eCjxRyoLRoG87wbwRBNtXUREdq?_|`bhUBk+sxtTa0p0-!Fo^_&U~jKGL%zN1Hs9vSFtVPg{K0*% zS&1?6CMo5LURVxz^>pt&OkL9!^0QvxmGnE0({PGacDu#O_F$o?mc)|m(3eRI4sFpA zEE%j@<|@^UqcUjg#%23$bzgLPK%%>o9?h2rfFr=&tVs=IzHeNQeYr>TGHVW@NuRd(qjTehBsykDF4@H@rE+!KI2U861Q*E1=m z9nnsvO;J@|s<8b34ms{DdIa~q!)QIChI>m-XY@F_i)TD z!78)wW4u#?($-^{t`CM}oGy5L8?e?`ELbc~0Ea^{T@?^{w&o`!bWvU9%*-%cw%U%6 zh`>e>mMw&`zYbfL=Xg1FZ6SNPt=!z+EtrY4ZN*80qs4hfj@<3HcLYsVVBpw}6vSFN zX_Vi7JDbCuVRUz~<3^W@dAc`C5i_fA%)+%@TJ*LrLqkJ*cx1q$`c%p-S}Ax@CB021 zT>=a7NQ=L>x4_@)@Mh2(-kg-_p%p3?hdGg<$cI?vJzb7FDAe8Cmv-B$j+i;Rl#P8o zO=GZv7%r&aQu~q0X&`7pnRujcj0&(`4542SxVD$cZR~aSE;3sC4_9@cvm5&+!VCGd zy1vVK5_oTJ>pk+`d^a-TiWaDx$CPqvJX=V<6XWxFyOp10jyn6QC66#Xt+PdFHKuYy zz8<@dFS{Mx{m6!7(_sAHm6))7Tf6M$nkPO0ox5%AuIXqmv;Zs(Mf?^;4a850434c+ zg}9>idDRVgqb;gc*|5z|1sbs9Raq5RK|9JPb3;Bb>EH;X#dp>9U8X{Z=7}VdNEm#z zd=gEu8Y15r39^G}1BpV*0Q@<>3$^6XVES(2i#FQa_-;_ULf%_&GGVwLW*g>k6f*6& z3JMJAt}*T0=1N;$Ta8=BcXMBg)g9Y%?^eD#<5A|D)l4Gwotao396qcK?~kq=ZKUq1 zojDruY?@_L@^Ylpb>t_^DJR=<&LzYl6R6~rr4viUqVDF&2H-UJVWiK5-ILpZ$|+ENA*B;Y4T0e=<>10}SS8Zt&Gu_-dKwkV5V9$$og z_vc@}{I}PYSJksEW;V33?W@~ex$(k!ZHEk|!qfUtnTNgp0Y3V7$e#S{A(#YV*W5RU znP=eWgb;!%q(E5(IW(cyR!sc}u{n^* z1LO<6$t?SnJmE?De(UUqf+&crnE?U_l0=W^j{N)k?+?$nd0wr4YwtmjXhUOH*Y97K z?fs+5T>vSh-_jXsaTM=M1Kw?(IrsVb;qU5TiAH3Iln*|?p8b7$Qu!>=J|EHdvHsJum>z!yF%VT)u~sZwSdA4% zjf!L&GL51vf{4Uo{PF9~I$PLpeswsT;o7k&Mp+dM!kLmO@ha^pBMieR-`95v8ltTl z+BJ)7NEJn+Q5M44R>;_^Wm9C@R@F;tt7~N0N;4&fnzUA$s&%NXpxUZVw1-%t$q538 zC@BEtJpBnUXWqXY>)qkKe%^qf$ov*8cB@;63VkB1l8wSfa2+jAE!rI|hfpZ~*f` z^X>uB*AJodc|1+qnR3IQd_Q5_@;{LgA|z1+Sfq}5_3FEY=_xGl442P`OhFb!BQlhe z<(wJfQ2julFa~qoug^!DUcObxNo65|M1mm11crG1>z=-Te11OveS4C&OXq16r6idG zi(vN{-mo|b>D2kS2TzzC8<`G?4!dwV>ot=;k;5{-cfOC2ipYw@SdlpPdiUoz=VzLD zNFbBj5LFRIK^c@oaPc%hLxjig%+H+=GGW%XGccKwn3I@kkSmb`a}w@_xXyEPgm^s4oTXe6j1!ldw54p;KyJAQ zn^kfP3OubQHPYFe%}F)|b2-80T;VsHoM2R#!2yd*<_4)57?tMGj{|nQCk<%{L^y`C zoC;0b1v7I46Glgr+;QQg$;LJrv?*+y+nDC)26Dn{DnU6*%go7Ixj4mnml_mNcgX#lI^|SgWiX)1^ zDGu=0=>Qo*^2WaaurLq2ZdqBmy|v^o!^~HDA`G?ke0Z;(?^`MF)m2qhRYfiA-&en( z;dj915j+$jZL#lXfbhvru!$F>uWOU3IGO!vQL-KAKAU# z&1Y*?ckOzs<9}~vB8>Z&U(LtD_mH%!+n9-($*uWIg+5|ZHO~pn*~=PTQv zM}Iw11z1=WZ;rKH^bqO-b2Alq<=_jusw45`CJy*8^XH!|w;RI0wdGdeFT zMpL6rHoZg=MSH_N;0OR9B!odA!I1Roym!@k&v%Di=eTM{J=0^T^|}sUdR3n-N(+?$ zvOy-wq=+Fl8LnPt9JDvKv$q&DiPo<;}MiQ`MCKjBW8{n!DKH2(Lh4I1ogNr zR9PpeUT_7?8#>Ip-wVO&JKuK$Vk)ArfWcxy&8$|99XfPn;JD>+Ow~e)iJ^ho3(e1& zb9YV|SK2+ubtUX$!QpjNMC#?yH+I!$M2R&PP6?{YD!U+QopXTZ5Xv_iTfm0OrV6N0 z4G|ctpl@Ap8gBk=)1sP+W)10jqMg9#uR~&pk7X&a9^%dhnGr~7D0SZVipMaW zDygCjAo&Ic`@%wOgMz~r2`^lTtD3BxgR1=X@!oa*5dcQ>vg z#tO_inOj0V$u|-)xZ{VWknb;Euy}cn2D=c=H69~DE{d^A;M!5@X!Us19%VU_xqOGi zhn8WaNhJFz1gL7Kcj(y~m1-4_=ks;L1y-qNH4^z^CUpExI&PygRTr2uXXZDou;GB8GhPKHTMdbLj8qs!M#0eVl0vIzIdFj!wmoBEV;vt*{D?QUpPq?r_uYsk?|q9S_Sq?MsnSGAA? zDJBa6G#ob*f+Viw0=&q-BCPpT3R0@|c~Nablc4=5wuN~B)h`+p;#2|!tI>L!H0B$W zWzEdPDz4@l3DZY5QkLnqaNb-LG2At;4m`}x4(XIAu0q#A?&n21k>DV033~YCmY;hV zDKRkEAONHA@;EmRaI6jSc)oj5b*nda8HoK0R5l_!gGh$ zws!Q+9T5HRl6;;bqY+R@ixp!OQ5W~l`u%-8e;)VO&a|87UkFY6gD_J@x6=LArSJ1v zy7hire%@)~PY5LE%LCRs-B;JYo{EuBRK-OTD1s>7{d(`8ua~dh^IpFHD_ibVmf1?a zZP3zaN=QhcvP41h&)sY@GcBG?o%nT->u=uw212KmpSR;D;Mrv_EBE)|V<52=Q+L0< zo7#KVGlBQ7e7kw@_#Fs+lvW7Ehs0t-@(0W=g^s&GbW75kiVl0 zB5#z=V^hE1Psi)_eo;|X7>I6l_k8X5=Z)W=4#Vhz#YD;GPNXci!R#=(N`0`hMEPJs zhtT`f_b0pNd)LG0s)(2*Ac%z62#qr`s3;v?c;5Sd6y$wD`{Sw0=_EY*nvn*CO-9=M zo9pj(HT%CV-8bIJ)!EtWUGow4XVBJ+!{B z+g~rRpu!5@Q+2E7SJc0k4jlG!KbzO$*$({qe62G&_I!#l0YwoMT+^R>{rfjRVRZOC zKNyF>1}f72Q6yp!B7416;=As;_@9^|)Br4^bFInI6MuEtp6{P8km2l~qzC{B2Dj() z@87HW>(A}(`u*=6*PpBRP}Hek$P&p(rjgnlA?g+fS#nrprib7l~9*M9Onj<{Va%(SU}IYjzI1GV<6FIGn}2 z6N-gH5jM*3tqV50iEbO5%chr@UUE&t4L5ggW>RkC-8XY}Om>z@ETUQqRE<&%sTE?I z2{5oojS?a{bkzfr%~q0W3o{hOB2iTo!&F6TY@)VhV%Bpd0^vbPNeK-lLt-atD@7Qy zB0KPVgD1`Osk0_Co(D{aEP=;!xw}X1=eYZJ9l$92!`)R^-~@!5Jw$Sp&ToStQVCVa z)^T0O-Vl0KPTjC?oP0m!UZ@3L&Aj%b};YG$$wfJ=nD3AC_C4@ zkrQ>U-n*>gyXF_N!pYI0bUJ1g()YL;Tuf%VmFuM`y{+W6{TAO)LoZ2RZ`~x7y*=Cu zy&m~sc0u?SyX>i&Wtw;Luyp&{6hBXi9dn_)v_6Xp`EljHU)D9%r#I*>EpO@f!|EhO zTDOfQA5%wiy-RE{LERpA_tOJ=w*ExXi_w*w(g3Rh*3H9JNphIs7`3T-TMYiv}DQM^=YrME5Ebs z%+TI_DBU~gq>;JuyeaF<6I?g9^ryd1t9S3R?Yidnw3lk7W&+*V`P2}L4{Bl5c&YE%8mVB@2*YJcZm`Bst7iAsz-^Qp9tG;G~KCrCu zkqjGWRdQXQNXYveMMVoJ+?~`0Bmp^Fe_dDKEuSEH0OAwPX$Xc#53Ms;a`l%lI_U4C zoIrh8a}D9)BckH? zW_UG}Q?QHogJ9gEQ6%j-Q>__wcWHuj5=lW-SE{}fqMACal~q+?+jiy5I1#LRDn1xy zDqK|A6SK0a&pGBfm?wohAeA3&wzJWcMfalSCLI&4Ui|NLxtmW7Cv6&0v}bS&V)(^G zGD#7W%^M6EGgiUx-WhWz2TdUA%)VP*2w;UB@19pOCs;KTp}~@j=mji+bL5PJx~t_vZ7s1oz+#2CSnR!j{@mOBSt^ zqdw+&-!_+rIitC)-Kf%nsnay*CJayqN>ZR`CWe!@cb10*$3*u|nb}M=J|z|{EeIj> zJF{4-izmx=g(L^uOWHZr*_f4`$Db8JbVcS)4FjEZjqG0+N9A^s`TX01F@2`E=X6p? z+CLdO>V|1gpJ<8JREqX(UiH;%nK~pPZcw)N$IAP01=xP|Wvt_tP4%rm9J!xX7EOus zHS-y-*=1qS?({9)`=0z4!sGdk)&j7;4Wk;kJ6fPSmgu4*!%+b|i3S3Rvl{t2p0hpj z9T9|Bw+}v{Rbii>y$ND4_LDGO`m@dTjM_s@Qb4!ob}sh9CF6KO6jF5xCli}2>$z5N5Rb$rSf^d7xF}R&wG;=M{NqCd1NMsmwWVkRao+k04!$AOn0C77u2T-Ot;}Dus zWx$ZSwbv?B%vQ?xp{=aZ212mxUXe4e8^DFsc4sJVXf{GV#1ODiA+?PUR#}2idEkzt zV!bg`bmBnLlg@<%88w^sUmbbo*5@wVK0hy8J{WH$NYGkIy6Bym~`FZ&?)3M`RWAZiMU5F1|_Cd?GfmMax9XwZXZr{`YOr`tC>23bB^ z!!VhoohM8rID82e%X+fy^VNIG6$T-QW;b8Ao;~L#dcGbAL_z{WAfE+bQXsKvYa@Ru z+FPGJ{w=Hw_yyog@X61~CFXtlJnr~g&%KJqC`d?+D3Ti@Prt5t{qEN9JNe7a;oy=) zNP-B6fS)QYl0suC8)GCC_e=G>2|jdrcQ&JFUrJZgqZmzkWPfS$43M)88U$V8_jljt z&);|6`h53Qzhz{tGJLl&AuVFXq*6Y~O9&fqJxWf}o?Gn~veOew@1A)8+uWJpdMF|& zvN0A4un#fe6emIa3>&26HyuG1T5tYYHu8 zG`(@watOkm2aVpih3Y*gjAAfb$BTDGn)7L|F7k%L@Vs>krtaekf}6uJO~zTAyUCfX zfMwgs%5w_l2OLf2r=QPJ?lHJR+&TQmh={cBl zLz$~LK~Xb!-OfCY;N%NLV{r?EcPMg(xJQo7Dkg5)Of*heOqAjchc23m?6Scs6Pr4%6|%B52RsYRtz zC{>yT(>1AUMAMQ%iWG(cWv5wm;*^}Z&R{}ln#v7SP|~o-EZS96no*@tl+uX^(;^rb zYGzVjt5TP|9D2b)&U?;IqIz`>`H!TYST~&H2ypHlS4wxNKNSVla=#(r?*P5E=-~{G^t*`5uAgoq@hNI<=f~&M z67Qax`>Ts&m&w->Un3l-s#3bgZ(RBwud?$V=3{HVOdp8MvUcc7v!6c86*e09eX;#+ zLW=AUIs7QUf|W$ty{&4lD!6s&!+D=nfo%dF@!WM@cCV_&q*GZWX^fGPMgm2F=Y74` zzVog*=biEIdfRzdA%?2EbTJ{g7N1cm070Y>M;e4CBNGGEs`hoUs6o85UuZjb*wNYU z2<)k7ZD7@#tHXe?$&BQ4WPKBN(*l6`d*O@2&OzTf&TYM50gy&i&D{Dqo0h<^Bt2-fJ9s~tH43xPl552v{OcrB?V&yQ7Ke}mdeU0 zB2AQ{#eq?z#S(_~KTlr2F5}g=<+UoNt44VwqE68mF^*t}`1Nf}RtllrThxa@p&aXb zxs3Q+1sf#;K9bdfuBz(z7&qRYMEgM^orz6>DNju=&h5Tp{BqmF!W+I8(mst7P894+ zf#<&bGc)FT+u1uMhiZr+V1`A08m%;+K5Xwj^PBHpe7x_gm|ok*wk#km=xDIP?|KL* z1LO=ZO}Ud*@84Xx;RwzS`Os7@`nxetEpJC)9e2e`+1T%XW0|22;qCctWbj}LvtTEQ ztLLT1cLZeV*4iRl<++(+qGEFv<8^z1l3>M95wdV(h{@oP(UKnb^Q&^0L0-fJRb#f- zv|JGiHE`bdlZ|(7(o-n#-uZ4H1|Av`78%D69ptsEFsH)uw%mDIaKY;a^*5n=Wydr! z2@Avrk;$K5RAf#$`H}T}^FCS9Kda}{67Qax`>Ts&m&w->Un3l-s&=7w95t%u_uW=+ z=;PSit;_o~SJWHVnTLvo@pGATRE_|-qSG=Ee9lQ6@3*oq~ zMqK%Q)$!CfZoZrKpP0V5p5*r~s6C5)qQDsr17213m4{mKFro+~yjo%LB89g~KRAx1 z@ppDFwO}}Kk);#QU&orww)6Q5Kl-%qlb;{Akz0tery-)Q zCuYymKw5y%%dtrVjiGkw-1CP@J$a~U(e)5wELJg8MNv>ufWeGnPOn?b?>*|9w-2oJ z=ScWrGR3ymWXw$Z>cAw7!dfd#*fd&u-@ng0^nqa$S%-q8cQ0* zq9WQT6cK`iP*Nxgj2!dl&zshs6!zY}di=kAe$=&B$cccMk(N)MXMa2#Is`s-K&kVG zo&3PQ+#qvF(m}4>5_~P&>~G_$2$4(@g%_ykUjYh&_sg81uYtqqgb?S2oPWh9dvJS z@9oQnoq_NqJrXFfVycWl`}Y$cDM*aUlez_)0?qJPI{LqT-#q#G-^AFlg>PT-y zoot}&log(N`)_th<~{FI&gGBo{C7DIpM(_|6=0$$g0Fe=@4fXtXSkVr`Lp2zexfLf z3JDE8p?P6Ry`K#Y1Ym>JC83x0^k>!c8H1QqFLxAmSz8f_r{-8Nl4LaC5F`l^${tRI z3TD~@8Lk*MuQI8Eu9=b}kYQ45FvD^#Ms0TlV7S8!3{0DuxwxCW<9W!dIP-3bL0}G- zj%B>JnQ_txZ3&sk^OhV-%d?c)JA%z~ORAiM5-}zr3gK6Gapt+qXxK4BF;Q<;O>(fbNYPi3?Pq=tm-x4#`tO z!YKm9p%%?ffi0&)F*X&7NW~6{Av8k4rKE^rgr-TDoZ)C`tu(6?f`Y?NVWi6}$dn9B zDqHlyv9Yj!pvD7jzBRtlnru>RnA$9A3X}>ejA(*1S~VuYqiuq$Vu}V9l9ObSDm8^9 z))PUg7(x>;$uXeTiLq>2Ln(_HtyyVhV?r`PMGcLkS*o!UVuHx9(%3YTmMAEUn5fD$ z$%{5nl4&+AL6SBti&3d;Y*@lciiKkpi$zAZHm!)Z(HJPjv1o{j%2Ghh2AY*7k)}gw zG6qDV(V)gjVU%fTHlmrcY$at9jiwoDQ%xI6ixMVmrKuYks%aZ!nl&~iDk_Wwp#==E zX*OVLjkIfNm5mcoY^8+=u@=fr6dH(9CJk&vOw%JKre?+vsEcCDG@6T1QpU-RlF6vn z5fo9ROlldWGQulODS}zDjbNiDl*WxABvB%oiGpl~mY60>Q4uM$ES9pvR!b5oLTNEY zq5>_1w6!9dsIoINNR5gL0VHIKM3hY$QEb_%Ni$8FSw)#i2s0GMWXm*#6Jj8yh>=M# zNkF7SCZk3)QDj?1vR0Ia!9yh_BxVUqNu)9rv=$;uWu+{LVWLs0OqOZ3p&10S8yPZ6 zgHWv*O=T=;G^L3oWSUY5F+~x4(*7M$7*to4cP{Ch7u9A*S$+f!L@igu3`fRyd{(XcJmhiW^b%UD6V!A zesE~cR5uMleXQ#}dNF1`xvR2Ypfb=FXF)2u^qM#C19Z=O-C&A!aaSs(qXvYdZ8i?( z=$++|^BO8|2SM|{XIzNm>)$iR)q_Y@P$)b*R2Fr;5#r+GqUjB(UDoMio0%t%44{%Y z^Es1Zfh(%5Rh}Tp%{=Qn(0KP zEm>J{^h2#-MO8iU_Eaq%h4KPic5ul+SaQCQCK2)6VHU3CZDGotEZg6nkyelwmY;Eg4l?~#hh1KPP@|Bu>)^8T)E+cZ$+C{`j#gXtPe4RHlSL6+yg}4L5Je!7qq(#0@GvsYk+G{kTv7P70K8s}z(Yq<=q3){T&8kw@R zDjKLd4M`w~B*wTbJFKHcRdo#4x!7UbCJ>vLCBpWwfCdPjHd~Yvwwf7Lk9jFP)6T^* z<&#!kr+fuwP=R)16Wi0;?*yk|HOs{AZOzG{a+q!koX1NRsxa)~C?RaPFglFLnlt zHC5+c3m%K2cJaI&x_lw>)tikJKu6d@IBbB39PxzAYuU$5giwYLCscD5aNlPyYhLw& zJ!Cz+(UO8Z7=Vr7x~w+?HYz}StD@7Hl=q)zfG-Nd11$Ie$N}49*q6P+JgKg)Dl@vz zH{(17?=j?6EG*c0Q?WOT7)t!f$GKGu1Rm2*-om8ol-C8q8?6|kdhGQJPbc+m)`qDl znySf=og-s@?%mF-aGLJn#ww7B&E~VTaeI^3Y$ITKbyUX;3`*}&G&PTA+YsQtaNHL( z%?CKy$OnV*ST2t0o}q#p?rA{ot*(o5m4nkFqWD zRC-&{GuOe0(X3Bc>5m*kj?D6O%!VwRpt;Wvb5YjjL~hC11nUEul~xS&eJgZR8w=cq z>UiGHtrm(Lc)Lv51(9OqferZOBsh>|-ty`{l*#Nw&|oGxT_r+0bW68xoKMiC~&+{-UFi-NWpqWU`%G~Ib|&gXby zyiZMg##mdm9u1+CfJeiRhqQsj2uG?;&?kv6c6+u1fkIc*F4B9~p8EB&*5wZ!4+b6p zRmbJ&fbqkQ-=6oESR*@`1a9o^YQwKCuQJu~IoU^FG(@XJXM-M3SGYW|6`=S_^^={8 zNyIJH_Pmv3Kn>E@GVe9vcNLC1x^UuTTo11OK%*tz47M}4DGp-s!8(TB*LPDqBrJ7v z$aG9M9%U8`-6>n9`&i8afjOzjuboxz9CQ-B_1**|D{-nh?X9(zkUXpoMmM*dIgFH~7<(p~BBAMvG`w9# zuvX*4WUf~DS-!n4>Qk*j1I3SC)DVH_grX5R2WxiKxOsY=2fM(pTwd_-5Rx<9T*Vih zUjr|zTPUvVb=m1&z_%~7XxsO^Pk_qG;V$ST`B z*5pGm)?XAW3&9o~3&5qjw`^q)BoK$C0JES&n-!+|P0hB1y{FMph6`*0P22hreEE;GVW7w))1Io7YQEBlhv6!+z zGq&{%RP(Mj+`2&OC#*bE(WbD(=SB5T~~ZzOwAHjSX6a0GyWq4K!btx^$TROeP?-folYw^8pQR)~QC zNYc`@O}bBDl9Z8f81&lqsm#+?tN7iqyiItAm zMQJUbgvOq5)spX$J5n0Vy>(Pu+x9OWptuw$ZiV9R4n4u0VnGYVJ$Moz9EgtnB@(sS|&9(O4E6JXpwdT{e zPD`q#Me`w_ZBZ0UU2R{G3+=>Rcc`?$DxjruaE#c74~01ov4jQ38H+7U;R}uizX7hI zfu`>FJ8Nu$>N^j=+kj8n6E?CaYPP$E(JPr&=KwPVJ^~+sP{-{n$xs&6YR!vj8ud41 zZRvW_PHD6knfH}Kt5ILsRqe)v*E(L2u;Suj&^xU0!y_=?8HQtp%Xm3}4TK$M`WmJs(1@#*gjtF53hk`*1p9*pM}P_Hh9L( zH-auA@9$-t8(hu@DG@$yGU(6(K9P3;fmvZoiurPEua$A$8=y(@j0zzrSx9ODf-pg|CVyX-2aI4{mgB40J8`UeqI&A z+@BS)0IFep@~h*G7Fs`h^D9r-Xob%Layr_6CV0ZL%@Uaa_yBx_KztD|`;+gdDgYty z9~pf1e@(M|%2JBW{xeGC{}_SSOa4>(C;d#x0n0#qlEnwe!fWQk z+yAqK|Nqqo03i?{w^VEJGyNa>|K@TG%>cE0_+IDWS@^Q>ivEiTH8l-{4fyb<$b}6p z3@v8(YK4ImX8$$-KnTP$XW^T}v+(_6=dUV!EkIVRt(FkTm-X)<$-+zFNBNhz_|w01 zkmK70{L}~_G$8*u^#54?Q~ZDESH&-z2!XSNz+bhpcsu{+^nWLWctf>J{-^W!mVWl- zr)_e}Qa`QFt^MclQwM&;g$<~Nf9d^?D!!awJ^hc$Uw6)bO8=GlDTbH&DJa(VtN!Oz z!D|Hq00e)lnj!v{(L}DFUtc2+u5Pd1{T8)51i!_8`gA;`9x?3{?j>=nURn|IQMNj~ z;)VTGQzO7RR(jn4qDX{s3zzd-pYoKNihU7%3$r@!+D6LPQUk-`NH`Yugq9BP7Ew%e zQ4g@*YeEEBBkMk4vF&p!xEa}}*Mx{MdBYfpx`=c|&2WiZn&-7#&pFJRQ|=|B0j5AV z1G_{&L+-lt)J8hIHrDW%6z2QRuMFbnZ4dMXsIGFXuP?bqvCOQy^OWV;F?-AW7*OBi zz!q(N?PciAtl6L^hGau5aLJjCdLbVvZ-yW?A>=|L1Ba-X%uhB(ZD2ZE&rxkup*C}IiT`6k{`){$l8 zHIlwN72BH|oTRxd6~zq#(%k$ciA}*VN-<8u(M836P2`t!(QiHr3X}Qj2WKZD)!$fC z+kf6Iyv(>cez|lWA9Q5-wqt^LpUrjhfq?DO(3Km8_S*mWP`Y2=jO%tt`(~nk9)ad!P$ACn|a<`eqKm&{6*2EQkBXxDZ z8>&Gx#NjN0c(HsyUT7h3vr7w1f-R?@){Fffea$b@BQb*SzfQJYyqm{;wj2v@Wue?LpWlzD(a ziHN-QvY2WH`DH_G`5Mcjf>)Qo)GH6#2Wr~%tjq9GC*vc-d@nQQwdVKSgkmLD6le_d z-um5dI&vA__qXrrKkaRHE=h+6N!p349{Zo9A6#Op6lW#FC9NU1{zEa9*5Q4JyM!SJ z^Ea|EweN>3DtGpt30UZFbbuUe6<3X9KFAvj{WRnvn%Wf8I};xNEa0QW2;1e0$Uhwx z=opY4xY2<3-D*7xvt)Ou0p6VmCG1I*K-c$DQl<|jR*bWGTtw}uOWYeDoQ?6jAUCMT z1s84cjX6r4;>2YhzRZ8t8DQ?Z6Wp=Dhp2mZAM&z#Mp$fwb8&dCh;UfJ+c7%xgyW`x zr*Wrw(Y`6b!K)=5eT;wI*nS8Y{CYZdrCm}z@OcH5B7y4^d(Y`rmSOuMSYU3WQ^SL~ z1(Xf`p*`#&g1E1J-acWpc6OLnx?`gphx&j%fR;~JI!&+4wB?85_d5vJw69XQ4j7;0 zPHrXBaddJ@)5Q2-$?jGhoYOfs1W64?61P-rGQ1T&ez*G?p4Pr9Y^GK%Tsj!1Me?S& z<#J`ITIVi5*D3sd!22fIR>^{lv{>nfP86aW+Ly>n{6d+(l*EU-Q)hj6nEZ)M*0kq? zIJ8*aSaPHzCRu7W3d)mVN%7nip|sBL&x#34?vW2|C(d!8XdSUmh3`)?uvBOAy#zz0 zN`cXFSm*D1^wy@SS#6)`Kg80NH^tt}obW`p1u}@Bc($KGZ4>CtKYvwO=Z{=tV;H%d z`IN{S5^G6n$zS@08*WeS*!IyrN&hQrgIaId+M8(cjjZc^WXIh(9l1!6ly~iP%c?ZX zlUxA7o5(n!W$x8wnY(=Gx2#AZA4^_P+4zIadxE{9l8Tts5OJkzlcwQoo{Feb7?fKor%|@WSOY>Ecbe zGoy{cG^USbxMbL5X+p_3WopW9fyYB$zn$?=wEl}vNO&|i7ljeA*$i!8(xMeB_|=np*8Upb6UON>qi6s`C_{F%R( zG?72}LQM3wEw8kgcPo>B`Zb3%w&Mn@_7vH^DP5QM^nvC%0etooSy{wku6Y8I^l&Hw;_49C~18ivJk zDz;EFdzqq^v^Oh6*VU6Mm#u^ix>t(=wn}$;gRxwf7q`sKYFk2ta01jsL52E8s}_(= z?TA#o{c^stMBjTZT69xkP5<5?wLZO7G{em>Q!;>z!JG%!005}!C_pFpN!Im<^`R@` z=_o2wph&F&HsHjsryC|Ws1??%(SKA`tHa;g zqZ8yccBoNEJ>k^-Qj}^>aiP%$ep?MwyGhlA^>Mq8ZbC`=XJMRZxTz16v@V& zJaoA(~RK7?LojV&6o53^hLfptpOkwZ~A{sy>=Zc8H&LXFZDR$5hK5@5Icm5QVvw zWN#$J0M+g4WtI80{O0q!s1n|&&w4?3?59Eia#6NJmZOh%$*`bZ@JBe4{PpDZU`#i^ zb#W@9M4lJGLX{w7cCP`iTKypy36AP1Zoz=+w(8!rogzs6nn%!#s9xQ}Hd1?{nm7!6 zbLoN$e-r)xNaAYfM3ZTxL@^-qGLOQtS(R@q9Pp@|#5d2pK^G{cn;|2WQuru0H5xBT zQXiv@s1qpUC6IBx#|EaSk8fz0l!^lsI~)F9tFP(ZC^XE=OBa1lnC#J`9J%repStqO zln=j6(9!Cc<^e!|djJ`O=@_)1Fy1rQ1OlySFX^-y{y1!Sl=^VwkD55c1nyjJ0v(=z zaa(c=6AO{#QD_Jono}?c>D1`PYc|wUxKj8~h~y_G#@iFrQdsj)05ocWwe)#H!jH^r zYYDtH?9I%CY3Z{l?g51>*|ewh_^RS-31cb@Q$%uoYDl7g8z!UZAamzl)g}S~g@MTn zDL`VOShECfBK_35N=xpF8VcV=T|SF=@>#1Xdto8F20)5$yf>R6VYX0JR#jeAZcSZ& zd<}`Sko`SvA#LIcAYdn*rp-z@I1QbC4DY zP6>YagVWSj`a|}(w$>ci3xXJ_`@IiN<&@na-0qr0_K(%}#v*aM`6l86kTOWy;Zoi< ztGuT6f|1(x>Nm#LEi&?!H&HfXY zublJ1rIaZOZLUDTp}=9~A(?x3TRTKR<|$L4F84x5KhtV6o#bfHQ3Sm1ir zPdwtem&ihJkO7521&n+qD{1K_y`j`>1(lvN01(Z$|NLdrgI%bslAG>r&EU=~DpW_< z|CJiM5B%UYk!`_SuG=f+wQIXsu7Un_8nWmBLqlQ%m>w+1EKi3SrlV}d!zcnG(p>Ck zqtAXsJH>+3@aAE*OZCkBVyPLZ8%PnW7zb+k_$DotGMwjA*8KaU<_2#Sj&Tzxb4KhF z5r9BEu+EUIc2rMXS6h1%qOv1kx470TadB>M&_mWgDe`px9w3<|nK(m*g(3Dnt%w<` zs6OMAj8!Ki)yphjYW-X}l9~|nl|;>cKoNySp`p9VVys8wBq`qmi@MrHA%++rLuzA( zN&>ZhW7?1p5*I1dzn-BsoT@xQKX^X=e!}`d-@21ds8)u0y6?*VO6Q1;w~Prn|J84b z6cty_CP~#}-oPRKG2@bkR2u%W>$=$caEDYj;4Z7rr3Ya77D$*A%|;+hT&bHyTcMf7 zX61da((z_pVLjjA4go;^Ee~Y;W8)t2vp)gR$iFAaC|=(X5ZFZH(~}0mCPKm{0Jq5B zs0w@$pZV9r-f!=&zPA6({Wn3-?B9}~l}eA{yJjIDftG>0xd&IKceF$FzY#0~cbwd? zU|RmQ5XS00XZcc3$_}+C>%WHTHj6B$LPxU)=SB5%S|nP2-?1`j0U70bO~+`w$b^1&xHmIBzy*#C05AL_hpd5jnhCYdXZCm)Fywb3EvI;6R_hB9>kcL`7Md8KyWf^FF0 z!qtR0HjuS-PB9lJs-b;NOHZb%8W3(TCA>qv%I|N~HJmqgf(@*0+n=y;yWZNm_9gLur~bR1Wzv)RT`_yge+Ty95ysyX);{m95;X5ei zEPH;rTdJ(tAJo5@g6b~e1U(+^eZooPEUL1r7HtvfR-^C15q%#RKFF_{9~#J&5U*>D-fwt+ zB9&m{SpBq1PohOU(6c*Y;C>5LR%&>@%Vag1mFmU$Q`AJoMvmqfVw6T=jrLrxzSl$ne%ORhkcrGnoTj}ypNR! z*9^_vX3Tt9Pb7#&AQe4fP|q4N0aZaVE_Ij1?Olh+{I`piJQ8kDMxIgeW^DHi`QU`( zw7=%}qx=T%+{jm+UJvv#=%=d0hA?8jzgu{*^9hya+h1NH>dug+SY8-t$9Sx%@rW7B znk6I^y`;r_}K4a@HKPucv~UDUFXr<_*g#91j9z!wf`m z1mK&5vWtU1V6*Rg-B;`Bg51SIyRNBdZ`z?Dm`#H;5g~k0s@pL5`pu znlJ3Lv9r@B2KE6{*oY#fBX@vVmcGeupsyZ^UCtDD939Brrrr|)pL1mwq z0J&V)my@vurlQG#vh-G)f?@N@MJmtWk(~QOF>()d-X;5Q#aPf$`1i?7R@(&7009JL zFjYTD&~9LXyK>1~kh9NR&>UAk$?A@Td*N3(43PqDSDu>YDdSQ4+$!~;e1dea*< znMONnD3O^l@YAue{`RWF*1%>rn(3^QL(Ve7NL5RCz^vJE%1&&KA$zH8x0q-;ky<&s zu*>~@G@0`of4Lb`t;EYcmrLpeB-bav!O&Z#4^Yn2uyE5^bY%DhhbAf-)d?LtS#D-I zyQ~zLJGp2Ws=5-0zfJGwLl>_xJ92)xn4RNO-QGAEq{mgbCM=d(%w_CNtbImh(iUHi zY%xAAp2bylDz=Q;5Et$!t^`yBavDI^epL7C+H+wxEgHPzOS0L=UsBxb5nt(py1eY0 z;gwa5!LYULf`fR{S$y9ma0)N+Lk_B?{0|@MJoK5DQG^&gZ(EnUEfGHo;-F*}Z{7;*1-UB;vNth7=W0#C z%FWo)CKIq~M{OZyPce*I)^qa`tMZ+uI?{+rVj!Mwo9ED3Nn=8;YD2ZAnA@>K6)0E^ zMZXNIK(VMY-cveVe#tkFoneD9`GVq32kS*H4wqMo5vrkWIM$L4k{X42PT8(uhB7$P z%M-m~Xn&^-B-ol`S4Gz~2}YB1!uqmmxwhd;x_ja1r#uU4cA`*B;L}r5 zrtglWV(ns7EmI=V*n$4(9ar>Vcm~4Nd?O9JUG+i7boE^Kt8jH-9}BuV(5WXUvCep+ zgLzEKpFOJ~2k|1Ld~fmIZI!z;yi>=|C3N-CR*^!2 z(6|iXz(BYvIwPz&zxJW2+fzIG{v!GK{9C!+h)}-rdTr}1)mOfovjMx(-M#*iTeLek z=Y?W!*+|pO&?q8TV-@#pS;n1~*%eobyRYxXns#Q7;mn63o!)qQUIs>sx^9?zJ|t)_VR(?18@XiCN6Y#&5GI$jg={BIdLI-n-vKB(@ z19l!J)Kc^V8Z>?9DRAa{Lu6{N1re{rN8W!O!u zmgCx|6XG5W06;^7X&HJd%jJj(h>7OLzk~r0@JkExMY~4>xGMlklmKeLFcE;7y$%x? z3rC|%41Dl&=0A%5i$fF^81{>IexENt+7=M>1O^MF2LLAVZa5qcM`h#oeB%K(3>F%- zK3AAi10drA5a4|f_W+Py@Q^=%2;E%jo`2bf0ofj+Q&#=YhA7l^Z}N1fU@tCIU*~Ed~CxLg4#A&-XS(IJ)oN zPaCMQ*v%9G;AfAjp}o+N-i+RKkp?k<5(Nq7=tCR8)j*891-JK)rrFuyJuwxOzp(h= zA_mU_Ah;LJzKBH;1+W0{0W5<4Jt)6A>U0@!2>`?b0W>(=J}m(jzd-k&Q6m@t5BO67 z;k*6s98{k zx6IBug0J}syL(np9v)JrZpk0gFGMU*K`xg?GU|;V0_Jkt$Z-1(h}bPh{4U>4H!|Pv z3kWU{Y9yU&s~em3?u5<%Xkdi+cb8gh~T{SL~$)yX_jT`sq&Gb?yRr#1W{$awFW z=h5@h8j14m4??r=`3@aMJdnB?2*VW*zNa4da$Zh#IBy(sPVivyqY1M|J;}+ zUHarGy9x(c+nIy4$``MtI1IK5KD}O4FofWjU>Tp&ovo!)&~%ctb!W;jKsb-6v81rD z{f+77eL5PXApbrj2cBFd{MUAYtlVpx z_Tog}U6)$0rC^@m6DM!={=KZ0LiHEVrL~#&pKCJKptCzPT!xJ;%-UA9>&wnb}aaUzoJ^7n!vi z+=JEcH+=b~ij$zd`~F(KZs){E7OUcK@%1|rQ!x|u^sv8xQgbhoiwy#=!d1U&!j_n)GZe~;soyiZtdgf@$_wx>AuYZuh{AHeE%!*&>08{e!-@4VGLSgkR5Qr6DD7)7_h=e_@k zNzrDPRVpC-#xY*Dc_z?eC@i%$6du>>|8((u7G_%OjvNI;WXnt2lJW z+kBi9DOpyZcQvrH3qKn38bx$C(iBb*-S5UgK zg^AZ&N`S--YoFQIue>OgN(%B~5!l63wB;bMMa1P~-470LJ8iK#`@vsBO#y?i@uzo1 zQ1(2FzkU{?$bWa#J}K}!R&<%3m8JY$0_rLGISW$d^b#$7%v!OokQ?y?3+|zB%KUD8rLyka3zEZMa<(PUY>J zQ;RY~##ZMN0Zr6Ws4e?qam<9LIisn_k8Y8N#s}D7b3wa)3cm81lO&rt(5&1L6mc%H zIwu(zK!IM4*k;GPjBOfvqGzk0`Q$!of6Vn5yu#iG-lDPuxxs72yp8R*tSG@;2Z3zr z;Y^-q`;1=_*)A#z{XiVIX;Frf9`x(RTR9TYT0NCA#l~A@|JTj^8BO^32K4)i?$1mP z=bwa`362l_pvsQxfI2-FzkbXbD=+o1i{^)gCNI)qy^1ajfH?Apjk0TFwI~&WU-v0Ss`lX59LTzk)MD}`0*r~MliS_7% zdF=gruN@t>bC`(LOMyT&hWuT z>JzF9GTwMc_xASPxOL4Z_MnVBYu-A20LQ)!(yYWzh4l1bA5vEwXZ_HgZA6HaHTJ=~ zzSj32vIf?E@Nlyma9;57@ttSAOw3S$l-Wt2*GnqyI&s0*gR5UZ-`|4WhnBBuZPL`z z^skNVyUr1x=tx2=jcq)2^f~P|i_D4R?iZo6Iv3h+ZzqUR0cKW$fjEz~_$20wWZ&mFum_tu+nX ziD(XBu4$x8#;3~^JlFT9Xl?sYlI7Qz4hP z|JvdU$l7CunU;xUo?Jx+e`c4{67CuP2%GyNj8vO-`&L!t%ykXL3By1;;W37-1eV6O^H$g*MSHZV3gaQ@anPl7*Jekn zs;|h0FH`YPrqX7$%EwI4TTnz}5-P;}CGxwrVNeyhQ;X)aLSd022b57Ch_wr9I~h_5 zN}D*&ImQwU^Iq zfWAuQKtZH8#Bcw(V~wQ8KHTiwW+m%#lMu9G`qBmLm?WC#aRXVifux@{yl)Fi9&1WF zwXM7%OGGfPDk=21)xOykVUJK`+UvqGKEb~<8yfy#&!`m{;jxn~T|RiQy=FA9>?&4L zv)OOduxu7wptsbShukrjeeQReBs>;2m3sbGcXedrm_jFPeDe6xY?)68GwoyLAHZ-B zo-**^p#wafyPw99H&TT5*az3YFDu=kPqhGt6pTE6d za?-7-B1#%v`1?t_2?0y2>u20+Q}H)ZJ%25VIiU|)yd2xHg|6}fKPsznnw`BOIzYr( z9+b_1^5aRbQzs?|)$$iEQu0Age?O>VT zklnu9i&zFp}8gh3YIv3d;BPn;oFBC_H6^#W-+kXXOZjo_XV@QO45IQ&>Lw`5ap+t ze4p&3?qhTbmCHPfIW37$8xZ-Fl3 zxdH!JQP=3#`AoENUv2o&6*M%`t?A~0G4>@Yw6LLR40)1F= zK%${19Vjti^4+6XhSAE9H`@LaiwwBPIDTq_h6iS4)1@(2O^#f+$euqXN&`_}QI0Cc zs~N8ykTKgwH&)fih(Oq&(^~rMcwezyYLYhF_w~5>o9aM4L&^pqIko^Um-bqfrhL96 zdx^iAVQ`*yfe2{cZ=749B=qzmo&JY2z?y8B?Ya76oAV(~^-KMg8<6Tyj{Yf@FSh{X zbaM$gml!T7UgUh&9-~)wjvacseTzUOj6!96KY!{ma#p#CM7W=U{U$nbY5 zDQ$!|ml@J71x-nC9Fyt=uF79tF^d!jo%jDXl>BWr7U|v7c9|SujlYMs_qhe;oQGFCkgP?nT=B24tNC5WWodw=Yj6VTux#I|jf<{_6>)WG}2+bY$| z8J&`&*gMrgp7fkm$i;l6@E#P>Hi+vqEl^tcCA!6e?ceJQ3 z2q&_KLNl}5hWZJBCpC;!DH%I71|8?+wMb}u_UV@BS4p!Kyq)a4GY32zstfgfN}yY( zBR<2Zu)(?IVwmMx?X$tNRx9lrXNO1Ia75-s@d~OHz9Bw1!V<9N>F`*re*Bp|Lx@fm z%8#4m0u^8QWihlb}raMTi=F z3J(R2D5zrTtxX!3dYx`;kajsO`epi5HLfpq@Ff`UdUv#Vlwz7}2t+DkB&|$;p^)7w zs9&|kpi||0Uf4wys*&(*8Ht0h<{D^~YY) z$8%!Ry-7Q<5fcxy%hBg*>l4aH1w^*_3wQmP3Rk z=;(~$N2hAb`mWx>_sq2!(rVMRKAa#m8&0&$y{9=)tlPj^#E8U^NVQf}ATH+fG87`U zl9%XeER-ZNgM7_<)*9iJ9I5{9Nko^WHqBvFLErNvY}r-R+5J$mO^YtIt^`W1f>lVj z(_@OGZ2uj*@daZg*7A|+%gj;N~w!*anOqZe{p+1rqa-|ED) zKQac(Pa`>y38Y}7m@AJ_SZFwTX`WW`auSrU=gg%F=KH8Lf>WT9e`xuIA`okgbHmQ5 z#z1IyJsz1$*IBlck<(P>);YlrivgJ*%aZ{=!c$wlDztUj^3sSP>+dPQC(za!F_t>z zt)-vMD_i7&Z8)%%sqnQ9I2GBF`iG8Q;>a)7MT2Ax*-ody{`Sj?mIg>9x;|x&6Jwc4 zS+kGxPieSuABi&C% zzld_1t9`Vt;AhKWztu6n(u={^Hm9PmUxRdoBrS%xO9n<{T8+ir_bp257V3+wE&>!O zQ-16qRtGuDi`J3ixQoaZ8@@HQuw~z`4cpTJZ)^*rns(W|yiAZ^_QTaj``HH`NM?L6 z3{($P?tkaOc0)Ak_)Kx4N1W2yQG6NU2w#_@)R|KiII>#|0DnCt9n~PW;_roN4W1#P zm|&u$9i}EoINzekSb@BWe?R036#2E%8tFlY7FeU+?BuHPSVyj&uXt?LN%igfynkCI zaW>FlCA{W_-!Skns0xQ%Nq#RGuF?fbz8}?B29L?tfTSHl1RT7*c?IVPJ=Wz~v%W() zz1ME4o9M_?d6}L3R|2f}AJ92^UiN#+KHVW`lRo%yxpy)W02=fNg#>ISkEbO|ZJ%)a zuPT^q#)_kE5j8Wmr+X3_?Ctu6wd;t|8qVwh4T};Avf5P}WGlK1Tv<{Y!CDFW+_?S9 z(Wdas)|Bc6Wo`O0KcdykWblPVp&rbszLKDa(Wm$ffk4WgJo+JUj)llO&S`n5+z#Fc zJ>nDI-G zXxz>6T$yI&VGQAvvQ!2iSoV!O-xf*+B(Juu9pPq`ZtVhjCcn)|M!tYY!FqPXZ;F2e z4jg`OOr!rUm#HgHPhRU5(bkeL*nAeu&QEQGJv{m&$O(s=d9l$Hd8f13x~sj2-j0BR+CC-SkKNS*~#9Ay|~@ z3{tLh%>PucS|))h?Um+gwP|#p^qG_;1qq^Vtz+Wh6GcVHS|XU#Sg0~BCF6>=b`;{7 z)z;kc`~g^bXf|nWdpzn()F=Cijd5@GEn3!PI<8u}k)C$XsdijEVC~iv3%3b6)yLVm zT+StXUV>}eZr~dNwlx)rZVjm#!-g-x1*gTR@gb>lpH?#6w}d-rzOk2M%f{1{wUXIS5av!+RAUh4^USooo? zd4(Jhr}eX{;+EN^0~*oLE*TQ;Ddd;JS6ULKrg~gA%flBYs%Qtav$T8}1`!Y_CKlTZ zpf>cLn)RZ}n?}}-sJJ&Y`MiHgj9r)h@>G$7HaK#L z(XE{*AfYgAkmx$8b$ySpp5HlJ&UR7K-V{VuESNn4nSqUG5QjF4mf zy7lg+O4d7dhi3A=9Xvyhr>=_w(iH z6G7`pj2?s_f`gmB<*78^eyyE53UxbJz~Cx(5Ufn+J#sdUKv=Su${M7$q=Q2~5}FRX zjRGfLlKkFyIkKcIVHEab<>TO4E+U(PV%yqXl@C2z6l0&=b*Un{{d}J-cju;9`<+x| zQc;G=70_$0oal3F9|Pvg9?^w}G-<2fI(K#KCG_Q0(JQ#iJWcj|7%hR%_Z)4dr0SjP zWk)a2@yo+PMd~%>T`sVjDFA3qU_3D;@caGS1R1=L)GiO&$u1Z!Q{oA?G z$yA>cs=^K87Tl;9IntK7?mY zjbqh!e{L!#lm%bmr zWWf-CD1l3qDS?!w+-=E6kG(|p9Z)xPFTzCaX_{}wVg~NXP%n2-3pz(4-P1(YaB(kT z&%2L~z)n3f<*GxIyfLIj&NmWo*?*T{_oqm5mNyV>ktc6UvG1vV@P{q9{Wp{NP7jVh z)ZJ=0<=h@j#IrLoI#FEU-!Zd`$`Y4tRIlfkFnPM3cCFkWyga|sTiq#}9Y^m(o#m~DmKaO0NZFf`*iq3A4t01RF zQ^|S`BRC@#Y>ZtGqW*f^m{8K`xmyx0tgm>XvD8ohyyXrlbD^`zPlS6n_?~PrxhW=> z{pBm~HO}Iv)wVv()Lq$*OZGElGaMDXmZTU5SEU_M+ad*7O>z@*X&J&~f~wqGWFmXA zqb7O!R+YG8kA29w+(~_?ivjvv2XU(2v2z{czuC?pDRkIbP4b^ zx%@JqXx3vnYF=|GK-dCuAJjpZZaD!^`Caf1aPny|G+otyoNi>y_we&Y)ZiG`hXBW9 z<1b}<@j-h9&Al>Ty9k=viHCK29Ibr#p-V>Y75OUhMInM@6*5Y59l|q@gv)rvKC!pY z&0!%`oHq`~RDHwd4VK+dy41+lDs`ec(+mSTtM@`8$EjsaqsvNW%q}_av@pbu7b;nC zMuW=y9?d#VICE6D@no4!u7Jn)QHydEK%4 zzKVpuZT-#e3jQo8C@3_ADGBt_Q#wAmNDTi22XtkB32Ybh%#*8fwp z0frEfbV@O*e1WsZ92I`LZX60LkY$Bz_K1Q^Ku9U6l!#sq`& zb-7hzG1QJjt7S!)P_oMDDw%fQOZjo_omt1Deq6g~e@PF0A z<%unrI2OB-mIWZefTKmzdNW!waY=o;=ZQHKgt+&^B$xnp7k~x;K;4(Wt+2;>?+y0Z zFm>&dh@{GxIUo1ja?g%j)-5vvuaKd-NwO&s*JZ?+@vM%JhH6nULDPhhHDrZq=$5xH zyuLv^VmsFU%9lOIY(0676Ip_p9XzrcxAuH0vEP?XNecdgu5xVfs7uA^S4=dxkhCdjzuQUU`Dd{E-m8`h$}5@_I(u$~o%8FMKp9CxJ_>Y+Im zNM`oW+~&mtjy6$dCoC6RWWh_~2N6qkwg-Kk7Gql%VwmXA5=9H&hRgY}KF>gBwrp&} zL~?k`&7)_J{VNUnOX|r39I;<6RlNz+n?`X_GSp{8$Z>3OAg6^JZX0Q5;!0Or`q0h1MY|i>>-Yuyr38^BGpYVy+^+zGUe{@+3zHP1I`hDNSf2cw_AUBkAY zduv5uQR+R-P6B)qPj`VEFKOZg-rKf1mCnfoOw4`So`tQ{h4joGExg2oV4!14^$|hU z(h7yNo}R{g#?glQlLJLF(^rz%?w>T12RL^>aOx%dE#otQ9DszbSpK> z#w-ni0Q@7#K^#pI?TiPMlws$}up{_@3hX?1pbRkpFa-c;00BWvfM0MEHiBVWKtL@t z2gp8%-Ts9-A;IA;#-jl;cs=Gnzkg%iV%{=ZG2vAbfv-b00G!yh{WV}4O@J;@tpMPG zNPA)=pL#yENdXq{Pw+2r&jKYL$P*3F_~&saPa(z*D)rhxxT!X=*q<;YA~fn2_zxrp zAcLP@@V)v)_~~eEtPh8?{|}mm4L{k82jFn=Js7YO06^NOk_>`*nd1#SLf&8+i)>Ejcbj_{JJw6nb;%}Y1NMv48G_zrX2gNV?56i z<(DGcd=B-o}JfXcVdb9eu{++H_kdbRjqF}$o@Feeid;Kfb zMRgE_x22!s2EP7$?Z!LO^KsV4T@c8w-ACc}Je)m^zOMInr}i%5mBHsXF{yb^18f|3 z@gI)b9JC}7_{FM^Vf^On+oYb3Wj7#eVOrlLfFNSv&WS$Us&McOK_%Yqj2(DBAB?O< z1gue&BW|rP{j=~ah)zj%u<98ftJ7_#D!eBE=VcLKMoMJT9QC^&dH@jm=tu19XZ9L6 z01bWX&h$HUWWydu74U_9he5_R$6ml2V{#lw@d8WZo@$0IkgqN1k;S<6!W>@8ivm=u zH}Zi1Gtki`4PYy`)4$6=_N+Zmx@k*(BIfHC%hwMhuA_qlrF1-$=l7S?ui&Co`BERo z2%;fE&$w|jZ8AX)!_>OsbDpks3j{bWNgw`P?faqx5e?}kdp2p(VL^_U7qukWPKX=l zfz^)7d*lBPRbL&~~lU z7X#gIbDCR;F6*`ELW9fMoxqzS)3}AcY)3o(fZo%VLUr4z{#QD8*wFjEuta+$by2!+ zj|-1K4#wxbwK9q=cv9F4EnfcS>HyI;rW^4{ zhQ^85iEzXubfIdGllKVs9!@nDH+tAT4fCcs=Bb0P)YUCn&=xQ@!uwo{K0S85y5@Fo z@n3{4*Mz0h=Dqfb50%d4%-S;HVbWg5J}_T@`_rJVR^4#HqRO8-ifJ|*nD^$>YmEu~L8ENG4>ir&{`60Dw!&pbi79XAP7^LpXCp8 zpZ{AR7$U+bHEEG+=VN$V164r<*IJ&9hyr^!f7fd0bGYv17#-794H`mJ980=bK->BTI-@IZcW>Rb7P{-rEn444JXNj0cy(^s#uhV}Nkmhh^ z*vfutU?Hj#p3pAvgl6%#d*+xDFMIDG^{-l08FBaP4KG5nUPqSG_nga;BN77dT;on% z3jB^_T)yw)XS2UcmShr~tDrPhEqq`+C&>dy>V4|?J`ZlzCJ?E~&+GHK^iw3zFZ6Q{?-4>x)L%ZYa1@t5J5ASU%uVphBy7+9wlik< zO?&kxXACaVW|JJ>f6Xm9F-WspaErxNH6ykXYt?|Twx zTh!~mRx2v{7UZvF5reEZ4qT@xA(MLaODikdRQ0`Wqs*v4S-laQnr=K@UrRdGTqZa0 zx5L`1mfcJiFbvUuCYhJD^;W)R!pCjpZs91){PX8*M#jP=BZl3 zY^(eTOxGPvOq6aLH0j_^nSTTeoWI6C4jF3Cz|2k2^GL(B)-f!ktL}2>q!6LE9vyz` zyH#fgr_vw+itU`az#EgFvbS%_&Ds5)Jo^<~pd8J|)*aq#oE zRkz15q;9e8O-mG}qpVCKX0*Z;CX|0Lo#3)%#$Qt+?QEtets4Gof0SC{f8r+rqeV?<2YLZv(y-OZ7BiTns*21@st*Rw)cbd-av; zQIB64c^g*>zvNtA4GrlJsR)z6cJI>aU0Na#a=pv;H;l-43jEzI@%_on1W_~+PeX6I zA-sRMRZg4C3UVL#&^B%6$QnN;f?&*z@_Nt2^^^_kT)H(nl&)*+zTei!+*F#Zo4QgD z$aYm{>KP;Fm^nl{-qH|Y%-x&5X^YYdoUzfUISCjQ;&g;fD*M{-9b78g0V2nq9xp_$ z@i?A4DXM=#wB-ZvyM>m$Y@^l-U9?Y}z}#D^-c`;}rB_2)dnllFdN(py&f&{Z@6BvO zndG-9V?*BH3%T}IKZrnR)!xZm_4EKic)Z?5Lq6{|9<5bK&TtTWSVm9&&onW;y8&?O z>1fE(;g4(0p_%?UU!O>BQQrYz_Im?~Fckx?a_0fhQUY%=qj=@xE!=a19M za%E0ko>WQ%VfmlOwgtPgyyE-Vq2k9{<7AxJ$?Pxr;?&YRs4bc}rZOnle_z(Ls99MZ zjTaZ$ONFky_Fr3DR{53x@Ui2tG-$K73SyrXto@K~vULFvoU!z09>aB^*zQf-++Ek9 zC;q2^VBiAyH1z414xw>bP^-o5!)#ue#FdbaBJ_-EkH7xx)arjiXU99%Y%y{J(@3*U z1A!M|U0KPT+gDme?Hc%KAXpj^?`oeLX_BIsXexYC7nH`2Z_)ua_?)ffdm7RZO3)S_ zHudEpNq7tSH-C3%x07w2W{QeIr-&?a-(q~zcrSv(bdKx(d-3>7Hs`mGvAl4!1tOm!={(lHGbpj`n5x-r01(oVhq=_GKR!U0*;c#xvXD za@iN048Dr*;vzTm15i-E&y>Gghz3O>JvKfI7LsQJ#=K|@MPrP z(hjW`7!o^>oislhCxv>&uZRkuH3p_#jLFv&u9gEH4iN1!J@K}Jw@nhepl8DCJZ)1T z+V~IG7qNcd&%(aYM`yH>jblw9u@g2VzYD=9wf=uq%FNZ8CJ8Zl*$Ee2;r}i6CUcl< z9U5VS2mHPhlx2_}_>a#2Jl>MiY#um3mVlP$fP_wwQ zeaLoooyd5`4wicaGNgVR7^d)f-Nj3(vz3XU@cnNmn}yXf^Re9aUl3-u^5X4TGm+$O zc|Gsng+`9r)JbKlF7}p>9wFN8*Z#AzbTDRW6{3w7>MKMPaWlzb1MK`PheJ{b+Wec( zqFsGy&tD=2rrC~4dAD66gW;HPtmJO-aml$Mp2_`8B;UVM60(8F$cFo=1ooQ006C)} zAZxx=`?ZJ<JY^fme|J+c8!rWcyOQ zj?ZR>t=8L9`R{f7v9Q4FXHp5J(&>uW(y#NcKK4E2=OowEGIq7FnovqH`wugKz#iPo z{=sxaeGIYDSMxXsC#nc2`KU5k?H&G6ak7rZcNMld%_zf!dMSdm13V6yp7oKfbpOr@ z={7{l1cw4#4WVk<-3K>W9QC!}ABX1vAHTi4|C*0PX75hxZzaOQD=tDa@`?*(~dn;Rn1~gDR9j|&TR(fJodr{jrldhs;dDJ z!_d@vQ%3}x(&FoU@aI|CfmyscznNg3^2ky<_<-}QWk@mFKjc#w`p*C_bD2o2k(-I{ z2LWXDaWZ3kvF(^2?Q?%aGNZWxTCwQty5jIFl*R7>zvHVYeFUC7a7bfT_&KEpN2nYg z?d2RM@IozOlYKKq@%v%eRd)2JQf^ zIvcZCpCpoH3YVH$vlc#K4s-I=M4(W*^z#ld4 zw|dcnoAdfDtaQ*6^uuQ&t}%B(Fr;!@FR`{+WN z5L6h{>M_N*;CpnE@2gWEmhZRcVNP(%xXyeC!qH%Q_`jR&r;THM3sXAfJdgHu@4ic1 ze5^Q&o+VYJTA|IlHl?&JO8sT{?UT<1qz`g8S+g+YY6$Py&$tMgff^Zt0xy377{f`^ zEl&`t77h7{bu$HKq96BMDu0}7mj$LgW^&)f_-*S&dpj&nskZk!zl%AYueM=0qPB| z(Sh4RKFR{$rL6Qjlqt-K8XO_dn{n`pR5<0N*k@+3B>mG#8YOx7tl4^pqp_3tIgV3d zkA$qJ*x!MYhXcb-f{#!1qw@>qP&~98_50pM@W0S`$}eLpF4bQ1K)i-$Me}?E;U=RO zPd$g8S)}IaR#lm78VN;55wyLYd8btR>S^(P;HUWaKtoC+U2UTW+D73Y;|u=m2Ow@_ zeOh$p?r)2nhWi5+g8y#J72`{&)l>qt)U4IwfTR3Wqy$kMhC_q|*v2jw|BTv1VJ@n) z+VG)x>C456b^voL>)x0`tvabf^JiibWeT-NgjGCo8m0CGRMB~Sj}$W4rPXyOlu0sO zlqfv^Mmh67N%#ms1Qj#aeJBAM)e?|9QA79+aoLbEZz81BT{jN7+Opnh= z65sHNJK$X-J8R^Pz5-1i7w`p78ri)Fxms=A78yMWo(MZIfGzUP$t%{HueYT?-fXht z$Cg?@0GvjAMnFuWWZjP~iv#(A9m@gt~&RS5v2TG(zuP>r&D&>Va6h_&| zqX@@%ga!=tSsz=BrIn@z7#4adDrA;aOr7E1JaW+zCvD38@!z#!d1P4`VfFcg5R6H# zo|?J@lqsPQfT!1K8G{bPEJz($9M2g%?H6ynq+r4+4PtSG+2$Ln2Z2e2Y-&*nv*&?z{m4v)IDd=%+l8c92?S0R`!2WbG3g(1GpnU9`ag8=l@sy^i^N@5}~$XhT)o_ zk%=4&(apl#M@+$J(AuwnPsEe+A4vaR4C3Z~!h?R8jOcUfCc65aljuhM**mMivFH7L zlt?kXJx^UJWn}mUomr~!wRt1J@8-rzH;tEyc< z32%IQdd~JGq|2r%*$F9WpntUktzYGAiUukjS3TZhXD@ScE-UK?Je|Zm-mPh))EZOP zSE4jDdZQNl)Kb0Z?;rF@YDk<)=<&f|_$?+8I}mhnbkPzJKjLkB+ktU%R#>E@WRr`p z5Ykd4Oq%%v@GT@>TS>s^jfY3Tm%sP@wrn})m8jj1t>G!>sK}^MDwkv%!Oix|>9Fk> zgh%nF87`?($5f;-l>$D_Uu|eia|3_pU0gWjun$6m?k?W&zdZjn;1hm-*NV76S~^}G zw`JqoWM)M=aD@tyKOyHJjLov8AqfPec`Ljs{Orws^v@^yk`yno{b|MHg0Vk2SLd9L z66KOh-pOS=OnW+1oC;D>0)*vBWRBJeyzEcqiK9-eIJM+74)6b7O}0o@ex^oMZKhm5ki4*!n3Paz<~w8}0@WI_7@Lu_X%ls50%;HIkX;;g zuwzp^3p)3?XSIuN`Md_P-cuAh9eGu~g}q!S(XsP(r93XxFXx@fzj1M#PA7xc;+p0H zkuEjNX3(ASDsc^HHn%Xt%;E)YQ2MuSE{?AJ4{ya^DibFbfQ^+hHXPje)4Ni8(<=oW zs{#bR7OrP!p$4p7f$Qe(FM{&H&0jUyQx5Ifj5S_nRj@b&9h|^7U=6Dtf z^c@r`>bV*R^fr{awic{_q^puZ1|7s)7~`n;+|#Dsze= z-Tvpn!tR1#i7IPukPmALMG z_7#{4Pc)Hb4#X)NJZC$bxbh3B)~+iNH%Bvg-AN6a6g&y@8eQuO=GXO$AT+`n%~pr+ zyetVroljcGH`(xTh<+jZJO3_%^V6Gz718jQKdc;!%br63L__C(KY!Mbhr513NJg5z z-%oJ~K#6R)B=C27*o2?>xzB0d4qxZMQXd45=IBH-#Eo>jH_pa60#7VciVE8$*y6l}|lt z-l?LhpO=<==Er1awDIE7a^SSTC5&`m00O>mDy{ILCXC!(!;Et7xH zf>brdxN_yYRM&2`rcc3GZ6V!qWVOh5T|<0f>Jz(ok$dw3?}&JvvQfuD;@hD#IkiEM z7U82S&f^iXA%YeKT*YnSvCPFrlTo^t1soEfIVjvON>b{$u}^--Vwg`@)E(r`#9*ysN-AGigh! zPB&9Mu2HYs0%|-;1ar{RWTf1rQcg|hV9+#pko{u$+;Fu3Z0$8gDW%?b=GOH1`5f1p zdOM6?2~?<5Yf(?5&bLKjG&1Eck{<%=`GpZ9DTf};yuao!L|QfN*(1TY>bj7r^X6P* zSHu4pt`Rec(If?^NEtp2+ufDk-ReC;xXsWb;?;uJ8^^G-dOwa|Yu2yDk=ulb2juBO zT1mNTF?(tNC3XpgQi)z8x!qjT0ZVt!O;8a*x!JrVf$Q*=Om2~+MQaeTvg1dU;YYK% zsO3||rIBeoh&Iesh|APa;AGd(&?}>h%W~G|EOXYk&sE6cC9}YPcqx54DA+dE!DzcZ zG1m!O>S~{ZfskgRqR&M}7380>a*&g0_?Nsv|Gv2Ve*fkIA@#XwGW6A$Q^@7U#&_oG zZwrF~h_(Ln6W>w3X)-D;e34dmpjH^UA={p9I#k~}m7LI8F$T!~Swat=&YJuw9MY9x z#=ljKwDXvE(?QX@YM6B%yDulvqk`crhP9cmqat(V_<5|Q#rUKQt?Ai-Y0M923~H>2 zHYsDZ_fiS@|7%LTu0?b7+=;zTa}zH>u?+JaQquhd_QV;6G7deFswt>=>{DflcoG zoKKac>1tpet$)_12p8=+lk$Jw8A-2uk55M$1t4U%iR=L;^W@U8+L6WL9{|1r$jL?s z73u)QXCz-q$ocN?oc~h?RI=|qB8%foiz4&;<4hN4&6-xmo67~LxUE$u9Ke+SJJzzH^B7I)LHUKT~RQ9-Kzb2s12j2gm-&90LeufvU3-_Im z%`Fm@8B$Yx0bV;4!W6X1ob;rZuK_x&=jK3ReE<(oUCswUPD1Qv#0e_j!9VGqr2U+yYEZH z7gh_>t4znYdDwy*lz(Y_)brJP&E5d1m@*x~U+e2g`xMwV5(0b8_Y?FLm;jx7*wIT=fE2hk{i+zBBmV0W5TD^mp30a*Nx>A zmR_umX7!E3|H6gCH^mYEcr^7k=`AM@ULqYwWhpOFCOa2hI`5OTM18h;{8)AsC_QOf z8PD6iIG)n~M`Nn?abfx8|xM$8gjvL!b$9wp)Up zVlT`v=Ev69U#d3+n1P+MFAs-eSziHod6IhP|D`v%L8{_#n*t6u!bmbSHNsG3Qqifd z>GiJx6txlZpu{o?;Ly-}Km%D+<*=5GuFZq-A#)OWd_%>O>L@X2B7k8?5fC!OMD!q2 zN`irMk?2#!H`MfMs=j$)4Ts_3YJ#p91skQpqHYF1wa9YXG?l)-wn(Osw#c-yFdH>c zE0d;?T1%T$gppSD^WE;HMa=nyC^^`BVn(~stop#rp{X~O0fI9RfqNz%CzS?AgnqVU zj%QIvfP8M}D}u420N>0AKd0a`%+2{2P?nUPC<_%aX~pIWY2(U(y})fR?5@A37NhJ* zB_HA5ceQvyC~Q8&^j{oVE-8Xm2yhJWw1_Z>Euh`xVmpiU707ttMMaw?{N-1K3Tt9C ziFJZq()V5|6KUvKYGobJML(N8lAWCtn#~ri#_2*tLiawJD3aHOolJtgBqIFrC3Qq- zu1F(d_8ED3;!FEEd;853NU|9YUj_i=-y_C4j{d>_y)OBIzKWQ|1pPI*^M5>2D1MWV z<0^U@JZ?Zl^5DJ?kt`~d0!f|N{NK9*LpRL#oMn-!DT%4>39P;@iB zspOG+y@MyL*a#3-{2bX+Ht4J>msdrBe~3>R$!bbXILrk2b8;W6i;$D2F&slA==ea* zzfnqgd1vX#^RH0~KUz{OSyO#x5Aol ztHb~0Aagrh{$326U<>B|9s)w?sMyqgDWub6!l8%MnNN*XRqKrJ>71F3uq00W!D8ys^GfeHydVOiu};s+if z61!+3V8Te$?&V^00zI{}wSZjOqos|K&7|7OyjX6|VPcX(FXb^PnHS(GX5dlixcDCw zczdZrK8e)EvDJUGZT6b7$R|j6Oz{pNMvL{KhB|b1ve9{S%O|(NDzT4rNx3)KsS4Ye^ zC!o8$W?QJlxz%IE2Lj>@tRvG-S}C1&+Q+79TN-W8 z*$n!Y7gJq;9B8i1F?474DVO6U`&gxIHFx3kdq%dd&j)Bwf!!?Q=z=H+UY-<)qGe3X zungK;q0yI6SzPwYEllB=s8H{vD+i~*NJ;ng%C!RbBH6)#tNL^{*>nO1MI=$TcbG$L zAmrRmREa3+;?}nC*8zhR7SBXFMwB{p$*n15LwD4QMbIPqXe?*Qk^gsjgi96aj!Ab- z>rw4}vX>Ls1+(k=DSgdxU%?RX!;JPzgejeZO*29vwzl6(57QXiP{{Bgk z%xrd?c3=qu##D!03cxC)FMcHx2m5#rCaz!Bc7Q(DIJN}fwO!`!z0obR64X|x<(oAA z+yLjNd%muL2neSQaHoX9S=U{ChvV8`6wpZgET6m%yPiS#p+O=)IAIQyI@yN5y00|$ zzz1^T2L3*$ze9--@ZZ%0yGm*@_jj5e2ijg-k}ZexR>N0#nk9?-R_^1AQQ{$${7YG` zE>Tx%aO_Lje)ZqdW^M&FSx<1Y-MvNog`C7uJ>j^f1Nvjgnh`c+t_n4x=x4ZrBm9lW zhAd%&YtR>-D;8ML=i6TzR2Q0aJvg>QfE<8$083myfDIW`=h18nv#g(r{Lqt(Y6<7b z`cw3-$j?4ie#3NnS=Fq{U8hDN1M2;|HHjAdH?(c0$~Cl81HRsUoYD2@GvVO5b+h;N z`LhDKHM}I}>i?t+0=*ib)0$@5kREH>F@Cuu?GK&hoj^lN-{^_6sLHg~>44yDcK-|K z;xwaO-;;zVM5g+@Dw8x$#+Hu4@<=ig&Tm%3pWq=UTeApS78I&jOq?sI6tb}pwrlF#YVJnE;qT_*UQtirURxWSoh&8XuUUh)f*}jH8ywG7@(Lt1eZc!~T#LzZ2 z*!g815g5<}uanVV6s04d!nkHxE@Phb~je%)|;jtqN_F(jDId>skqZ88xR6|S%E z&9;l1gEtc;`j}Z0sq8GpXsCQaKI2&JrhdaP$a0M&Zi4MF{S4Y0P!kWP1O0?uwo|F$ zF+#d~>o~TDdkshnK#;ht4#(jGqz7?}K~C`iq_gF@-4GKVb`EyD+w&sis(?69h8YdG zSSjC#ItD#@L{2aVL&N8FvzDY8eXWNhkxf11!eBb%Ejih>lbSa&1W{PfqYGSo3Oe`+ z+C(-`8NVX}ZO<}3cjwQ>kY+N4c>k7;9Ywh(*8*~WKEuu;M#-*%kh~mqM={$sR3vTN8(^aYQ~i1wwWCaz=!X_xw@bkBrBB=FyxJ1byx{ zk^>Mxei37hLeST3UlmY{Q059=D_+G+ki`qkdGsQHEM(df7>Y;RXO7 zw0WYO^mY&7*5#Ro&;&8v!}`2^KHF~YrGAP=$o2$QRHH%*QTgeau6LAEin|^5Xs7zMQil~zzeL^PmreFVFP?2 zDLuAHs0T7q?%=BtE#w2mfFjk`w{6U=X|X(70K(F=Mmgx?j|cCyg<_vCR{wt78jbHs z9m|1t|0*_#huPPshh3NB8%Av~zU}_OV}C=+i)Z}8GmSjSOiTls%=qW})Ru**ENle`J&&0ZU1NWl-4lb`Y&^ZXPTH7y$tK zlC9hvFHe*E2u#-n<2ZxlpT0Rq4{3p=4M{k4??SF)V1x`FL77Zuj=G=5zhuZN(xErT z4JQWyL%wQSadXUoHBIwG_OYuSM>cdeU{2RU`g;C}u{u-Z?23&N9%izM6!ugeie#m3 zB6I#vi;xXKLrU`Hwv1Uw<7BH$Q8%d)km|iyR!yV)-U$0kYixY1_E6F%rq7#Q04IeB zh(cZ(?CvG}!HklNit8kG%|Ouf$|vLT(Wh~)yD#Yauf>xDn69u#d!PVuQr@wCIbZM>G!p^TJ^ z@TZuAA&ORZ4)*F+zzCfJkcXDj1oyv2DM!l1+OSf|vEnBZ9FWmJB)Pad8=|Ou#(oz` z1bj|boDgB_=*q6aQxB-lhq80!^VYE|s^RCWEvXQX1;pzo916F_`v8o4F9aAS(Jft9m33LRnW?hc)9_Ftu@{PSQFjz~u_ zT={^JXt**b;NtEyuq*UmNx-M%j&*~aKOUI>$j9??`?Brc+;&pz4H3P7z{c}njuQ)+ zM+xvgfiE~>a;eYUtdF92lGve%k0g3lZcN`a5UN;T|^J1ii!J$h{!E|C#tGgFT&v>{9|y z2zJ4VTc7rZXT9m*A5)N?TQElAUDdSMa<*Gt=k`oh)|Y2hC^hYsms(xIJS$#}4DASw zI1Y5GHY%C%gLj2cjM3D#nhU5hzu7e?`K{FF^0(Xx&Ow&8oeYX8e9MqwwabTOZB2@8 z2o14#R_8XiS&-vlqEc-IqV7wVfxAtD@H@vBsEyj4X;bRe`fc|wW(}5o?JK@xU2@eF z4aCGLi`rEwE{PO!O~XoB zMe0t2!)c(CjkI*wQM0Ri{ojEgroVjY#|>HJNNH4Wen~&K1!Mo;{NKbZ=v_Um@vEp1 zkq+nJ9fMR2HzbNj!YMBN1*W6f)Mj+?L(c;BTB(SkU2HB?i|aJ0WOp z+t9PE!=S>??nmQ&Kb=I7Xve*fr;)2VpO_`ZC%e(QX1_x9xh2;fC~hJp&-31E^BO-I zZYfClt*<#R{|hgTxEYJSDRDo$>s|1G1;~@z;~lqz3~5kVx=elq;0caGYAE{Z0dy3w z74Q}64t*0}r{6a{o5BC9#*IfqL{5z+Af(`>G}>3esyVL-SY}4wP-PIeO4WCyD$R$@ zxBqjC9KS$cCH^|@V|>$ZwoX68!%hbQ%%hm#nvy?yUA)RNnt#K$++3o&-0da1dQEaL zMl}}RWsa|!9ud+p7k+nRE<8o;KS-`Jo1I|M77S@v3&|5gZ4JJnFJP#ma&rEm`cWme zHtR~U^!AK$3mZ$z@! z9qlah5{-tQMVfINxz{p!$dMqE7^%ELj(Qn1|E4>L32RYXNd1>SdrUPtg& z$L1u_@oq7sM~Y~!z+G%?-HtK6A1N0%^h}9POZ}$y3bw<-HL+{*-s(UjZLlqY z7ih>yAU*-H3Pl2Q8kEL*h+?7%02u&qMcP980Cq<1_6mtd&f4zcL9p#<^c{QvZSpaw z{#s~crvvQG2w-s5G9n1cEgqw^205~VHSKGm`;3q_ekh)BEz&(DzJ)8M>+E85aR~I{ z2&rrqxcA^8Q@UQ4fwrWaNF-&qv<-(x0^zou2i0OMYbm*}H3+#kXFayEj<(>B#U)tI zkbcG>FIWXc1@Hq_;9A4>EPWt}U@IVe*O-xfaIJ~6V67tIT~gkLe~a-T2K6fwdXW|m zz_}LuW&neP51#pK6R$>|rSlu*Tp&yQ1~>9l@CeiLmj!NM>K{E`gBR-VWY1)=)NQW< zz?c2=p51=7s36fi2v*cn_T!K%w^eFk{#PWHM{wZf$&TbP_QB4xz&_;g!iJzDay1I) z(*syM9`&Fa78wBHCkj|0=%^Ne`wiM18v)pmEylIOXCfXeetP1ukS3R!)J<`}PR{0m zO6{o{Mw^eK9~kt-+UeExJM9rWyh#O+AImR!L247(tEYZ*0?RM7`sCV{fognd@&e2m z%Tqc$)P*z8-oM)dlC?T`Q?}Xx3SbHR8PU{lp3m9FykVrv9sBO%Ti>pRbXlGy-xFX5 z{Z!dQi>ZAj8mb<(oN#0GBvX)h;%!mNOFGRvE%sH>FJ*wPxNT9F!M0qvjl0s5*H0x$ zO{v|m=B;hL`GUANO=8y6+h|v+uX$~$GBHl%55`^nNaqZI8!SorTZ@W3a%1!~GGnfE ze7*(T!nKrbQ{7_bYyZ)3eJ?H5XWxOM@H|x-rgN22tz(j6FFeN*{bNruWnZ*Yly@Wv zmuu08^-ZBGm~>sy^Cwc`b(bsbFox33>hF3po$o7Ajbo&Q69VF9l}7fBO^lq6^3y2{ zL?XvOq|)t}y`(|3HwjI9ZWPZ$j&G3wd^!?pAc6Jf>ui37e_ks5M3V%Rw}~GWKF5c- zJg+;Y{c~J@aVL#Uo^!JWZ_hze*XOpjpKKPyKpN+8^?LACgdkROKK`IAz#;kBrLQIC z^vB)dmEFyNWs6C83kd0NjQcEjE~R9~Vky8kz)RI)Qg7Ugo0*NZTth9No0@y*Hh${y zI&bRxma7e`1q}A|?xb_^ManczyKS?x^F&I_-*Ey26PhjnfQi~*8-hE3Oj@Y!UBb>I z2C!Y=f8mC&0tT21FAb&G@NHwCF8Z*>upt#YK%!kR&_aOoaYA%-kBm{Xxmr6!r-+1` z+q1A}QJI7Jn^onf5+O15+oAom5NFEt;4sV zi?`Z88@KRWBJ zZ1&Rj&K%6~1dO{F|2|ry9N%*GHpi$cVP3Sc5)wisn6r4Hb_711W zOJG(%+^qNozS*9A$nMR5LbcVQ@|96+XKO2)(H8Q*MV}XAE=oQW-{05$$+~_ej>7JL zEBx`Tc(+`WHllR1U}B7Jc<(3D9+y z19S3P`F0<$P`T<1jPGQBkk093K!l`GjbZdqfFXy}gL_0%c*nEH5478r1QJ;X8j)Aw_>qZkaS?LG_MY@c(ZZzUQc z{F8NJFQd!@z4UA|TwL_nUNZI@clGYu zP5s^Tr(`LbBlb7l(|j+d4IvV?A4W-5AFP^^e~jalCC)hS>HXV|QDfRh$}C2SX{fa< z3zZm$_3W-Zvv&tR1-mrmtmxi%9f1=`WR;`&2SY(QkeQ6G>dsz9epjTI^I0Dh&Yv6r zTnlm-ZZOtlZbL!c9bH8E0pi329hoMIKyMam()R7+(7hLG=?{3Dte;c8dt^kLUv3Pt z<=9{ZyR4=yf1vfUi{((%bR2K75dXP(rochYD&V|c?>}!Y4iBA;McZdQ zR|7&r{MXyM`dqWLAR=2{ooGolq#NtYWJTqIv3&-RX%nMDA$nW9RD>z^t7$Un+p7bu zz`BRh+6pq-WLInM9prnu9ndhr`(0- zzS_EEKa(`z`|j(n$a|M!R*c5VxH9v{3>YFU3|yA zW_nm6W%R12FkqjVw)d5$eaFkDrWU-+nS)@hbr|@svI+?D8^mo-j1i%?#(BfdnO@*(q%dpchUtv!xlNx zW^h6q?|tp-4K2c35NgPz8Sa*Zdt=xcmnbEhzn~G^ul7SYeF)r@F?iJbE9~v+g8s9 z?Np*I4ZJsa;Nima2H$yY$C>PJbQIquwas%f_$(MZCrg|g*57Ae2n;t1bZGOBPqQA` z8QVNI4TcN_FuLoKARGRZfI+GF6BNOaV@M1UaxH;zmEuB9 z2HDi_X+894M3n=;=z;4**_`>nw%oL9Z~`ZI-7y|hb+-b?UZFX?rz^BC))G>M(;dN) z%Jw!?LtxWHn`b0#wj(N({6s@KE8PX(=iH2pJasSfJH*(WTM5^@^74t>i8daJ0Uo@M zh8+`%f%q*h-xQ;|{@XNp*xJPa8*D%H`BPV0p1S3Kg^1)EZq z+rQ1wwvDkJOYj-=i0c|Sr!^375LHMRsCn14)-m8FDn^nx;EGth%8Dca^1vCX-bS_Y zn^{xx&wx1d3K8EL8MG^pP9yErn+nsQjY=Qb->Qx9zlG1j`MdRvHJP&PS?3)ErbZ1n zNBGqRG;KIFpRj`8QY1eiutiLPIG|tVJ;b5r>Ym{77md(HZSiEkz6PBG$Ol>o7gCOV zGIB&<*5(;ZL{)`uUPZkXpMXreGrQG#I0n)RoOWSj>LsG=wy}dgQP2iXXajP|#q_rv za#*R3kwvwWGeBek%xzHTN)A?}aCaqA z-A$KBO(>~rR^8>TkeH2`9k{I%%^h34?XLPPRh0=w_Vxd`d(Wt*y6;^yR0S20CS7_5 z3%yE}-U+=6NDDoL{vse%kRqJ`(h0pJfrO%h2-2kYfYJ#hNCc$$-u%x0oO8#x zjQin?J3p+o_S$PDdyL)YUe7b1iKtulw<8iNL49^E;x2wDXl7;Pr%l(PJP7}u8l5wWxMhxm{EOv);@+~iV*En^# z-vicV#n0y+|)mwyON@ZqfA|!hfv9(TUokpXa;TJzsz8(ghj0 zeZ$ZitBS}^2{QA7KGkiAjW0T5x{ZW(-kQLkgt)xvCd9JN`@8zUdzAFb$)^1?kuFC{ygS_(vtqyj( z4aVv}O!J=TF^@;^WvhA!)`-1ML-^J#wt0HE`O=}b?ES<2JY?E5V)wd1&8ZrJsv{vt zI)B)HAX)6Np`~D^I)gds>t(ptq;^M z?uvcGVQyvS6Q6T{IS^@vSSc3Yk{Nl**9~f5;(Bt|W<*eaI1>PRxzBReW$~^4A>&=F zG=z^mLCJ+V`DiHl^K!}NbRo$%oPkf_pw94DZm+M!Ou1%X$?L1_tiNqHroOF{K{qO7 zC+6HqopgK0Y;=5&wC!+tIypCkq~eYh)RKzRmBL|mi`^~p6qyUu{0Il36h@I^qQTGT zW|u?^%f}JIV3T}lJJo?V4rN@;2VfD_?d09B<@4W4HG~4J&;Y5`NmNoq(U{(W?{ zF5Y`~?Qi9PhhBse<2e?_&Le1J+SIuUcnbC}IY9#RlW?1jmxAt9plj(r$Xd;pZw&{U!f=mswm& zFGvX?zUn7^)%UVeTS3A{(x_#I(-X_M*RzGCMwwre!ofjBDE2hocaOL}z^ zKN=QSSfcv=?GOH=SosTx!O;FKu>Ds#^>-fHwV6jHSwP?=wq7VzkEl9!mA8fvBx7k` z92#3ImON;+4-8yY`@+B3Jc^=v^@?dZ1)(jD=1tYy6WUiopDB)+FNTv`h9uwWQxbW+ zDk6G&NnTnK-nzm9Lb7z`4Uthw0WZ=n{nwF2{~AR{K40#ND8oO0Jo)8({F?A9hU@vD z-G4^HJ3PV?KWNZz3@4HbJdzRIdJ3Eu8yg>*Utsf?N}L}@EOjs=9dB+T+i|s5*E@u( zy`=S??o#^mb=NVchqx7Adf#Qqwhq}jqsm;hJ9Lb$`$^r#-+67`-koL12vn6`NLs)5 ziT;A#$R$scCHbX?z|;FAw@IXktLBtX{{H(?xOe_a#BT?!G0Nv_3qR71gjhZ-;D zS11aZiQdJ^!zcpbBK)*}T3<13yPdzMee&W%2Vipcp^1x_@`I&=UCp;#b?QtwEQ}kU0B*Un+!O)7 zH6Iz<1E67w&|ICCvcMs@O`9uYp=rrFq_{cCg(=n| zOs)c|rZRS+Yh%j@?#hf}L~)LO@YIQLOwsI=p zQ+=*D!Xdyl4FDJT&~Suz3PdH={2WX9>F{T7)L$9}&7^&&oBT9FbjhsNFXCKL0~uX6itZkd zhB2jvsUx+zy8e09ely1TwjqQ=d1`sq0y7XyF41&#OS?b1UWQ-~mH-AIUie`C0L$-O zR;*nF90c4idZcn0{X)WtDuCIYDKsP0gPQz6I*%xaetLF;J`+6s>Q5?rw!6TgeDF@| z@=63hhYx@GVW2o=QGqaT_)9h>)Wf;w75EzI(0IhR8|s1mtnw%ED#q^fvC-KjsMmOH zD>M8G)mwUA{`;rEO-eLkW$Jv+M-UmjL8pqbnxwqeuhrmG*>HZYLxPW-CyQ9AjVV9x zIfn!>LxKr@*DJ&hcd{t#8pdvq82%GWts8#eSPQ`dKq>r3etOC==RL%akgkRj{Fq3G zqV`~BHnW=%A~*uxNL22Rd{^5bs^t&?{ZLsdKZkZEJ$}M*C3hb9qJs`CXi+jNY$CV# zt>Q6RaiIAL<)4l000>qs;BiUx=+Z&&qbzIVH|K*UeHL$^ww<4EMbOi9Iz@f|?Vu6m zokZ5#-jcpbVL8j(I-;N$J;=y!uh%{LLF8Tjx<+HjnyEnOp-0eR#C}~-iJZvCz*+B> zy1a+=1jX0sD%X4DY;4hn@x8*L4=4B(=!-{)zXa zo&#S`{-@>YgHtbyT*z|)+IzG@1?qQINodImt-07<-n$LywJ8R;0&XWb1+|j!065*9 zVLqbdlw1spo>9Q)*HSahzZFg$4lp(7`e>RnHX<|hKG-*+DLn{vvK^+_ zm&k?zVH(yB8b%kfnDIVGXTT|_v;#8QXXSl98M?|G%Ffv>JkbTVUQFh<&w{hy9@3a8%Hdv+&8moBFKiD>4N8a{|wp`lw%|SEcB)b9#v@zShDpy zB@hu+w-WaCMo2I4_Zrf~am|~UClD2pGU9l+7?~3Qklfhhw%c*bg7^Gw3O}4WIE0Zp z&(@GU4M;ri8oPmfJvw5VM)^lCPe>B=J% z)_e4e=5!`JW7-hw2fcjV2gc#Wf6L|d7JLS4SulU@ zr`2?@U|eAaoF{m6n4(BuM~TWkGhMa3`qG3Rgxrbk zeDXBB`8eG#(bZm7t2K80HF1?NC6NWn^T4)Bm5QAr&qBSNG(n`fFs zp>@a2Z*{Z-a>lGrT${(AGU5&p0uafkvIXz);izRxrh+^sh#IMtlV-j_xFTi>#8_~5 z^23HgmJ&Nj3g51rXtYmN#+mo~3QTbp*v-@9n=}(6a3kBXvr&nTO;AoWgRB|xx;Tn` z!N*TRqSMza6Jbeh(3R>a*T=LRk03j)Tj> z2@}`77wfPap#-51PJ^fO9xL({FTH$09Y?|ic{31i$~lx4UzNTU{>vAY)?2D&RCIxd zj01hqj|O(%L?Ul%pBnDZ&cF=Q9bD_hl(S z=rrz$;y?s=6@|L&IekndRul|^s_evTHjGw0(n1%Dh*Swu0HsBlO5X*><8ci2quN@h zlF9HTe8K(RV#RYO61Cra<|mSO?}h@3;B)`SjCKkjIH2W2Dxf>RVdO8 zm&}_bmyr=mT6B+v;#`tF=zh`QUVK0R1Hr$g@=DU3_;KY*^n5x;_3!$!(i15mv7ny0 z;PZdPZnO#CCgmsI9^lcXd)MRP8?l;vPsI&QtOE3NA9a9`ARiAI+oAczsAfE=+)p`m zx%~-w_{$fIN9hebJjrqLqbY-?x?fD!9%{>(K9Fb7))1f1de6|ws))a}b#nWkfDg$i zTAGY_d{lqSh-9@p0-izd>%+G^Qv4J#)!9Bq1V0gMyZ^*Edd{rH5&b>*eZo1mp)rRS zFPP^MwF2rQQOv0psj5?~f+fSUv0WMHs*-;YGb#UV`i$Mn?X@485Kfuz>_P4f5ch{n z;2|p)o3;4lgbWTkoh|n|K$W^th+KSJ|j-QZ3-tHsj^k)#QZvhIR8jU38l+eO5R zsGV<06U!z5pen=M9JBlL=iiwee~C20Ddv3b?@2t=(ckf{rlvYA37zgmVPV048|^m^ zN5SwbFlegA?rLcP zxsi^zOYoy!_TUI&{P;S~-{FjaCaiDop4{Nm;xl&{04mL?mA@lr&h8l>KDhM0R$X?Z zgcm7lMO_n!!*}s#7b73(Gvahf*+Bo+M)dpxk2z6%o`wi^RNlq+^wa&l@j@(70j}lH zEu&EmgCQ;FKW?(qGqOPunT=TZ7V{gnl-hb(eaC$OX8hmrzvR)d#5bd`< zak)MbwRE9rF=lEAj7U4CCriczKiqNtLG?ZDfbcq2d+TSA<{NGKARSeef5R^r1w*fc zS~h@YuE-huUq!yt?=0GN)X%`Ez^tHaL*lFc47qN?aK)&AY^Mgui9Zcrr z9U8WSfFe@qf+gOS)OY4GjplZ4AVfAITk)=eudkPIXb0p;?n;{Z7gn44p}bzu&$$<~ zo|U#Wi$%72J42T9JMu3Dj%J5fzi?t-aM62)Wu6GV(PH!89u~CGHEao?o_6K*Q$| z9f{lS^FCfHwr+)^;$|7Bu{~5;2WqqfEw`5;Dg#~8u~C#;PI@A~BI)r~0x?76+JWpk zk6QJ}`ADDF?s~ZHK0G%w{%VGK<^SsRtYLM+=u1bCxJ?-qbD5d4yq%WrUJX3(Q9w$( z*)Je$|A~Fwx{{ss(B{h9;qT$Lvh>L1iyu=GmF<^hyKOU~%OzxyEcm!J4I`iEc!2rg zmzCUy;~S4Gq zxA9Y3X5mpv@Fy}tI+e{@mHk`NJ?+bqYwIiC8r)Q}y>mM5--Dl2ka`=Zr^EL|tcq7iJK>D^Y5BB^t)vu2 zzeTjZq9<89sdN&Evbq)iV>dKEnW!8{gB~77Hm+p%u;ZU@?}4{^A>z)T9Rn8lD}=#K ze#c%sg5f^x0%Vr^4|6_GPlboJ4viRQzsrMr_!Ms!b`%S`xKJf-z=2s2xz+pph5+?jes&f@WKN$VGz?^IFLt@q|-eWrzZR)fv+-?V>F zMKc@PE+ynU&}oXNG0Xz@)IBt}vMMxk^WIINGqT8=EKS$i>u*&-*xi@(kwW|>(mMrO zh_jns$O9b>=tKTbw;}7}$A=3DaK3`_#r!4ad@nir7qu6R$6Lr`ONvw7?ZkLVI{4Mk z)8-+MRG3IXkseIsih$oH6k)nCL}`<~9gkN<$lZ$C2?I?-X|3CPuadsA+w(eUlOaN* z6%?`er8OBWG?E_B$lWf*H{JaGNBQ5Vb*0n&>j?be)z#G{;gasQiMG}iGUD&n7v;ex zJKD8@z@X0q^ob$DcQjSCz^-D1x$oeHiWq4-K0`~K!;UFinXU;1(ZiTissX&kY= zPScFsh^;F#dCCKGtxtgUe62H58Ybzk8Krndaq(57AOPxHE>z~NO>$8a_ z?aA(|dE!RjBi^#>{?pr@iEF4oPH z-&dB$0+Qb4BPQTJ|2)3`xONPShRt-ulzGP0CBy2@#~d^I$$oSocWA^3+bQGU*^C*} zNrNC;76l>|i|%wSj(4oWpr?jnOrl~SadzNr zI{Q+=*%F8KPn2JE(}R6VC=8Tb01X^_;l&pOmzLzU#l>r|j*G8!<*pfdC@jLOq}iJd z7cJx&ZLGI5#DgtTSUuRP2FXmqDxWEoici6d?bLw|OQ`n?hy_-iX{^ZIPs$7S)}l;v z=|5YZ4vOj9n!D*VdpGUq6}uSd(KV5KkJqtBHcnAF3*Y9;YNp}0HS}!t;kF0KzN2$I zZJ#%+0NElArw40_G9)&=>X!nw!R||;5Sv$l9xhGY-6igMaLLf(m+pwrH-3_8^Ld_z zX@I9=pFh9t{*9GJ2X0VvFRuqT2~S)spH55+5_-_{P5w%|dOYu9OYa8&QKLQ87c8g8 zTNWCr6>DcgAKs77z3qXk&c_5ep|Ge<#vqNrLp#JKL!Ez_@!Fuv*M@;86vo4;N$aYk zGl#4x!XE>PIs1xUjp#d#RDQ@atI(?)fvQ``k4E20wXU=eJ=-OfeQMHXm5aishmN}5 z8<)qL`|ZCrP(Z3|0=@fWzX>mwYVXuoY=yPhE8^wqlQ`Rd;_4p37%`fwuNgllfl2fZ zZ{AK%c2Zi?Jt(&p+y=vY;-mb@Y5G$Cv`*9_V*X)@!UwIQMK}0mblGI^yGAFQOp9|W zJTjC}4Ov#U{>U8NSCDLF3(DA%EA&!+PCl@8+u^a6q1L>IQ+dQTkgqM=dQFc&@Ioe8 zL4e_r#Amdlt`ogV6a-?o)5dRc4dA|Fv)a=Qzd-K%3Sa(>^8W~+MBKb~yuweGsYF8X zy*}%qkmEOAq;6FFR6T}bs>N6nZr*&W&v;^>JTXHPbyp&AQj^X+)n&>p7nUOAjX&mVNhwo7 z{a^wxpwN1|sTngvGoqHyI*YD=*VeDhSCsyWU0}AmL#;mQ`DV+2)+eCbL*i|)C{5pc z3WuEB0ET9r_q|H*3uIk!I-VI8fP7ag--dH*X=I(q@!DTb;}!^zQp8 zS}u$Fz?rthW?t6JYBg;(y{7$mHMo6TLZUQp%CHjBacQ_)%=Uq_Rf}@WF%40KZ-X7+ z7){W2dNvT|(}&uH5_ThIBOV#fjswks=I3G0GY06Hwf!BzGpo8l^8lU964g85c*2G3 z0uq0YJs|W;#$1%npEidED_p5PFqH&aC*D`%KHd=>b`4LOub~nVppHuwa4mv~RJLO$ z{C8CdJLpN&F9HRZ`;NdyU4%;hs_xtgXxEue0HaVNMmcpZiH=p&4M#rMZV z`^UuGtU~1&=wh+k+;?g;HI@I=Mwl{0T&nSzjEq+3vg?rHFCxNUm4%<5DqkO5l|t4n z|2p8KA;*8BMW}grQem)%g=yc7w|P5Su{9orFAG` zydUd-;+m2wQm^cykS-*A|9kpm_%+d`&?JwC%4<>pA_*H%yDt}ED^uYo*D>$W3DTz# zJ=l|G+(8|z29~K3O!f=o9m6Z+-=FVr-9~@0gL}u+#QuUs+Ac?Y8f)8#@)Oz1NgmdW zl1>)u>0}aqFkz+E{ykNJ8Jf!$+KCVpuRm&*$xK98724V~_^mF;I?kWSv7w7qHR2+5 z%@S87l)c4Mw?s{JH>dZqi(Fbgy>ok>DVjxgy|+VXv1U{Q1B`@99bjTWJMV8#T_ZbF ziTL`IYb-6Z5!{{csl}6eZx_2^U-4sgU2n7rT#($CWX$X+59ke3;_~51&=>fspCRm! zSX4k&Z?W0-{@~OO(}aA8C|KbMmNbMeJ1pfcEr-~1K;3p`K#kH~6*K8~Sf@q;msZ4= zflD5HWVXs_)@2N8pPy3r}Jg=OwK6e+?}5`%FD=F-|LT4DVT@MkZ-`|B+FnbCMydCi#d z1a}1+@mBAQR~yXX!Sda-6)il!Bv$yUF_tG*<_?oQC|QkQEGH`?l-02E-Y?POqo%V3 zM7A=fv&0zDnp(J6T-05Ixl~$ME6%h#&0qTSNWCs(1^ZS-G7asZ4V^@+iQn+9h<-RYi@#n)se;wPo zLc!Cpoj!F|j&(zoY+D0OBSJy9-h#M)T6zo|RAFxN~FqotcsSJULQ zTZot&o@nmwe+iCEf;=Ux}C2Fb%|_6jj}5^R4b*S!-n34hcAEb zghUOI)9P}?e^%vlt2b~LMoI12{#1xbqJE}jDiKsEzBC07L+O00m*fUJMyYg}(v$1i zNmW=dX0SBFL027pOe-8Kc->0ROXNiS$1qj$Y-4h52ZjtQ$admHGQMG0j&y4kx`Q1_ z3R3{)>+#cR`duv2#`&1Vhe4U|A%0QCu z)r%OuH>ygBjor4DqP#CXju`R8xPdlS=F)ipuSgOo=>V#v0G3>V>~1y<5Q2;ZDVg6Q z>DNo1eH_sp)uQmlQCm}~o(2}udQuE)Z=xP#{WiE`>6ph&u6Zc;A_JIiC*}P5JEY}9 zcsM_Pe#M!cWG|G6!blRKmhjzTX8;)igq@W6+OxLMwn_kXF37B~jsd@>q}4jU`ke{9 zqwcJ^2O8_M6s7OQClWS@nKE)n=?_iFJuTk<+SI#1edx@75zr+3zU(z5oXSkVjE>+~ z2lG=VrwW06wVLd;R&D|JqAgSuw(>Y1Lhoh$es198Ki~GQrM<7#=uz2lN_X7p)_fxF zOLyUF#Be4XFUZy^W^5o`v1Ia{KU{P&!tV!|Qv&Dg0ooB_q6@wQl*v7pE zM86ER3x3=+(y(CH-XdnrVlotdpRn9|`H93`-L7-VJ~>41)|A2leh zAEXSDZY$83D%@uD`KRby%6}L0N&$-lU&Mf$4z4JOf-?_*W`7-Z+hwWd4*UP1(KKab zcqlxOeVg`{RqfGDw@ zfYn``@5<(NUi2$mltr#b&1WbrEpSFeJQC3n;(?Vb#*bVd+*P5YoK4S&#vV`JFDo-N zWyoPrGbNv*2Lgds6TSUPYdcX$yhAt!>>q`JOoSI-^uIoLGceV9@IcFW__v#s?&^nM zYQ|-<2h={3Wy%7sb#X!h74^xm)Z#7wb*aenndXZH#A%6q&w4aL<&{-5^roVsq8^r- zTZO_JC2%P^sZL7cq7__I>+0ev;;3LmfAknne8XR@M=4woFjmka+(I6ZO zjw8o?nhB-D*Y_1K88x*mO!>_DftqkrD~GkK;HK-VbDLlYbOm3G#|N9L@+AWo)}l`S z1_cECn8_f~0?_`Aj<_a5H4DY-r4gI>GQ;4aINA9d6%Hw&=7^@DaAa{OdD*?iqKx0Z zS34n`@Q<7uV-I{^1L<%^A^4;Y+_^!WBXlo?%so9V*t@VYy*t zUCv9r`>q@dlnwD!b-Lmd} zd)eZ#T)R6KgTI5p`#(%g@vE=U3gEKbi)%{YZsAzOedN2V?Fq=b!=0`BK~#+C!vi(i zH_rJFn2^Alk*{Hy_R000HI`{Vm>bz8#!_U#D}lw${9t__-EOy~msLfG#S#?!pfymh zsK8H7wTjhH?zmf57%5{bYx{kT!O+%*%o1C3PpRlA_^#o%#3@v@kyn#As@m2ev?1Tl zl}$sphHu%BEbK&~eYB|~x5}r(oykX2-}S{rMZ$itmpkeRHQuCw)c37esgOHjSX{L9 zFlV;*Q#m@AioMPq=D@?(=A*I{79sa_$K=3wMu4p3v?S%$4Ih8)jE&huMUY=B39mtL zey5=fzvV5l%lY0v16|;SU#uW8K+-)E3-hVS8RVUY=se%N#;=U#d_VPiDv@D^RD2n{ z6MT;w*DA+M_gg?_{f;1|F&pXNqqAn_oZ1F$ew|44Y7Na%*P)0)w~MdJZ^o71bC2;2 zKO}~)WExjwA1Zs`Wxn;MIwAueMXqJYy^-L12={ZnYW{V{e^vJ9#~H0Mvw&+ALC_lJ zlvPNMY3FE1IkaymIIi{4=;CMF+EgM8UBk!+>=(Pn=yESxyLRkn9@NGh&5teFjbd_tJ57k;032R%Y<`YfMQ zH(Z>N5B48gb?m);9BzXxhAh7x2{a^vzW*gx&-M#1{bLOX)gEl!RvIIB%~A z!p=@&?XZ3;R&i1};`AYSvzgzarnXju3R#8mi6&kP@h2onrPaCyRZko+I%X;FyZZUD zU67Vf>{apfH6n&`06F93-nU{-J~GvPWw-gaG^uSxljeg``48q8%g`}9Pp|)8=?WJY z4jteK1ek7kA2(mlxs0sJ*Kf~S`#sj3Tx~^kfij%Lx30f21Oiw&X74pb!9c{=*jTdS z7V_csH@ytaDjD}@b>i5PCZrvGfYr7UK4WQ{JfW`{(zQ9Y(~&H+a?^lhugvziv9txN zdBV=5Z=Yx}jf!a7M)9&q>)!xBy%Y_;JjQ(iQtM+hhqgVmBsu zS9s3~RV0=N_zK&clTAX(`z8QlX2NB{z;lhi^|m;+hDw0(Vt20h#_^A4 zMo>utZ-OCW8HBugytzeocD6p~gn@KKUi@iu)i=`}Xx=!eQ#hzX_Xm+a`1BDA1K>7c z83)vWtNmY6TLRVZ5FYV~Infu#dlOgw6Hq~6zDykwvZxC%=H{aJ;1WV;#OGc10`BK> zaor5TDnyb~>jBlYF?we@ti{?9#w4e*y8}9{Y`=dcr>4TZ>)3T^V^#Z~=i_d!uFtRk zK5iMCXu5zLpP_&B%-{UEO>!K|Lu-x$kY`bm9@N#r(0Df566>#2Lov=_eWm#F!#L*x z9)@J<6ghzKQ=+q=0_pFMK-Nv11+N`0CSL;}06;Rw+(g7$I03?ef$m&{uN|CR%Q0|I z+~WI5RCEGKt@sR|UY~FNT;aIc|3?XKP6@$47UJ$#kzQAL74f8sh*Yssy#GyrPt{Q+ zk%bjsRh)NdY4Okm(69$5q}*z8j2t8EmxV;;Ru(2iAO8^~B_+MzWfGJTz|}3R|I2av zLb2#520d|v>}y)^fh`PX(#p@ysaa@Q#hmX4+Y)}9<0nvi>q@ft7@sMXyYH53U^=jD zx8skKIv*q#(>F|_p|qSObLY}~ej%P8=hHnk&J5CP=ID(X^W9$zW4bndG?f;_3$162 zZ3kH2+vG^WSy|c;ReDH1PX>Mz@EM}W&+AUHS#w)sSdLYw-(rGi;>L*}>Seg?JKG}9 zdj58AI`uVU(?AQ*TEY|~$SoLb*o?AI1z8(URO=t75-w|u3}ZO zsyR#T+#C9!j2#X_BN=O$&j+mvua;kA9JmSoIZrNRAUoBu^1$f~D%l@!!s>VBccMq$$bR z3&pNKs%Mz}RE*6?GOJaumB{YauX?7&ZAhz^L#?6thTh67 z)jn@t42=CWg;!wt=QFU_CwI#;)5_vS7mc^ zkfxFD;AUkPYBM9QZlAA?Loc>6wW13bgj3LwD`%zDNzu)!iQ`Mv@rV#QFyrANugKW= zL6)7to6T1zcfcE4kwT}gPQKYyb&yel3kfcvGNO^^3*t>H|9LwjqoT5|ezyCT$gSX7 zDhhg3zOeAfL-sCRp5(pCRQZ6A5GW({&nj&F*8p^UhRAyd-PkJi0#|3ItYlV^gxlor zt2~9hDYzcIrfSAz@KkKpT7YL6bXRrX)D@)i=TRr7y6EuO?}IsnRTXsYZ&BznY%6S4 zD|XKwSaj`LK(rsq8zt|Ds2e%Zr9#ZWjH7R+B~m}shS5|d%h}fHn zfQ5s(baaLXH9x7{A-N-dH&ct2A%QlFdh`xA4^+>>j9=mXfjRW6fJdePKlcZ2Hz8&! z^*9{?^*C!?u0+*1Kw0$V_4w7Sl^pQc`1xsNOqmX=E@yaOBKM0j5 zms;FRsE{o#6kfOGvU;O@&lq!WD- zx;)pNkRC3bt`oag#06Psld7ni4*x~>15_6MdjX8II1Ac1Iwgvf!QR@!-|Np=F;Vw@ zp=j#PA4hi;e9C5&RgAd(N2`aH#&*dTaf!~ck>zPzMV%U$l{&ULQ!~-EF*Dh*Qgmb0 zoN>vDCi@qKUMi1$(@yG}7ZLFLx3BgU7}JM5X5*F{`Z9j9@6=ntyL4W>PtJ`n8wnQ; ziv6Hr+u0JmjeqmIO5$|A^0xY0-Q?@G&fFNQmIZMYpxQE}TF4DXj7pOTb=uZuV|qld7dt!<*gi<8PgTEn(@Og(HM@IGn<+^(P<_Z_PNq zQ1co&$F+Cv$v(C`>bwYHdlfe>8v>d8ous|uzFDjrP5FD!TQTF-9!Y=nuRID0qrIYE z&rrcz!#3Qn&w{YdAP!`D z2+AruHRA*am1+yk;9&{zcZ}d9x3bXro#ySDFP|pU?%;Pe@n!s=5J_1J;TzdIxtg=w zw1iuOhTb_@n!KLnSdSbI8E zQ6q+PVbZpIde6svw9wdy$4M@Js}tww-aVn95X@ulCPc4k4@V$w(VHM-x2eAq_2h-` z#>HY^)|^u>;+;J*jarSPH@}rHgtdY16&EQdF4iQ{acp;>T6Eq-|Kga7L=O3pEE$7j zzrwkxBZ> zcu4bwy>0cEJ}XLAH%1?7<2W-D!re51phr$xQDp`?_R6nK^qdkZ#A6mAYXUUMGK9)u zHfXn1z*I$3xcimDZ+*6Mo2O#fP%_KQ$nZ7S5+jd~z2I(533hn~{gJ5PO6f`XAueXs zUkYma*;l+N!jionA$pHm!2?yYCl}n!+mpZ$R?Yfjdh@NOXEk(N^CuRsw-9-Dq>7DX zyfp1~uq$r+Ztt(!X-L-Hb$TYAC_PG1u`FS;q;0kxn^o&|OH}zW$bm}juJE_=%<@mS zrex1!c+4V8_8lj2vwQIfw~oZbp4C^qB0GA~yv_EX=;JdE@Jrc4Y%?Fbk1tfR_0FT> zzDrb{W7c`aNL|h4vK-RCeD+=_F1IJ=>=XI(y}KcZ^Kp%1Ps5QF4|?2t6Jjapyr(e) z6Sw%0{}Dsjwo~i#RbaDvKgDM!j!bekWJSDoPz9%@Sgv5!{Y?&xQhZlQXAU}iOPkhC zS7MJ12oKdyF8@@89&EtF5Ee~3rfu13wwz=86UjZeH?z`6YPR^k?yLGw%HnRp7eGHx zyAF{=KPEh*vPxDPoktn%u@3YUN(CzO#mc_WGUhE)?15E34LAr~H7gk5?#?iGKi-tI zoqxv>F6VS-*~hqVZZad{(RI% zrCCOn+6;9({xi^8bc!&KpXimo09+0PQ)!nD5RUwUjn(Gfs*+n=vzb{kv?6ODpU zW7eG&e6*CuNf>R7<~Pmx+9=%Vctf|mB}I)pwG951Jsb*PD`!<;8yXL_G<%r=>-M{o z!}uj0X5ft%XP*ef=-z2R4k=ZZ0YC3ni~^q3J7~-u{ZUROYJR!SIBqGdt9?VdbJ~lq zEY=xyxUolaaX1E-aUnM#1x>o4ZKsHQBD!jm@DkKXeh9ZBwK>f#@loM+{B`S%3I z%vl@+q&K5VrI{VJ3{p;m66SK{A|;6MRxS4Pg@ZqY2J~(_>6uk3Lc&EV{bkc zIQPEODcqn@(MG+MTfx<&Ypoxof|dL#5TAa*Y#9IpPDNwCiWw#cWv<^V#~K@UfV0?| zH2kYc5F{&~uzF;xLwvs5w;Mq+qK$=ysSlUTg$sQGu4wvgd+WjU#0>1Ym*~cQQ1SZf zq4NpC)Xfjm+wasCO@pDO7wXoEQDmNF6_@&U{Y=}VvZ#`s(e6_37ky(#84JwNntJ6W zR5A1ovMSA&<1Dl88!sZFJ-IHtpJr?IR^ROTnuDiFx>ZF%ffJin0F!2A6d3v(ID@-! zFCU1`#*}`Q=Ksb|OYvYO-9QYNB!aO54{0=hd2Jq^V`mexORd-?*5dpVE{er&JhfnX zmgNvptUF)Q`7GZG+^~!>%G8e*4DBQL#KzNDym9%}O#Ob91>=77R?*e;L+`@4tnt11 z0EvrR(Eu8U^v1S$PS4?*xrejqN zZIEujn3}gWHSNskdimM3+70TsU1+TNigZ)L5n5bv&_gkoL1Fb|$1l#r?F0N%+ijjmI{%)jg9cKJ!u*BHp6LQv$=N#;w%3@W^vXGk!PT%ML zCQ74!vQvGR+)8*HP}py;HNM0wBe5%0 zE&kTVHlr1f<=?htI&xwfM3G1a3*>_%@Mn?2@QFzWF*@&WtaCDsS+6Iy3vET`f?VKm z5tou^FsX+jo{m9T!{cb6gY{w6*|T};VtAZx7%iR4{t(|AvqL3brLTO$s|x8OSz3N4 zdSGSMUw?A+q#n^GCxr(*;#MQ$yidO;!|1Yh7~tihCA9a8%g=VeeyHPp_b)d8SolGb zlU>r%z}}}jMxD3iv~cu#X#$T$at3ahy&5#I7kca*{^lCt^`S4Sd?Z)oQli9mc5$_~ zAe&it*catYt95oV{u0#Vfz4p;wk`50lW6_r7u@IaDC;6o`zw>WZte=*$H^h6{9JYpkM=uUU<;)k?7a7y_pcH=)HmM zXzDT6MAFF{!%-Z$J0^<&p=QD~f$Pzh$tDh0RPv&9xR5@d@u7rqnI zy3P@EzFxP-61AMn{!{$F8y$dz>;GW{$pnC8rktT10H6>G&gM|ixn-0POAb{aS;YYW zbi}r-hZpeW9i7V0RV<_9Xb+jF2H~G6OBBUSp1ifZ~=&P zkC}4f76})z`0qv@`#)O$HHU=je{K_p|DPNGv-f|c@&DED{IC4?|4wtbgLdWqbCq$C z#{vKx3jdcwBjF?V{+E$({pY0q_mfDR@jv>BHHn@Mc`P7gkJu#M31Ed-V&ng}M#9CQ zNkkR3{`pNx+Hwht6(KH-7XSNd_sSGWXE%AqVtLl#Sp2u_*Yv5X6Nv83mDhZ&eZi-u z><=H?Lc%6{j~Ky3&kuMX*sYR`tz{YBFXl0<%ldLS<^&NWxp-omgJ&)sO)!ld9)m>dxT|M_z z*Ttd^A-V}t*q9Iup8ulTG@}14;i7rRlwO{x(B|p*2G@_HT{v1B`ymzcr%t7kg`8+p zVL|5r=Cb|X7-Jt zT2$O>#-;CXsWr|tc&0TpK95pu$c_GrzjZCpW9@y~3IlzM5eQ+Yu`BxMNAn)V^{g} zksg)H8zp>h?|onWoBD)0mrDz@%H3J`{X%|Jc^K~}TW(IMPmV_%Naah?%Y~gtV8_*_ z$7Q?>eyj*cF0CUrP-vxFYk04WulGm-!p7NFX7pBP`JK$zxWf1F>z{}tnGNP2^I=LD zCRmJka%H!kLHcjjp8M*$+jRlqOFYHt@k$?5H}92mRc;Dp=>Bq&aOs!$Hfx)YN*H+l z@zVPx3NdnYT1|W4QNVWG>Q04x*nH_}?CV-bY|cH;?7USX3*fplC1z)WE4sa%YG8_;;B2#}2x!6O6hm&Bvj~nWBBEQR8-uW`{YyOMP zq~B?sR*LC&B)JEN=iTP|Zj>g}RLH{^R=*&w2g8F2G}1Tp&u%bI!yHs>hn4mfONPWO zZ;ImW@eZ)F9>b_3$}j(UynW!>;bL;GJJiuPd`~8=pO+*z6_WB2`euvhdT`+ChKu}R z^yfTDd;{w@s_}m|#E$>aNlzofpZyqTcEnnI^#@Zx#+&%F-%$tHM2~S%5k@5bKW-9f ztOwtQRhJyB*G+VU&QV;mhDyTfy>a86tfliRvHkH^yxB#GpKTB&mL+tljg6oXx%LNv zHa)!&`|PlwR;8YY>K~(=H-1KS&+P9;y<9uClEVMtzpG@a?JjX{u{%>CE*X)?Zdj1qV4avbKk4aRV@wM*l_@)k$p9S+Hd@MPa4} zhe&m!*E0rAUC>JOr-9)w6^mdRYpduIS1@6zI&dAFDq5f$g1lCZ${>1+mb8m@Y%1q< zY?=}MmVWuP;LPy`g&(bkcym*2@uzN@q1jE>0B5e^ zJtJ+LgFFHQ*}3t3o-<2hB99t)!!i-C6~LL(6Xny1^9VkC0^Ug-<+%n zj^iM;;1$9PkIReolIE6dJfGsk#@F8o%QK6syI)Hh=Q+7Sec{fnEyUHm3(S-RGFdxq z0}q^p&k^{{L@Q0xP2s5X3Ds{rjNURgOIN*qD%0az>*RFftHTnX$n5TAgO}I)2IfP8 zlYjBKfhgr(ByM^pRvVc}?sl#SS{HXcY3ZfDN>PTqG#HYa@!IXB{CsFvGw1Qw+`@Ed z-t+t2AHuuz$LutfMb@$aLOpoAyTptxKl1kMIB!kV{W!kseBdKIr|XZeHdXM*PeTK* zx&;|Rk!6P8Y<^O`EQ~jWWWOa{+XweF4KTDbZM9`VsiQ0ZG48sk^)H9IV#XC{es88H zB*F~(80RY9dh?dp{|iPurpN8iL_UW7%iM?J3yQaC8$@tivHv#X0_YF^yQzo$@h3L` ztsKDpUt@sre+x?S|9U}3E&g*J&i&uka!~D%9=0|5{>?ZjZ+wO> z7@g+~Z8RoN5r}sEh)(`DMxMe+{(roqC!zlqf_C=j&cA0K$SE?NMAOd$Dob6#V?Tk| zDu6%#i^&8Y#Qcx!Y!!v+kKr0F1$hblih)7=&V@kK;P1A1_1@*io(}Vf&ag0j57 zDq=6ZYRogg=d-LyVQgH%B_Exk$&Ib2**>i=z9yx@9X{||^0FIaugsM3O%Ofq_aIHP zaRYr7E-v!&XE!Z)0OE&TN#HO@4gl{yb*XU;ZKeuh@&mqXi-w)Nqc?#|TaW)pnJ?Zk z?@@;HAAUYKVV~fy7M+k3BiT8P6W}R_P=3+SG&byieyQF>9(9(qHMk^}g!kC|4Dh#P zfPHAZu_10*dvZXn^M9TlYvbPBGb|?Fzr|?NbkSQ<+`IGx@IRNh^pwpSaBmh1FZbl| zw{CWd#J2PHXXa3#iDN#=Kwct<0I8X41;1N!NB9feDia$vr;ubyP|$XZCp7JW1hwz^)syQeFlgqRl3RN?>1NG&jJ45adAsS?)0ax><}5& zG+b;{0f~`gdjv{0p*njbYQg%YSp9+1pEj56YE3&eddZoI-WnL_yEU|&q**Bhfw6YW zjY!y7@RfI2&YTHnwhUsOlfGexNH8wY?@neXb`-l?tgRb_huxwd4(`A!S{DT$Uk_lC zqL-0T`c)5@$Wn@pscF>k@3Z^AezH-!;pC;9BChdkaR3ZNklD+?sdV&Ry$wXb^0(d-GF2v-1> zJl63)$W|4CMTIwG3dG!{v7=v=pY$OnAU2*UF8%ihPO+NRnynBcD0j}CuPcPOVn(|B1zrLw^58ph{uB0{Y0|GM2yEs zzmB@50ixQXq7Ozd;>=;L_j2&Qka@|%jX>rV*?u=>iH1sOOZqXlaWYzajU8|sT z&=*GVdXcNtu_K%}w#KxaEU9)&V{6Ba8gj?#Jyh7+JygsIR69k>BkK*kXlokiyliV0 zK{+Zd?!0d6eBG;+?Ir}CCfyxluAO`hlqsd1d`Vsu2w|@_4W1OParRbAO)r)WeNXnq zj+&Z!)e0j^y^QjjHEvPY4hLh9hZc|7Mo0NpV!KHSZ9}!>7_8AYAfpOJXnm};?bb97?Zo|Tt`Dnf4^`055fB` z*!!!|Tk>xZ&mepzOinLjzr7nDdj z&M6kNI}E*7P@I5<{0esEQKNfE`Dkpge?v#xZyh{uY8b=2%`o40$|0Z#>afEJ z9woP}N3dagG2sE%7^Be>-UVMZYbUTb5RlMs0hBC92jhfKnkGYJ}uIx#ag< zq8c?5AOy_%j)CN^Zae5!#37KD711`JG$7#K{;{ya2M^*%sZLv}4j|=B*O0z`uGglV zR$CDl3lZ>l4_&X!RF`Npp#zt@Zh*G$%ie56?_v=Cp6eX(irxM`;NR6-LJYygfUI%@ z7&c3i_#aj+R*C2$HYxD;-A52cDL{>WsnV_uDAAQa`&2ys;sG8o>iajDhxY5fmr(lz zu7^0i=wYpg#xfD8znvQ(S$5d3*05C(MLGtNndErcXW+vrKbua{g zhu%YTZfF27VLR|kOtp+0zog0NSEKY`-kOqAT?!RaJ@y1(5f(*^&8N8s$^JoF)&$n9 zHyZu0fRog`P&u?x00_V+13M6{gC1|OT-`1EsxOLD)L=l8W>$OWY}Lf^SFzoTY0Fha z5spfF83f@r?$%?`S_zpY{u##WUI8b}01r!c&KsHgHs^n`*AVN#iR;uQTj&S9BY-_Zkt$!2D&r{(g1v-L!e znSe9=AZDKS{MBl3Xe#lxR~K@k`|0%LEBQS^UtWSR_k1wpf9k&1<(E)66{!c)CFpJA z7baGMpj?g11G__xQKndg3<^8)vF>_K#-tcy=2-fZMR6G`SXnAmvtH01Q#*bt0u`ms zaH_vp{Era2${3@>AS$co$*M^|bE-K#I>AacPZ~))qm~catxBqPwdt9CnyKyTUQC{K zC;aCIna1kbo!kbMIw_Kn9-n9Sws`DG0md^lBSf$) zPDz%?8W{FRYL_FyhST~wJ3lrLZXX$T!hEGkJ*)6WR~$EW3o{=> zCw}W}U?-=l^9b?c?u;2OMR|~dfP%7QBefzav!7S%#H2g#XA`5InKhh9nUO#&M*Vcc z>ELXQ9%eRG=p1svHGY$n^sCJ!uCj6~SIy)kMsRcK(6BdqMM8!!!o7IU*je4EJb<26 zy%~dw@v>V}omL|kL&Qjp!6s}%kory35Z2K4TLLg=w0b&|N@)H&T4__6Ry}jVNWqDO zm?PI5N6dIarV{qQ!YNe#yscsWS;PEl1pY4t@co>^8w!Ot^QEyh%!tys^U}BzW8iy% zroWD!Pa6N^KKko@H_`8b-+#ZCcl#qpDJh}xic0jn^B~f)ImQnIZxwz!*&dmF%3bJ~ z(>m6lT0Wt-w#El`KmEXFoNwSwWQ`j7Q118BZElGd4t%}QmkcrXpRP-<72>PRqJzy5R8CbL?Rw3`R>3nCTL31<0Aj5$wS_%do-|rO6yTF8& zjX8^GEo>~f=sKSYYpQ(-dnn3vQd#VRXda^6Ah}e@bFO||j9o2S`tHg%)IrxK^XFrj zMReyPH$`PZLUd!$?!*aKew=D{!Oq7IXP*j_8ee%EWxIV17DISEk2HA$A7YeItIc4qwkBo+!%qT~-m*IS??!Q?V$+#pK)9`6rHv@^ z>_9oasGm-Ty$%f;+Y0>j#K?7Y7pz&f_Gyc-w9Xt5x%)r;r zb9wkk3vuz2I4J`3{5N(u8w0?Y@4cd@q1X#b7zgD(@y2z$@p90(Q{?!<{Axt7;OjeA zR(u46-mMmqLR!`+{3F44V?5*3V)m z??yM-Qjekhb2_{Bwf)P#nn0<~Qqh(=VW7ZtM7w={3>9w&_1(R|x%{JYPe zDXb0t?ybNbOFIhOr3S_@k&@d^_OFdsekbhD&W6dGo84L_Wqi)hyEo7?4`i>u-+|)n z9<5~--6cEk5sMJC0cbsQB%&GJs^dY8JPD@y~Yh zmf5%1ZjIemkJpx4Sh-n0Td1t;R6aevw|@2^MQgFj78-WUU!#;Si(6lKT*0Li_)uKy zrE92*dD4e0n@8k)cXZJ7buP1WZaN9em-xPmcf6O|cgwlLq2Aj+IwUnOxY(E>t)|>v z-ky5W!K<4l{PAa>EyurLDs-Rn%_%_^dSc2QGSoPbd0()P&CdEz%AuQVoC{q3lZ}^a zWaAk-S3{}JTUUtM_~#P*jCZy(Bp>Qh6mU`));)iw?EB2x?oT*sg(6$@hXH=MM-TCpd5T*6q9UtFi-EDlJayi| zI-*wIHkJt{79^^sa8eumLetM8#@ZgevCs4x6fT8n_*U=49yg6X+E|wKkN11~`)y4Y z7^ca1FFr_wc{=U(F-ZG7b^tr1ot`~+ek@(++yvTdH_XxG*9P`p?fA{c6<+&&?%%$Y z3d-cknX40(xR0go5)VM^v_maAhIfr%+>KsNY)Em+iv!(vJ3Y__fgXF56%t;Fq8Xr9 znqaxx(;Vwr6bYy}_|A|v(?mc?(&X8`dYUk^bQuG}C)IDWl|yFKm_v?jtaG=n{h(** zCDi7W%+&389d}G8u@b$aj*-k@j zTzsMrsc(-lg|YkPGiV}uaLto7ALmGa{!V{q@N8J%r`(Sz1PX10FugisFdwJF1J`AL z?iH!xM@nl)6r@jj(F|l>P#ja*kNb*JTKyq?p~{zT>7Mc;t9Ftbaw6ReWd4A6H`kRu zn`dwU)Hh>epyuVLn{kusKN=s$BsOYsze*axNO5|4D$Hd*GwllY_9}i4lj$I`TMuNw zu&)D>2U!G}OXQbXN>^q~XFz&*48(pT;dCBGneM6yGLSY%CJnoWVr7=4x1~2EQwf6Z z8(iEPkc=U8A7S-sgYh5(%!dj$MWE2YBX8TS1|FL{xO<&+{paVZubFHulm5aQ`Rk!I zd-gSs^)zNxE0ZqVGZHDXStX`Z`iL3xu;RoqtIAKP+mv1OvR?xDCXTpYnaziGcPe-5)GQ93DvPLX*J_rRw@cLXuUBlDfspC7n#`!$#vVund4i~F6mHeq+-zB)s1RZ z*VSRuR+GT?C0r~}+$DPieiidQDmE51EpNx`QM(|7kZErUtrUy{XkL*Ju8I=YA(SJ;gKp^H000;?i1U zeLI=|en~TVwUg=((D}0HXQ26jYLPY9M;~PS9vax*wWSuLC3G#rkbI7sPyI$Oe(e?D zvyEtvfM;Imek4N6@x(uf=4sOvj+-v!7pH<=kZ#iu4*`9dLg=ne$|Bt_Xup z{(Lf+wa`lGqEmmIzi`St7u!ZxPNMqIY3&?!-GRxvnFZrHpEx8_`{)5ZEXI~xpKMR$ zLhl+ywGT2m4>NeO9K9d~kuPr8q0i1gowKeovgThu$`y5Md{bU^g$Xnr}t?fP0s7KP#v>h~(2iXS7@kUQ$=nIV353E0z`?ZRYh z3lQWUs95*Ir0s%ZXE*HHiRE0qDkF8eEVD$QFxClA*#1rLQ0sGPn+T02gKVQ4n^&jC z>%b1R*n`eSeeW-u3UbJ_u_{_OUSoZ`R=KWqRy-#OngZR%sWCcu^(^@Ad+E<7?jFS$FNN|j5uXAi&sXx+_)F{o}mX8}dOZ?U(pB6S!(2vWEMfySBW7i&pPN+Enxk zh_alPy8S04r(xh{`CMvL`DEUHKBSo9!tF!^<0MogvTGtD+$OG2LgwBw9#6*BB7DuO_$bcUTo zqE_Vg_)GN4!+0>sNOgbLx|5C9kXz+G2Cs(vuY5i!vSnw6ZKiIu{W~Ff&pImC zwhw|P-|H0@+lPTs$x5|_7^DfRGk2d0>+Y5G-|gDZS}7%Lb2u&ZE_e4<@$VLg`1$OT zm&4Oc66~L6Y5VT>b%1kMfbb^6x(NmEKwXAR2Cl_-g}gh&WE%Yp(^Xvw6`yYRMtY!lWt3S3Iy|bB zCW<#l3Hufv4tNH5<@zv^k(J^sP&{6QU@vTuRsk3M8)z)<&!d`>DsW<*(xSPB?3noI zZCz>zJ!j;`nXafiDU8?rYCtrIm3V9PBDvV_>SsiyM0$$IFcBvHDm_Nnftdf@dFj$^ zYi|MzmxQc+V4EMc_uPyq4z`9g4X}wrThZq$*j(m))2;*_^BD0k7}FF<`cY1#lyv zh3C>k~$8Lo(#Ai33Ehu_9yqcib%LVEXmv{-*G)*JGxYd9Dw= z@W%+vCZuF)Pq`v7O`!k9>#j|6qo?f;Fs;cLw;QmV#O=wkB~bo*jY65LxI&q?r03I4 zL{GlL{RKRtaj0W=rD4N-qG2s;=(kCV%0NyGas)IDT{~nLM%P+lk-^X_~gQ=6St?&vwNVqm z3eZT^JPwyBvd58#$Vhn#yD#FR1;eY})R zGgWlp4b-V~3k>upQKAkU#InUxFn;5h{_s#ck3wkG+5b;I5>OKZp5&^J0uIyZvP z&h$m=p3+1+%WTP1VN>2BD-3IZ`9&xTi=^1yKe#)B3U-l9tdaD*W=c^Y`EV9|dQh`` zcp@Q*0zN(U5DrknY#*Q$hY4=6O`^n!1}Q{RmyS?NFw6T4VW*AB`lXWn9{)p-4;};NPcs<+$igT%Wo{IODzL&vK^zF$KizFzuzm`R?u3>sjQu{p~~tDVOA?!7;{v_`USz zzJ(d5)_;|`VYcwWTn;I{pHU-*d&mDG+G)t8x>&TkubLzL8aY>5O=<+DT@nPilAt(w zN{DqUwEkI;_YR3MycgWfuZxc=s@(si30}_?;xiwOFJ=>S)f`vGD^H>zW!lbjJafM zDMXs-a@qCkeW|3;tL7&M6m4Z_fT)*k@9-)u%aRU1sX0dhP7@V?o=|pRS|E#(E1_rL$N| zI*vhf1ylu z$t;Sgvi7T|G%B`&`|efou=Al|RPR}(=+WR@Bm}0NIsP|^^m^$*@be4zr*irOpQ|}d ztHs2@ms*|^==3MJ;(W+M^i_#~SjnYzyTp&ImPC^)A+wMN-wjGayx{N`6ImS@yD{lW zm}maXgx_wOC4%nuLr1g6wo8rkK}3gC9U{l?^?H+*E@q|!^fc(tA9U3I zD{qHmB((~4vO4_8G)4#%!a2GviGTgPUrL}^%UE}te8One#~)WC#h`=&Ko$r*f_(ND z=XVPJrduBA&+}Pr4t9JNP##ftv}B>A_3#1?ul^zLCZZZSU-}3q?RW|FrI+C39>)v_JJk;*mn>$V_sk^<%4^H7Xl(^v8=Ay95Hd*p{Qh4`npnr;521K zWx1Zy?ydtC(NMXVKWGu7EL#NI!TJdhw64rT#pZ?p0eP!CW8~_FyL=*Xd3tZZk#bYA z5{Fu7&Mv2F2xfq0CRUZx^uXMe;zU{|g=3&?aou#drP^2XteyBh;^qxNuz_(@I2DLD z(flvb@@+dnzXe(8MS8Z8%(Mh;A-NJ)kX0!zA(pWqU1OyL?|z&(qr#rIaY~u9wZaN}4y;#$x4!Qeq7b%JQVJpj>*<&-3iTGDZ_aD;#pj=RS! z2K6DKeR$ax)83?B#2+#fA@87tWcp7`);L6%U}WL7xowa2srvBW)$ab0I@B&ru#*wePf6)<7*yG04X=oMWd(Ljd$s~O}3^Q z5X`OvBrM1o{un!A4bf1T(gk|^tZ_lwkMvHfK~}D}vq7GV!no|C!aRXiG}k{uB*#-I zphGn(lnJahO8lKQ&gIaA_7kmvV9}FMi@CgwhrW==$Rr7w%dOdEqIQX|lKor3V^V(x zl$9FRgGY4a6NvQ>wlb7Z?XZv0)w^WT$sgLck{I~{6#+Dt? zP(l<7%CaZ*aI^lN5^tuJ)zo#&t%x-%&RIv{3Ne9c!I;v(5EY=a5se&Y7WZJpFSArY zeN)>1oUxY@he>jg<0t4rQ-KWa1Pp}-b>#Gq4ATb*-|(FwTddL-3#=4=JYx*_uMJC4 zoJ!9rmF@@I-p#f)RW;v8^*5}!;!1DR9Bt+^9$BRxK_~Yrnnw!bp%+jYEYfHlzqLcc z1^b$HjNluvz;Hsk3odrzTfFw+wLCXGIC(gA4FhideZ!(1omS>sjCI(`(8*HGX;Smb zW$d$Kb8BQ>FI}6kjaAJs6^i{VfWb?oRa-3GNFLGH9O_wc&0;nT8PDzmZ(DHcopF2B zW2{`v_Rei7oOi2+W5>8}8ErX|rbpK3y^&~*{t>;uJCxU}P`K9lYc-LY^$oe3D3O8@ zVYPlz-(b-Y-+nY9CZb-E*ZOngbm~8pTg&iFs4W5afmT&IEkc+6ZQmpw* z{zhf1`4>8H16VwvyZ4%{RcD<@SDGcoC=(N>{?S$H>^(oBJOd$T1GCxwCrUQ)U<6j{rFp2Zi`h$&W zxgMn!%=43v{_Yg6(4{CCXH(cEGIxqhZl*H*6p@Y!pWj>Ta)9G;>q;o@8F!9$@8tfr z?a1}JVSgt~5n)E4r05;KW8!8w{xHkWKpuItusAU)4zKQ;Ly2@sgo}r55S6m+LydrY zU9j8p3)yV3sjZf(&Ku$5qmzhwno~U3n-DEkyim_}cou`rncb#oV5Jqd!42W3`AR%0 zz9eb@xd=X1o7hc#F!nJ3FtwWF1NdOoI)@?b-zi%XnfnoB1ZxL`<-tU+$G3Xw75Paw zka|AWef_!OCCRO|vVDbN=m;}oq~JkkIhzWonbX*qaeJ|oUlxBT_cD&W&)heK+(Q34 zTDgsXBV3Q%!ToOmVNm0Ng!QqIEnRcWwoiq4+;??*S%2S0x)I{U1vSzy^oorWbVTA^ z>RWmItgc+H%}Y+r<9Ze$hK!8m4IyU7Lg;Lfd^@t_E5-cx|XS_oZKlQm|pVXbL**-tEd||qwKW?bIgie-YPULl*cN!_&_d5(ruX^L40Xy4N{)`qE zcsjTOjyRHop+43J8db$T{@BFZu1@j!AFPpG_Tiyx0*k=Q1bzj)Tq|J{B9Kf1AqS;& zPwWkS2W%+m>=-*1z}~gnOVx>8SI4{~zNs6J^cSeHFXc46Ejv0E;%XMY9toeZluf;q z&t*#JGfiO4FO_yurS_`fbgDCM7f*(V|Io5Jl=HzywZr(8XPw0MHqH!mI2VtAK-adfIv0Nr!<9nx~ zMn1GG79?};be`Bu#PiXEFfSR$`@tn%eqH$!G;c(UTLRxHD(r0I+%eZM(%*#%U$^eZ zQ(*;h4&=5quIYC-xxzw&B1e|bU~AdWDew`?g=RM$Tz;*6MGRZqWuyr{iR;cB5^FQm z!Mt5L-*IynD+ZrxJ)QAWQWIXkmA)O09A>K^GGCegdM+2(jJLq^ahu73tda3f;s84X?C!yBss8+d}!^Y@luYF8pcz2vpmZRVcga0ZXokFo_f zfunPQH~@L3L?#lWP^*4gbg<*WQxEHk(uQ?7sc_<4UM_*c8+9G3=1Z++D`te^OosbgPo7B)bnVKu+p z`S=6kK`8mCw^tIM2V`8JxlFEa-CX{0T zk-!x-;lU__8BQiy-|RCbE`&+ySb@1<9@e^y_fS`oO#7|X>774r~S2b(wl(joV#1z zxkPpH-~TNm5#gKvBM^G}7BW}@!mM0fd&Fp)1DK(u^eP8?TdWy_w(SH+v5+EiGpWXhBf~b#IEUvZd7F9 z*rPmy{vy6yYmUE01)*Y zmwT2jK~;6aF(H2Lv6kbKv!6+~Y@NMY!c9MX7*~R}Hfwnv%#s|M2gKr+jmpeL$3w3o zXwBL7)^bln^Sc3W`1i55l_eIt`GzpaF{l}I#&)BH%3kXMoKBmh?P{5mmqhtIQNKLmH5R8qb+_iFG48e%x&8H*!DUXfyF68KXQp8Tce$@kZ70K=x6dA8Z zPY*(TO*BtlEiFX)5CHU=<=rh9`E9$Hk&0TRgcQmo$|UlbzY1t200A%7P{#=Kpfoxx zBVFZTOKM7shJhX*E08xvIih#H>fXegsc%+H3>?lVGhLjmb?W_x??dd~WH4Zokw$nh z+Lz?FS1v|~ws`QmW`pV;SNs~7VYG~rm^I0+oO7a2pMOzOYxiQ5xD`Hs4tlE@hU z@VgBqqm2z6H8zO0`_pz_;sdb`7Jw;IE0mB_evp-D24yR6-j!@OQ)axN^)%*-TKn}> z+kX+V`y${x$qNzM zd?(6Axt!*Q^SaLGD|};?&`*pt9#Vo(Dl`9OmyLjKcS z$@%P_K&uO!yV=DDA&%2yk=uuDJ2k~u!+&`C_$y_tEJPwasi0d`u$ zD()4&uv$3Y-9wblrO=e_;wdsf8qAw}*D8!llRXCB-aA5C} zdy*~vdEW(R;xC%Q`e3}+H{!W#R{s7rzp(a=fOGgST1GVNxNOz7fzOx5LlxKR=yaYg3KEoCGKm z0m=Kxxg+U3pVCA<*#+(Q7&ET-Fvvf=4S&b7L;n;O73d<=?vW9(P^hli$RFMIhCu_DK4_Bn(fAvnGtC zAtP9hAnCz5IZz5?=d8NMm7SN61*zho99Qv8n3L-&wmEq$mJ#--bf{;o%7d~MuJP|g z&fDO3PX^Yl|Tqau6Q5!8VwS zVAqZUlt<16GRRY3$CWqx3vEHv_O-$}d=hrvN;7Pw*#00?>tUU7_fUuC{!~$LCycfs z$e$(J%%bfx@mt1>D$AF3!VN0Xq>3Gzg^raT?I59+0Q{+HI5N)g!5umCwa>Fe z##`+>2;Da3%5)Ai#AA2kO688fn5|=@lKWT&8w$aT!R$pFFD7H+;j)4Cj#LrmYy_WM zM;8@iu1`y}v!?9Ks1$Wz&}SIt8|$5l(c%j+5of`{vd@|iWRz`;gwQFIajwz5f&}{D z8!tFxThtyd%3=&tVov#d&y-^5yl%|-$_NQI<6N4hqHH)dPLoyH4U&|)ym6_zf3sK{ zd;dts5$5ff0sMhkXUn2G#D^3ZHFj)ym&i@ zV%68m&Ks`$eIr@`aIt=4BSO0QA9?6HNhg+po$}gsIW6**j~!$QkG6*?&3jRRkWIGZ zp8gz4NJ-C`;kA^Z&pzldQxyLtM*(+?G?l4W25H7mLUQiRg;qXkmw>_@8nU_I-rK8d zM#m?Vi13x~kqd=CoZr84$v_TuXF=T{IH!vTGimG%POx0!?qP|Ne zD#dss==9XT)8`y6UAv3dX|YWOv)iWPwrY8jcaM$Bx80|_!r>Pa0F)`5*nlX(8=Vax zZ$MjNkd)ODxWB(el&Fv8bzwKOQ+d5RRYy8d8Gq)7Q&yt%P@djEps^M&8AU&APTGOl z;0KWIGn2Aq%b#X5!NM#i`~W?mR4bswsJf$TNwbk%%|r4d)|@Pv zIV(Xk=t--Ur0?g#Tp>!&fEh8z4u;B0^PYfG-+9Wb9ylWrt$>=)!rAV2K5?F#jW+;? zkmWW>fuBUMc*9xo21x8%)KXxgrz9PUR0oxdt{{Gzd@b)w2VSf@pmym`?IeTTPq6lV ze(2MTNqE3~rDuG<0k<)`a3gM<)v?1Oa$;4m!RDwcorOS+8roO4AEC6r zY~(icM&y3)fy$J)d1ttIpT2qc6`NZVH1wV*4DX#s#ryuqi<;-UznmHmZ_#F2a;G6u zq00o~`$Q(GXV62`vm;ohQYsyi#fI1xR7eZZJo73o%)IQz9P;UQ*z$&W6HH+0De`cq zaVGX~jqK5g1c)+N0b|_2=#XDXMQk#qvIqoRE@i>ap3SZVsUNBqkxvoj4r@!$Gj|rT zYk=8E(*sz2LCio!rCI~9V?=j$a$o+=zQ){SWBT(!;Kg!efLf6hVa9j{_E$oA!NUw7 z6AOzn#^-H?Xnb(zF!tyi4y|4Jj-NpVYx-nC{5veKDb`p;hgkJ(cjfKWq8Re&@I@jJ z0dI#!43luFXBP;p07+4&w!@_luZrgyWsSg@id9Y!YExFj7k5}k4F!#Ph>^d-nXi6x?6v&g=fNBZFt{$q+TYl&n-8 zSVo7kP9wg7USw`c?(E{N)#v^nL`zBUW)LM>hic)Pah5~UB!|OyvnXdhkV!qy+@P|I zl$uwsDZZjdVkalR;tg-D^|EsbspAIRIV)O__$(?SRctF@```Gw*=Xjjkk@Uux!XCz zH~wqp3Z*cA!k+kH&VXw)gu|OnOenJ&YI*JTxhNswkb4%!axI(iifTka#A#=;eR##|IY_0`_}^+)xh#ED8do#HvkQj(8<(TLKnxJ zX@&NjgT`U(q3<v8pYc^307O(|A`9c$lOUz zSyh(su-8g6)*h>z-1cox)4uLB7YJ=!P{O)A-yyg>er~N-|K?C0+I+C_@P#bsg5P?+ z0n;L8<}}S>(hz+WVH#JnRaY4-&fmmIH6@K9`30d_;&XDr&kJ1EK2fT%D9@jSx_fU1 z-wt4rl=sdVXI2ONDRNpg?Eenp_dhKN?ITlcN5jd$(rI~B!}Im0LS9`CLXe@&dIPEw zZ2pNjC(ur;fyJ)1z%o>_+&z~$UCtpi zMIeHE8}VC;B8@1pu4aFgE>nYT<3sU@Gusk$-iiNuq^nme$MbHY8?JfyYv01~(>jbB zanEJ0@Xn;M6((!iRP_Y+l}v!-_8@2d&CDfA5<>gotPZUkNK^as68E2W!6@nG*T4NY z19#U_WjhF^2>8ejkG=&3IVJSY=)Mz-l!gr)1{3>Imutu_s78%^Szzq3jiiqJ84H%b zVJ=3Z#BRCYejFa4yRAQgzlFfaoH>7FWCrSZcVGRD^^t8Q{uH9YIc1+Qo^&kbi$Y}# z+-Qns*BO8Bhu;MEhpzLLMZ^kXmlIUX&P*G3SoAW?Y<^xra)g?@NSlo0uY7~j?IuC1 zl(M0zD2^U@#*Mqm2nXZI2TyG|a$?X2aSQ$ka%^IHuw5)uL_DVgCWt8x2yTuB3y#oB z_$*dn5emjeGev?#m?FqQOsSY4UJ@Xhf)l6!q-Kf?FGHux(S)2nkszj_|8txYZOs%3 zWQvUbm#R|%3yj|TpY4lM^@soQ*<|K>wsgNO6Si34VlCx2%WBYz;Obmb&nMLf+qNpB zjR~0|(UuB81#zz@L{zg$@9#fG(O-1%1E73L{_3!qjQlbMo*IMIAGd_^_qM%(eE$r) z$Q*-fFpC#Y@vm-W1GsEmNeS)VNokG@%~8Llw{_;V{=-DjOEdaeOb9_PqS&eTv-TUC zg052V!(OV70&^0v+wmU+>WJ(CM1B-vLiFLLw=v=sDWFLR={6;`*jD5je#tYZVzqt- zdAFPG%@}ZY{3Ew-8^+!GyY;7Z%V0PbMWrvbsz$*}G5$}GcaR-@P#=zFKa|U*+H^&b z5%x^aaYa9^cs^b*gKEL8Zg;xs2TM`d^e4?fMBpRB?*v;Pvtr9zesXY{ z9Qy|kk?D4|e#8>0Z2cNbidW_Y@z_& z(WcVJSyU(okqifPX=U##LD2PxaLWV$ZNV$8iAS~LRvikg)wT|6n+ze<3fkedIIpZ9 zfaSva&fe>mbA&xQeb_LJoG@UAG4jX=yR&0pHJqaF|E1*V< z7&+)~!@{eenSeQi02Dngmh1xo#7{egZ+v_;-xXDovOC@HGeRo!ejB;mI;U&~HPUWI zNX)@%#Q|0{dmu9j-GIy(6e8}$)o(C{Z>Wp*8{_3HP8Vz?AjM+u10$74Ah-ZGckdhw z?Nw05gt^j%&B8er3HugJ3Ye?}UDcC>5T;w?f+KeX-nMKElnt!CxhL2j<(1nXK$6j* zuzHQo!Vkd}mD$wu2Ydo?UCo9e4%WR^{kryDum&*lE2KT!g7o?ZEx=WbGX?+!AuZy|@>_sbbFW5F=ESL#9Va3H9rLb%G4a{FOUi6!!Uu(An z7GFoc7Dmt*YJemHW-G~zf*eXuL1?wSC$c08L#r`+I## z#sUeV2(Ge$%bS}t04ZKH{uIW``+8$c1|k4`^-)PLi=+YIyLL?XyVD{Z_GV+o=^Zg2xQM>J7%`?idQ*qbI*5<_lhx@sGvQ0^XJRYnUesbjWDf} zjkO4@BqBtK$u|qG8r}1G&68T@j87KXZr{)EfVd7;5^E4IxL}!fkz+RDtv|az=vXScCkQEs}93$+K^dN^+>wx za~tzFHxdgX00fg}*66#;!~p86?F-{&gJb6U{wH;PfTzzhF?ZhvD3hA6Hc8Tm)H?d8xx43;=cnX*;j0q%utUx@Yl+*6rvabk$KkDz1<2Z33LJPnUq zf>i)d9jBY`96t8x7R*jGCYlwzhTXN1IJtpAl82Z8-W#pibz3&I84xhuazW}Bo*T1M z$pg2B7sD3SQ5t6FqLV2a0W>WUy_tKywd}$&?u8md-J;b`WFvbn?15FGW(khR!;++@ zTMH;vHji+iW@lK_v_Q$neCmb}BcaVkK4Gx~OOw96AUX7{|M#Fx=Hc zNE8muGVdOgQL$4b3z9I9MOAz<8~b-_k9<3aGeh0SM{+S@UbKYvjLc^(2Y2Jt1j?W} z$1sdw3Le>D(Yq7?j%a=y4Rxo==IsD+WsVeg*&laM7vnwPO3r|al_Pg8hydj>c)xB4 zC z4Zb%jWof9569$B8g&e+vx^|~vPz->y%r zSDognnokSSTOODx3mj_Ca8O6v@HO@Hgy6DI-Mem4=UvONg%v6nLyt+2O%IM)WG)kK-X>{SRV=&7@Bjw<$rd%6w`lkh9k-vJJQ|2_osJ3fen>{!h}n@ny{Ky z8XsK)QG=&f+9{X59`*Xgu0e_!cyX2 z04mlPG@D8J-Mh)y52#%2O(B`-?&|cRV9Wq6hON(at^d3oPi7h|<>#VYDR zSwaJNC&MGb&ez>JhX$Iqx!~wAfJbS&(uWrrqUNs;SkQEYrecTLc`2Yi|M21jGWDki#)s*sH}K>R-YEkTQPoNkSkXoLsfIZ+3g z=Mg|Oi-U8tz3i?C+7?R|M^N5bO2D0BP#e8iHOp9~3HQJpH<*pF*jWXku0oFRx&r+- zd^$t!9eG$BnjV}Z5vl>8xDZ9gr3I_)5`3nSU@KQ;<-7Ndi==MNSO_)QS)>rx5w47H z#E(6+2=$&}V&ptLu>j9Ot9t^DE%&70;9>2RcTMWe-5NxVdUPWcUPvgm2E}{Ihb-`r zd5lW!Ue^c-y-x5T;I%Md*@QdAKo-vBod~kg%LY#=UY^3d>~Kd%5-E6IVR#V1LWH|s zzJRp0OzQ9uN02>NkXS>rkVqUtl+~-@RJx(~QPl@W&70`=!*vO^HZ#VQ)o>iryHvn> z^kM3ZjYZucMKNh|7Au7=(X$oe@t)qxbHpR#?ym?t#AN`+!Zav#P%`jpV=U*RFUFQO zs01HsJH6gVx7WlJ5>F1@v5vC5Ajmo8+TC*ZSWlwA3*#ED0)V!7Yw_M=0l^^RWF47W zR9Gxk21SnUdNgc40a6D8?ZEw}=WsIP$AJCtq!fb11CZzzG#=Tx29AKEo0Ju?n)MCc zs|u~MgCd4}K*AL_#N3 zPj9+jrZ@zJjR;u8d<_ovA)JWVE|73}k8I{p!J<4CH>Qi*BPyzZ11|JVox>>#?RhHs zMZo=KI-sa$)IoCr3GRajX0E|IDM1AeBf8k3(jr0K@XVpX@Y)o|VOmH8Xn$j3IZJBZyGijh zr%pD<+kXugwJPw4B=6Q`k z4twY!QE6Vk8R_ndsZf{diRP~dx0!Xc7U8bE;q8tEGMQIibwhy&XNC_U;pw%)cslr< z!JU5uuvc>R*Dq9^rxF+P7P`Sa@Cf@R#omg6W(XF;*@3&>DENniD*8YXcgPw=7koDul7jV8|rUx9ewX=vD1iL3}q^Sh8!539`8H5!@Y~skUJ#IA$Py3;O+#%fDAsExhRH3jy0)#Yz1LN`q^CU6Qc_Y< zl$4Z|>dC92sa&tF>zuhsWV6WEvF2WNs<#!fZCJMNpe^E6>DJnwp4yV+kVs@`*#H#DzsB(GJ{ zwcc}_nrVrerB(@_oaI}ubR$YhDNWm#7b#?vr722CC5Y{zCy&dzb@75oO!)Wb zuJ``>+P)H51}O<8o)e!gbQ5GUo2J+;Fvx8b3uUlMMKl{W83qD};sg-XsVJu{LP0hg z3PQtlfhmGR;VJfJxc(S3`{6%=%F52Ml;^G(0dNK?Eo;*n$raI$@7F2y3O6SJkdiVFI-H zNJws|A5Uw7iYSxu;pGdLKTi5f-mfj-&7V7a*E#J4TxaE_ewpOS1&M}R1{;*6Q058AqC>suRT2LK2>tKaTlD9Jm)!QbCuan zsP$T`9vAgBFlCqLUJ2l&EWTf(nGo$|mj1Z6+AO@REVr4W) zN(qd*>(;C9_ji2n>CJxc@0$LgQwXFIL--e;+CKI;Ms&}w&3LuU&yZ!XYr5h4RK`kY<5fW8` ztg~zTYgexywO`A8f1e+`+s!bs224~V0wj_?A)fLk?_aXx-|D@ko(rCRzHV#n&{qLN z;D|p776d^d3L{lbt)(qx%oL!t-E!vKDw3li6$w4>+7M6VAc%leMOumjROhq}e9=az z7?3MU{^S5Mz5kU)O-ZVh{cUSkuUq@v-Cyp%-XEbFGHpm;m#Wsf{{Hs&m3QZ#){Yf< zqPjP~yoHt~b8~2rq^UGzn)%HC zUF(G1xtaRWJsl>jyDbCtG#=3Bo8|!(^55p$QnP7lV=ZQ75u#|>HlM3&ef9g-KQH%J z+VGH26Aa8rD44>H>uX=x=P#y5aOn!w_;@SL>%MgU_uhX_-Fk}rO4iDoWY*bUR#8lt z84_J>lV&Bcsw&sd_2s-RE>WZk@9ma;-8t!I$$_34!}R$P1h3!Z$x6#wWLqjGs#;>V zHEVhCmFPKszODD~^~q$Rq=6)0Ng+H`-w$^Ko32YMMC1MEyZ1TbZtH+2NQ($52oQ*b zA~0nwHMG~t5@i=!*ARnJFcqLqqO+VVXX5FfRSErUu4X2?I9r&r}6R z=D)Pt7|T+clxi&!teZ^Jl~w)y{qp5}#Dzq%ED&UZSBlm9`^Udaj{NfR>zj;zzwhJ2 z)!w|{dQ>ufTou?vAizcuvc;7pWT`D|imqUYWX-#|V@5MZ*))~@`or9@za&x2YI}OyEqQ?C8;m&_;p?1aXA6O_N(Gw56)eZR`*l zNlx}?h=7(hD3TBek`SK$L)iS^mj4HjJ;zZ`2y3>#)LS&nMk372u(nNT!AgxLR+6QR zDS~_mnm>YbuW!`PkKFsgB#Z(=LPHq>2_(@oNl`{1(h(S*HGEYzTD$l1|9@Kb2iV|B z>FL+lhrRTz+%wKf%jupArGb!4I8zCM$DmA_#TbCXV6~DpgshKh%-XYCWD0iCQ&klI zZyNK@R$gx#S2qLJn(IhVI95dX5JY;=;(tZM4ARA6bsJzSyZW*!Qa8TQ1TvKJt2Gd+^MtE(b$~! zx4a&|+r1uq^H+DRb!8Szn@Ok2#(>a4kpt*W2xLGL2#AJu23rA=3mC&L5EBS0sIFY7 zcw{DA;Xtg!HIgYo5UB`46*>GHh8!*yn>{`I7Wb#Ul`E?AuB!Qep{bNBDMd!nMx`Rz zErP-%(WYjNA*M51X)I|mlEF;hs@s0`zn9NfP%0K;txvP>YO z7$vD_yRj@A0Lp-yNwgWO77%SvLAJ^;wuwc%vS7Ha$4Far%@T#nw{Xw_*@%Z!${Uc6WW9^1-sc8L ze7c;4;#K zrwkQY?`YLr-@WEpUhUr<_p=S&jlH2eeYxACmSqj}RAJA)MFCOfO?sQ0VwU#J+O>!{ zpsAOdiq&^`E-S=tvv-Xc5|G{NiOb5J?{^D z-uJ!ex5kykGS2UsHSeBxe7`*QI_1jDFo#cAECh&6YFOL5ON~UdhQxD?rZhzw zKq>@KBqM@s-8Q`3&w1_L@E%>=nt71su#m8j+e}*?o`bs(#D;Hp6R^C? z1bMld$A!XD!OPfIp0P|>Q{}vni-fb)PMEK*iy96TsXt!~qr=sb`K4`_t1M_@$AS!K zAr2Y>rU>VuigiXBAdy6R4ZQ9=joaXYqSqgC(I*TKyAFqTBgcDvuUSq;?BUEvKHOL2 zG3#_gmV|OYdmA{)2NBOJ()07()z5dUy774Pn2z-fm_;`umoq5Y7TL&7auikB1lptbLy&9S0avhi5l$I)9ak& z&T)4Y$=2N*ZY#>GFpg9gVTn-n$`z;ybqJsonj$@tT$1ZotIW)Slq)unZd&Mh70Q~r z?v7oJyn9PlJbb7{9Gj}`)pmhA^Sy4p?cTl8s-li+XpvRxO~iSR2XHuwRWcU`CL+cn zAhPTr-VY9Jkbz}L`bV4`Ag2hycZnibsdgSqQqQif#5DJ>E*dkp4<+1G+!XNd7jws^ zXMlAVz;TZi@mD;WRaI%c-0^kSI(64v=QscyiNF8>ET~Fu;1bWGfHf}8Mq4EWf(LT~ z>^XxJD`RtvQr_9SRb*$`kqOWRkSruC)w2vG#I+kv+OXq1}?M+C+b z1rljd1dRz=n?o*uW`rcvE!&2q8m2j5oIKKY#59t^h+KptyBQU%hRD=`Jdq%STw!An z;6eqKV?Z-isfNuGIizWkR%m7_!Zi4^eBTf_`(SpFPY)pT$dKcXpWH_Mr&T;w7V)FQY9?6MRQA!e|nuR9O zO0`qqXfj|y!-U2&IsJ1dU|f+sbAk~E-tSlSpLiOEq2=VUrKz=9G+M1OTFis+Oo@bW zV0Z7?NF!Bfk+e+#QV>v)I2Ah$fSMG5kV~LKprHW|s8FH+5m){rzi+75^+_+ zm32j>%_`L>Y_JY3j$p}!8lR2oAMkNudi@O9S9gzqmUaXGu{GF_S z$mBN-y+6X8ogJm~h18zehYFL~(uzGW==4Ys0x=Ax%{E)*&8}9G_=-(rQnJY{qAjG` zR_auiw&BSHB&=j3{5Wt}QL1dU4H0`az&L{QHpphO)s7svRB>04&OmTh5a&&W0Wfp? z+hfIbCsRtva-Mmia?&*w>W^RXC%?a}I42Npsa_)mQ3NNo;90qSTdRZAnJS8l)#_T+S!l+q3rkHY zroP>x>e{u*X}D?t+nX543aAhfgxMl8U~!=gnMWHq#j%(Cg2=QZHB?HnQz9q41H_1z z3c6v!W?XTzY+7c`X4K=U9SZu1_b?L`Fh^1Z8x^$*OKb+wpe!s@wM#Gd2pA!kVwM4B zDd%FtLb?Rf97F67M<6UzUAq0w>fNfet#5k2;@9$`ibgVKW|G9SOw(r4%wpP88H*}S zM#jl3*wl*5i)hTXWZAN749i#%1EH~xd((~c=HbJ(sa&wQkYytxis@vip&7EZRFy>N zD0+D6HM&2bc?}m%)AfIDO`F~So89S%k8+Rz--S5jthyxho4| z5)g?^q{Kxeik1E9fN7(feL7{Kr* z02l#^8?i#vY!mv#uq;DGidr_d5wUq!4t}SzD`u>2+Dx%V*(sVdnuBbmV@VrC z%^4{(B+;yt3?LE$$)!c#D1 zG^HCR(Nbz=Wu{T18WR+mNZFQR*=(B4rCU_wrPsfreLxQS-U`-{3L#KMq@r4~3pG({ ziK=8~gjt5E3M7>%l64mRKg%n~hw)c#ODFn!iKIE(-}~mLn3d<6CU1FyDjpC5REk0X zgZ+%I&W37&plYn42%dsDtfoo`5Rg#O_+uNQ86)l8b4upcD^%K9SAIMa>JBgxDq0px z0W5?>yvzm03IsrJ1dsy3Y+3@wSOH)ZKh!qNwPG!bsL6~` zXwj)GGPG#XtW<5J)gs7|fS8CTg#LN&^l%)i1*k9kw#SA&2j*)uQdJZwOH{%61^&i{4t{<0v!+Z=4zsBBzROiDuX)+>WsKVocZhX*c+ls z!SCCSBsOh0GOPJzS!mbs0+QH0RwSlX3FjEL1un;W%EJQ6(x)s3hh`6+? zQQTegE1K0)D{t+q{uO?jO37HXlv`q%LoFGFizz0iNwgGdHKSsR#|e|53- zkKd#H!Gq@S_K}+;ia|836^LSq)TtE1M2oO_c1tAZD${^5!0w7@$$m0Ju0alXQs#+*Sk7K8Ek2xB6+GNt< zNrfbZ#m4DQICb4yttDe^ z!6KW`>X0i00{{%QELOq*u|%W~tU<5>+=Hl?I`2tamu>$F`q62rnJKDaHj%R_Lo*a; zW;G@&RBWb}ic?LQv0;gt%UadpLEp!}9j~j8mBQ!dzRHYz-nnM5!%lW;T3DiL!&OrV zp0?W@_I;n~4p*GK{f>W|&o9%_qWlB>{-D=t@a{ zn`^%H`rq)VvW&$@%QH!!$jr(jNTp4MX%vzKniU70rvE|dhDrMFsKR8t(PqUW)yNEz zppgJ1HtHrts0<2$xSSyoNL+UsbR9C-AQ5CMGRT!xYcC=fmsW&^vsr@#fYxddqSCO- zM7b&e47L)moeL@wkSJ4f0U;n;;`a^bHm-9KdBWVdhfY^WEd2^E8fa=I;0PI4tdLf;O9KK)C3cQ=I@?n^UjAk+lOi8Jjx4- zBmx@*%Z;m$5frPV9fwRn4PA??cEAza7RAcBD2q_sp)G<{0E2B)0+6U&O0;oDTL<@v(9i-=A?vhInkbT zPYXqhiClHU+!12dJqE#t`}_}=&Ym!TC{>|u@BY5~I6ejk!stc9sXXxa^w1qO*(8!l zq0k8OIXUH6KNLP}bLnvWGEt##K-iPy~4n zyVmbArMxuzI^ScV!|+b#A8i3ZRf^uh+a{;uQrVwlz+%$cpFqr^9s=mg;^wI?&bH?# zc6o*J(30&Fui2RaHZ)pB!`oNZAoMvPt;u*58wz`I(VAZA=5xYy@W?cw;e*1%@b+DL zO|tzjOjCIMUd$qip*`p81%1RFe#-;utZ&?%wWSoEF1s9X4b_u*UiN`|>vuD13zu;t zSo&A2R-U6dy^+oLb&hYkkC>ZwFJ^Z-_R1VK?BX6SvOF&~>&2J~ z%5YgLh8^!~**u}ThO z)J2rH>Ga|DWb5-z-R8~JJbJ^r4Nw=Jys1M{Ue&UBIQJgt?{l>t5i^&r-XD`=Uwn|h zvY?ryP1O{h_q;vtUEjU$NFR@?N4o^qLvDp1c%LMy zz5Dgo$LZ3qKGR$yw&x^CTCLRQ82V_kWR;bb;7gUsvaKy5)qzelt1zpJTCEUVAW&^* z3Il<_`20KXzUSfNwlsD*83b%=x_27~b};vjo)e;#TC02<5VnfEwmSg@bGgZxwmvlI4oS_fs7mh3}Au)#|=7JvU6J5 z4jfG|BuMc|0w6$q(@LvgOYgR~8P2+D2=es{)@UErAuCzJHjB9h{QNySTK2(>Z(1}_XhI4OlHLG})yP9G~ z2_&v7-Qw@Smv+70cH>#C=JUL|3Y57Chk=HR=^dhNffm9AGG+4fb*`j@Q`ZP`?uu7a zU^4m=5llm56TBXAG!}s&HwcVU*H?vu+PPN>s;ZDMqLqP9&9s^UmlE8lA#nEb-6+#LRc(~6GVcGI{5lJJXnd) zB%vZqnFv(`q~Kskfox0jv@S9(i}by_y)2AgnAj$Gc=aK=Ho4i~CTB>0KHcZ4UHCd6 zhw}%Y-7v10^?2ur&v1R*{XOq{!`}7X``+||NhFir_lLdfyZ61~H+OfrVlI@y;%GTu zhbM^EsM&jWd&c!?^25$}Z*7Jr4H1G7kS|cWAAM}c?`!)$^q9LZdT_7^;6ol77|_HX z8a^Knch0F#Iw%lOpGL~H>O@%#pl+Xr7cnn^MzM?`kd1C_aKWsN79UXrZ(NySw5+U{ zR<>-kjMNVZ+_=*T5-+BhFl7$T%AAsL&=LIwiU?o5w&FzujD-f2Y)5vfwb$Ntifgq5DQ`Kl2GOa|zvoZ$?+>9HML?jajZ+q=qH8HQs2OW0G7RWyshvzBzV_RGeRBu< z_&c{aW5--I6dMf}!w+{(lWQi4q2ul0mA|O#qiJ_T3Fk)HKZ^Nr>Cx z7d2N;zwSv}RW0**?k?J;gTPAhEg@N1QnhLoTU84(s;#6azfkEpl||Q~#G-NS#1q@4 z+;-7gPU6ucV19q^i@piT%>p#jxqXe&5#8ZWja?`dvy+` zk%@CoeXgW26aAn{f<<*e)EEU=AZ+@>e+=M{1_DGII3(30?u9gsjvt+x1knIsrd-me zdHuk6kOl~7e7yg|{X|(d%SfR%qijVW5&}q@5g$Jve{zz4s)EDTPEiseCS{0HWNj&; zs;U#(iuixAKiFP-I)Ar{I{0P(y4~};Z?qZb-(X<;2t?`r#1&O6uqhsdOR7b{M4=P? z*I(@jX$?QqdeDZU1iV+x=mSXrfZ_@L&oltKQFM~@+|s$UR!ZRJ+{)(Atpb-5iGTx$ zrXEN33OKMB2xfQd-Q7#No+aj++4jw<+Ossw(SZ>H#9PIx-@R-1@A$jtTm9c(v(NM~ zfQfg_Qbbcy)Xst=gpxr3znz~`A{zL!Ps#is{*mk#Yj?{*@cRTnP5wVqs;12nM?mB; zM1-h;Ac2Awz+%7WASd07j(`I|1{#WZxF}-;NFslxJ%RZ9V(bhP3l*{mKpO!LSOIGV zNQhanihlLbsi;I9I_KIKLk`g1rn7$U!sx{s=-e%4RB4Qe}-vgCdelL3Vxm zzrOzeK}AHtKSEC-Qbmdo;cSvc8fGRWVyg&)ScIs}YG5R2QB|1AwM;5ZGp9S}kH3-g z=>LD-?r|r_(Zixm^X-QDiw;FYC{+*WKT$x0Kq!QgOwghxk`tR4KMVoH*b`%apK!5T z2mt{&P@zl(APLMRh~=fFXspp$OMic{Tp|zq(^vt42!&mO+}aIMrDm$D zDPE$k6tU}m{@=fUnBTeY+4J&7BNaMbIx3~m+Y1m@q$O&kf&M-I2ix!K-w(sX&z}AD z^|!wbfq!&D)iWj%HylaUx>H6Vg@mzJ+QuVv08|13Ys&yG3dLU=0>X0CD@eNHp~Vh8 zxr*k|C@TMRMVDy^clU>WoOi&vo@gv`iurav&9Ha}-{0o>_v?6tWu~%Bj6{+%RZ!Zr zH}B6+IA6cl5_pHh_|e`Ot?$pg`<<=$mMS06_M|0MRTM&sIV+u7M$=Ph$(4e!Mu|qx zbS3!WTcI2c9PQck*AJW6xa!*BXSDm`6`@8lw-Feiz)!ZnLN-olyDnp_rty>__)fDG~1NcFHPW+ysbN4m*ad{YJ zR0NTu6AH?~4haBVm1fZzr!p=VX(mBUI|+o4Z5eXyI;=@JT@30aDyAm^Ra8od$V2+} z&2*``YzWuA@k2-uB+-ZC1L0GYdIlslqEtG zMKM$}1hz8OEHc$=7tfyV-z9k{FzK0?eZ#-Td##X_xwQl7AcA2ruhDH)I3`jSMIzn@ zTCSFw=B`ss5=!^|ujh+3?MHuyxIb@ZVtFlZ%JB%d=n(NT50MQ92TFkkDijXvEN%y? zKPo5YQ25|}3;;`YA%YO0F$RB71jw8=6G$-X7-?B%+@RwDfS63fL8J>po!cZML0ne@ zP}&z@69Xkx2M{8~pv5*~VyuLsu>fcwF3JMwM@Wl`fDDTSSO%;+xg@zv$kJg(WEAb( zWRLNGK~ac90#=hSD2_|J)s=yxK;5QRV}^(Ykr+e-Z?2~QBj?QqZa){?1HODIu zaJkPO6@$+C=W&CE)kSK?)+=n4wOnh6=H$_(Ln_#$Fr@57Mk>sLtum3kJK)oS28m~ptgl9&3k$@UR#zd04&hJcfeBzx#X~5uExj!0B~&t zNaHh|3Rq^tzKZyJxI`!p0)+rG(b|JgTB#Dt%B|M;_{%W&10`*72yaBens8?D0n&bR z<4XQ=_D?Thc=Y7WnXlMYrrQ<;lu#ZANJM_CDTK@@oc)8`-VW7wsG{Z+4GM zb;fFYuik|!xq^);SMCX8^0>_!KHQ_gQS8KrO}0IMd{A6tDb7ruk{L1dc25jXw@eMu z_U6~U<&v%(^whd5yT5N%^*5%gT)j^AwtHIL_q{%pB@(!idhgGxbu}b#Nj;gK_r33W zq>@P-5>IA(-taX&gO2OA;p*pVs2g8<~=T8ymSXp4KH=m&Lg^m;lZi2M29)<+nsul z+tim4dj`kA`@pN>v^F5k90Euz2*4Q-(S?ga;pGH_!X6wFjiK36sn|fo2xAAp?_RUY=C?uPho?oR zJoW3%OqZY&isfH*RTNkz#KT4@=CbPUy&@`b zRaI5b+i~T|;Y1=T=eVxTthrY>>v}nG5fSrk!<=#=BC4y^OT~ypNs1+WF`^)rl1W$y zru*Q<*szV*b#vlKBoZPhoQR+#eSyQpdUlGBh^FTvp+~n4T;a|tu6)~v9m?0UhL1w( zt6+r`Mo{XwX)s77{E4c*i6g-6Kp_U`5^OOjF_yWO*g#t*(*Yy^4vXT9%x-l-&#M+B4Ep7*`b+4rx*sMBkG6j&ZkTb@rmyV>m`?uOX* z<+IV+@^R7idbunf@G&l-L{TH*fj8KO4(phC%NiC83{cUdMjoCRVd3fN>FMtbo{+dY z?(CyjXqFiS7|hf{Izw}38uuZf>pK%ES@gl8z$~M!4CCx1&Dk?zCKBqO(@rl!J$cR6lf3{K$ws%SBMZ; zJXOTRm5yNqpG$KwrEby?5vdO?V3czVas-gj_A_KwTD)bvz+x5_JG>S!2{KcJEkWs- z1}0pzAq*&(PMyJHP)^=E7@eESabR$a$e9)$%c($F!&cx>Ok*fxP%Bt&K^!>-vTBr=(TBIu1UJW}RjEL~`|*Fz>T zV=G&CVUUS|@SgT@HTX1mq6z^jQ8G+WC`hV`MO8ze-%01@`*%H~!1z4XM4v}cBKP4$ zKtKQss-bO3t*r%8Y7J{(+PCmrRY?RhG&{q91ely{IM)`4*0&XNoYAfd1f-~v#f@U4 zoaKPc5{)4vCz$_x6;Hpt(SmA+E$ro(7jXwxl=4OAOc2?h;d+XR}R))yGYRoO@Msw8Tf6qRA7^=_?;TvTh015|AqqSelD zh}ft#7AuQtGDMnGB|xAg&;}-E5JU+@igTQs=Z#P_x+5dHuZptjpy6Y6Px6QCwiY@n zg2EjYKan2}{5AO{Pb;gHh<(FJ`ZWZssSc)+b=$TYeQ3Vl^ zDxgxO0&uzEcz1CN{`33IKS$%!gyuW*&KUa>SLK6TJs8LKFeJ$em1RhERD%&fmqU<3 zI1v@fDjCX(!{Wlsf06rM7&wL!iK|QuFmQqT%3o+SS*@7bTpOyE6;UjL>W%2;x&rC@ zlko%R(?4Y*Tp!o{n+mF?NeLN>nXIVJrgX(rG3VE>$dJ!#&9K8*9_!rRlgRT5zv8{n zgYb|xKtmVxnw6@QijkwZ<=hEr-=db_K#Ic76!0#2sL@m?jXH%9t(2!J1f?r9=s{|dm_}fE=dk)XC(i!!*~{yJsm=dx z`OKTT)Q5cn5FIqee@cN>B%w-mR8&oiJEs>i1P;nBN0b=9e^X&ZiTZ;rkPPGYhXWAZ zg`$C!6g<0b9v}zo`k0;XJV-ohEmN-CqAF2?k22fx0y%>89au3C6iIyGO~2ALVKCpn3HI)Iz6 z!OpurNOnqz8fr>tg%XMqr%RS5h_Y2d@8_-gkE!eX+m}HxY*@d4KOTLnKLhRj1NQik zf;2)&B2gM6RS4~Df`q?czOS+7(yqmCADSHfTZ~8%;X&0$&9XZh{eFuu&fnqoc5*|B zr3N7@EEQEL@Atj??tcAO?yyIz((qTnSF7~e1SFE8k|7l1V^oV@K+o-2z!UA3X-L5X zaSxYl#=$?Oa+c$`DcY(ImqNguG|y4E-y|85#}U3@Q%1s4)dou;)or4T=GV6kAu8P zJRKq0>CSRnmo_}@22q|Ql%PO-eG@$G)2tcT^rBMh-d{1;AZ$^$9;+6e8*;P|L zf)W7Xj@*;CkmG^e%TW4-pLr}~2iGlng>`8Iq62uBRd;TMP9lboNRkprPcx!-!f^pq zO7C@CnuT7oTEDe+RS(HtpmIxms-XK6m&3B3rtp~8B4(5)&c2@dX7-vUvcOE%me537 z2jRZ4hPTTrs`dRUz;-yyKKc(1?HYS2i;dl0XabgTSG3<{-93F*>;`y;2O$Irh4d4* z!05oL_a27w;K8aD_9_&r&g6;@Yd5=?^8gAx`EFV}G%^T7?Oz)t9j+XzuDMtivZq6L zc(*9zGIaIBN~1U3<)Nb%`?q!TH*V=@g?5fPnZ0K_tBT8Wqx!x%tXhbIigw)lZq9oH zJL$zv;hV2|#uoDm%=Q%h>8|BksSCATX2O$l(tjOV#!b1NS~wa9$-5l9TCpxTMTRfS z1=z#CT+T=!9@dW@>-!bmq~qr-T)cRsnQzCB8LrVjzrL|(C*{_T@!YmIZLNBpU&m4> zv)@uRbSRzQXR>(0NcG6lM8B=!`&ZjczT7-*I@ilwCrwW*u6P?g~d;kEu#d#eDEGx$GT@Bf^5C@TU*=rc8wD}1lJ;g;_g-? zxD+Pn+b(HCZ%Cr@C>p=C9u{1?>d%mg zUw1k=?GEjJpiCYegIVtQrR@%2RP)D)I?7H8g+6r@?BhFfj>w|pU{PcS?AgLaFKq_& zN3toK8P%`IZ=GuYGUdh{?dVcIc}_pgJ!N9me^>Y*_RRa1Jh126xorVtr%Etf9n$P| z&}Du`@kWHGx}~Iibs2uCBQ~pvTdu!|lm2EtW|ytstB;N(w9i()$81~d3n|(pa&vD_ zXX2BJCyq!n!|>5nZ8uCt2e{-_hl^5-TEuo4s8_z56DOs@aB#3BX}cNvKx&k^l@J!< z!=bcE?Cmm!?|P`=jvgw>2p>^2ClFnOF9wH(Mrlzdu?PtX;jNp8wL@oEma;!aAn)GC zb$8Ntt=8LQj`5;_O(!MAU1MzowD9J#=&G}+Bl5;rB=umG`+`JwCts3}_l4K)y(2mF z_MPNJxLargtsQ%RTh-oE4}SMO*zk4{2ih-5pz)DEt@)OZ)EWy1dVKwW+*R~M`ut<2 z#KCOukkiD*!*SE@(|=1m``>c!{ZBWh^fZNFQ0SwRu&mZYuI*WWLv}u2@Dpowu0{O2 z=yi3$$E`W$1-~loK!Xh7Eo4f3v5Pn^8o4w7DlISEj3GiE+%VKg1Yp?6a3IRT^**wq z_a(oo5h0#B~ar97GtkQHLY9^54DQ_h2e z;?6ZFIWArtv5Oii#foSdyo@$(w^nm$zvCdvL%e- zx-m6h8C4BMS7{(oh1hLKz^%|6gzV0gdtsH;a%><|0eGYidT;^)cs3GU!7%ixBD896I$}Eu~?G39kd%S%}rds1z0OY}&0%qosF3zVaQK_y<5ni_R@h!FeW&zy&dOYzFB_{2eB1HNqtNsDH=lHpE4>zP0>FESp3xez`};#lE+ zvEOFJy*hsDX<0~Z(UMm{z=3;WDN4fA>wvWH*+8M4HGvT?7c(X+BQKvhD=T`N7W!Ln zUr<3N{(fco!#|_E`TZUooc4YnHbON^n+)0<&-q7BiD{mak! z8xnPU+W&{h0}?tv$Q`WU!o8j zla3P$23Q>m#eeUg2hFm-8gIzuVB$DBoT?TSq@MrY-NNCp04_x7EdxrulO33g_D+}4y2r~D)6>q$$S6U7i!;@-(}^Y1Q0o58?Ll9Wi6eBGIx`A zdGGOM!#rhJNYpR8>Ky%Q+d2?m5-nUZaDP7RbsDQvRp)@)79R7nM}BkRQ6a5zVI9^Q z<)66zflr@hHy>SazQ6qu|2s2F17ToQO`(>|PHQ}kQ9~xuC^5HZL|d_6U9+NznY$eL z+&6!7x$nFH#Sz&TJ*6O{V*bMj01?oscP862R99sII)%UHRg6mWX7B&lw%3YL5&O-WOZgFMWJq`)gjItzTWvPz?d9y)(S1|Jtm6fc7s<)&B0~TR&?-Nwwc^ zlw$;^Ix*_0Hw&X~zpB_*X-0bZkaN%=m2xq)HKBcrWwb4EwF2<`W4;ZUdMpeHVnA8UQN^UEV$KywCLfLe`|N z+3EuK@CO^@q_cn@AESNpq{$Q_^Q;;8#t^vT*yNGt5GwF#(8z!r_M=uaH3Cs8C7>ZN zofa~B@DKbLHPUoQS|~458Ghl0w-~00fY#XeYa^$|+Vxv8IhCjggkwqFEZj|s97m#y63uKx9r@f5zA&w_Ex^H!+CP9TJR7RoCK`dGSR_opptR0@HFf=Z zFbi(|yWcXGx}G9&?!4;ZxUUlN(6qLcyMOq3f=6$5f$;5Or9a6{#Mv1C z%j7HAf1&rZ{`Duc-&2>9>}-!F#(`ufo2F_HM(_{sX7rosm$P2By@XqbZ|iC3vhCDh z5@@aDu`Jj{@VEb}tYDy1TTo9>pFv+zgC7aq?85)rU9jeNYoB6v!GixD7Rnl^ zZ->*a&w2W{H=VruHbd{uOT|dG)TF!Xe@TSNVo;+Hhl(Kt|Dq}sQP<|RgbyEgY73Y% znX|xVrcfr)VLacGD&JGs`CKD;5g>fUM#R{?@EgZWL zn;cgZ4d5R8EKFE^vv@#&zW8UG@e$0WF3*A_2<<(bch5=RUek1DszKZP;!Ipt%95rk ziC%1dqkzhu?Wq%cDv#QaGZN*;CzjYyZ7cLgpA&Jc_%owz`qZk?W%?(v$X_0cXY^03 znC(+w`bP{tbSgd^mUn8U9vB7S?zN^?eM;o*4M_cxD->CRuZ>TZ;M0U7ikbI=K+xDd z6L_cLLw?ccJHy^C$&k@ZF_~66@bv|4IOJCFBkTRr1~b-$fP&lqbNh9Fa%npo|FgHO z-{`e`vk-hHET~v#42$mb)D#iw?cqv8UDMQ^pC`iLmv9Ye14{6HwNf8v;24i5<`5sH z{D2enttjvs$tNJs^P3`oOmdhDqsdYYu;{$ciYS3jrd*^JoU$d0fLqmCKCXtGHU8F5>d!o6mz#~W*Wxp5wBmGlBqR5c*6)dA{7JW1yzo2*ijmDi zh}kgA@0D5Nc34p-^)^0G16jjLuqOect0>Ld8VP-3=Jqwg9+JN4N@d9>9U)g&kzRH9hUc zbtx}V(?Q?gf4>!z+A-)s!n2Lgc;zK%{{DG2@xKxB|N5^g=J=ZW>8zSlqd!4ha> zfKd8ydAz6UJOOzF;SCOhP`9ooh%fhG#Nxga8YN-hKr-9KJc1tzHM!vcP!! z{q{bW&+@<%$}l1Tg4UR3TUm=0zO|^CgTLmen0YeSSuhkeULg3^Ff!u&6F>AUWTKtf zd#5UVKqh8m_j@47|M?%k7<{?()pk8OJ3DD`EcrN#h3j{ zM2kV7f3+=3WZX?NKqV23l3JO%ZmC*ohZjMgYJTmT;E4QqsO)P-3_Ca>r-w%Zgkl1~ zn$5_+6s;q2s;pQNXm9xi=}lV`8REF$rEHDX4NJP^D>Tz-EX&HOV$?d3wRVxNqee~b zBTiS*MQ@0EegMhj{%mYO-;X2+ZXh1Q(75$Hv*fH8i_Pe3pojZ7hHr;w7d{W;u=AHS z6Z&t$n|unGX=Q2Ab##`k>2!?h8(c$72YAm>0IQ8^}o#nejdv2cm+SkwFk@>w&ITR6MxNyk?176Q+0u2UW{NAtqz1w)4 z(%KSbV6IbwAcn%O*WF=>=hvgZHHQEC%BhoZB6Gu^Kw(dAmnZ3h2M%J>HDbS7BtHNp zK3q_9NYLGP)g*M*$drt=*fol)$%9GaG8aDFl>Rc^@P}B3651TJ{w*qJ{)h0PB=h&$ z!pi>Zskg~dBm$`g3W7X152m{41G_P8`pv)J?FXWR_G03T)um`_<@~jT&zh<3s^l|D z@sy+qZIndsT6%f?nwV5XGx+yDc($l`4Y}y`GfeICDZJW(&hJzEd0oY|Fm_gi*tN7& zEIq)C0=IUGVT5X=VY#w=mVE;%{#OKBa8a9lZZlpmh=DnSoIqPTmTi!U&4D-A4h$kf zPry@UL-d2f;n2U!EqtB~yhlQ2acp}?e7p_l%u?q~p#ZcE!|zAFr=te#a57X!$ra)) zW>Hj?PD0`O?MPNU;qNjHyB_U9Uh%3t0=yDpEgR1Xih~J957}X(ea@w>WVM+ln#nSS zuhqeGdL@eNWOK+FgCh_IJoLCmsw5^#>G(Hnf~aX)8wiY547|q$hWI3`3t#aQo$PQ6m z2r0_{WqNR+8}=Av%nn`}^y=I}e?$VYcvhyUW}~SBB-&rA@lDN+W!pIB`$v&hbrJM9 zh>V1uRDrX(tzVncgQU3pt|;b=?+?<8`Tc!#itBHvE}oB=`MoZ`+hms3#`>$}n(fQ4 z=gq~6QMCEh_h+EV1~v-{$$Pv17oPOrdwy3{)9t>OzmI0t*x4D?;J|{XLcE)HAJalt zZN`VOD-l-3li3s8>#l&JBYuC;+&I4{^xe}3J;5rg2buK}aT;+NFu4GUE-j-D80CEH z38P%tma-ERe7Nw9S>p>YM_upB+%F{fU%HXZUW5<5Bf&p+B|9Z#oQ*iUT3*QwDU^Q{s)m;=wGnGd(>V;XrCQRI<;6ak=Vs_BqQr%LH?(SeIH_=2la4hUsC= zaH1uuJQ9#b{6Xbf)9b}HS|>rbcbb1@EC)NF$f(Wyc=;dCV=fs$dFB|nKcG#$Xr$e|&1&I-BT zPmQkNG>by~=@1YR5CKepT)M!wKg0eH`(qmdesU3(C?5sfL6bAt>@DHux3$lL)1A6* za66HVm?7#3doPy_F5DlzeTY<=Cph_e%jkdv=xa0}Q0|vzcTQ`)JgN2lL}THveqNCc zLwl`d56|-ad$7v)z`Fnc?dt!q;yqpO+xtY;QN-KbYM8Ed+<5>wx?4)yqu57aQ7qo? z>L<96J-nwX*Wvh9%lr~6@Zu3KZiTx+bondrLKcgXl0wMiuEG-57+LDDJlOE~u z6iWo8TgGiCpkZ%Bssd3D@T;$qq!nd@N>b1#OQ)q0NR$Sc60Xi#{Dx#FV{2%_Xej!L z^3$5pFv_b!Cu7uPxrJ6Zt9aFKPwe9?v|=;F!_}6A>+Gh0U{!DYwZ#xBE~-fe5vtN* z`ah@T?)h?EBBp!5LE%W!!^2G}Av6Kq;sz_@z`h)thH)xr&y@W-qMrdDB zEhoVtfz{FWR?E55n9~v|<YPcLdU^}o85&DUQ=ia*Gi-5)viQ`vr@ zs(n8?dBs(QAfXv~H`7}sx{F5tVpHjvgD`)q8qAO^wPvMPO`0?sK~~d;Jy=xo7!kkH z^_@X-4vuLww^43Q*7G6didXIqdrO;jY0;x`Gw>Rf5?*8t(s=ghY z`o2~ceqQ16_ex+~qP00MLqj5`$Jdlz@T2sF1vR^YUY-Ie^M9MN;)y&6rLRT>FP4gd|s*qsaug z&V7xpMmc3x4>7J>OS_1h32%tzLG0S%M?9{DaI|<)C^y$oJye83$gTo+6wjhar z1}Y2BuwR?)p-KHkqCq~&3zXj*di1LmQrc?E+tL;3(wf!NwbNb3)njV@eQwiKbI{{! zuHZ6PK#KNYc^0U}b4nOG>FCuk_lu9HBxBYE6-F!H9S22WKB6DJh!(OZVjOYW;4@9h8Y%txx!amPX>dp-@=pxq&e7hi@%IA z5)q&%0yHI}uw+&M7|ScE{l2?y4|CBR$0bfQMi2AhizNU;L%Z;?qA8S|s$&9TyJd5# ze(%o(6nE!7#)cduJG!=6W^pvJjOOmu+25@hAPB121jzW!T~;HJ^o=FKVBNgoHA2IB zYEVUVnv&p>5IKmOIC9J4gGreJDHU}RyE4vvTg{a|Bc?^ALU-AS?yL7cZf=x1s_@qy zBmd)(wsn;V z%Qgq?#PA-Q%a%1!vkcDFuc7U7W~Cd!@d91Z>k{_m2`8_OxW1tFx9eT>H=R_|+**O} ztRfVfJ~uA~JIlzjCrj!yzo_yHRO~5)1&_jN){@uTr~Pw<_180?BICzr#*%(Z3yx7P z$Yg{}8#4DFv;JfSxd}So%-FrqG3Mf-Y)aK1A?xcn=WU^^R$tHPboKW2gHMYw$?n(UTHpgk<{#KN9I4 z3>rLf93}$JBG}Nq^r^|Rxti=+tb|80e!|c2BYC#Mu%x;R+_ec@GV5V}PuG}Bgfp#J zZX6`$BzzRUJ1n7qrUM?J2yrmGL@{O>GEnLViJ-O=@yIiQ6WzRt@k=k+N8`AV$2!4G z?O)HjBT}x%kZQ2@>Ge3XjXRAgJGM@J^zP++TP;;Y$l?0T*sKs>!f%P8Kj}DA8o!T0_%yq}MCumQm-~_wBRkBR;!5B&~vqY(Q4hujQl%DhJ&2N-z zZHIEF)3EP%^A3OBjE_^e`yN7Mjq-`#)%}kvoPp2qS)y=}hq%_Q4ejmeeN8K*JsSHQ zhHhHtisW3uNerd9^+yV2T{IL}$n{OhPrM{pX(ry@Z0EyKyF}nRHF8qCiXJD0$T%Kq z3;u1(DpON6*9^jl2vXL26(ARg5W5SFMHsxTsZhj|MXWDKPn{E<cHF47D$z7EOI&)rqXi<9e?!Re~)m(mexHC1{q4PqypTYL|Mi3?2$zm8L9edCK(t? zLc{h2un_gkQ1iMfjzOAunea#GUxXI|pu&5{1?k`_ac*Jf+*??))XrNz+1)L_KR}n| zF9_jd-=-1xprfrZFsXEDs#&q;J*@TLg8=MZ$HI2~TRzl?48$p{Ck#!cL}qodI(+Is z?w*+DtPJ8GP#hHpp7oXv32W?xC?v$`c2rL6~*zw`aSn<^gIPM zfqZzwLkk!m-W9sGl6U4zopI&FRc^z}%zW`=38A*3#367;Aio2}#wu275D8{mG8Tr~C&r zwiajznBXLl&8k?w{Iq&I?U_@5j27YG8g$`s_9(Pc2zh!=68XA8yy^>4q< zpvEsgX9GHwg^8b4T*M189UWNPTUds_7`qDI@C2CenU9?~@B8-&hqAun{@RWcs`Ghz zaNMdX=(v|RlY%70bJzddu)n+e&|uQ*^?Jnax8KSL4z~>d%*Y0BOI8Pbozn~2jVu-v z^lss6TYGB|d465z>$s&(N?HLWp)EiQ_Zleq`)_>i&U)rd)T`<>K4mbE1b?zxhPh6} zbb3uBE71fl=l7gRwguuWM?HY!EyKfz<-y>1(LX^jpS;^^(jV5A4{EqU@hOt>U_j`b zg5&C@h2eeeJ!xe9S6q4@JqQN0$XPC)&pq^Gd*vcHCPrq`9E*-?JQ@v5LjL0|?{mY< zVJTNngHdQ88VMSQ6$r5Af~u)Mhf|_Z-sB7ZD+wH z?UGZh_LRuM1lBHakmST@d>8W34yRAV1`uprujLuh^qTWb}m1B>NKh~*k% z!sU_LYgKKH);3DW%)0p##icRtAv_2EXNc*0DqlP-@HHitE$OA(f$Bvu-RLM;3I?X( z^}6te64Aj)Tw_HMn?*x3RY}BN7NF^HCSY&^o;9j^{%RYQ6*_~2c@9buQY4u~)-ZN3 zI%p(T&a0Cm6qgEu`%y?yWvN0tBCJnnbRiEggYuY(!<*y<^G`l-SnoJ=yM z#b-+a1PmiRSG=#qCgJ^l-}@N^JLpDpx|;92^e=xu(9X2_s}f)(5p$F!S*1Q|+@vv+ z!jtQpaw@J;Bw8S)j4x8N=@jIDSN*EsI?PE^+W@B1$l^$V{|*ru>uZi>}|_Y-^1 zI%HD53DxoW!G=_PZyq-@58OC=YIO@aK5~?EH9xGY(?HLx7oR*x(AoGT`NCAfe#4Nz zlFuOQ$x{B%D+qcI49_h#Sex@+nfXf%c>Tgbx_`Uyeb_nmS+>KyGpv3V;T$cD`$(u? zT-u@e(vta%E!L`X{W4u?b(|IuWU-geyxwsJ<#jXhPP^|k^6RhMY-gYlaOQdRis zY(oylca7cc9{M*|h*PLTKsCNqot$1Xk1?TfjfU&@^D#aU*n&7-9>iF}lmG;fA4qA9 zu|3gdv20^p4h{cJ6k24+2i#gaZ5mq?$qm}tY4TuA*?ViS;OgJAtnD(I^I)5dcZ)W@ zIOaI`j5F@;Z&{m{!+|$J#_Q7*`ZG9TRSMe${~egiis$Gu1b~U zQHYa%3Zi^IwU5GSazq|=QzUShv*`}NCZ}d(Goa4JNjL&8P-KdaA>u1$f#U#IJK#fv0}0y6CQ%@ipt1QU-jB} z>i4PndcS(}dS!3m!TamVCC~6u=& zFj5dczk&9omOKPnq*1d(Q;PW0kK zJ->=hFNz+nZ3ew02CRF+c-E!@_cW#tDTgw?P+@t~!Rt=g)ACL6@nz7BxiNJ8KlT<1 zbivgrLI>IBx7sJTaf3%C0}UCM%D&QoO0(0;+qo`13(J05TYY0=Sl&ybL_*h9gTiBs zb0G=`RU{^%2=T4O$lkTT%?MZ z13sb14>Mmnv7uJ-P^-ZuYnfA}9FZ}e&iBwX?(Se0an5$nNT;%?#_Xh&T5_zR)^$l( zxFM)3Z>v$0m5gX=C^R)IGp#9Q0S5tBR;g|mkJ#gp$Ulj!?Ib2voNFp}J z@hh^t<_M{15tSpaQsSE!<2~t02*S&eGbK8QF~i~UIE@Zs!=+n@i3jBxYa>CRp&noy zyxIuZE18!35qicS(0A$mN-CG7M#y0n;oXa}%CKb$noT|8h&Q7K%Oh|B!;_Lu z-EZ7=?waG@uF3ZF7EfE#%Bj>B&0~`3DjI&kgEI(+C3w`iCKItZxnW<>E|wxsLW>^@ zC%zLz%>M~@A0bCj-i2v*?fJ>uX+ZzY)BE}KEjWkTbU8RYw@_>y7PX%k#BS{W0D}g; z{90)9Hi=0NrCBd9Ts!RdblbJ5dW!)4=}>h!7$As#jbbzUQdGoUpJ+x1OtPc~XZOBx zXQ;p+zs?GLf2gUSi9W2|SHCb=e-CZcF04Xhg=8$5Z@+4H5V2ma^DS%@|A8v_N8{t! z7Y2^9mk&NFrzj|Zke01bNH_+19zN{-?)!BKTM+eb5cO|wXtx3nG6IUX#5&&z2jWph zY10B&uUofYdrRW@e0PsDTpfDE0F%SGDZqHkc*_`SF#VgLr-=(rZG*dB{b!ZXemV3u zV6Ha3(ot?egxpE5w{Q8age@f7DargUa|8#m96T1vediLP}-02p( z1`ny|fr2BNEI*1Tf^IiZpjecKBD=Tu2fiyIAfajBJ*Q40;kgspkYo4!tC*pfbmDg| zspQl=@+f}6grM)x&ID4lba-?I4KEXd`IqT50=S(Lni@+3Afz}t**T=sA~vEZrE!=A zs7gOJm}0w#lxdD;olKLIv4a~*V;*^EF}*X?%jI_W&?Bq0$IdB<2cPcCTN7CkZO67V zoQ2z&O=Uzxe7R?lw@Dj%^B8}e)q>-I;4CY++A>m%4@lm+^3ahL5H=*EuOXHM+Ml-| z>Lha$Dzru$q@vYynM#-eM$kfO*@Qykln~LXlfp2&FuH5xbz^mzbbBC#$kmw3gqgIA znZ9}L_{h@&IVnYWy3#{5xGeapweV&XD&inTIH@uOWop(~nhj(MMvmbm?GXvhbIUJa zVK&gJ9ZDqqmLfxYh4ev=%7m`!b;X{_zNlIS1B2zAt;02_wg;U? z7GY;ro!8PE+~*iV&kCk<%kKG*kT;FbjO>YZ(6>b7y(Fk3YD~oS;(H;VXtJ@@v;Fu0 zndVchdKh&Sme6-Aj3&-LHkj!!LB_Iq?4VI#e+OgqitIpx1wLQ09zhUkWxTVb6g3 z_{q8aN1fW#p8SrBC>t)?!?g*mSXgC8Z6?v)J(-19O~+>Dvfy>*9iAC2{i*u>?vK7x zx~c!+fB#qZ{GZwYYM=kn*-2X)gFJNM(y)y(V|7f=sB9!v`i0mn9_pdpCI zfkP<`_vYQ+R@dpFQ}bR?j$bc2GL&{mDzKM;bAe{vcN18L=@te8{A*z*A=h36Hzs02 z>b}BL8j0JzG1XGKV5#*4NXn0Z%*FlKd8dHfJ zyxHUCwT&53L5&hxh;N5YK;oA*y}3hIzxkdYA~x6z?*!o1Gt&D_-Z+2Kn{+Q=7KJ71 zrHb?|dP)Z0SR`L>KzdKC2ALvjXoaH#VXlb{ia3l&>Ng<_pa3@{oyt5Y&Y$dJZ)wwn*;JVD!OY6$J)OC5|Kf7aGW~w}d zOi3*FbgM3c`~fTZ{MSbW!8?oInGvcR9rbRtQbA{(bho3`^P-%IsLyhbFNetFh?au_ zKlc){%!2X#^ej^(*?^kV^G2s!P+FXM;bAisXN0e=)gKZ2pt6;CeLu@Y#ilbNgaZaU z+3wWNOFM-n&JV9bxj@e`lfNZYqQdUTavWK=d!K9CX2>4TrNTs?Fwr! zYjj}w+{bhUqbE~z)i}(9ebMNDoyl3za6Nn^C%z3s!N8=N2&beZ`R9{r(OBHU;O`G5 z+GCBGgz#W8Dmqf|5hR7g5X5eHJoCr*pj1!siQIx(j-)pS@NPOr-v}Nw|vmWN(znn!(m+18TS+37}?QEq$&vv z1d+~3utftPv+&ej66h$qhQZAU_C_f`uTFUN%b*I}QKOds)e5FE!1oKPH(;-?>-2c| zHD~qI{x`zM`N?WQ2|mtWDMzjO0q!st#2I&+fx@8cAE&Q{r7TIr?^Y97LC-66f-bw% z#A=_ve(6K!!2274a5E9CXSiE|R%mH$Bp#Yr4|!g>r5U=Pb3E)A6j=0?GP zh2NCp^%M2k8l|3xIFd%=gZaIUCe}@6*46u$BLCdHJoe{2%z0;=!~I4|rbPpUL|{%U zM!+PbBL#2xf5UcYJ!>?nOgF^2d`1Eu=;#IV;X0geC^30G$Enx;<4ZO1A6_FNo#NxNZGpK#$h3+#jl%c&RT#d6Rt5)KJ6PD zf=Py>_9cH|PxoG*`}cwF{t`>1MrBfz7;uR9l_eEBabc$*`$r!EPk0lMocz1xLj&D0 zOfd6@n)LYIgFj|zzp(#X1S~pI}V4jl#)4 zJd685)}Dict4vxQI{I}69%wXyC2JNVekL8*2k*KMVkh!>u}BXXuG8>L^*^#L*&EHa#;u-m->=Z35H(DJuXqEXAxT({Y)$n9uzGah2ldiUJ%d~H0S7dB9 zl{0MdP2qDSmz7L1tga9yq-~ZlGJfM3w~dvi<4AFAO~8fJ;n}9?HtVi%@MKswYgTN0 zFK4k(t46c1YMoxLmiY!~XR?EU)pHrMsTJhpM&KZk^s_wCEOyLX`Z>gE((#g#;kZZ^ za!E1Ycyg5N(sJzS^=Y!I%9g%aPL-1~%d-+NR47%2>DOQn;{{2^*(yMjip)021gk#ALlXsA}S2SR(p0Z*pSJ+fvVz!=a z-BMb1z=}=fcC?EwS7ek#B1V!?`Q!YOK=OPwu=h4!>E0r1tXd>JKPZq+#vg%U=%7PL zP%5rB8sbrtnZAV~>K+(ueRMSMs%njDlWVpcZ-4$i(a?_8m3LDT=_hzdL?t^T8UD7x zZ&?5Eg(1q>Qsz-rTI)G7q|yVs-(u1N2psjaq&5=g)YvSlU%$kO(-1yD(;Zt|m-#*R zSRXiiX?LC-5JohuJB=u3ae$S*_1(BaMjtsp41SG6(BZtXQKG&<8Vzrc3_lw zQdS-*95bUyxXsqj#D;~+v=gPK3l#5kw6R^AC=5!d0p0G_ z;Xig=74bOT3TP@q%OHg5?LE>ZV029CXR!jI9tNXCwVZ^j7Q{V3i*ODtlgJZ5@IrLv zDi`|WHAFC8d5^I; zL$TGFISxb7VS(+?Km!3B;?{(=K$hdnna=i0_;&B1VlS?BPjgeR0D3{&)eeS^SLM$G z$nZj)OQ-_=C4;U7=YTv9&)2BL!Lfc~dS9B6%V+eTp=koeBYY0Rp6Tzcbg3O?_DmOL z))xm%!5@xo^jBfhNgh@rD3yLo^M*9R&-Gt7_EpKR^&UlS{7TbO7U)A@c|Cr@>)xIY zp@yK$66hF8ff~Tc>eahLw8E773`ckyqy$=HlrokMF+!1`wg=$;prxe7Y?@J3B76(n z67~3Cc2_iBoyQ#Rx$Z>$?L5bq6zNT)dtqBABGL7#gxL38-V5~UL(h2hpQ04(HMWJd znGJ_h^*%L99{?wGM8M0yUgAdAwU9@DUnz(VJa(ihZ+kRJFLoWC_oS&7z2%Cy>ppJt zem1YGvoi3Qe60X+j!i6VqcpYP*De-e0C~@fSJ-ab;Q@sB*jO0Ll`(_xJ4OS9x+!l^ zruEnL@=-_$@Ig+smvjig(iiJbz+Vp~7@90LFR_+v+$JN;~D^8=0Jm#VK+ z-mN0=5yfE0#NrmIOg?WJyoU_AfDGk%t%?iR+s(+4>jS7OxkIR^SG6Oh#wRLibsE)` z`9)`k&xI6pO{U+4u?X(Fi zgF`xa=h?p~0t3Vmn!HIyFs5@tZ9|;LOm3z$$-Z~B=PJOyntynDsm2Z_d`V7n_G}72 z@1<>wr0FA^V~HXP3nI(qCwQUJTCYXZc6vORUhs!x`*Q@Ohl-KulxRmiNv8$_!r8hs z+zlkd4cRJ|cMQ2QkvOMTYTV|uv|OB~5btO+40d6Be20?_C8e$ukLZgZIkD)2MIf|M z!TN-~q~5a_wurq9;(9)KO=ogImJktIJa^MdUL5mzyYO;%cJ1c^qNnI<>^i-+kBlZF&lo9y-+-*mMt7x4ywcY5Us|FB|vzkHZIhQb)lJX0d3hw%Ym&pxXc8CxJRHrl=u83BAg$db>5!}M? z$SS-I8a<7E>DCfg;ow-H%kh}Kdpc0a7CoO`uP%d=-B!aIee{4e@htFKPw+Q{0_0Or zti3}9jOJ0X>f`k}%F-N#%N>KCk={gQq5L{MS$9y@j?aKQpX_kmlvD5C;CUQkH|^x< z>{(=D{e>^aLv>Ens0Oc|=u5@XA?ntiHSJ=b6ETSCe9QZ^$uI`3V+G5|;`={uFKgMs z`K+NMVuoP$5BK)$J?DK%XbHhWEsB;Klexh7$Fn3zq60R25ZI>0__G}lCJ~oM*)$Sq z|Aer(v^E0lIoN&o8tr=RsV+LIWk~jS0=rB-1II*bGO$pVu8<8)Go$J~x`b)>;sPih zDT_DHe+eJjXp+17;9A(n0q9Cxn=TQ1xa>~Qk$6NGb)QRnl#)$HaeDFU$wNe>%pU0| zz|mGkm+RGI7XwyQ`<`0nG-KA>nC!_6yk9Vc{MX&Krz{AbJJX>SNuUJ!{mKe^ip~*g zy4Ht{Ke-F`t)fl?)c&GVs$t?CQjW~WHi*(10gR!oFr(-rqEjJTSW|@L4Y|&WMk7x3 zdXZwLXJ17FDsYJO%%0ysFfRC*z~IJsZH7o$BQ(!+ZjJ44mi@?5z;oMu&twvP8sRCY zWMln2O2}X^zJOwtahthA^KF=F3Cp&!*o~IU3NL2~LtcM2%Ih37wzcczWc=En^U67d zM}qMG&_luZ#zRj6OeP!xFriqC)~5zhaEaunbZV~04<~CBU;0SgO&UrsA~opA_|_UpT9jtpgB#R?go02XhQ45jEJU`O5ilv#8GP!U-*~K)cMuJE zPY>%uf80NaH*Z{z;v`mzt*!w-FMODD6(C@qjcvm63&-CE!aM2q#>KI?7hn`VTsdaK6U5(VgRZ$z|U z@)*?tFRl#_`;jfOo#bNw42zPWxrllp>(Shw_59`}zJpYipp+s_(uM+;am`GDMa;*d5Il zEwn8Wi3?-CR*K*0y|VblA|!XyPUsr`_`_{ODQat^5f>OaWQcz}f^0QB^SvNLY+mi# zSTZSfxB27Xt^V1MOv~}`s#uR!EDB#;q!rP$+NlrX@50Qo=I|0@I; zk`DO~0~mo}=|E-yl>k6$DkeBJ^*>n%1d)r)RjY--kRgZ!0Ki1h0str)U;r`%^Y>kB zE{#05tW#i-DZ^&lU0v;)DzV0A>;A z{|%63e`ox6AN+UA5Ivp_L0BrKtNiY>mHz>Of6744T!#Fkgk?G2)YMsU`oAmtC-47E z{^@l9vI@d<{~yi#7wK<3{98U0eh32lry;*@{cnH}>wlD=u099=BO3CX3QOmog22d- z{~`UqWBqs5{~|$#{7(x(gNWV(gArZ#o8Wg-5E}oTAb=f$44KW)Kwznu07PqlvmloD z5xsyIAIK2I)hwbhzY$~=#KrGy%-_QWg})MU4@H9=f}qaeMU1h3R|WA`Jdti1i-Vu_dy{VlbWtRjHp+Ac6RXJivCA< zWLXFbqL2TpWaezsKl3B#&b8!rv+h3$4|HO2pi2Mc>qSBI>tBD&VW9qtz6ZIiMT|m> zONF#fD}0W+@D25;wiEEX+mlgI9MvUgRy892bBb3aOIbTqZca`X{eAFsLbF?j$8{$4 zny%IPIaES7;E*OkFc4g7gEA=ugY34;MkB>lZWS;X7w;&>fcz=@fykBGB)**wextc| z#@1KwRO`-JJt`iqNS1i^^M=QWM%}*sG)28*jLtDZ3#Lg;h8U3bE<|0wked*5L?vGd z4fel?)E=8MKSEzP)ijH)fM!T2?{WN$jBl8GN;R2Zasx~}f)-p84bqr;-~8C1r+gViB>a&aXm+tZj0e3DtqE^yt;L?K&V%T zKRyovFG-4@wNbIplxjc*s7o8D;YTC=qSycwzBovWJBlhFG1*Okm+wK=bhcag&Rh!Q zFPmJJ@BDOqW9&i2!Kn18z=pNKJ--tvXpXsnUuxx7bPs2Z@=)q6Za+IsJf^xWCcTc; z*NjD%GvS^=mFY6b=UT6r`CiUEYE3H36zX@Bi&YU9uEs4A;4MQ^2hxo;MsoHNiVkXo>?m&{lWN4% zf%7i^R5tHTpb47UhF}AT1K(67xpZ`O&nn}MN6D#}tPKwePb`qK|3M~bgWMUFRG`5Q z^hnz?jJCs2LT4n84aR@crz`_fhW3u{VTWlIx(V}5MfnXHlRq)Gz~@F$o|9e(LPZzJ z2K>HRxa6@t%@mro=fd` zIoUqH?Z-Wok}~f=W7PZ)H?kbHYOvYfF7aVXZK`a#=DuGBwV7y7zb-7EIpU=81jAEt zM+D!8_VI|-ce(bYw{a0HMb^pqkRmaWt&tBfe~Mj&$QFh#P=(5RA5Fiik~8NqV-#}v zIa9}0CquXkr;6 z{YJ{ylW~J8ig$5u37;IB3RZTLyo^Wytt$^B6-9T4H0c4AX2T7PmU{ugF|CC_+)L#H zAqP+ljV*RRnQ|I{&KDppApHXsS(%-y>`hMwdOtO1T0ak;O0oXcjQ(0Beg9XXRvV;E zdpsPhR-$e;qC>8Tz?-@N{TD|~qiuS914k9sZmRzR{o@xYLLIfQGztfVNj-Xk=Uq$^RJ%Ww{=&L1nQ4*U_68l=iPzU_b zi7KHbw^kDC6hZs`&$aYa1o;gc!(S`-)4-q={O1~mOD#D>-3=wN|H>_C$Y5_M{aSH@ zgj{kn$jiZo@~`g%fEWPT9o&|;`3)`Nd5f1a@Dutqcx|(tzM2}gD>1h~!M^T-Rl*}O z{++m_Bo$amh@`KDq)&{gs-njc7fxS-1V9dx>}oegpQSGWuwep9wYw^?v;d_#vfCzE zZENk622-tQ&W!BrGE5qJ$RsLMPGw|Mo3J(2C@gTA!zwUKc3Vq6uB4Q8k7l60ovb7n z7)_w*1RzF&7@;R1Btljo)MM8o&Wvn_JE$^N)M+8=1AKNgFJi+&dM6_4sGyHpUGTQ+ z6hI?Ift&jTTtL}<8ki$bq7v##P@N$zizqO1G?>F1(8-MSyhXPt61~MU=)6v^>*EEW zpU!Ul@Lle;B8T~_%k>sS!5fDqDtk6OwyCWp>`rlgwsT>IxWS_kJn~oKxU^mCY9-nw z@%;IXTYA7mf6k!BOV8ZFcJ{o_^_mE1f|abn+;C9pEpas0dw0mUl5(NUd3{mUqgc@4~-5Z5nyTjH% z0m!|&(2taEgeJH!$LmZ47fiL=-nG~5ehqTVN1`Lw>YC?QQHZG;a9fIXUHNtZ<|Cfa z`woDMZa?TU6$lF;mQI=&%OtY;DO*yNJ`!=zCh-TM30q}CD|4h0*g>CZPVcY^Gc>UE%~hk zEEPQxy-K!608$(PO-rkkK{adlpZxz$=)4D!EA$~8CB<88l_cDQfR%enAysDWs*eO2 z^nB=)mhsFgS%MA@h-oQ!TAKk?AAkY@AhFh^J7BTbG0CKr(^CR;w820j`Fz@v(Pf5< zpih;k$}*U2bqG2D-Ir7QK5dQ=d5$mPSWOH%Do^a}irORu4;*P~f9s@Y{>ky_D-}uZ zMpA}Tk`=dhXD4NYv*Na5BPpk1l2ut}qAO+1f{UxQtGugXxvLYW(ME?8m($p9%SaNV zuJnz?nym(BJ(GkLXG(5|4q|8RniV})Yg30hP7{uVwS)x5nxsZ5MCe40Bz?*bR~`L? zFm45#ZN)l~E?hn*?mA&%CZp9z(iH;@nHnKQ`ZbQSnq_XvgjJWyt|jhVQ!H{*M{XB= z6%wPhEpF097gq>rQi7ms#9G24dux*Z-!PNLE~g_`ZEf@pXCrRyR+2_4uxlBYeuj%) zwk}sqT|~JJj^bEdLb-yANeQ>9i?fMvB4wgOD=B1SHPIxA7)_xQz13l3ZPB4q+r_nJ zqrp@mu8oqfD@+LC7_X7EOQ^-g#l@C?&Z>*si7WGb0@u{jluF)}v}Ua=cPT-LG^uQB zjLNEFs%cRfjKBXQ=Iurkh+|Mu=Lad8R3Vd_uii zj?dyPHkF zn5Cu@sxUAxV1lC%(_efQn~;>@-~q{RKfYiT0m_Bu@dBXoL4Jeu-=H58y z_FelaUF#LzOf`f^4N-&l%Hnmj{so2kINwDEb2^X8+eqgUrG-n_-r#ve(+PzUWm?VN zl{Nc$uTTa6Xop{wLI&A{URt=K=!a#A6a(dgP(U{W3-(3sMH655kcEJQFT<2O$gxht zKhWid0&*>bLkB3-?>^f>UD) z5JY)wqpK}}2I5Y%uMCb{s{6LPupAmi4ZksuuI`;%U6+BU_~Ch8`sZY1lH!yrtvNX{9q18oOy1 z@0mrZV#3G`dhN59R(cbyy4%c<{nA@rQ&PZ~&|RiNgA~e+k22#G_52A>NwVo9Ul8t3 zr4#qvDD6XOhMx!ruS!e!yz8BXYlA$q!WOB8#)kECf%`}XDx%4ypQGr1kgz4P7IeXa zPv;C)k6M7Ti1-nZR4^v8tO^4lN;2T7KZx=B*TOvsGt;dfgjR6|e`mm@@pc<@1qPR4 z(nTK`H5dp1oQdDbNxyk@SmTL@N<#7x&Nd9I0+)_dBu;X+TE%a#*5CKSDOW7Wj)@GF z|9FeU-q$x0jFh--HW?y<{+)%_o#PEIPY&hy7$v7nBa7G)QqT6oFs~OnG0JF$EngK) zyzp?wM=MY7;g5_K7VJZZGO}YkDIgyU-@frTACf<~wq}2~B_{!u3yl=`D}IZt4a1i# z9qA1{6!H9;^wsAna@$h?YwK8K~l@|5?nFzF)!gt^b>% zb9itqun&GZ8*qe-48Y>5(2a}Zi41=hqF3%dC@~fO%B2A)&-Aye!-vd`*t;8itzzr`I z?ZFMG(K+=e^O9uB4A3E#tt9hP2h|yqp5jo#(&kmBx89o5mlZUAZF=<&cJl;Csfw%? zaHJRXx{!Hkri%573~QSnj6dk`O+xFvBmCs2|A_u70s2*bFiJ8E$BHUs$KHZ-Hqp?C z?JLI<62N(wYOWb}>haWNF?R|ThUpwEX#GjAVdZH@ot_@4ZGv$43)O*TS0Ax8#k*~V624R^`9}WZ(P*=68{{GZA4iD_63h})l| z4IddvOmBYBUH=XF`t%9**WStQ-~YPtFOEIu#0xpyZS=IBYpysMxX$VqPCg&7HY8gi zhKhXjOE?}K6vA}ItZ(;KbqMA3GusmJ;W~pExp!EdkGtgg9iCPf8u@z3XwGdzq2~iV zrSuxKO7G9BVhQ37e=lrw6(W^}FP7Wk6SNY&u&I zaW}orneb}WoD#A3$wFZb&N}dYRk1vKf$qM@E^kQJehL-81UkoXxa;q1^ZPsGYFeQ?qKT5do_$f5o$kP#yw)A5 zKI^(E=j=}eaNf#JDPpPsqJCk<@Qi|2hpdQnrTA`lx0e2jL$Q8?>!&;zt7egvo|z-u z{K&97SlDDr1iRPc(DuYB(Aztxu7jtwkmJX*(!ZB@MErxCwvI2OSZ4d0P9Qjm^`5(x z?tGb8EJOPAT4}Hl9EAn14O`Ia{zFU68&a?O=#42E7sp9Lrpkf-mwZIj&WD%1;5Tnv za!n-^)Iwr@eGpjr!z<%j&eC-Uo;|lbvt~X&-SJMN-lehbx}iZ(wYucS$g+)ztknlqf$#?V(QUr52tDo0cEK-jUa(HIPkc#dJ}fR$!Z32V4^P5Nd)dGVb^7vA>P z{i>PPJgjfgDL00pBtPevpCFI2^ z-2~TAuGiC-j#Y)seCW{Lo^==YRS#ag9#cJaz1DuVSX~LIb$dEEK3jw5ly#-{>WnXk z9Rn98fh8-KBeHNusl5{WF@MEMp^i_rE|KVI$v?W|%Y$cwo92ITeKE(Z_6tnLv;So8 zR;&tbr{UC0DqM+)}`XXxGfnUL-N~qwMcB=F71+IG3L}Je9mPX8>3YRO7kAzBn(MHJ zrC>k-y+7icECdy%D;$oZHYe1)Rs5bmsx`drSVAdtx}e<}I-7lifx#V#cI1r7vkZ<@WX9H>u2=O>>3h|6@>L&? z2Rc%rqu9nnT6&H-A=TU>F5XQPtF3AvS8<}6oyfQI+#V!GYHl~vCkAU%fwuMLl&{pI z9IHST=!qfYYdvf(;CQgnQW_(1I=Iw>Y%JT_av{n)q!z3L&vs7Js%byd=gVFNEr64v zD%eGc6BMJ^YgXb%GjWB8!YdNhsA=|a3!1YwpMQqEbZj^p$p7tV;7d93qb0Ztlhcy1 zk=QFaAvd<)xHtS~q1tv^Cqy!bki}_THdd|9cTGl`ft{wU2pQr&*!rC z_|@TD_eskytA3qOP^;5&nIDONQ*c^spEz3s9JT6|aI#j@#-udp%!t zbvo)Ns81!9az@TW=P5NFdK-^Dr^_5z);~=>@r6v@RJL$Gh3NPD{VKcc$WGyI=*+XA%^5F%;_idj44e8aB?>DM`c#7ROqPcqF zrW1+4gzRn>_)udvg}Z>TSi6@K3|5rdH`}nT(Ovk?d>0N=5NpGU)w_OTxreqLXHJ;U zrUVOgYSc7+tU2}nU*ASjE5#b+Lsu6JGgT=^zr3sPA;exP;lVr~rS^^Zb)N5zKFi84 zmBM2VJDz;usWx@rQ(^n`hr<(xm!_g@%3`m@tfsq3L)}`Ic3@*al)~(1v2F$*L#+93 z>&jC1){DQLt&zr5fIp|gTz^*f$XB>Yb;79=}zm zQL(+WF;YPjr8xj9?b|{QUSNArypxgvFw0p2c2?7>e=|~XGULBE8M#-1FYdvol6(B zzI((zwB0-=qu-M!R*1e@PQK9A)HP!gHQjJS6)DA#57R!qQ#bwap@Z-#CANFBXvG`d z&la|Q-fjnbn$VQr_D9&;LW{sPFyZC2ZQE`Z-fcIPd?7dZRS_s%g=MlLUHLc*oNkkD zmadkrlCEys1uf|MS@GYW$XMWT_<6d*&fTH6+oipMBrCttk_v1`1p`_zZW_9zk){Gp zo8nLb59Q_MfHRocl)$y%40Jp0orbwBMEJcl6-N~?JmUB81oFGV`z6{C z0(ATP`TMGX^I)qm*g7L(_3$?xw5QkKrjH_{>l?Iv`>nl(mmWek6)zPY6&4j{6>zdL zLclf(aJuI2!j$sz(*4%EDI4@r6;!}UGMMQKDCxq7X@YrNp9@vR82D1@Ygxksw9JD~AxLd6O~1*#b33RPxc{0LEW?lCSq7T;)@ zlNdNni8>wOe3gyCV{`|n?KnYniAQnBGlwvZgxE2MAx+s*QFMn;getzKkcHHm;B#hb z6}2YIvG#a4kMeAq2$POtsT&5iXIDX7EVgGBy#oD?rl=XZ;-RAoB>`JvG&^xR3l%~( z1Fs+NpOMWI@ zG(U}%F@bd3jjcRgc17;=5)ox!FO;~cOl->;H&^yD=cM-PcVznC$IqMortj~JW3O2= zh{E+-j*vjf6Nvw%QtyIK<)F`vNpVQs@6#2xqpH;KhXKM9#rGR$Z7;ix!hRO%;&bD2 zRWapGGWR3d@{+HSVwQ>CQ-WGLbu6}; zpFjvO*Jgd&b9f6vrWM4`T7P(_Z+VN-61*dhACv~9|4gz^2dD{4>NP-SiojnS{H|@E zh9U-L@tG!sO7dMVqQalPNiy~uRc;GXlt|tWR$CP3^MCgv$SG~2!3KQW|JeninM|~f zU>0^(ro`d~N}a2G;i@_tHY6l#r<5D{7E_{NH5b2GtKG{52;cEB_o}z`Kz4YTUc|{r zIP0dRa{>#B=JD|>WqV=>&f0ex-O@_jXj8Kr1z!Z+dT_o63iGiteR+elFXSjCoNEEl zVq(>PUZ@_n-j=12+U`@7nZl~Z3n8{JVVosL{uv%@a&bB+ugnT4Q>SK;{$zomLe}v`8 zXTKI^8*G1Wno^5um&;le|A2QjyRT|ppLA38b)E$A0Pl(}cJtYeLYsUpDl~oIR&JUX z*X_m@(Jo~8h2wc&tFp}ZX9p^Hl8}32K_DY5EK(pfJ>(+@ol7QS3`CVlAt=neI#Wbo z-qk{V|11)I(R)5J(%BX{wB9Et7cHs#+2gbL#p`;*eL(NrclgD^7;XT|#EupER<5rd zOU<`c3RWWs-|B{^zs6-`<+9D<0dyN!Ced4LXI8GPVEv}Rq^+eTiw>Y=Jc2M$Dsp$W zvk*{JjV!FmBc?rkGoP%LW#0Mu4d;ZYLd2O#xIojbn`P>hAGei13UVQ;Yx0MyM}0Z| zVT7qv@gCZ>1@<#-I>-7H2GC_kf z-{#Ex#Z~WR)#pm8ZDSBeCRjDmDcKdY@F3wkYZTlzdXHhWaOrO+zd<8`qZ<10o~94F zQhDts(OgGsQw4@u@BhW~J?O@R)y?kI*7@n=D1*7_LV(qsOQ2y5G&2F!V7!&$FL*0J zwareDtyPh^-Nj_MIX+fm1f4H4D(KuMVv=YT3VIIIg3aPF%!u&Mba%Z~OfmO25OBC# ziyt9#fVMs0=dWq+nM~QC)aYFat>y%m)i0gnN@}>#*7Ok9^{f@Nwu@9O_Na+uH+*qT zHc=Ahg?qzcu)4rp`hK;yek=a&YOAqde0F-+`=t(~U!ZjbZnp((`8!=93mczurljt^ z>*{7{yp*Gxe&Hngtoatr)!yqU#H!12-qAw=O;>$$)%~5iNWm(~ zb&g|emgxo_|BINI>Xir4c7LdbkLiV};Ng)1Ne@r+1iLQPSD(o2lKS&{M$Z?=c~YFm z#v(ZRZXNt2d9Zb($F=@FBCOS$s!>@p@3|P#YkNnmrpx?qDbm}AAatoS8;aG{tu|PL zc_5y-*4*rM>nifh<&avdw9!?oxrH6G=GPwPHR0!zFRED2O@wqjTE*s)1Ys9TQl^it z&Mxdav-PzVa+$)f4++8^#Jq)~eo34YJ~eKmoJw3kzVcY4l0=YEB%ovrVPT3&PA;bq z2MkB$azG7CMg`I@3{i7=XY}fAx=y)xUoJ{^o=wwiphk_+OwS~AQ&yx%8gM~ea}&0;B!$sWq20ACi|!`J2$ z^o7sZ+fyherQXx|m6i`mE*Dfpfe;2TUtGv1#T11e=veytTtt6}%-wWD98Y9H1lKsn zbNDS#M&yL&69>kk9|QR;%O!YyUx7mDA+-e0dMzA~BS0x0S}9wGw8&0S-PVGhCZ%Cg zhkUbLo!O!PT>g1SDN~B=E0c1f9?SgC9EPC2d);1VOj)x%_Kj=l5B1~X`Zb<>ZwGd7 z2hN`sZa+!qxt)PS{2G1?`iPeGItXz5oDk8Pzc8$0_#}Ch&*Wutj(?KU&GfnqTyU$(N z8!RYn2M6uq=O<&t-32bE%9lo&8NcMI&54yG1uHq8vl%e7fKY8N5Xf7Z#G^WiX)Au9pECI1ITLD!B#k)G!qGfuqs{8x0 zo^ZIUYj+~9UDf&0hPI*EQ@ZboOf1uuDHRBfL(3T##Api8D$b?pF1|cNpM6+)avF1Z z?@Ut%xJc#pJDiHA||YJD7%CKR1-kGq%x}2 zTvaw4Mh^OQ^@C;r0d|dNy7jtphu=Hv9dcKux&dQZQ6+|}30esYB8ay1n;EYZ(Vl^sxzt-k37J_#r)N2Fu6F1VOHHjiwJQ zl(rQ#kYl3x0^~5mBj|zFhLISg4rcv>I=IIfbT$_5fiV&XwRvW>Y%G)|$LJ;K`|xC= zZqV#X4DMoC6!vo>Dl4vzC=Dg8VE^>%2|=9*TTB%Hd&PkZ|bPdhFz$kdv5NNU<;O^YHCA7fF#5 z$_>F7>RSpaq~el@kIuKIa3&$Y{XuPMfr%0N=ac$KRHBD~HwCvysMNHAcQ}6uVn80` zQ`w4<~6Ni$UaQkDPf%Ic$ZpACAvq%!wOxxY&}R0C6`#YsHFf2C;H}G<2>=ppjwtjE6yd)S`v!gom!ek_f== z!YRWhmK0P=$B;&uqwhFWVMmBcyVhxEIq4C=FBTsD>K-i%Ar$-KziTF0))~0v=x@>o z^?5;isW2}c<=$?(7hWb~<%Tv?^Bp=;_Ci@}1X6oxLhigGL!y-5y1fjftHAT-yfrFs za%TN1@tHe0Zx zgY^YAACDJ%lt(YdfFVP(CKn3NEBu4Z9|T~*QH~TL&Y14?pdEoq2|^jm;;I`K9q4SI zieZ3Us(SzJts~J*fFo%n8gV>|;&cSWHLMZ$j*Kl{3nGS(B6MJSn$x#ZsG*+2Zn0i? zY2@BT)H9$Nck!(EfV{NvjBX3V1uUd6LF|?j_L~R8{thiy-J^~HNFS8_1<|I+-r5X* z2kKS1UZxuKxILI#AknvW4%#!?4LDxx#o52C^%hcxXV+cfzm^*Y5QhAqFrb`6<75@P z%FD|uu3>ol#{e#dzF9)HS;FNxcCt*pzs5^w|c50tI2<=ES{_}QD#w`jfI z-%~K)p6OUkJiNg0>gzv*jjGb$wpvS8Hokyu5G>y%ItPT7pUJ)MJm3fK4hTsT)8!Lw zr5>fmUa+CMZ5E=TI{dJ&38D}A+9_7mUv>)Vvw@3$I2aStk%9qk9QqTjZYSHOaz`ak zYGvMZv#A$^SIzXvO_^W89>z9ELp@q}6rVaVK(i>SaBDo3$XPWs&jU%N{*>sJOCxO7 zOon&?smGs-Z=Xf->9gXbr14S@*88!HVZin$sqNZgd>HAK)XM?&bn)voWJX4 zGwsZ=0v}JTEC-7>+Ty=&(%r)_a|n~CKaO(lUGs0$KvRK z;rk#4rp@*W5raLm8dyF_-h>>@SH@jfMA+qk_UJ)x6cvoV&IPyV7CF3Rr1LY#W1&>f z4!2d*1D;<6fxF9f$AppjSU3x*7?IMX>z!0==Y{bX866~(@&+~tC2E<-M7S3BZik~Z z8yb;^AW1)`5>P@0d-n+Jz0CSfF6RJzyG@i=c*v}JE%>h27fad$_G}JG?jTdWUr>>D z2hegQR$-i4&-?kAc0wM5t>pG1=eiY4e_F&?oG)k>iq?xpW-%EE^|3HLFC0m-vx4={ z^poD$h^#K*&UOkcBca)0Bw7`s-4Fk`(zgdr<O>NdDes{fCA7$){hJK)C zB&~tIdva!Y&$ZF9LY%j5=X`f$(MkfO9r5 zp`J9s7zJHti|ZkXDmALEbkOvD7ag^x@+?6WrsBJr*Rh-Qa9rz-7=UkoVB_*KReQm0G#fkC&>>Tm1Tyi?WSK#@X_DMoNrVxO%`;BfO$hPr<%m62* zw=ixP9jUrsy$9*L{OD=*vEbp4U+h>!vUnJiCACg1A%9tX)Iyz{y=D3=Rs?gWxfdLo z-qBpSHm_x6Uu;2AA8lUxW>^0~%>au{2%1lhVm1x+pFTI#SP!$DVTrCvJxQlrl%h(5 znG;fyDRbz#SkJHbOU%!_=n>RUjod1sMVcl@ z`9{!9XwB;dw2xcVrg63~2Za5#at}$(zDaW4^j&f_l3~-;}G^qL8 zEXgj>ZAxCrp@>se{X;&rsp5v*rfw1Do!Hh{SdMDvQn?Po`BT(ZPWC}@XI>F(SwMi_ zG05&wO0K14)zntUf6&enOuf2YUa2R>m^=-kcSMV4EK>m|Ffz81GL|v2rSk{)ucuHy z^y<~AV%AzUE^`i|Bja+`NDw#-AEOAci&vd7`GuaZ_}vk_@|XrEzsBGIqE&E69iZ6t zwYI~^c(&eik^)P2r(eupFTYlc&CGQpJESti*FwYH!jEoS>Yo{+t!&`mO83AwnB6Wxp0`TCDMub{mj9Z7i^|vg@>IfzX`Re zQ~uuk7h?Zr_4$X+K7%c*$f37hF9Yv%oG!l8I`)?8`3Ki!rvm0G6#070M?i@oosY}V z6W1r9xHaNusq@^5sD)cJGgJ#7a#>l^a&)Wm5QIY@uanq#1Kso8TY5Wt9nJgk{4h%Z z+s~W`I^4UX2Hu1JLYT&Z>dOI-Puh);rp{r;pkg8 zLvJB%N;n)b`U_qAf!HX!x5*Np`6U`A9KYcOfHIXiK!my=bmJB`drgc(lAmb|DMi$` z_ESaTw3gxWk)x^esUD0DI-&P}>Ro$`ScK;Sto0=Pf_Dq%Nu+k%n?4R=lqCIX3?Kj4 znagWA-lsc&XM;UO#0*z-p!!-N#|x@;lJCevK}Xfl8tSItCgCC;%8N|$X$N~C0Z=$rcgbSABe5;+Rn7bM|`%H@OdAmfg6$)HkH6y$euNMuIk>K%N z!LrsG*E~MuBnz%w&ztm1+LX9NQrH%1b>}|K7{usXIw(Gi$22z@rRAcfy+uD?TIrv(|t>Rqh3O)NQS}?WF(Yx>x#(plJSvQE<*r7eR>Y}Zx;zq**PY%Zbm-GWD zf+%F5C;PPBWmyJ|$`<&TS^*v}tz%Dw?X_%P;6|YwH%Yyu-^0K&rfVv1dw4hjF_%1QqO%U4 zq<)yjPoGNTMqpRHux02N%x2qhAiS%9S^QJ%v?g2NH7i-@Hssu{#`_Q8M_L1IX8Q<(q z7W6eMTp^W$+9gcWz3;DT4}wAc!$LAa6T7@=kY(?o1@=(ro9Oxkr1H*rjfA0t&wWUu zkTy2A#-KMghQaImk|L0nvjTd|x}P3YbixO2yn9>HoDu2)V&r>ynmj2XHxxL5hE|gK zayUi-2nU{fLiV|zzZZ&X35Uk?pI=!_t6$+_nKxwnt>&@cM?-v1*0udT$OnqS|W4e(lXx}O1yhQ`Cc>RZOlZa_BZxr!z}-# z5}pWmxRbQ7dq}V6u53Mj!kSQtTMolR3r@EWFM9bTqv#H-8k;V=7-ZW{?AuHEm>x^~_EZBX8-*p*nv+dm1 z$DmBVO{dIru?(Ko)>A4`3X5WBO`Ty7fdK+Kg0-INHAzJR2*&nK8E_VawhJyLGfC)Oi zc8;zG-wO))Yj=eng=>Bb*=Xgqubq4S+=vaM-x9a_Ns_!_FKgTGNjJ$9@GjBPqFV)$ zec|NY_b-xO)fJ9ZBm8gQI&sx=7mlTJ*D85t{>T6%})i^%Vu|JN=s0 z-ZZ<|#z8sR-Cbs`>ttFqY#POcG`BcsME_bMg7)v3x(@t2Kx}?=oD@JuCahFf8Mm<( zKv5fm=AS8lQE zTV)xr`|;N#G|656{IH+gdl!(!Zj*&vBb-^;0RiB5p{6qrD_3t16rQVBVXyK$8$57V zZ19n`I1N&%fU{K8G#FJ}#<1G-(HEQ|YK2QyPmA4o7=7pa*8Qz5hf20ewp}Q@bQbYV z=kD2PC!^ zBZV+%R*WgGvp+Y+rBXGInFC^n7XFT;~P`hhDj7mtu)Mu`7G6) z7JbegsHs|Wb0u=qM9fE0?Fb;jBkSOKbIWYE8|;|{bda7lzGIoO8kQAkkZ-O5mSl3V z7-lIj@H62I%$yKxH`3Jzcvy@UH zbt%A14^7MY`cLh7=G}LH_!JI6sqIJqdf65K04O?Jh!Y_bHa*;opPZmnOQozICgBF3 zc+`KpQ&O7ta?pF&THEoU(yV)7^mtyC=SO%P#DLWu=NOJU?M5;4e3 z5++Ju$q0-#I1x=q+i)0Tfde9uMH!JG zn^CzVaKwU8lLUfEAcVqZ8)&r%k{KhCNTF@U+inKjahRl$vkHi?+XTqlk{Hus0*Z%R{B#4rm3CIviNF#+rQ4Ka?aw3vWG+GJ( z!!R`xMHPfL0|pS2a!Dg?$dZCdAcVF^ZW2g@q@!vQ9Bri3Ns}XLHk6DskuoIIM5dA? znIj0nB5p!p1}Gy+6CzDClqI&}Bq)wmmr~~4 zPRyv^Dw8)9;eFZF+c%`0-QC@ImS$gd-S+PVnZ0*TO{{9=8p+11FS4<$!moRy*}0gP zQ&SdQ)4a@7wYfKT4Q;r~d6}`zo0C@V?Cgc+WoEi+ZJnFxKZ% zX!~z=9+cguD(DQ4uO?-V%eDq|fnewLcFDaYl1U_zNhFd<7eg}MAWgb(XuiyC z)kmFGDD{gMFS9O_j^xbPh%9omyD8n<+pJy!I$G6Nx!t|%kej)7qwel*wm^K5#B3&2 z$~o4}c1g8WQ>2nfBB$7!al1U_!n{Bzdl1Z71w{JH|+MV0ko!xiRZe6;pk{z|z z-6wZ@aMOOi=)Nis{r znY)>pyCjlHB$7!al1U_zNhFd<&9>arB#XJbZf)Ic>c@oUNcu@TyNMw8W?mf5?viYZ zNhFR*Qb{HZ%*?qYnH#%;Nv-ztxZJh19FnAxOc|KBajx(OtbNhBc2 zySnu5$t0U1-QC&U)g+QH$Chq3x-IDNTPTQL9&uu-OHOW#*CP^j9 zB)KG+B$XtRIU`;LJsPyd%0_gLi2MwZt}VJSXm{~<#lCDtAuZH?2;|T zM=Cy~mjT`)s{5qwo0%p_l5JkL)$`2Vo87wuyT?%@CwArKE?0TgjYrq(hkA}fXBrmm z*-pw+2HXnd3d^~aFjvJz0Z_tkCd?QsP^md zS=qzv;3l5~?}qXRCaF}OeLMj@uGJ>hPo7{aip|zDF6=w!!0>&yhTgU@4qQlB3bdN) z$9H7tm5{x+MC(^ma$4ORZ5|kGtYEw^vo9qsw6nKqErfSY+h&RF`NKC*AdrZUd|$+Y zH?`jGCnr1^Te)`~yxz*lF3*lSrr5A~u-P*eb?Cdydv(d>cpV(HwwxK-!kF?~?WK~T z>WV6TdiYIdW-x8tcI`HTP1qG~hLGaLBV-v^_Vm@h==au8XebYo4H}=tL_S>Cx;>*) zK|G;+!n8V^?|km3XGERGcI9;CbwCXo;)Wf^rDeBNj(GWM*KX2mYs#+N#Koo3>{N!d zt+AF`K6?ePZK#Mid(;?wHW$m@E#98^R-oJuD{GsHKGLy_k$W)U>$!K zQ!oQP?bbwyU%Q8t_^qk|Yrd7l1?GF(lKaLNTc(Ryst7oH3mkj=(k4-a`hycV*DCRyI&tFL>! zHR;hk2Y~E;jmQkjGLFG835;$k8P9WdTL9&YXL{;{Sq|bhTI&wRKpw26Z+ca@!@IZ>iH^M2MRzE@Yy0^c@;~;c?HvG z00B>Id+(l@S%m{47zM%JQXeIv7v!%!fJ*h(?Po9y)|FC`Ls}=KsSlD3FF%GYB7!;; z?Y*qIk062zyALQkx*J)RUJh2>*N0)pxF0;d*WH5R1=niCZmU?!OWsG4tmwF7`h390bG74+~iF@7G}=q_Jf*RuM$@O#6stiT^XY~I1UEG^w3QQj)m zL6WM)>=!syW1;YFgv*^k4)uDqvenD>ASkOEDO==Xcb8gl?2I7>^NAYjA6xf?^n zW~IMA7zTY)H1k6S540#E^7GYT4>qeas{B3SRR*~ZT&UIa(b01B)JDOdn`jiW=4XKXJjSry0>C`<0~mWNR=o|`&GYXt>-J;1k&=67`pthSdh z0Gfv;^d+yrCypGPZwv0$HFMB8dW`p+3fJ-&GI%VX9BbjzUx&N{af`QDufxK$IW1?O zY!Z#w(PFnS53w`eTNBVYgKvq|1W!y8tg6jEVsYi{0l7TFi|x$IrQHUVf4;U*@ITCq{trPI;t-$4sKDd8A&~^p1HzYq1i1g71!y&bROWlS;@YG zZ;zgfFIp-+LmxH)-Zk6ZK)AC3Rdv$i-wdcsu;9@E>`z@{Se_FNsgN@`M?3T9Sys=#xfj)MVMH>lV*$!sX(2@~P3h7Ar@j?cYYYj?h0 zEYO2~2@xe(IC@97b?5yrt-YHc&JhxiiRF-Ow8byXmOLAPO z&LM(k!AnIla$&Q30YF4XKJyeF;iKx@PqPIkS+8QA4|qzhjlr#R%jS^ZGfr_x`k#*u z>)iI{Y?^3c^DXwxwK<^;Z#uF&lM}fWmie+{%g*UrFb9MhSA~-Oeby=*P;a^CuQCcc zz!nLu83?|!(*(tXbV~Hsby}d*aA;)BZ$?dZxz*_93-^V|O3XZFi|2=I;*5=JdbXM( z?A@`ez2{g|%Jp?c(>t>28!*Z&OXP`fEMdx~q`jTpW2#0daoj*UV--q(Ykk7`R^M^7 z^9dP~1h!9iE#4G5qsLp`+1W^4iKQPHfbOE~K^A+vTpZ2&8j_Qb7vUZX@4-C9R+-Z$Md zn7OIDebv1kx}qmOtpV&d52)o~Rwkj3q}-*t6+{_|svac@gkeZV@~1*Dx0jZCk2cxcSggMbz{s{$R`M)KD=4)oX7YU{(p zJIHE#LniLtR*cD;S`PTN4=SPI;nC+Ryp?2}nVgl1>jnfhb2eeDTfBbHm#6=)32q zzY0t=)LAC*Bi#Q_*!n{+IheOO~w1IOD1LI01;X#SdGs9V) zYtA2?H$Z)(reM{~AE&pcgyA_WJeUKWOi@+wz1&JZRr)^dByV*N>38`JNfH2!|I`;i+Rht{%(FdvDV#FBstD zp`p3G(d4I_;`B;=!Zl0g3ZY#2C!GQj)1jX>rO<0+}s(1(?eb%eLBhN>Kg%M%)x_$9HaDR zjYXc1#{3uCvyaKUKT0`J4F!kP3kk%e4)<5ngcd~crY4|P$r)o0$4pj)2b36C%15F z_HFgsr2>6S8@jcC5^@%BtK#Av()^BI4mVX;V+V$NyJ~dMZ>&_8!tLK{&6~TZ^xY)) z4wbuoZm4M3`iU(jWmQg0jzxU+4hDrNH6-e^7(Wyaf5@&wG?MnRY2KJ z>rP!J`=0LnS=56!!`MZijsllb2(2WLkVaS55*3!)d6n3PY`wm!1WQZj&)j%x<_Zh; z^#`IK2HTwfZ{=KKi}qu*AowZ}@7MLrnPpW|?6_W#w?}T@*SlM@pK+M z84$XQtOC99->`?q{z7|7=FXYKKvt~|KG^y2+h@tMX3O^*1idsizRzWRWktK9&pV$H zji$U*YR%iRZ0FZd{ap_+e^0Z9;p%ynd%S)VRW-pqCEHSXT1kci)g@kX_6TyFO(E0`P_R^I6Xq-GNN#;Rm60o?{_89I%+`(H-!IPJ zbc%P6zifKnLUBP%>ATd$hmGwbbUxFAWM)HEI=PRk^Rms|aamPR_uM|0knaq|+||2~ zJl#~|-O3m{Hoo6$RCQf?6v7-aUnM?VIxOF_As0jL`tE@~b!D#jo86YF*UjhK)9vV_ zgvlROeJtees$Jhshq_54AGr5-aG!DV_qtOb@6)e!VfS8%S8A5O+qc)5;P+&TmMwPQ zp6;`!L%&D%y$^2tRZS;$=Iax8UJJL^oT1&^=?#B`5gJ}-q<7T)EzXU zNSM3m5v1YGkxA~p-Jf@BLO$y(L0QWPRIp}>t~`Q_Jg_+n+a4Be4JOiN$}w3snrwlQ zW^B_^q?DT9YihQ(``@AP!Q#6H+qo4LcSP0s6%-#X@w(+FDy|l46>n|FgV!&4JS0Ath! zL`Eq$1`2rcQ@hTsa=k;>aU3J}RVwY|(l55>le+Xg(Z>+V;a&y=g~r)$AtaJXBq9q^ zCYcT-Q5RDpV|{=DyO+UN&hD=0^pxhVDvH z%#z3@p+u;UViepYMuf=ivZ!s50TUbHqr9r~VwML_74cN^JIQA7XhdGBs;a8OD)$N4 zPGn9ficv-(GY67OFxbj(0*ew#B$5Pz(n%EAO_EMj9Fd^|3P8?8L`RsVid9-`%dWej z5y<6uRq1=FlciPj%bt6x@TaPkSGaq!#d0Yqw4uX#+(p-icz1H}%F3O0Yon=2X#3ZE zc=_Xb>hs4_|2W8b-BXpvIxLMJ!P&tw4j3+6$Gi>%|>{vvO5ptT${HrE6vvL~taLh1Q`E zHADnJzzWp^##Cm(140kWjdqX225-7Ngk0LAZ^Zt({{6lauL&jVR{dQf0Rjw9E+Jkf zxN^hVOzXU@>N!Zc7u9ZU+O5NRb@eA>>=ZN_C-0T!tfjYi4N=)&e6@Fc^7`oa+4tLX zx#@ZKFSqF^k_FSTt2?z~sF5bfO$@AzVu% z?yHBegi+##!C3A=?kZcvO;obMXeQWXxR52b%!m_&vI{UsHc1H*Fyc}$$x0UzuO3$V zxq7d7lh1uT_uf@rrBzzV2_UqgKuE-my@PC`5X?)-5NaI2dJ>Ja0Vr(_)F~vS98g4r z2?ALyrXgXdn*@TEFdLDN35>xTVOQ34K!QkMlYrbrqKG>i8}`l!mb&|n*pdARF*mpvGNJ!Z$oaj=qxcDH(Mnj zs#OYGdfZC3&~Ys&lew6U3Y}HM5irKISZ6g*ONEkX+Oj_ByS6dVJe8P*E1GdO>t&<~ zAw@!0DV*J&pn$9XAb_jqnvHS&e{OvmEidexwgjFh% z%50k^+a|P?Wi6>~ze0&5op7?cL{>F6RisNAYwp_HtKDzB zxB(%NL;)C(H&t%!`7blv_wO#He|z3d|7*i~`FyE!ko$RhJ^M4FkC|&Mt*J7VD>lk) zCfZ9?nzu;67$jX=f=n$UD@2spMH5=D>WH6;VoK&onuFqR&wm<@eF zp76QOUcNeM$?_%ToQ)nerBl+?GK{7RRt*?vvTBoSYHfaKn(J3BXsSsd$c&1@5`DX` z?LSQhip#c%Rj74&zVo+V-hY8>zPcc+35#kQ2%O=?Xkwv%a7Wi45+b&6!gh=AGEZZMIM zkYggOf;d;OacF{EXpSgkB9!HiZ$D@GQuVl{ltU94*)$O8Z* zWMog}ut(bO@2xce@km~K=bOhox3j<^B|sz$Dx}=Ke`dA-7(_QFxh<(mT5U;Wt)~r31Vow= z9(8eZnz@Zma}r4jQ2yH=fT{<8KeI68$kro9&*)aj7$%Y>22v=~HfW^8WSVQ`t+&sA z%RZ{Ff7;gj=VT063rp6m^KO|h`k&j&O?yV+{m)Bv7i7Pym0c&C-Q=g&d7Cy;mXxVY zm9KX#WXW1tQq3imcP?sERF$?{l%g#oy||SsYl`GrG*xj&KYwpeZM>%Mmi{f>HGh4I zMA(@|r7}`l8MM%nMn)tOL_9@KuR219!`u83J3ws~$YT}>5t@xK*&-}#P=SjDp{90T z!woeWFui<7>mRK@Su%Ge7yZ!cE-xd#6mGk_&R7swk(g;@WYK#$K3!9bD&fVJZ7UTv zw6j%~Z7r6|D<-#6t#WHilB$^@5=lxTFuZG=u1MO;jl^y^K!`CveE$7c$-COky;cq` zvRG^2Ql9@2iXkB*Ad*0fNiCyB(QS=mMzUzMn$l`55>jl17B%-s51l|k?C`6B_5h!t zWF#abAs87kF15DvwAGfIYE;@DuH#XWHNR#4j}dl*ND}{#?E359diX3_)}{cX#KQ zJmly0QQORlmN?1+WzqM*u32<|!b+U3o1sWFT2X z0uW2=a4E5rF?)6+-uKT$=X>68Z)h|&MikqT1|H6us)>ncNf=j2I#r}(vMZKhCu=sdqauYPB(yUz zl7v8V%BB1_vQj;zMeSI%^h8I7SIuSgtL@jzWzt8ZmNSYig8S&)<*N;r+VU zWYmFuspUJrb9d*AfnF(@KlH5PWYA0T_qFEG_P0|;tBaN#1awvNS=&fom|pX48$|K~ zDX9r0rR%ep^V8jkHByH%POOnur;$4S_kQrMiR zC`KtP{cnN6y4G$p7DDrv+40q{v*+>LtbZw5E$7`fT==^BtUWl2x!>-cZm#r&PM^ttu!AZQgLt!7#5wYQWn<=uUKe`Vvpt}LP5_j1DD zefIr-JrdW{FSqRbzG)*_J~>fUOs}|fsrGN*Y~$U;{UgrqZ|uRYN~PWOkavCe-+lJ( z?(XQ>-PxaC0r0aJ3ek;e#*;B>02vM$cEc`*#?X zK;Zaw-ahZz?Ph)1$U5rjpN2$1J%&ShUGCbi2rxJ0M#7Jxhr zdjdkU%iKj`>Fl|XXP1P%d=5?5op-W5?&&(K1RO^)KYS3W{Z<1jksE~no%fl%GD|Bs<4xXBlDN(URMv``ND^e7mtqFL>Ce0o4n-jZFhKZh>yfs2j)S`u&QHAwdlekf`Ws$ z2<6@1AA{uDhP2Q^9Eq|dV7%IqM|XCOtXFyX!2s(~RP$s!v#GG}Lf z0rSqe_|JLgcP9KFkK^65t6|w@CV7Jv2_~3-5tSyZn4`gXWdh^N6}5ry7dE_zb~BoOuf-KeS$iZ z>yCE)$GeI8N1fc?*@Ik_OS|bH?)&e)`|aJ`-O<)M6Vac&Rn6Ur5J+DUs13nRC6}@t zEaCXamJ|hOFx#aNS`j9r9CoNjYuU{}V2DYqLKAFB%u`HAnnXDcK_*8cMAU%N1z{3M z1d26Eg|*fr1kFN16eu(jS7yw-kp>i^eHe*F%?N@cuQd_EOhFs~zHXFBp<6SchaynI zh+x8!N+A+el&V9ZHlz`O0f0n5z&+l}d(XVAeW^#Us!<>r&?yN6 z%ssPTQ)J>AS5`E|t5v0*oE(iYGI5IcWaCicv6if|ShA!h!5It)hQ>oe0_QLBvr-_- zEKPbxG+{;BbfSZbl?W0i#)SpipC7MEdZ(%Thv!Vnwp&exH6^1`S}kcU8k1`pjZ$cejcito2G*sG zjc9EfQ#3qDJ%0ZWwt4kva#1xzGL0n?)`VsMb{s4)vT0hciu>2?r|+j>u%^H#B ztFHhW4o*(p*>Na@Cw|`rj9M&OFvCcFIT^}F4ji0ZI9Xz0h8i*O$0e4VQf(@0Y_zp3 z%2_fYkrBw4alh3%CPs!>n)SLeVoe%#%Hoq2Q$s@{HpLj7_iek<(zX6;a;_Px_rP4U zLhL^`%y>^2Wq4dmlHm4L(R8~$x{I-P;W;x?i-|cW2fv;v!GnAT-X(W*6%8*Oh_oA>gs^}G8YzbE*3e8``5 zCZV&30*xw!Ix9mmNF^>OLQKmMA~-}8b5yHJNKAx{Z@ru?D%8~$H9m{1zk8oAZ(hHC z-oGA~;P66$=^jn?^8>IrJP4^43#pSvmR5~c89ZF3V;gOyHl(d7X*NxKn{#VK8-I&6 zG}8)`qH2*4s!nsgxuRi(x^f7JM3T&tCd7)NEAMqx-L-$HI2@<9O`TQPaD4S0SC#9k zy9`);eRWR5)$jT6o(G4#g8X2k!c)vuqOU(1>ZfeBrmKGcTNaj9EXk5&%{FF|O^p$% zHd50zjWX11mXfil5}Bzr5?VDSjTtqWv{p1)5Mclz2?o?q|2Uj`)Gy1g^wG_>S%w=; zQ<{>gV)WYw=J?}~*W>)Z@&`LLbClW>=%@Nb)YPv$%Kv2<4%$Mrt^3`^$S*urkwag<@c=q)8^i}IBn4|3Wbh@w^M`!1t z>nfV6?D+WcJg}_?lyOzUIX!h9j>W_{k6k_dM~d%}_dbnnGgY=NMH_5eGh)of$+2QB zGOUrcjg7LFi&)YD79$|6j)51SLH|?noT`i>P)jUI!o^Z*)5Z4BN4SpQK>6s03-<%kyb-OAori&d;R$O^+>t> zo9q0+_I|#yS!tO@LJ?SNHB6B3MGwy*^lk@ZU+;D9R(-P<_bk*?aNTRY^LNd2JXL%c zsR987_#&%6(G{0ksY>u8J0q1JMk^APux_^2uJ@nToAdhz`Tm$a`UORPOAxH#s!=6Ss8z}> zT4I7ll_qmKQd-7Znat4?s-l);ha%NWs;X6~6{*cEshAVtQ`7o?u|An{QSZ6_)XP=` zcgssFo2ON(-sP!FO0R;x%}F5%zrk^`<^+p&pdwHKWiL-WDK_2TNP>5Mq@9Vb)Hx~|zVaP_NoM_9^q>umOTtHTnt*71Lv~$V;_IR{EPk3 z{?FOW&KdsZ^)xLd5!ioRvk(Iaqy#tm{}5HlRZ@vQ7Er*TxnUs)jGu&YU-3)`Shm6e zTCh;<1GRappzV~bk;{rXf?}>*7c7;caXy_??h%r^aV|0zReE~ru9+pIJWrmf(*)FB zk1w~x*xPBDGfcEllPwxGj1yKOW~8@uw%4n$y*KmcU3K*UMRih0xCCyf03p$4NDek0 zQh;(kBit7oz4N-9q31q4c!W!~J#idLD4J*23%vK!r)a(MyfRdZ3J0Bw8;b7qy*v$2 zNw>aw2v%kzLyEbW@KFN<#)XE2@Cd@dV6Pzn2ICMA1*|mD1PBZg*f7XzgDVEHf;>+N zRzXVyGXhzGkg$e&oO znVxHXqapryhOeB!yYTOHd91zYs^AlJg&uc83TLxg?xU^NvT3?w!c%KfXO~ZD-aGr= zW6QUzh(s#*@e`-Zuea2T=d9(5n!k4s6$bYT!xM+6w$h>p4P};^^a24$;!xuG_F?escTgCG#{mSgQ3l7KVx3*} zRtBzJblmy7cP9?>>Ms{XeLm0!JT1q)>pv5z6haki@r*2$yU%8{Oh}N*%M|@vBNPaI zJ?WtYyo9p?FYGd*zd#3RvT0*!pa@lSaBDU)? zeEyxX__JeJiNC2;zohLIGS=^}H#MKPPAgpGbrZU~^6k0kmy%r(iDf0~^eYuux9i@% z^aiFH9-5}9Yx(YoLek{n`ASsr_gd=n##|@0SlORgZ<~9d%s%2R=Jw9$B#AG+`|UAW zf~S2|QcmH!_Uyr#AKUaByMJa1O6sUO%a5}!aGYYPr6YzIZrZi5u5<}+3*L0Uu zf<+~F+h?nhB{?#!*d&)yqBKF3Fh`OY#?WLSohhVGHOHE0e5GF}2 zZr{^&18IYAY%y&ijgXJPH0dOKAn=2S14!?^nElsyN=W)UzY*;dl-DB;S1XE$X&iGX z%ptMFOSeN`Rz4iq-S01+biV5EIog(sCq8Se=gv3}-cRG*Y%iqXz(S7#8iDvM8jyAN zX(W?`hu+EyjDwtl;QvwcNq5Kxw3-LV&-jA}wW)hl2|^P)CBD7)A}glIb0< zxuVVi+tc4p+tb`q=LU;e9qUCiNaojvIP0U{9{@FYk3WwdC%$*;;-Q*eH5y4(!9sI1 zq_bOE=cg;8G{%SNgE=z8`kQo95uk4AcKc6z(xwH zD}_xILl*_hSGH>!%B3 zGnP{7gi5N*S6bCB>HUy^*2Pi8M1eTl7d|2;xRn|QB*0?;P ztUWXc?{|XleDrS{yRIS9zGH1m>DzilBpDEr3B7A~m6>@YU66SuY?qYMX{vVlRc%#U zG}hhTU2<8Xkq1(pcSh)pQ@e}=iNrGqf|8O%NXu-229iZ33u<75>LiX}PSvjl*OY-V zV)4!cj&kH2I5R~}O{7JZrBX>HtpFoXM?AtYA|xcNkgP2k8YUqKfuhbvh!La+4iy`S zLdi@di6%D8C`Tf0WC)~TiKU1q55KRZ6VL|71_cVi_sktwEsH-5=cAVI)m^1x=pfFs zNLO~7cTU0#5e3JLe6Bjo?tf0%d<#0@S&!?h&iiL>Rc2y8Pz%~LTv_2PP}`gWL%w$Y z!L2>i-@D_uIL_Wv1Kr9Lo}R(F=KZ?|cO<_1@3tFIRPU;)N!&Mn-Iy~Y`+lt-XWW(C zec71nsX|FvhXTu`3o4T-h@hVK(uwbYBpL0am!x_;+GVcPL>n5--jlS}5PYaTy!dQ! zGPZ}Uflo`>y4VIHM`3J~Cr-B6#wdhA9w?H{tankLWDr3 zxI4BQxxP}g+42%xV1S?Q#=*azp!hi4rQ6RFR@;S2lvxIjEMZ z7;1`^Ath93@j;)?<$LGvcY3b!wsb>#ttD^nd+yfOyi%&vrL?}HvS5M8rp`s!H}}vY zN|B|rEkHyhj3mdwJ>g=#unO_od%tsd%T1qblm@zu8~SGD%}7K&Gom!fZoEY;E4Px9{`! z`r7qe+x7mxxc`d=z-RHaH)mf0%}m4ylvoBTc^%0)!7tol626v9Xn zq>z9hBat?C%d#Xe$~3v6sX|nc=7DWU2oVAAd4K?59=InAg{V9A?epk8GA4!U;assy zM>wuBlOp?(^Y7r7idh+fXs;^ux(?)8Clk7LF3h6UR~OUmttm>%Yi5>9Lo%e$LQEB3 ze}6yU0YO)pKhy;s+=L zu@Zu)p!(^x0Hf5AktC96%}FNNB`P2=zr)WZ8OlKpiltc;htqVrL~JHvl0jNyC=;+E zqd+`zw>(PY31m+vsnt5kEC=KCK70q3RjR(;t9t!kq^2n_|YsjLnf0RMCwTi6bINNQRXF z&pXgQ&*S6$RTb&Jk6A`XOQo1aR#{R;6Y)Zi?EgHo4H8s(z|-M9zrWq`e0;2u1i@0E z!DQPJNfJesHHN__`S=|<$j3P}_qo>MnZ+kLT+tY)h%%cnxp28mQ~)#|qkSI$4{`+< zsrP$go}L$zB-Fbny>u?wMx^);&&P%3VUyaQT~*k2i}TRv?Qkv&p1MxiR+FgUa%34N zxZ*g-Wp00;#%U(VqZTk@8VZ0YlU_A#e?8m!{y)mLwO5YHIB@t_YXg)?Ck(bKL2SuRsM7R_nECj{n1;!cxAG+ zQfP1TdspiE`1<$z^l!6~ zRsPI1EtfW}Le)QiukHjF@pvdqpHlCe(L`Vvt5+;vtMGmjd;zol-*&26r$1rb7?DIk zav4%Y+Dj!Tirbo{mG4`WIFHwV2ZP0m$oAs6o~NSp=!q7s8VdblhUX9-Dkb;ce_wsy z7@kDx5o%c*NY$ZM8CpUmB0xT8Ke65lkRp=w{%_&zhiB=uPyqf2o4|z@ifKl!+khQ{ z`i&W%mSBWD^x8*M=RqTbYOEH!oh@Dl&65Nv+C`m|M@|vgm8)Svqb?^%x>==Vsg;str3nR6p&&kop+9|p zYp#2RR}KJRG+{NW^Lwx>DpaJUr6nw>WD_8V;$Q{-2*S|J%+4vND#W%%SyRk(2u^_n zQ3-~MT(G00QDF-@8A>@14MOIpu@%6k6Ys)lngqo>R zih`1p3@odZDU~4%A{*>6Fo)#x2XXiCM!{qK3Lj8SKW{~IJ|`3OCJhOQ8FC1}u!07t zNtaLGF5%~sWK4*4D!3PCima78ndR6?{nHP1x*g~0q=B(C#VDtMCB+NMNdpMJC_bVO zywxvBZ4f|VAB1xW2!Z@2YKbU7#GQ>;ub_LQ%YhfBVWsni-X2Q%=WX6}24E1DfCPgI zkP6yamB#TQ0IY|+7Xm1V$+S|Fl?fywL7~dpK@eQ&jLsKqNtYwEQxN2xOD#(q~Td|R@KNM zu50Y~5?;_R-(Kx*{kQkq_WU|Oy}MHK<{ArY@4oFs<>ly3`_w)zZ{J>hzkGL(*Io7Z z%pukZue%i-Vc#)~_O-ptbQ|!%zQtrZw8P3ax9p5O`12RnEq6!lt=&Ue6#{yZs+Y$Y zy@(qan#;=@d#$}2yY*Fl_uqHcexo|Rs*-mH^KxcK_WWkFwyOXm-uMDN;75S)BQOz! z3?GovD%%Z>_{k1f7Yl1ZQ3fnlXiHU00y6n{c?)ohz4AgE>9vPJ-svF8SzKWy2(GHc zgS7TM=a-9yq-HD6cHPnj#pbvrRqn&Vk)`tWPBO%9?mo*;FGV{Yxf#khdFjRw7%X~* zeL(nb<%Vm)fnW*Fj@OMK$OZF6J0m^q97uLeGOfjiA;dm;J>2^eY;1p2YAHCHf!8XE zMZY7tzVtn=?5F8<-S5X$(r#vD*d`!ANDK%e5eNYRfS00JQNs9399KeWm;j(q0t0|2erY$H zHaQ`V4FFNFlca)4#?nMg%pMuHbg~`ULTMPK&cam*Xu!y8GbR^#E~1_R=ZYiWUu$U; z-vm6pyRi2W^I_Y%s5@ZxTzANlkE6{mxTX3jRd*Ts9DSZ?e8eAOTVoyQzzEA-OvwJOD9gDBZM}IK&Fj@ zsgZcRH`8IlCaq20=Glaa8yZUqAjzZKK*9(P;sb~aV(pX$2m}xtW&VwU2m!u}zOO*? zF-?VPF7sm4ZhhiC!&fY42?K}G;2d{UX@fm&OSY6iq(zBUryET9;ZXVKD#Sr6l>&JB zZHhi+mBACW4K@6=Qlx_Hj)mkc-yRLI;Yo?C?T@3d_KOmQtpE#r7mM@eX1CADhigq`+t97p_|8Gt9`e|`VQ~yBu!Jy|#fF85 zA>Be#Y1TmvAof60VF8_HG$>e0Ha4L_gb5^uC?K$_VbBUOrUkZ|H&-{*jy=s{JE@3; z1d0NnQIv(b<}v>S6qcf_>d-`_qC+JMn6y%fOA1JV{j!gv2!Z&Y0H{D$ztGtt42MBl zqk8NB%9acil$4n(NvSqThFdm*$!w&osfK82DJY96U_kHV0Mx3J4QouxDskJDN@5}+ zEfi2oadSi$WL!&R7MPP-%2X&MQ&KcYeV@irS|WukT-}x*s)o{v6IDQY5xU;=;3+Za zhWDKu876cmzIZ>{x%)9$xLg+-}JpIewl@|=lJ z31R)F3ZK7cIu476st@v^{lC2H{Q_IDxd=*>%!Oz)B{3y7oUsy;RHB5!QA+8YMns^} zxOF+gQKTju(5ekewNlGfElRRAQniyf7a4cfB*JrbxaYd7U!|HgY~5rka1&BUjFBX^ zh_-1dHd^1UwZuVDR1wf9i84e`!a`Zng;k_!Q0)k!E?wIwsB%(Q8zL#n#Sv0tV2~js zCo%iz2SUQNRF6tZL5}JEwvpTy`soiqC@4#$uCZS%Xb0S5cJTfEFW2@L$VhEO3k?fO zrJ#QY`7Gog%H}=-&JKSlS6A9E)m&sh~g>LEymGk*xEI9 zU)_4;%Qal2q5U)0YgU@Mo5KPE+zAu)U9xUC{v1v^^$cgK4Dzcoq*px-DO6;H7opRrOELekYzsdfllVt_2M4Th|0 zlGJE~85tydj`V9Y62r34xeeO0#AS#py%NFYWmhrdk%er6Qsa)oQ#e+c$ z_Wx>)X*pI}G>|~*p;`D}tM~SQe}fW%2(XEv#W2k(s?|$os){iCTvm&puN%}}t zN~t8P2_g`Q5oqZGU^>}{B4&#$_68nQ;Xqm*2vXOAk57H}?ho$r6-4P8veeb9Q#z8J zGOWZ&0RA5QBCY2)D$O6%5##skfrLB&9})Wu!bC|dT2@!+;{pSf1_S~SoWnSMZ=9sx z-dG#qa80fUSRdC&eq-QYqhR~p@AvK)Az_v!QAmV=Ng$F$q(H!+e&g@wP|G==o!j4C z_WRNO^835%;ehx*x->;JqCZ&d!5}ao)l2iscgBh550796Rp(F}IxiFI1z#GgZzyuhm62l^qoMDNDia-cLOlX3T z%LENkMS+oNX4(L>Lj=~Txti2ktdwC+49m)e)WQgX07Okp0`fv264VNKgCs}_m>~+w zXh#AK%r>$zoP-i$7>K5vjs_s8oGk=V0@jR3K`d}E*uah?^1H(&m6p^;A{CU0F{R9z zdW$5iCy#-iEprRi=!bjTw&!>_A?I%L-h13~`FQS5k0~BgiC+%k#E?X{m;ppHmCRAe zkmhAhB`^X?Zz}ajHBgh3%8E9P6lfx4lCZ#n|IH?1&U0x$D@dk`IgUl0OORAa++88)R=j zn8D8j48fp5+hj#DKqYf?!^^io5nnwNjg*SnNSS~(=J?r25V3Z0hrfXHzpK8+F#L@Q zyXAKI3f@^h@2KTgcFnXl_W>2$xIF6#-*9JytAvX1e=zeRad_?9AY@orj%`!3>~#KBBMf>%W)7b&7>-=KJh= zfj=#)?iJ5SejdK>eTUzERX*GM8)$VkO)iC1WreM0eN-%UZHoa9oxyAFRT7Khv|n8+ z!)Y!dM_+x^%qPCDP|o@e59A$S>fU*>o?p)H8k(_RISh|6=4?AYO8d5UZs&b^>uSjF zyEV(Yt@F&1KG#*Lcho*Rnh}vsrTP~H!JJ;WR1U@e|(=L_s?ekTZIVH^-E2rc>HAiNr|E3??(gZmR@nZbTA6Y+6pqQ;x*}F{ zV#nW-u1ol%MfCj@J|i2cHM;|0Qu4DVtjQUMNhwxBke0#+93b>P@a=qkuqn6!d;%2b?ap>ccuy&nev0=WAi&)pC zXHqwVv5MK)Lw$Xts`@>!WLi);*{04Gim?U)G*FWhUUI=^=y(h8DAjP|J-Yh9z>B>m z1YP5y2|n`_9ru_$Ls8ks+_RuuLGm6m%AKn?a>ft1>-%~1ybxlwT%pxylh}>7WK;+O z9U(bv&Dd@kHJsjSlo!sCiZLJ&ATdaR6tbN2l`4W!BP7roGzFEeUi2lhyctQ{#1H@x zm`>YeuGSu72o|yIv%_xz4-b6yXx=N~?k^XQ5P}KM5=8(Bpz2!7Y!Na>l0kqNks_v( zaRX4{bz4K0(r7twk^{^ZlLCm8KvbHO5~);{V8A#SkwgW80?A=Tw!18-P)1zL2pCIX z<~+dsTg$GxmDMx^t_E1eEr1bOA#OmCB7y>76p~3Wh&ln-(Z=wSU?CE8AlW7+%4h}- z5LVY@nV4v@wUlppt!S|%k&%Q+BMBHl{Hj!liEM=DM9fOel%%4tlv34VEV9{Az|kZ$ zn<>W}BqUJ~K=HU*Yxy)P>nX__k_62vw_7GgkfoZ-rUIZ;86t)R!W0oyY`UQvq6Gj= zjtxjMXGt++8=qMFS~w?nV7>}AW=2dEEvum~>RHag5NNHv!fUW)=WZuimmS|4?O3mz zg-GijX2Y}OnZxgw&~Txlfj;H(8>4!LUGx*JW^Tp~Biq`h*!z3udgi{JQOVp(&3DZ9 z(p%C_+?5r{t^C{j>80n{9CLPcZ&%&8Z|(YWgOe}sw+K}3?v|>-g&d<|@H);~fg}+u z6W@43ojjA!c1N@UPXaU$8GcI5=Tb?@=W3J4kw)&J;w{ayr>fXhA)WL!+1jBHYtdQW zeY_#$PjKC%v`~62Y6LfDw@fbA`+DMd5#;taj!=UQL+OBjbRE6)d)jVEI>EchJ|`@g6s=! zb>Qu6lpX?`jCOE>cFy6vor6-RLSZ$CQuwv5&gldqh^p-iRji<0bf+ti@zu10fTYWF+ z{q-!=%rL~DO+_+9p-oba0v`bQcrhwetZ!Ht(9R#W@ zic->?VMI~bMA^tD%Z~M7wV4xTN+869O+ea!T7CaP`M-hqC$U*XVTP8bnHrN}=iZ&b ztyc`!-q*U{VVm&N`m^Bpf*-c@RcMi=e#|3@oPuRG%YqP4=bviyWmEi2`j$g%dP?Ed zQ~P#Dfc!c0Kc0U&{6BpRwkk(Mrz>j6vS<==Qk4u+Ef!qmXp11Zl36LGMHXaQi6oRk zNDoiZKakn{`xZp#eY$Gw5@)mXFFZEi&&yQ`LWsb&YMU!bRFR^kRE1a|SM&x&_P=$^ z!GAD&F!+6AV}AaR-}mS3vyobrk}6eE_&>jYe{cBa(o{bb&Q?XhoHomX&HzW|aW(>~lL`yL$c1vz58KQ5W(jWQ37X zQ3Mz&si|gYv=c2(7Llf=K5GKxb{AtPqJ^Z0n6pgLl*+s3SCz?&fm=#Ku7J`aSL1S$ zA8hF-%&KKZ6-7}ADpeA2xv$+h_UF*du6v7rx#$~be->$>KCvl<2PPL`LpYR-kvTQ} z<_U=EL8ae2wZAAeN!y2js%KGXq;Q>FM9>>1EKzkl{h`b&~$u=}kH*|$= zv;oTc&LaT0Yq~%yTuqhTY`0@#P{e_~?~67rNDvNZNG7fxMSNFBIyvuqjvqe?y9h53b(hlr;zGIY%T5QZ13T_>dUqDqZD)&3ZtKPAoho@ zkG>r3^J2CoCt#}Vx%B$2SISgl7rrYG$2Yp0Dxc3DXEevwUZ0QD<#kJ~b2qsM^q_SM z?yJGwmzGyy=L?iKi?3fAtE=qJ=OX0As*d$hrbpLIBp2Uz6TsKQ=!;l&a{*C z(U?9nj=cKgi)xninGR%=Dm`JpoBQeA)w}oGyY}w=@jLad(|#Twd&l1Qgh+r8BB!*- zd6z%du#+uX&0(eOJy`SUWFj7kZx&F}`(2ce4W;2X>d5%2u%uT4lTqc%A#NquMX9w z)u!FKh$s;SF^C8p41&26a0C<-f`}oA26pJBl=~!R7-O6V0YK~kXF^E3M)D~+qq74S zC`NAuUp5opuTNRH^c2!RaG@fCg5!M=3Msy*s8RMWhttz{oNq)CHzI@~>UVb+cM1|H zc%GhlaNc?IJy)OtihM;hi-7NkC2_~jxNhJ+3Fb%P8b0^caL;Z~gccE4MV4Oqca?c~ zOeB&JB+8#X;k1Q47q>moqr`VbcAU2y^LKBhd197@`te~FK!5QgsqN#)=K33y1oI*kbhn`9Hf_)+T=$2xbtqnS5$FfhWP zf;md*enx{;;O+PNe-m3=y@PxTa=4{8V(&)!R`0G?>`p8o`fA%l%Uun-eC7})mV{KJHmD z{9k~N?f*Ii-`(|;U+hFSM5=92yXgM^Z`=3d{r!Dj@5k%!>!;@5f?z*~(n!@%q2LX3 zKoXFHXe#A%Yx~M(s6Au(f$kr592@AXhTp>DxjiY7ol8}cDkP=_8qsQH6p|*ZLPJvy z6{K}dO)V8F6%B#f*33R2{*cc*_x0C!hh#KQe(yc{w|>vrxA0HhG|No73sDe+3^@{~ zUWAbOTp!QWAAaw? z`M+uVy8Oz=f2!I0-pZ9kDyk9~fYV6_IcH*Ee^et4MEJL5Qg~ftV8nyfMEhTmKOVko z11;B}e+TzTMN=eYN+h9d%+R93EG1NmB!Z*8l{@w+{O+yCm``uzM|yj?0zmHg58(p| zGD3?8ppaDV*e45&1;42R{;|K*6c*7;i2?&yW(GJPb2FF>e!pK2;lF0lkLZ6tNem4| znubJ5@FgNi?`FDbUJu|sds#%YKa5zh47~64?-b8>UkE?dHb_FMGO9@>c+nw25s4;> zi(7E_#`P?k|SP~LR2oRBEBp!8Bcb=R3&pm1SilpLbpLcK7GMSM8y( z6_QH7no&hjdr>Ho=%^5K<&jdS@+QCg9zX$2&rBODz+8^G*GBG91=?s zAsh)X#t1-!1aiQE4ohGoF%Vr8ljYVu5Ybo*sw_DrG-l4Q5j4q)glZWR>^^w@ z{O?|$Tl-Mt^&m?l~s})E)+6G}vr1|8E&C=VJ%gHx!{?zX;nKt(2;}M+| zKnlfMi#vAGvp|Z>qfFBHQ)r$X;llCp`!4kDcipzU$IkwQL2uW)%<7*HgR-7CcE{8| zZs7!Y=W5dLQObbU{3j09PzsJJ&4D|MyMdw5O<^5;BduOWd{pBd~>IqU`DvZ`XX%o5Us2`0}r2fi<_up&o zi8ZW}L@VXvvRG1|r|Z@}O7`jvt&2BxqH=8Qh7ne^)8Ad*?VaBDL?D}U19@G>>jogN z7hcPo$u91bH0E{oRJ*zNefLQuzWcX#e%5U?6FC% z_Ws!~Nw4WFesg1{b(XTt4ktd{{oUN#Wmw+Fe%RE~%u&oB?N{PdpLcQwCc!7%=3L-0 z4JF4h$A+77oGOj1yOn|LzzD$rf)NNTJo7xvn$=dRB-G!QX0^?w?)j&DYFUZh9<4ip zVb!wyg7|rQKCnH=-$! zk`}9MvRd#45Db%yVGOiU0gMb{3o!z`(WMo zRN!TbA}ETPl(mK%RVyhn(%~9Drc1B5@|e;QxRFek5>3dIOhCiM7=s`XHVSMM%Ze6) z2&mIgwn2p!VobP-^)8mhu~9$O#-DgGV~20X`$8J@Eh>?=_c1KXK-NPhW1l6NAZ_N(|bP+46{AyZ9e>V5WSvxe_`ee>YYWz~IdrK5N}5fIXQ zAd51p(Pw1L%rmQ(6&yWNE=Z4eNsQ)o_EcADecyf3NiV+b-QTx<=Oz79zT4veA^HX4 zAEzVRF_3|1jTOWm&%b^QSsRWA)meUMGCm=(rC~#K+geStjNyA3OY*?~cl@P+(BWWVojT-evAA{PZLO2qc0`gh7V^AI_W#Jbn8( zYkVdqq$45b_pN08_w94qquyrfyra-W`KciiMlwhu zd{GK%Nd7A9+zj!cw^w0#XLjDdo_u-d@0Suy1Q{?%B$=;kyS^7E#n))E&v})8un_ESM zj9SYvO3Z}K8&<_A%%TOfmc&*|Y?`oDlG>>(l4`P9EJdn=YSyC_uvUF*2#8=1ZGKl5 z3Na=`n_QOMCKWP*gGOc~$~f6}8G@qLQmP`<=PQcVMA-#1BvEa!xY$z|Q*5}vrooa! zDuz=i3$bQ{F^Fi!(UGE-11VHa0I0Sw&9rT3wUXM#)=g|`%@9y)Y@mG!3G=^wr||Lv zoc{C^#cuVvT=~B5e9yFqrUX((Pu0&o@9MMdd(U=k?9F!@Jw_2y5Lik}Nk%r(Ce*D-ocV9Bxb?gpG00RuK&s0C>eBlp2c>0zz9B2p$B2 z!7*TPBn*hGB%CHNoK9DkwfB_In$CO-_0L~#+21^7M!h&FS*9sE0 z$`If#h6-500yvFIT7n{FNg(i(Xh2mM20&O0nh-D|2rgIwmBJ!aA`k@Oq!n!-v6Rr_ zkbtNOk^#aY4H)-|`oTh^N+RTlMaYVaAr3@kMJdLmWR@hRObwLm zQz@?pPW%pUlw3M%k9E%u9msj++cp4Qfz!P_%kTsc*~{lpIst<|=Fe_Qh5^%iACqbr z==TbA{TdR7wismee0|~F+MeG&C*BYX?WiVvPUUXu{nrOA`&DheLH*on4~K3tehRB? z@)r`yOSxy=lnM+`pMCMJtUq_i+qFC24~UCWd%qc|b3J@i$9a1`7e(cDSsCc@XzoSz zrP*bA7VStX#HcbTLpJ3?r)yVtjW8% zs{Z=)oloqqyX1Sj=+EQS!*GC@;|==)^z*y$nTXtCmEn18 zVy&yk7?#--sjQi?vVk?C_>gNtUUk$?&BME}_bP35EI4>@%^U+WSZAU@W+l4@#6d+O zfeTKA#3YypqtP<1kP!_q#N#`^3+3;8{PvWX^=ZA`l*^?nfiJPcO9pJ>eM$rC*L!-c z6l+bJVUlc8%8Y4B+F7GX8&}J#-=nKtL7quN2pa=xkclL+!O5-cyu8A}MA5m7fJp$7 zGaUtjLDej-+bkF$Xkdb#Z#8#Uil|j^ySf!k5XRSdHynJ$4)f=&LXXIN9^$wF*!W}N z;lY9P(zqc9hAv)*f)ik&jBjx7K1`5%cZYXEB7BF<>4G8i!j*kjd4Ti|^c3(B4>EWM zlvHdVpFM`SJKt*KxnpAx3EVIREE@tK0h@;7V+{}%$O>+^nykCc0;Y&4QbABYxnp1{ zV;Ik?1`XbMHwH1!O}4@~Hat`VO5hC+!MXyxxb?<>zds9De;oB2+^@;ssn{WRv4}hNylRc<`bq0x5`DpW zqi*?h>QbEpha~QKn9f#S9i-B&>YK>-bdLFVUChjn={iXy&zo)h{`y2OzWK7d8)5u@ z$@YA^<;dVkry*A zbd+yXT$FQHcVG%{USoLZuW-r zcbw239v*iK!ngndTBHOnp-3uj4x_Da$C#6w0?6jIlCkrCS|gAVkwK9J?`c%>3O5l? z3%durE=g<wq@q?CUhT1 z#u3P(j$DbqPs$6X+y{2wpM8(C@HPc~S1xN{@6b%Yq2c)a6sm1X{QVL@FO!~1_i(J| zb2BTO==@Yekfc9;yBHM%g0PlW3mYvp4L+yu*}3E-C^H&kA|W4p{m*xwUVcBFT=nU6 z?)T%zzrQz!zsMp53&qXbZ*@&3mIcK2CUS#TJvL0XyF2R(_>w^+AqfRWXP_KVehDCnK!aD8rM@?%)$^{k=Y3r3&ixN=_yP!LeeqyO z$r%|ZuYRu!$(`4l^SRF7v;g`+gcuM$k|dH9V;Lr{=D%0YZPn+SU$)PiKbvcp zk3RQbcHTMT?{Xm-CSsI~goO7u``+*4m-yDp3*U1&H+Q4)1|%UQAwH+HQ~Lsn5QPXq zzM)kYo$tF>&)ao>AxwybM}NH6j(+id_Q^JAy6*Fchp>cUB#=TUxX^s!31I@)Beh81 zAw(i=19lvQ@=zbSvxhK|3svAor06RxXd@sPEFnQX?jArR!ZdewUhMjJjy&;w?80e0 z5SHb*q_6{Jk%$u{2bRlKCNRMv2$%$dT%|ZzaTX9pGHpW}&v@Yh!gqOl=;pKU7Z9Tr z>chs6gaBBv!CVx$4lrY7f(uBPg2o&n!)ag#AZr>4i!ve`3jl`s6kZAEM?NHq9Cy8r zqsaE;@!f^m5J1;hB_)E8i!Qb*!&q__DFU>sF$V@RE;JY-I1IM5NpMC5wX(?$2tg)f z!qz-^u+&^H9FG79^UgiI#o^uH`p}F-wAx&a6DdPd#F&Z-CRL+BCSshXP-!R?XDsG( zEF>+ou7r}x!)72sR2(8;O^{I{Bm}IAK%r!GD>B4rbYTU*JH2=^b5+fzDShqWMu7l# ze6DV8Z&yeP8&Vvc2n-<5Wjf_0QaOMQXbzr`)XX-BOE%8;+}?|{-ucN&x4E&{CJIZh zvv3-$E}ciX$c(G#o~QS(t@$rIGQ!{XoyY6lO!NH*+Q`Bf9yu^psEj2OzR2z_~$?e2SKIfH)HXkwaHKgeq6xMsi}JQn#AYf885oXWiNMt?oy=yY9U?F664IzkT%X=_k&2cXxN)@p4MM%(t1JIZH|Vy4y@& zRc2Lf?q?@QJGRv(+sSl8_3iEVPs?B0trOAIjaSySbZOn2*L$stH8(9syKdO0Giu%& zY~q{pb#08fA|OCc5R4sbBKE9JLT2t_1~`enz(BvXqJjuH7%uys}^cCCpqiy zBiCmKM?kqDDbR3ncOJn30F0Yhs8kYly*=WI}(n!~nHOOf@hCUfxbQ86?1eb74 ztD{HDbC*eVijJR0RD2j95&*Ljn4(n%D>h+`NoJ^~EZV(z>yBqlG@7I?y5`&Y6QrC9 zDbUFfM3M-H)<-0ao;NSuvyer}hg_rJ-rq^*HstZ?uzig!w>>euWn>6VQpj-^t0vd2 zvqr{Da`2B3^P-VNpE)Fs5EKUY-s{-4?YeZ5SW9naw#wfsl}+e}tLKwR>+iRBca+q+ zMFU=O-QCZj=PvO*6LP!2NH_u{bo03t!Op24Xr_~SuM7LW8I2Z*l2yGccZyo^7*;$j-p8_ z_vfB@-RF|{Z9U*p+Fe zUcv*ggo;=wQwD-+uz=`nWcTO4JHyM)pA#M=-B?nD9Yn%T8yab(NvS2DRe1`GvnoXD z;Q2`02pCDiQb>w;6*bq_cf;pbT`PrC!QOpeNp;DL1gfHHNGR?SDvu6g3io2a9z_A#fD|Vv<%#QbaNcn$l0F zMh!Y{*S_ASJr6zI=hfygUnZ$*6CkBf*=nhQgj7iiT(duZc?b4H)eurzskSH#2r?XP zBpVDc7zYB4!mF+fP(euql%h_w4OA0StvORkVnCKyK?xLvh(#@Yg!{$gVTKp3EA5}V zgW=m3=zT08_m@vi5_O!#cC~kT-%M!>9}COTTUKc8%*27bzubc0$OmRJp_J|7GSqH+z}tt|T~UXcx5 z`me7!PQ89So>o4J4z1;5ip?Mi0Tg|4vP5stH$Q6oaXs`(vRg=p5F}A8`31YN5)r|M z6!a7+sbeRCPEhs7duQLB>GB2j__e$lHr`bWkpR1;9TN94Z!SoHY@S0=L8X{82_y?b z5Oa7Tv0`g7kx4m1=Xd9oShmr%qiu_7Hmq&5xL%{E^(6Ux-4>VU&p8zlA1@-MyJ0P? zBt(%8xo8Qblp@4QB+uc}oIX7Dd?{6GRS%SH^gi@_6S`C7cb(o=P}_IXcV(%5Afh79 zaNrnX0TyUWJ5iw`WqJ$jAjh?FoVQWld)7ov!n!DsuX+-6bciCHxx>}-lC1gMovK;!~*h!c`KDUc4`}~<{Tr-HpESZp}WX& z?pLux*?W&$z;8qwZ6VUcmpr6wCy3tA&C${q*)1DZTqCM`-rgGd?)BpNeo{>v6l_{B zQKXD*6wF}OHuKlM`kuYLZ+&yW9KE6>fY59KMA}Vc$+k;bGKjGxRFy;qp(0oAVYPz= z6C)TvVuF@73XNeD8Y&G0-_MsdOK_y0QBeK&g{Hzkz4^~7kKECJp(K%v#1cRQG0z@+ zzJ30A^K!bu|t zNN@K!UT~_^t{Z(K9Rwdti4qb5I#?dSgt8isPEu*Ad`;4{j64^J^!*pT&^bHogk&Ql z7!VLh+GBE!{ac7%<sf@7kx4DB(yyNRXQp}fgXnEE(NSRp zft~n5cfbq><-re=fe1vBF@z6zoYySPkjDM}d%VkSL92e;h?X|gYK)tK)&<$(6<|ZX zx5ylcqJZ<*61d~Neci^9p(1H!`}6hR9=~0Yo3n`TOx<53nqiR4NFu`b&py9+?|!0= zXVvZVeBSi|_=J)H0!bu;1I<}ZT+E9wX&ZvCyu@Um#4-6>OE9S?+a5W=f$>Mj$8sq% z}8&1wzg{ct=h^pMlT}!<4-dQA&gdrp(l1W=ZIjg!k+BR@AY@>r2 z?rXi$o^M=c&TnI+vaubAN&{T;j-MS$NZ;$cXq101th3@`8kgDqGMR>x(P6 zN!MG4r+4K-#|`Z{MuGTf+9582uFn0TeN!#qL%!ZWV;>@?%G_2a?GAI_PD(v&{nJqL zM)O5Kn;r6x@uGFFW3}6vdA;}4nZpzKi`p>!0zy!yy)x(1QV~5yy034O(_JFG4Ca0J zUen*Kl3~feb}gMU_wTlE-SeBjFT0%Q-PQH$x=VDKcawak6PW(HYc~z*_h$UNpIDW( z$bD|rud{W-y~De{`l?AKRZaWvr*}y{`*(MDckhwY%eq?4w}7Mo7JMj_fD{NHcwCy) zn`3B!sWE0o7}U+EAjK3&tl3n8vovI}QEY9T^Lo7V-5=9=DFJ{L&n9AiS?0t4ysgm00>h191(J*zS_yu<* zrY@_yZFWJUrEO!oR{IhstwBN&@XpM!T1W&KjDZMhRneYhvI6;&)4|3xc}tuS)dxIu z2lvq}9o&_9GmT8XHy<}Z?s6uKn6kDDp^iqYIp1Ep`8_;ca^4Y2ZJ5T)jh1Ags$kiY z*Czy<&F=9o1I&szQEl&W-QQuyKS0oU2Xa+7MjQm3Es`^VT({iZj+}l0&l?v@<(fmf9$qNhFXo0H`eKOLf$ffZ#xe4jeGZ zfs$5Ept5R7B6Avuq{&2_d4fP;1^{F2p_ZGL5=kVIN*SSoC=Ugmg*Wo_);*yIs^3qZ z;#aAXRq_UbN9I1s=9OUuUdHfD58A-P0pY|S3DYyd_#cO;_!Tvgy<1A|YLmdE7#MTR zGqkkCv4Ft@fSL*HEtlx`-oez$XgLCgE?(*#TQX+jmn}8nc#Cctt zjV*Lx4T88klH|Mfua=HpgXK}q!LN!(5FN*>oa=q!u+N7 zFCdrfrL6b0_O;vM>hFW}pIRWIm17{NG)gN*=^!0OO{k{OfmvAvjT%h49xb9&@@&&x z+7pQw0npS*5=bhr^#)tiR>*y#Llq}lN+ldGt9yiyl961E$j*&>w1s_b;{1{TKrjel zCy!qJef8_Uuf88TzE_?41PlziTbo|fs}3K$O%i@iQ@@dvbHnuB`OlIOk})9?MlwfS zzs1+QIp>aEYa!rz6iFmWB!o9AFR^MJgN6ulIr{s4XU947Tk4A@O_0VSHa0UdS|}?K zLWZ#xiwGEkh%szxDR=7eeDi$w`t_^7JoWdVcDAp~5R(>U$VkZo3Z5RVmUz)nbDJAe z5!g^u#{w1>8$83PC6FX{)~s>ZpF%<;2?9WbBNM_KJI5=W*1o#dW?_6mUtq!nVk_`b zcf^<_pA0ynn;3K8M8O5s-2&AKGxXew0W`T3KBJ%DSXuM0vQeY+GNSje?Iu_Npr25in{nQke`rq4cO2!SV-KOotP?nOm>SP>GQ? zX7A`+{d)V)-#%Vx2jWNsVIl(t&9qc}RfF)Y@wA{IZ$yDXtTQle=MQ_lG={uWr|FVR z!Ay!3F_SL+y?1r*zMlDW_phD#=XG0sGGP$OHHRzXbdCCrG{aed-hz<2){ynyFqjmS zu3j1?hr|g8z>y$H4SiWY=3V>UdwTm^eMlt)#c`2CW}J|WAW#+oCIEnfGD{fjU|5Nv zl?hE#O#p-ep&;;)NT)HJEyxxc62VM30g=FqeaMfc%;h`Wy!Vm-pW6uV0dFLD=UKcJOA~<>HI9@z*NsQZLMrF)6h)GF{Aq3(w z(E})x1|wU5NI@VHFuasZ7>pvPCI}V7gRgk-_qb_`Y-iKX#(ZEQ;|(o}UI11>sxIpF zWkH&_6j){60-bqqVvUHh9FYP}5^|Cj0SJ<@lJ~LB-O(gkT9{_bL?X+jky>nFjZ+F5 z%M#>C49u|Fg=!UqT~;P-VK*zBE@aCVOC_Uf8)dk_vawNAxIkGlg^~zxt`iBQhCy*> zCK5_(L>7^AR{J1q+ZQbf*&?cr#F{CLZNC`}lL@_AFLrEkV4IoV^ zLnIjzva?8Ll2NHC2}Ug_vYHDOB5AWL768$r$+KG`n>5126^S%av4l$$nNc$|Ow(m1 zN;6W1EQKTqCS+#RNt+nNXvTv;Xd0PqWeAf^NeL=aNm5j@$w?_$Ga7(QOCdIBsMLZ? zwi1lS&8V9i!(gL9N>Um{Aw)q%6qy<(4OnXuFp6x(W{F{C5K4^5%}81#QfQe>HkoZE z1`1?A(pj=2M5&N8(@ivB(Xo=MDNKb^DrqxGNQts6*2t`z8dE5eW{WfhO;lS8XlBz* z5LRUkr9)I$v4op6B{rC zgrLzHF{un<#TqD$t0ikCQbvMM%1NpMNg1L^n@b{8O2ESrB}8HqS(rp& zB1kZk_~g64tM4yG-tzxvy~>=M*L#zORiDbSVM|HX&u=Alitg9CAzYyXxaDaRb71Tu zvh{^GsjSXX?-zG;VcYdJBhL>XCUh0w9c2AYrC#O0URCX5qUKFHmB0<}|wFcf?$I zf*$W~EA<-Icc|8#kUcCcEYwukoW^o~yWnb`p6NwZ#UYI^6^cE@k7g_ttfNIczR`-! zWeeyd9eiPh1HlBg$FIA?22%~u%HNj5Z;$SPqc#sAH1D+zYGhhPWUJhznzF3&$r*bz*PX-5D0$JFyQ8g@Z z6*yX4Izu~iAH=-{P+ZH_FgmzvAUFXsxVr@o?hqt{yW8L{Ik@ZK?(Qzb5In(MhZ)>8 zXcEpj_vhSu-+kZz)n8xLt9q|q&+P8C*IM1ZcCW79U2Avu!soJ4wZG`~A{g|~Kzp>? z9yE0wafVR^y4%-%K_fnnjVK_$ANZ`dTV8kZRKA)0YJyhf zIvLAubya5CD~=8b`vzbMd>Rn9ZvZd3HQl*uZ+oB^t)A!eG?*hiV2GTqT08BCt&nui zW|*pC$T|UXplnw7YbVVS|HWCvj+%P5%h&Q`oo%Lj8=9zj@@cD4s8R>B{n6dxuGolB zeAlP;0TSXH8*XTffuC+Oi@%AHwN>-Gs~t-B<-$L!=~wal08GMsjADT8_5GXw*!BIPCy@vOKe3r%IN3cBk2upe9UG%8ctk-DdF|v$MMNJoIKQL0&AqH48Ui7{X*W zd}fqC5HIr8=d#jTrU~^?d--)Nb(H(5jZChT3hMnm3t0xF2^71s@W>5{e`XPnVZ#=(6 zYfVSC05J_z1i37Y0W5C@hhpohtUW{FePK7f61lkT33oSor`b6zQ4Y?mhl9yE=HsiI zoe$W_6J~YoGE79YUt|`;FPi!SYm&O=%F3f&E5$i_ISH*ici-tI{H9au^mnPylo9R;CxNj zg%2O27zh|p&Njdv>0ec;b#V2+zx0IS!YHd@`z$}^c?EB5qV^Z^md;6!KbGMB75h17 zyNTa86vb75=Y?Z|*UaX8xK9-;Bs3(C;Nc_Tk(~OZ?GRCHqTSDTgwc&QCF+_R09E^0 z73JQ;Qc~ldxBfDU_lStWDsgrv=F4hdOrAMwc zUrb1@_^X*?W|uUV^P}lFtR0$A$nT|(6(RkYKl(XeOw}r>E~*1ZV_q;T9)8kQL>~&# z{nK&rh6E~wywXOyW?%X9v%kc*{D_nF?6v#rYdntU0LOA_3S~oc)`bX?L_Hk>ddXmE z8_U8yviR`=3=b1dH+@|XG0}EM@xX~9I)&p1L8~cpln>8{wLh(%=kU%0^iB|)SiuOK z;sp_9*CYo?pADvOO|lEKQr%nvNF3dmo*ogmjB(DIQD=x4f?(~dyPx1dYudw3vOVrQ z^hJTG?R)FsqohiBQ!I$)g`Ezx-RG-vyE!hl*~y<=&Q4Z}za@gjRKlaW2%FgXkBO zEpTFc&2N>_vbm;gO^K(-Jq+uF-y20h$*tG@OzB20aeErj>(9@V%v^mzSvi@(nh9pK zmjQ9_F?kp_jaUrlNJgQd@PBzX-?MPz)#|q z)+$$Klefm{X&fQG-fnfRHkE@%KJsXt+vUlMQMEcbQW+nn*V_{*y*qji6tCFar8HU# z%8(d$Z+@`zhA$&9Zk(@{dsMutR%!<#qY)=HzDwN5Z-i>CJ`b-xUfwi7P0mlkA$;Ch zz(>x8?Nuwk;bVjqlKGg)E2DcLdd$7Jp&}NE2G8HYiFIq_Vt6sX*3t#jk+Ya3D08g@ zwH--+^*J)P)JeW7rV?C5OvlTk%~clUQM2FH7Oe%RBYM3mzdgIOosp-xn;8%FTW=Pv zH7aOed%ekfRG^g|-r~Am41`b-kGM;w+AY}$<$PNcKaOA&3{H9MiH!b3Z@r~7xz=|> ztMquQdW;P5gHqk=rv)yfsU+szi(BcRSWVXynKY|oxzYsU76ZXo$7Jbv_a7d-O$wx7 zyU$eBBlWzXg5h4y_EyWri_dMwmY~ptIO92AK6y-AUyL|{-Qyv9N1k*#6Wwoadd}+> zZf16wQnfXQt2k}CMDQSEp$8EN#Rg9@!c>aIqt~fsT}gX5jvm>1i|X4F1ff<*cm{M2 zZ%?4MH zQ14*IZ*uTxf^w&UGOktJ!=Q-*BaW2whfmDS`fSKgWgXE)%u`g7gwFl-EzX@63qRF{ zViI^`Jr8zK=SGG2L}~P~iho{f&!c8`h_cX8Vj1FWcPT3v_I)oByFYLEzUrc}h_Pc{ zuK==3?0vNNfp+4Ui+m?sn=Pnht?G07F(`c{oOX4!6Bj-2hr)bsK7)pXgkZ+w&q=^X zn)nK3FC@h9E}#dQ^OoE598DfGCxjITlYbt^mfpl$P`fuvKOyjS6lEp-gT+-?YHi^) zt+#D3sH3E0e}LyM6z!5)Hs0)YyIs%3gAv6iYzF5`k22Y^I7=hzn3U)S+UP{C1zuME zcP;Pfgn)S;UU;R*+t$x&gsJL(M6em-ey3&P^sTgv=x2NOAM#Bq)&~qU?GYE|@cnfl z{L#kkSBMq5SB<~!jrCF!ysCphF~C3&2QKb|+ue-_|KO*GLtmg1uB; z+E#~C8+s$`fNa6aja9DLv#+&-T3tdBa*fXY_MXO%0`+w|lF)!Uca?T1%N0a%Y~0@N zXr(@7bZvixGcUwrTh;U`Cu?wC3lK|q7F~Z*B{B@l6-U|~UeJo#JuGSXanse0zO(IZ z+zGZ~Jg*A$a`HST>Zkv;es%wur*H7&RC4{Z?9cZms$K<}r6M>N+3C+cc+HiBh;J>* z(Ri020^DVxbuv-NR1w>xvhGnloj{5|HZ*Ee>xTC&;|H(EVUqW9l=dnZ&=%9y@+l1M zex8^}1p%N@DZeh#l&sxB7S;#qd}_bI6kXK1p};3=;$Ifs7w&h6|4H!NQpH!KC(z)p zt6zB4DQbFTjoqjC2pKDOyP5cNJ~+0P=UD5$U_g@BYoV8X6+U-WK2A~&!(Jl*fUMdQ@QVK@ z{O{<$-Jpl(+5=E>0VoXrrvEGXS6%<%MGtd!eifVHU&MdLe{+yhz1H^k^?wX1=;4gH zuS{g6000Kt|HgvC$N+d1mMZKOi^A|4y@r2P`7aoS0p*q96{h;%h5r}zzr^SeRYtoo zmA^BisQnxN3jas&|HAtJGl&lPuMhbDxiI$ssR4z7^lt_K9|HQ{n!~jG4+TB!Kj8ms zz^j7($4>okD#Jg!?B8lb56{yrMag~b0l5JCf64vNZt^dsqQ~T`sJuSg-);GS>zUe# z@o(k-vw_k6p=q3Darx><{V&)*ev_m)dG&QO?-+c1({%B837Y+V;pY=$oi*3XS=bx9 ziFc}>U$j@67k5Z3YJU}P`#q}b=vJxRz4VnkWibk*;oGg4Mc5x(;VfKLD8$wqZ91Dd z_8?4^sj@zz6|Lu@oS|HCmpmSoc=_Rjk(4UL(m!agDEDzEgh zvsh4eOOkEIR89>FDP)b>Ouo_BsS7LYo?NZf2}LXO4yk4=Vmxl_wN+-7KDW@;b3=Gg z;9Vf!e$rw9WJw}oAPW)up_=L3Xg5>F!f|4M;U;(-71_Py=>;f6+pP6`c0?(pND>J} ztqo6Ye~DuOGLqp8F2+j1CYCAW(4&47&jqM*1^!IzS#qu{*7zgXQL4vuPlfg*2M`4O z?5lB1*(@^1T5&5MA~IWOhtHTq4{;8qL&4tGah$wzN{UF1AxC@{@qmsd$21g(@0;}9 z_-zMxLnY4ZeNXG@->!E7T2j@413Weh**+NtY3^spFn^M7zbG7yPInVKZnC|nJvIjy zNF**?4P3~qnM!mh>PkH6@u^UgzQ$OjZf{ z;&)4?x$#o5%apO=P%_s@g~G&A#K%y5%VTFJ5#EE(HM1ubA9zE?wm!@yj7VvWmIMa4 zwsK#dS%@A89g?*;0QoXQ0_wv@ic@q+6|WzEJ}VJ`pT>7#SaCz_*ge_lmkhwx7x>Vo zudc5zXoG3{9=Az-{c{8{<}I&?$sA=Xv{5nt^ol3<&uSZ=^dKUV@3XhhoUF6i9>+SL z;!al6FYn`>m}rFc%mgN`ljnUmoG~$>=2IF!1kMPh*vdIkJKrRk7bD zqi0+|k&P6)!{S&)rBSq!zS?MFe(@*M8>sbV%t~#KDf80vqSst|Yjlxw?IZ)r+tDndRLy0cy9(apWJBW?2j-H zPt5tef<-S(7~J3&mh$5oMi;X%@-ZEFR=$P3$FKeEF0`vjCvjg2J5&_|C|P~?A`vjN zxUFP#iieWG1?X0aM8es(V}5X znt-T4NXOTMF^6~dY&8a79Nw{P{7UU;pnt1L_a(sI5|7TD!A-^VIq)NvYVYVHRudjr1a`RVCPuv!jXoFv49DnB=$ zatjjN7RP9V=O~UZe_2PgYgD&4<}+)d2L1Q~kf|*t`p2#UDkZ?;YhUI_>4!iaHC?=$ z!PUX9$aVACX$Mo70RYfGJG9jR)RjJj1$Ow{j zSgKp8d0<USY6CCl)< z;*%NA@azF~3zT1QF$fm|(BF4YUl;fyI(!#%B+VSK2ro_Dt^~O@t)O&kTT*F+gwJr; zkOb!QyjDNGuOp!N*KDrQ(>}-Lj=!f4vu;<3Y9o!gGgAUvH?@P0F0l(CIsm|5WBg0{ zUg1-16Jp(Yp+5eWa0zj{n85+B)FMVf1g&*cmw+D|j@UopmTzF>j8o_pejw9rQ2ID1 z!Tbr;Lj*~ByWQ0{jPYd`!_r2vxytK2dZt|bX?=_8^3K|g6Om}U_5Dv}4o<>b6} z?|h!^WFMSMaGn%DiJ$(h8k8I9G~D{iOj5Es9fdHmrrdPd*YkzM28xNF7vCg{~47RbEBI000o}RLV8Lu|Zb2E$57&DRN*51~c1A zx(@wqg8469j+z%{X12eGCZ;+~47)l_Xq48tOcZNN8*EIJDqN`fozN_fNdKGhV_r(h8nZB(lhn*qYZooa2BVuETnd-5O@f&NN z%OPu{Qf=3#$JGLrauS3mq%WbzU7oe8}e5J7W{bRId1(x2Sk)DkjES$oa>S1R*p)}K>Fw05kaIyOgi@->7)J`76L2M^}1m}^2f_4Tw5Qj7;Bj`FFSm$`NhlYgmN1uW~R;X z2D==Cb1dD#JsDwLqI+ zwAK}26S%pxjf1HuI(s6KPpSx!vBjUBS6H4t@hz_uw|2o~f;Q%y20H-BY6nZx<{Uau zf0cWz7ROlhQfg%o;-c%2$%@?feQIDKkCY0*W|*4mmyDKYEJdwQlGDMpTxi}WvL_eZ z)|iYW_OY+ql`-jq9y?ZeN=Ori+=)_cEq*lRhS~E^>3td3pWO(?A z6}nVydbgno9x|AYg2T3Om?Q;9FG(y#O0!$xmO`ThZQp_P3!zE6%5Q1}Pbb1YPse%m zkE=*j$z$=M%U+%Y3ugrFvd)JFuJ^IUH)b*eb23#YC568Un0qTxp_+hk0+@;Pe{6V` zNcB-CJT#lLst0Vk8+_~E(i;r3JX&zWkFfVLTP3jt27Y35$;Aj3dOQyJfh!J-jEJjo z?HWfcZbVGg0^e&cTOmYML`F8(ghrM=_ zl+(D~0?H+cvuZsmX6h{yYUV1IdP&=3CjCvDs(wQr$9*Q2v+6j$12VR>xsHkm7E_=c z!ehy9=Y2t;p4(<$vz!UFNOrulv7j}WrH%b9&slS}SV~Gin|ea_^*Jssm|7g#?39!k zPaGNd>8Rf=t~XwgkU7(>pfN!Y7d>r1+ZvDX9LO>@T=(9U<=dk5iWo<-T!uZ9?ZoE$ zdh++#&d$cJ`7E30@8?4h=8o4syKa4`_x_@E32kqD$e5>9i{TM&z^GV%6;fb979Q^g-TBo4=L0Sr6a zCcB~_L@q;0#6E-plrJ#c@3zT|B!hBIJ|hVXkqL?L(p^+-m(n>Vt9l%W?(VjFxGkC- zh|MZ#?uOrU)?`knxFq!3o8(;5eFapEWb>k7QC2~HgrHu&p#zrH%SyS_11`5G><8B?4 z<47={u3;-Jr3#vMKPrtsN+_?<9LQ^XG?ri7y=G8$ch{eoj6`^dRgkcSi=R+#KUeis z z*9auzz==joGhKL~8foA48x~7h`s&4=kE8e9TTd=sABbu&b8rAD!IHKe1231|E>WSM zr~QuGLC>2)@x6?G#a0m)iC8xW9izg@bbr5NdsWGPEr%{}(Fu%tI-sYe?fz)-eof;m zz3M7^-4{NMU&#yMc+M*kKQFulp=3rqD)?9QJI$Mw_u1bE3!br;E#$?|^F>84r``$I z`kdVrgw%SkBQRlRCvDqTb;;((n*Pe=alU2nzE8)$9@f^X#3$qI9@WUNUF@B^RQDR< z-CaU~$8a|(VYq#tcnp|tZ`?=;bS6}uuP9Jhr?f08(q4|tV7PEHs{-Y+;hXXkEM}U6 z3rIhx754_)k(d3%MAPDH(RG!(jW``OU3Y?wDH z6qVRd4RsQ37RvH=5#?L2hlzgd;fcPsjGgi(?Mj5)FgBS0kAspYfs@k>yw!9gKV3z^ z^c$32`Q`mFE!1WGb91nI+`Sb-b9tkz@>Kj*7w+v4N}JATUv7zg3BC6?jT;ceX$4KL zT%|zcyj4@$D&4tbpYfbamhUQbbsf=v!)!j*wvDlT$YJYrG$LY|4~7-R5>RqW7Ic@d z2@5NF2qsj=g1HTX`KAN$PqH{>y$=J|V0wq4@yZs|}M?9&YMdn3m=Jk1} z<#gj~1s?Eq4&%)P$}wm@8MmAGt=cH;A$w@_O6q4kS z+*PAy;({NeF5GF!KRHnqGY(^h&iqVJKia)NQ>r39ESZt5W`>&m+y1Ar8(nE+!Km;i zhp+!E>a7e=!Benl4ceOMt5|2e=QItKI`J=rl(R)Av7&1zL|BdKrBl#AUN;1BPc8?T z(uuBg*A7qm>fR8LrFGkSkdSCA6EQn+#KC`md*KSa;4fdn5y$zk*p{=OhbNGI7E~Et z9;LY@{n42L25zcM)b&Jv`b{o0ef28c@2mMLePB`7nsd6niS@4&uh-)jRKcaGm=8$^ ziI2`^ZHtI{jvD)hGTNI#(a&oX^&S$5KPLw>!13Lw89!iE$xEMP;F&L(xGyKbZ^RBh_3i- zo4@_9S`x0c!ctdBGEHE=8YP<@5|`r({lA3p(EL7G+Ym}L8<%1FKD zB=ptEED?=Y3%g#UhB!!e5M0@Q{qyNMTC&f6vLz}i^$=prrl6~M4&};BZ z)ah*Tt8XZ9t8baag!_U(hMB#aJoflA8H4fcn3qoxf2|{kxrs=|=D-%sl`&6WS;Br! z4XQ|Q!Sx|kWGe9$sYE)4fQ4vWsrdn z0`x{wP<(D~H%)yBM^vzQx@)@F-*#a7t-#gb1)n&2v4_fZNC8|(;V%gd_#JLkTIyVp zIwxDFm%A5Uilpz_Aj<-t!2}gAxSFxBBqi4=iS+4U$Aap;m}Fp1%=6Mc*O6i|NrF&7 zp}?P<3H1Gv5op_cF~hS-1{PLy-JGshZazrPHu~Ao&cW+MsKROTkE=LC6K9;RFhq{6=MY&zC+bG=yzm z`bU8kIdPN<6IS;In&UC$A616I9r;Zpxg^*+Q}g`LZx=zaL1;T5iW0)d?y1G)ZiRP< z=BK-+alNiFr=~Be)zCH|x)M1f5gD+KM2%tDB8cX3mN^XzSZDx_Dr-U;vq*`F^HCD2 zCn4?m=)`!HpsK(mB%Kt*y>yC+&Eza3gMlek_vfGp5$+bt1&>zfk`f%;_qWCVr~)`M z4IMzlGebrFeO-0tz<4!gqOkt&1q^F0ZC&MOxJnRQ?tQZZ!z`hSLw(ymn#q3}`b{As z-#Kb3-2I};g`C*u#dXveb*$VoYwPa@OM+jw$lcWNT%Uo+CwaT`)ehVx3&2&2b-^O+ zG)0KT?kCMD@P~pfxVI`bU%DY19;t2$%RO{M@%s{=1AT~x+tFq+nV`$Wg9>b{I(uCLH?Qnf=( zL6Ylel8u^ItU8o*S_HWh(B1uDymHI24au-gEx7<{t zDYUX^8$ukQ#Q8gIUa{hcv`hJPcWS^qQQ_Se%!nUc_^Ch=mcjhMAh@&zOA+kMH}uBO z%?`QLe(#$LF%dr=-&8@YT;VM$K zwP)L7cyNZlQ~WnF!W;woO%PA_d^NOTvZ!%%ebQg0?nc$}7_6xFLh=b(G2?c&>>nz0 zvnXlaccfPZ=Wc2UWkh`Ro0mGhF@$@L;l+-gP$PhqiOk?TE$BO!ucV9XSGe}p+b9I< zMZwmM$6c?dh7|BT?07+aa}hg)XZ1cSmDld>)t4z8b*#d9JXK~ndc|mvJDaHkTVJ+i zaQAiH6Jc`~=fvfV{tc*!QWKIOJ?p&D9M3w3U)i~XZWn<|aBx!)A|&_?5NQS2)OZg4 zB6&XWvFh`)|627qcW9k@x367`AD%{bmqZ{_PXf{gbq- z)M_H#lO)(Am<0g6*ilDsf7;|hKFFY&y!ryhoxQ3+@^wV*S7lHS zuGYMEk96}vAU5-ItFO=1Tp_j)W3`3)%Bt5dT4p=8uXz+IA%DO8R1Uy*l290YNduy; zYOH1oQTjPh51vGzL+W1(tArdvG$9%gRfwvHD%rnp)Q$3Z6yJxy-BjSSOA2$T~}8AUG(dQ1$Gl1V5-OU8OtP#DyQ2KVp~@{Ug-!}&GwxMQUpBx znuRn4a;E4mzZwGE{8*VC5o;}16Hh6SQ zrfP0svPM$x9)!$VqvyRYQzeGjUYtsTmnsk}bO;f%Wgp3m>c#1nSZb0hccyx;qf+Ur zWD2gV3|HA;tD{O+vH{D!NuaDu>mf^5$oI0faRJXyrVQ{=#zblQuulzkYNR4HGJnKrIh);1F8rAkfGe!v0DRju6vm%Y~+ z+4d6J<`yZ3Ff%1pA0+Q9iXFt@kR_e=86|4?gkL5O2TWp;h*%9JeTm-$}cgkG8VA+}gnw zJyymN+kXf7!gqBV1cOArok?sQ%MOai+oevVF!4JT84tE1zN*Cr09 z^NgR>hzAQSyDL2h9UhMtQyBh|eG$-Q-1%^Ka5-G%ynuVtMYJV{CAI z9Z#UdoI|0Pl)K*-A7+R{TlwKsCTK;-Sb_HQC%&DaZMDQrS6ziT3+^__QOPK{z_6LC z^U#sm<#yqo#$H+Z10|>1MPQWb>o<|!QJn@!TdW-Wk7$v!Z>WIQ@3+#J80G2qh?d9B ztR^g(uM0gSI|tWVvaB-q3@fvYSE%|%HvlX7vgCO&1djt!Ve^A~zDy-(9Ysr2q8Y@6 zE>z5OShy+m`7ttlcLu2j?URYnvZ8=<*9hv_M$<-U*jni6UpbDjvp52wV9H>G_j)V_ zD(&U9q}>CeDzIO)7SZAt|(1 z6|<7a>BCC1WWQkndyoBFM!Fq)jhR+xaDls`W3Y{#nQx9SSx7H!hsa@b-1&G{UMJnE z`ekU^;RW|v)Aas*^3?PcJ08c<8)kjicCd{6Iy9z_I2kz>vkN^Zau{ z;&^7=^=n8eWQx%!5^!pgjD;qBO#P6fy@sq{JnG}R^JjWq2BCgpkrV! zftPC5Xr&$7j94m!qC)Sa;){GF^n3kQ4&QYzY{lmoIK=3)0+-d8MLrRjH9!r|pH7d# zJ=yox2H^=qJ$;Hb8#;9ej@ly9+8m7=oW8}QYQggHqG$>1X6)t)?p!wb0SjJ_O^sd8 zvV0>fd~h`rQPgCn^FiC(BO>y`xw&3{7-egV2nbs-gci?HjXmb5HfC4Sq=pv=h>ec5 z%}pgbRqzyNRdhYoO?`)gQ2GmKy|O^+Ywdm-vj_yD{`eTLXtPqo!3kp}mR++GyK;>G z5%Q6%;R>9VC&ex-*^7+UzHIJ-8@bXJ5qs%)iTe&)2yW5Y*EhlLGL?xOOUENnZo`v_>26`~H5&#MA2pGk@x}sK*bGOi zeUZUE1_R6-oAyomoCWpHtEfuMR%=It7qse;XayaklplprfW$0uNNW6_XJu-QEthy_><%J(QF+X-}Lx=5#sFiIu8Wu^Xc0@mL>MO&el^lpBLL( zgN#m<27taznGz2&%S&wBUkx$N8bf`w2bes4NzMGG;9VbK<}TA)o*=8)j__RJd z_SUAphGcS;2s!wvgM>@P<%QyLRZkbFYo!0#nE04}Hgxxll-KG)cEPs;vK>HvV8G$r z6bvdzB{<%i^cyCdkUlW7x1$%54DSI6l{n~;Z~2Y_c7hO`Z85B4{p%4+$@=OqH$JF}$-KBAE{_d@F#4QAsr! zR^r~NtkhV52{;k)X5`cVvHXqZER26;w4g|>y^rv21{`*iUf!mfI5y-d$<3cpb-t0; zn?oi*fy%f!sIYJ>;!dfg5A3#fj~tYhL0VX2TRvbCJn2d2%iQ3=PtJL=A}8O6TTkGg zcSwF-N9b+6eC6Zu2-;gjwVG5nGX1$kGgsrUgHSS{H8SivUZm-pJwfxJncnN^>EKL9 zEYqH=UMUt)$eSSYbblVMXa8bJwB!PPor*@a@*EWAEgt+DY=7iLkwWk`t8^AGu;7h$ zhp)yFe9FelWzx3Um%^Yq`w5Fe>ZR0d@cZ@$sS}Zmkp7UPEz{tH$xC-PEBM&YI|oDe zc4U9$uZxt1I1<;Q#;v8Sv=@e^!8+!v*(R&|?Sq7?aE@u^I#p~B?{c#Zx1Ub4JY*ux zJ0yMc>#=NJnPw|sk6idUg_=tzY*2n$3h9oVw+OnW7CZa;=>~cfH6kQ^WT+njCGo-ToMAt#`hcWERzR zDYABlH=F6PD^T|AUEJ0)ffREavN9`}@kKTUU}XDMf(>{i-MQ30J)U|*_l9IA&(^wE zP!$=NDx0m;yENkmud;F323;8S%^oM2$VLh2GE?HCcA|?icCs3P0P|99g~`+dY@>4n z!o$5-?3B$7+}G3xE%m*yQJw6BOmWeo?P9karc(hG{Q4P;>8Id9eqOu>dirTy%sVyz zg{BMliti?}_#wCUvdl7`^XmJoCX^2ZLlN$Z_}|S9Ip>0gZHQSl3rS&IZs6e|s>0!j zu;=4<9ogDd^e;uKIF~Yi-bBzP#~NYf;tD++P>SQ16=~X=_eMGe%hhMw+%7w`OoZ3D zm$)7CgbmHApVOTWE8u^BmR}y3hoL9b%41m1*?OR#&C~sClD(SekEq}_-55R~bm(d; zQSSJb8vZhnPo1{?7^wzCH=9xLq7aOx(E8!m^&#vM^O(J$D4IV;Q0SW4WeSG{ooXSq z)qAfJFK?rbj5{cD<~Qt@uxdb}bU6KTPfRT9Z;p#t#>!ktD-?Jf_5)!*Ll<<4`-bep zq?A%rs5?9q#8P`Aj5)C7ix!`7St!VJ(b@gOn#Ovz?-idhhkIh};m^zULxbXjP$7N{UGRL-Z$!lCijjo@E=q}) zr0F|C>!M%9cpjNe*J3OeQNH4eUw^iIp_zh?-Vg(J#{+Z&S0pQ&zPN7vf`r?|DG$9! zzZZy$azTGj9I0yCO1nGf;TRcDhs}U{SkWqk6$?8Xm6X->R22y>VRiM8evU!grM0J? zjOwk7d7kzhWxmq{PLHtCh&if{uf`SdiWn0s`}sE7sJ2H7i=vD#u>{&3#Zg6NrH#iq zo=_JqmmjmT_=U$oj+@jX@YGZ>WoL|)P&e1n3WC#Ec^!O{Xs^+FwD=3%C1E(O$Ata$ zi`I1qtvwL4X~V9F7~_k#8Ae?ZqP`RUwku6-*D$YHXop*0NaErokBayz3G!5gmOLZ} zB)TC8QI&S{H%~0?@)B*%2F`a5tlHnxZwWPzbsNwvnsy&INf&K{#L@SsGn%gmV8~KF znM0nrPH}fw?BsWY6Kuw~-ed0c`4p7M@y6v6V@@%$mow=gy5N4;TOW?o%7rQcew9o| zI;+Y$qbT$cmC>&_{75eg@pAunpZmfWE1W4v`8`GZ0MURP{AbK+tv4V!+6h4JB;onm zL4~YBke*?fzq2+h!U-}W;oB!;TRIuCZfO_axKDuQO*okL4Ec2)+MvPI2{x1mW(!|+Q$FwzbQL(@;|GBZX2 z*rUnO?_O_`vNVNpHmFeY(Pe|+jbOxkOniO||NNf7;Pd44doK#Vwwr)IZw93zG3_k) z?@20{ER%)=KlU6bAhoadubU46GvfxDaFraxg1QL6a0&5IUd{3i*16Cim)RZOmR+Ad zt9BTJpmG3;%$7t+Nqp8~5Lpogvc~Z%&r6hldmE#%WZOh$a(-X}B0Cj3D$XDAW%JevBJi_O zv9|=eK9oc$_|-XfQNOH)4}U`OkUDknI3T5ysD4ScjN5qP2Ig{khi{4YVNvIo+<|s@ zB*tx|f^kt-o^Gc0&=5evWev|Gi7H%A`u)@gCX%O@(yf-*$(NqCa0I-ILw_Z7S^oiP zm{Tbv2#{-i4#0o!NuSt`=K4W*KGXxOjx^7*-1uVB_*t!@_MEg_O>{~1y>Axc zvLX#g`b4^g(@9c@e7m&u*)uNOUdO?5u<)DZnbCrh%z_abs_mg3V=jX>+E5@Kc}+AQ zq@pQKTzdbaCpHK*1-4`ZWGZM^%f*^Dvs60tB~T0cS%KL$kQ9@S(T;=%ewVMC}U;ON&fF%bbE|%m*H}u1ke<2Vw32MawICf}v34)0xfa z_~Shjb%dt@KQ(k3nt!O6y{L=KWkKXpXDFdPD$C9s!c5+rf9D&<3JD{%CQo~~apwZ) zMUqf#g)j4=60KZ3BXF*Mclb?FxO!dBbm2J+4Kh5@sZ`CemsRNDPSfdjd_4@ez0tCf zyS-S_tDoJPDLeH-8231f>h-%oeedL3+>)2t(76yp6^P5c=c$Gh3gpA@!p7&cUDM+C z@@eu=EWbO`U#h@VsS)iaEEnX!^wc!kNNk6F;?{@tnCJdy*ePD%V3J`$DkfuI#&x3G zV;bX)Qui-?QrL~64E_bUYdEo@w>H(auJtIZuin+0AU)j^suuoU?ubo97GD-sj(A6X zUC19p5it2JwS4dyUhryVN(wY`&S!oP+RTUNbLCG|Z=Ol7Z;M_WXV+fnyseF2&)e#| zw_U}pFW0`9J~9kX68L6ZUw1#D`kNZZbBzaM7BHRP_GCdPk`KjO)YmTwg)F`4Ero7A zv>laAO`(>UD$LRlOGfH$@!2tgDh%A?AL-|%g%U5QW*OGRG`8fX3cOnAd<#I^67{Rz0417s zU-0-|5xVs9!vjoT*Cwh|Ee}f&&iK5=lS@39EO%TnV#zoD>Yd!Pq;(w~kT^Z!{DUZX zME<#XFa&Mu`@=~^_AUUW+<#7|4up9{4GzbjDK1z)!eXbGxciBcA0e;O==_{w|HQ&_F6A02`fhrVb_WXu-U%{9cd#GgWe ziWh*g>m3*&eezt}H66*UV@)NNwC5wlmdiYLH$W(dE(`+RizjA$>my5V(=Mv38- z4z-iRbD{Jv)HYzBwyA@g7zaFy;ukz4S=@I*4~0Xeu5UH=rtWU$l^1@-EZm(*l#Awx zwnzqc7Q9;CQo@HOqd*{AiZrfqCt&R+H{b`jZ?&sbdxj|(*b!l#NQ}zL>oUB-rop$L zeBr8BLd4rYlGi7LI5tNBK9CMN1>1~I=g?d`t)=)Pq|PSlu65A@dV8GM;;znK0S4qy6goze+u-SbFQiXu-(7r5NP*^$p((|G$ zZ=KZyG2#eHz_5-Pe>l5=?Y!FgVV)s`qNB6#69~)D$4HxS-TfaRX(#Wn2lgf$bS-lg7$1fb7BI;x_E1=S`D zVz|FJq`ni%59nio`x_bw`)`Tg8wK^~zqfBF(SExA!`SgOO|!$+rQoBwvqIr%SL62f zVsr^}KDR}v+jg|A4 zaPXx&z4^n8=|}R39EQas%iX2cu$YCX$gd7zbEV%&dSDpB1h=hHfw8PJOQs<^6iVHW-C_H1+)S#dQs>LU?#uFX>NOOI4|o?C9Tddw~wl z%)IWH(_+j8Sk9}}wobL$1DFJAo(mGpf?F^xJ$)WpmZmBC)oR1)&7i^_3+rybuAm*7 z+Xed&Xp)vmtqWb}6!OXJNc-BUoXdxfEgH! zh^B4(_m{gDyf&EnH>veNqr99Ob3?52eq9c4VFY6moV60N#7})w+|f|J$JuO-xS|%! zI-1&4ufa;Z4Ve>(NI@5@s4OarBq*cK=Ms0ifx^B779;xk6A>mbNgGScjT=IJo5MxQ zI0+9=JwB9Gt23rKqJxajGn*XmKTxzLDvugxfNn~B;IMC&D5>l!&C6~E#UhzBvK0N1 z7k>UjL-8LpR+~Zo%d@xVWCX-7B5jtTqlrtd=0fXK13?X(gbw~(@jIoLw+A+ElN5}? zK?U=Hj-}M{vELlxW@O9aUvz&k`k@@&G;iGsbFT;rZW7-vMtgSTVgE5)3K(YSxRu3byEWZqs30vxW?n5Zf2dNairs%M(UlB7-b*&6NOz3F zF8d~lN=V6r{f#dvN(CCT3yk5FZNR63U4$O;@-=Sa=!nm;b@&V>pWf2rW#^R8{WO z?r5a*1czTYvDskMjHNM@SqF~JK#{?)|Hac= z2er|?f1tR#dnp8W_ZErN_W-SR$_b$xrqM^y$!onwj9Bdxi3_129*4oM)J zz;IIE?s8#a9+tC%6UejxVGvyjq|HQ4R2qBse79{WJ3=xDdlaiD#OYrInz}5PniK|; zg}$*geCJpI>&QX6HD9d}6AF@VK0fE6hiLfnPO(2wDFC^B>Z$>W_wEb-Q%J15VFsybd9;-@orq{kR5(WfF zEYMr}@7i4z8{*T-96qFN15l;>!^F(X-FJpe!sb=yI=@3IkT4j$O-%)NkdSzrySBsW zH8Hte=vlzp`Qt){2QtMa`;nMK&ZUPH(XqRM?lhgE;@e?T(B4j{G7c2aYQAe+{4hV7 z%QN(=&tg6z&mtIeKKNe;~MS z85%(d)a}6K2q@zx>{^=NpeDy|ft})^HgI`2(zW_rmZK%UDCMt?lqKcBIvM2$%c?vC zTQf}h52Sf$cVF|Be>L|4vxEd2S|wQV2GN7N1`t7uA#sf_3zNvopJBg#X63GzTbm#% zwgbK+4OW?Q<0zdlI+%^QMtPO(Ysf(<8ft|*D=2R3Rvl`UN*cizhdc@A|@S? z(a6p{+M?U?)Tt@$^t$9u^-i;m4UdvyDFwWUfGwn)}$O5YCz|H6__*2Vfn*yS2!>dWt_NDf}y3NWec^rJV1b_=hb?x9E{ z#hnD4sU7!sNZ#oZewa%Ot^>s`0hPA>s_M0o_3RGq)WPeQCZlg6G>tnobP@-Zl#r#MS9zbYQGTM&;|6R64h9(yl(SHL86jon7cQ> zboIUHf9Ii2c{YvZGuK}`ehgIEf!%x{M50l;ArOW4to3|dy!qx_CF$XNR8-xy*{Gcf zecgevX^T5pA+5rbDNIqbDI!pjvaw_yLMDoZTRcs-LPMwkF2_DiU@TO3SkQcBmD@7J z$kd~EsUh&zFUh~U$v(pxNt%UbfW?86wkz?`hIx-+7mTLem;x4S{o*KiiX;Q~p9#Rr z&%G&i6|r9Y+yY0!aOvnUx|ZYpIvsk7b2R{lcHmwT&ja7VU`73d$S~1n{h1MEU#}Bn zc<@t-=y^aXv=?hoh|{xa7r1M+)WN%&t$se3HL$4Ga;YJ;gv8+O;I9%Q$n{Xmr}p@1 zp8f9?y!YJ|tZhV=Sc>+j&H`WK^xW42jjhvu*Mau1l9(g4RzLt-IIrc8W&FQ9TO63Ok z&*flqS}3UGy12g$;xlcSL~a&EK{bRzWY1|pHu$FH40(B0TS_;i%Hu}#G}6>m&tcKj z&9PVwtZBZB9JbfCv)1c}_CrP1>Vtdbi}Jiw)R$kxlg?~K30h5Y|AF$igH?Mx(*vp(z=x%aRCFJ4Ng^Jy6;$#bqI3OYODw%N}R`pgy zwFlTHki5likJk~T%NVzHi>+{DAxTv^mU{))V#TTPVt-G zZTX$zqkZjxdQ9N=NZaQ0G~N*1{;2)w4g!sC7cGNhFVDE=4!yRHwJS_Lgv%kKd0cx1W-nQ~!CO(=jBblp_x~pgk`k8Z{A+?hd#W zFPSvaNKe-UEJtymiXSA)0#iQGs52JGsmMEb?m#}+y{3J>@(94&q(ZSrVE{CJj86v+o&7L{9~p~#9tZz6AOS`RFy3>CFl4yM=7s;Wx5 zMi&!*<*_D8Spr(A0PBk4OJf{BN zRf0lSIRP0k`dz>)BZb9%7o<|*&7QSe2o0$M_W~ucU(aHEoj@@j1jziq`>X)+ss;c7 zQzWVgyA0s#JdYu-)XJRW|4s6hRwD>x1-_2-f0xdfw1d2kAO<#yi-RzLas4bc8y@r;XQ1VnOZ4@7b(zz{YrpWrp~ zn1I$|+iS&!?JLmcy02O)82n0J!{xA8npaS>Co;M*2eD}YPT9Z>ZbJ_CAcJ3*hu0T{ zJ4;%xaja9ns)~6RCps@`m151ETq&ZTG1e zXfNo4iB{5VK^qAScH>c?`qWiC*ST~7<+Do}KLdNf5CO1R!s@sFkhND-P0?Jfcsy18 z(!R623cFZTwb2JCFy#aMAA|ByU-p8%bt>9NJ*dO(s@fxUQ7& zj9gCYzyNT@xa!yVjjAdE+-6(Wi?IYZ@vrjgOoT}T@Q`sW%;AR8FvZ<+#h(a#G@DE3 z=MlT!pRf}m%3EUovWxItdD&bzs_=TmJ5{m@2142XsnW$&OVE}i=F+=(oGMFb!W>?Z&4*ndrJ=f^Q> zp^);^tZiub%!YGjuJ7)&+|Nliix$WS&pA?^d&q~dJL=-C8iAx>7LXXRCvOSQiD} zP?hhM%z?O9>UrSX%0HwQl4vE4YkYJNt`d z5KwnZ)1S}m8=)i_X9~aBV;2{|xnr=kcv~G!1$mNK&b^Q+uXA~D60|)&H257HRCxps z(QTXa4;eL2v)&XGFt6pU3+P{x8JSdrPT%9Jm5z@0qmC_2|4ywGu&C--t3u( z;dGvNsKyB@tfDf1; z+b;3P*+y-0(W_=8>B7pn!-nDzMMA5A`eBJ@J&GozZy&*?Ae-a2R+{w>)h=RN-X0Yx2N`J`uDK;kP_FrBI5Brq}cTQuYoN* z@S%S?nkcEaRd}VL3c9EDCCkh2ewg&}(Y|WRs4z$hn-pYz>d$+9qMCAV5nc$5^HKRL z-uXl^IH+<5Ub!_`-&{HNwA5c+%Mr^%K-6M9L=jCD>(*XY-`OpDpxKS7#%b1SsyF z=Cj7Ro3jDz47)$tiujO?qLS^6Dy_iz+ho2?{W}SLL%RjWw1)ne{cyiM5p_yN2095ai&H^!&JZ0n;9D)+J^$6pFP_>HIqZ2M zzB=W8TxncfmAuxQL+KZ<{J`~mxJpGwAM5+OKdJ#}5#Kn`+k;#*q2~;v)+Z)Z!9P8PO}m^4HU*x_ zo4KqyO8c+d6a0Amxd(z(-r*bUJBgy4Ft`}Y?1yH(Ou)ZPJ*}e~f*wx2baTIJ$oPqx z>;-*FfCutY+nRhsLV5djRolx7X+u=E^G$$Go-{Gben@*`OS3Dw0PJQzD0m<^4EE`& zg2FYV(`2QkYKI8|7g+m#%WzF1nzUd%*`#XnOWmODHF_Hp{b;*@7@H@U+oh$@%Et2x zhBJUhouvt2S795?Q8=}L!(}sg=ApjdY?0t8Hc&(}`$2J}7O#~GBu`Y+A z9`>Utka}k!$Fmuq>o2bt*fb->UTq?cS3{6u^an<|7K5If7YNCaRG)&qKe<0R@%er} zg+~2Eitga|5k1QB>(jnA7io_3zw!58>x|9-e@M{{I486^L{>MwgWmMTVLdt~LDBIg zm#=X&vN3ifu4@DDo1*LSyhj}FSyoJ&ikbom8c9oS+GrbU4Xx?3&$7?7zrU3+-$~EH z?Cr|@WK1EHWBwV{RJ$!F#FTzn=FqSwDCCQ1RX%Y@$RuBe8RfpL{Ij=>@DfIImyaDm z1ZoMRyZMVN6ixOzc+9vew3F)=5vPdzHT64f4%D|z%%%R*vj4RKCbav+5@*1?UbRt3 zjQ@?~$fjhrdhHx_{;>8#VV|eQ2uN4>_Y6`zUj4ha>!-_@KPz&7+C_iW&kl{v6(0fl zc5Y%KG#07BlJ`xOHcf;fvnI7_5jU;pzNGTb^FZj2za0x-1JuJs^P2GKDj(Uxrn-fH zdwl6RSfCD&zn9XS8h+C+sllyjv7)hivUnjYk9#2svvzAHH|2hS($-I`=4Z7bmx{n-?| zQ63)_O(c&g%E3sb1OccI2qiDceT_{-BGYL}+xS{6Eg}!7Y%Q_C)t|B*zklBn7LDuF zN2lA{wI%C9YJE10+B^7r_@)^&bKHyNAe*T`i}A8k1Ml}DBq$cP+v@KPib;^??N$#? zT_=Nv%De)j2eq)Y=3jfsycR1$NTe1tL}_W?AH}vqO%T;*#_p$|mSyMbcep>#leKnE z^kERAI=W6YC@P2LCE?a~+AhKwgmd%El(&=1wFlN@Y9^)qAMIh}Y+BiO^zsZsUCps= z$}aSqt#y#YpqV{{;TOJ63$_~#+@&|Hk|C#bvnbr-FQNMz?;4K0zWK@=#(Q{w`rs#1 zKj942(wJZPY__=x zl={All9W*^twXt2claoEFgRool2*A}pBw(mcH{H*Mhd#tx|(>(g(SZHHnl~i$!yS! z8!^2(w;phwI&2Ss84eHj`@%hxwXegl78nAjxKNg;46{tW(eMhfK$7eo7$7KZj*lsK z)dSaX4?ctjwIL!o|E%{n2}Xq3t4E$$sUp67*G}2Ey?wO624k2PawG*oJBhyDj8VN8 zH=Z4m;p4T3j0|ap4I|nmJ`?x_Z5#Pqk)y_SDI)w1u{tJ;%7twvPjU-&&v~%jJ_vFp zO{_H|-8z=P3_Pb1%1`sS$&`9l`I#|W`oI+j^0N&G!4oaJrI0J*Y?IlHqFPu5oLzLG9Vh4+TICiQ0w?F#|Zp~14lE3+kl;I*rsE%=9PG;G*YgJ!0jS_ zdpr?+|1!r0xX@B;25FF{BP`5tuK66b(8>c|B!xW08lXx-XBYOX(!Dy-=l5)jK-0x-6;Z7o-wOU3|y#@G&IJHtPXy64%$C898* z%`h~6H2cdlS+DgPpHO_7DFbsfnzF&;#SO&3+)&yjVD?iSxx6j^FdPpIZT)-=;iA_M z{_baV`3_TgWag}7;S(}54tnX=K{?thl75rH(Yl*?I7jvK0)~pAk!aGHS*jDaVog-e z(8DQln3-XBTi7?Thq++lg`ZZhs^C{~@J&1@?A4B@R)wkR<-07Xf`~lm`d@(7-iXnf zl`)>@L;L*r`)_R`br3@MA(PBWVJLCFjEFM5^Dc)8lE4Udp-HL0>=Ft_1*6fMJ%c_W z>(&zokI>J5xA=IrwqE4v<#iEzUvjT7(k3>(naK`gyM^NusSt-TyGn5(A?*i2A&N5q7IEkSoIE`|Dcyc&D`Wp!{u)nY&AMm|V9;iwg?v`Ov) z>tPi>$KlYlsM9a3?6CHw?o?+R-^}&+ z%}Mj)$QOnucCPL=a2~hz!T=>=Khw2 zoW?o5)9ay~F+rvioD(WJw7L4`jQA#o&R}h|vB@9$kq+-qS7G?OYAkHJKCs_-l#OTQ zuk*`|TL{hhM^6VT!Uz#LVbYl!7~QrD%x#wTA>}i?AI>g~dAji?(F-9RZt+er~-=*wG8_hAl=Cs`fnHZ>TAN$?=(p9`t!D$<~&B%~&F*N|Vlr6kff6rFV!X>WB_{VMt*b@2SW z!wDt+v>IB{L2}fSUw@hsX#rPG9FcVS{isfsJm;>)vS_Ov(vA#U?AUstOsn5BjO!Ci z4vzu{6V`q2*{AN2GqO7D&9lxd$*$~GT@poANE9n>Z=B>;hh}FbhxK61cqbznGhhw| zW}ozU|C%Y1%fZJZ1KwoM;SLMlB=RlhX4fgMF}AJr!eb zziE842Az_wh#hMHGozv#t-aE0i*7SZeI0C+JlKC*)y`qsIKz#l1Ay4}Z3Ov#a7cDl zN=~FqLHGA$z-_2p%ACL@JGm;@Ie<|w;tj3tyi0ZA^*;h!_bfB}Pl(~+=f=X|^gWYg zeoVsiUSQNzNnZl_DZTV#I*FlEvBYugz;QqgW4``IM2`q|%u4!9-T}WXHm0yPhAN&x zS^kK+Vv9VzB$7v}Q^NOC2ip0L5wN?M+b24jMk}S$M(4tzh;dpZX?2UT<#Bj6tUBxgHhjN`mhq;&#NSxIxSls(y5wl$0@=qI1Upks_lqhAK zMNnVh-BIjnO9y`CWoKuB!FFoRy}KryilYVJ{WS(se79kpm1f6<2#^6qZCOc-6fERm z($f^tX{@C6W>>4+fP9TrOX*=1ddnZ{O-^Oc6w3YtUVGJ%uos27t$M7V{MGNG8w0?b zZWd|{L8F-ypWo{b{aS$J-cJ;Urn()&Sr{f(re`;td0_PqLN0X`KgvU-IOhA~z_w$V z15*v5FaLj?13D?CDqh>d9;CxJyjN_T_1a$cAl}tBvb@%&D4L;{gR}RMJ`o`C6PGvQ zCx!&D@Y=z8n^l7kKen|dl7UfPtyA5p~OM>8~+m)P;D)H6-awk%|f+9r7_c#Py%EIoNOBKc{fM zFP|SyP6MBs-qp=npfDydLIgkXw`jzrWGzukMXlp`qa6BW-Pp-&nThBig2Mu;?kuq0k(R@sRS*&_|vk+ zKRY^LjA4z6x~DL^6?9sY6r;p#L0uA{R=;V;i^ae2zI%RoVhD*KDYNvh+sjf?-)+H| z-MFw7*RPgP=7l|9!nnTXABj}~DnRB}z@JDR^de}oNN!)T0SXaeEW?Rm!ZG}?R9{h+ z=9YW55mZk9On$+1a`Vn5{Lx^KJ<^|@4`#W{OKI(A@)&gl%@|1%n`Ga zj5({Ye|i+_m7YLFHGr-34Fz!&wp-z-o3y}X1_0t`=8RuPL{;>U^7$W zD!wCh!_w7xIhsYMl-mPkn(Ko!|0OX_LV#F;fC$~F`!U4n-;bfciDDos&Cvj6fH z34Vp%uY3PlMt-Gh^gZn{>$yrby$T&UcB2t&UK6PoT(zXwz8z%+Mn);zJCra`f22)S zK;4K6Bv2(&m!=Y^`}w%_&G6nbYO8D$FqXBVzRfz@Vz<%hK%>*DCz4XOF+M(K)5#f$ zl#y;nqM(&+c9QrmQYu-(>=~24wz;ZO7858l1U*pYh+B z=mPsqYjh#4mCL&!{OExyoy2_@;VDjCcS7Mk0y8bTC2mQlB5B zEW?9BnCNHXBybj^6YD}JvJ6x!5vmw;)Tr(B1gt#jN%Yc4-02N;yGpDzmINXePh=qs z738-`kx?16GiI3JzS$p=CJN$=+LDDsdhWCKUs0$cN!XZC#qSfWc$p(5;=myz@!q(} zcCY=3GV0mXK~_#?YxO`H)YnK@MlAlKY;ly?X&PA~lLYJ-9WU)$j5!YpBw{Z2K^nPu zF7g8#RV$+2_E zp$w9q?9G6imCIgIF;P)i@0c%jPnWo0cj~&RX_uIkZz&qG<%&jRlh!6Bg4r`AyYB|y zw_r7z``6PEEc`+I<9nRO2$=_?P&8&Sk2p*xroXYCT|yX0+*Nnh+lMD18GMm)uC)f? zv<9~o#5{-NpE?4uhO9q);dDImXIH4u_@VdHXfl7UFX+Mer@BEvX+ z{1g7%>~NYK|A^{)5Z()`tkcv?R9n<6wQcz+vz?DkJGv^%dwyb279QknR^3+k#n97V zW}e2LAxyI0WL3D;F7IX4wW!C-hg7s@*Ko{S?}eGlapqc+<_3D*pDNO|@3uA&_Vc-> zi}8QEKR_7)7|872xkc@EqQB$kci~&SR%gsfUc#x8o*vC4SE$32Np>VKlf#qAG48u} z%Qmsz_)_8s#{ZN{Z(_Z4be@XvC&?Bk`H6TR*Vok-*U&XiNtaak#d6?2#AOe~L~L{8 zL!zU(tGI`KcNo;7)U^05*9c0T8_Ve5W-ZSCnICBb6auu9BGf9;MU`tHO?%M=`JIWd z`e>a{a(^Hi7Y9kk zY*y){Qvp$t0TBe&RH%4Z05k$^yrj34@#<;UgqL{=3gvCsP=lk-c%vq1v4;g|!y`$9!sw1-G%uaKss)$Ch-Hz5?igMgV% zwKf&^x69}`L|8t@>N(=-4(bwg7puf@3j85@c9PZRl?h@rU$I(maAI`PFWO-!}f*G*;t|GNrw#+LDyOSy2Ti>MiP%}}tyH?`HESu6~5B}~xXr8sdwzfvirLA`Q zyc~z0osArSY#Oxn`Il$;9$4nI?@TBr@wqnJrYsvo|B7WNchdZ151C?rZrxTG@SL1t z6vi2H!+ujIsFDuE&n8Ew8aaL6m6ehXcMSV2!BD(?|4Z+=daf^Hyz}LzV0~f05+wTi zp{;OI$da4C_#d=S%6lOu0H>d~#lW+b60kQuo>g;h>3S5oe+hqMLrqxtt&?+7{i0Zk z#Z&K$Az6Asb||O10Fp&zng7%@S{Ckm`Ke*EGYC<*Tz=y2ZK6CAxTBKk^9NT3Zx z8=D@jS?$ZGt26(kOR6dkY`EqCV#W$2|4nJjWEoNYQA%}nLrA0BONfX+%;@t-f_DMZz755jU`I~KMKmx zy|dFx{RxXBJn!0sGCQBWySoh*^v6!D216%b}QMyu#Xv)bOqQ`SI}C~P2-0_@;Wikhl-Rjk-(XET zp*|Y1_u-ZQW#|8R3q)efG*#1MA5nCm=>Wa|60G>MwI;3-7~wp^za#Vqi@!}!XLV8Y z&_KU8bH}f76PN{+sR-FaolU5*;N4X=Qd5PR>7QhnkY*i<+wiC!zg(Idt1i;NH>WgG z16l07kAI$XR&v@}!*wN_-q=#3&dF-95okC5+S;b4!7RLKSc@tVm*;qn8j|v#*?R@$ zX%-yTsJCP^aezwBPY(KKdHTz7lmhc~9Hd30xnT3%!QvePOs=@oKHUycti)y#mavA) zHVcP0+fAp4kbed3xAN#i7ik)E`}||Eom5N0&)u8ixs;rTUf%Y3!$vdiCfpsF+|468 zv90daBJt5cB=!%P$YY`EvzCuspG25-#Ph~9Fnx;`X9h%P+NXWeM`626oF{%99J9;N z2C#p!Q@VD3HAa>mm3=k2x%a$bRPUGu_LFvZE-N~uhj3l{BBn#WZCz&#=evZ?Xrq;h zPDVZ{(?4-T?#SBI$HyOi)*6auOBv?q{^a+2bv3YeA9+$J95%TNgkz`ermEL6mF$7e zLhR$4qJYKvLXLd(C8HHR5(Q>D#%f2~XNG`(@1ZN{Z-qc_S;^$6KPkDiS}PD8#yXBa zjy(MtQ@?sioaI9@4DxwOHnI_B!$L!AHwFDAj8pbs-R;dS(5Y@uaJIEoDr?bo5vibe zx}{`)BaAJ3czZoN$&qe}qm28cRbDH_CJ(K??zvf^XKoo2Z^Yf=v*7&6Uv>)dH?T&ErtpQEb_A{7V$Xf-7#XJ@h^5C7ZwEr{?iT47FDL_LK# zo82z*Yc5NCeFCes{(OGq--JiYs|QGn;_QFk4!PoIh?|0U2V{v1=^g!Ml%_6TU9Ng5 z(N^D)M3AgjXprJJM2Fg``0=Qy_*+GA{>_Cx&fAuV2V{!-4aGX5QRo-NCYn)HJEBij zl2ND|7m;#~O*fly4wb6L)RWZ-aG{gAeEU-TD4HlUUdL^W=x7%-CUzyZFSO;(H(_;hbw~X5b-7+r zI9cw7Cf0I6nk%@=GG5)U-$lFJqT;vYH@|HM`_FfA#3y{k5X~Wm{BBB;JAveJp$gV6 zrHLB~7&Te))@)7MK%Z85PYgJZu4Zjh;?@62u8yve#YV&4)1v|RY&xpVRq>loHF=|iHb58`Ik zpCT!MkR-nSS@xgIVbPa`o2jg4qT~af`JStFrm4a;_52?xIfi!%y zN}H7zp9L-B3hC2OOl2eM%o|GB5drL((iRp9O@Flfq4dDRjpT1yW86v;uo6vqyU}Z? za|VS!p7&GUiPw7ZnbFm2XdzT1s@N>3Sma1a-vZ#-0ja(8RTdq;UmP5!1eaVi@^e-;1#|SXaoH2fIURB>7E1A3>`m%@Lb?VcsCHIE`sp)+$)&T#Pv z)Ct7ORa#^nw# z1r7!FZz2Xgq>S1QxHel$$AvYETZa;ceDjTsJCrPw-R4~G*|qmahr$0giKgtv@*@Rw zAS%lan>>zl9adlV4@YigC*D^RcdOJPyU+;`p?eQ1AeSk8a$q9LDS+V|A)(EvTQSut z<~3s|Iyr#U^H9}i?3_m;*t{HWR*Lv{#9ME_?`<6xt21n1I$@g5rr3D3p&%c+3nnv4 zaF#`8(C%F)<@e7rI9GZLOgItf$FPxs;8I@mjmvZ0hq2D1iBQ+5*k6;nZGFvW+>~r0 zf=KxzL3Dw6O3mU@6eI+s#p*kf2w#FqZ~h{|ZF~ZH%6>`jQ?t{{GYrjcMor>4!32}2 ztnUgEM$^u-+L8|P@jv+c#3w85tNQ@f?FOU~A_Qy+8D~8BzNs`G$1vhXJG0 zd13iqUC}U3&t=V6-@8gamH8Na%t1FEH3!O)G|6Kc{lm<@Cd5c;zWt&VXnrEghIwhj z16h`=n7;3fvLvD(LNjfkI3fqzTfBKgdZenyAvgz#rL}F4^ivRaTV%9-?-3diVQf)@yqajOfPT9-eJpWEH2ox`F1*>B0?r~7;wlM4R83o1qX%g?O#5Qo z3R_qh7)=CghEQ%|yohSLcdElW@MNwY9Z-Ip|BFwgDG2X1dHLeAH01bGIcqr{e){M6 z6UU#@Cvx|jFJGUaSDAhPj(%A~ciQs!l$m?)->v0}l9(g*0kt)u|6UGvw)4q7rZCy} z0!B0O8w&F@U)^E16*3i7SLtM&+PV-oyUU$%tj*8b+mUkfOKF`RuWfxl(d|rlb?$K* zTt^yV{kfMWQkn1cKd*j{^la0vZRZBDk8&3TFXv}ROx_VH-xO{WlwLxj39g4ID`nL= zKYS*7%O?F65FJ7C&M2VGCC}I0HF-_7rKW&UR@Dh3FVpvvRasBJhNt+x)IdOq2Sd7F z-w(I?o5QG4>(ifSlNNd_u7RuCQ+cseJmrc$;?!jYP*6lS&IXoqK)F1sI2Jd5H2`@V z_d^~kRhqpCst_7mR1Az~ZoS7N&?Nq+>1K@0#)Fxp0)9DDBvW#FEMIr^Q6-)W!V>a< zdO43w_iO-OmGj;Cz;-vda(Vl+k5mjXJfPxuU#C@*v}j{zY0?_@Bz3+qU>=jO(bKzMGb1lm?lLirB=NHxxaiX}DX1vb$Rb9dGU3N}S~c;F&@APcmMozKkbn0^(~ z`ozS8dJ+v@bnVs*6ykuyU=m6So}r=9ho|qqd<*Cf>3(c+Q19S>8Vi+zf)ZbX7JTPU zWAMHc(a13~GRC7}q9U0_8eeGm%xYfibDjp}D7EhrN#ytNGSSt(a^=w?R8fe*~_!xZ2D~b`%n14sP6P?b*gl2J+J+< ze*gU?uWVo*cmF$y{%S-x`CFQ6uUM^v+xJ)uz^JB!oyl4AnL}3@_d7{tX$xHA&hC^Vyr*j_&p zFNJ?tMczc5h8Tx5N!x*iUv-MSgc(m_!n?d7W@*ijlN`@%dfMIEAm@U!5QU#zFDF|e zI~EAw)E6vR#7kUq8ZrWK;Q}O5DqAYh){~2w{qecWy5#Y>6U?pGa&VRFn96b2R>r9S z?w-`yXx6QOA2`9{IC{1#(|)BWB-}X(3yNzRL@wSv);30~tOld;R59_ysyf+bwNy+1 zl}~~wS;)e=K`EK05c1@fBQ!QjyV!WEni^k9C7xLcEA)?YvhN5uF4jF7cXELlYH_5k z0%J=DUSO+nY^fNDB1mlkd6`?`hJ)=t2G93RANjuR&79tPa__|iMU0=E(XStUqFPIm z1AP}=`;?XM0`ZSv{$Ij;*iasVg-%YQJ~e+WKJrG;DL0+#CTRPIQbV( z*Y-pVj~f1gP)C1u%ihE%edHx8c{3YfPfIRKPgC$d!pX14mln0v$E(Mpn~qyxVy3pr z!KJF2a=$&WiFq^Z{c3|NzNvb)E44$U@V2htp1boO@^DZDk}*@ z(>=PP-25N&W2qQ=27-efpI>(V!#M^g;$*56th(+R{x0{8s`&PKc>{{EdFH(R_T~w)*f9TbYTVF~C!h%!(E3sWp2FX+n ztKcTkt~HxQ0jMTu-*NSF&TDpkMlI#-H-j5!O@sH!=GU)3u1~S67dJY_VehbkkhHEi z1}ruhf{n(CdWeb_Er8wx-E>t)y_bz6XOUxm-Nch=xwbW%BT>ga%E2ZZ-)4wA@TuO_ zBOTJw{maOR0T6!>)gY&##)Ftpk?^9+{_tJ6WGY=Mny#(QX3v(hCzVf1(&T*lN4sG9 z^v_bpJLc?pcjRff*d<{qS}Md_?qf1U2TMOa3*=E6zmaUf=>#ZaisFvZPW$pPXMMiw z(b6!niFj3}R+6iY)5ek#H%G4a-RHXMD}Z46Co{cFvhO|w*kjUR4^o;<^9d{9b>Pyk zuzwDl4(*%m;~QHW+x8*_?kAkTL*INGCbtYPyawo!(u`pg=+{q{WP$3H1-xBsA|c~7 zk(4MVHp7LKWYo=LXmSPF_BHxBwb?o~E{5E`WMdM4kFK7perZ{jSZGl0l9}7GJG(qN5~ z!=yi*iSk=vGrJy}Ol(N@jsO#Jsl#m|~(y|)R`Y*kptpI1V5*__u&4#5j)B)2l& zY}B=Z;*D%oM~6BiLU@0K9^iey!yVJMl(-=+@v&vuib@8)u&%V_yKwb~iQbzl+!Tk) z1o?}WDRr_|6CkJRl&bbY?b|QI-�NWF%a^Z~F_+q^@i^C|b4D)Z4|-*!V;>9s!h z&|TM7V*^O~D?$>HznWyVhi#ettwYfOZ`S@p4h}6@K!oHWVk&U7xU#kaM{eBAgg7rd z&mo(fy@0wp?&MF9F9JGac>~|qLP$@@7rrq^2pJ(1&#EGVWto|YAqrIdMskq)oFxsy zqesbkSTFs$|L9TA?o$)_d|{idaUl&CJCP2^tR}`4;roI(c(XHa^A8d3^)A8Mv~IY! zr1MaoDlLn`xVrR5!g)2~efaO}vsRjH)Q9q-NL}J=ELLI@7I^u3T=B=gXNT^xd$+%q z;fTvGA{HkYC91|z26)jN7%Mqh5M#?Bcq7Z)X%n%BV$ntV#)kmdB@r`kfQ^~g@pkXG z+%M@|NvCf3Iwoc5EZC)$qe<^dhOUp+-f4%S4Uk*%g|p}G2dSDqAwuq4gCD(>E=-{i zk{$7a6tB}0UylI#U0<`sIsgo2?n=|6qtxicCN5Z??qqC`lZ0nB`0R;56vOuyECuuH zeeO(Fi%z!@1p-kFNURxpZ$LmrMFLGcvO1CuT&7LGNdb;pJDZukOFrU{l1=_@J-}a) zXa|XQFPCy$^ScJzARIxf3g^<<>A17GuV+39rT_gOrbJg zJH17f=Fc+g8pF`TBj?hEAQpoxK_uC+d^PfKecTB~GWpVDzKmgzP3^^86O}F(yHmyo zJ394VypaTT-UD|lUy;$};2Ga|59tYQNW;bq!7iQ1nbTSp9B&?WQzTgpq&q#FHJZ_s zmMypCwql~Iz>G;^pg?o`(T1UvB+tzCHYRTk$vT}lns^XRB4LPlBnl1XZIX%3RzBlo zk+y;bleL0mtC>oo0R@Rjp;Lun&a{GrcHS@}8n;{wevRZ^GA4UK0%Q%H(Lf)Q%Lvq( ztsN1msXr2vCky<B?LA{h~lzNwKCuzj{bJL&r|#tME#>B>Arn4$C$Dv71^6Q>CfazyAW?S%kdv^*)CJZ+Xb-o9= zhq#&`Ay(`TulIM(*haW!g#9i)@2@#)T?~Ub_xSzs-@HpiR9b}5uQCka29l%#sGi#C zvO>DNGdTKI!l9y~Id?bj4L8>t!bI=Hz6m^T|JGi%)G~1GSH?8;ttHj@yI%NHFjwRYs)!8FSHQ9JDI zU{`-rv!2XQnrG|t(#}0teK?bBX_PIxTSxJ>es-qbduuYJ{xm}}4&6V_o&GIyIQE{2 zth>SZ^*3x`R?Z)nb105lR`fmdaA&wCSZuEuop)z3B=wf}$3`v1^K-qprSkYqR2>$0 zO^srQogEiWsRc7=}poVt-(g?5KSLc?YQxwZ^yJ zCzWP(+BABb_vFtT`Fcp>)6IkAvKr>xx5+_X&h;P+dNEF?2j7?TP^oixWAMn#K+ro^ z$}?;uP4GV7z)Mf(w&m-;<-_iN!RaLqV?SaMCMqUITZHJ%(r`?$*$)rU4-9OMAI?(qlUsBVO{FEokp) zffa3qz0tF-inT6~SzFltrrDy1G##Zix?Ib%NrEG>$~V_|yP{ASnygu=(Xl~xAjXSq1AAX+L2T0s*!y1bh@AWE@3-!G z;l7MK&&|PAni3fhW>iLrp`fK=`Fs8M`SY&seEZ)!-+p@O?AK_%(VbIXN;@4O=01pP z(E6m5R3Y6vqq`q9c8RfK&3`Ob{ptt8yJEi<)x>sLN;2+>jcourW@aAxFU)#y5Ofwq zh?^y*97?EYd;9bG{M(m5bmDLE=9--QWy|5ts{6LTeEuELxi~r3&DxP{X^{i%uh?!m z%{PfWp0gU_cwfR zSB`jMU{w7g0UHuAA$pGHj-2k!?&j!l?&USd6U~N^sHP!W)v>i1m9<;zzqNChIiF$E zhWXIJfP@6p+i5^SAz^@)Hm$^_djK<^4}SjqKaPVkGPOY1u1!@5{cYdli2VKJ9b`Yg zereUj&xg@41N-XLMT9MnFen01aYcb7WKt|a(3T&A2k$T^a<}^p_8fRjU`#2Hv-OHm zl%>d7SFfA~8I4v$)C1gYYrm>+HXorqNhMJzq=cs-DWZmKkXov0LVbJw^Su5{cRuoO zeDfW}Cvm$f7Zk)912HzD2ESR5sv=sd0*6c-#lS?&S|dh_H8vVa3r4YkBpj9=Z%Ek) znlH;>r3+Yr;kqm%$A35W&)x6uGUNFX z`{5>jIZpyQP z$T`dDT(r{Gko+WEI2)m8LIgdHES*mT6Dp5~S|0X3yDC&ANg67slvz;ZvavN(*E83z zU!HzmbC>h)&tCcUII-S)FE@kl^E$Ouj3Ta3nhOKSKX9pAu-a#1Xj-s`l+pTt=qsJ< zQ|+Mpf~?AZEU8TrQzc5MR3eFF;>smiA|k}KRIw_lsZ|3v<$e3^dvo1;*}P_S+`Jx& z8}y%6O(ek6RZ0*_oy!4N0Y{XZ@`9jT1MnK8&UXu1OjDQjA0!OWSKvHRe}0-b7T|$D z9t0(YR7r-MaGYfshFNNEW*+}vAL}dOrLp+*x!vxEaPJ3gIa(aC zi#UOfDECQo9=zu{p}WL%fmKO}l<0E-IEWOQa9{!{18g>O4qBXNE>|uNBf;C9>gc_s zft=@fP8-~HbUKtqq_0!0+m0RP>83`5i3VB7NFk|VAXrV3r7(*E%5V{cVucK)90A#3 zR!kTv%o4OzS<7%U5zWd|8M|O&V!)6ImhA%I7>-CnDF$$ywKi=k08SGcgxO#f?&+>( z9NuV`bTHBEs-P)~*)&ZwBZ4&KDvl0IBO@YWp(TVvWjMJLlbBODxh`3fxK1R%jSd(K ziAF^QhADv#Sg^#YWTjbH0%7&&XU}TR8aIW$Y(p#h09LX<&L$9>)SKZ;_rOeDr#;1o z5D@Fr-l%=kjSm`;bI~M5jfBR)L68+xcb>TnWd8i+Fxlr@?FW5NmsbNm`fJx3mJzJW zBB^g_Exf2WTMo>u#MQ;tzRMpvH=^kDV17u9)Ssp|I!CMDrf`|a{`{`{@Y|!~hLroN_v^Sv6cz2Rt>s@i^Vh1#u?O@0UaiJ-HfHop zt$X;6kM;Bje%>Z8)=$gGWcTgJW~t!VujVJdZS3DPJETQj2QubUy&o*rt4?KBg)8d& z24baxw<{QdYQ5F+ue(=M=#JC{*UNrxlz&aBwkAKg)A||QylhnR+Y*HdyexgcUJ<%v zi&OQ7QZGIGv)>V+??$lxZ`~Rnyj>5SXA%Ohvmdbh;`(Q9t<1-4(aEj#%VPFo)7<1# z71|-~1Jy?y?b~@`6pmPuv<>2GjhcIFQ9i$ru1#jg$O*JQ$MpNkyFXtT*SN&jZ7Iv~ zeHdeyrIJ~8b?)q-jggmbuKuducV;g6Oy%>Ze{jvDZ*wu$lfv$A+qP@>k+j@H2!?xRNCb1U0 z$*XinnT>AXyS;gxs7$xr*u=N;xpCWluXF8VUgO=&v10S& z@%rV-nU(GkK<>gfM{^L8Nc@q6EL+lYK$2<1&MOnO)uD<-h(Unk7kSwOrggfNUGDeX ztDG@Xr9p8U-IVEfrcQE&-0bXn4?HJ&?T2n%oQabv)~(*!6{3pk>c@Qb-Zm{heMD$< z6rr)@;nRTSTFu3t8r*5^+_|s9tzr+CQ=`elPup5Mc?_%^cQ9}R%k0)bTuUjF?S15! z`;qlPlxc#)vweCRioKqt4N2K#BgA+?C%4oiu`4(Q#`tz?+P@*9h6Acu;Zn7!JjNY7 zdhWZOa{8D_Z#N1Z5hB4LL?8e{AiKpfn?l4A;Wl8ps;Z+4gQ}T<$`ot=Fq)Sv4e)B~X&j64_vd>|j3f@ZwzCnrA@W zUIjSEh^C{QVGj3xa^2M*$>`n}YgGc(Ty!y!F<+qs=Xj`A)+Gf<+MX{fK+ zlKO24U0#-Ir;7JnV)n7qUPRnEs*j#|zHanbdDp$O&9SrKoaY*s7d?(hrjBQuB~e=_ z%dI;69oIO@y#iYaBFIRRNr;GurYY^Ak(FvG!ZLzLkU>A0*&9&^14>4VhA7LDIEx|3 zi!wJPX-5dA>lAK-X_=*Hez_(V;qyyk|vn0^L~$!k8hWW zQ|;@kkE1KMH}bNbacUmLny*s%vENG{ZHHt~`q6eL+}~Wp&ZE0ViY#o0u-H9rA)`L# z{`>E}_uomoyYgRs_uqZ@)g#?Gm-WRWpDfS1NTMoClYZZ?O?^4$Ac@C+J=@+xesV_L zvO83(&6QP_eg=@CgF^UnR0{efx>wEAWAC_5?u?-FpITe(>^EkP`3)Ot(BW;+o1j$E zD#K`IFcBw$ZUe7fE9=T5OGu>;Y<8qOKKmYnlo88VNdpl22_Q)X+XRVVka;2WY;sxb zk&4hQ3PzY36)K_jrDZ}LNvtXl!DXZHmq@y{1e$rtmOmAI6*2@%EfR@CPW+;&l6Ufk z0pCLrI+6yK3zDY=`|=zLllH-J2mJ|88KK&nlAC&dpj$Ci{wo2XGXeO#bpZ`PsZEMP zss$4ZO4TkVok(k>8m(xdAR+>kZ&I*AY!as&w#Xnqg%Kz=lrd;exFOrzRh=1=W`;r{ z4MyUc8U=#m)ppbC-M!Foi!;^)X)o7js9WeX2uRto0w%)=qv<)s#e6s6_DJL zf)!E~l@<-C`%`UIx>WfnHQrcwvvj9(9g;(H7&GLsx|UIrP-^hHr~ z>r*I;6i`b|P%}+cEFhM7iWoS5V1D=4Gk}>{Qr zW(ehNnzmb|hR>!szOen@Zat!W=YL;-d-^aSqzuDkHds+gRtzGu2sKSrA}P;(_2GVR zzt3CE4*TYNJ$loEd;>7~pG7#cl8sd^=`>x<*P87aGYW`OjAQ~T#sCnLr$V2A)dcB` z;3@=wd1*Bj<8U|@)s&Z9D6qbsVk$!peO-^?h@83@k z3Y*t2TB8SLGjJ-;L75_=e!{FvAxkwQQ!>*?v?UP2mloKhk_v=?G||RA{J#BzPwLK3 zrL;rE3gw;%r|i1@_Whq@Kx6o4B62F6%1C0OnrWOc_G{kXe|x_v&Mwb$%Y5>-SC61< zbbV4)N~kLpkxL%14aC84!!<B#5a4;}T|`E=xwiC`TCGePdYIA7!3hvGYB5~-;uWD%Sq zT56XJ_w&AY*U#U)*8b<2x$De!Ro``@k1G{5S=Tk_IwHa(l0pzAlti{bvRX@6Hn-jU z&6;U4#Zs908K@|$MU0Z`mr6GgcXmjGkeO}JNQfvF2k^E+XYb$!eE=`sVbI4u`zAsz zf+^qud=UJhv75k{Oml~?(>^Plsma7xra?&-LTbvCl%z^>Fvf(IAEGj1OQd_EPBB$7yNm|99% zrBoVenx%>=Xuwi25votY1uz?={g5coh zD+~ya9hk%3+;EQfuOubXGkBcH;lKl&V4=k#3N+>gfzF+?r!$<+<+vE3u-HJdoQwwr zV1fWp(!pjVzy&riScoW$6)`Nig`fpa1#S#7g;TIx0ws=^sbc|y1f+`^LS{T=rZ7Um z7$QIgT&S^-QHd(XATCBS#y~>=30kTlA|#^PiYC{Yixp!65oC)62sH$;mxBpPwrnjy zEl`IR0Kv?l;Bwhc1c8qcf|`{9%oighmnlqE;R+)ifCkAYB!b$Bb?}}c#_821+nKe> zE}+UF<^f|UQ&9sISYtzhm|K+XcWb9Bw;8uBu3M^VD>&VtG(}w1cWm9#x*#r5Et8Fa znSqW%5er|M18e(V>3>%}CBjj&C!x@&4`tB1Gyx3z2bwK9a0R+Io84?|;fI~h*Syy* z1vV9~&Gqf>uFP`y-CW(|o(|96(qpKn4vb5dj+9l5GS)i;68OKgmBbT7OERBOw zcLq8*y5Gl>hZsBZM-KcD-=kGywrRS6n);s3S))dM_tAW6&&x-sRaZk=Zn>m=#;McTSE|&A~-I6XWykr=M4DWcl<- zCG-2f`|rN{>yLM9F8+!|K3lurNR-u5WZCxpBY#pZC+54&NOv|D+?=0WEen45U8SzKm^-np| z2UZS5HthPsAUcPT_l0x__GKfpTQq9|JF=DXkC3_t!(;pB?Lyc*;KR;8nhxAx;B*%| zx1-I5?{ZMieSI%`u-m$!tIKnQ73&BMG-hBUOGy!wrBHA&!r7qWuG_Zm>cSkufgW6`IbVUBsLXMn@Z&E2as z%stBnB4&E^>(1NGawJV0+;PJH>+>xx&pim$~5L6daO+R2YvfhFbWTX)U zfp;W~7@X1ePR&hLuahU1?{+V`q~1v-`hR!defQseaqjJ9-_b~?%XfR}5}K+^n?B#L zc(e4McJJ5JVzx7EXKE`!JUguQZQpKVGS6VdfO+!|MJ}(OZ_<6bKKNw4-dS4r@3sB* z#&vvAJWszrA{h)RQ)VWnCM00ILKj3AAx(pe$lbJsbu(gsid@*Hp!7+#zs(9mF(Ium zo)`K@wdY|7mfIlmB%Fj_J5r4?+vYa0k|4OA97z$X0!}#ChO$DTkZCets~J)-XcaiTo$ zf{}$1M94IjjLIymAyKKO;~Vbg4?bS$2e&uE1p&}*mPn+FN(fZ4;$}UeUut?9baYl% z#%_C;9apMORV#`k%58IvYVnya1@Bk9^zp>V1~^7~5~K=YNY!CPiDMyBlSDBQ=)N9q zcyl#>9Os9)Wd=Kkx!7Z#h`t=3RWgq5;_l*Iz3!r*+9ufyxV}yP5a!Jmd+yBv1A_xV z$M=FE=ni@7cX#mmai(Nef*EpYQ_tRR^<_V=rI)Ja^Q`{GW@n&1ASb47s!FG>>3i2w zm3LgqXd@QIM{rm|FgjMr)Q!c`0(Z^{Q+|2m8yux!a#6~OC}d(Q6j>3eiAY*jR+gxl zDp^ueDH3;hck}k_{*gu5?!SG{rm&xa0r>+W*+ zBu@JL?)mKe4E;V1tq{!R;2Wi8#>`cR+ehyi;Z(&v zge0P>sx($P6-1RX%T`LET<7 z3rVz-vFkp)auE`{uTSCN(e*ptBylbtwwT-tTw|7RXm4Pl}L9vPo%-Fk2 zm%pEX8^TEhi3Z#)6#~@CDTiwN>GAMh0M344;wplxpN{o6(ev9sJ~t)vmow{oiI@T= zVS_<{5ikG-3;+Nc+d-|CL2Y2R&0(MbM9BaKfDtl?000;PX)pl$z#ew%pa_wS2>=}~ z0&TQyo4V%a#wbcP&C!I?C_3g&Fe)rXP?AegQi`gpM585DNg_BGqEiRTJ&pk*52;Fw z+KZJ%RLu7t^f3^qw^+?X1|U`|v0x`|4h4yKEV&uSGUE<()g(=k6t;Q<<45+IN87yZ!wT7KvZ0jHd+8dB!d}|W>;-YRzd`04PX(Wm8@hy<8c5O zuDYs?q9K@!iUdG7L$QKMEmPDv!ppY-GfqaP4jCj2$irhfh%Q}ccX0x^(ka?1v7v|s z!lEJyDiTW(BNr`85(u5wF59^qmsEAlVwJ(j>z&n&T{^~82^x~{9ff}28~_7FJUvpL(G1tAZL?*+FO1o%Hhq4O zu9I{`5$)~OJ^c?Y{dGNU$NQk!Eo29ODrS9LmVK^$Di62W=D7XE?ESKQ`$XT9-GVuw zYAU_Ak%Q)`))qG3<1V*d%~lXYWoijabwgZRhnURaPjAGNa}D9X69}77Nqx60aCx{^ zpKQS&gPGm(nJ!DGqwkh=QQxkfU#?e0aE<18jTI(YxoaM}7u!nSeA-z%yXbblCcfW< z+24J;XAn0)h6@@nJNV%c8``?>uQP(u919^UAowdQx<2{vc=vNZp5^FM+s-ICe~NCg^tTErf0`K>G#D81?;)AFPq(L zJ>9o%-BWw=8f>AuK}63h2bg{1Z!teNMBL5%uKd=Px@G+8=XN~?Qg@r!j%G-w-%q~# z?0dUaTl7*+e?7_deZPGEZ@$mDB)<858*6t)?qq7uPIhYhlkL|jy|#AG()3B&KD#7| zzCm|eM!Rb8#<6Z?VOna{uZuywGmjfLbVS^gQlNfp!95T@n z>veZc6Jdy5w_V(W6bCzoT=Xik+HJRtlZ29=21B{YMK?(%AS1PPInZgJXBPe48OdfB0vTpJ* zYLP`2X{MtZ8YEL~-ws^lNTw*z$3vF$UEMU1M{ii$xuMQeB=dJ|g%^U9JRQZz?|a?1 zeaq8JgG<#{cl9fdU-TsyRjUan__-t)cl&iw$sxiFyR6NE`b4h{`_*VS^`YB_Q) z7abQ`cXpLmUT*Iv4o3`-mQyLPqDn}VkU1QRM3fK_Bt@j5DK!GbOhAzQN*;)Bd8^3! z^*>?RM^;+f<03u>F7}-jH;vxboc(>cr5~dE@0xbzp|eQUww+0|xn8A{J4@;%Rp&15 z#k%{xX>ZP7)m_b|+{L@KRlTjQnSCp_zHz?$KID@7<@W7%Nq6_%6?WoY-K|{}Y#yhB z4y`BZstjKTTc3UQH_hi}XEH@r{gv1EMAacGj^L}3@^LCUD#ChUvvr+dSb6}l+< zH=HUtJGe+FJ!!zvNgxN?Gk1qZI+GY|l^uyC8Y(zR4w%Ggq(LJb4YYe-ADps&e zIq#==?e=-EI_u}*_Pl!gc)9W3{x7=MX&5R}T4-rYNolfel$EJXR{Rk$WJVzcrbdyZ zB+;fSMX9gJeE&Mn55E=o-&y^t5uNXW=YNI-(}leL=& zVwa>}M^q&+w1FP#Z;!j*%dcD5NRbmLLqc$nLCEEv`9J0UNzuE5vh<(VP)85IfiP8@ zYxNXNn+h7uuZ}W7`=Whe=wvSQUs-lg6#^h~lQ_v`CPIZX@4_1sgc61>2iXZ3HpF8w z3l@kfW;BUVRyJT_qdZO+plHna0He7B7W|Tv3h^l|af(-kRv2X zB$5Pv_gW|0_G5XgsC&H8;b+lQO8t8MZMNHEa-fFFKzDM^5*OfG_)il*jAvL!Mu0YH zz)ZMCA*Koa9B*B!l#rq<1`2F|j38X4Fa-+Saz%}r@C4H!2Eh=#4N{W;Hb}M%gff{% zQyGX72rfKSNrfjekcv36z-$Oi2GLwf;S3}}B@)yJ8Keju4wp;;g3`=^R*W(CLftvM z#N|>jtHe^tj*HaX(n+D3905xanSc^OmdH*3LshH|!@Ns4r%l~dG>jG;;NitXc!aL- z;m3F*Y`B}8?=X%+?XL$jCJ2>?1#t|76H+7$shHr*a#JzKZf`nSPT{UEcHQB*yjI6; zLez`lcF9A}WzMb|R|q6-p=3%^CW;A%Ga#B#XBZ+8U{XSHrK}_fK#>y)U9wy&6zW1v zH&P{%ID%3zrBjIDq|0LAB@860NmW%O{c3z_ZxX;?$N(px`+MPx;g?ba#4dLyveE6& zsK@Z;=c&V4#rAe(4HcOrl0&m0jVETPUg;M*AK0h8?|_}Gahn_)dXL37-Ft869Zil` zRe|WwciW!j)ig`&-+Vf6q`D?!wT8B4W-pp;zQwz>Rj*rJ^>nVz`bPWjw~|Zm zm)ao1lCJJW@ZsD%&iC)0eBr@r+EhhVSTl|SL{=nGkV@}wIjwJxb7o0h?=G`tZdOby zWW2Qk28GmBa;jOp?`_^myit;&>5lH>IblV2FRNvZtkxr)e5j0BUENfkSL^Q!_lY;a zA&)vqWc1q^qkhYuZhKO%W>s{>&Z6= za;PsXH`l#c!P5~?x`1AZ7SWjbt~PG43gKp}M{`zmZm1`Dh0h4iL=7GQ_<#XE1n6p; zO2wJ5){PTwe7x>-aYX<}6t=6>xNobQTM{Uuoh$)FOvMab%upcX&A#!C zn(Ldma|1{{9alYLvdTGHZo2f(ca=HBTwGRFTh4mDb&hwP>EY)UR~o2?vk1sRkugh& z#4)vqq7q1=1<9U8F1NC?Qs(~`|484TJ^QxS4!;fq;J0ac_hC1eWThv21)nHF5Q(= zB+Mf)n~+7Ca<2BK(B3~?SvcPN!^>S?vhC>t55bbHb=KyI{cHNS57hf&j)2wdXpGoK%_7>WD z;P@z71rH=kJ5!N}kg+;bO`?q<2^XiZRZ3fpoiN3S9;x`ognER66bNM#8e?f}VHuwG z4P39c(D}GhMO-A9P1(DkIsif$lW|%-gL{lk9!P0Sqs_xE)EX*m*F{Up0riD%9}ubg z%K6O`@mCx{#Bh%v5=kVGNdSUBIl&C!@!iaVhgFs-h@(a|86z&9ihw z8v@en6>TG`kfH{0c4u9o^0Ix3J{ZXfAqgasMt$$v_k7;G?MxI%`v-2DWCC1D2Huj>3;H!%bA~c1DOn@lCAtZqz7C?~So%VWNeJ_~B zeV$`?&Rm@LZTYSBBNB{6k*TUNb{~6HT5S&x2j!(uknr$4kdTQakb?+9Ng)WaZqI(2 z^UmIL!x+7Mb32>x5g%$o5RyQED;6i*4{FPiOVBG~W(IQ_NL!ig4Ui!jB!ogpLO_y2 z71Ia4_cbx~-fN#`V^@pS-!Izxt*_rSP{@I`pBG+l%U!$>zR)=!-bNG?!B2D;Pb=Q` zNnetTw)=Ka>WF~0QGUH07jAqfZ?BfOO7B1(H4jEShl32#3?Uj6y}{PFA0x1I61@$>QYx$*Gzt-l14Y><;5RinF| z5zi;J9BsB6x4-XlY|9ytniFhrG9 zsG^o4g9s|eiYy|O>I{k!Qm}4W1R@|~5-^ab1Q5HDKuHp&2&D^ANv9$TQ06i!1QcoI zb~kvdxf?sZ%y(=-IEIfLINWVUC!0&9-W=WT=L4uN(2I^HxE38ufgy1eW+EVG6)8)r zlQCu$&fKRtEIWx9aiZkz>A9p8Zbr2`T`5JorPa%zS1paXj)}K&>Pem2?8}9Ub2&0kgOVf--3DAZ ziKAuO?Nfkk)&q2HEWv{IqVUgexC>4p>Z+Z^wcQ5J&#KE-wZvNa7)-l=q0d;|u?_h8 zeYC!O4-7l^W(W?^b!L}V{Vj#PFno2M$-LG3>-xFw;}@S~+rG4)#51>`Cq)L!a)8k1 z^9xS;dce5TO2%$vpFs}QKCgI=dwJZ2tp@qtiJFhfx^f#;^;XtS(7r`b`@4H=?`zBA z?yzR{#XD;6$3^n*FUuB^kU6Pm73bfddW(N0>(sx}rWXG9if_Go{6B3%1LXO#d)Mb6yO+OzkF;ohPeG6PoHxsZTC%MNDQm>52y$4lACitMaa!ud5EG- zeblkB2e1zq=wL(oLpEEi<@f_UoV=aXmZTP^RnC5yO^H!?w#Acf#SQo z>m0FSd%2}%Vp%QNzW25;_jUevWTMN2RWK2+`w|$NNiHkZA)pgUjDo5&$rKQC81WD$k3$KZngBu z+HnWC`nYw`SIVnHRLi}~+S{er3B75_Q4T$-voizAS5La~>Ts2s&IwP{cEFh~5~lmr zfLpq|$F-YJ-7jR^L$qT&*AC9fF7*Z3h0Zk$S+=>G)~0omY&T)agxm;42>~ZCcOlqj zVNnjL`gX4IJdEjK)*m-@T$T>iSmV!N8vz_q0gjpM@G`x`c#zMKE$GicT8j%g@`F+~(y@@X^?EEW%} z$vhm+X2K964rWU43wHts0&O(mnd)95;;B^5KT2RpQ<=@#zBJBsb9G$BdTDUSf+qBM z9Rs}KjpM!6-z}M3a#t|$@Pj&vX5e`$t{RFOW(aZCqv&R4aLZRbDNyj~YQ>||6ErkA z(L|2)>(eg}Cy#Gt_6xmk5Z!JRF$}@9ZxuWftKebH9R@{#mI_!A3hde&EEKR;g(0KC z?r^kGM}=(1L`SA*f({^<6bOr$sEP*$_p7_4h$16g88JmOai+x-_0V?XqiviEMZi@B z6xOL%VZ~HgXcS5qg&GxA%GL=#zi|sAY&H31Zw*HyWxsVg=OLl@wD}MIv)5OhGVV7)I^k z$%ggs?OSm!Yu)Fo%_*6~#5m`IXNr=KP`by{ zGct#sPd2uTIFK%a;i92qU1dvLQ%!vY8Z9-Vm z84J8@q?loNX%V7CF0>mVNljB;TC-S#<(ED`FNuPaOwpM@l@VxUWB@Dy z5LeI5@9Wb1C%U{*j=kT6)zQu4!4N$F)R82Ngv3k$h^trc=IXpl?Y#TlZTVkaUT>TB z`}gBq{rs-Y7z$tv@7c{0)11yVo2}mQ>5M%9L)#>hNJx?>hp{3AN{-++J%NfNvy^RM zj6f!l5DmS4d-e14@$mKc`}6a9@1FJJw)6K!LIX*8eM;XmZ$7BRL%%2n;-lComwP=V zkdPrHl0e_O#&PVv8pQJUdSSCW^EiEbB$0<{K+N&^Xnh!#&4C@29elMRBuOD;X(2R{ zMKFQ{s-mi@sDbyNkG1>5ZS`N9_25^o^PA5kd9ur?Pe4x|i6lru5=jXJ#A2eX8dGcH zSK9IO+WLca*T5DW91xHsVF?)nTRXe#zHgJtew8=9X0eMnaPSfDq>PIoq47O|^gKuz zFdtZ1ncGgQU>E|)W;fgBOu$JQB2pqUB$>wZepO1d>{S`rF%Kb%4Lkr}9g;EHn zGbgh*%CAi031&5Z5We^#`{a=g30l7@cbl}S(_ZTI-LD&d6KxePhQ6?CM|J#DkG+~;?2dxsK0b2UoA%Sl6V zopj-j6w9H>E3}MC-0tpCin+NuVuo%h zyLUlMoKaoK?PhMIBD4_^iXyg9rHPY;Sd9>ZglbV4R17`xHJiPNZ=hlKC~rLt^92}G z-Kla!SQ^hu!~n+)Vy4YY$Qv_YYz}jaTGc!Y8JaBan7he*)j$g{Ijb&A7SzYwx zxw-dzmsN1e-N^X!O8J@b6qP5K%H*uA9hmk!`a2TUXH1*R!7-W!|5L zF!qELa`yR+jG;54%E#8>?oM%nw7g;)#ZNM@R_|k+uCEWcW;_<~Su>DtuAp){y!S(e zbwSrzFq?bZ?8lm$-r3wZAxj4Jd2l{NH(iglc%csF6(w+X4DdtO>qfe6hue3z8?c7u zZ#B3wE!v=9BL+r5-FH)Xz1MTR_nC8`^4p@#Y1-K{k>2;vtl6wYmTn;{c9^SUY&3zD z$B>fS8R9a_di)0a-to046cU=l8a8Oq144@MyM>hqLWZG1yd9Mqg3LisYAzb$ox{|< z4Ddka3BD>A39c39uB^r}krl?Ks!?Dm8j=(WW=U^t)^nt;dA4yyoM#1C!d~Nz@3xtj zS22t=&ME*%3wf8Ki@XY^%tBCr%wn3W5gXi)p#{dTT9qzQjATG;AR<73fIz+2;LK1R-n~f(0grSzSQ4D5dO({Ig z6II8~P1AKpi)n^n5P^mz>g82}C_(~)Xb5WhO0WUncaCaf7o6x7E{0G57^x^$5Cptq z3vUd}%@YHX!I%h!T;6TF9`mFjnb~peGD_#WeV(xsW1Qy|^_~ZyFy8lzY-+h~jcVqi zoxnOm7!xFQTkm;y3(hl;s7P@h0G!N}0VO3Nz_NI#TX1$}jvb_e2^Nh?p7(9%0!7GC>g+zS zHef)*j_T!ISv8YH6{IMkMw`)zxz7T4uNs#QGB_CH3*+PC-`}4+cYEJF;`%!ZL8k0B zh7cfN>A0&hp5A+T-QM_hf$N)aQ!uxhHil@JR;{20Xn+A)w@w(mWU-4eR$`s=tmh5*74%tR40GrqLvuRUD5dEYvE3^3>+h=w8t4<03Hq6;Z* zYh#FWpD#Jg=X>CIvXaIruIq8b0~wemWH+7Xrgy$79WX{ryUV)gIwwq}j4H-Zdvnh@ z>Ac=~=q{M6GAlhZj9|BV=Q=rcxKuBj%sa&p1jyFPMB_t7Mh`Tg}-rZ>3suWyjO*KU1ewsv29x$kGk?X1hMt3KD+ z>yy(vc=YI(bramOhWwsmGc!|lC7T-N3#|B}w-e6V7%rCiR|A@?!i{)q2bo1^)z~R5 zp%O$#7iEaB#V9mY0<=IzMO{p0@L*JgnxqF9!Hgm_YLHy#CQW4lq6mo<2*oFaiBBAC0e6eLs=&0T;! z*7Ln+RF^;jF6~(XF@qSwtcX=oAtL9w*0gFtYOyhNNH;xcq|u;Y+ie7d%M3CpBLFb| z`-iVkNZ>F&Ko6ax$#iaSNy!e^(3+J!#AaaHB?gZlP2DH*T9S#R79>(0P%Hpq?%kgt z$Y)HE^}q#xZ|A_zyT=wq8P7Mv83877WyCcqBU|&j^L|Y8egIw2&A$a_1~4o+fL=~4 z%ttU^KcbQVLz7ktX6PE!yBewvRbv-wr!1?8t#+R48NxJGBc9n~A}$F~Q?^J2K>|h( zEPVqw1x2TW0NCCG4i*L;6^1@UnSg0Q+A{-0lQX-#OiQYY-!oml^JdUVAp@|ekdgvc zF@qhdBvHBwK)iToCRe(vV2IlZm~%}y+F87W1L@5=9FQ>fM1kJx1`z{Nh=LO1xZ9jt zV42;PBdJ6IXdqD(16tk>G6UNw7nM>VxuT%}b$84KW@6NCHf7ef8^=C(wdr|IzP>W? zenw3b5Qsp6aDqrA5(qnC9v{Sf=$zl^CQL|VgIQlaQ#HD8&zk)E^?ddDxe^8d zG8gBMzrT+2-<6vy>;W{kuMN(vVgLuf2NFmm_z*zz78&gYo^-J-s!D_?J@5&sw!C!r zEfgC=2*N~BGf+_#gs>WoWQb&GBqWkaBnZW18RoanZckFpUO4;8HMilQFs2QVtLpV_ z^=rlT48|VNRuZaB(@PHdPW6uO#lf=t6VyDC42VKVNJtDZ&F9?bz23aWj%PUZGZrzB zJz`M<&fL#4mk7~OGXlz_vW4c2@OA-JD7<&w#z`R|77|8AM1(SUdkHx^yz%mHHX*rMvgo;2~iVPNtRA9&$ zAhv0*GO#xjE4}7tQq|{Ugg6~HT{5lS_ied@-Ovu!8YgHr-NRfQMiMEf0*u(mA=GIU zQGvJ%2M9T6jsOvoFi6CaIZ2h^76b*2NCsC}$Qnc<5OP|CS&FM=nT6LIK(umK19lqB zkRz6$xzQo!b`5b^Ye`HeFe7BD+yTJQmI~6qPGAFBGpgIpJHwIP3m29JoExZjjUyZ+ z*zrszTCKJS;zWQ53St;Y!JwI1hdOt2B+lh#cNdbyOCn}iHbhccDzyuQN<^~*f?_N- zRAk{(G~lz72_nu|LaGUtSz|Fo3T8?Rm{z%T-ENm@MQ)Ud>@l(XnFFD21VuOq!BpG}NfpO=A?BVw6=9)FEW1MJB|_F=I+d zHejf&79?hkSc);D5waOEsIj8PHH{jE1~jDsq6z|_$YCO*5wTV=B8D(%*s%pcCW6tn zNHl6JjMQUBSzyT0Dlw`}lTZOznWEU#Bw{KkNVXbLv`~8jTSc4Nur}sO*SpGiLtV4 zWT{c5i)ED+8p&#mX+%t8O-QuT#HOW*wv^POk|kwDDXFD2r4-bxv9m1AnX;uKr4phU zwi3k~ScIlwD2%3-nMh2;P{y_>V%a9CYG`SiSXMEOtY)f8#>t9eV?{)Tv{o}|lTc9^ zDGL;|h9!wX0*OjZHd?|XWks}&118O^n#BZaRU1TtF@#e}3{2T9vc$x_WmsEH+o+x3 z?zBaVQ=qtO(L&Hd2@a)5aQ6m!14RlH3$DeBQ(QtQS_%YrNr2)SDB99K_fC61&wk%` zf5-P@|JrkK%&awQWF%b89u*PhPoZG<{kd^|EnJC&GPKq6I4S1*r~x<=QY1ENEeP5vOynY#u==GY`! zW-;gBAqvK&87az9pB0Rn6|*B1Bc`%dfzc4N(SCX%@OlBR@CbGC=`X7o3~KgefPX36 z=HtKKmc6qeB@TQDyLfXNMY@wb*WGvhWeB~QzDt?OdXzC&Bb|Rb%aT7vD~Ix2h;Lo> z7j`QpHQ`J!N$2ki51X~YbZY-HbJz%{!eJwmttAT<$6t7%tT~BVox4mM+tc1lLd15= z*h@F6j!k5kg1ar`P8JeEk8^uwtKC-$USAP~`>0U{0((Jf*!t7GD3D_ty^spSBG@7ZRvbI=~ots{H7)z^n4o7c+S9PD)EPO6ltZ*_x zy_H>sM1MPskDMziC@o)lLZHyI+$dmoDd19VP`q(-Oppx4yNJa{Sy?5nwvh`zo?zat z{R&q9j_XO@0Gd_w8}87y@-nJ95iJmS@#=JMaZ-5A(+GiQJ~LtBp2W;GE*W6K!)YLG z;5?;{#vXVJs;YhdRc4-NR$$$YC;ZDj&0?I66BbT1lG(l9pp{T0Qo^2FOtlbgG0Bxw zuyMb$KJ(VMA#{K!&f>;pu|D0bGb_@OC%ZAGq5cDHnCX_IWoCvKm^xG}*-5T;G5O<< ze6}mK4a{pX1L@Hu?Gq;3_Z}oW@vKk6TAEB>3B}R94}Ja3`ID0SnEyz_Q_Bfu|y5s)p)5vo$!C>kzK9$*Suk&gv?Mx z@ak+(le(OlC|-%#{kFQgh_rz~qsqRC)=T5EAS6gf48u>Fk$1#Tak4+`V|!N9XASJ? zEMMN0=Vn-(SlYCHZhRt?YAtcQ_Q=r!+F4ecCH`)F+IOk$WUMY?q4SQ2~go}}}Vqmj}cGXjxb^)=#N3w6PaKhr;&KsDvLdH=%(gjJ}YYa}+ zDNH+AC1=EV@<#SGo_W_FA80PW3xQg(T%cczL@MM*w#yIuc(};V56=p?#K<_2o5nSe z_1Moy%uU=ZR!^mD+nq9y(yOVEt_%)HX;y?4t5MX|%r0M(%ZB^l0%8Fd$ZOFc;o0<> zw6^p^Gk}rF<9=uAj;2_2@GB9<_2wC@&_7Z@jxr1!De#H~oNiXTTIaw(!TOL4+;CXo zx?#7a{$8Q@fxK~bE0M{CXjD)JoUulHr5X{u9r3sffvT{&Hyb$|X`{KLX& zc?$GB!8Ma>RZ{6`N$>W7eAqDhj7d~usl{HX0F)vE9)UR-?yxUjbeAhFVzx}Xn&1fFo*$bjL{`&YNA*=1NPZ0%!+rq8hgJ?L^bhCjt z>WP2cN=%Ju=jB0`(D%UAgDstV(`{Kkv>H)O8LqOX3s1ikn!dEa_hC23tx>5tC9)Bd zY#D+L%wDBVe-9T)I5uE>aY{uTF62h@zUbUQjCDnd3jqKw z^h8I8bFHx%{}r>sJn4jD8?RAVn_#AOx;$&on9b4Pt6^*O8~g!?Xe^HH5F|@`-NnrM zm}R~&8(wY>4@@~ih1q3z+|XvwE1IOb`H_ThahfEWA+iqMTi@34*Xf4UhGGgKdkQwf#lK8urK9X6e5=6ds>0q&`peTcO$Dam_3r zCd03krg3IFiDTF4pT1)K3%a}zjIo+Do!e0VRl@X1OR9LkL?L!Q)QjiE%XzJBLGV#U z9z)KsT%kEfNDZ>c^GDQvmQe{ucE|mW`lO-EV?Anu`@%$lO@MPreNVfvnWcUCOul7n z61mfMvMYb9MMQY&_~z!`cq?#yU{~x8~(!jY>xd2sP<#<+FO$O-T>W z8hjh1jH-|ttr?x6UC%%IIbT^Fyx@QB9%tq*EF`VC?g2lkkG^@zLPN%?4h#a3&OtRe z%%|I9@_QvmM_3E?g2f>icTj%kNs$GkVvicd+y}>pj{+ZO^zJ>Iw{gUNg?`P;7ra(&UySpt z5FSby5n*ePc%3LYfQjEq?s7~bC@L4xc8ez{pg<)<4V@D@OD9ejAps{>CM-z*4oeN= zjR*535;ZH&RJdBvk1GJ5_!XjOpRQ|`%@lpexlY?>cqX3cfj(skkhXjkP~7tarTHb! zZjvKXNMOE`=lXQ1gPv_la*6F&iF3Y-EsL>wooR&&SaHYV)CmBQbx0e=;gh_1kJ|Xx zC;7$QHeB%DY3Zg=gB-)+OY*}vEycrw)U!Gvx+;Q^rwZYpCD3Cv>9#$ayf38DnRv1Z z+F2$;r4`-ARFlvE2SLS=Tl*x37!5f7lHAMJ#uEPj|9y#_sti4 z_nRj^>mSuM+8KGPboHD@>mf**cMdhe%b;5|DCMO_mD7Pj|FhOb<<93U*RDp9lp0Lh z1Dt7Nb*L^d)x>E(v|vPHvnpe8HuW@~C8dQjy7i|wkq=>2#JXu*@yXpjVGpTRFO0rO z+Op3yD}-A4JiS2ewPM&i3d;3O+V)54i86;s3g4j0 zBj1IucCO(O!z@H)DLe1ru(hk7S%n6|Ws_L+8}s*^Q}dC1SD`nUH#yk?*! zvI@gHi8&{^nm+vEX3-t;dOuI{x#fr#!aIYj#Tp@%pQS19U@6{cI(x?NxxZQ zWJ4H<-(0@VzgJH>;?hmYAonzv^WCoO(R(*9wX*m1(n?oVT*TvAq8rlKW9uzi>>F8NG|+}HQCz9(=1njkl>rAA^Cj*@ej?;g-l;HGAhxzoIZG5u?V7G0W(q5fq{ z!X%1P1->uru~<&_hV&n4u4CixThPjmnAAzBbT7_F&p+4pYOLp0)W|AkKp&! z9|r;8h5xzu?;b-`j6(z)Fo*5GMgFPF+yN^lkc|fT`w0z*E1a%~AQwPm4zUFoVeKA! z`}@&vA+P~nIFOwUD;VInGYbD*0FVvqVFfDs6a3>b!0^Jcs*J&w@qgv86$5}=uz%;l zgJH`Dvi4GjPJ+IGbkl zJu_@lP)-gvpSE!&;I{+TNJ6kRVH0CN9ax8lZRGFpzufPFAT)I4d^x{W3jjd=F039CXDy}xK7AVO6wEV%-#LsAl#ADmlD_4^P{V(Ln|V2Z))Dh zhEoT+l+Q~CYAe;06Y_l2rE)*FGzBk+f3%+ayesy7Wi41(eVRffS362_D(GZtIF0Va z%Z}>TH-BNFewC|~i$WF)8@(Sxke_lZ?-QPI5eEb{i@bHdt`Qmu)B8ANS)JFn;RF>5 z^q=zdFpneaa^gFiKfN}Vab6FOJ@KG;7$jy%CETVype1NAxMS@$MopJj%$qtJ-sN&I zu)r^s0x$Ci7!)$MHO`8gfvcti^4>fK6&#}do2CH5B&xIcvE?oRjyKg^M!sZ^ur<| zjGnMm&-R5cuYKPKAbaRIUeQIiS^u&~Omt<|K|uf&*ZH3HBd&WzFP30ipXd+A;FsI) zhr}Wu!7PYkD9q2(Sqj^94z^zyitkY54zPBcY7$Sd&#c~kbj_==o{XeJe>0=3-+}!c z&9(l^d&06Flli09s}JVudgl(hQ8oNTLbJj=FM=Tn+uYe!BNt8=a_zb12qsth>Tdlb z04m7Pbyqt6jofIb(q^T&8a-Vz{WX-`rQ6_xEmVU=PiZs1jkHgpWHW z{?(kLcNPBMe+JSK%f=8aDo^iS8rH8z6>{Ih|Gv~_2VOB1H+bYx$P_Z^F#`6a1SYL3 zS1-n9FRn39_t~0{Ckl@z?$8?Xk5^NHwXNo)Y zc~==cu4ms?kYjG2!Kg$Lg(fy;#K=ulYFsvERZQWRWQ5Q|SBqQUMuyr_Mq^*N7+v2R z0c6~JYszTxjtvVNDTPDPqHX+kYB4E(2g64h6CvR)nEJFBl5WCx+f;W&3*JQDxLrIE zz6eS_S)!?|F`NC`YGCb7uP5!|=g(Gs`utq<#z4WHL6Ms9>BBPDAsz39gev3l1hz}A z9nr(tF)k&# zm`B+C;sk)5iY2w@04W@9XPqikCI%xJE@2G23hh8Us-O zwJ8$4#ni_)MN`s9uMAnbuUb#@sf@*_M`>^wj2xa6_A0!@0ozl>d-~k&aP3w?T{R!E z#T3&4Q_NV@O)eFeY3UM~J~l5#Mp%Sxk;)O_KhC-7bL@HX;(h<25-=nm|1n8Xj%cV% z*39k@U6<+;)0N7{4(kCUW5c+-GmQE7(ff(tZ_wwo+Jrr3a@k6d)R5J5oKOft3 zzBwdhf8HJ7Gkg*-pnPt4-tZ>wN1F)l*|`iQZ0YHH938=F2VcTLBl&~sqAx6CkOJ|I zNX`h}2s|nVnidJUgM^obGFoqD`l%sQ`jBXnNMd(_5=!!nE`4)TW0xSMPsE$5fsN^H zpJig}hZ5LRKib?zgVpRrPOjDtm-w=jXS8Xc@=f0jXS-1ZY3C7s0uc zx*51faCM$nkoMSLU^z%PaWqNT|7sMw@Cb~O?zBY7?XR_qs1|Wpf{78P_5wO&@?irN z`D|(7%;R6>HIsDZ-k>^py!?62`%Q{oZaz9-z99Om01yAgT~U0)`CG6rJNP?Q_22ob zHGemfG+e#~|7Bcaj17X{f}NvHud(;o;N~qjRGlA@O41M^8Y(~hyZ0@g2;ft)A79i+XsA|lSeFkMZc*rd zWm$=FFPA_)(-V@%-Bt?kFey8eR@Oq@nI%q!G_{l zW$f@mC79{KcrAoOw9(OSX~5Qh(UN!4D3tguy!U&LQW9mf%K60uckZi+&+Z;E3rEG8 z9&D@y!@;y0N+`Zl$|8LEb=+_n`jewmRFJ(o!ns&INlLUeKtt@J@|HY9=%(*O47v&Mjn(pYkLs1hdd6vg=%_)2 zBN&app+p%09j)So99SG?CK-0U{8qDJ!HzLjy8WTFw@`Fv?V_6g<2hKN+)HsTt9L2= zVn3=(^?bU3E`)AAtfkFj+T{|p#n*vVFIK@A;%D^QMsY?N9HxyW8LH9E+C}{FBy@r; z<)n@T;l%>z->Lo&hey~duHXS)(Up2RPjfP_43K;O6@o4YgT)B4aR5_O>f;ZLOEgr9 z$N>Zq)vt+i%MEF1b#YuG?L=lrxTw;>1mO|@M!do*t?+p4PYnQoT}y?UE{*SyAZCv7 zRpE1Gj*^N&Jn-MqKzeWNKubSE9beU0S%qqYqvX-wC6(couSp($OgAFd{)pj8Bmo2#^Ql-WjC4wcj?k4;t(;9|}3GU9T8g7=#0HSBr0$N2=IL}IqBp$W=MTZAQ zKC7ll=QFWXX^T&+H8f_@U@}{^XEKnF88TZbSt*$VCng$dcrcb?53v416G6oXG<-y@ z?4oV_2-tA`uh?G_vEPsXRty^dyQpHefkSSBGW!&Jyl#HdR)a!E26V^&I-tP6*oRL} zRdZH%R!bxFH69i4b{XRfr;tE@w^X@asjjY}&%fx|_G<3e|5A`vc2hJ^yJzz%H>F%e zf85Gm!k^XOHU916=clec53ToxJBa}cWfoxk?h6~Yp4x?j9U|=zH*tZ-5aqW#^}D;+ zW%KI_l8e&v=qorBT}-2?c-6MdmDtV&W5xiG_Aj}x!`w(BE?dApQ$U_q92bp2N_OS& zQ@r;eT72i@z-qz24Bcp@eqBB;x}%t6yC$)L%hp{hUF41RBx{O*pT^S}lT-_GutD7N zZve8eBpalm68RU|6SL^>7qv}qbm<8G_pPOXga{$LzA z9drLQ`38Xj55w>L&J*;@4L z@|O=)WdIE}R}1|SM(H$c#{ALukqf^Bz4t`*wBM*!sVqM#O(`dOqs4rX_ZXw{5v|y} zO%N23rb2_yH?l8Ii=(HUFBzUz?>ws>r^Di9p|2nN^f}@?I;i=TWSqnZPmX-7BX^W3 zul45;Rvn57r2l39BJ?>CGy<2~m_)?@N8OjcBn43HVtg<4S-CMe!5eBSk)K$z`MWwi z{?l0zN5fquQO)1|*qiHT)TWWx@UV!Z7W+qn!~gf_@7v!O;s5&A>z8-`dNO=_Jii$F zx8POo+W?+%eK;1Rgw0-0mI^r;^3L zzE5npRL-ml^EV{(zYgIE#>iO)`y_@=dUf@dR(M|B?@0Gdc&E}gM>1cM=(!irDCLjR zSH7s9y}BXz;OEC1u>B!-(sPRrvLS9C<|MagrNCYuBa(7_-X#CAWDKAE`PRO8%9>VM z%rBvzp1%U?CIhy|*PlEgA*p2rOdUPObQ`Q`QHl=kOiGGuTMbhRH$UCc)WI$w6}|DQ zw*2t9DOc@XjxITfUaY9oaQe~?idu*ex;Go>3jfJ7)u2<@7 zgk&U>H$N=%6q$WxQot?=4`RX9Nrn{XJRmVD3TI$H#Gp(K#WNBnDi`eUe6`ox`Aj*%-Lm)ib zYR8c*%biuI?+}lSRf=ypI7xXR{g36=t`S`#L)%eRG1yf}NWAM)pJkDPH*j$RJMGj2 z@rQ!bt=y=ECB-k_*^M_>^98&*)A^Ai-wIT?TBIpJIZ-DTbg0^zOgGv+JtB&NN;n)& zHLd)pdIW_iT}(ykNLG~#bI%{A9=!DQcjw=hZh~OXL=EbuN2HwNd}V&yQN=IFg}&?C zrG?|cG|_FV9;IUIb?7wYuaOuMxe(YpX_LEGD>vG|jP)B+4j)X*ln)#GT&RH={*Q;^RCE5Z6z|M2W&$ z@`OXzI8wKu953iA8tYjv0iq~D6cYJWyRx0$(@~Lkq-`*4_#N-Uq~vkWw=rvY>mdR9lU#6&?{f=ek>W-Z@5sxat}{q`F+fg6~EfD9umYCOZ|*pZVvWlbnpe zxj;5&E0n{f%B@R=8B-zC=oJ{tD->Z?P^L+|3rHd{E%O^1;Ia`Q1=*F4eZXj$s(XBb z)Wi{o&i%Od6f4U~<>o~^%*s<;=8k>TCefWg(P5xTaT&x!VRO|+H|&2YwIcf9oq0BE z8yHuowx!W zn9;huYDdQjm5z!J#s9qG5*8O1hr^~&(m7ZcCv;lrC)&hR=_g)RIRk#Eh8nL$mc=-! zqA!=+ca%Y=$4Km-o)L&EE9kkxDnRN&T$D4q`-A5b=QWVccIN3$N0xr)^zRu@Md_fj zcRATGJzUe@BIF_{pZwnQ^iGpE=~~KsUhKk>`f6r6q&*>N^c2bdT;lV^ zUY&vu|2%OyUzb;qpGZO7!WYkCAPBEnRB*2-H z{&5u!$M&(Z#MB{odb{InfZ3u+6%DSG<*T^~CleduT#UW;T+2z@`yg=|01gyhG7m52 zfa!67QkfQ$t<(e0l6^@F8lZF)3dQ3ne?n!2C z5Coc5KP)JZUF#zE?$tky(RZG)$PztiUkw;PJq9t%lGmMXm<(9$YS-(LubamPAihgS)U(sjf4P@%s z!daeukZ}-T`Wk+e`qE6OI&Y+H7XtAwUEU?)NUt3Q+eWcr$K)Xa%{kohqr?Z@@TE(F zVvk3C6EhG*TJFq=>l`9?5ZTxk7OICr-E+%jZ5~LS*vYx?1!yr3_GqMgfC1ElGGqe- z>ZCB@8i^=6RlL%is$S1+IdO;?ul@zy4OE#0x-2<}g41O)GMqA4=6EI9e|42YNw30N zYGW5IJPO`@;BJG>c((?|olG~bC{Qz?$Ob!wadL*=LSV=_Pz)4&Zun!V4&ER{%MIK_Hywgn3ksu zruIh|m@la3rW@k``1$iE!2ZG)#H06*iZQL&q`#E`oVtC;fJ9C}{;dpL^a26{?F9_j zV#l>90036cyAUTo3E;zUvj0Pmzq8^N_bN!?k^>B|GIS@e01^RC*z8N#CT_}dr8O}V zI3SUOHwbja6A-q3TTYdUn=q_yus=*7VLAE8--^DzR@`g?De{!zJONPl5-r$1Waz~z zYEucO5Bj%I*q<=~fFkA<#1`ANMc8XXY;|z?i5u$!u8|)gfaIMrbrI~9-Uu$%I&k0X z-5`8HybgJ|Gj2A&ojSY2EOt=u3m zau2bok^f~}1Gd=8{?qH>EHEWn7)YM|pC)T=0B?!K+<3~~{I*MFTx`2%mB~+#Qn-UK zP&SC`ci&;lO@^W$IAfbe@X7hN8TO%XKGBMcfs_>Adx_hebA7>@7(nzp*1-0{P`4o% zEoLOL0EV>@KO3w(Z~wQE0`OoUuK!rr*$txbCI=CfQ;1#Mgcb02zh7gCgDn792Y4DT zvc!Vzc+Mt$ko3*!-NAqC9NPh&H>XDkTyb&5(=?dM@9t|-X4R8|?bkh8O&v{Z57}Jl zy&mDgq=*Je5(;wrDXXXF^{9zu(+dqZ1i?~<@0FD;i=@@!RSrp5A21vayhPcJ9!ar$ zgY6K^4=tJ2fA7}aDu_dTB=;rMvWw5^|M6BybCVu7c3r1p<4&ofdR^rvHoIiEe-2l3 zT{S{_o8%#WFPC&|;GG1+L}$!6Pm~ff;+wgR?CFHd zF@5?)%*GSJ_eP~l25N(ECd}(Puv?+g(s}v5c;83aLqWX%uW!h6(9wr1LvZ$y?_F0l z$C9QDZht0^$IHB-@XoZZGxvJg>WpmRES=HLa!rgD$e?tppQSuU?Bww~L5^Fl`tUL`CNBhp8M>Bvj1enRo!%Su zSDO2Fq!v;!AFP=ylbOs?SD)~Osa-24xn=7C z89)kF^B|f#L@W@IO@8Wy=e#b!T;Ot|yH>k4)bdIvOyQ2UbTZsn~Y%n_x5B-TwL zCz+Cd@8~Dl_tjF`dI!?ONoi>%Gd5@zgenv|l#z>LiO@8md9)hTeM}ssjXz$u)g3rt z*$6n1+nKaaVJVwEjS3#l78kFkC0l8p_8+cTMLiFM%#8V5rgqQ{r71sNcVL)kkSeE? zA}>6&s##~r4=l;zZLwTeogEF*qr1SQ<4)K$(SUV$l)b!+E_%+pX>^bN!_Sob+H5h_d&4bw2; zZoZ8dAz|x%R!k;xs;M|aj{$0u?+-`6?ssF>X|Ayj5LRwj=aApbu%xd5I3I^aMgcsk zpBZUt|yjii7iz3h>p=ocYqOL?TAP~ZSm zq`zorOw6K5x(UT5+dc_TESB@W?~PjMMrAD|l*$*5wD@?Oh>moA>Bk=k5%uNX&mQc?gut$59X-O`lO+m&cZR=) zWJ|dY`a@SbWm=|~Bz3r7uy@v<7X(lQ`CMo$h2o-g^khNz!8UoC_=4?{ z?qfdJ2~*U&>`A}l_^gCh+Oo&QGfxQ=?j=iRlZETwX&k%@dbHPEwdVOYS-faE1EaEV zZTp;yt&@#tLk;H_VUS`f)EoC?rKDp!GpOtl3%dDag1PWrn%4|;060A}na~PL7fKi% zD>gbrTWCr@GUsSDD&eVTL8$xInXTJ8A9a705q)4kCXI$1_R7v4Z zkN}V0dnD+zRN?5(`+_H?m-`ao5a}_$Jf+^Vu&L0XPgI`3!#sYIBwXlMW%aH9i~hQ2 zj?rf;^F4n_kV+BVMpRwf$m!=GTD?i0W<9#$9>v&BYje+JT*@qOH2krgn$@n~Hyym; zlWY2<+qssSoyj4*P7{u?E?x$@D9Ee#0ZK=Ytxj0P#TUNsuOr$!0*J3^?bUry20T34 zR&37;PsdIPg{$=9^yMz|n^+E)e0K7=BcY63N? zH@{txDV3etL6d&1?Sqx-9x_O>-ckDFt`jM3D^VVjA}tHtA4EW?aqdp;cJJ=jQ}whY zdj#RnBQ1#mYLBnC1RUWlU4y08Ab2RXW6D3Bu+>PGYh)B;G_g!BcvD8 z>IxS_DZAWyMaI{9l1&mnyhH~ud=@A#V+qPZH9VfCWoUlM*DP|ah)-jUFuU9tOXib_ z97RLitye5(!{&d4q2L<9)D50;^=YGFFS^cRj_dr{-otyY%O{Qu4e+j$g-a3|y{Tnt z9uh!0JN5bHCrgTz=gk>Z%5 z;0k4jx5!(Mjrr7*&kz#n#r)D@xBRTtY#SKb{y53)2-sKV)x1y=V?E0{VmeW5V1>|K=-XuSmvu)Fab zAF?*W4}N}M9lLzb#QA)j0rdf2Xl_TFn9U=y5&iLTUIlT_qN%xN(@JPfrMCO#x?*ug zEc&L&aR+_tbGMlkRJpE4B}fHGUdL0QZG1`OhMp9+Y~ARR53sFRr<7+iu+JU*)_dWt zu6(zZw58U}BSJZN$arX9FeSuNaCi*ge4s=yx`Sv=*8kXzQJXgq;~cQe*bOIj5;+@? zU3ZBK4w^`M&|dyXSVV#IQh}s5Ja)PyL;2hpgt<3btf6 zISZEzsv`VE>To{ost)=?V6aHsy)tD9yeWR*TxqX7#^MOwz9@?cz4;)yC%5hZ$dg_R z4m?z3WEvC#+{^7ZWa*mZi8&_?$FHcrov-6k5Ztf|NWt-_as>C7GbH0}eGI3KX|JBR zfXzK~QN-T(IG&fjtxdA*%z>|b!I37T3{ZTlWVgTTW1$7)ncB-=PI{X8ct9qfyKBJme^q$q)T3U6!bHQ}gcud69a1g!^0$u`v z_s};vJv_IOl;ew?p6!V5G2P+Mq_p!BwOB4Ft_mL%*E?CE%cE$#7X<7DdA_4sZrfV7 z{Q0i&-uuB_+DE898g+wQ;TnN~XGW;OZD7ec{@5EN>OX*dNS zu{(7t;h`jkuOpvyY)j1CwR$RvJb$NGix4&hJl&ZGrL%+iq16!Um6XHW1;ou{2u9(i zPtAyDTQc%NKHkHZ0#(>4w2jVsCx>v?@SP8tFF_|Jydk>P{#Em+bO3Z{lNF`%R`yEJK))^Gh&==@l6nJucMdo|0#OLHv8&lMaFTJtCdaXcN{;7xe@-Du}^ zJJ*SVHHzi!WD1sXNys`R z$e)9ow%>`!@owIS*(F2yvvPJd#B42$X`g^wp*;q^kjwh@#t^`T){Rb6>CnKwMq8Nz zR-Us>m4LgBl;4pCWdnHyn~n@&iOr!hY-Yd@qW$|9b#0eC{m4Pf!LgF@llEe%dk~J> zbIXDI_#Mw!a-!<5zy~l|QHLy4m7X6_vMU1fjJrqp9`j!4UdRG`hS-VC^wFgt^$xV~ zAoQj(y`rlxz&Z~OMJl0qC_dD&Unyinlw>G}LV_~gvJr^gM)vf_?046KW}*D8%Y zBQQ>SX?AlSePxVX1h;D3=MQ{U@Hxm_%&<|itA?$R1vLdI&2;IH=buaP5_sy5+R9-j za-Qx!=@=!VGjZ?{+z9!qFZYUyG|9o+arb4A9H9SIMe=4ANQ8E^y@VYfg}QLxPx6GmX3xMg2rXcnsc*9^UbG?0|8+aied|*#&`Nk%r4U;WD zXy;!y<9RhvHLeTe`1XAY+31us5QVThkHD_b;mtD=E1V2r(QetXtfj371-Z0(nDV1+ zLzQI3O!NHdt5KGhD)#WoVH@*zS*o1*PE+U-Ls4aywqy&L6rFTkIW9oGQ zPQp8PdHt_1T1ri=kgABWnxo` zrV#J)PDF1J4j9p4_7v6HCMk&hRPMK^90g|BD$@Z3G?q_f>iBz=)dAoQmZZcb8c!4S z$wv8hVba0ZH62sqbXUKL9taXOpEL`XXm7LA@$d5;$g5O6b)U<0FLukh8Neiw zMlnWWAm~O+h^b5Ptv_`iKieH#=gZoT0kOxf^;Kl7H}LT~joj#`7q(x40c9}lna@$@ zRtr~_+~(n5Lrk6qKY95Y+O<0G^5y9^CC`2hi-+fWPt2mpGrNGAJ&yoKLV@fBlE&JO zbW={G8*NBO9K2?OAT@elCo);^s|D$UwM@Q%MFcp@raCO+gfo-od7ijb1JSF@r(ad6 z@>CCJ0I6{R@6(d5NaeHsg5%u>BhpnDvy-ijd7&~i0x|_WpZ6&6-YkCz0wGQ~gU@<+ z+Y`G%=@W`Mer->$Qd1u*!0xxCo_rN`LC(Qe54WMg(ajoT%|YO2w7z3?Zj93fc0 zk*3{2nRdg_H4_fB6MfaLl+6rZ)3F3&@R{eC{4u4(7g_;le&_SD#{*u#IRw06ty+|SiQ-y{f^)M_J zhI|UW=tWqB2ERBKhrCUtJHOTjL{aBKqS z?QLKn(;kAqKpB5V;0;o`;2M@?shZ7v2T!sO!>izpZYXQnRh0vM*X|K^#4*tThOjI}8CYcQ%zPqFYc0Y{ zax$$Ec^juHDNLc%Z%aNh4^FT3Kj0_rIKpmpi0c_(im(Apv()qXqJMm4MFE3+kw(@i zEBREp9RBUW_;~=e?7YpD*}cxdApG7@Ba^W@#CibkvA(eMi8Thd-{DKdM*Hu9h?8kI zz^hf(GuGIx*$2NWoY8Mab3!^;&OjsN#Oz+BXuDXMU%uyAfTsBriwGbuXWoR>ETsdr z0hX`WCN%~~?FK*>O@m2}#q*nmp_!Qg59Hy4Hi|~%HT?v&kwd7+xC3@LHQoRQLl*-H zSqG|+lBN3J0FQRD@?%VESMz7GgbnIUf^npR9uIM!ygI~iSf^QKJDv;Z{4VmL5HfNL8xqwBS8=|<=>}GN2hX5tw4KMtV(j7liQ_tzM+fXIl zeDZvHh>4G#_G&t1_${H)8$z7~eXC#?Jh$>T6mT0!%5Xv-W-waLZ<3W6=1F4g=TJ-^*SrFd-!58NO$( zV}vvuD?Dm|m(Dt6%(S@&?Aga7Ie(dw&OupYnSG4(a zv{<&hn7YU0{MU^HSequA0D6X!0gGz^()D#{Odt&4m9&d-eK}vlcn1PVFIfav)eqa< zmR5!{I(mMHFRabUH=ldT^BrKr|EkIAfw9FGpyrc3n=4bqp`>NG1LWO%rSwB!0b(tj zM(0OW@y)_v(6aCmzo0vy^gS4gZUCEhubASbhDsl=GG;abQpc>4T!WGT7lewY9>uGX z9m}2`RFKvj&e+rm{gpJ00&#OB%)gaWpS1Fuv?TK|7ro0Cb!V2ICwI;yr^Orfzx2cY%UMSmiGSJV3CP;EGqUv>CaagpWoa$O`XJOu~j+l3Ht zBYLpho;Vv2(xGNcFnbk%J!=r`Fz~#rY+i?i19%MOx4OpNNK5P6p=XrII~p>DG(5AUop%+thQ&a2?XG+?8DDBzquQI9lB^DV`Lc{=rcwYO0%<=N%=XBD z0PO~ntNI5!a$V$hRybZk`YamcK{-pNfLS-OyLP5PpVh2@fCi}<%5WN4SL@{n&(U}% z3&%ijm(2x$aju;dhhKAq@1ry;JjX$HgXRdB7g(USrl$01eSM;=>GOWwx;|4Qp@4Vo z;?e>sFu?*;FGEi5OCnXOsLSCg0T)NtetZ&%rsqmbN%Lj<7gxF!IXj)`)9Xh@3v#20kD@bCnWwoC{tK;*605C{ z;xa$~Ov{csQ^BUsEdYWSu5;xP5uaxiZeED<1_jPSfXyFGeRn#x04emRxoY8IrVJ}l zB1OVtK~I80yx_~PZC)2*4`!bv)S=V%-euK~Q{BTJ+x?NOX7$zSlI4K45CM5hoQ3|q z`spka7)WO4CP>v6#1*6UZ@$BN4Mm^*frG=ly}xnDKbQ-*c(WJFvX-+$DPjRBj38ETj5CT>JmUHi>yI#A&eP3X6fDg#UlUF9`dvVFkxw4yN@7k^W{r=$nG$@Q3f; zhm*bb1aXa2{zHwfu_@PotKfGNWOH(mz5l2n91~D~gTO*0?0O?*0I*j9J8_`^`I}0K zEd5vG{(~+5(HsB^MKQrY7uq{9NxDcqFPow0-Lm&erx6{k+&o_*wd#z7e$@Y1blI5+ zXhC1*g5>nmo^t{JqbngB2KSFe`w)8%mXq~1i>+{SeXF;T=8S%t}T`b54SgB z$YG!ZNj5AKehqlq47i>64Je5(VZK^_5T)h@wvhlVrt?DsFJW@OZ+>g9xf>IJhGAJ? z3hs**AR{qv*;>kPi0qZ~spmJs)QdQfY%mDPd549=Gaz}c4HiHcS5hqC8@3a(or%*f zVOoFC9t)Piy$`a+yz*DvLtvcL!h_uj{@`b(-!&1cp|Ob0UjcBOdX|qxk^ey5Kg1K1 zhCTQhi;d6Z0Kdz~1$cR4yAo>?{UA21H5{RD%Kl@{e_$n<6vYkVHYW!LIzPS($-Rl= zdHNqrPN;a(t#DID0fFd`U@fk*0gFio<(P5*&7yIzT@3sW2**HAFUOC$kmrAv$N;f5 z-!x;Vt^fe!e>i3DaT*Nt8zX+|SzibJhj?O@AM`26dY>UD2jia)`@_j$SXJmEk0i5U z)VG-RupxpZQ22~m1E?UNxMOq#n^T4q)T4)hwS!n&|=B*#<)V- zy_|{N3i^WMj()#jXvj&d5l*dqX$4$7eUwFgg4X;usvrM#9 zrak46cD~C0m0EfwlPbV!^Z6#a239+N z>m^7#@=^}{0&M%y-sqne2jG+B!`oM;kww*1Yo!97?$I}$dZ_|j_CLrfEK6tWP1x@0 zqEd*NF%HSPIQn^rS9ocj@n%oWaTC39U!e^4$>udmAqXga_{FVm~FmoVOgA zP{Bqkvi>Ugbad#gz6vX3J?fTSvR}!3b5{QZgU#icr>g#m^NhGs+MN0UmMTZmR!D}Bh4cJ`MyA;&nnV^H4Mw3y3w&JaJmuvZ zG17YcuXxrYy9D9LzJT%ESvlxT$q}}Q_bqd1cH`&KtpJDNZQi@3zKyt^h$=G4G|q4Q z8Ef*9A|c+1A&mI}{@iY~GBvR+?zq?83zq2vtu=6q#tW_>n_o9%2G;sc)nvYCGTY|T z#rDG;#`?tfBX7UIj7fW>%XoNdot4@2UbZ?de7SK^RHOM`pub{W;J`MRC`e;t{4xd~ zSC> zw<9XMUr7>8*XACnkz{k*yVQbg$q*{_ppJkHQRZ13KZt`({4RD19!6aJx#;~{_XgLc zo_I!*_vh3E8lY6_p2C?8G0>O2;>CV(5EWC&j3MaD`{(%}AsK-nrYdBS={B8w*n?>y z9x1Su7g$uoAi~R4gZ0<(_}$R3+FyfOIjporDKCb_L@Z-_@CvDkMYV1d4G%$I=7=)) z(qMk_1*65Lqv(;Tq~C0veYy}k(!)gBqp*!7%IP03`Njl4_S==qZ@0~=f8yULef@mE z$B%8@VY+EAfbh(v)ON~0#OrsTPT-??3WcHty;l)W4#5aNt)1|dg%okvSAu3k_XVhx zEAUVQb6wDpQeFg{ixvn+JcxQq>g=RoD8JM{w$ZdAsM-_3KEvBjB9|R~`f5s&rkCON zH^pyJb{g^w4+`d=J>K{3QRpu11DRMD+`)`}5&tS{5~xfh(11h9>YyXVq7+vG4FvDR zx2D>@&&_Z`iYS$D_X?CBVKVerh_TCIuJ)4mG=nAvKN&ZdAJhB|H2X<}M;+ha@XyNT zQ|!~M2N@_BTe9oP zEqN$>6H_9s zdbVeuUXjr@JD_qKi#73WT(qag^wp`u(PurkCj1tCRl~p6$Uj%Gsvwn1G~dhE;i z-RX&=uUmxv%J2fVY<&~Bx6&fCr@zpuMZ$MFv@x(z_}8tl#S}0}BSEthSK5gMAb|Vz zO7kA)vW3ogOE=g46CZ0A5yL#!r z`DD~`cEd!h%c8F3#7~T(<1qyoVuXDjIIw5-EA70sn!u2Bn_TBrKI45k%Kg5v4Ex@- z^~gtrhIJyfcNiFb_w1DtbU~wULQDSTVG$Z?7LBJBYkqd0k|t}?rohSN?OK#zR3+TU z6y7$#D7uV0@%R>&s&e|i^X-XIaG>eYv(C}w59RA{ktqR^$$jP7tbA&x#(zg@x&)g%rWGTqU1VxIlR?BueJ9|^>X8v$d);zPJ8Cq zh7CttGVn%l<#(FLd1#El;U9<~)4$~Q&Ik5ZOlVV22$UVSO)UyI3rGx`?Ue%dx0G?M z*8SQB-fdi%=McEstT?P+nm^)8!>kt%x8d6 zj-eED!}B=a8J{?2nnh5v_uP)SciyN%Y)?C&LGxkQmr4!+p=a4Z7eqj2;JlNA;wYsJ}|F_ML%q^NYHK z8m;yu-k)9-+6M)H(rGWFe9{%n694CPkw5Cb9|_8Wqa_%$23D|2FG@{dlb>jFO;WJ$3TTCU%!Z>_ z0_7g#e8vzwq+_1x>Yjw~60YUkZ}9l7%*T$78%s!#9{Yxtm!SRQ`El2yUfx^e1X8Q~ zp9;KEXcCTsOTBp38A19!uQLzvf*QJA?VmqL^Xn3Aj0T3+>&Vaa4qqyrW>xLL!yPO* zrJObo>{dW}I~E&g-;XNyD6D6EwGQM@si*sEnp~G~M}sBpx>yjS((obVMWKiO(xyO| z+t+o`Rk(`~FBnu^`pYR}b?oH4{pGI2t%463!6h>|YgqFNJjh+PZ6|>IMG))Z_;Zhd zP?^Wx&c289R|0mFZvd|xKUv=fKJXxPRz>DVtzw8pfNqBc-z-7Au>s+$-%Fapj7BM0?(HTBa)~q7#F5@h+ zltS*yitP`h5IW|PS`c$+cc%d&zb#b4(NDjl1KGS_gf^|H4Uj({SX}Hd#wUNMa1+0x zCFJ>pn_9#DJ$bhIKv(?5UkE-B*vL-iVjrBj6lgi2eU>8d8|cU)2ecM@S0xX!;rv_d zdeBjwZ2iZ6A*VINj7oEANUy{DhwM?hmdf|7M2pUaWt&=(6b6p!wC<)l_LnV|^b`tA z>gHk~PQQJ7RBOnBpGoT~4@~J6H~SRe6`LM>X)_5K)u}YhA$}g--D;S5=YTnk$*a6^ zfOQmB?t!x7Og8?2tP5|cB1x5?qM+Tf(pmR-mS|2-8~_j03p)C^QD^(+Jb%Pc^5<+% z5e9eeq-gVU*kz3qBcot+w(jZisB~+X%YF6UoHE|W}TCRCEFuB@aeC^o|&VQleT+Y$(+lc32ma<2pip3@!waT)qlirQVnS@C$}6a^Jf(~+c2o? zL9;e?vD z^Z#~C0XwDofelkP^xE1c*ZIWIQ3968s}bpA%x>%s-3&hEJrh&K)Z9+-Rx$3sEYHQm zwFtJD6RTf(;~i0FZl_wPB&E=Ch4-G*MeNFdrXIxfZv$IROt>E?oA@e*V&3MAoR{QO z%zb#fRve3)?pH@8N8T<|)N?GF}Pj%b*PhTD4jpYXN1v1*^| z{*^HsXX@5u!|LO|-d~zIr&%8>{lp_!y7jjB-bl_ZsuIC{X#}mjJi>(+w_d3JdDw%C zF?&FK>b&mw3IArOi+s&Etuj_|Fn0rA82vZK(Y{G@3Nbr7tGO|Fo}L_DaBt+PY{8A2 zZ${sGcdE-k_JY}Z`n42RbE;qw8uaZ!ZuO9|W^6^w?>sOP39f*|`GsR(@7$xlKo`-N zM_}AJxIhl@@>el%fIC*f$LtNB+jMi}*&!g-R&${P>vnxpRv1_f0y1!9Wdx|$l8&9X zW&NW{fPk-GD&g=04(OJ8M*YAj@+Ge)*SJ%_rZlo53WE-`Bv-w}53>B3o<5xJRM{WE zUcv8dcSc!j-OjV?;Q7ooK*%JN$-u%Dwp_ZdRD3{v_SNZY#Pm+-WpiO;&&=_&@F(>t zi>0{!s1h4*Z`zKsjhtVm`rKUJ52Ss#d`I6Ddd{h+SY~Z+r&3lH_$l_8_ejEa9q+E~ z_00roB1<(}Le{OLhT|WXG~!^VYllx*9UW(-ymd4CLdNZ1#Jv5EoD0X|N^pV7&!W_w z8dt}64sB81fGkO=fW;rVq6j6B84lW|MRoNhGCalS;Bto)BL_j)IiPEA!)pr71}LJQLD| zs?vojN7=N~scocZg5;W!rCMrV^K2?Jw8@c@Ckfk%V|-k0K07t`aG;nf5=)bZRs0 zHH4R6{c)kEzpR;dA~9R#C~$h6#LG(UN&!q`{+uhnN0_8X{f0;7C&>tnB$64u4y%7l zXCJ=**hTB#p*_reKysfpF!@EUdb(s1xtOV2A~O&TsRS6|_63Lzcv&Fd|KH?#WTgDf zw3%%rb#8w$Ykzn9AH~WG&@tXa_jZ6v0|DoKs=FV#v|JdWY_)`CnfUiFUbzg9+_og% zf3or)!o^bw4+zL-{5v$_`%D>ts~hPE8*ovpQijrI(%@6PGGuLEYTpsk>FSVCOXwrK zuQ2G-)jT2PZx5cx@xLu?nCovZ?J@e=e}Z+igYOGk4=tW2{V%WWUfQqyi_qf8tg1|& z3=bIV^hlfkZPICkA#g<^^H@jcSE^>nQMOexgnX-F#KdiFS~^P^vgEwTY8ee4rD7RT zYT#AHbN&BU2yHGO`{eq7_vZn=XoiRV|B3}D_Kg24k_2jdAaS=ZXyCoYGdz&2qrhij zHcPSr3h#eWj3iM1zj(%gLh@SwGh2JQtdu7m{gjZYpH+&%-~RltO*W7UdmDCRhtg10 z&Y+u$=>OA*72SK|9~eb>MPP1(4}rJ?&9mncH-neKH4fXS$u)or9PL$rZ3e!0aeEjV z0TDRwF|WNHb9r$XdwCXoz6|e{J5RCzIshG@Rr3T!A#CPLFP)^(rJ21n`k3?e zXwhFtBnIhY1N0dIw{PR#R?N)=1{mNctP5_l&v~650(}kC$-ozdqC7zVUghIMp{mjc z>?6ccc!e;hLlg?t9r;XYG~8Ybit$A?E@H75XgJOYJ<|<^h6gP8qF%D>mNWojDAeK> z2Hlko+|(1+fD|k5cD$}6yHz}{VGfJv>-`Mt+K0nmfezJ(>VKm|UXB2AXLi8pe@7~C zUOj$e5NS$ddf)u@p=KAzx{JhCM!-#lz_=>My5*3>SOp>iA|`e_RL9s_$Q7z4vEcxuFS0%x2 z(^J`BL6yE&a9mA~_haJUuL0y@s_gaz55oK%N2)TN3 zO}If|na+x_wwp0`M&lDv@Y zkQgzI-lnRSVKms(x1)OUPR3p#C{5r#rL=VtM{eq)_(4##>P1{Sp~y8;jNzy@ z6aob=T0o(emeChFgIqD^z+&2N#8S`l{g16-&F4@iGZt+Y>q-e{rt-m6YC?)c4amGX zwV|F0_vS}Q!+BHs5k~s=#QJ3o7kFU=Llv(ivDOVPCJ;V15PPwF)N|Z~-|kv=rW1c0 zf2S-DYH6nJgd(o~gJ{$yPXe^)Y5X|!(Q?9FU|83+wQq80ljXcx&6LJXsgFhiqM#th zCrVv4aEu(8CX`A@00Qx-CCih}sa&5|#FdWW&j%}1xx;YY4|d8Tz6nKav9Lh3nW1|; zdN&Ai9?7?|BFP})fw}oYXSx|K;Y-lGR?mBO6rf_RjW&7d27bv)lt&#tGY2GYc~t~Ve4`gMuBIIp?BxQtfXS&zNG zEW0J+L2#1_KAq zTs6$u$Vq^0kc(K3SEnc!k?R*i1OY>SK5(2Xf+$ zuS%il`AJU@#r>s#H~%Fe*sTU(!zM+nTE1SY_6jjcPY+_;jcn9zxxR7!eq*jsay9-t zPJuCz(z(1fvc8WHL@2ZG7nqF)e3oKs7xyoH^>uPPEJ^FZ3p`#{8mw$~scsbnM7tF$ z)?2X}NErz5#zYDgYk#jhyiYc7wmP=|GyW5LxIabL8fp9;Khy<_ULKDJ$?U_r&&M!p zsNX|xI_>3cwes$2KYG!c73j?RXPyzk+?GTRbQ@JP0w0cU%$A3`@lRqoFIxT%K72WN zh2OqBu6VE?8?pD(EmxR9GD2G&ME-0BJ=EK0OjBsSLZG0`VDzl{%cWjM!Z+HSv!!Q1*)$aM7L z@gD*ZA2-zgXsGw(%ZTSHams>duUPMF>X!M+U;x9!u;(<8oR}UYWiK#PZl8^!WJd zNQ)Z}?t2RADsa)egLC*K@@<66ju_jXM+gfp5SR&2o0wh}2BCkE$&SMc%-v}no~X@g zCi8e1zTqtK%HfR|S^EUyRU#HJnDPLP(=!Ir^zf2%@D?XgO?hdoviCE|nAPQg*OGUr zcNA(wyqm=R3R=uxDZ^E0|5ywo zr1vGDv}8K@Zb?n)<_;P8ZMkXrl;0)9xDL~U8P=K9p#H7tmKDi}$BhDxOCbk{$)gY@ zguoAwnnrp>y!XB-w>g)ZTH*WEO$&z)O7+|C$G2UQ``35}Lv5SrzxvT{O%=ai>?^41 zmh{p}9TW0`hjw!{H%&>W3nj~tj}hd1QJYa_rg-v=r65E4-0#}VNb2ytM~dpKiaYEo z%g9LI2f*01W{=#(w{q^6^Cim~{@n2!ae3D3lAv>@yz?Kv#?XtF4({g!mmdzNx`tvt z?f>{GuS(qiFiMpd8(_ig*D*4cePF)d;J(*k-7#erd&x!thnt^Ii~qsY=ajC=5W zHfXJpbLvJ;<`6qu-OAm9;VGExuX}f0P~K)ic%Wfc}kc6{{~?ZB@Nk z*YDI6XzTsk-Q^2dEJso8 zd)!?y>%I17r|VVgL%8%}{XFiBrEzEp1N-0IAHreW8S4-*sP6y{LXgM;94jUS(hLE2 z{au}dubwUiirf3-sT8*dM!hgufbhR~IdDL?0PJE^7?=?LV~t&oirI$^{ST`Xo&6tH z?>+@1584AQ`RE1#O`-17P63Ee)bd;yzHiZg!ZW#^o}8BgDe;u(DB+V}(gN3me1#n=SN4te~1>VQWiYM?Eoy9oV%A!U@5ne1mq^$;Rr+l#N=`WCyplo zKjl#_0~Cb0{>62xH0WPcz#p88hxp%(wZY?m+bHpezoO3Z>w{6}EpjvesjfTMt+&SH z`pPN{B*%i>45vC04RXo`@g3 z+<;xfC=mMptLAlgjv#P&?9ttbp%J!^SMdc&`cC|4a)MDp5arC?{At8uBR!wDHi(?S z+B%U|rmUC1QY420MX>sgr)gjn^smhCt&&p4gUFa=H(WrJDfOg>l@eB8O5IT)(*Am` z5laG75S4f(h)bK+xcS>JLy#5_gpvnTuSUB_|4g3%Bm#uhucx#6SyKs(f6yrsFG`44 zh-m107o==MCh4uue80QFvzGNhL0>oFamN#q{H?tlER~Oo&>iFGJXcPWukmcPhe0@DIHgGRS zl^c#9yxLJXrrG+bbiAQ&&YTQZ0#D?f)TN{N5?P>7Q!Q(my^I|Y4Y@`eu_%ukF)!sL zJpoT#+cPXVhiMYIWE1n#o`gT8e7{pdQzq9tUJqMx+O(|!HF|(4d zSrwb9s}hgleAp*HANNAWcgKmJ0SHV5yBs znq38|dmM+l>AtXAr&75Ze{_8v9o~DstG$f**;4H2{CEn>+V;kP^qsp&Q3 zP5c~)(RM$>iPygJ6P^AXHLK!2^=SQCKN%m4z-v46YHgcQ{&uh8EW{Y{k;th~>>q9{ zDOt@o*W48CWHvU76vFpzAIJr0`Ti99ic&3=u_gol$Lqh)eXhwe=a zR?z8R4S-d|)Bhf?Pof4J&j+jpK7Tex{YN!37%-~b_vYwmL*0@^-SQG)xB|Fc|1U(^ zO9}h|6htJc%dC{3*d$B@4D-}aQ^;uvC7WKh-P9Yt!LW`k`J+d*eY*H{@;^^@&LI6~ zJhG5JpM=FBUNZudzWP=2`Awf}YujNQRn>m1>|kL#N=9DF$COWEE3jm-n+&9s#2zm0 z%zBbGA~{fXCmy7?dR0`Qw%}tke@&jhoy8+jf!Eso zFK_+QJU*cz>pDcTvbr+68nYMByS(|o+(Mz+^s(pt{}qJ(y@@$Ly$Ggh`e?uR;#Hob z_15WNN7zAy$4%MU2#{Hzaxtr0{^BzW=W!AIDM>tPIIKw^bv^&IM$hu8i!G5OZSrH@ zYLXyLI{L?VE6H`3_y4>SW}Ik;3HiPf7ME_m?JKS`nkSuM{sQ9ju|amGzSCz#YzktQ z1*u=St+Oal(`42$C16+)H+Otp(WCk%;k7&cJJ!1_4m@Bs6lFb7H~A|6GepFdM_spW z$AyIt>0CyZJ-dYbt#@8}Wv499`N8W|O^{>LO z2ubpJ2?>(O|7DF8^wgDZx9ILuY61`wsD^T9JL&N-INtB?i8>PlxS5LHbnHum*bCNb zBcWAIj*raR;73wAH6P8i-9`~3S?LIQVGZ*Gb>*8XmrI5^KECO9(i7vld@m&l82+^} zw|eb+_9!+dN6tvyZZ_r&+TTOdCk>e@t37|Chs8wl8dvg{cx> zpQdvRJKXZ+kQJ@u-cL~EJtq#z_=CNVMQd=7qk zEjej^CTXkpCUbMUi5s04=}9b4bLo@3D90EjbHT*gP#}@lmIP{yF%!zy{p$zlhd ziIi+#X~E<<)oBTel1)@8ps#Nmg!=z-u*|2lS+J}#{hd%_PUcZF*9NyOz_c|lb{-43 z#%?EW?p@C8DuzZBv_S$&$YJ*yB9y8o6upJpH%r2{Hy8AP`nJaSsMEtJ;7Ct>@`sFP zsAQXZ2H1%yqeEZ@yXN?&NNh)b+mE9I>@C@#2jTzv#Y0Wp;}Ii-b$XX zNLOi_V>mw{q2A9s_V@I@h8%1zZhI24AU^XD7j9!<*A`uJ+Ho9)w9#bC+b{p7GBM

    +UkkPV40_F!SBQwp&*Z+z`Cv|7AMf55mtw?Xi`{ zIU)njpH9mZ5c8zs_&DaEK{Lru_<^k}vEa3U-b79&@^hYa@bZtj4ekN5fv}44o_Rr2 z;Yeq(=~-WVv-hC!UiHLZnWBL?Y5K`4#tXU+9{jl<9-6#^Q{GXpIWw$2`N2V?sP)%v zL%f#KmaXBsXYhX&*?`1Z)yGh zJv4Y3WO3P6X6xeEl=q!z^6r@5i1pCeV?Vf}E%>%TRIhO=8T zJ+OWo`Kj$)IpP=YJIp)b9fOpE%P&WNU;gN+2;bN`C0dACC+s!*R6ctCa{gh+ zn1LgVCt&>xhF)L7;=?fy0jz2d>yE;rE0PdqfBLZKbKRYJF$6$^8aO{Kfc*8UL02FM zF>&_r0nDSnfE}5k<~}U=yh98@dfq=hw^HOeeU0=$fdCToyblJfW|-grMNYjd8R-e> z?mpN<0^o5smJy=vhbdk5?wt?tk^fWorXeRa*|Zsshw>h+dyq+a){rE|s5aJ3pCF!> zH5B*&V^X@ZYm;1$~iWZyGfx3c=J>5M!^o~b^?yEaUOS0vez5&MCM1{yB7X-(#!O6 zt<&c6zmIhXtnWEq;O30yeBQribwf-M5<+aqM=}XbH+ab(O;M9e7^m`lxqY99_R)yE znQ)!f%lO+3vc4PjFIFnw%Nit6JT3jG4lN!1sNA4r9<)uHDc6nooR0`?F^l9_9iTxc zM#QC`UbG=hC1~#*%>LLf@RrRIx8K>YJgW*{)e|Mv|8WBYIe__~!tgSfy}>4h6K{&5~| zx?L}KVB0Hp`t9ZVz&;WN`oAgxC~pe>Q{t?NWk-4-?f=!0ikRa8y0;J^aX@%_N*oP@ zk3z2mZY`mQ2;$Vf8rS%s+0urzf7TEfSzfPer+e!dXBG$5hGy%SBLeCl1AgQEHx=zB z-g<)5ECp59R}dcS*iBY3mhnU)kfmN51FI;Dr5;M%k~_rvWUqV8lOs~2bqF2kco}try}FtJ z=3=wkfj`Bpc&f=!>LBWYTf7!OZ>d#mCwvvS8(&Wf`kF$SaQ8-*qB4$nDgJQ_DWywW zCIO}XFt}mWCQXtM($r6PYPV|A9e61Vu#; z1!AXEO&|+&ianiKpWBK3@Ml?QYw*9Zq|j*mEPT#;F85$xM%pB9#?&UEJ`>6lPx?gU zhWv*H!&6>c4TdCMHXBkMmi+s}oN6~^KDzps)js~ZzNgnYLN!8G@x@-0Hk3t8`(tyT2UOaXHg)b&2a4?4HBFw_WRt zHQir#*hD~n$36WDNZ0W7cp{;;d*rc%KhkU%br@bG@x;|qDrTgRyD73!qv zUcUC{Ef6n+JBSR#%SKdl(;)?(V$=q+8rCCpK1h*Ah68rXmcxkqC-by9ym~}7 z1nFvsBnnY-y*ouz3G_*H^bFGzsuMfiDiq)ElGjTT-eqgxLA?hcM`dL^)7kzpz7X*H z2VXcHo8w;bZik$gNijf!-4YU5Y|E(`4XaH3El92;nOKrM$jw1XF65-vK|jnTEA|T* zCFt)^a>q&C|2aM_*&&_D!zaa)nb62W0yQ-?RipY-X0l#d@v-plo#6^W&z)JnP37P4 znUd=>4}@2o*WXcfXt27vI*8<4+Fsk=H{-T;9*i{!J(e_~^G23Sz#hVfQo!s9PnlszpgohU>20KR$`U`)~b@ zDen$1?e2>;1lEsM=9(;7tjGZg2IRibLb9+%e!eI~pQY0@&8*Fg?Jf@m$6X3`@==Do zz_b|6J4_e+f;}lKw8`8g%yDk{~MFv0W{E|k= zx|&!#vZwa&Nx~Vbo7cKHw2cm_ z-YjH-o(R3`ODPgbzJZzRhSrkHwWi&K`#&sykz6;to->AXaO0>`D>dYa(i=IMpEMmXjG*q4Ii7w@9wlYDSz0-4)qhpQqfhTF|A z+p}uqn|$v1)ovej`h50-hpnMUz3le1tvr*#qe$7uG58~ah`-r}#THHn*JueY!8jTQ zy1Z(qXok>@(79sVvD}cT`quiF$M+hQ@d^&DgLOEH`pE+;=}x=DjDy^1_D`!c0bn6P z8@!ZBe!ueh6n3Bob3e`1EtEZ@+(oaFJJb5tRpIwb-FNuD-m&ugv45;rvg;Sd9lh7N zUoG@mpLX6P4&bg_1dp$jxp(isy4*VaA^VM{JRu4vyE$d?S6^uB;svMQ@x&vlWBiw; zzR^KRJzCz?Z|@PKhcrGn;m z)BgoR-vHiT3QrKn$z2`@NS-KQv~I@B6;S(~Mq?_;Z$+Uo<`9X0U?3i_X7{@rhQ=BQ z#$I5-2%yX71e8)P@$s|7KO6R5ghBUvha$XvmAB0l48jMy)wq!&WoK0G4#fn^IuYuA zLEcd~*Pz9naNWOvn?;s!W1XS;?m|zDjsk>zDnGea|`lK0}jbuuedI=P>&P zX75AFy$KXiX{VR@52f>0V~$E|aIJj!la74yMZYSC^Rzl5KKb@tOhlwJfB%5Bt5C4W zWYnwV`ib|S_P+PnFTMD5Xs5p1=K#60K#}o)a_GtLx2_#cw+CJ&JN!u?_)}x*bf#rD zY?whG#H5qRm*r_4GxH;YQL6x)nu_2HYi!YK>~^dqXt8<|^2TMA)#05529T1_f*jJs1TN#h;8-EXR6#ifxyx{l_P-1vXpJZyL!}t0f`8v{hff)o2Y?;zsI;g>Hq(J!a=;0$lmO! zDQ<4Crckf&Gv*J4>gA7P82S?w0C!#;lK2)cFMHTLG1UMD)&MR9aC+1*fY>AK0r37R zZzvkCUP+F|_yCo~?2l7u!Rql`ATnmH&$$qWHN(hmrjnZLYueUPYf?EBu=D;Xu%xAU zp#e=&{2=FIrN%sU-pKcCy{tCCJ3(36NGF+1jL+&z6VP6iKp}BUua<()= z;1pY)7aewCJQ#15+|TV9U}ATTrP0xx$qjAUq^vixgz8(};oD`JPThJ=y;YxDbb?5! z{xCc;{Cqb^m_%F&tY@lCw(HydWU_Q>)^Ux@-d$eCy|08uILv3*DYW!?|69(%>q5{3 zCX<&hja-b0gjCGb6~tFV1gw500knvv8ZmkFap`62JNKsFzi(tOH)F~!J=a@Rrzemy zr_{8IrckG&Vuv#9+Sed>tOYc~4a54{Cqr9O-h70eXPDfQA!&?Kj?u`1L0f$({@RH5 za)6{VNYAJynBl^>)Re}DFB&;;Re2`=X58TmJ!)~AE&L4=nGHV+;U zGl>X&MY@#6r0mr@aAg@^MQo4($Et8FU($eO2 z$K?x%*E@}es=absX-s*eYF8KY+;oN0B4+IDBx;f)WGs3){|GIpC4miy&ROYt2=|{# zpzTBch-f74q7SKppB=bd+dr6|5Im~?H+DC2VMnm@T&#bB&aS)1~Z=vUg`@YtI@K-D7F z_;}`0+GB1Z>J*T%QmiMe1W}zfpyhc!no_a28xU&|2=YHAgM8>deB0#;GVW4}M~ z5VCm|Ma<_SoL-|v;F_s!mMWz~3BXSv3UxDj(D@!d4Cy4-v8aPZXSqP(#FY#74H_w$%s2gZx6aU zRiTX<%6|Mi?C<5n=!^D0VFMa{XC@QJ1SC)rtA7ALUSe(dsel(_oR{(1(}&bdpgp>A z+IXU;7kg2TNuKO!@xt+6LE7)1l1l!gn}O0WwWJL=J|Bw2Ua$96;9`&K06uUiC1R%! zAE$h>e~>2-TdooFZ{5Jdy6^ds@*Cx$u%z7j&vwGKR$y0?#k()v*?HzO&RaTuPe?SS zNnTrxztzm&`rw|T^C^rsUz{6w0SO1=&Lnd-Y-i%Bfz(4&B$VsOFPaaZE%rJQ3L&1KY z(whhT()wPZnG-WiwgN{-!^K|$HaGj=&plo(?MnwNOo+*1_<%ipp-FHHMzve~TkV=~ z*VenpJ2EMH^bz4dH{KNOy%UxWQ64Kn*c;>_I6^cw6{-irHvc*)?Dy`{|szJ|1;0vndnO3A zWt^=vr0Yy_4;_(UytUVDAQu2b{J)EXvozdBrf5b(vj=FI+ExTNJw_K6+y~ z{6p$u#$N77fwM7mk1jBJ{93bBWEf<8{o0(u4qq@;Lp^hy&1 zJatI}5G=9B>*1HU2AX-v&)9x6Mhs!__Y!;9;E8}xMZl^<*Vd+cWFnsa5K_35!CW}Y zZSqo|3u-03WrH-Ib6wmC_7)T+nn5XMR72>@uhX8qI&%A!>h}Vu=4>>V6YlkF zuTHBbBJEaljeKL_i0_l8&1l^>8-wf(GmO^3XW?b*t?CNFWS<|E(8oGDEcXbv^s}k_ zJl6Og(ygtg;0+KcYtXFhbOF2@Ol>!KL!|JZdNqlDsI+tyhnv^@Gg~ zx2;eF)9K?a+lJC|Iri>|ri4#-ZAlgs3grTJs{sYucv4B;PR9RJMCBzmOJZ2DcNu<4 zSOtu6sCbYF3RUgr*M>E78DZ9hrWy^CwcI0GhQsw*;D8nZLlU(?m95b8885@Vbym;!gYpK*0Naj@4a=Yy=(-UkBQRh!MP ze{#p1JYRr#zb+v`cZ2g*_NOMmWnC?1<$1QfUuh=p!DVbq`!@kxM^If@ipE`o|Aw9o zMXnuP?|YmeU{f%(A0tHi=AHla^m_j}cJLgf30S(W`MmlYYw@hx=L zTxh8D=FB!(O(ihP6s6(p-$HkM9+H@hF6qRDI{9yZQJ*zdpa=2pp_2~Z#=wDGse`mpwZ9)&u%3$)Rl zHy2IRXh}4P@>b8YVV+dWnK0@ou+OVEpiuh6=uK@{8?H5}Rrag+k)pnFTK+-VFzrQ1 zcu?Lm59-q9#gxq;!wk;MZFpZ^z@hRs9Nsa>n=Ltb8#9h zc8buPtHen{=`oJ_lL4xZ!1kWQp9S8@nkk<68e94}P%H=C+MXkyz}}9_^TW0Mns|Uq zkoq^|+YDFK?yMcxGx&A|uI>G2d3EWT*dtLMe1$r%Uv9X;I(`Gdfjj*_Nr?%HoVSd_ zTGbjk+$g;dYYy>>Y|2Yr&K0fBdh5EHr6rAJ365i6-ha)F1i+ZYYLrK3LvwR$hc~Vi z_uAKwC4LD7jKT7j&$q0HUab6+(ga3(Vm0TL6b)uV zzpc)7-`jZhXbZ?HAg*pogfl6RIsvQ}#D#u;s5!-5-ZUHiUAcRxL*~q47ibF!l>kkb zP)W7zLQIh)4R~+3U-;#Io)+zhrpo2_?X{|5LP82cLaB5u9_{ph*x_G@RFjX`R$T4X z<+`K&MdapCFTMi4EYMwX9~XN8EUlSB-C3q5rzfXGrhkF>BUF+Eght-Ti|n^Xs#e6r z32tudXl*W8X|v>#XsGcis*Mt}XhETB6kvqOP$Kt-^CuVO)FY{T**1f7Z{IpO96fl@ zflPbop~Y+lRW}Emo>rt&b45KHr<*?+F;3EL$$oo%l8um(=E(utx*j1wV+o;9C^Z&B z6)v4Hsy~-Q14qHtD%hL-(!!R0-3qYkS-ntIBMX#=*3-&+-bYQyLr!$_jU;zC6>sDo zqsTXR5F-^E-zXm#Y6+wWwTu@5MNFKOhuK`~o*u8S9T%2gdjI$xb-WdMJ`_7q(NFk~ z=uAN6{KH@#ydc2oFX6lT>x-vJorb=W;6$J7ok1?^bYe40y-MxpY}#(=0JK7(Y6wh; z^6+zbY(-J|np@lOcK!y^f-yz*7vzH3_#&|YI8|f3P;d`Mf zBP^nE(eZ5DaeR+N7qCTs9c`%mOFrCz#VIMsv;tXk*M0LnZ zy$lPemflrPF!6oW7}bkI)vXtDu>$}eTw$+_{?xc4Q=tirnd+ z_av`vz-_k|p`JNX$a72Mzb;6dHoMomt@j*cb)=f7%_o*x1Y6KWHB z;Mk@YZ-GCRh(pp-43hF9P;oIHytP}Eq`ahUZpnni0m2-Y`?vg%A$m>QM+>2bM2Klj zfKggExktd$KK^AVft1a3`A6NwyrQq;SzTu}3!U8a3JaJV?MlCEdbH>;=jX5eVJmTt zuKrWcL%5HOWP_sA;`vJ`SRV&5%MDa<#d?Z`SJx*MNQgLTds z%^!+A^V+p8mH$$4wDpVlId`e6cRJydiL|xu#gJBSkr%Sz<2Qe78q3VB*O>p(dKF%< zJm`1ib;LFxLW$t}Q}>CxLa&d=p6c--AGN)m71`N7GaKkX{yj9r^5FbV%k{IGfp8a_ z)~~XYGG{k;Tb;k;l$j`vt@j0fISEPsi7D+zFE@908c!%FeGq@$@XrX%SO5vS6k!r2 zp%eiw@0ytq2%quV`bq}wIr9osnwo&2S3xjfpn{=sfSDEuK$D=2Y7mh#y7B;j2KHV- zdK6#+HW4O}hQ0_G+5lX5<~bL+s^pP3_)J0^jR};&4?+aILW$b-+0VSloX(f`hMWiX z4@#aTJFi=v$DBH}r*AOnI?+8oT9+`)Eh>PHG?qhhEK=2iZ^4#z%1M9OPa?l(lcPf2WjxCvfbq4xB&SZtMA}n^s(0Fv9in-I4$f3UDQ5 zVPpmZ3HV=~?D(zhxA8LIp>>y|R{2UYF#8L+JAqr@@RG&L%>?Xs_lE+v&!2+sS!nhL z>h7JzdJigQ7z=H^XG+uyu0ca{D4z z@M`k*5<0#sq&(4KC5u^;aQ~(1_&Ph>{WCZfIW}pb`lQ;&TQ#@QxGex{gg*qHJ?VW4 zkP-m=%FI~C%%~!F-uPVDBlhzev_?2E?k$S|Rrf_1msG(y$@vcUz&H)_Bi`qrrlHRQ(5mBTH^rIsHl;XSI*ljWTE3?;wvq}nVd=U|0 z)bHM}mQa>sd(@PjO8UqLL9<67ln~m8W6a^c|Dg|J102?0AHtTlupZY|a;fcQ7auC0LA({QVXm|C=mQm$*;S0Y3 z11dv68RwqL(}O77CU;u{>Ly#IX=fHzc?E^YDCU?t1shg2rQ`>6Y^+aGjzT`vF;bIh zUQGvnG){G(u^Pm}jeAe~UJu}WF=gDu1{6v8lQzYeQ`C0191Ar^YL5#`{6%rbA91Ij)LLTSR1|_Ld&<)-HzCC^A%bBt%8L z7a!gK=_%tF@%#7K1l+`S0#UdIhS&vF+WIPydFU7F8={J z_B9vL4wWyEn2Z88*eZe5pL_QdVjXkxA9wy^^d|Jr$<4^-)uCH$sAso>s?f`ky{dZ# zHesCHVA;@3a0;GAPYSMroNQ!LxR5NCE+zW|Le`PUvN%qQjf=(y=Y+%wWuL#-pOQaM zvKb_&Wu>438+iS@ph!d%Oa8Pm=g-aE0{Ufl>ygin8O{;@KJCg>*G<&dMubo|&)i-G z1~qr#V8~rj#{9RuUrus!|ps$AL#K7)h=!qA+(iH9BFD zZBc1@b#-@l7#gakpo5LgQBhh}QC7C|q4N*s2y?Sz80a&;znuu1T9dpT;UG}8*^68J4^SHZ;lGlX2l2n3sXCISOgf+0pA=r0oGJl}6I~eroix(Z+i%68uPG-#? zDb(&UGlYd1kc@v-V(*d7K`4ePAU+0L&0TzVmnkZR6e`#RSimfXgX*@Pdh^d&9xNWdQFkAYEc#nsq?UtDXo;q~30U}{_;=OTeVqQbaBK#I)wLv>sHxp3Og z0*u$tjp*+o0U@D|2sARdHh2H{N|9QJ3uro++}5iT7Ts__`IsUYM?~Bux(9OaY9}!3 z3K}h5eebPAF1pU zwT!Zi?OOfalIEYk6{2ZT@bmStiaJcu^2v5zOa)M7RK{P`sE$TC)Q^i>Jn)hCTTR(# z>!8Xh39(XLIM@0pqt?Dmlhs4P%))6>AlK7RlzECbcTAc}dv*K6Z+4SCGlRp&e@U2& z<0Rc$AKo#j#rRBD0~)9~h>Ih-gX6=bT0fp$<0dS^hL}`&y`J+^%d7=$^?-%Wxz!YT z41gKYYrG#K_|&6JPZ`xu(;r_sA+&3}zrDpSv7XYqfW^cfIj*xo#U-g@7zh zR^FdK$q`|4YvFuOa7Eg6&dBMAN!C=qIZ1^UT{b+8qr?4*9~`@WTf8Q^8QlXA>N7rk z7re6!UX^Y=T^Z%sIAOIwpgx&1Am^9O5iM(x*MRvrAk}a<7_(0U#^&yqGAW+0233?1 zAlgh-&6lKT8v=Vfn2rWOh`A+AK)C{iJQv~ctU17Zwuy-W*^?r_jOpA@OQp-u8mTsD zSq6`fy>YM%S`>C0AJjbhX6h+1X$($LJxg)*+)nXNU)ftTST&eiK%TFf!@N(kzZ!|@=zta)m6s)E zp$-DMMQ#9)JYC*aji(Z>@mq~{`ZfuZ9Ey_UqsRjWn^ViLqE5%nJTg!)+=O6-%jF5Z{aGmml;TmUBuoDOPD!utuQA65b{B zL@%D9Zb$F7~_OeVsT2{5U3+dE_OQ#CW(H}z%8ZsxM> zoS7d(*hgyIYqs(DM%Z_{n%Ta6yxLHsg zOWt@+eb`J%=6FXA0bv97GPxmV6=+O9hUX@GyRp0^xKqYwvhy|&jk-DkVUaWQgj9EK zuhC4@E-&mLHbRH3Rk2CHfL*ODVrc8=x{GNCb~lAYj7?PqA+I}McmceHm;eL;h4$jM z7TPAk?){?0TAMvGDU9QYAednw2i-@sBf10s4CQC~TsU(7t_z)EWDRLrx&_uKKp@Ec zt@}B;eR;t0A!?AkBuqPu0N0}A*~@-Q|Dm-ssEb)b-oB}2`Z-|Oy1Hs$K&|aAcfWd< z7|-wb$L_4#16+}5B62KHboUd~Ta2g0ofPR+M}FW!W>D@_Ll_7bM8sWW_xr7+h*RjN zC%8$-DFlIoJrxUxoRH}pb9J(J(|LM_>b#jdIez2gX*`l|1#n6bd3d*!OV`r*(s}nQ zu9Wv8Kn{oi5jYitdWKC!2{!yr@K{O!`}tZ-40%Xg z!N)QpfNCHRZa5~#{BjD02o1>#2_or&MmuIb_{qwvpdiOgPA+FzK#m1jxIA>V60Km4 zA#Ji_S>z*p*_F3KH2b>%%X^krOxUsy)O*EX=N*$=FVgkcTR1tq$Rx0^Z9rhP%Qfd& zol=62tEk8}I#J2T!_K{pZDO^3+%SF&T(dmsF_N*>i0l2peRbO`TgzBHy^U21pG&2x zmXA+xQ%^9^L2iCzjA6pfM?j)Q%UZ?4W7wUq!Yh4KVBm~pfc{coGt5xV88l#T;@L;% zn$*x7=wr`i|2-R&>0{)v2wLF7i->x^+~vOcj+n7A2-zaoxncg(I0K*4x$RR5Zsg7r zUZ}fp;H0u$qI~LGFe#&Z)_2X~C_Kn8Rbyb!3}m@o3hpJ43C-5{MJ)f!I(z(+nib@| zVG=7%gsw@AVWzixagAH1Gc_$f4>51!lQ#-OSd!uq!E59%q~u+&`9Q44{$P-Op}@rb z%ijjd3Y=w>{;{Za73C-b0EHeH`X0++xmSs)oJS}J4(yc#6ChgByIRarRYQ|s~ zdANX4NMFhws~|&;lLxG=5uX(y!#-eBzWQkUy!%mEVT@4F{{3<5g-gAoovWEu+^0_m zuWd{C9tYpZ_)9#lJS?3l%JSW7ZI1N1{yg7)^zPfr(6QEs?;e>`zI8HJXm4Pa1mB=4 z_Yv-wFN?F0TL7lRg?+wyaRJSlH^5ib_{fR@uYMX0+NLXjX&$Cy%!zcwk_2TB@Y!yF ztNuItmIaG~Oy7ij7mxHD~j~vkHALkLM-k%?ckPPLuZJD_RBB^Niz#pVZcPfA~H&EfVgU;04nr z5NtFW$j7&Kv;5dM1q}*-`P!s^&XC@U=DW9S1a5z-WL*|*$E|fFrjeItTllD9E;xke zDVSuj(d*Kc?r2E%k(7F~^W=tgb!BCIv%mN&v(v>=vlwB;VUeZzBU01gp$|hlo%OXY z!=0yH2__GFjy8U4K5@d zQ{Y@l|CC(tE>}ytDmYx%FqWvm#sGHh1KY8GXl(o7z!<}{kX?Fw4kvd1S-ff?VJQo0zBW9}EO&;NwpWF@*_LMCqk z66x5bsC_y{UH~fq%RztbD>G))0j!>C-DMwP>5U6pq%k-I3{Qns&@6`n`b!1)%EH3D z8QKTwf9trSLPu_lFwmR*PEU-WCzMr9YJ@$~jrA_N9_mVzluJ_#kXv zK_lbzShYWWxtNAaTZ*v8IBK>iYF>qvK#t3p$uDA~#D)Yc&`PN$ZxJhIE1{y*`}gMkDZ4J2w#GZg1Kd_>l-#ZE{;zHc%Yc8 ztLC+=<9-x;ZH>RnHF%y0^%Iv|fE*&nSr3WP{}oqu&bJ{YYw1U|%co*} z;>U}zINDwDH!Qyxq)NfbvdmavtWw?G$S$<`pT)_~-D}@N{PtJ#@~+D-DgaoL7zR!E z+lG~{+8ww&i>weUNFKx#a*MRIw9MR?3hkCyGpNQC<>#DYOi^`Y#dG?=uD`xEeXlpE ziZ9Da+VXi>SqfbVfIorLc^euWy1Em3b9d8mca1qchuu7u2}B0Dx}Fh`gXm{g=G$t2 zt;rZ2_j9C*d;@|0vQL80eb~-gzNF)`yVafNlUG*@ZPl*dYyA3PF$&ZV2PeHT<^1!aVB>0T_tqQkW7m*xk7q zF^||cfxI8Mr*Pd9hjT2MRS?0Fo zuyKKVA!@#zgO6 zSpnB2TShOSPzzn&Yq{r#sG2pIOK2(8jxz=V3WI=%;tGaekZ>>+K;ToY!p ze!32(Er~|W)$xQO4($1oaB)%iAUfsLiBa6ZIGV7DoD+3#lK*Su53uX#q#4rHta8x% z$n7a%!#7#csR)(PpG{4?mXIg&Wm)?4RoF_j8YWK{es@`hn9G&mdTxVw=dE--`MwF! z^JN(`F>k*@vnTaGvo9wqdqI{zQ|{R#!jz&iz?v~b&GsPW38SBa70Ip63psuL7TYQl zyTY$@{=+Pyw_WyN3hS_`p5d)4gzYCa4)PLO6$$Qd;|01;MIY!CJGdk?xVO2F83;<~ z5~c_$fM{%@p5BweYdm1~FPeOGhaYNoyi@dvX}`OFOgLzb44SlvoU#fpf5TpMT9Et> zEMu9EilR?{qbt*$WI*P4bf@@w6Ml(`&vKv>?5|^PkU({qO*dKdUXUs6^@%YW2`%2XVdxW zexJLV{h;TK>>e=MNaOnLce`dxau8u8c3~L8M%LXTPDFFqVn)O zWO2nK0X^VKAfErU9rm1l;4%z~S-)Ot)CRx4dJKPP)_b{SIuH_?Irl~emA8wy2+1Q! z;ABr8xS#qK_M@c@>fUm_fOp3C@vigj%ohOK0Ad;}!3LvQGxeNbb7&OJJ8!Y;KzRay zV<^5RoWCXF-COb<9PE*pj1h2J(cg;zjPOPj4&QfCrWcO50-436W z5AulyY(l-4M<@3Ydb^GU_efC8+|p-&1h^dz%w*0&YFsZmqa~zfme3O_b3PVGMMZuDD;7- zUr3k7Pe6Pn*Z!!4d?(voIKB*7yfQ39BV6@BU1GQe2?jjyubbw8aT%u6W@iyEoebOYK`dze>LDgnWwpU2PD%TkYv?TX z%v%G=$5Fgr^*BRK_c+^ppLs_>lEb?*d`%;&0iOy4CLP~W(L(Iy$7$ZZN~E^cJn#`B z&wllhvyjhYdpCeQXJs8~=Ij4)wUt#q%g0mWhk#%#o|;CF8AUmj%CoqSt0Gj>l#=W$ zgJT}^UK-D4$rp%QWGR)JWgqZztOTap_Y%m)fzyS$@NAUk=n0Zz|KG=*lULim+fY122!*>aaClO?044$U@Dd^T5T% zMR>M5=0>3)85ftqzzDso;YBlCzMge|1;7gvyW_7;{6L`~K%Q4x3ZkuWVI3)9O zwra~=(=yuAvYnv7i5vuh$nUHfqibPTvl0@g&QCI)nx5~-jDm2nadD{wpQan3*Ids% zy5g1F>5>lRyNeRnWa*q(puhE;$z7eAhq0W0VeZ z%ve}hkN*7m16!Lzf0Mdujdkpe8wyZa<}?*?Me|YcV@~E)e}sial$X1l-*o6IVcRkj zV6#ev28MvxP2zwFL* z0hl;uEQ3>w#WhjZ?kVyCuFcu9tOD@i2PaXl^9F_C`7+*I9 zd?g}k&3}L?R5uQ9z4+x9)?&%$#O+L34iBQ%O}Ol>JzD3-@mD^y+2&!e&&}x?d3N0c zciT?6d2t1O`l$T14p8Dc*uU{SdR_=7Anl$-OKI=$a{=nwS^0b$&z+;UfXkWm-Ws$8lUx(ChP4(d; zzX+F(FF_G>>gu8kZCYoika%@*Gu6X<*tX*P*f?>-j6b>~MFj++^pyG_ba{W69|X?E zrJd{TPK<`aASOEnB>p-o%j+Cn4+{X64Ej~j) zHxE#8VUCrfA*}{8D2}tJ!LSIAE6 z__u%2i|sDAn6*$QmBY#PKAa2 z;{#n0Foqy~X7X+}U1ob$&5aC;%<^i;J&T`VP%n^l;7&9^IfE1ulL8#DB1m7q0#Y;L z-YCp&EX2L+ZErTb?5)-Yrydcej@#CVA49Y#8hIQ=Yd}Cfd6|9_rbA*)2GqvpFbFn2RdZj5HZ}kqY2w{h0Afri^0O(09yEhv<(`kAYgq1`I z*7f$E#|r&;*UUyWnx3#inxhsoCsdHgT%o&2!c)mNTKv@TjPpcZl;E&M??K$@Vy_6B zTcsvQOmhV>mrL(ki&O4f?C)MI8qlb)qV2!jXWTA8t8iVqK^&nfLdU|(BSSOe?(xku zG1EVCHR5!6DBho|h-5x$dzmAn{!yDJUuLctIVi3_#qYu|oRE+zl?sGK5OaHd)rB6z zXw{sfx6n1Mp*|mKVHdzC0_JhDH6|BxC!)cjw_GaV2wGrd0WJ{+oyxu2;SIIuLTc_o z^X|+s3y8&?y#2M$egGt+j-oc*f~TK!bFC4=Xip{WBefDx4FriC55?rmRAP2Qd@Wna z7@oZ_T-Xc4Rme;YUJG#znnU?_-YlRRa5?ZmxC&C;p$}>$Zyx9BeGYV7gnFPXa)5T2wh#o00bcwtu-ndVNz@1P5M-1ENM@a&L%i&oDmslA(Y*uv*$W%({;6`X~f3Jb1T z2;Eh6k9~}6DTf_}s*cWI2uRXD!8>GRq35}G3v1F-A(#~$DRi{djwGrY>Z8`J6v533 zRIV^&1#NN^{md(n3w~I6A*LiGONh;C;hA6CtyJr?Ba?OVG#h` zY{}^IYgnVK?=VXDvrICk6H=uh#AcsczH!{R<^M-K?Adjs6tdR z-}S&3UucZ0Xy@KO;Cfl4^1T|fhJL(4nwmz`M*XOUR=i3gk2*Fa)IFHpJLKFN_mG`I zMhUKg7tHj2;J6yw-D;83>BUDoJr^w$2Tq_oTg&#Z*UOEOs&ympGW{7nS)xhA)KKi% zOfA~j#t#Ies*~vX?ui~_h2yIB$cxN44l198D^WJFO`7;*Mz)0+8c(eE)je|eC*ENf z&SJ?rns9~dWt+prvy7A>TPmkCZUu7b&W6dVobmJ``Yu9F#p?9D9_($h@^(vfSPoyy z5nswis+49+du3x;MR*NjJr3Kb(za&f+AEIQS4rHCj@Duq+yWCRm5d$B0{hEK#*hjqpFB;3cQ3S zp2DVSOx14YYe_?vv9nuQd3j-0I<+XJo?EPD21kin@v>@(D64LkE9b19J)hWDO|_YD z3a5$p@DdIa4GwCNl5%w&S1y&0B_veFC0s2Wnj&STGpf2`iuIZzGjaDddEL3H3QK7C z=oLx?${MKoxLv7I6&BUp3tb%2N{ZD?(q__Po8uJ=HPU8Fvqlv)?YYuY8b+$QRMOxY zUxAj3?MuYcO!!1u_0(LPGgLW+?0Gqo;4Y$BI;90mnqo60^xyO&Rkf3g**ONsX*Bw> zOp?nLdFfwerOg(mXX%cLIqS}Fhhk z8KFu0WJ^`7Y0u}7raxQ4rN*T)nl<89UpUI8sir41lLpu0q35G*a1p7uW2fpHp)4+) zcjdKnXVX+un69wb<4xyM(_d73Us4j!Rpzk7N8=pl9H&O1rZL+r=0cxV?8;-HsEa{i zPToRqOy5+ki_}V9|MTcOj=+Ym5yL`f8=2EoqV#v$n+Y<$i>R>YF84%pK1E_X5G^3O z@?<@%>2`%I&c2u5Es)fu$A(~31C=PH4&G{AH^TG5m+-ytaHp^Ed#v|4*H8Krtn(5c z>JN}=+HFjKLC@Ap z`JrY;qaFhXy*=+}lmz~SfxfdBN ziIr09o4CAns;7QYs__{^1PL81z`_M?FTHf}VtFm&+{SNo+{0Brx};C(=gVC~FPkUL zYA|tuEF|DX-WttTmvkR3zI0pNwN;;tfv_!|eue0Kc@LvV|@ zgGpEJG}B(|7lqspcuK$E6}db9PUt791ofYlbXPx`@8DS*vNPP6ld3VY%e3aMs76U# z5nb!?Dx+Y~tsmol%hVS4KD(PYn@sunaW-0YH3qMRw>X&oRB;^YO()!Moeexx9q%%g zKm9%?+Hrgw;#-mZvfsYw2a(J}lul#=PxiJ!FPp=Q%YWSv1BaC8*5{$S%l^V&?8{AQUTgC3Tnv+q4LTp+9ASe^gDy) zPHgUd@jKhG}ud(xpB@)?2LyDB|8-ZwY(!@i~fAs ze&1s`se%7=dF5~Wtb|gouq_A0X4!(&uhnhMemnj>ZBIm=!Mn1!hO)AE&xWlIxL4UiLrATk)SO>!L?d1Kr%PjO zXQaNGFsxF${gUi^OTE;R=0#J_Y0Ya-Y!twtusa9W`TWGCN~?18_bSZXPl{Z+xb>O% zn3_RHE#SmP>temN!RBr0l8O&+a;g3{_}AEir-vmX_4R|cy@7CZhl$fvhY5r1&zz&m zK~t$pDHrjn!A;TD2fxuDnFA*f*7jAWb#(_v<-w zv!g@i5uBL#`yoQwfm>sG^)o&r-Nq5^yKC^P8jV3G75f;P;VGRj0R;#6?cqlZRhdz) zq%kvFohuAS%QC$(E-)FBrm<*+iy?;{dX+5G`^y>I!GInLqdXB+-#EDWb${B!M1>g- zwJL2nI!~$4yvxTC_%dxMEsMhejJ$Hy`qGlo%Gca%PD3-zY?l@_wO_`89?WWwEY#Iv z^nVi($cY{rR#qnz3#N+cI?&uFqz<`^Be%99| zo3QEOm7H%Ajl|s{+&ZWGK=o`IH)e^qh@KA8g(BrkMUeO3H}{onIggGzT}|MiNs4DD*tp!Lq_(4Nt?SBS@!$}u;qhx6G}-ga`-wmc>$Z;`jqgjIvEn?N zDH+;O#!v;E@L)Mi#!DmBla+x?JG1(n=A&lociQIdAAQt@TzG-6P!rT$!m1J*!Bh33BT3Eg8LWDkh(b(OGpqvI+R< zR2-_=a_r$r|2k7#eCX#rOpS4uy1ZT~#QP4fT4Dm@MyRe!yML{Z-+|T(4VQ z1+BxL$4l_P9hYl*>XJ^bDgVRCb~^Ctqy5?QFvwMv6Ita_(it^P zPGXCi*%W*6(-+jX0<>Vi7al9Eh(2ts`nT+b-Rv>PU4jtfk#V_N+q#6?;HcCvd{KbD4UI{J$!hU)m^qntFRuw#5?J(EE8=W7XBy&oBS%`_` zTpInslAD*WtFuGaoZClnsVwO?Ab>Qbwf_#UIqspHNYNTBzv->PO9EIj{ zZE4x&t29ahOjTNj!uJIl7nPttt_qmt(i#eyH}D-YPZW84);U^8q1OQRipmvUJqBx}!_t4e`pj zq|3;5dIf*;d5X%znpRcC)T1+SwANiRw3jMIdY@wo|9*IZ9VGcggnu1;IwyU!*wiq3 z%1$X>n}A$RWdEe_9s5D-s((LIlUd2CT2ugv8l_T%^V%9xoM@FbF>@{+O7bF*Ea*j` zYDKCEEnWW(l~mdmdU}O#ny0eRw`ah-hSL70%kR2}I7^+XrVs0PW}f*=WM>D<(kk-a zef~Lol8kFztb|TrNs%^)gW0+9*BEw)v330_S?+S$Z!?N&?3#DE?=5QKC2un+r$Cm$ z81BG4{0iHJLB-o@(eiCA?n?*ACh z%$RlQQ=>E-ORl0wEGrk&_v7rDhfmUq(kdtWQT1F*X0Afn$LIZB7dp?4U6dGl8VSzbgUZzr`*)Ti*y^avj@%wK6kVf2xot@my@X@uF$? zo;Z5q2MdI^Z^o7H(bpM{w2#g=sDfRnBF1G$8NL&0usl1%+ zxLgWKDU$8ph4&okssr&X359fp0$01Qlp_wOpyD}*u3Ak3*jIXDx+qj@3U~Z+SYuuv zqrE?eo>r|${ggSpK_U4HHg7IRLGq0FnHAV1&Al#0Y}}lL2^s*$OnJQwU>IfMx*H_9 zuq*w5mxr;MT%q3Jf855LQZalph6>o0vZV4#i}HRAoAs=BlK1BM8ld=rIf#d`Dzju$ z06G1=CU!!7G~XGK`hEXIvJ6^O7Qy2^2Kz;}$RMM}Md?bu^r^%p&c0D4a7SHeFFD3P z5=nXH(7@hh{@ZB*`ADnfs^*QW%mK;Hi>JXejLXl@#LdJ$Hy07Jupj)CwrT8bo}SQ0 zm6(`jJoM(O#Fdqp5tO#0{UG|G&OZM4q}phEXQ{uRpqA&{+tS!Cwb-xu`e+1mkA~)6 zJ@<|F-6ra5my>E%89bkb21eSgSs7|s;}lK#n4zU6wq5ta;<^tw2`c{>8vwA~|2rfB zQEb(J(_lao?mq#DVM9QFe**%JfUq#}ct4;e382+OfQ*03VMDMXAVMGo1j7F=`d>-V z-*vvfOMU;H{Qv#@pJDi)y-mQ;Gl&cF-)$!02>gvEVM73Vfw(k9a5PCoNPusV@4x|& zjqoo;z$uWwrT$%q{V(Dz)-BfkoAsB9e?!uLQvb83|McsBw$cB0S_4S;f1$Gw07>}8 zK>=&+4G}i?Ke!?9?u4h>@>>pvPXB~{go+rMTi+X^ev{<)v4msd(kXBpgv#C39wBiJ z!Ss(%oq|@p^@sf)DY=raYwVN8Z2E{7li8sqeffTSv@ae!U(1poKGMrR6TL?k#A8ta z+hQx{Dl9MNcwk7?r3@~at(p~Cg1~!Uk$^Cq({CrRBN%Q1nU!x#;71NsgJo<Kh$;0}Bsb&Wr% z-7w*7XIaP7{S18%Jw5xIwer>W<{-GZaDIHgh|ssKHl$6X=$=))U{#2Orw5gx{?oh! z|CoN6Y$%c;mj+_zz0M%!*39&gZjrW$ihZ28>~#1-D%H!yd|xz5QO0_Aoe!1$Y7mza zmso|8*(vooHb~A@034o_s@kf{0oKQQYFFH|X@wMa?v%Ec;D};){g7&i7@Iup$$hTy z65d3XTz%P*^(U!gTgZ`JucK`>e!nHEo4^WIXK}lAIvbCeyq%BMU1lg4$zGEIJKff& z7!2rQT4%5Q8;s${OGozp$*ob<;$mj6xVngqqND|pbe;KB)ncMVdKNBhJQ!Ybj(4<& zFM;pP{K*sTkxx=mQN9jggml(?dFQM_rJz(+`ptt+vV#HKFF!)`AAVJwD3mJbCKkDU zWqF?`M$EzxHgoyhEy#PB!(=amRq!EP1+__baAc?XfL7Y$-rL7W+%zrT?;3LxuPWMbx>}(k zDScoh|JKMT@s+>yz_XLr?U-ra$kvi3rJaf4+p>2wp}2*UH@w%`mHgDXgN2dP4bq8U zPPb(yKkMbXiT&!uXs>0Bw`Li+RO$8uT`~jqje-yE(UjuF||4JF>fD6li=CG*W904=UEpuF44i&D! zj{?@JzY|XxAc5=wlh0^aTo+L98<6J$B>RARcYm(~OiY(Ro*FjyD3JXdhys@cyyzMI z&AkU)bP=Lx3^a5FWR+l1hXAKfKoV$S3An^G5WSnlHAurXI02&i|DG&>)IUiIRAe_Q zM4bQpv59EVC~Yj1=dQztr*(tE$_mK-`Kf?S3$h$)OY8HOK0j7vu7p96XXcUz&7S-! zxlKh;z`qy>SHMU6@8|E<4+x9IVi-Uy0AYvyO@XMeTZWlgun2H|=vw z6#!A-;0xmy!RY~6VFOBkAS}=sh%<=fzd0|6{%=8$6V66m5J+C&eqIQvXYePhhaneD z`;zWa`vz5Q@MfnH_Yza5W02-g{N6g!pbteVEa>4LXDpfPH7G4&*&i*=))up4WW@h5 zvatrLQM0#^8HDUuJzPlG{w(>kV16eIzwZcxg+Yja*-QV%I&1K-D>)3Wg1f>p=*o38 z*Rd9wn)rGNu@E#k@3*oFb?B`32l=%9B#Xf6Jd2Bn4pPP`z_;Xcu4*prGQm_Y1g*ka zEe>E-OpHTe*8~<}GU&Zd5#;r|K48;kEo89MzFIUD>Qi&DuU7486OlKCKYbr!1~aZX ziys9A-FRG{BU_Liv92rgF9l2J=T|__IzVJmJt4JrTt8J-9De5(N61I_hdrQH=w%~n*rRIvk*h&ZQ0W>1}_)u^fI@W`zmXplTlR!}Y0 zhXD1#=W24e6*^&{k09oEU|f5uv@=aSmV)oIcbqILkaSThEI`nD^EmIcfScPljJ5VO zjJ1Z7s4Vsrcp}vz3RoYN5wU)_EFd6?#<^7i>9VPa5HD4^%$mf-{a99Pwh^t5>1`?d zv9xsGsoBki%|x_GX}Z43WL9ZD!Det;M<<@j)TV;X>4#XnHvK@6Q><*kC&Ng>cSQPJ zRJzQ#a^d>)3cATAY6?qnOCtKt4yoi$)3ilc^gIl@E_}8&Nv4+|3Zn+4(+6iwo7S^y6zU)}2q6Xg(&AbnB~J=?9ni z8jM9;_-F;m0;+|5ElT<>+tMU=jpq%^TY-)MH%o-h4F zHg&>ZC)KD8{Uoc0kl2$SYa{7P13f3=}JAc z)ASyK3ip#)T&+`-=3*+eK0W+$YQz?L-St{pi)mgK=_H`0V5~q+$H=8aRUWj&?QvRP zy}E%4?m+tc$oW-IQ!8rEDx|oA3br4XB9y_%)GuVO=;44Yvo+f7LnnT*w5Iy zmVV9GVhhI*a;g%iYJ;{2?(v-tPj!>!`d#H70}n6(LSSghuRvRhN?YIyeqLZLba2~> zF_KDJAs_bEq+}VVZXq5w$&0vOWxyD249^zvqrr4Q$o*nIwK{KW*OKD*BOhVHm*4t-Ifht(KsC|E8?I1rk?-WNrLBvMDf%J6s)H(Stm=**F{VA*lN+U z3FBa^-zScLl0)#Vv=MhJHSEem?Y#Ff{&Puxq+nbPyJ{n$CRjk7*@ZAwbkc2ACubTF zb=A@MNSSfR#7NiEc$4{@%6ojk*WYDx+3mC|m8^4nT{I1Dy`EfE2R42TC@W+ZrM&)~ zTCnrpRZs{wtmz!Dpk!;F5qScxdMkWSoa4(jX2N@u^nL&9cJMacFoh^lbSK=5<@kKM z)Y9vD(VFjZ$D=ww#t3vL=5yFHoR|t5?oAFM!Ja2UkfdNCiZh`R681dfp92=90wX=R zS2U_1FNXE!0{B~Op^7dIOa#=l^p6Dw;SV3Bg1pL ztq;UPF7Ea;7gf-E7_!A(v}kb{|GPP@ zr$?UCG&z0Dd%|d9zB+B$J(6O|lt^g^z%>;BhMNR@>OgVb7+^;D2ZYUi1OiyN3O08S zaDZ5AF%Sx)+c1!##XnE$p5DHxy|ujjr+4k@#pa05!gk26+j}&)-EmD#VgAU0Nz;3U zDpqf32vIp1x38Q7H&!kSk9&to;1ATc3lzzBJ~jvWM)R-09#=U;B{CGc74FVumsKR7 zEG=r#)+6Fo2KWfX7utJ2XsPwmcd*CyJECOt6n!pLYhG1scnHsiCwsgu8k6d*)q4qhhw&Fxi`|1} z1Y9(o9?Nhai){~xb`53h`YWfsgE}SI^_`fvAC7ezIbS#(9P&Pc=k7RuSy>rLk2Pr2d4)cubwI;y2!@{hMyG&EG@RWc(FIzRhI zL;NfdBhV}>DQ4;$?}j$$?jq8mX$gMf)2huj_!dM-b#rh8TtK(bv?|4oR&ei? zFOIWAVO+7HSwN#ix!0>z2I`LB17GHW4sp2Jv#|GOgh{p^zs6!T^rtSh=1hA@oiuJ@URB|2 zXl<+e(d+eIX#ZjTo(y$-L+d0Wrpn$e)w{4cO{_MpP07)r2DX04J2MG04fLV$u;i_x z)~h%nUJit(Ic<=K^@!Wf8A|I`B?ZUPtw2KZcu(1{l}Z z?*+kwZ94m^ZsoUzO$TWp+rp;%qohd##cy5wWTyr)4J>!2_BZpX&@y<;i@Q3A3i>{J z+7reKW?6830VT)v+P1kaEv51vf6%rcP|g?JGIN_stS@*-^)x8z?8QDpM;AXf@a@a( z3T)e3hYH^_EhG0+L7!5iAP;DJl}bOI9wlQCQK1CU0N60w5t_0*m+#yjhy^VcfoOo>g4l0Q@v&1RXaS&Ye>CQi0iR9<2~`pv zfF~i!sN`iPiW~xZ=k~AV6gQQLATW-?u4;j|oTiq_6svGJ-1(*Gdqr?)Pu0{Er|~vmE%JLL(n=L#(}pHW8FxDou=`b$?OkF??ZNxEdQ2ud!{NDQrQ6HU zXE<%G)HwCtpCBp)Iq)rzNP;i*u2`PDT&7V$x{xgi#nEST8`H>nclX%YCeQ+7iUt4` zwM&E4nfEKIj6{WIMIHL#wBZhh?8Q_y) z>SLLt1ABU9vFi;q5(+pv=7W!3(`}o=;5YOZqg1TZhc{(iXGPe;Ixv9kaAbiiyOI1CKdCsT<8N)Y%-;g1FI ztwXk)HXT15bD}E0wx%p(M|f*mj){= z6XFLhUXS34b@-04BqLq;eO?TAU=|~6C-Ac!ouKC3y$EBrjZrozBt2!9(B^C4#iwfY zV<}}HRB>4x*zDD7U};j$52K8uWBTH*bRy;=l0EO=?(wu=h>HDeq>40IIL3k8+t4@+ zg@T84V4DESH0pS~h0?2Psp$$}iwYXg##9SP%UR$oG2@|e3aM9GKrE=KSK}863Phux zv^(s-bWy$3^CgV72^*h|xth6LQiZ{X(TP)p0hgdJfwFXVzFHk*1q8oL29=l@d#4K( z+er@`KNQPOd+V2)*3!3}>4aTs0SHewriQ`hzorz8Q(EU@w7>>S{Us34$!>#(T}CTp z?++Jj`CeqwbRkN`vuqI#oqeOzby*u*-`j~XWLcMGAN7~-_WlN#5R-4M1yt>%gUvtS z40lE+Fv?AljUZ`n&pRgO4sB;_w5;S{-^H~K_hOX|`+>=voB%b$>})*(@Bum*)soX$ zJbo34ayiZ7D^Tgu2Iix1Q2ykGv-9`W1AL4%o!mdl?00I~-6)l~3`#VmAu0gf-&JpI z``tnMYxm&VP)pFj?AVyq-4V|>{9Q}Vdk>|Zbx?AAMfc7H7l_d3dsj?wl<3YP$`Uj+ zN)BfTZYOHGA}6kP$>7P9zRC?b=LUEP&T_TIEJelm#hbh0?V)uIlNR9>19~&_J|pcm z!8GD{C4})~-LRr88DV5a){SH^_KCz2_%k%4eW_HctgN?xly|ADa{B2Ce4cT9I<-Wl zXf$Y*Zjj`R+#8-pa)J}I4miULxurQe6JkO|QaJ~sP4xNhCafCCaKBG*uMv92A$@8l z`T0yC_XqFjTO!=GZ%wYBDd!j+JTu@R6v#Efx%SrRG9TyXe=jq0;O}Xp1H>OeZ?$U9 zUgt|0+>W@+ch@_{;jAuaPQuw|HUD1TfBk+@?jqL|hwmx}X_;drL9IqkhP!q!LRL6& z%}nhx?`;nC9|`|frPTjbCimk&ZmBYO$OLil-~Y(}hsyn{X5emdTjJ<*5`xwx`8k|` zJ}@q;_WM_2K_%4-A1Bht-h?lx49^yH=%7@4M{wiky0}2wVSb z#Z&e{CMUp_$lkbCuFJ9aBLDU}r5#mYVt3o=f8GVtJr-dN+{K3FOxej4ry!>5N(k*J z0qjqucHQJ)n@7a4EeB|+c;MhhQk#)8j5A-GR>-6U;ze9{$0)itItCW*?`IG&jyy?+!=~>1F6u{= zIQHt?4SR|}Wiw0VTiE@BOmdFg6XmzDDcRtMI@6*1yjQY&W64c=47`2jr9r{!%kv_{Jz|SqWuO5giZv?R@!?>G?*l@14v(Hy4ZRY6jU|7SRGl4}$>goS=GH zuS6TM<>HR59$QEhIreLaYoYliFSujK=k4NJNAPKGjFGp`N#fgKPJ9MDVMgKa%q{z` z4?{kkiyBJ8+T3jZQnZ}1Q3AI+*R~30igqO5fyhZ_Yy|B>+j7Ke#p)d+((VZMVtEw3YjOgE7O^0MT=We z&!aMduDqM-hW+Tx9`61Z7ZB(xee5J!R2L5e8OwJA`~>%n@I`WJJkI=!=vDtsps6s} zyiI-0$gU_L>Qe=Amlm^jIdDOY8rbnk=_(vh7c8(he-(8Ju^>o8u4;Q!mDENhRBx!l z+BVvH(z9)vC$F@{YVU%wo@KWg)y60F(h%aV!P68Wg0f?1Pqc!4RaReveD4V%C)GxY zsU)j1-S9SglZIt&7;*U-LR=E-g&q3By|8lPYSm zMFyQ8bOf+o-q8$-m~SUP(89T9m+#dZ{f3DH9tJuj1_z=A))&+_yg)9JiW8y$Sb^QK zRR5iks+4G%Os9_c*0;mVTYZzf#qV2+RYkT_dM7_-ov)Xfy1g@vT9yWu*gOInzyu3) zipH{oZud+#c;jartQTU9#PzW~m(nuOkIo!-p74#DR{(I+M<4dljLNuvYRF`5ziZ^| zSG0Va&F4%gkBRP)-AvG<)@fL~R@k&5acM!v&)v8u$|+SkIkpsHSyzni6Zh)B1yjKz)Did}M?Ou9|Aub*z$?sLkiJkjulxE-zEb;7j8MtY!E;lX;={6qy^yM>e z^vnn4v$FfTJ&^+$fj&p2>Pi8Xx==vlkn1;tFbzDVw%jZ2{vs|=?affeeCz8!`2V_! z=W$pYnBhH=#(hY({{x~7!<;GjYJOYMo9Cu5&|`cVDe5s4t>11UB&B04`SXCvYHA|f z8S_asy{jp_?K}UZ-DNZU&Ji76eQZrj ztMc^TAVYR1C%s=&Hg6#gwxK^7dMmud#D;$}Mf`57>C|)gl&Q!3fDby&-_GhZyO@V) zJAbTU-h3vvGsJmZYN%RhxM13MDGa88K8ho7PY@_;VL>fnMq=Qx-#Bu1N)sUpmGn}Bm(Sxa*f`Ta8TwfDUqdmBK-+o=5h!!5M| z!*7Pw%Vg?ezfN?eih4!TdcTK|!c6X?O<0 zYqfG@FWx3Zoo8eZlSw}!nZI;J0K8cD5!g>&un%ts%I|NIjGqNY(_Ii}QEiUG%d)n^ zRw_L6k#V{#J;ac9OEoC=Ob?MHP`>?N&B(=NTiV`x{ z`UT-enXY-OCQ@bP7@h`%yLse;T`4C2ogtKIv(NKuFQi8WEJfa~l=v@+{9R&3kr+IJ zXq7eWV<#`>cO+|0r|~~ADeZ_K;DIu6XU>`qo?`dUn@{~bx*P>$;Uzh*H)OClhB#lx zWg**8?#`O*z#-a;ckN&=|AS6!On8Dw0HNhz7;cqOFUZeXx-Bc&MPqTN-o4xVl2fe1 zizOO(Q2FwA#TUd{#p39zy{0+?8rEP<6xmw+n@GVkMPd9Rt8W-*iMkpi(*+@19I^(Q z<2Tmn6GZL10{i*onEaUT6FX)14vcrBrOU6{vG|p=<0y~Jz1h?O87ATbjhlA-GjE-^ zhqPxf?%m?z!-rvTJr&X2SM9Jw9D!;kBKMv5oY~v=lZ4Ps>9!NYfk048ZK;vb%{}uk zS9sIvJ{pI9HaoOlSH0!YY?<0OsGsXXnC%E+t+o%NFC;cF?ZxW#j>1+ns3i{v&G! z4PsEHzTUXthbXb_dZ@j#Y~Y%s+YGkS(LTI<=ZtNE2`BM}!gY2kWM5ScVL<*$?x_hM zFwI{pK4!~L)DG+gnmXcM+-twH@{GsS;-saek*a5*UNt>h`Qw+eIAj&mQq=uYDS{IsH9Hg6~aFE;}E;8IAYKy81VfS;=?lk zp}r^~Wl#{MPjxhBw!M7f_OoLxQ8m16yg*B+v0a;CW{NlA!wbw9#O{|?ZSo$78m@}` zx+W|N&@|pRV$N(|pw@QXDZgUpt)XIhr#eX>CA{lFVf3BKmqz5ICSay%3&Jodd~7h{ z5QDg!;Ubaup8KObKY!Bo8g}}mMU%MaR@h{8m)4jXax~wwp{#Vho9AK`b-m}_OFQzI zf~K~m{TbJo^>2E~U2y%dz@9E}Vr1uc$}FH3V4DNClDR*Q!(==|uIEH&&qF>G#QtzQ z)ME+XJSSQ;l(m(7XFEV{zoMXTQwmFcAhjJ;eYwf$xKLrPX`&5u{rlJnYn;B*q9I0|bPst?yR{aYPF z>AqK-UtgzoPyRfIyx3P!Jnvl`sj{;8Uhfxpwr`m4Xki6DmfKC^ICL@x()tKXB;j-o z9w~2rZN*1=I(cR&ZA>1k5%G4TiV{LBD`g17!8XgjYL7a29X9zcz{dlw%mQ+^V?2c@ zK>X?JqB)(u0GM+Nr3Yjg*G1|vcpWh`Ron~Se`l2p8EV09ep0Xh;YSv)aQ3p?oT>Tl zYryeCZ&i$ysQBwt$Lv5FW?pQ0Q38T^}l)bC>Nw*F5jf3A(r{c-L zXoFALRtUs`aT7{>j8!PJ?~ebWbrpfosSzK5&!!P`350m0zkt5^Lxa#?8HA-6NT=!2 z?vY3JXD^e(id_h#F1@RBU<0 zE*Nqmg3Q!pD85(qUcEAL(r^RqqR@(9{0@ z3(3IewM$jmSLPDsXS7Yqyf|CktqAuzSL;d7Rc(|5zt3erD zH-t7x+bVDpTd-tFBT=X!@GJ^;80mv+X82>yK})jFnXV-lJB^EYC@g^g1UFmu6uGU& z1RK>k=QZw9ah+%+n!>YXQZ;vxKwCVR6BT!$jJ*67tCzeeDW5#Ovtf2uRa_dLrQ|}- z&#$ZKW!U!CM-a1S+^^oNF!T*scol6R@Zd>Fv3Le*M$vIo%dC(}J7>CjS;=9rcb63b z6m)cxp1?;{mPCTR!~ilEUAzpFM;LiwU@sr+t%3=BY?*{S(x;TMLG!w2H}8xhKE=nG z304-5Nyew1pTL6|1vs3JEYJJ~eg^kO%bA3Wk(kGqv&`r+{-I>@dF4h6Roi1?gMlVk zPe1offu`5wAaPW~uSea*;wGT)qrxcXDqA6e$Jiq54`t&9`f-y^ISH7yUKaQ4w$3^0 zJZ?@g<=<%B8cJ^7VYQT580T2;lFS6^ISmFBG&R6B1C%n-?R`x%P}9H z9&FS#JpuV@@8B9wZmV2fcBpT0q+C3LZ1^?Lq_|w({TY(M8Z$9p#3z z(Yt$T_)P35bK`fPGXrh~&;gHyPZA=ks^XU*vGE?M+aSJJkM^Lv5DB z!NKSFRr7{$eG75?Qs0JPN%xxygh~P{HAlR>Imb}tH|!@P_CcOk9KklsG>;`8#|W3E zUYZpZCl`%|fN!I3wk)dq>tmt~>*{fqbA7DHklqExE?AfNPTyQR5a3+T}~!Z zpZs9#`sGr;U?BGljGq!);t3f((`D|4%xK+71g8Q$y`yFkDukQ@V zxpZ4i2b~1)D8NxDWHQ17v`>xyW-WZ(t(wY6EHsmdF=8cN9jsb7xGcY03=oft)G*B8<>Kw>!U0D8(rM$!m^ng1Z2WA+=&gQJ4GX6k4qF8@`q4T*0^Y zm)JJ~Q25BkYrWM|C69ccIu{=&V@sUYvBZ(8Z-rMvUd2~XseV^KLZzi5{o=;}4z1dL zPn<^;M~iwaw5^^hN68t=KVxaa^cz1%TCy&#S|lLb9frU8c3Z~8o^3IpCS>R~dF|55 z$Z5BAzqo6A9qDt(i2@dI6&l|G7n#~OS9emV<8765yPi}tJ3W18b=qbt830wd(cd|} zSNE*~`^*3UZYaVPIGj_z$WHVO51bmUGM|i$tp6}XU6`e+oEpHs&O3Eg-ZAeQQotK3 zkstPa(?_XlZ8B1hG2xcu$eZR=YV0eox$gC1$hYS8*c67ArmWF8&n2N(!}gu_&rIFR z`rp9kZKf=gk5)IwKJ#%Hg54hSwf;gT=ZWz6d%fCE~9$DD8>A=iP6hc;^*=_VveO;lNA66FAIG#1b6wq#y!Fn zfCe=cXrH}#BM{`9qkx~ZHcY%<#vaSZt@Z|*+WU{%#M!nUDvU2f+Y%=E%qz&gH!n{= z1`d^W{%BKEM{0B)Yy~A_LJ;i%_6Fza`?fAZ!r&LA)Vj6J9uw(Ns}TqzDR_2rvVztb znKC{%4W(q^^wEJ0h;tpts?cJL97%iId7MxOKQppnzXr5M)4Z`0vFdBFBox z``>6|I^o@SuUz`iJH z?ZKh!FO*ad+^DPfo^VsX=W^|8iG}cPI8J#zFC^|~4uY)9J5Hfcl0Eofb_gyx8E7_< z+K*CMFer!+MbHYcC$=QQC6ng~L^sBr#aX_eb~KI?VrgniBWL`LBe8(^;wSb$?hiva?pZ89&xIVjM#R+5W_-Gb8T(OEKu5APCHQak@#FhNSbKj{JS^?7?ltf?aG5h~L=HV2NBANA0s2Zfj&I zO~2XR%`b>Nv{henvWoiX@c(KFL5pXp{hQwf{PX8rX94X)4+x| z>SuAWdPT}1j%}2RyAu7bN!2z8T#_`Nikh-sMvdlYPohSni3c2a_`l0>oHIqDz>JXD z9969;Gf{LW+4`6YX~t0o+AR!l zQyHcx()5cd8<6mJVe41_iE_wW>PhC;m$nd7s+G|lo50)z_Gx41MHm=F ze{4^8IdK#l&*Tu(4aVqbD^|c`bvdq|73f^YlL2|g`L}YVAOOF-MSJx6ppp-y^M_HY z3~@Zc@2N%Pudh8po3`W_V@K`<0mFXXd#bT;p%2co0M3u@d=D@s%Ri6zo}RHTa#X>< zHP0KA<%kH8oNP;kom6#{Ih(BtF6Z^74ufnL~9ww%1=OG`LDthi}bjdMKQ}KMMsRb?8->AiY#2&@SKshV?H)^hB@R8TQ3a0xJM@S#I5eqa`?7heIyOv?P8@d6O%H$kgYDXu_5kt#zlD z_39^QJ9UF09s>L9;)QJ7Co;Ptsq8(1z-=~%_P)VI!px0} zVVl0=HUF#$J_*kzpI*Z7sU!SGH;sX#>lFIx-d8qMDX@RK3`W#f&ktiHUM@FiQJ{7;s*J;AH@To zv19CGn3&l`;w-$M1k78wJxcZ5GIN25mIa$abaCo4y z>l>*cd@}8L?)ooDekpLN_$u&rXkx_U&M^r|-CR)_8rw z)~m|nJb-}lTJg(!16Z1-aSsi;b;sSuq0gh^2U(ySfWNTYjayVyBB0*hIZdo1PoG zvWtuz)u(7OdMah|GOAvG@-j68In}NI))hLZz)-G$G4{Yy+-5r8!Y{V`;2=&#bzww1lJ+e~)%Hk}iaIN6?pb{yZRgV&t z&Fq2f=_Y#bj`W4Vk_~*K(c9?BE4{gx(5>Z@cY41)Px`S;<9O!srU#Sw-x%{hzyBR% z{-5I^bdG-ma8m{kY9s==|KO1LZT9aV@&5vuIorEAvpC$%{x>EK-1v8p_`h)Of0Y?T zRx=ABOZvJwZw!#OwW+u^+L#>2wnUzXTeFH?gD?L- zI1Yi-j8YsI0?!h$n*&E11LfofpGYNnwd7V_%6=OdL1`-r8>39`Xjr}Jdn{6X-Za|y z0az7BS-fMp1s*T!w89Z^9c|5SyV5syu7IEb-;YtR!Z4Iz3qY#$fI14Hqx=+yo6OyW zfQ9#Wu7%D_;&5F$+MpE)YCsn|w^Ju9DqFZq$FTC-024)}vnsl9eIRRJt;x;nhfUKb zih_hKZ+h_V^i+$-$IFs{B3Nw)e1g6)Ugb{2{(5`eYCDcL3Pk8cw%=11~w=n z!0OLldTdNls~#Yac2~3gD{xTiSwN1OCw>aeHr{2m>q8g?6o#WrbQ#GA_61pMqcY6T zZ|eMF_to+@8$X&$aH|I{922EM!5z(8cQ<29~DBk zsJFIF$A4)=RBsN<(?A_ryr;`d?*6j>LoWDlasV4aXZNk=EJ8d9(cUvjV9)H#|6(h! zXQa;(HdsEWcbwifA8JU26L$VdfM8Efaa_nU_EySfEwE=L@&M^M6Y@#!pD6yn zI1Q|J8tY~GKS6pHVKamdM{PlA)c=Oy*+pMsmrA3U|&7@W9sQU$ZmTH>rd1Fh>AP)iiQ3E@hJTB z@%ks_Lr0rIDk@9-Uqp-l)0Y232Kg`Yhd$p+jxICFUmSY>Vs1_ z7AI~us~yD8iN64QA(BYQvCkqep#5&?QfZTX#gsjY6uie)-ItesR4>uz4gKcmztI22 zKC*&1LDHComjOq^+z7}|b_VsXf}SmsadF6O5zt`PS>95+Qo03UB9kEnZ2gi5JEoVe zh_`Fou3F%OLaf@TRPw=lGsRr1gO_68c=7;3H_QR&;l!<$@@XvVogI6PG>z^&wZ|;{ zfcsR(^{v3|4yHHWli<+opDoK>Zd?2oy|)b#Hk8VM5|To>sxU2+sb|KhuAquG4Da<5 z42&5GiGWk%i%k^GF02Z0#GL2g^?ZAr1t5%>mfbuGq2Vi!zVP-5TWH>zcY22KG8Y@C z2rtlssAFoOMLj^=0NXN;r$BKZjIm#jITF4GH+uO>J`%D`?L^z;(2icmh{oiyqsCkt z=E!*lk!L*bON$mIN2O}6zqqO&>V&o!(1ujNaTvrILALpW&bhH8RRj)w3h%7IGj>3$ z8_>MH3qu);EKw-GEGad%r&9Onv@yI20<(BK+C6E{3ZDizQYQE0Sm!wThR`(NZJzq!sSPzpSsj>JPDOC&#C(H|ko=uvPK_H8w6Tlb_uu)f(z27} zT6fV{I<<_=O=+F{#3j6mN}EV-{W@Dy3GBf}M8a|9#VYvl5AQpCEaZGSV%zYg>GPV< zUvXmxJe^n4iY{kbWDkEa9zVz=-N5f*BUM-i;n(M3;E3HqmB5hRASm@y-oz3R<8b|w z3nN7CAWzYnLLAY&1mOB&VYm=RKiMcmf3?c}b=#BGQ@4PHO2u_QHdvwz zXWh7fr7bYFQ9GmAVJO_R3_eP~UxEb->D!;SK7CSKe+*+nnd%}LTh!^*c_*u-wKdVi z+vKuv35YDU)O2m{tm@L30l))`Lw26lGsC98c=9!DTGQ9kzUm|FFc_ddEpWLBhqFJd zCv$z`>p|Y$EM2NoFWtyypy?COnV*xvBp z+;UZ)cDI^fY{_9t%zJxx1(!)U1Ccp02|{DI*dRdU$Zg)w>`bYC|Tp=sXT1U zrNq-w?Ebgj(iPQUKqvCx_y~J%ab2ZA0@J5}0(C_b`QQO^%?9hme9Ej8Y z9nqC>YthO16NvGv1YewO@?i;Z4irya4v6Gqo9ChH9)k7XV}?p~2UErrt1dZSKE)NG zcMW4SKV;lo$E{U?$nS*;S5?BDrJj9VM)tV!I!is>z(-D$eJcpjztKE@mb$gHSC*OW zsq<#-p>v<(;Grao5MbH^YJ!7fd>q64_L8dKA?CWgNIirL(1a+N3&TBKdg>ia1Vx7{ z5li37WAU7-^vvH^qHjQU?P>H+_g@7zHI8_or*{_lT1*Pn(<38q1FfE*QnH-|0P7VA z+)2P!G>vB(oITEVqhSxIFxnyqpMA6KnCPRes2Np0xu0)M3<`=tTkVKIwQCN0j2<94 znoitF2*C5V%+=;iMw0#zgZM^-!k*mma#yUG`>f{D>cs(xk&a@WplaUE({|b$?Vnz=)E5olw_7PW z_X4i+8@|{!sOXBKv0kjAJQf(=ABv!MR8(5rHL@7v&slGZY-MKmmJQ#-&F3OMUoV^} zK7k-;9RnnIB_i=-2=8&YD=y;fkDIF|B6OIo+=s8cxe52;KrS?7D?*dD=Y11YiUK#l zD#A36Cz`vwP@q>Gtb37X$gjIv&A(x#49k zF?*6)u4Zw)S$DRNDEr(r(RBReL=7L;+s~fxnB`>H-I{L*`HzZEjqsTCj&I`e_9C?C zO67$K`j_kLJ;H#!3m{qv`uI;lOIPPjE%3sRCSXBVh`?1H3#k30{-_eNPE%7_ao&hp zyU5}5kWczQij!3K2H@|EaPS_BIKXTfIU3b5vD><}rx=r9BJlly3PH|^`uObzl3UsR+SE3(P!CzLA>w3dZ-%~#KLj0p^u)C9+fhhTfZ-Ee> z2|c${`8njIDIOQ@CO0Mv%1TRv+b=*NiyVTWOqJ$_;G6FNt<#??! zr*mPrT~|-p4-R1}>nFW`{_~x_Xb6pYBeAhK>N@6)@09bmBt5=d7A47E0)M@A_6fso zS!!@Nmq(CyPQYcI_AZ74-lu=)QeYhBZIGL4A^xGskgb{@!6g*gi2!mn?)#iOuX&j|m@T6q{uI?l*;8nwl-#Ktb2=NBOf=t!DSJQxk(OZA zH*_BmgsM={!gEbF1kUNp6baKR3jY&udM8w-Qr4`b$bjgE#p=aG(^XV;E=fw-)7)jk z9_b!0tEuJxDT97?a(gU%+5)8IySHSwZ_yaa3ZBV$`4i{@fQvrm*(|SrX+!rdHs7@T zYRPDm(%#e2R1QUY6wN=O6Y7T|A8TFJL`Lc<$Rri*S5>Sr`OPW79vuE9Teww(p-*+G z4!-9FyYGoaMZKifRJYiGS2@4$mS0GMUv_pxMH$I>inClC#4>+SpXHO5CK~s+aoGLn z99>r!>%K*}lUt`%|F~#yWwb^5=`EH=LzoB~lEYU$h|otxUs*Of`9%qJlz?{`Ed-)E zjebNdrNv$?hK%hoBd_l>XwYs(1+m55v&j=4Pp8|ewow^t&PO+kL`-Y0QY$|Cdk<8e z2ioVtwe7r#E;x|#^;E&8ly%2^?*@=)>~+W8VO^c3gs*hF1-BR#nL7tJe)IcR#WUk>qaQs>5&o1 z_(|VPhkS*$oS=8{M|nm8P(jS>QeWTtMr6a|$H5J5C0QI=JQ873gZpN$9i@_;z8+hO zUUI>nJbqhHrw`71^3n17NZPq*=B3V){#STsyR^6T80eXHTtE;MjC$=U-8W;HFQB0@(y9#9iDi?l8GMm!fJ+ zf7)m5yEwrr-(YO?6dIR(4Wx4moTCOWZ2kmU3L#A@oYS&e(H^Y*%s7D6}j5+xI zm(F|6yLR7(O(5Duk3$c*<$zK#=2c$czY5N`K=xULotWTX)9p?sqK?5;w-6FrkFR6R zI5I@N1Y)Y1D)%a~p`)J6Y4=Y**@>Ee53;j2(>T&`3H+$P5(LvH@(-{YU z{dE2rFIS***d>w*{+L&F`gOfJXmRfoEIPF&T*u8!hBfJwCa3V9rw47k9J{3wVs&bK zhr1bC=1QGP@mPk{@YYJ$K58y_ixK>i!kj9ti)887TqzVKy7=GwgFM1t4-0R8Ag+X_mf*Ua4&rPhApcBzX(^%!~D}NEb zpTv{OmGnMFQ*8M)c2Plu3_IudGWC!vtJ;U~aG1l4bw|eB^+d-EwSdaUml+5u|C16i z<-Z0Pr!g)ACr2Ah$3LI(J~amPZ~{WCpO)KW9K+q!hp}4u&z*(EMh6{g(w;QqYKF7tfxdvP+5OW2HtpUDE~dv;Xz~|C z@|UyKemY+Q{uvAVzxR0T*pgcAcaTXUkdVrJ%gzabG`{vnI@-1iU{^iDW=|ySVY~AM zqlDu>sz3F2?=#C6x&tY}!mLV6um)P%_Km?*dH)o=<&{hGofJ9wm;`|<;e+v|x5Ym_ zeImblHpr2GR!9ezNE!Z*xU-1G4-5V2py?wkS(qgoY#0tBo(o*|UjA{L=hv@%tFL+t zmf&g-d0;X-2RQYi&RGwX~HuHvKRZz_g z*(zktS>Ads+KjuZ=`WLCtO^dcmfR5V(Jbs2q2YULy+8ZaqMy6O zmr6vsJwFB=ho;U{T8>st4vIVfKkhrT66+>D986_F|0Ef-{mQ?nEdP7i|MZP{_cqUJ7U5Ih z2nHVc@7?QvI+XC%BgiRZg}Op!5e4t3T6Oh2`OEVFJHY{}xcJDdtn~Ub|DRD2Y3PLn zPWd~68;ZR*&b71^;QXuQf*Qu;+(yI|vb(FJ)Sw5ApYAo9olEcdhP~<3E`ja%PJ9PJveIwiG?hKKy$E%bt z^yE;+9&snYeVU9C-VAMb_UtvwUYdU#rEL42lO2jH`DDbzvtx16+}wd4D(~IIzX`sF zCQG_ZLYv_vqmTM~apz{8(DfowAol3@i=Cq`(0%1Cz#-4UQOQBcn}fsmIlOI)wNf3& z+CKe{%(e2*Ay#vy8=o}(nxAS4QxbRf8db`kYiC&&QL#-a7W@ zY(lZ!gZmQ2d3L<-G(YW}9*oz^^9F+1f+Bx2b#KBae@f3Tt^a4h3dL85M3Z{$ee-d^ zr`P|nynx%*eqhG+oZh?Ju_K_Jyryz%qIQ=5MyBdF4j(m3&J_w^jz3SnP4HgQJ&wz{ zkFLMuX1wK?xn5qVm6s;AbL5T`f5Bf^>-0h(Mc!NKVYBL%&GGl}$-myw9{0ZBxZ)GY zfoy)p`A6076@4hPMAUWGi@_SC{&gDjboBW#SERPUd3MS9@zzLdqzbBgr17Qg#bdWC zXUtRt%uQ~4*GU(0J=aVz;@eAzHCaUQ5n9X=e>&d3werdMy5D=-TzL*r*!-cF7VYBb z%m290bs~16Cwcew>)FH3%e0t(aMMT>qz&-lYCZ?wQQCde3!LH9L3p2^bb{n_HP|}z_%o}K2gtMKsgfd1`E~V5(B{E4RuIKMb9MwzncY4yFSJ7)0j6gTjOtkJO8c zRQwy-9;*)|oME@`m*mx`1(^qHr2}2xADC_jFV1Uq&lNZOr{~pnya`r+(p%XXpflLNz~|y4C1ko?W(W`46ybNHU%}S9_=k-Z4WUKo_xn?qe0q2M zmYgpaFHS06BVp1DYPH<$mV$t9$+gNfwX#Ml0sW^>N!p5U%WX&O9;A56miXJ{T6Ml> zeD&kbUS?_AbfF{4L~3!0vv42Sxyd-=mtWk4Z>5vH#4( z4S2LrL1aajPhwf3_JzjDk=~z6FbczuMu++Ibou1x4~O~{kvmE-nH96uH2J4~+Q-X& z0%VN?TG>)7qgUB~xtkMP|Ag>iaKd3v`INlAN|+J{O+gHA~Z}{3?_O0co?;# zJ-XtBNcG=%dHdAhxg|K3@%7{ZLLBDDtoZYfq7F>YN8}%{zg@e-vAv_8;B;!#P7Ld< z|F?=WHd4t@|G%B66q4HGNAIK7HzQ3;f}hQ1Rh&0b-axhhOQ1=A@sJILXNO^*TcB?% zIRz$mQO0NwXU|JSw;yRcUeO^AGFutt3AqYx3h2^DReS0(jUbUL&bb8 zf3Tmgw$QsqFxd9B;7P^jOy<@KwC(Z-Yu5D%X|>|In<_);2e)}nSVrHM`2VyBxg+`^ z+Kb_J3(1F4EeU_Bf9*_*@Wf)!uN0N$^w5l=V(8O$-Q)l*wM|u7!iZ+#)emWM$9Nf+ zE3K|Ljmgl1s(FH`cm-(0(%A0wnTJ*f} zO99aQ0Frzrn`>1Dnl-SrOTM+)P#BjjtemEjdc{SUFr&ArIAZ9zQUHDXQ`hdM`R$tj zi>K|KPmOJSj=yv3Y_Gp@ z!BPI)3O|^ZAcPH9CRC>2;8BAJNk<|2AF5WK8}k2D0s!s<%@`^{dHH%{9ryr4e12&R zh0w5ok%%)@sYQesVSl+&=5Mt&IvoOxv@)oJp49?#jt>;|b${d=+2(U9lIR1HtyptJ zU{gO5l@N)53(kR?TYh7ussd!+#1t3$j4W5Qd}_i(DT=$*9rE>I+Y_Via|uHZ&iMhz zu|NRUKp%R}OtK?5NABkfc%frFkO@lhr;r{X%5_!gtm6APd_RGw@QHr1#=EY+-=$MC7Tt!E%jk`KAd<)2fBJvgmgxs^*pns9+d7E9eyJD{QB|?X0F^JSRWIb46f8s`ar9Efa`>-{`VpL(9RTq8RgCww}@ zidoFf59w_Mp?~ z=J|P-)0}zmRJ{!RKfS0;Oi%wUI{(%{fswkS*h&Yk>y5*@3N z8NBDz*)#f}tU~049pgZwVHBB`RET{YeU?pQ>Z6g$#G?q^Y(zD}elN5X{`K*aN5AK* zCQAI~B2wDQV|oNR*I8=*$jdL%0>4bIFC2Q+tSMo^1%_Bswp4we5d$0HP>8wpckyP_ z0ap6(Xt!HV@jA|Yt*ON8_|84PYEn74w^-`*t&>P9ih{y&>U!e`DH7`5Qd@`!_eGY| zB?w_`JJ=EyOVB&y2vh-PT(8%1%XLY_W_hMm znr>^UIwS<>r!-mtyor2#pGY&Pr->)b^n4QN^5jB{u<*^MAxXF&U{R`xu#{73CRCA) zttvyri6Olr$FVe~I88r0O}oL8_p{odiJ4A$Q)-iY*4%U2Uxcj%pFatsEbQo=67ACM zQe%n#9TBj~QyRpjO30n9ba$`%lM?X+5Eci!W9ob%7c5+#z`t%2L#QPTiqr*CQkJj* z#?mf#hrmp9h4px*PZD7`tPX_svoBIy!YM~-XoP7HZCHh5Bxk%OBpiK(fSH<9J?cKc zxDN7}E5I1&K7^{jv8inMhnUvhe&`h?E;XHs6o5Vv@6CrOI=UL71UNiAp7qX0fR8*f zQY)HbCV#{v)W3#&W3p?$Ch58Pi|HSiHKFKZvGj5BIvw09eib-3T4(AY2BTIFfjGoE zIly2UZ*3XO92t~(ip4)QIcSTs&eBCuni#`05{*BBwBuW-d&883G-*ZvZ(k|6JlE+L z!R6o}8f9Y7XTX}RBkES(oQE#$=@nRvGx-?TJZ2iVif-3BLhGMT)5NI2b>YL(gQ)` zahGv5h#xtq+Z;5wrh_Jgiy9g_c?NbAri+ZC0c+L+>G3kyu@kZvtBN+m=|HSn1+_cT zVr73~vFX?%BJug`=A)T;_K2~BpX2tb;t3rLN^msbBUy?_D9AI&g+Ub5b0Px9RiB5) zj1w6dqF!>+vnLvJGIa4IhiYF|O#|);BGxDP-b@HIauDMtI-0P>^I>ENETND{(Kkp#Z$f#IiEnF3KcK8r0#)$pg0u6v6F#iAN- zZ3E^ieypF+d9q@s|VACMs31V23#fn9h#VifT#66pxSlKw6 zBAk*<^trku>Q{&9J(8si5ziR!`7ttV^564nfJFoC#gEhc6Urx|%9=%=}~=o1-JshgDc^Ip~#?N!{9 zOX3`+2rIGVqJA&Pb{y2KvJduQlha|)9|16(z`27da$nw`DsR7CscmgXc3)m9`ZqoP zW%2lm+uahV70M3h!cY^2hiYv&5(7$Jm+Z9hFq(>obE#;NCssWIh6p{z#^S_D#O(*z z;ha%n3E2Xo^{8;)#sa2D0NJKLidPq(Ls)%6<&{kvbc*@J21}|Y9q`2_iyOtv^c^g! zUVQpP&C)|I{pU_?{kP13Q2#gfM53$&4fX_f46IYYV|P%9!C%F#JCMfab?_g;2dg(D ziPua*5xRG4_r%XdwC@TE;%?ym!fG@Ya5#Y;z;uxSZv{^XN6`cLCqi3kp@Vux#(HBW zqL4}Uv@w#2of6B|0{<~F?x4TXW8AmaYGGc3FWplao|c-3{Y=k-ro_*r(T&c!L{`I} zT;KPxbn|ROB#fP?hlMFYwqL?A_f$f2IF|n~aCi3)57Bg4bktp$qw|8r6)C`uE|{S8 zZefC~>b|>U{i*Me>Tw?tK{8QK3j{*91aZdD9{Kyrt{W>isi_*7u=8-iC4ly2!`NHI zSam{=$>o@+g*25fRbo@5C1*%e@AW@n?*nlh0B@Mnx_}JS-@~N@kp+b+#{6n()D%iZ z)XK%6bY2eXb2l$E?Dk<|BF%ZPh>g8i8Q5ovOM^{rjKQiF|J_7dw-2&l*Gu~$OlsF% z^VG`ia!NtDX0l_;GjK{j#qbNRE~&QS^g5n7Atm1s*c7Maoukkv>_4hnSv>Zofqx$B{FU~Q0Jv-B&eVj95nPfkvnv6$ z)pTfRb&XvG2IqS@% zX^BY~71^G5^Y4;hGdp1@sov_WHmLqUznLX9cE7^3^G1j$&$hF=T!*q>gK;*FhVZQN~1NNr$5aLp~ezcWL8dg)X+IIrFi zXxhb02m6jNYyq>MI@8`+r}1UIM>o{AG&ZyIgt!U*T(vQ!sFeOR@4cS?QoKzI_p`0+ zY!bQ-0;_E643rTy1uBKL)w5UxF z^!SUK_|sv%dgK3&*r*5opuRl!+0)Z87x6pf>HFVaoO3@yHNE`1^ok1@`UN%-G1VdtzZQH*60_* zy4jnMU6$R#BuLI7UtCN@njK}&h^)BJf*e{K{SnDAV609HNI4 z6QlpV1;zDJVs>@#l9d1X2m~WFxS!GnX@hQ*F)_t|zXw&~R`^ZZjXFKlBE2k)u4hst z11UR-{ejLgMFmt>)({)d0F{1~YxNJY*Yogj8P(7MluXGX_}W4sLiwYuGH&Nt7nNy8 z?wa0ZvkakO-P1njM#=X(nX%200?v;Nd>Jm;Ct!lZ-Fyt<+ zeTOF(ETVxi{ZV3p2VlVucBZoAjjNwEN>3;*)JJ)AOC^2hzs=va!TCg~%%M(tT~n<) zxKHu5XAhkweLvdQEWdn1$7{S4$nQK9QHUR17vJg-*%wFjtoM^ff>0z+KfRcQU}gtb zgHPJl$`o2|50q-&4gR33Qj>|0(PpoJmw&ABpX>J674N2{O)pmYK)oUQiq=IraMCGS z4fA-xMIP6uLCkdG?oJQtixRT?)7PL}=Sk7h9EDG&CDGisy9;dF(>QQAv{ z%)Xd$8&7jf3wboi@GULv5TmTXEYJDOLD1UB%l_VAkLqao`R2N~6gyzR4@URlI=k(u z&sic6z4_&`_sZluRU&fesT>=dN?F#^%BVZ`f49w@ zbjqfwtJ8O_qjBJS<6FPxC9p{P_oI4|Z{()i>?8nx^(%J&m6C{BeDnlK6mq~%IykLlJ1kQF+)GsC(T({eYm7T7fh{~m#vp2HB=oX{ghbprSsR-i`<#m z>p~77pi045paN|^xHefhC~c3E^AZ`g`J$vgoyRHQV|IX(A3<>&NU;RZ#NL z6=$Vro(7ew$8>k!SVEpW1^{PKqM{;%pey2u=-t(|cB9uBJ*^j~qHO(i1(zYeUK-8B#O#Y-;RHi-OR&e)>w(#~W_<8!7&HVqr~W8Zf99shJ}&tsD06$S z=@yYwCeeEIx+R*f@YPuU3dC_r?o_tx<;hH@#LTfDFB&2Cb4OqT_S*f_U#n26xU^wm z#k1!r)DfA_XSE!;;x+ER7|<#L(YC8@r^zb&xtF$u{JA`mad2#DO6FKq1sBhUf1#p> znRBgp3%~m1*(fTM{OQ|y8fo?Pt6qISCjcOAvQCbp)Fu{em0d-L*Cnsw@oEU->@mjJ zJb_MQUJw=W@AhK6>^!OXiVl=kefReY5CaZcu~8XDL9XRw@+3W2M;#{n1G8O{ug129KcP^LP#?~2OHT|F=&7F@A^|nS zyU`wbDk@~$m-Nf-2d$jCV=E>?b7C#kav3XkneW9sS1BEG;`c}3t0frxu4YynUi8{b z(eUX+=R*z6r9t;H6r3}^R1 z%xi}u@0<}2J9^O2?JGlKQyOEi{q(08EOvG+emojX$Xv-pE#dh1A3y>OK{?0I{2E}9jQTHga zr>N^*4NrnxA}WFX4_>-45slGIQK7+Ead8~hBI)-5EMnyyB3m_LexQm_+zwG2e``*8 zOkK|W3i^T5Lr-l2n(%Fr@`XJSffie9L4UZ*F+Azl#HhL&U80(87F|jz#^D32;hB;5 zhi*?yhpnI9F2fe?SDyX7{)gaq9{sKyi{SBr=Zz1?Sw_5CxaR56FoYi{D2!(WrT{<3 zXpP{j@p2Ls^Kg<$l8Y(xsE{MFSZ%qk9!1iJx3K|6A3lb25d{<;FOtq3;0fb6YZo!I zzV@BvK8$%vu4n35e8YTssXu+84a-xoi%^VIrN*TcP}kt66MRG-Eh2?+o8j?9B~fcn zaFkevP96?@Tkg>XSKljkV^V+|3qdEH_bd$%=WVFtKk|n(U}K?PJ>@L~q6TwjzPppo z$>5~((UlMWnvc&;)Q*`)r6G1bd9ohIMRq=hgw<9GJB!Gn9Y-Zw6Swb`(vXlQHOBK< zWUC|11qk8bWS*3Rz5*kQ5=5F*xvbPI=5@dTM2l%2XOf3W)Qkhg7Sg}X@Fvmz> zGgde>ENB~j@Q~7j{(F6Ql<#=4u7F)b&c zjOnP>cdw)u9*ef@@F$7lfLJk;T8YKM4pD+_pI$#6xrrhP%bD((`X~3Qy9a@(&Ntc0 zPxthh?%FKa=H4KJkB}#5Qh+TU9HE9w@q2)!jhUK^(=H-cNU_9lT6%+%r|O zuCQ6+wt@~galE^`1Dg>ktD6Fg+hK9#+SoaGqh>VWgt1ByjuB=wKn>j8PryA34ZCoK zj$a|9$*3dX+eopEvIL9}PTJ}jO#a5*L^wWDnaRG-f`?oK*A7pE2s6-nQ*41p4|hd( zq^bV*(Y~SPPGD3b$1U(#apfJQbNlHH2oG!*D{O=Zwm?A5SR;!Wl#58%vry!L4&7XN zPHYiXqMbirT}i_vA+f|M7er6kv3A!U6$GVv^9&GAo?DE zCb`C2m;uke@r0f|X$l=65~!M>V*U2HszICD9*0gyO_SBp;#ZZ?V+s&ZRpb%-e`CXf zaBW^ZgSEE9c9t*A{HMIR{)Ie&bRx6YY}4tO;W( z(Y4p9vMjZ)h`4nk*56crcZIMg(hU>SMbNw>*R%Z>9F&B+PP}WPSCeb^ve!X~rRz}3 z(Cfx+-F2v5&gm7r#J+?BHxk}x7harg4{~8JS(A_Idf4-}z=!%W8rBc_GAAe$D+WI# z%Z4^>H-6f+wL?07vz=;unxrq%yKm(&DZaDO%ny0_#!fvN8ZJ31b+(u! zXstsnBa1y+x&F3tG0(%&r3b7*Sykh2p?O`h?+iTjb9dc-v<8)ea_R+FbCz{6WezK! za~yM$tywiN`AIm=cpss@N7X@+C39(kKVC_^Txr#H982TUP=ALzK;I~HG#9CdC_xUG z>-egxb!=t|=e=D_kNiQEMIY-FDW#TfphfNQ^7?F<(9$c=4CsT|`|kR5YQ6Ui#1F9tT07H4ya%`!K(`k4Sr>8JENm3A><>%h$>q z4*uvSo#E4VNl@p)TUvjwhFkB}-cq zV?1!`1=wvj9f=ZHJc(}RVzgMiP2EJScD49zRoWjhFp zsTd;cLTO8bzRx&pN_LHb(lDh!`sjDsAPfa7RnRJwfIFy08zhvSA`D9teWn0|VUgT- zWK8aOt%ro(+Jriftg*hw#*%h{vI!^9p&Ig%6+bU7f7ga-l^difdjfsoj=1oL!kUFA zoafPa!W9GBp1%%~VhOC?O2V!AJ0<*v{obph@z8QyC_RdgX-`vj<{Y0(&wOmvnQ46< z$2`+mZfF=(p5n_urs_0RlA;h_bbwFZQA-t%ZWVfaplwAetMr$UzCD)DeIdDGf!5(` z4(Z!&`A#p1hGgLW(xD)UoVU{}nc=_HJUlD=9YeAQVx$>GMXA^VsQ9KR`sej+0JooA z;9V>va+P7tBxZ=X7eJg7Cd8|Q`!&_>M~Y-yPMibHuiwb6IpjXqdB8~4c$wO!yg`6> z?l6I$IFX5pd$|!UJ4iwp&X0|)7N5duUr&=NOsV1?jC}dLxSt+uL>vwTGE)QCo;)ha zmEK1|m9CM`dn3Y22mz8^h=ru1DC}|97ROZO+!*X%F<|!u0HzibKvD<* zkc8s^T*)x@_K*S4ONXO`H4u3GhXHG&!;kGvhj(u(W+T>pJ3VlVxBd0{Y;7IU=KoF? z6P#_rN{(K;1VQxy|G|N)2|0UY)}?C$`Q>EaBG~AvXm5#|r-_5`@6l)R8gD$bM>N)m zLQuH#kMPUJbaQu~nWG_g(LW;+Ct$FEvx!ll*U`@!FVT^vokp0z{~KYrJK8--x4N8h znZ;+Vs0i#A-vC;;f0a5W3SY-l-lfD&i?}|I8tIVkmK23`ySKlx7jivlNR_u1kx_MY z(QTQ2Y=$qfNN;A}-I_VXEfp87!wOJnHC<-_VAX!*7BKxC4aZtxz^YtZ{#U*UpcxYI zE1dNG-%uHxt%_oOBLILe-1X{`tB?gB@V?OCRk3Qv#VsP_+_k3qMN#*4$K$Vs=ZzC+ z$?;u7sZ$S<9UEyD{w=ZJ{*%atrgiR2rKM(M7wO-1+7FvDNMCDiZzSJ!|3yoylN|T+ zPE^ifcYtUII@9&2OxeHH?`4n&vUN0{QTun-niz?7F!V11<7$dJ?luQ@ZH>BmeU^9; zfbf6L_Y=9dwdR>Q1%4y?40f^osbI`|lR6@nD7@}%VkBUT5dRTC4P(^6A8=C@zi8kc z=Y$0;93r2X8(x33rKP4#X2uu{#L9DqsyjIU>+ zjSD3V*meGyd`Z%*d*d8&)9NM?e$Fxn2CC4hWBROWV2f3uPZ2(r?_J{FlYJX81skCJ zHT4&XEdzywDK?(sL{W^^(Mhoqo6`ysC#YHU{p*jx>&^JFJsv_!jP4xHlfu?Xdjf3q zX>Npq`rF?d18^Ou!{n|{LPIXEMM58TH?)Z0ql4<~yqMS&3>G_M8~&A`({J2;;BO<@ z8cHmOa9h)sY-D8Pj_E$u&eSrC7dKv-n8}teiRj-8fg-iY%21yo%khP54oHus!Wh{{ z(7d%MwAZ}<@`E<)R`v>B-aA@ECjkD}TRr)ZZvUOv<%>%D+{ZBn%~b>L_aslGa+F^C z34lT?-ERH~3km3H>(R~ zA#wP~Sw`ISCfw^-F1lYiY|)ZD#Jc=|5EZdtNwu;J-@yd z6+LB&xPgC3Nm0TB+l&zdc|K&*lzfS0OxC_vRPH6eiby6u;@acpN$yc?H;2Gg2}e8_vEkT?k?A-F}t$08+a9Y zwALV&x;0AiCy^Fi3(xm265T0Lb29a8`a#vigCkP0)VV}sVQE{}mWuuYUZ^d^sxRWn zpV#xvz2DCDJ_u0?oMrVgZz+ zPh+Y+NK`lx*1S4uhm1Q_eSVDF{;Gd`r88B=@6^u~#|2CwRzfV-KL2$ ztQ*#mf7-DtpQmlBp%xDh80ABd8*tUM^|C3=IO#L34`*9hK5t@`#3 z)%vShH@*JX%Pb-DAE=G2$+RQ*1W%bJkv~8G@3T5zL}R%!K1+r-*X_|>nXmU?M$z9w z%04aUP7#*;;P#j~1lm2|lK!Wqn92<&N9W;Ibf3IHRL@$ue7}a@ z_=l!;d&{(seWs*)tTF7mw%TP;8TcpiTSv~P`k#FMQ}8=89QlF-^H;n55m4*7J|$NjG|DAypLoOh@f(wWQu#`rP z9gJ1iRucH$j&bs!7+!u)uXkEZc{?Rg$g9^Tn7^W;v%9k)7pQxV8qbbO)E|;MTkiBh zuLISsm&cQrUmUMmJtBfxm>UNe569@ViNmjC#wDgd)xQ94T*#oTNEZ)MmQLr-eeG!K zZ;(mP#^Y5Eq~_o3wUuHIkrZi3(BQ_PIB1Objl4~2=8b5U2=R$RVQrm^@Dl6g{HEjF8zRrQljT{VB`O-rWh!G%@R`F98+$z)qX zfN2_Za)>Hwljd5Dq}D`~08?IvO9Kk+X|iymV_4tl2}P^KXvL6)_ll7wvVx0rsG+z@ z;lXHriSr&jTmZ8*>hp5*F2hxcNSQ+;kcRTHMoU2FI8*r>*UrzUeF2@dsxQ9=-k?w< zO8ep_`0zu?F0=Mmb8JkiB&KmsaDLR!aBgr-EQV`M79~ateLktPJv0%L%qSA2Oz-p0 zKx%pNki-i=B99;5*JB6pLE)J6Tn}iqZY)W&Nht+To-T(|j6FxpRiHxDDfWK7@8T?s zw8u@}hA;91@RQ>bg(`ps_>V${`;yh-w-tnZcAvb;_(w&&HTk4Lia_uk!+CI5vcuR4 za@7TCga`QFkl=ocs)cvo)>$_B8~&6ONOX}Y^ydxEfCc0o$f8|EMSan^JLPvfoEN3H zXVZqM`RC6By#fxWJT9dJyPt^)%zo7dO+cK>Jgvqu<#$$hR#v%!d{0bkvi>iqX@knHN_AxCymuDl^rg@tO*;X%=) zaa_B&e@K?=&G*0;l>r$@KEmqP7lz`=Jf;S9y!(CYqSf;T+K1=(lRLP+Y_%eJBY^{> zyLoQqe;PNEaX!AJRp!V2;$nPGAHf8+GWVyUC8f}){$MQ><5KSQHLm=&w}bH4vdZW8 zM$V$zQcelxdJP@{lrGajMzA@FKOp0}mK215pi5LTMlLS}^Xm2IiRO$dBbSG;9Zw%x#^U3{nuq z2$(KSBB;Xvk0a7Fcwij#kyR$_%B;M==-zl+O5tdGp%miC|BP($R^s}iyk986smFug z6R)7#wGe0!H+o`J1uzPS*V)lPg_Mjjq_-l=+fY;2l2S8ril^aXhrmfUH6n_eB=Y2P9itVbzw-DF&flPwxKL;;R( zfm#@ojETbnxS^qG>*R`t=tcegBkBBZ7H^{%=N@H;)xV zk7R9H?+~Xsb8m2d_7Kea_Xm%|r@i*!#hWQg)L^qPQBWyF8|61K6*P3EoeI#PMByF- z{5&sH*R$*gX%eI&K+1H*CG6o5IKW3V>VqJ{|7N?K_kFOa@B=;}CN_q9zaBbOROHcU zlcLy%4rssG9;W2ugDVf?0*s7lUJVrTW)o@Q7V4x8?2OWeUms$X>AYqMtw~d6TfHF4 zyWair;n<=Mn>C4tNUBf(WJZqr??FEpjQ1vQ_fnBEv|TYw_V&8RvbqWfGClGV@uap_ zCbR^q6tki8s82R&R~CWjK#!Y?Gh|;^J;YjXosdOv3%rXYko84nO7UFd8LI-~IcTsf zVudVHEkEE1lc)UKyAn;*c3h}-eh7LUUEtyP;PK%3=etzosG{s<`xW3a>hjQ<7nISf zM?)(WUI>RHQnRRVIQb|Xv-DIcEoe|xj0@yDK4n>3JNSguecbG1&RsiUB8E$fQ2%3^ zXu2&X3tTf&ekMH&;z(A$e-|UN{pKl7i^Yc5r)mL$M zjNg5Os_1{Kgw*M;z$(&<(jb#XY5w2_e{aX^wdk!9kjJL@)6|Ud*G2xERij7n*vl^l z=YrfMu-vtlB5f@b@Oa>uu!zSz0`yeUmx;O236kcR0wSJ4J!2*&jJ3{##ng|w)eR|6I&i>3_p|Ah8T`~J^E+4ar z+P|IQp&#tLbq!}BlZ~vv)9`DmhJS1BN*PJ8?rw6i35&_@7%XmLySQ9B|Hk|R{g`zF z1nT%RxO9_pHE4GCa_TxRJC5nFZ=D%_%Wbtg-<^MLUA60-&0^T_S5Eytxsi0vA0o}2 zXEi?Lhu(9DC7y0-ISQU?m^>lFx7S%HQ)u;W>~RL=FNA!6g^s6MpWjafnTyt+*&*AY zwXJ()zsQ{0Gl(lecxf)Et=f(}&;vK>u=Mo(moS--HdndB#|wLAhh|GFt1_M?`(MFc zrP5II@%EyCuerAe$jgQ@^$6wTA=;Pa#Yqi1Vh+856Pn@Td}hGl^w zhk%Rm-pPTKeI|mpMjtlhzONmoxlX~F#%0WY1?>x=4t^}W*vbCda-&cTIQ0Z^kTf6VyEFh1bA==K7$Xuuk}?eUHk72|B*h* zD+Ch+?5F@>2$3Xve*Eu6yy?D0HypG+;ngf-OD8JhomF@)yx%ML-|0T|Lj=sZo0^sy*lgo1K=I7;;vlxUE3U zUT@098cQ92kQ2qk0vFvEs#-^q1wx-%iX?{dQQDwRc!bBF9H)2#vidFze_P^fX^ngFV1qJ~ zo3EI7tUB^V(!cNe^hEE$@iGH!NjD56g6}|lC{4j8F(lbS!8mcu%72uFLN5JvJcjYf z&m!;l<;g-1-&;B{86{HTQu0M>wG#l|XaN2-isAhEp@uAI^vY@HwEr}^ku=xCegJLR{^;dEcQGF;sq1CX=u@fxr{RuG|KspS z*=dhsmv`9n+v|nj*9*D6XJGS*NM643_)^!(!RnG_iRGsi5??%MzmvNp#-_1mi_(|W zQ<(lxCZ7Ns9SZ)VXT=j3OpGI?u5iUnpoVuG`qcEfu(%RtN!2yA7uKgo0!NYE$ujeC z`IozfRsnIaKk(Y!4AUlcu(_>%@iHHu#G-h@clf8K`NWx2I-c*gMO-wTLbJ;Fv!do- z&u^1wW#04-^1LM{C;mi7KolMlX5I3S`B9gNmL2tI7B(ROpwgpYovawP*7@*H)b!fz z#ctyD2xql(k3@gVq{ncGYz2kc-*R|N;-C@>Y>IZMn#SGDzC~ZjULZvkSTg9s$H%iM zWSD)((j_bp6mz4x_(3)Aofpqs_T@;2Rf~`nKyiM3dpf;-xf`b@|a@W zA8uFeK%w1j$$NoDnv%I?<^qk+YbN^-pk+E|?_5MsBUYKREuuiZj73x|WZTOx&hxYZ zGKE|n@c#r8oA`t8h+HUYm$Vdh_SbCn(rwMHxqQ3eE!&1%km7XvcS9`Do@m{RKp0_>bI?p zt&jRlyYNoBZN*iuZAN<4?=^A(q2oL3heBcKAU_{Ez3-Up)M@Dd`gW8GM+E(X64FNL zsG0E6eUxVB70*#UQ@vk{;MjcWDkpc^Ag-FJTEw^&Vj+`x&7ocfDVsD@4&P~&bl`0G zJ?43kBQ7$Qx3ns#E(Ebxvc-L;Av_kVNuE%{KlW^vUiYw!AH7a8tMzCtF(|%Au9iT6 zbd>xX<7UYh0y13g!s+)|x0MU}x_|uyXUc48H9O{v4j#Xn3m$6>#i<-vg;V;w zmn@L^1;0G7e+|mV-M`Ay!{BD)$Y1rq?`v%f7*niizFKm)9CFH{{kFqj zWxLK6l9e*w5ItKb0bc{~y7vM8?v&KA)oTC#O#*&pAd9(nytHn|evDqXO5)F2zxiKP zpZw%gpYF*uzSe@K|H%nIucZ0bBrJgm5-iiuq744c%Fy-)NRcMMF}Z2l|Fr;b5oQ`w zj86r9^IwaNQw)b{lj%SMwV8uCt`?uCc7f-kX73UO~DF+n^4WLUU@-Hfx{N$8&zqq9u~8?E={;AUo-v zDwT98bC2jE>Ef(BZ(`2+Z`z(_$2m2yo&(C*cC912GbU!VVBkH3Mt-)q( za~g;DLMymZ`quUA%Sw+Vn)p&?J!s7kN)V|QK^e^roH&KE;@jfJ)3-;jX8dU)v?FIq zAQf)@q>gjJG*?aMrp6qSbQF1FyD&dntGc-GX94~#7zZ>%Sj>m-X&4MY1VW5N<-y*i zl=fIXd@Ha9DqB?r*J=PsHyJ@^S2DpA3N`rR+^O}jE8$OOe&8u0>Xne|iFrkrUZ~aD zi`y+gFbnT{@!fUVI@j|Yl-uIvHFEU{G2`-PCxDL+Z-OlvXh%qROu$`keUUjWNn#zh zZHOPG+=Wkvec~1u74DA39oO!kk|sus#}p5wmwL2c6OqQlAl@tf#Jh*{O}FAYf6e8= z!NTXBPIA-1A+TfeQ!Wn2=8w!JGYO}U+u`L#M;)1`eFIH1vdtxHWA+&0$fU7JwUh1u;gDDB0?!%yhDw+{cJ3X>1{AG%nTd@xP}+rImY){~UG zlEck4-dNPxujy~m5m+L%v&CB33U}V$6;843-(3B2yb095njOeA3;0`? zDt0`3cL2p(@&3>;dF?es_^g)l1G*J8n4h-E1;x!zl)ZQQ#|fTkW+_DPqfxli|jq_ygJg|5^OXS z9~m8azWyxs`geZC%1TZKr1PNL@4dTRO~T%$*c5k&+uHSaM#RLQsq2#Guq(Era%dD# zyBzv78~`La+~*DxTfBYQ(@M)wCV6Za)EkbOG){O038gMSx7~-$?xB9$ynAaxD&8FJ zaBO{>g054^e7Ee&u+W34_SpB_zu<-O32>->iFo5u?`fBdbSHyi(vLN_+OY%ENa_+E z0O$4j?QLk_tA{%z>b_F6%V`eXb-KP(2Z)Yl0{~K1DafzG!_-zosg#S`HWSynylM~G ziC#y8!U5UT{OwZR(%t7kQM&u#Ff0%h!=A1z4&Hg<@ew*340>8Gu_QF5a6Zasli%~~ z#Qu{#t0?QN@xK{I82_W&yL&z8K&}m4b=||b5Sn+;?Yrdv`xoIgEjwR%c>=sVf;&?E z!cSLO`JO;%QN3&GmZpSttWLUkN7k3raC?`JMP+P%e7vIX#Ex z|244G3MG+2vnkBWcb=F#o126hH5Hs!`2E~P)6#5X)t+?n1@;SdLDXfb>Zbb zDj+WRWH+#3T82!+5M$cmZ&Fr%IiPKP@`uEY^@N+$0N6d;2smdPj5uI4=tpBdv3xH8OI2%8g> zT8K&U`#wp_5^~d8yEJ*Yn}1aRrqMSBo72&=m>6P<^L{uR-dNh&X|8mSpSIJ3=}n0( z)hGc7v#5M?2qhk?38p!H-qEyke~a|D)uLxGNu95DAu=wMaG99&a`>b($;tIx2*6{vToTJyxXQngay3EhLiwJj5)-ej= zlUi#ppHYtdT~$=rYZF8ENXg2zoT>d0kaW=RMz*&jJu_dy_ZOduTWJeQ=eQFscx>T$ zH-@x!aq*S;qY-E8@@Y2K5BrkC5G=3~*31UH81uuR{co#8x-G?5{_l^g&;Qw~cIH6! zU`&v7EksX97^b+&YgX$vZ34rV6LOq3;}cJ{p@7TsK4JswSmC&Sd`aYBUDAMRcSNt0 zi!kn8#;1xjzl@F5^-o+uwWE`=u1gxez8_^@!H#PR;|F|1UFM!s@4Xf`v6>?p5_<`k ziJSrcI==n7i_E!=rzL(GgKYD7829Z*;J%F{ zKw+b>@4(T5713Ne$2sTcdKRg+WPgh7#@+0(|0+#d+GnhJ(9d$rTjnxPQoU=Un}HLW z>EAK!CA%)aX7I>JuS7+UI;G*57Nnyep2hUr&6ti5SG(rtvgg9jc9R3TRj}L(FNomAG$5&1dAV47Atm4E@PrW-j;Ga2@WbZaPexF~x z5HN)TV727XjkOZxj%S_58RPtFSBh(n%a3f~k`!xl(G6M?R< zfp_#5(w9q_Jq4I_Xb`5r_y1g31H{tK3oH8(r>nc+*s~Ak!<2il_8hJgo0ngM(zrw3 z@%3vidox$vfIUL+b8^I_CV5gZqQ?1`vAT$En(4qU5cHH`dtG)(hKa`XU$p#RE!*;# z^{QV;=YnVJimboW(yQ6aS6gDRy|jME8$G{!LBeT@M#l&?~vn_>=2C|axB_K`$G zI5gzrS$41$yCI>DZ5_^H(PmOxS|+P2!ZVo4be@l#QrUj%uM%Hxih{s(Rdz$jLUXga zYlfMQS~wO>Z?pnA=%hUN0?r=)q^WB&{f|>w$dri6`IyJ)yH_Btwr~~wubJ{k?W<>8 z8gG4<Pa<=TEY&`T)gfQ@LO=u z?r?;}n7rm(atpkY=bF8C{z%5O&S2u6f!t?i|3vTlz5?f9JRqk0JIy*cjp} zJpiCP>An(X>DNi~4%Xjjx%83aKJE}is27YpOFCfoV z26TjV?0bp+KknW-tgW@%7Y#1Otp$n)*P=yN(Bj2{ySqd11(ZUIyF+nkaF^f|cbAY* zN^uBKtcAAgq~Evq-RIo1@A?1S@jS_xugvk<%sXes9OE~jsR08saHBb|p!wngFQ@L# zK@5_2c--8E>9y?bY919GYvkC>Ku`i%v?8EJiI*&zS)LF(q&ilfTGwC!3)=46p;S+8 z=bBi_BSwL#lb{M5tkG+WW>zXOJFOv2XR?;K6~C0-8voV)53!NeDU#3y2LKq5{q@*@ z^6Tj%A(6O9ytiC6_ykrBX1R(6D`*pJ++e?8k-KUM`%dp7E5aVh{Z2j_fbl9K|5}Ak z(4u3lXAYGjXBN;I5U|-fq>CN?9j#5!S5h{xCB&a&Vq{ZX-`2{G7!G>PapnV0UBsr= zqyu0Ho?h=r|N4FL7ccz&gTVdu{CwX7nR8_P0DDNdR6RpU2UsupQVETIcnUUPD8330JETqQvfRgSDB z1b-e;Gj{#X$UnS(OL%P%%6jkg+1v1803H89%m6pXk)X;7|2HmS;e)*mOC+PCIx1ZgS%+DiI*PK)Z&|cr&hy4iu zyLT?}^xi1%z)cGI8%j{c4Xqw#8mT13G+v^6vZ)EaMtx|HZBIktpIU#-Ut=HoUht_< zGgVl2Xzgr|DD=6lm%(O+G1xuX)PJ%^i{r?qnzAkwj|4##h1K~|oIwkb(_ObDYL-`; z0>Par${?~EvtuYAfH3DZWgCg#bxW|i=P|Y>O^&HanTgGD3z{vL^V?`|Z{XmXF<2z7 zL&U{W9gNys zivY*hf*!^5n!-AC~ja*__T)b$^e~`j*VIuESDUGu- z+UQt7X7Lmbbe5&x8m!-M_q1BvnuuKv@%r9fvy5#jDlsF`& z_p&BAKYHgNeW*|&LMQ+)b`<>QO6Np#e87!3PtBi=T;_k~B)*<%Y;1u#>5dNQKn;GI z>1w z%p|T}?2N6}*=|f;AxfSLjebEI5^brZ94c)SXxA|=vG4Zb?GL|Iat^xf+#U06NIKXz zE3?$7&+*%JW_NC5Fk6S18>-IuUetMt{vwEp{6dXbwE4;B-86PwdJdOI>1p!CCZTR2 zAdO4)IZZMY8lXQe+{zs}NPNL7CA8tkO^F|@b^eq%gmxRXyEi%UE@4n4_?xo*^>n*u zQuRUgj3R&wP_5P8jI`$KZ*;4o6qv3aFOBxx&*dTjhG!8UOvyX9aWOgYhZRL$NwgxBx8;IL{#<;^3;|c)`XhucBeIR@9g)?eAif?(4sCc6Dz5s%;^VDgBaVsU}sMDLkeVsL^vrC z4y-N=o$_!jOugW}nezps1ZFX6T2Jd=i^=>t+r65qDg<3s*JZDPf^&I>VH}d9`Q5)_JU-NU;fcrOl zj&wS;r@`m__PZN4VqQ)>b?A4mOwJg*HoZs^8U9|d23G5Dxc92BJ%2}o<2d(be-kp= zFS;Me5DM82Jl|mo#yJklS%-{xnk`$x)w4pTl(yVdR;HFA3bokmeB7b%R&7q{-8M-7 zOoyk&he?zkH>Cors4Y7O#h>3SF!C?jTyL3k*Z@7IHf{WGEJ_So04^Nm@ee7opNI*;dIFrgJY-1RsN;m zFy;)~2VA@_h}&X z(V*}5@73F|_*k-GigybD%!gyIoew+ftJmG@0}XC{ZpC4bt)G>xHo?lox?pMp!aDNd zziVXiNz049+C?+l)b(`LBQY_0{)zZyfi_gJ>n*=eA#PiJKM)DRXGQ~~0#h}>Aeu9* zR*XFq&u_7@;#l3G+W z03$BQ6_cIR^5^E4;5{mQRkB!Y0>R>e@ZS$NzkkclUYws|w#pzMcjC&zAD|y|p-}!` zZCe*bnw|Q6hto?xe97^npJh`;;gc~dNC?IBa(_pRSnw9q;L0M@K}cbnUV z_>S4WOK`1K=wbap|2w5<1p)vyc#c8tanTJm;AEbG@CccgI0}7$Iz|F8?Uy-sh4b8U ze$>S?w#?w}M0j~@`Z1iRtF;}&7(~x!CYxFd3l+$Ou|>q)eNz;B5DkgvIgH|SusJVV zn-P_m#hUK=?bNT;#3*>P?W})-2P)fI7Tz=oB*=?(9L|8b6{UMY7Hj*m&Mli5Rlhd|e#oNJK4DJmeue&_>F0f^#pMG`iXX-}_ZKcC@PqYE4;%Nv ze1E&Y+eJTphUCvD+dtgwaHhkinZkpr-KTPs!`|RUKUzHadhYgoAlPpw;t~1t zaPpSuou(2cDH#YmTJhE3_E7j$mZ3nJq1sbt$D{2HN(lJyZ%1%OVd*Iz_zT$!VPnn| ze$TAkyquK}?v(U>M#Bpu)kwKZIp*(jQX&$99)5E^Z8V7M-ZB>JbxvXdQ(?&z5va=7 zKJi9gdU1`uFfo!Vu&npPCumP&D2{(8*H#(kA@oAXr*{Bnt3^GaU)Rn8YlSzY(F6Os ztDmZUw3TJu;^9@q<9flVVeh(A{um(oqsjYx6Anxc4Xy+^QmkcS^8-hfcZ=tvl`|yn z6v&CKUR#!f59uGG}Ch%AIkb{DNYCt<-Lrh(_yx5&S$H zdWfjM5DDJCufT*x0?_Ewcqf0BXbKI1sJJyRD>_%&ef^^w!{g_DYp24Kie6bb?0(yG ztj`d95vI0NR*zculZ0Go^v1VDYYag0kcX|nnZEY%fF%`2j_$etX6e&Ws7KVvLtRRo zTP;McYS|SLTVKoW+|Odta*m}|cPGq3SQSJ-NMF0@XH}^Kq@+%RBv$gPgB2O_XY9D> zBx@WUh%}>J({Riv`WHJy--b+Y&k(ImQRVGQ!vuq0%btBokx;?Dc+LHFSz<(kf`&|U z)x@K&Lw@Y|k;1jv5X@`G(__|t{po5s2`*Udq!IF+!DMa+pC(vB%{K0R<@x3L=D0=3 zk6FKv@BW*kBH3s3zOBMwLl)&`?-b!mqgYE7YA~jbb1-EfeU2l1c=pq`%Mjkg>HrfP zKz>_MLWLmD$+u&egm4weS%cci>RSdjCQe=n2A)^>0IBq~#fPT#^TR$SXbrFojiezn zqisD5nBB>jOr9geP#LnC#$p@~i@1Wdh94@HbeUbAcL%`wsdG4>mi{Jr) z>v^V*zP|zQKpvrH_Xv1P0z>gPiE_{I=3mFhLNlW;bTwC$(QmVLRl*-hV88O_|8j#v zE`s+jAc*tRi;KAd*WV`qTSb7|S0*80?0jpXp>fH}Vz)R4U23vKeIfvJf4`O6;l<7e z_^;jz)4q#(w;aLl_48FFeYEpAUWMRx6G>96V<|) zUGtsGnf-Lw`I}VsulxbVi`~Mo3)!6x=&Jf~Ss5HOixZIe!s?2m=>SsJB(|aXZ zBtNf;Tfkb)1oYO6VviF0JW*R_{*k;Qyuxb4dg|V8$nm`;LxBF#P<5vIdWti-v94)~xL;mxjLPgl1*7 zt16YkOyYz%B}-zNtGH@X{Md?!utO_<9Z`jOrD#9 zj%y=BmxH@3JKjMFvmIx_ zBHS7Z?_Jtnbm%JOxobsNz84a1cH#agTFIxSz>A@Qt16DeF|48xZSSDf(vp`Z?&6R| z9dE15tCgNsqN=*6szGUM53&aWHq_nODPJfGXDVk-G6}TRA#PxbWzRFduOKF zs{2trKC@X1za(=hOO499Y%wc|tC_oMgkw|P(Zse&UvnybS*u)AZ>5#c1*8|BKi1>{ z9EzVZfQ!~cc931?QwEa>`Pmkvcp+i4Ew&g;2H~VfL1G+ zt*Pwioce*u7tt{OjsojE( z!UQHyZI`6y+e6~;T883=DkCm^LRUZ}I_#MB*qUmE70xUxO<8pLVvZ(l+|=q&L@~>~Q5vJ!{+5W=VHN*z zin6!b<*b5xTpYk>2RD2i;eV|ArKcdIb3}{UTcz_g0I4B;E7e%b>!A=PHUv$pqFjNAuU=W+_B;Dc&a>f(=2XelM+bRT z$YpRFs$Kj=^q}_g(bV%ibIDm1ui54EO`sd@0a9sXOyyoZ?xia1g=Z~A>b+;`M|!q} zNa<97eFMd-PpnZ}N4uBr&!h`xVoNdr zhwjl~HWRU_K2u{$Ee(HyUHig-jcp>NH<_bPXeXDhrq)yTzEEZ=9=Hd6PoXIYPP4bp z<*}DeH`ZtAo!gS)i0<+o>CEX2yY*zAA~j-s?w+9W5nDN*S(nXlRqvJo^vyhk=4E0o z2l%Ex!Sc~VyI&>@ryEvy?8F$v)uy>{tEYQnQHCj;nyc;_pHR8pN>-Aph7A&fy+|5^ z-x6S2AjIV=nEV@XUtWvk2wX7PW?J?vy%(J-QNw1P02hHZYQAPwBd8rDNcBXcz+>IX zTe)vK6>>k09s)nQZPjKXd(DwOyNVTYFrI*b0`j+A}z^vrY=~=(o?) z+*(7`I79p5N2jXZP9axW`SpDm$=x@w=t}^l4V#Ev^5g&0Z)=8dsNs zABH8z2y~S2K$0w4(xy}RSgOgm0UykZkzr>8eDLST{btHrx{vjNYL_4kxl5>gDygoC zS@+PjZ^!o?^P%}Hk7=oQ*Lwm~BHQ(p#vRZt|sLydTV$sgNSA4zbR!i(c&Rd$~r(jJaUV6*?>vkA1wVOY3y5hVxw35 zYYT7ri$nt3;XU^O%0=e-6VlqBH@vz0A65BT31W21@Y#W2LS_JF(;TMb2h!KXoc*6( z_pM2+`RNbFK-#;fn&{OxE=LgEXb@m6U*@{BC+(){zBPqcE+#iKr!5PxjZr3wrOPxt z&zci4V|izlrek^<3k$uBBs*IU0o)YpDdL8(#dZ1JD(`^mb;L2e6u`Mkn!hF|-0#LS z7*!_w}QRDa* zGH=V^2gfFzZvAa_YAPQYxR&sBu1(b8gF~{FL;-z9^%@JR(`JRa_lI)`y__f2!}n-! zaDJzT&L=N`l2Ul?Pdi`B%5FqrGl%>vzbjQDTHllf9s!~lZ&=HoyOB_uMJ**%z0)f= zmky@ffRvaEHYV>M6-A%6mutm$iCU-KlL^H*w-5j;dR1K*NNV1M!%bw>oKznW)9y_?w9*L&9*xis|akEC_sbPfuK#R%$XJEChslw4Rs81Y{yqZCSN~61CP=g z%{tVn)y`zdSxP8G2{3fxYic=a6x!CjWQBDlo4WFmPd`JpA`HV{O^7-1W2=1)U=ec# zFFSY-14D<(P3g2Dj>tSef^Z{=Cy0xbxaYqbU#y=op7N9si2pKCt#Yh=0T$_V4rang z3kn_487)wlz$&|c6BF}m7%8pn!KwpOR)4ZZ9KSmEt1tIv%h=BroL)H!f z`;y6kC}CMS4o_yTj5@HKOwu4u}8H}c$*ADI}M%9j!E_C!1yZE8WZ0?Q0N)u zXfG%gek6hp!kQ(EWra3y5lSFLh-=LerzBwV>5kE*J*{uj&SjR>zzBA#C$u~TmcJ{hI%{N9SMTiB zN(hr?^sj2UbQypEt8(!NOH|pKjlb$v6_Kf$Wn19|3{*HyaxN(4XHb_v`Eb8u6zcn+N{@NB%N z3sO;nO`T0^Lyz?wbe0xswMq*NUktvT>qn|QISnQuQ4v5<9Ft3rtnSeqRRx~vQG;$V zES5R_WV(6=p)4sw|=^X=ZP@=W9>E?!1>)-uRSJR!KM-QdiZ*IP}?TVY{)$^u$i>zlB4K0w4#En#lpkSh38Tv33R{ad5Z6(zRc~{Jibu6ecrQ;vrX{kjJr<4 zsXDK@=ljY2>-^Jo%4tM{dW*bx{&E8`oLcD__w#D=$B_N2Ij(m5Y?GyYJaV-4kFJu9 zQl7UyFj}pK-kcq|Pw29$PsH91>}^F|fGsgQsAK4pmz9EZK?u!b6^2Ty@HVE7oO}#i zfx3O>aLTjbNA+~<@^!G$8=6ujp3)?ql#vA!Iue!Hos2ocM!3w1(iI3mqHl1s0b)=lT?+zlHk+3O5>drZA9 zh~=4?l`S<-EOnbpV^W%o_KdjXplr5Eew6==9zyO{kJ#yyB#bUpQp@@V)O6P^{J zPM^XUN?ZnFeon_+C!`tmIlKnLT6Ka$pB;lGZH+4~Y1`VC2V6w`r!R;XOe zseY@)@ecTEe-j7kpI*6Huf!(bNG{%12PAA)&U3a9ASom}bd;Jo_?UFx`*M}7DIZ)P zCE;T$nNw)xcCN=Uqy(MrwEvXkp(hVavJm%Ze{+}tF(ie%2823Dm_loD}9;V?NrWvhE<3Il!00@D5{XD5P^Z17brYMB|FZ+KlVPi004-f<*NNDAsSW``p?XN*ZV(w6QBhHXHwJE(5Nu^a~h|1aWJ*8va^>SY3WdH+>H03i6!DMa)C8fF_h z1jm06T9<d0>?(Sq2>t*hp;rc&fp%~PVWNlh z|5y5ZAMEBaa1E{ZC=Lx{%r2XcLQP$?pK$pw<6feJY0w1_Cb1SwF<){06??~)%H=`u zkxC*8OE3DjMsGqYTa6e%lBYLSoqWB^$+(f-B#Rglm7Ynp2wHtobUL(r=0m=H!bA;( zw9dt@=RcW?k&0R~-;r4lPsub-3(veTJ80j*GP^J6TL&n*e7 z8ai#pwej3FSx@Q`yh~yEs_iW;RxJ%k=trjfH#We@cZd=)=?a+w}3K)5JY3N8O9Q(m3rRlMuX4r+tke33EVG7bHQ(JC_xA`dQ zUOH{K)`ql(#a{uUc^9A25TDIOP$~O;jMPH3pWb0gS28{Q_;x#czTiAis6xhaFUP*{ ze!hA!Q8%^2#a3zLD`}%F&1Wf=XKxUf<=qAEVkj}uY2KA+eK2Xb^+2Tgz4%_nu#ANPI4OHEk7G&9tovj<3e%*;c_D1}IrbY9 z0)D>^mAzygRYNjFYQmsbz0M*%2*S0% zn&8itKvITMaP_lYc6`ua*mJO(q7ctD-kKtI@@1Wy;rAH>$wxtoc05_S=s+M3bBStr`x%YL6Uh_6wH7(IIDm7 zgZ;c0?T#s%=dbhEp&z43h|YikA<=Bk?Qhoj6jzdnRzEk^STAee1buMtj*pp8%;n_B zJC?=wcHx+iaUGS-ZXEY*ohE@^X)L63nR_ifz5^x`PG4QKbqg9M-f1$dgOG?IjV+S* zCJM2Ivdl_0z4&g7b9MAasr0JrSuyW{35xjTPFpp~r8`d;8Ig=;U%g`EhJ&z`s9b}y zkDYH9F7Y;TK@JuH9T%%5bUV5wB#|c#dwrJg_ZI_}imwr&aq$hQg@=p*17Xtp8FP4z4i?<41t~9gJLrbPTktGaZ*F#?lb=w1L6n1gUF4312B0$ zqmOGadHyLw^Iw0Wx-MXYe}iz8wFWV$0|D6JRCIC>U2cy-{dX52z7MTX9YlvaWJYKG z`5Xb1t-b=3EhDkPp8?9o=+pzc#t}LyEc3tOA~yVye+FQ!L!Wbx7LT@54E@9YeaZ&9 z{sQ`Q3m`W{=a&4t5Y2+nsmFI{`9DW-?DMo7k%W7Rg#02A7#O-Brhf+CVG98UQvA5z zvIbpJgDUnaUQL1?9-PFb5=vL=1iR;8(DFzClTMVpu7Wxl`YDD>9s>lx{IkhM0#MEJ zt3dTkYW24)3%IG#3WVtZto2Mz7DN&CbwP6!KQ#})r9?*ugINd21<=tc!2qSnb16mA zeZLC^a53otsi4&Hn2{xDSqksDukB8CRn=J7sW6nX2=OaHP=gpub*N6MGOe?&0Vd_q zlaxs6@hCd1i}tHlsdcl>)Ahh_X(8hfse0jt5wlM2ZN?6_45=`vAWUlQ1CvpI&lxCm z*FFaGdp{c7K2W>96Viv&XLLX!mSq#VXPVB6E`nFCX`~MPBupAkX1Dj(EKa-bkRk39 zDsR4E(%eZmkMB4)LVCi;Q`vUJK7iedW)K#zPCx&1B&@e%Zy8|*YY=hjGZ$yR1L~q1?MS0zu=?)j0*5Z%^cQ0Ao*Ka|+mGst*BGlxVH2-} z!j;O%D#Pb>c~Tnvk`^1QGQJEjwU*#AAnI4Bu<4lpCs667SINBdU@KLYE-v>s}nXNeNhYo za4iQZ0wbkkk0LJ)&4tg<_0VMzibW*Me69fft0nibp z|2Go!)}g+kS|A2s9nS+Wxj#F81T!ZBC^?dZhR&tB#x_`sXDa(^OsSNMn+Dp!)xl3Qwg??-w!?uEZb13W zoL5!gDoOPtTsb2digfvwRXDnazn1IBzKQ; zkFt#|sCcnT@r=QB zT{Wyt<>l24FtaMlvRJWARWj$lGCnrW&$>PQ{rc!{jmA02!LJ_I0c%Z%B3_#%)&UN) z^G1IOTE%{6Cc{5@UUd%&k@bc7!274#aAI8ND9?2QWzk+63TTj?i2?q}mqCd}!FpdJ z#w@McG(ywtX+>uPsEdT`{eh>hzIlArFLa2Fb__MIm*67yvv&!-2D2t3`vkMVF6pPG zSnIVyK3*G_C><1y)`3%-pT-t#G0$FNec!|FGQX|nq*w9DOrGI+0HKu%16hjz)W8G0 z`wyj(^gE~Wk3U<&(;|qXsSaSCf#W?kFM^AUyUoJN0+6A-KNy}g-AfR6K4p;}S@4$J zz7~<)bsu``@t^`KUXt}IPOhx#a~iyMD2RAwCG>7bdgdxNuK8;}@j1??BCnUP3dDjL z%yvry+}>Xl$(<3ha=jChn7OZK$dWy{3(BK{#P4o?84sJgUFGUQ@0R^s&T;%_`6;WnM!upZCzs^cD4HFq>Wa{~K}j!FqwJ3sFHaZ;jc zSLQP@i5JW<--;}8S!6idijE7p5AE7wEgxm_mVhH>W@bi2*cK~fwP$a2rUde!@^aM9 zp;ausdbsbfc@(K#9XH-ZC#8Wt=O4s=w9Uq5aXh9|KM=>ZXHB}zAVE( zvp?YY6#eBL@X(^QW(mI+k})0(=cf>VKh5qlz7{{0#K6%7Q;~8T zFV^1fX7}BXC$vd#g&Bz=R+mNSdyXq8$!R&7yX_1|4WkTK-&ZI~t zAzeJ7rzC!I5aXMEbCG@p;1%jxw4HExf+JXwOd$;rzgQ=$TFju!Tys7Dw7BFpx0jm{ z!)6GDig#V3oyMldw@x>uNbAs{npHEPp7{FI_++zHZNN`IokxOrs3bIbpNrTX^pvYd zlP7=BKJ?iLaq3bHNT^B@x2nr$=tBE?WT#Ok447&fsX-5su+y7WzS;i#fEbA>6Zeg8 zE8}MN;jfo4T*r5;tN)BQ{bXlaIsA+WN`?81s)&d{bC^dMT++0IT6cTvXPiP)FWh>|8 zdSa+s!3))`qb^ZaLZrxa7V#LlBi#iG3pH4Solo@gc;4c-;o#TnRPwaNi*n(ykWFA$ zl$7daIxEC*16=f?T;!eo)sJ^)@l$}f@dn&DG7GzITq4E(Nji&VoMA_FAmo*(x}#0{ z(=gHJN#iem1MqqNK?0&1|0zKqbfIrFKS1(EzW`+5pCB^uZ*=A$KF=_^{5wG2=;0l@ z+-g9$ZhpUU`3H<>^W(4eZ)<-G{+b(8PUncsm#udS^0^mQT7paZSn**E1#Zp`&^3Bi zw$owtwm&i&mpi9;w~;n-bOp-K#ss?o9juaxSWzBW%|mMeX>SU)XHQkX-3Q6rv>(0B zr1nL)vb{xY;k$O)^Cj6jhzm_lAyC#&1T@SE?mZoDRPQq9%~`l<`Gchk3W~R8V3tVX zxeS6OJ=`>LVTO4P6r*My%CC*mQ1>0@m&R8@Wh-g!ApuLwC@z=;ggnCKdv(bi#z5f7 zW*40Kt9^OWd$JVD=AhzJ8(eyCH)FU84XU-5}k`)n9cQ-G_u>bvaHAa)aCQ0 z_km{no9$l_#nN%^UTuBO&)byMljbGoC3Ca5OjS<50_`+{?uMkld{9iDj3lBpp5 zde1|M@NWo`I;Uj}no$X9VJcW(3W~cvhuH0yc70b@$LrgZ4!I8bVGfg-bNK2%re#)V zuE?lK$I#1}i6S`r5dZyHdx`n#z?*vHS(CeGdtRu+iJG_ZmSF-^3VLQDtC>Nuts<*Z zdp0F5(hR2kI2vHMZ*R95?&#>Qf2hxplkZD5b%HR-6Y-N;r!G`izeweq5a|poh#S47 zD*USPrQ!{bU*%iM-rDYuhry8U*PD=fXQ>45dEu5oEf#Wo<>uz`h;JnD&97o*-u;#W zoZQb%?D*Q+g>M=VY-l^xx%eAv;OLix@!&A0b7`jaL(j7tW>C z=w^P9w)nATeno6cxOGIld&810yrg!u#-6R?2*mIr^VKG?qPG7e^ep+ceY(aO43@e^ zsS3~{q|q`F>vD?{Q$EmGEXYQ>IH3bCzej1|5ezxFsPMMtq`9hoPxgrseOzYeaxtAr z4!KrA^{_YOY+&^mKMl3sERb4+l5w=V=zbyB~P|6lZ4=rbwBDje}5&c55 z6ssZXHP``hsrZHRqhIC{a<*m5)PIh4`U&&b{o0Xn&Y<}x-;|)A9VF&QUTd`C$}b}F zvJj?-N?4Pu)G+)rSb|d8{|Yq(tEPv|dUt`r!@Hg+REt(p!esrVhJHg#xhjpL0vLe- zR;ow4&<*wKbF(+SgjS?$P5ve#>5EGNSbBRq&{0d>(EVa)NHo9hLl|!d{oNsy0Wn}nuO&U;L`zznh^t9>U5+<5GQTo|=az}kaZ(*( z2ZeqNv?sOColF#yh9!9`DBlNMYfxG2_zkBkGub9gBfB{(5nF2P)+a{i;%)>a)|<6i z+lpIt_#Joj_gVuoGivUq%G;~dHKzq=9~f~OF$Cgi-C^#t9|hp|&G!rh;s+Xexkbxw z{iW!%KZq4hX11V;dGd_2ht?s%Nu97BllGqMBafe{^z^Xqgv3v)c3n6{eWs{0RCz1e z2anqV+Tf(VQ4;oVCUMH&J{C&sb_N*iSSzqC2c$5x=#2MyAxvXPdGYxys{l zEUGFIj}yf-SLkJ{8?X<_dhxTl$6j&L^TDx)2?zn(RR|@GwjTLv^MB)K!s}rn>mX`|ah}Z`OUUgChZj9S_nlNFc;5pcj;m_A5rEb++8RAQ~oA;|s?D zrh9ZOv;(so4Q&l85Ykw%r1!AbI(2D?d*2n|!I$K3@!TyOPCaKPez>u$qIKNr=f~j- zex}#1*@g!0=3}E5^aThhW8vwRk7P5ss8UJ&tDkCC&c%XGmK7*{Hkg4P~!V~eT7u}XuKRp=Cqc{a7?Dt)>Pfst#% z+$q1*)uIeeOyz48d~zt+YptJ^EWQ7B+ovC}-QxeEt>Gq#1iY1>O!c0VuhG&G_ifQU z1RZ3{AvHzA^4fGf95F4t)IXzjuibzOi-q?mbmAT?1A}?oWzqMKt8jMtWdvdzq?B5%ph6Ek}W zoaBjJC(oX!t;xL6=-Eu53qmd6vm1IEyRKKZ+Ykja`#hYN^NFYWNI=B5XX44e=sz=) z#(W~^2I$y<25#l#BWSG^v6q=oc#9q2NwlxSW&vJRvVzTQ8zZFQo94&j`#OjU>)my))6{fQ zt5dcuaXEh>-C9Mu?3)T{Uf}CATZ^XU9A>gbqETLmiU)MA$G+Rg1A(Y1^T|E5YV>t% zTCa^)PDk!E?1S96Xa^V(;^*Ofay=p(6hh&$3zsmXF zlpp`+jOXHTFEr3tJ|O@rvI($21P}r&JOPkkMgruSac>|HZ@@b)0In(k^FJz(oTDuj z5NOR!2izm_KSZO0mNx+i-U9&kkrq0bn8Of=AE*N!ve$6l(gi@@Lq=@>OFI2{4+KJv zMh&F^c)fx^{=3f6!(b(7^-lA@7$pS&FbM$2g8<$%06KUFJP6>76DjMl>=79a60w6| zfB{$-?C`v;o*w{bTnsZEpbh{Z2*5zU(At^pfd4Iruj#ll5&z!&}{RtSKW%?Ef% z2*ALO1fX?B&~gaGAL!~zD1-|D;6!T1{d*Sv*P-&L@rJJ><~IIoFu4AX)|lCUR)VqP zykkTSy_tO`{?i#zEC3NetN_+s3IZ^v0&qbX7oo_};&M0(f5)D-=$=R0imyt+`wjzT z2}&M3U@S1zS82{+uS?J=>u!UO@oeH3 z&Xj_XDN&p&P4v|>sRGzm?E5nOLB~aLB=6!^c2p9sKZFE5gEMp2u!1HGl+p^N7uz5W zINgm%Nt6P+k%kp_OWc4*QJnS6M7hmGn`1JdeuzIet>*3ih+zcg|3yX zKbOTA9%ALhz^98jb>)tCeV*p4)G+5cZ;kn;JG{7ksNY$;d)Ho%^{k)p?Kd=Rf2xuh zeqRuPSyxQqoIkJUJ+0^4!8#TX!{Z{;*>uoii0}p#4vmBd!&Hfo4(irpfwb`aYzu3L zIIje+@#RgQFM(1iIg!|B1+wO2KgoW&yUrg1-J$MKRDQ)iDpmnf$Yke8{2wzhT za(g4S&(e>FtArXceI$>71hJ<+I)=7SyQqA!XkS$+MWi)NxNsXL`Se`sih21~TQ~*` zOS1>=^*o0&Nt&q~yk=!id-tO|V=erv->?CZ+kL}0!Jx%4MbzEu!o8i;n9z#Nd%lvnArqVB7F4Mt784l;3cKRF*s~m`5wV7FtbBITB#S zX>Y~(RDLngFSFWLIKFFK^eU0F7ScXoE>TNj*(;|ScfQ~Cu)t|q>>(oE7@G&n8_J;$ zUDma)KWUn5spQk8Rr0(av%8Phz*AFjQp1*<##gvsW7sVpPo5|B3K$(PhCzfd=LyZM z8N3Rw-1U;Xy@{gwfGzz$}kSKfpQ!s5k?{Fh{ zUMy+GtkLX+Q#o5F?d++Mz4aF{#xGv8Scm=O9>=%0$=ivwEE)_|%J>_dgf*zL=c_LZ zr*u1Ksj(3`{H|a6JQPai58GC5kXEzslufTm7c9i6%Z}@8HD&dPE6ExoEtx1cveEy89mJhgo=musD)IunB z9B-cq+q6G*MpjOjTTh-$z}J2(C!Z8b?N>W(p5r~m>gxIK6CLvH@=`L+sS-J}GR7XB zdQGtG`~^V+XVP0O&^jCKJI@kGs!n>l`20frZq0Pj$l^ljX5GZ{92Ih_ z8&ZnXNJ_bSa&mIuH*9^}D?R_g^KRz7d6JNLA6e`KG^!xNPR|2L_UpwOPY15Q3+HTh zl+?nSCx%9Ph1(Dulgoi3hREDnZz&+wZ(QXm$v7MT`JC#$+NPS#)-<-nr+OR3!Am#! z`j^4jQ$V^E+z)u6{Vli~Q7IM&&XfCN3#((JBZezO~3smhKnE+-pOh6aWFU; zH$k5)v9;28Sv2_NcckUSZ0`L!l^so!v`Cx;O;Bx{ zxW@{^ptHrU&|j8EO=02>xrc+1L(iF6xP;&4B*zb4B!~8l?#0(6d6@FBXlf0s+#Ie) zR*v*0AdAA>P&G%K>b|rbQj_EK`3DXj3Z64FaNQ8cSK4E879&R;7ubINH8U;C`X9BF z_tCG%wCg34J5z5Cv2ye3hrKuh5VBl$jHe<-N+<&N*3gQb2F$hB!6}S=%|(W@rgHqrJo!C4JG1-je!k!DAlaa%TiQN%XIM=d*u6k!`hJGEPOeU>kiABl~KHP6yB4(FrWV)Z79Q@m7BE$6F8M`SSQpm+qDy-IJei zbVv{uZLVX|dKkhB`oH8Ulutx#&6STOu4w>eO7I2dxdMTja+^)R+4gXY?IL7N<{iFUp4d@qL#m1@nboL$>k2Y|0b0Kx*i{)@=eY@we!^;S?3;X5>;# z085V7*y9RKaPK6iVHs$a0SSPb64nGOVT!Y{-juULS{ia~<1acY@iKY9*e?{P)X>bL z(fSg~PVLLh5N|P;C8_s~6IPs}9_1d3^ac6Y9u!9@_Z?~UoQX&R-!K`CvK~e4E?ub) zi`Z&xZGNFMSmx0Mpn>*`XyW8y1>#C|(lai7&ZntYcVl%>w!36WdZ;9xRrRyRtUKrS z;x$p@E03@(;zY(->Hwg5rT>PM6RwPzBUHijr{QOXgbMNK%@y3QxL7!lqwD9;25jlL z5v6Fttf$!cafSVtogHJr+iw$@wn01=^m={aBrZdSJqoDaLDLdfXtt|8SZO74Pk`rd!vDLGfSSpvg z2q^m9DNYg**e(P`v+;czhStn3I@xvdKPeSu34Pl363AHX(kxAyIIXrKk~0|Qoedi& zSGNC&S+Ic>IGS+Nt#5iZgiTlcISrwUV*p;smdDhb?-p;9Yaj%Thz)mb6vB_f?yIAT z%C%#>yoQ;T7MS$`RLz#`YYYi1!hL>9v!kbq_U z&ldve2ZvC0cTs2L$?WM$Qh?x0LH=_Am|StFA`FFQP%@lJythWo!P^*rJ!rnZATcRJ zO8A=?rRVS5c0;-@FsUcwyg&83i>PzAF>thQ1ya`>BXGRHBYz_N(CR$c&jLK$&;seg zkh3hlJ5w(%+jo8>iDQoW%4B-J@wRA(jw##ZH~?D4KD#YJb$vFv`_0S`4+)CABZ7nCP<$!GqypzV%9;Rn{(+A|41kgLXi;4-eS{ZTdzRZ)q_ zD@KLY7V0kby*`c_rs1H4EVtv3-S8gE7yR{Dr$nb0k-exDG37{^)?TFw!1qnm`UiQP z*Xg&H4grgJ#C}YpcQ-EW{W2n84`P~bwUO+54x6A>!t)C`v27QiXUNk1u9}8hsCn>? zV=p#1NCJ1FZgTLP3^to%lgu>17fvE-~DJ38!&d`mbDV{5bkHf1nB~~l84w^O; z65`$L-F%ObnO>Kf_iGuzf)HWX<8}_O$qC|Lv1Z!R-ckC7DG0N6d)G?{Cjj`QovIj$j%kK!#Lnc)Dw%MIWnHtA*qCD&j6ss&S~4 z17Ok8j?g*;AT4syJ zUg#T{+lNW?pV1qmny0dS7v!D{^v(nun6o?RoGy8w0s?l4Jf2yT)RngVE=DL`ba0=e z2k$sNWMVq^X*{5}{GSE&Ue03-oeme*9Y2zqwA7o0|BCOUhn!ysYrB5*-7oxLQZQF3 zKLstH(wyh-=J|zwQL^6Py-2oMcw=6oQZqQ<2DrB+s&ppYIY6Io{0!Ekr0F8fPhoK* zlr(};9zsu4`YrRJ2@U*KyjD^#e*L4ko)YaIoWQK_wHL(>9)r2<^4&d(mQhBQK z9Ol8)o34kW@JIb;Ds2AlvKAI8Wz|s61zBHZWVl^XRE_x>Xos9(UxKu)4On+`D4|fw>P!rI zlG3)nDmrE77eeVU3q=t&!*05AxHjV0!x51XMJUZMk_ z%Yc`I?F}~6cLo9MM&O9=_Hp@OhnE&%&Ew^IGX1x-Le0opim$h$86@wHrehQkT8^qW{)({hM>z$K)C8s}+ z8cKO2EN}&(g+~{Tk*vMok*O}wuJEw$hPUG#km>82>`c(*8>S$*l4cOuPsCV;bq){* zq!1oie|Uf_=n?X6cPI0G=kEzCl752y<3&NzD9F1Wvpv(2$AQ=$0T|7}gGvW&U~lH& zQ{fQ<69wRcP8)e1OSZC(KM?tBBW*uU*yq#Z7D8l4SR?(hKZ3 zHV(W1HP#gtw}?`KBnngrfGiqH>y;Sr?fmR^k3=f`opUT@%e8yLksXGlxK;dCxd8@W zJ!39~%@2J5_ek*QmE;nM*3ddn1c}gYe77o@buy4I%02)~% zT;{p$SZNsQc-RVkTzBE_rx_QBsjIA+M~@XnoPTE|YeEi^1La}i&h!||_|-LXCh|t# z{dN)%Mmh9C)A?aa-_zdg7*ipcDwPCJYRFW5>UvhPHC|BEhjl(T!5;35@zD99D}l`* zsCQv5A0+-Qq|x~L_H2B-zket*ecSVPUjE&-ZSCDI*m+&X(|V;v3+Y^s=#?s*1%BB+ zjX&)3gGeFP0}o$3h2%nbIrV2ah;;F#`gxBqBEHk#GUQ@N(BnFp6KN( zzuhh*=$RPAedJP<&{>edG`S<#7Vei(-s)5ZhWV|pN()r1KLZCcteV_~kXH>srymm+ zK<8(M_WSN+%`+&k8|2S0KY-Sk_bj8GEz^aGa+xG4me3j|Si512xl*G#s*{Hg93bG+ zhtXC4-tRq5aXvY(JL*b$I4JEi=Qp|Krt2nIA`P+yJED7d#YddDYOT~|0YGVnLAF_!pe9Mxlip)un@u*;D9f z=L>Kbey&vnI)1bt1PJCWaJ>BSvgs@0R|gk=v;=c0ne${PEk1v_UGhOzwo238(Gk{j zUHPcY&`_1&(w&o{_q>KT@VOVXQbNbk?MgrdnjvhvH_Nc{D+a^qIgKH%;683b(q7h0 z1{If9bIz?f)Fk@c3e5BS7i`xHclVlYzLx(0_VaH`$vqh_J1F)5j1>U`8KZbH zy~A2UGc6MKwWqgVM5BMfJD0A$j}%_H!9(zv=Orb;wp>m%-lk|sKCkh*l5PPztrEqY z{;HXI$R-T@B~?{yKNecxy9tx=obcQ~?@Tj*D9-2();wpJqRZ`Ph%{3O2NL3H4^5qI*WQz(vj#lNyu1v^Hs+QtPe zfgj3TlqUTLZ-36*t#L6t?fhc2QwUV)NjlW3q*$x8vBTQTIOxY#@EQ-}O3R;o=OOL& zo4;P*UJt>)Y_W6sQe%1eA~t(FX(l&aA z`bn7vlP@+UVNI6(CS(T_uDjkZy#|KwsoywBGLquwdP*}YJ9J>2HeuG9LD#(!FA)6+ z3UB<{120{^3`k8ezFPx(-V#GKS2wo@eFU*6k^sy0vkcXNFr`My#gQl^q#!@h6%h?e z790!Q5?{^F6~$pJyu4GlhOte{hhF+RPaeX?Ct}=jXCSa1eGCZJyXOI2+M(tR&=uhgOCer2<;5bz(F$g- zcot4b^JO!hhWqxUNl6SqS#E6*LotVIlRY_}77T_SGe}>WJ9XxH<3$#C7|a_5sd9bJ}`X037s*1acawhJk!_eD2dQ))pV6VhZPasvo`Z|ii*=Oj!+W~kyZVJfrJ&W0ny%&x zbi&V5{Uf%VuzPbyU%l``w>z6ayG;JJW!t;Kc6F_nA@|1M0i_S(>na&VHn}iQI{BQE zhV->>Q^H~g_PcKaq3Gt0AGwWzw}{#zxv~@x(ak`D_IWp1d2`9B&1O?XPQCVi$eVJR zwmols>xoaxCMBJv_N;-En2^4o`?`(bAh0uhv2JU%H_C1ujjRTvWcLooluumhBt#@c z6)dY9iJ>$SgW=oq#uwXz7j&Pme{0y9^>)5aN1fAGm8@K5AdIZqYC*x=XaR3ndr)W( zrKj$>wu^zZ7YrsBv>wTQ`~9Mj*RgUKie?tkG`eLP3uUcR!R*wQq7N+2s&m^eH76kp z=8R`)`n7eTceaAH&)b7e8a%flX%lSx(a_?1Ij3-OATf45zHi?Rt93!3>o6~IO$$&E z550|`24FXV_}031KA&w4ZV8r#4>E_z8dBqlKPgC^_z-%yYKCR%QUsI><&P1u+u53% z5n+N?-~rxSgl=b?W0~@oT=lx_NG$l0z(4vaE9Qhd=?0Fz3ocA zd_jqsN^)4o(M95oF!1dyc7h?bKz^uGWYkLSrS*Db7@%R8Es+CPjV;t0HV706-DgF* zH7B*R3>9sOh7q%+La~!+h{?IsRK}kW$72x-3M#RU04RvZRoL1IdDRF7RRCgyY~%b- z$UDru^vzfKxVt-QxuI2n*X=G4R6$?u0lE!cPDFig_vHkvCsQ6V zg$7GxTtO>O)&h@T4)*7YgB&YO1B!SQLNDwPGokk~0Xrup+!qHWg}m3(_x==g{-0mB z0wJ9}O_$|mBKH4;F`yMMKwW`KW`_9#p__-TU~$lA?C60fyg=_x=6;n4;wIuxn}xvv z6U%i6m=RMvsaziGd7_$oaS$fPR5IsGQqM-n9fG_gbSE3!SpcCgEe~jbs2T764W0*y zmb-`eiCEXy60{ei+!pSS=`yv7PiZFu*Om(gzA1WFz4SXCJ$a?`wYB2d%^~#!HhBIK zcu}443|9-bZ&vcMyGQY)zduLA~ycgGP%uHKSGydV{sHWy3l0^VmAd0>0QhJekZWqhh$TEazs8e^u5|mi zSUF$spS+OwDQ3!eP7tKg!ScLRP9;e)^w1M7of5j9No|^=F$a2AMG~llO75ef-!i1H z&d|h7u1^)}aLP{NgSwH&1koHWnnZ=mLlEC_@p;77I_ zEvn2m#Q|t<{Lu5KNz z*z|Gi_hTtkh6zfE%>U)SOJ^Br74e%Y&(M25HyR*PH^O!%BVbXhm31;@Nac!W*93^Y zf080aAI;$;)PtKcT6t7JQ2I$q&Tan5Z2u^-AlncI(<4Or4|BNUAEfYU8ycJ9&M+DE zle|k!Ni2@(z&T;Bf#A0#GVv=zIGz>!Z zs$?8X+~omgX5vS1u+I^@d|+Pqbc(+W7g2q7of@y~O5HY}Y*vqh#~lHSx?e!A?x?HCoO=moh|Fo4FrImL()$U^CQB5OOy& zzh_57TU-zsHMLj%ZRvnwbY*2-@i8nf=#v*_#L1(u*Z1row`qFAh^OwNMdUc*h8lSt zKFZ`P(2FKQyg%#_Qi0-jCJnAF`~2Tfga5D3ND;cM;Ea^0@E{;;`J`%$w6u{4r#zo} zLb~C}yP_#bV;v1wjw3*D4l@8k|k zWY}H^A)6fWa#NVHv^yx1N1$R005S9^r>aNwKpMfPoG0ziP7y zMfm|p0c`}$1HNtKTKGPo&-@htN3Ma(cHbJT3VJ-y1tuYy;8FGUKlug#j{hTa;u;NL zs{qJ8Awr|IJsO_>pHxS)FX&Wx*b?AD5P+V;>e--rWLzGrEPEU}cz~xR`6x#gG!kKe zIdlAf(Is6uj{oZ$fLOOjz@_TH{vqoWASGyq`L->RFg=#3B>UvC(qWwc$_0Gp1>imc zD$|c)G$%qeo#mKQ`u}d67E7G@zgGZ2PYZzaNTT2Yu>Py1f%|pny-g3m|8eRjdc$zw-7UMUxY$u-8$(P>|EeKHXB)_tD6 zC@mLMB9f2fID@6z<#0!nrWwp}nxfj>V=i{WBLLqSG6zLeiWYVjV=LUssv(onCyC>e z z*UBgBEQR`%hm&8kN8roVsNUlp{TtIN&abHf!R^a$Rz<2fI1ZPJe^eYd zs$*IA2(*=k_6CJ`Q1d~eo&WIgq2+gEz=a*qXu6b1#2msBk2rCvp!OZc?xsAXIb_R3 zlE#Gky*??0k)%4FnhDKOcdOKLG5oSTq$LKz!@(1kSxK9QUQXVgsv3l6(~a+kGjcpOP?NaWd*evtj0N$p(3ddR&aaw$%LaeI5LGw(gjSccX$ zaXxuzoBGzIuDkv$ZK~Cd-`hF}HBg9N`CZLA9fFP(X*6qGTU0DI)pl1|Z`p=}Z-K$L z`9J$ID3W2c`6>YmTLjoYwm*h5^0PS7#vp?@4Y*2p8*HDpmSlDvG78)LqDPKTkyBIoUmG}Oh*&G`8SrN9mVtmnXOhSt?;80NEw$x@wP=r z-N%1aJndaFI>cu(x^F=mo)k$$L+A0GuG_3`?p>DyU!N(AWnA)dFH7*c5)e%#DiCdn z?f&EL^)b}k@ZvV~i3yOP0G}_*6bAO?X(0|!Lle`CDM|zh|Gb1XR|Oeu%50my8ahcl ze|JUI9sLmg znm|hzupe>Oa=r>c&3)9|(GmD`EpQw@Yj*~#rGHLJ1cUG=WR>es9=4mQolt&-^o;fn z4M5FgTrZCHLMD?(-Sv>rdB0Ysi8=qKppmBTl(Z+U!V31Ug|`iUTH}Z#?oP-#nfPj^ zSaMd=m=7^-bM}l!k3h04r>6OnIe6J64fe#jZTqh;UBqX0h2Qk;R#(WuuSdh0Yu-kie!X%~9l@rutj`JFAKU2Ok?(%F~! zwYEgy#!LB2#kEq;2j;mMs=Fhn4pz)uI_4e65KV8ZLHpH>4LGmARlcXk@uok#9Oa4` zY;)d5oa>$R9Ho)1k=U8Fi_u6W*)(i=7lg>J)_zO)ZEy+lY;1hNPSu|sBvdTCAM&|7 zc#;W)-Js(+s)A$^Y?wvJih!y+s)hXCxb8Q975BZZYPm$2C@ zXa3N?ZtrJP%@-{8Jg?B_JN<{<}z zL1scw>r^z=>*iXJ2oR(54u#<~stsM!*eeMhXjg5GhX8N=-0Q$?z;98zxTkqnVnrz= ztN9V33B6#&B*pf3^4knI_Mi{Ji$$n6zb@C2f=gVPOxXcf!U;H>nAkc9*F8Qk& z)y&1hzp$T$>}XM9?t7aKmZGwKk?n;KenDh|&E=zsu8U>xZ+DXNtsL_obrCBv<6p1d z`>kjD_u!X$op=mnpnI9$3$&zj1m4lw30LIt^KETL-Q9hkarW~rnRM!Q49yNWc3!4A z9O(6Sz~$v^*3>vgx*EjF`AT$zoLS$ydr79r1jCJ2T_bmyi)N z98QkVm20@g>a1B^_sa0S5JNYEQM+VCVX}epp9yd1iN1|VW*n5X)Ux~trNam6?lV7~ zUv*_MG%viJSaY3HPSj27-yHL{KM&!*cpmooe9!rrcX+Z8WNd?h<-c4(xxM;=ePOlH}nbCIoEWhL9g1Noy4Nbr@TZe6?__Z2j{g5fE)4x43Bd(A@ z!@Kk^KBps&mvJshW_E)7@(r=;e-=07a}?g=9qnWs!}iLawnj!q1Ms*cIL^#Lw+<4P z{>~OBGL(sjN558K07IJ0@#>TXZ_%Ch$f{dK6bxFyKZv2iU!WFgJG+=i4pgSY?=a4@ zP{1>SvX<9M^k_|dYg7~+WdE`jZCGh`D&cZ8KS=p0ZGuZSc@DAs-kiGkpV@(**|kSZ zX!j)wwG(6g)T%FZs%K(Zggws*Mz5>#2b0<9Tr6|;`bC1=06yr<<7PTDtOH=Abt{K z(m&$~yAig-JL?9CEaLACfmZ|G$q$#Mvfx@%HGB3@)xok4&%IwRNfi+pf-&`4PSS;t;Zk5PXnaxJrG%XKs5C_M(z#@L07EX~JCAs(xUOKd&RDQLD z8VW>8%ZLdrhxrwN)&vomsAbO7GwS7P2Qa-B;p0j+0OIy>UMQoi=gQZn_cdu7KR8pu)v990DR)& z`W6H6Fe5cg&#~Xsonj6D#RrKjU*vr%rSy@8=^NeN#XRdw-WWvqtC{0`&(Roai zPkrR$h@_h4yF*$yZ!+G>jYYcOJStoN{4cTVk4L5JJ-~?O72?ruL5Y_b+Is)y)gF8I zzrsffOKL3tX84FUfP>@6xfqk%5be`pla^8&*kEIv|6JCTzWG!!*s}wc!PP-SqeO(UG z{j|${KXy4}^EKnOgMdw`_5N9yj4N_vO*u({Q?{Y4C47N<0kV_Xdc-V11XCkv4+;|d zN6W6Yx77sk1<}nn+3szcJIkSXW^ETZSA2VTbiZ-aiuv)!^AGY$V_bBuFV{?Gd+c3w z#bn#7DldJ^q@XL6eTAtHtxVZwOz#!6CD8&*c^Wo z_3_20ojc3+=E8!k2xC^JFOYnvsO^DFE_w!1X~c0XS+@hVv(0x1>u&Ga`BYAGsL}jd zKTGe0g&n`^yX~!a-7s|Ih2O$dG`8zwlBzb|V^RdGA{!P4b8#h&!d8fg{EWqYkaP1r z8h`Q<+6YV3lHRG+3Nc09p8EpBzCVmz1qJUy8+sta4xviD{tHa)EETayEbn9jR&jNF zEN4Qa(15T}EGgaDqDr_So#z%HOR&?g>}b59LsxCF=9Ajg=5gF*$J)E6d*5O`FML?- zr|Fe4jSUuAY7Z-Xj>ORiZzdHh&@Vm)V+kT=8d`mlObNDSB2uCaWTJ9sfeKFt3%W4@ zWTWfN-mg)aOs@yidM7*bv5DBQrO8{csMX?&xu_#|?!ZoSk#nPb`HqVtOl`oxIf8=f zk6yj9l_;l(+dIUyfXVZn1-z2FJKK{O$eSDHcZ_1yl&LG5&EnHrzgHVo`VJ%s zB_%)M>NIF!;s53ht~ym_G~?o?jV8ujYwPez9i0v`)ru{S{VI9(=Haq==YHtHxVf-s zkdl>|1bt}B@J)cM2-F=%!sy80BXMZ1Le%HKy|g5_sum+d7BuFM`M!O0;yH*ZiVkL8 za0Jqqg`4`%CN7gosvx+eM!S|Jo|B@edr0K113#25Co+7M^iyW#0P3mBEbT^hZ+VNxa@as{Zx;tg zda|ioqk4}nrDSD=CjpDPr>Ic3@1`TVi;%pIWf+7xpgh4hCR1ASN5>w-P%+VFgSkH7 zS{SEqz>q|V7*?j!t=r{G-x~t56Qnt6ff=8pT=DLVOp;e=g?O^}vqngAj-0!3BZZxan2S|t`jaF*4S`Hac z7BDmQjLLPQlmF(6eLs`b+B<$SJu$&2EOW%L7-n`8{oRJ-%Ju68?Br--m12h6&LO?I z&k9eg&G1ZV98||zGXd6XFP`0nY5!e#G_kt;81=CygxE2b)O^NDZIxSamS^UD4@%#D zvEoMyL!3HkR}Hbf7}Zy$r>up^9??J=8Gcx{@)DmC0rqsFD0M7#JDYHZV{9=O`2kTj zSCuQkHG#h_I+{7Uf`Y9%*Ty0jvie85l9axxs-!~ca_9F$_gH;#aVkd&G&)C%6M&<6 z^>+-KWQ}+nXzR(?pI}jfE)|VI{N{VO6O;trh z!kvt(C(2k?O1DYOHC9OJ%E6J!@^_2unYh^f`9>~ot>1@-lIA42(oveaDDXUk{9cT zxQd#f5{>T5lbYs7mcqBCNfKLyfu885p+_1Pdz5P=VH~f{{+)zi9?9^c<yevn zvR6z5I7@1e-r|*bTojVr+BnLReS|EfkqXNdFA-cG`1sh|Z@eLYOMXSY`PYFp(ZnJ2 zb>pAAHxeRuyHTr`NqeRMM;s+XHs<_KuFbVWS?_RfjNh+n5v+gPa#{3ddhzKJ{#0)) z_VZ@+u@`^Z;vdWC`kMM^XiZU!Q+>Os{QYt9_n$^aH2Ng!CT8lNUcEsd{(4n@e0D&$ z(;qbQa_OoOigV-?JZHE67@;z>%XF8SVCK(mV#f0cS+h0M;B_rd5nXO=L~ps67)vR6 zd;60$?0Tb6GF!IukfGKQz(kmXcJ})7)$dZ);Z7Q^16jwx|lH7r!7QaS9)xvNjrS`gHLArs-u#&CT&= z7KOhGe5r-b&K?aXCX0yxuh@ks!VFvqyYJkug+@LLtVFwpyKpKz%$80ovkT&K)hLnc z$q&>@*6JXI-Z$k*n|RgKG>SyWk1JjXsf&?QSC(Ee|FLWH(#S$O{xRU1%{N_YN-nI? zS$gM8DXn3~)9tz?RcnCk1HEQZr*>WPEtFz-u1=Oi;KC;R{ ztUwcB3T2ZO)`|>BoL(GTUrunlEyv7p%vHmT&R>bUDz%1!j88+?AUl4U=LuVqDVn^# zt6`DQxSpj~C@nxj&)8Ib#Hj`YmGAVz3&iYYx6OqkBONoB6a_B}H!HYPjT`puY3;^8p>JK;e1XL7)?RG;_?E=izxklh?)3+y zI$h#d{60ku3+^J%+(0cMdRU7#vYEFZjq>sOKzT6Nlxn)sLjOq^=t#IH-fu3IhnwJ{ zW2&)mn{N zzX@m;D~^_%o_^jsh6cz>Lm1}!yWWI_WjRVIJ*D>*{hg;Zk{uVhJgT{=UXn9DgI$!l zU)p}(nfPZhFAm0_6309=6V+E&(jdht0+!nLa|%AD-L}P@R}2wDJ+=QX0zrxK>$F0q zjH4_zj;m}T?+<=x*v|jszx{w;7Ja*;2Pb`M)js21J!rf6^A`-M#}fD#oq7iv>BPET zUxdlGbHd`I&gj7I;56jV%9eGf05ueX8kr65rK<8m9EZC(cuiIOwIzr8d%d7tATR6$Al9gguDjX7yYJ9mSJmJuPb#pIZY923VH{)gR zg?_q4|B24h#G&U$8gM~kXcO;2mA+~yW4GGbz(+?OqzCikE|Sl08Y&=~66_tTVc4+g zk$ufsFX?+-B!>=Jg=S|$r^2*#)YY1(rIfDZ=kTR9o2l_KpHL)&JVS;(m=nP{xFPx= zcL8&6TYDh9-x@f>GgNb8xwN3{&DBe8&;(bK+gQmaHm>TwM-eCngjW z9gZKx+=TAxK%v*Yp_^uQ(4Jy66j@j7S(g_GExTE_zi)-0A<&~kX{!VQe$G@VIvh4| zi91`IH(~451Z{9IGi`!4qHJm%YO%AHw@V*8fH>QW&$Rw1H!o1Fb120$?4L_MA3+Wa#WKzpvi) zL$4<(MA^WcFM9&xD+ra70$xc{R>FL*zCD4#U$bniQI%tiuc2l?jE*DiF1;RfXU!bI z;fS2s83)j_C-{98LIlk#*RG!Ap={H<)ppRLhGbjP=ong0FKqF?J{lE#B@`QzY7*!S z@7*zl>ze8FWn}lv0eR>1OlB#25C;0XhDSdPegnMB*aDT<1UOif9oIa^n;0wY##{M* zR{u*3{swcIX&(y1Ep^SyZ5c3UE5_r^mDb&B^dqIhf9^@q;F!M2N9FrDmlj7WO_HUe z136B*XR4JzVhQ93k}xjv5L)}@N~xvo!LLT?OiFw8E>)e7Y_a1)oK-B40$czlp>vgE3!Ef7 z+I4whWJejw8RM3*{R%IZ3F}8xv!oV_QjSr>xF>l4UXFSyZ7p=riR5wSRNno^+vrl3 zvDlz@^P;8icTyZ@z%gU@M_FUu93Uk&5q))Zf+>eOVCZ=U(8wyo4fw=(HN2R7l&=ss zwG$QO;|Fp_BC?4~r56cA7OGd0>{Uds&q0fg^-kDWF`vAZ1}LPe-)Ke? zkjviO4eKY5=D;@ITAXuZ>ElvyEO~77q)w*MzN=g6@UfxJqtV;waPg$Z>2oT2*u5V9 z`*8oEn73TADJRcBjzpJmNoA$m8d&ET?L0cR=dklG=$Dhm!>-O(f+U--)#e|Q6uTFq z{G#G=ba8QYMma^t06hL}5)w2Ehi`G)a}pZ7{^>9FWs~KhaZIjHAsxmB{AwJ;_SC1x zrdO%Zs*ZjhK`uE8P^tVdNPLP*uO#_OZo(oOPLJyZ_M84Wl>zT3(%^li2H*oQP2m^RQ=Km^!5p1 zZdR^ox|xxYnDY7bI5``xlUX*=tH`6kx2UVdsIQX`>zoCjPh&f+JAe5sT%vrUzU-R$ zS9lmvD`|5T*;I}I#)n7zr#^kkj&UZB#|OIdu&KDkPyh~~7X=)s9@8yd9ga?GoAwm1 z1GA4GrPj8|{8OF)rB#HCrOedrM#O<5C52PMw*3fGQ%(YlKs7C-!dYF85!LQQ^Pn}2 zHuWndYN<*V6&&ILx{O>$Sd0cPX&+}6bht7pf}Dj=^wF#?3yT~Jz``5q=g8(mE{!!d zlwkO|iaFU-Zjji6h2Ygrw-6WkxQQ5fu}-m%Z?PBeqkXBHfL^uhgb|a+maYcWtDKPi zle%5S)9K~r@`K%E_9=@`DcHl(B8oS<)y)g zZIL11!hJHq2g)WB973&;cf`cB8VD+TNNDBvqj)>w z&)#?A(&Iei{z?-8;fp*mOTRLwIW?A=W3~CH_!@L_#9Sw<8uHV%xjpk5^xM14fl$68 zNo9R`tY;tW!1u2VH;1=@F8Q?TF{wQ&eL2U%{hGQg>MP{64TI+@KX}RxHL5CTfDcQiuT*LvkOh!v?u2?-Rq;6SRnOxr} zF856sucsp+-S4Y{=2TxctoL?&NWe)7%Tpm@&sa@K-3sMTaVhh6MD3wu*q`xVEb?S8 z5=e4<1uQxy;>7-KRpZj37FAM97u1o`)|k=gLgw(fn0QJVd!^G?NmbQY6Ps1?G16w& z(w9YZyg7bMNxl!QwfG(}T5{o*=^UmE1QSI-Pfvfg;h z{B8MC))@w%!#deSXnvGCL3>N>LZ6SRsd32)JK>58SaA!z&*K_1F*M=ksTF)rpPZ^K zMDzMv<|M5+R0CSy2;(QNFET)f^tW($qJx71_+q(b*NjyD9t z75x>xuS`4w#@wsf5q~{Bb}pfV2$fK8Dai80UUsU~#e_`8NQx9bzQGfFw)oV^n|7kk ze6oIJMq2v)7JpIAC$DBM?fRN_7fY0Shqb<+vYW@va98gyv_w1kfUw{AY)D%`; z^Z9ce@s<25cY<9O@7vtCBFET@JW}I>Rn^#cl4oU)W;qql!BCGi4oRE*KFJPOE)7aP z-oljXx6zu>!j5%-w{f`ss!68Bc#HTxZ+(=u2xJDMFYJ9;uuoJ8fH9JF+1nnbi^5nR z7B}iv*T&CoiJh&ny{tI6rS%z8AN?+JK3S?EwxlIBOn@5VCB~%Gq}&o%$`jO4LGad- zzlIM}6SI~1rgdt?Iot`JiBQ3h{J-A%-Jbk;_)xrSRWP6$g?@JN_snJ;+6<}H@%~4wbQX;wrDDDhC-QPRgZrv z>lf?Zi|J8_n#keDOV*L)s4DTqNc&tm%F~gMlNic0pHn%{;)-u;XeS=1c=d?Oyv_=IS(n!_@sjxmo> z7~o#=5EXQj0WSC%_R#>+dS4OB7*qAikw>4JEokumlKfQecpwzg4ECVIeV?d7t-A5| z;9e%^1DFV{=-uwj)n3(PRN3a``aY#Hv6zD~`SR+?gu`8Clsld*`_bWIM&9SgAXN%C z9L>7) zNLSm&G8hW^b^jatpSb%%qwJ!h7@%xi@+ZR-$uZ;VR|oV!hxmUR>@R=)`BOw{7Mdxv z`KOR>PI1$ezX?YT$0{YJ=r7(Ib^ibEvxT9m!PHwFH>H>(xtf>n74bRMpQTEDfOqnI zjD;3fY+2MlG68>*hK!Lnun8N1J1VHLLU?7&mSdmswfx$ zQnQ_BzsSiYvpMo9ir(o}>R4c@I^SM?|CzBO^|2JWJrU-=6DRDWqK;KjBg~i>M?tKe zq-+^8idD^+#crMlP^+1)10lELO?plfG(bA^$1-5pJdh`!W%e+DIQy(6_9=~$4JpSd zf+N*%>`5=TVV#STp+CDR3yMbPOQR(3qh4O?1A`1NwqB<+^A0ES`Y3R}beDyF(5lli zfefP>R1CMs@FIBB{;!S6Z7iJ(g6qAXh!w}8Yl|#mnK#bjue$B9o!=39<|x5pRCy&# z^=wN0EM3!ebjAz(-_OJKe z-^PFciTsA@YXzzNw7ZAM%7))w*p(N*dExSMi#VFh%rT0}aw|`@9);aT9xePo0QNu$ zzlW;?p2`7Ypv7|oz2L_=;J#uC0mxP_d72N0TJYJhlNfD*hW-Nn`dhakK=9^rq0>kBb)!Ui5uCz8l?|uO(X2=@*wfv4NWO ztmUU}#+}^`{A7C_+^hD;r`4XRvNi+CEl;n#y(@M)J|WcSd_daoyVj<XNdM+aQwgv7kWy(zR2Sl%C<=?Vjgr>TxG zucOOsTFl?GEO))=kCH<*)UVo4@ib>)%g zW%ED)6CeQq03P?f9`~w!?|30Lm%ZKY?|aR^06;(h9&NVU_lN)iw+*_gZGiv)`~(42 zLGL+9B)D)5w*1^TKA;AY?&r!Zw(DpI+mm-m4F_uX|{o;wF)%M_s^1YYvo?V5bPb7pglH$g5)J_4SCt^W5N={ zRjF;VFD0FJA4Ox?+d_Fd3|M*2RPloC5Zge-x69Kd++?3;wi!J*_H--L6?b(!nA@zZ z26V_n+Dm3&>sJIzJs?mK5JMiG-09yn=JnIVM`h!hA;G2}a8gIzIg8-K>+%@6gEHC7 zIMuh9Pd8#c-Ed^TJc!?ocZHtv23YaCP44gu%)>C)=uu9HG|%^J&AR+&jf#L7$wh9Y{^4c5a=2sa1} z%*PpEusO?1eBP!g-jR@wGWFB1GO^^5Ok4`x-a4G;G-;e6L`P6Z2vkhvOu2%nYNCdR z8l>dB!F0AN15Hy?TCx#WaLmI|X`6JnYKD@#ajr$Z6s{w=Dhi@Fgd}e6j-(r8Rv4yH zR}4%cH(h#r&pQ6*Cw}u+X!BG=NK#tJDeE=Kye(?evvx(2V{9}UDb#I<+YuldXcmic z!bx~(QL^yUiOXfPoXO$MjW>?%18K&fMI#9*mO)HBR`(t6+_wk7VO@C+$291{N{7w6 z^ET&s-cFZ(n(h1btvz0NZcP!*l8Y zNp$n{cTCJo9WirIl^nQSCEOO8QKn?J!~lc}M&h9e`|J!#BFZHll#be9@JvxR4oH+b zv59EnxP)mP6p+LfT2`6KOn~9geB|ee3XBCAw051Iy7K1k?)pzj$Ch-vquY3KnM>7M z(@kmV&U1uS-I$H0TCl~)3^WDC>_pfh*(Tt*K^Au`n}-ugF_t3@%OKh@TyX>;rs7H5 zks)mu#G(bf@(|4R9;>L?KG^HBsT)ENL4H_V2rCqFzs0+Heq1PLAFR}+cqxL zu*7kOVQ>jTR$g2L-7HKi%KPTW7C_7Ys-an){UE9PFsdTd%D6;Ri3%vB%QZw&MGa)K z%(96%xU|I8RYbL)Fa!E`)E~V4*Y>;L?RBsZv3|nueRc0F_q9<>Apk|2Rkiup*fvvW zD+ZHbrXf~kzo~P(uI{-*oTV5>aH)x^s%|E0iU{Fl+mUlRxfENwh^x1Bz^Di+X#65< zNEQ)4$NdT{^8^Q}6gUCK6eS!0Q;Mvpi4q7c2m;Q5G(x}{1VBSa1`UI_1`xwS-_iqO zCdd>ZR{%ZGu9!kpfFc1TUhqQ_1SKAD;CsPD;SvMdiU&MwLum*Ef_MB#nyMI-85A;F zTDHq1MHEt@m6*_g@xk-IpT3vz1wiMPqo*vAuoM`X#Ab%END@hfrpBtSh8O|x5AX9o ze!M;YdCvOX|1@r4hWYsOE!hgIQ&PnTZ*XKMTlZH~AknDY#*K!2<#n zferrgupOi#z$YdOV+xW9&a@+-4vYbCA{E4bXai88DCv2ijSHkRO9q9|ImDap-`Ytr zh!n<+Nl8NBqJMsQp5M(T!2c>JAGFkWnPX*?F;ruT? z7r!ri+<M|u|t9!RNlqdIu2+@NcFRd>;q_Kwg&-&5)4tsPJ z4SZ`am6S6600aCf?nfG;%BrQ@Hy0GeB#@}IV44jZ7_uaZnu2O-==ce>e?x)~exHDx zV1e28KYri?z+IfZ{u}_}9C-YalVTeOH3%99OM#<6IzY|up8VuPlz$u$zsW@ZF;*p&$5M2!m4nKhFW z3bPQR#4%zr)JT#FiBh5p#H&h6RLqK`B#0gwM~_h9fAa$*{G-qL*_<`=%i8*eW_k?% z6;x3qsb!X-Cl#cGYG*2{ox?R;L>C-IRZ>`Dn5H67?~g!U01gB>(7IRrV7L#sCIQEz zn-DgMu@2AM6JT!v#ULf)1RPa`f!AW8q!2mo{P%wPJwx{-KB?h*Rbg3%OCqHbIFhrK zRZrK{XVb{}@1K4BixgRt!^-_3okG8fXpo91(n%zdXlRwC4?uRO&OEj*!ROaPnpf~J z3=^9)E`-s7U>bv8;C^78Y;(WBX*D6Jc+tH*s+|Iw{QJ&WpFaH#JuxgY!qkmZl#3!z z<0`Y2RZ>8Q_3+OxJU)K+!{O(?``=~(`;N4&i!Ds$Ra5H>)f7d{rK%DpOq4XAnhs)O zZ}tFM3>+UcnnPGS&<3YQVa*r>{l~=s_y`WYFz}#%6^nS<0%T z^Vh@setY=Q{qw`nbAx;Q-<&@)12gzvk}%BWRZ{L|qfD%7Ai;)UGBGt#RSZBH(e8Mz zpP{}L(X9}7#?2dyW^Ad_JJ&cI!wr4nI^i4VhynExd->^>aWVe7vS#LO{2N}*;TNg7)!5}ZhCQEFAa5?~s9`dEBFqduC!mdG$qn4Lkd zoZ;B22hkMo=Z}Y1-uv4y%=|xdr^vAq#jhd8|Hz&A@Y)1{({ok<3;?m_`bQMR2Zqlr}`A{9Uw zY0zSZg>aD+$QlGG49rIhFvul}A|kR#Lkb{F%&`WHTOG~XbhRK_%bdFGcRDK-Gp9P- z$(7PJw(dEDK?IOWtP8L&<9Yml)C}+NMTfHQ!g_cDI@Wj_?P(7WcWKfn4ipEuBv#8> z7{k74I_4Vj@7;1cfOHZFJ$f&l?n|XnidvLZs7AmXGR!lWd-D#3I7)y-fR{dbz1gk% z#I@&q=Y4h4t606uqTyTW+sqf9tgGIcTke7u?Pj%c_mt3XgEu$r`R~LWd@mxu1DiRv zHus)dx87Sl3##Qhq0g6;FF5jj9<8{9o=o;KXV|+k<5UnbyeT4E_7mCfPrAEEpxhvg zB4=-WBDt&guA+|UzGs_*UG|x_kVXF9#BJwAn|(H-mZ z*^1k`*3mT`ww3w$^Gn`5023epNB{#MJyq{}-uI!lm%ZKIOWyZ@0DvR_1?Jmr`1FHW zvAZ&GfFuBIIBojw!`?f)yS%+10q=euck?~hzWeRI`Ilaqmlm-GJRFABDyj&YM zPplT~nS?bVpLcGw1HIawFf1qSLR@q;B*#&)e^J3@8Ku_qbSaHc0AG9X>K( zR0;0B%3#{9fwR`Ih%6g{Nu)gs%F0J^4TlGV?v}yv%=M>oTzrNThC^d?vZ7+~-M*bS zWSy1TkmpuxI(Z!(S-tVyy>D(U0}2rVB&4|&MF(naxfYmO;6D35JKvMd!$+BsBiKQj zVO5dK71JOiP*B`7EOw}~>hL#%n4+1%MH5WG%MIGB*m1=*QqMcavos9h2nmXdmSF)S zmJU@&O*o^OTpCbys;YAwCoq>rj1UJ^ATY~XjLLHJRzX&fow7WCI^t%%|!tQ)`~V-Q=M3``%$+LRHuk zrk?OJ1Jz#lz3+M(X?xw>^BpchLlFn%hA#$GcVA6Op-Z9piBaPYfg& z%yLeS9RbjGORR0M#5WuzQ!eeWC5Rb8D?!?`cVg5nMigd+E0=bYtG395wpg=7;Isx} zcAiB+MMZ$6!Dbt72IZScM&Kb_h!|zm2oh|Vk^6|rPrq% z=W4Ne*!FWf^S(Ypr{PSoVl!DH7EuhNEhx2BNCZ9m@8M+cWz7myBLrTbV(y?c{{jj` zTB${3yU9c%+Kr$%+EaXKdk=M zQ?)SVNhql*luERs)m3?$iKpKD{{7j9;r`Fd*L`4TP$b$_%fSfX0}!ohY0qcT5PxV@ zr538GodHQF2O(aKtIWTdh)x>N8EB097|X9TXyE`ps6BFdotJ-ejtdOJqGK?cr3q+R zXDVdGaY;%^rEa;+GlO>qE}V83Yq`$FX+^4;rbiE(4SBd50TH0N>#xqQ z2o&HL9TKWHWBAyaopQ^#eayi8`}ue1{QmaE0}}-`kc})1!!0PaRYE?0efghHb%(b+ zx0`!AfPSVOaL=i}pgwhg=a7EG;*k+ji&a%x8JWLL;qy*siG$?7*?V*iwin1sptUqa9ZH$#p{()r`goFN zVI^UiSy)9X)rk~LDp6t}&Q2tdl+95KRaGpR!}HhG_5Ave?)^WTnzi0}<(_(Tv*F2q zm4O*W3{*ryRw+>pF;n+5TmbWd{Byj|UBkHtGj{eEBLq7mywI9M=j{QZ^LkAN+)NI# z?NB^9^7OAXy@2oT^Bl}*Rw`(irIxa3sv)MSvOo7TTq$25zu)iMUO?!hx3lUWz>Gu? zNT`OGslDcACG$y@go#>GS|O&Xx)>Y$XTr~pbUyw1TRGdV_G~0O zFwMy8wK4qq2z@&94^8>_Z_V%Y;}bJW3lmdRvlP`3(^UDJ@AJ=}-23BuJ^lRqucNE_ zq_k8+O;hO1!@Hk?{*7&5b)v%bE(bd7ToL|6-7?>cY`RJm~*bWaT6RwK`q@d zHn0fDa6l>+t%7JaQ-&xaP0$3;qc-RrZyiaJX6#hoIlE@3nmN0WaKdaGdBZsLZo$%Q zZtl5tfJZhI1|)KrBFh*eV>2eiAYu_1#YJYEoQ8@S5s3+EG1GL8E4JyPhjLQ7kU&rf zRZunTPx1a2w}XfBrb_BuUqwq`v!s=PRR%{H8gzZu~=oYGW_YpXMMfeS;3>(<~@#i>UHSSJuu*+ zYT_nmW)U8hehQPODy7s`Gw#{b+3VwxDq``~wN=hOs=n2J%4fp>VV>~|)9nP6^ZUB6 z%sIuX8JzN6iJjO?J2Cn$O!0E#S)KOu9{FW`_VHJ1-hvw$hy>b@<+N=OueITb zOka5yiG}0~;Y!b+*zy-eOipFgWliC|tU%kB0kVqii1SAmX5{8(=}G2s|r|`m;e(X02BZM36KWcblYNH zNhR-l-T(rsfS_q=UT?>}?|alW+1)%}uHTP)-t_=B+@*fIZ^7?2l1X}-01!xDuKn+O z!zA<1q!ZVnOwO@cdj zKzOQoyBK`?-Ai@*psa?_rGpst%n_t|^x!J@P_zc}?-~cTQMWw%m76;cCU#-+W$@Lt z#B+9a%idBIZ*1Xhb@0V#xg);2cKzzK6so%0Oq%U_9~_i*3~1nOVk)W0qnPo16fe4OiOM-PI zlCfRnwJ#~DRaY=oFvBz>c{K8KFcu*~Az~5CtOQPFV1yA70 zBSTEnM+^ZG?zNy|I0-8hz2&ysmM$(U$4b?3(MKa$t7ef$4QY^3m6f7ORoZJMWmjgZ zu7R0`Xq&oIis7aj8f`g91UZQDRi`)?3sry#5D5^3M#xmc5nzW-RA4G$2!uj|5UF7- z6g1OKGrusmx2v6W2IiDe5M1*DvSe9GvURs>V?`tpw?zU0kwBY?M%yj`$xT3lALs&- z+p_M}1!Cw}xNWOeL}7+xktJ=q4cUS@Vy+_rMMQ1IWwc#}{$9Ifc4w~aO;>1d&szAM zyEHBEZr^GazC=ypm%BQ>dud$p<)*fP046{;K+J->c5&tVwyWLbn?rElf**nOeM+WR zsjl~*Hx0JiZkudN$tCZ28*jwO1p`Za$$9t>dY5hP%ddLhk9*$r05;sEe!FkMgd)`iaCyYbuc>H6H$SuOfLS!<`yD^AV9_x_C2`oFn)+z>O2n7N(h~{FT zW?&Y=1Y<5_DVdCXAfF=-v< z2%M}Bb%qO=9Pv%nzzwAZz}n1d7c&(vH@$9@EVXH*Xjjf>H3D?+FULN!2lCO{Heb9!CFRYAPS z1y$fpjK>0`s8t84kSGie1F%^X1zzA=EQ+C%cW-whDJzAyL119IWCJagb8(!h>bapq zWPU)DjRHtZOoUY=G_sO1(J4+#2~`ZDBqKwMOI0e;tyL{d)W52p9^cQ$!f}JozlPU- z`mhg~pQ@rOjzbhwQnLiKym8&!9mU7hvXWXfYhNFJv-r;QOt%O?qw^xoz(D~D#SJv! zsl=D;=7SDIRQ&ex{LOXWf*42v0OOzkmM1`RH*PeazpFQyY2ZTzslFW-$1!;hp0C~4iF^$fHCs~2_N4whZI8YDI z&(Gh#zjycN@Wc>NRW>Npt}9fLAe53p8t-lYr|+8fFKLslZ(RsV9r^ctbI+eY5dIZi zf~iHSiEo%;Dxe+p*Ivkf0`0f(%`irNT>bOsI_&dcZTtH|&0S%mYUx<#cAZ=7PDOC!P+)N1uH> z{Lc63yU$jBe)r{31i;eBtpfu}qC_Nve~SIbtS7&LyRqWGB;xSTg8n3ijKr!Wm3je8 zGZXuf_uL{Lib`p8b~pULVJQI^6g8e-itr8p%{f zioXm~3_OqE9+Z0b_@k$;zmOe0a5NNa2avt+!0TQLKYIE5{rd;>Kh&z!h~ZT;WsOTR zs>(BxG6dr*kmEvDSy@&}s^qgaG{V(VXUA_D_(f#{;@_oO+ zYJ!3(^ekDXqO28}#T;^`imI0?p-;@f&OmTJS(_h8y1>p66X5*w4t>L|ekt$YnT{D) zRUpAlQY%#!RYLjm=dVWlbJv|e*dN{R8vkgy#(nlPlgSUi(1IEX5`v{vEAI?4-hW1D zBzx215*jCZch~RNgQ)S=(~a_Xt!uzQ;86e$x;C{=6Yq&|Lk@B=+KVvf#IrL;v>dpd z7eu3X1cAClTm_2(h{z!W8<#9V4bzM$08kRBK-(mcEmL73gX#%u%=daol+^31{KZ7^I74NmT5-RBf;>5$oO=XrOwbWk|x%>;f!+)=XXrb?{{P>t;q#cpzVqf)sX^0U8!>ESOo)8Id##t*=vsKJ9g({ zy6mGNz>6v*T!P6mW=f@SmLZC96dV@@mc%P8OBSIS3kgvbi4?5N!!cH|+xPbVp=&sH z{;;n6ap$RvHfOFT@sDiVyWMisTo~VGSQ{o)4DJ>yXl23deXuktSn;QH{3uQU04z|- z^$UWXD2NZm$PsB19Y=?Vo;~erPL{UV##S|F96#^A(cwp_`_EOsq>?r+?-$XxT(e7s zxr2?_TD!Pf=T_*iC%0a%y7ckruS~A=zkMq@@jiac@NL>g8`)KTF_}GGjw?#O+NzR8 z({QwLZWVf|`de?_+}Aa{I=QSLpFH=e#MIBesKI-rUAdssdZ)>G`_nNmI_uwcPR`ey z=fg$V^W!rHYG*KXd6Hrsxw?kH0GR*)EC%(sZLk0=0VU*@z2F;uCO``Ty-Ur%0q;^v zv$|b-);|DJUQ1H-JHJ?a-t%4E-S0bK2LVOjuip2cqtG~0kuw<)AAJ!q5it`rL<3b? zK0rL(yqk((T5uq+FFt)|-9i|(FzsU%!ol5H%nnw!qMB1aJmjffqNS~TrgrK-J z-Kn}%n+-a$dfs<+K&1I+|c5hUqY1XSmF3qORZg@r~Fu04M_lu*42!aq1 zp|?wXT_w_OzCC#77T^FE1{gFwT`sy^IMniRWM3)Ug}qw!=ZlvZF1se^Vq41DEw-$c zUD1=y?sHORlU>I0R}PZ5oQ|#3uoMU&2}7_4b!un6&zl?z%?HTIi)V_M=;zqCQvd*& z05^hEtuou?&43)|@iyFgK61M4`)^zG*5S6m0I&p?l3w?KZTOi0EC%&2Hv9*@NiNRm zb?;dG0ZDl+OVsZDVec<^X)f6t@~@o=eSX-fy@cJtkuIpU~<#{o3yXA(vmAO*-?g@iIYkPlV0EmoT%+;y*5$eah~ zE;N0v{KUIKMzaNa62ZIQAuLAp79)Kz!Mh`yw{shLmk2704Psjjx0i-;S~l+OXrRM7 zw-ANf7a1i zJVT#(&u%Vwf7mHZ}7@Ukdj5ps}}sj439z21AZpr z6M^9nL3Y^(<+KG;^!@Vi{Mf3VTl@$Fe*%d_EO&G+oSUa6TU(#{wTFeCNo7UEkY}d)s=iR2iya4_wEjjV0j;- zud3(J=UJuiJrQ&0eD(JFKD+xY%Yw{Rf-*F!AfysOX#3Xv`s4t?m-G*13cM!1)~49! zuRHh7el=n$qBK?OFazH-Q`&!E5J1d6=JZ&Z5EBOgFFc&^dhByE`2G$#%7zstah$1a z#a5+Jnu?h@^nY#keE5&|Jo5fO4|l(Y4tnQLpM7)Y{~uf_YDrZYsHpjdW_o?m6OeNn z_Y5X3pvQq!`O(M7@%zG+!NzQBDTZ;SQJRXd^TvSt_2BHdyfiQGkNIc4@AQbIsDeo# zqO%Ol>=B3TCph$J3=LRu@bz5-@;^6%amEEbDjq!dkF)PV_3f!5V3{F=NemKTnhXsP zNF)*+*4I8C>K?uZhI2Rc zN^^#8gF5BvDjNTt311-yECyaWU_odF#)6 z=Z8tlIhxn8zPvN=bj3wcF>nOTA8&|MN8EML*ggJli>mO^%^M(zceLSr1%RB>GCwg&Gx!Er!gAi}A@Ikw!>8*R=G8^?FN(^@fs1>9*$ zK?E#-85MUOP)^vkV*wfgU8Vs^#X?=PR$a($AyQhmDy;_UuGJWVQHrVnT($ybNiAK4 zX_}ydZiHyN7X?Rds#*X>g(D~e1<{~QVKG#}OdJi`4-f^2u>g9zUx1)I zD_>1$1_3k`fau#yS+SAGZVB#T_-c5z&{JPO>#5omn7Op2q45lm*J^$Tdv7n4IdO>V zF&R~l8lBU1_g!)g%Esr$t;$+$ud;VC>J8l6%)G%4Zk9#d0W@D@z;m`%+Y{4slY84W z*UPxr!rbPy#clJv;jYhPWY3z_Q0{lB4vWoRmfb!T^{jPQ7xwH}Y)UWVtw3jW_Z7zN zY3<6(y~YlzPfnA{{&zl0HfMGCt)9q?(55KKVVj8r=>kD&I%p#bl^<(h=c~y2O!Lhs z`Wuru8SSX&nK#xo+nHRuu{Tov=Cj(d=5a7bw;h!&r^Yle{Vd(igGj_TR?!Vx*|RMI zh==9t7kpjFOoGkUm@QqQ3P@$JVuJ`-cBVF*-9xu9j+gP5jxu{9rbT@UebtjI>79-$ zF1{|+iNXk$Wy`wPie5W60P>xS%{ID1iE zqk6rU#{7fm8XHPTz~iKm?^3^Z-Ei~-1Q76^9m`$}9?`ZNYa%%=hKj243+HL;-CLd>_4gf4td=y2AnQPFqj5U)rPhVm z=UFgn+puVuJI!5qk0Q90(R`xwc8w+h{R0$ZnVV6wP(;GqeC8UuW$fn&-y3){&J5DA zseVA_Zm(YUW^>Pa*7er6v&jgU2p}LOW!M|DZC3ExjNl%3cW?(?UP?CG!_MyR?(XgY z008c)LqQp3cB*!%rloMNTV8qK^=r2b0U!@MySuP-NL7tC;AxqGy0c9*+2-5bZgYzA znw3>m=w+FPWTDZORaL5zmBn2w)w{gqw>iaCTt(~Wyz|dIUFtB3s zb)qjUxg_1X>gwsBtGX@Mo=-0+g7SjhI?1;*^78XZaN&YaI__%WT`MBP5miSj5JU)+ zQXrzOt-S8LyJ5GU^YOs5KDH!xi|oB_6ER%l_re9_bDMVaBA;oIO;SUbfC6Ly+Mu|)hbNS0hl8!J zba!CgOAiV*{ygj6Sg=jwaNA%sF2jAG4ZlA*mfLR_ySv@q^F2M?-QJ%Kv?lE#B{IF{ z{m;#`yqAE_1IFD|dAIIvw))SbGy)}%pT;@$0?l3ZRZy!tNccLhl)h3JJ?8C7yG!LS zDbFd=wyLW=Zknzuu?o8~(^TeQc5=$zVj_QIjuGxS|D;4daX#SS1M(h^XVhW?QxtWdbaPkR*;UNl60n+_@e$ z>?lS=W)&7(!imjmo7rZy(VQcE#6fx1D51_a2rh4W5C?naghA@a6+?0;y>p!bzZ?SH z+`}5(@ZlUqLo+H(?s>PXs_|gF$#~u9x3a(hHudgZ)FVvUs!41dlWySGxR}j?%(Fc4 z)@T$z3jh#HQjsEQfKxS+BLx(R1r!lrAPrR%#jRhQdFOl8;nwzjR6R!)P5C1L9OO}+XK9Zz8W3~Z;;`?KQ;OZ^WplUG9e}r2?7v&U$xWT zj{V;L*9>AmYDwU~ek6cF1du@_kVzbea1n}WQW+Sc9vgrQXn#@!*lsJXBhqZw(+8yc z*Pi$8kAFo(Q&mKj1XWQLQABT_de>Rk99?tm&m8OKbH0@Con@Qz&U_Q`=uA{aR8aJq!8AuCamUb+qXV68p_b=B)Q*5h+MSQ$s+=N*2+LhHV;v0SQGv ze{(w5S$Vve$6jxrd;tad@&yVpF_8cUwQQeXKb?M8^@sch1_7cC`G6o2?0;Bt1~6Ce zV3c@|IqP3J`0zC{O+i&fRbM^VA;(?*_xGB!y{|{Ms-!S^P1~fn)Ezisj7$K}RK1q=Kx=uA|8plBffAh&L%Kq!~+-=194uvC0HkA578stTy8 zW~r*H-+JXb={Yyooa*57p1U>K;HWRTL{&{yKqA^P#3H*B-!-p^n$|dHDztz^5ckNi z#SzMwOs3~C4aK8&Eq3g4I}vcL?+ynG9(L)u(9u?i2TlT>MTvbsKbBq~&L_ z@x3T5PhPCgwtKkm9&dLsy_bF;ED1*VZWy4`wcB*3FJbl1Qk9EAfCR_@00xcQaNA%t z$6>qR2H%f4mfLOUySu&K^E|7&yS+YRXidCANmW;$pP!Q5_jkPCv>mqUslNx8zH#qV zdB%PB+w@HR^h`v9R2+8F8a^H%XLp0_xvRuqL`~i^%h$auF`?5oqVo`>_YJJ}EFI`B zP{;3N)g0NLs9e;q4(E2@hXI|MK@5A|-t#8&J)Xnaux4OA$leU?(T>Kv_Xz0L&=X_u zx@2Vz3K0nQj*qp5F_E?7SZ}?r0)a8U)qUpqYl3e{-cgRdT07AJ!_*rNX+q`{jPV9FdDPe^SRzz#d$%4csBCO&Bc|}8wTB~BWmfU zy0?VJYkStUz07Hi)XgvvE+wMT8B)oTxw*AiJCZdRiVkL*v%4F*=rFEI!YZn)GH6vg z8^Nv)F@t_3aax z#7k~-IYW;ekls#hl>#R0YUOdw#5Uupvg@v@t#RI7Y`t=6g?xZ%(BG^Avr}8LXzCc5azd; zxa!}%bGg8S|Cp8dRI#@*(7;Z;BkUt%h%YN{0u&b~Th zP#ESTRH~yt&CliqjzC?iQ3n$rZjSyZYOCteilQi{sj92z<9y=!e)E3xb?BlmxKUKq zR0=PLxu2P{#W_s}g|d5xJ~+CS%?~su*}aF|b9Qr`cnSbM2?-F0!nL)n`Pd8+Bm8#NR_!#A8WBWs_n4i2 z>ro-_)&bTI3B~8{Z_kYP?cX=2LPyto?aWKdr$dG`8`D1Nb8A1}M3Q|-dB^Fvl z7=$TWBtdBf3J_XA29QCeL1{_>3IRZhlvpB>VD>#d!O3p%_CEQaxrRxjK&a!x!OuS| z!-PZ>_2>yGCMqD3Nd%Gi)44T2vGSGby9ngW3HQ$bR!~J%6-mBgp31*H_fD_pF*oyF z({In_tM!pXMpk8n1R6Z!=fdxL`NxKhsm{FfeD&xZ(Nz>tRYgzDL!sYTe(=EfNKkO^ z4|d_84*>T#eD8Geuku`A}T701omd<^S90^YxXKL;JGPqcgiosgG5zPUPin_ z%S-VN@J$`{ra0c8&F5WjDiRX=WHm-8YN~=vM<@WLvSFtki{2gX0)X4cc$vq%vNVir z*KpyFSyPvF>;~?;9E|1|&s{`LZzVUSyPb2K*GbZFV;46@4e1ON^~uMOapB7{<<#$c zCgINarw0lpMcqar3^h)SVSw#jxkwPwp=m^#eXb8XrMx@3@l8}7F{9p>1>U!M8nHmI zOkg-|i2_RGgqwv4WC?Hx;KzG}E^kAkuBvO7S1#d-a_*BSQ?7*Ugdg0M{%h(! z<%Fx@)l&W2r(dwYR&LGA^Uk|F^zruQci1Pmoj!DUh3<~PK=R~(Fl%DCRc3%dp;>49 z27QXF2_o78V8HU>H?!LuVEUHy$UUM?zokd_hjp8!zWeL@?|4X0tU%EcgF-uEF>b?A zSwmFGKY5-V*CMelUA-&U8PCm5K;ON2IktWAN86is2rzKfEH5G&8f!f8PiEJZvOV|R zz>jcVu72Ax$a_3xW6;3Bpx&0^rk?w`FIDAdRMzEt2dkZ{6TOPwMR|H>d+A20xe@1G zL;|I8m(zD%+_-b;^cA^x>8CXby3XJg+mqwnm5XX4*|R%Zv6J@o{Qlm9Izx^xeAS`w zV3FnL^ucwX7ZRqc9<=aN*mvoNPM@jz`Hw$q8%aKwgw!pIj#ULmP0G9X)hEtU-s<#= z!b-hp6T&}5=2+q;JAjmM)U-;275uc?yiq97EFT@uz1O}z_gKpw$My8U$sw_zzP~*p zLH8}Ryq9&31bXv%i#PL+9ewL2JsT0|^i*eryttbA`5QIbyp%nUZd~ofOq`yAo4Ty5 zBPOkOd|fH%S?pWjegGyw000gGz^b4CYmUQTv>R{UZe_OHe&N$;FE-egdwtbC!+erj z*K(@!XS~ww_mcB|ICPV$OV8Nbc+rtfy?iafEMD+yO6DeW>bmTy$k@!Wgr0#;;(AgO~?D3S;|fdLb1;`=9PI=u6vhB_009Ijn- zU6k`|XA3toH07@=0H`?2&nhkVv&Yk?y7c#8*Bb^m=?uB11Z4N)L6CdT=`IB)_gnZhTS!ptza22B@O_E|2{O5C(w_ItLQBS`F2 z1)on0Gm5^#@eSE}NV5%CjAmFJEWaE+IGyr-%->y45p`nhLAYJ7Y49g|blEJt^z`mJ zfk%gq?wD^#CW%>=iV0apf`sJ961dSrqM?#k(zR7nTm*8&TtMBcBIn+3HQqUjrqtBE zz(<&vsfEguGM;Z|P2zVj5=9hTG-ew#$dN@9=MCQP8+olVcMX>|oNYP7lu>tkyjPs( zxlAQaRLSOMCw7^|aX4(nE3bw&%hcVwHte-6OSQYHySH+3n4nE*{D&}X>e-BNmpvSr#9BzEY1!R zxxAL)z|r9~CNa&mwIy*^1zg&z4311sDUjl-xGJ`Uh+u-jq)DY5bepM|&wvZ}48c`d zMCa9I7=ntL({A&3%bd>X&F4p6YnLFqu@Ql^$Vn#Us}AD2637?7pFR9UH53%08D@wH<59cUd4g$C~daao~7peGTGk0XT9Cy)&*4n z16)~;z&78!+{Wp&p&nc=k+7Y3E`sap^9v5U4tE{)~ z3Sjp@Z#rhi999T-a#-Ru>I-)EStXQoHa$GoC0@Z^ZLl4mV$XCA`(JKXL^K#<%y+kQ zcJ}S(w?~fVA|e&X%J4<-@BrJ@`zFMa8Wkv_QkatzG?fzx0Rjz0y?WnwtTorV*SqVy zwPySU4t-V$C7PIuXsRk{P~GQ)CMWK1L316&I-A|}bo|+dKaun`5LD4s5&;B~Nd%fE z5AMF+cDP-Qf6ryj()9hKHGC94xl|QJO$vVfadf7oys$YZeDdB|4}}s@6hzd-l1U(w zM38nr@4tUp>G|}alKb9xz5ox`R7}+sG>301kCAS`@2npCPjnsh^l0CPv}!$);o1et z!puMy>;r!9u?h*KfI|!8-@nhlUG?>B>iORF-;tj+Q8h(P9GBTg_gJ@>7W47BHQsMo z-n~3#Vjza9iYgG&Y-2KzAsArt>e|KTKYS-Bc}*TSlV{6GMcra}^ti&gNV z?^)HCzPnq|sNrF5KR+2PmuNN`yaBu5HpJGy=7EfP17hk zgS)#05AH4r?htHn2s*es6Y>u31W0gsa2ecXfZ)O1VJ1L=1Q`gLK=QnI^1SC;=UeBT zyY5aIP#_wHT0cXd^U=rgGBAP7XRua`1KIvJ#_IknWTTzMP$^X4_% ztCWxVS3k-1)Ut+4m9Z$*GHoXQUW&Y25nv|d_`!Vtuzy;e%wAB^&h}i~u;?Az)s1%3 z!O-xf%=y_YI%2yrxxOTs5n5jN<6DKu+#}jn*;Vps+*~AUmKJLUKHbo(#y*??YQ49g z^ftP`yv6B#OFiaftOiyiTj3Oq*E0mz*FHQvy?Gk^{dVx~>etWyvtv>NuOIAxDWBv! z!?+V+dPo43=g@HmnG-Ib)WKZK3V*d8dEbhGByHH>-)}yx_z;F z2U)*Sp2UOvAQv@VOgaiX8NOM&Qrw?f}d0kh0Tue%4+D{4S5b#-ZW-Ucxy zCAorg*b7d#@E47NClI5eg7;2bnIv?&d4A%y&f%oMX)-9?u~sMI7n znhRJpKHa5Lx`G%R0^>c2+88-uBIimakCtvJmu^UwWOfuq#%K~>hgK4Kl3@~k?dAo% z3wy)Hl`%9_%6^41OC(Q-Zd_bX*I6kVi%%j8P|212$hB}#QVAan%W))eU?BR|K<%{h z27fj2sxW*xzUaO^tNe;Hp*!yp0`=(IDl+hcU~5Ww7Hm7fdgmXnNQuwtyy3SBq{1vcx=WJ0g>Qpq&b*9UQX7kR2HvTOy&e#7V^X7B zwmupzyeqQY_t(pEWV!oneb_FaPt`E_w!td5Ef7NKEvsYv(5T0|?f*8xI20~!;WLg2 z->!7pbm;XjSZYgH|KWw!O>lO+JEqa**1&H{pQE~d@1sBS_>Kf@YeR;@`!60$AEeOp zbY(Uu{38UhGxz|RnY+$j2+vKA zHJxRmE)r#;M%lmLhWX#R;=ZosmVZ@6-{ZD8*ydB56t=m%dHFKz`vb8#Qm}vUctdpU)eUa)-it_$Z4yyvhm zFyHXzT#m)r&y2Na#ym3qs1i?}=lo~mVrPt~LT5(*W#rRGnd<0h6^%T4n6o28^g-sK-iSKR3UBUASxW|9 z!y2Xc;rZ#>jPC5(oO#B)RLN-)Cf=1f+T4U$=QtZs4iMkk0B+F%dZ!Uz89BA>@F_|M zR$n6x89$cQu~|cG*M;)U);0kO+qQkieG0qaFjzUee0971{(NXPswC*M{4ojYW>6&Y zhlEI4niF1PGXZE(y&9CfqQ7PZBfq*NJ}wCy^*(;%z>>P61KxZeBui85$ZI?3fM7|Ed7%4Kr@eHvZ$1v0TBM(c;bQST^WP zk3Crd-soNW9b}h(oYJg=9*2I!ZleP^`Id78nEAsJ`LVS_XRMlTl%N{f8!TYoH zym#NI$m*aO3bowR>``Thq0nt@0j7^t3zHU~@)gRi;fi9;6%du4-qK5UWz_Fj(ypF% zr({s7vF{QHpqyw+?GyF-MpqGbl~Wr z2!(>dV3>f=&}Nn}0899BN%%38ubKQ9h z$Il~f#zV} zuVaOqar8*kg~L0kg}%X2ooExyi;ER?PA&V=DK?}tS?rR`4zbJOmQ)T`*tQOz%lp_) ze+vD|Wxhtl8g;l`-4Dd|<}32M`2di0)8#a1vv2y+BskI-cEK@+-XkB5pVo%2FXoRu z+@%Hg;i6#8@ZI1Ja6IVU$>~Bc$=FhUkvMK!FvK&)-HbbckI11OoO5#QC(LX(2-x3= zA(k;_qHz!$9L0W<-JDTfIyzs%g|vE~PjR;J7M;gXaJ0$%gHxj>AuOp2TDrU(G%aBnJ6QBBEde@7(%x5ECTj zXM?!L?=a!QxnCsl+0_|*jy%zvhN+GfG!x^zYMg7PRoKT6v_t00kE1cxmnDkFe;F8Q zQA!LgrfMDs|CIKP=z|NVvn8~5z6~$1eIBtOzcCc@QO5Dj=|SYHf_(NYWgPoxj{YBK zcK#u*3}|C%*-OZ=^hO!T*c3!%IN2yUrf2%1LMO3O0Xig7d()Y~gZV^8+{N`?ieS=H zL@f&+D_Z*M@!{d}Wt*_GNBq?rmcN;mmZ+)8O^wuk9%USBN_&0Az{47rYnBkGP-T*c z`8@Y%?RR%2@==1-Ig6W24f5me^V{El|9&~1VmQU67T`u3TCvpNn&IGlTH|{9Kz(gH;VL>ulrm+rhVQBOl&A{rY(c zS?^s(I|=2jD^E=Bbzf$Acu=mgOHh`+Wdx6wd9fM50IUwlWXyd{Xtl}u;Z3E|*f<9p z{=nytaxt|{C)E;2@eE|EBDx&I%6)1S{-3O zzQn|GcA5{BIt&lARoCmqoUx#wc>dkKJ}jU!78#qdbG9yfQ`w8318oFnp)6Ou4znoF zlp?>euc0|f#aN<{k=;uY#-gpW&Jf7V0Mi$5ZdI`z&gk(DA@NWbasMqr4C-yFBJgk@ zc^^Q`YX)AUgV^o{cIk2Q3RuMtb<%Ne_WI3`v3gZ9vCj|&?Vi@KNcs{Ogw_Qn$P907 z^ow{Hypu!*_>JRA>;wX6u}2fMiX;SWgc@xPv+2Cncnq;w1)yJPXD?+!-H)VYXPJp- zOif6xSHF=Vc4fP~aSWJT^m2@p{Y(HK9M77X&f)Fp#mPXIxeyOsc(6--4anBMVNP$e z>GVR(CvMSQ3bkXiB&v!JiXCyK6lL?E;;9lDdxRz@Kf6N5%PGOY;U)xw6HBY77MK<&90g*D=bkEH^dMDo8c9&ss9VvtR6};;B>P zOm@#$;-X2zSeNWCCB>}S%kxoEB-$yais3 zP9Smj0tqi;Pf06)_Q_Erqq@4}d@paw0%Hd7qMiw(j?RkC#OjI}Z}~Wnhq^L_ zqj7}^Uj~JRX_bnpx|lw1&ZLVT?vb-k9W%XleGbf&?A48|_pAM^_5stN^TXe>A}^q)OEJ^V{N%zHw3 z*{6RyPu$z{_l%G7)6ji=9nZDv`d{$~M5%HY<@(MRd+{q7iwH?aRSvfH3Thk6oQq@7 z<8M@JZifxvlb_FTtXno*8N9uLM@Od5OHq$_x>~93*^6I_oJ@A7K8-82iH37_m5{&n zYP@fV%Pmfj7QH`?>58VAOAuYh>%}2N`*kCm!nsw%!HlCzNp&G8L$)qRbC-1LggL=& zq;23kc)^fr--H3=C3%=O2l4?O>g;g@T*@Bfv;8FAD-_ptY@^qdkV9UzJX~YSLD|Jw z8F!H+_Nrx0(l$hG}& zGv*F478l7f#4>B1BZ|d#g*5A{2)4PfYu#;7fP2VROWKPWa&oX%+i~0P!Ty;O=OeDh z>$qt0N_PyI)VH+lD?-6UZ{DQrb!*ZY&3CgW=-(Bs1R2fDV+Lxzjsn|LnR!2>bP?El z-IXtYl1KAo(l(rCG9VLj`Vh9KRQTC278sQkhVN_qePAT@v#qJVOc+XM|x`WwUK}axooBQ{r z*+5}ilfNQ&N6#{vCNAXe^C4wnHrhT%c4VJ$T#meh3a(k! zF9>)iPF&2VY?hVhvr-A4Za01(qD7n^PmUiib?1ST>7ExJ-V$-eWh^O7$g2fb#-P6dU z+2k}{YM!K0GUCMCEfr@|N3q~GM%1jrsoUVm3|=Dd5zcTfVv2CILOx$_M^FRpgKuRxod5Z~~UlIscPOWHQPu=8kP-qW749ehp* zC@}S)(HGg`U@IwGwMGxG`PpVSZ@9yUTmiv}-x4k7p1LEjMBcg1r7c!0cDLGL{zgb>6(SGB(_x;-7 zY`f;<_)ZVWT9X$kcIk^bd76rbr}TmBoF0#|qF?VQ)n=rpucJiyM#!}ToY_)c9*@e3 z;#?L)k!l0d=eQx@xbXPW+^UOE_Wpgyr}4W({jD!Sn)UNNtIJ7;mPSNyRz?%#Y}_te zRD%F4RL1WhAXP)8X)1DXZl%{E{%{KG)$4YaG(8)ZqbZ3uZ5zhjRh)V~8{w_Fg-RR( zPvN1=(qam`tI@+d;?vW(jj4)DUW|dmaCpL-_eQK*>Vv-a4pw+$hSmeAnlJO(^PK|&8=IQaVG!K=I#ZqTB)eIb!2Y`>h%7ALoK{Xjb4d`qnAY@sr-#Etgd{@&Z%ou5iu=ZVoya*81O>W#mYGj0PFsz zhrP9)8il5al%DD`WB7Z*2c@AqGQPT!$fmi6)`t}F@d3w~!LrpwAMWPe_vc+|O!|}d zw=Gs4ldXp%YkTR1H|e)}cl{qjU@vAcJm2K?<4PEA<&w{qv?g1eMOIU+HM{Hfo$j2| zzA_h(`1+YSSBSQWq|M8c4PrL#<`{9)577v>Hj=`$aeMdLrr#(>;CYhD<*p1et{!wA zF7qOKn%yw7vQ9P^-cR1WKYxqBS6TzevZ)pTh>AxmOcs``IK8^q;AxC47x#(`Qck;d zIS*S0pS1q+xil>JRj`{|c*f$2OjC*$fmkf5;=gjWo4;j zJ4rG|Pcn@X6+U%!Juz?sN`|j3Am=o5m=fF&GviUL3(Mu)WmEc@7pm}1`*2E9Uh+%K z^c=gynq}LhLRu|>oJRgAE$46K>($bIMA*$OB={|N+$EH;$mJ3ou0kWozAloi)#{l^aX;5}sx5jitI)cZ znPfSF_tjXs82o_qPnu+J#4HksOu&-Ei@c!IA2{?U;k1TAeWvhASTa=bB$gRb%;>E zhxqpz9Q?hB+H;;VPv6a@?Yt$vN!>NvTQkWx5Kj5l_vq|z1MQSqPXEPqu;SEspb;36 z#QjV0Bnjtpx5(OG0=|r^)uX%jO*bJ(OB$b%!S2;$*_kCN419v`^&g3NJ7n%NJsq(Q z3^8Lt_pJ=I9-9k+lLe(2J*-!kES?5PgjS(&pVMBAFu&PiiG>j%ZJK}QQEY;662^u7 zbK089mXgB&Oz+BuD5^u+?j zdYp)UVrv&icm(|_}$mebaUPbQJm%T>uh;?q*LE*#Bw)ba)9`*gyNS1M*6K| zZwoUE2o3jddm>rl!PzNrtEck3EplTnGZoU04)rz;o-p>M@7dR1DS624b^$IOcO(1x zt%gp3DQ|!@^o|zS3lSC@?cHWi1&V|OvA4R|-HPkGnQ0WGcm06pI+@>@eOZ29RwgL; zO6TAhJ3CN|2ZU^?S#oCPD_-oM+9?QxHzbUCm?pln6%$BrW{s-QxFb+ADaUOmVLOgQ zv_|Be1qBvy_%F~My_@?xaNuSTZTWbMj#_sPWv&0!qXhu6u>$@8jy(W?74^rL8QM&f zM+++|4*;Nt0~8o^QQ%%z$ri%fUH1P3NXb# zWC{RQ91l7Npep^R44?pLqx(g(0{i;?2|5f-e{Aa-a1Jr!jIscXa2ZOZ$I0f!iUDoyt?$uG%IXO_QC^oi#eiphO z=Z~|`{{jcje5j=ZXOP=t3IOKk=c8}KKk%O` z=T8+z^}o=MuoU zrq_ZW9WIYTd^&q~<7%=}g7wwB$m1Pz3C$ZpQu4RkOiCN(?UJ}^pes;(oEQ$-oUteC zja98bbqby9D+bF3anN9kF3fXtv*o1mXZ*kycS!?ZyGxjKQyvEAd%`K^0-|D>_cKA0 z;CK(ri7EfrZYFq5ymgSCT-kyr=j(6vNn)z`4XKA(I04_n66n^#G2dEgMRA}m6-$>i ziB2Q#QuYe4qP6J+%CIav&Rscm4qyj7DMUdVUX{V-I5}KjbV2OGGak(~f-KKtdo|^; z)2`H&AfU}=DduMYY9dO~hVbrwO=i3&BiumSMmRB7^m#oMTZ?Igo+z@^vrtO0-6~W;~0Bx(#H>oiux_V3M_1R%XTO z4>Y{5){KvcrSUR65RbSGJKQQ~jv|7; z)ObS|nj;0nXV#WjW>uM?LkAMurjv^y1}>KJ>hzNYqHeg_?B5LwMW41*{Z2z1Lo`cO zJPRGRP9q0LfRwV3roIXN(HH{9?>ECYHC2j3W%wJDXZBO`Dvv4)OmEK1P0C6UnQAcC zIr4+=5bOdP4c%`>tng{I?kzUhwdEMwK^m69>20H=vqP;zjT#ooo*Iq1rBBwO#3!}Z z6kJwG82#a^IeHdht4n%xByn|9rf5ad9+!&pH~^z7m4phOMikC^n}4V^#-@9fGme_< zh9mRpX(GEA#&Z$|@bWS*4c-_PPDfHm*s$8WQ0NJ=g}y3kbAE>-3&kS8(sb6hIunf? zQeeUjApZn(CK}3YLMfw7u6oLI<_@uLh^Y>4?tM}_=I`YO>s#Tc)Wu&8W@t7)NvRAi zgG+>dr8!3=S;=M~2uk~*7?#V1?AC4+L^Hj|y*)DGhwsLeNqvfja|YrJ<<^5ScBm!O z8b5oy-OViTu$ONk)6cTk2#@!2Gq1?%2*8kPeMa(0oY*P!?zZ>DUx?dnT&tjFq{sQ~ z)PA1AhLVgME(D(aSCHk_$YdH(y~^`*&ZHVnmmLXwH3t_4jrh#kd54TJJYg@I zX#Dpi9^b!PFbF>G0?|%u0A!#|Ky(AT?)MNG=-+sL_`iJy~9Rb9) zgOY*vf!G%4P9M=K5Ly+oMWa7`{8BGpT|4;jVbo*^|XkP#xA9`MFLihX|&Gc_{ z&*+~1biVl?geH94LoZeT`-q31bJ~-8ybc%IO-Oi!N01Eo_up7bY*6f9kbFJf(N9o7 zDZsA|VE2?Hx7cMnhp4FWGHB)R+6q&`T~ani&%lYsJc+RYkSP}x4}ce~TmWz@;Ub1| z=xG`oht*wK$rS35NX=da08~Obfl34wnu`EjB??@906-9m$qp?=GZHo~0vM}FGnD|q zgXr2n3JQ98+i@-ryg%c<$Co z-sClUWC`Yj+!mYe}XE3f)z{7zu7rKAHk!^6ave*eZ zix>K`QX;9oA}F7C(c2v&AEiHudIuH2p2Nr2DnDQV0G=C@GdSmTwo4vM+isd$rV*+) zH@qk_R0AwT-UGs~GjBG5{X3C`jkalGz$$C8Z;hc&HS)nN7$a*}I78`*3JQSfJJXF~ zc=3GqR=?C*itdiIU=kzi4}3zUzD`*DO0BIs|LK)0L)TPdA}1lcrOJOf7ZPeEhd>z~zXzN$f*welPPbLU7+Ub%+x& zER58ia!lQaI|Qi6Q`hz00agWaqo3C|LVE*7!}nYC*e{}WVE|xo2wf(D0sxE5(&+Sm zg~$QBVQp3b0I1#sASl5p$p&d84gtm7RX7J((n%gc45m1$91 zTNT2`_xw;zt2t)gGRHw+(lWW7-*H{4!n;DFGp)5N%>pK2b=!5&TE5A?o#MvFm*Qp7 zNL}IOZ7h+Z?&Ym+O`W3NN$urrYE@gl4qdM>%j)nL_cG&wr8y>-uX>gT!@G8krWM4nU7no0Xw}-_ZPW@s;RT zt^iTD*q2h-<4BmTTD5pocu3Nu(d zgOOE*=gZxH!&7pf>i)8n@Zq}$%JIZ zW8IDog6LNh)=VA>@i7+)?R$&1+wlW}SocAjH`HTNs4&1(D&~b9%LY5W13Mm?6Wfcz zae0mbY!q?1VQUcb5HZR37@oSOn`QsGPfiok_g$Q<3~=9G|&dDHb_DRj`@JldZ>AfyfU&;E1_v{xOm&*KIt~ z-+%Ez4YPUC&V@>J6was4sN&!h}PTS=?b8Sn|H@#!(Tux)|1n~J9aidPKSSt-FJgw(D-;-LKx8d!qgwk8Yotb8NjaiX&$3`(Ky8LLS(3RZmleMv zq;Zj+TXp}E)DV3ef4}$~?i_Dq)XSQUy+WRmO4df-Nj~pxYcA%qTFZ1^Ws?gs|jRg(2Af z4#aVwFmBd+Y94+44X6}BC?m^?UrF1t1k7j=KTyE=aYf&o*0qBUBjk?W)7Eu=tULgr zI>b6gv41Dr{Um1J3?OkhkVeXVKN9MTA&MYV%TH-d|9O6NQV<_a#E8{DH6$BIwZk3 zJ|{W0w3NC~GOk$SA=l)Hb%cvXg>hUsXobr2xz_sE9yp}0>F)t^vmsuxgzVDq6kIKT zK^2dN%9U|@fA|A~FX#Ktm}IH0_ibd@4AZhTk}F4C&TB`CtzJ%R%Y>>M31J@X$AxHM7My? zSp9x{eLu?)N_@6Fs>DzjJ9h+dc9T|}%2)YL{s70QI1A)w&vOm{{6r?rr@%a=aDn;8}ibz-C(qDuU3Ul6{u z!}O9Y4iWO+=(Lf~*?S1PLmH1ho^%eBA2N^9kVU49#%d8?XE^L0 z2kS$9L=v>52ah_Z!x?d~M9SyHWmLKev^;XUmfBDwk~u;Z2An(ZcdY{l5Mcon`NU`k z$1fOB@WoJ06T_ZP`tUpt9y6m6-KL1jEcBv`)+PRGmexxWd)7O#H%eeBC2}(D^>sgs zYYBR#W5>;2t}j0Nucbu{-I9U%bFVwaxt~7el}`_cq&l>zb7Dl>*-sU!*5kJ45BXyX z`44YCK0e-eqHWjy01N5|%P^TA>p3J*EJ+mbGZ_HI8@j`J5&= zD}BKu_;K!Ligoe%5U|NGUu!ox{!3?7Xg{toquRYq-fhrv^e;(1+Hx6@D$gYhWPPg3 zweA36{yxO4h<KXC(kytcQ3%`3--M<96J%V+tq*wsft0pqo7M}jceS*L$Q~<9_YZnaIeLlVfRa0JAZIri^4!})XdQSaDIr= zmpi;9IWRe|-x^tN&op9qv& zyzmv;Lm_5GDCB$cOHe58aPMGkQ|PW5#B*(pzbV5`@S9o4+6)i;VtQv)BDj>kIygW6 zaJy9oE_B1ld(rd5a~*oSEwD z9ULhSR>vfsQL(l8$tmwPYc&kF#5Z&OnLQ(PBVuyTiQcv^w}@S(KBsiI*Iq9RR<2vl zZZ}ia;l3_Hr4LusJq63LRyKOQ>(Zj`B4N8EdVxXtVau#ZR`@+RrHk$i)vs(uEcIZl z+BdrrUwOSvD>MW@apm~nv&Spjgt(0QgR2i~2uz6k&PEe_)SXwCNZA0c<5WDEZ8mCR z?jIg)qSbRk3Pd6n;UXRB*`4!eD&d9j8P3otfq`PPx}3nqx!e8EV|WHY?cPCsW~(8w+w!ekabCJB@{@T;~ksg-m`jj@uTS?}wNP>01Q$ zext4oOfYft@JXdeBY>MyNVxY-*jl#E@-P3^l}hGASp#A0*Kx|RF7LGmX^-c|x_yI+ z*r*E4S=;e~4YVV!(I4M$I6bMP{g-RPMqt_$J0wxVa+;^w2xEf!@)hPKv8sD)kM5Fr z8v6Kp#B5`wRsHyuMuVL2a4|I^e;RdBbbh8Vrk&$6@9nD1#_!RL1Mb?MnbmI`=nS^X z{x;W$^VoL^YljGf<8!8igSptfodkPhGa!81u!gK##r$Fm*yFG=81z+&3Cv zm*HU~N)z;{-BkZrdqW*DJ0Ft7nHw5{x^un*3u<##gjA!F#cl$H>Md+(yb%)!?Y_B{ zF?nG~L~8!>gCy#(OSeG+0fOgkZ8&UK`AQ2Mz|P?CGYEaUU?buz^I~isanufnaKSWQ zbZAH}q`py?q%B}A+=I*K(k^a!xqAZ@Wm~VCY?@WUeZI3bJCyVqdHwITFN+~S|bSR63e{xyHwuUzJYn)--PimyH>)Cro7 zt}kSS_W^*OuAxCP{}9kGr~tIZbEwu~V*0MYUWV#d)>`6WOpPWLda^`t#+hzwABza@f1*Lh-hnRmH2v>fo<193{$zWy2S-S1}Kls!nvS4>ex97PVZEsF_ z@C+Dv8FE+@^*k%Hnw>W~3-%YJ{OD3%?Za`}rCx)U5|$AyXeF2{tEc?p?r_J}p_+T$ zl*$8T$SdJ-?3{VB(w!~?1z=GCLPCQ>Lva8WKzkg3A;66SfPn{?f)}zoDiHx%Fh)Z| z+5r;yg!usZcj#puZI;6q@6^YJn#H?AbB*sTTNb}8sX$#Q3b|+TXc9>lOITl$Ybktc zx8P?g#G(pbGuz#Tq?cMJ-+37z7FNjlg; z-YFAkuN?ci|KZn|VKCBGN_B=_4n?25;MkJQ*=SrQLj&IH3E06(Fj$)#KvsENGAt8q zz2}^N6x1`Yi{PskgGF@hn+q+HpipNLapI=D45cHGudvhFI(MNI>a$3RpEI7i!IUBg zXK-dXJbt+_@&ixO7q9MfV~rS-xwYLYTLY`@;x%>VPz74vIBNgN_!hEq6^adL7yiZ; zyz&YVyyhO|iVb$7_M^prWwSP?3CqUAHnL_O(-cY^7Uyd_5tJ~SE3tHTWlV<6aLv?r zhn@F_b6ATthd06B*OTuCCN*V!Ej$-p*U)9xIXlxF-*NQZeb=YSiRy!;PlhfvTiN1B2w)zfRVLxBI z3>IfcJ78V713OLp;^u8*UFXD;S~zV#cK*C-qRnTzccH7f^FlknhkR)8qCaVSTd4fL z&Ic9Mqo(iTQXv)`Im67y(My4) zfFVMF0APq11B!{pEtmiv^py($VgUgDdjJ3)ddCd0L=eYRw;T*8a9*$ zod9s6SOKh1010}c0q7TXf2&DorU_k-V0D#ODdgb&4SCjEhjZPGHz=iIt8y!`gtCZj-nS~!mGG?g2kYUOm539Q=g z&(@jH2Hz;I2*4XvAWlZx^U`Z|OyCQbavi-erAaUTP|!>_TwGkl8v$|!+kOT+A~)%H z4w4~LIH2@C{(8jWWRe1M_X-h78?{<5) zUBqzs)iLO6l@ZgJBuy}i;>8Lt*1m>ji0S6k)I}6?zcI!7u;X4GE7D^vBw>U%k_@#B z>Wo!S5|AMu-B_+=tc#a6jVTg}LwvDfkBiHzH>4D-8V2&W){9&Z*8eXLb| z+Puf*2a+6q(ry!_i!{=$k#OY`6XZkmLm8e$vmdh-{*bVeG;Il`XG~3zB%#QTJ=b;) z4JD*99Or|0KxJR~JH_&2v@1rGVHZ=sz)13jtod4)+g2(VOYBXRy0m7@5Y02}%P>Qo z@x6vlp%Dg^FI*;r>YjtyI@@~L^Ar^9VTo+t)H|)e6hQz2NS4q#^97%fl=RGi9!z{z&eJv#-wIi2zJ=02ZQTR{s6>Dp4W{ ze)A$f#zL?y^Y}N?yX9dI6>5ZJzKPej->(kDl?8lbZ;Pk}KJ65UWMCM_h9)MHb{#gJ zGJ_fl-bldYet*ytLk_;RXJh6gNvAbB$X4}&s3OQ>E zGfQn8ltwLBA36z$lXc+0`fWoKS^%Ti>V}?Q_*||rvfy441Y%Y3KJmvzR1u3i%2@69HV`f477QphO7p!*FZ1;Fqs^4MytH5}72|lKP(-xTHAm7rl#N>~B{u z-!Qd%o1QOe!S&5=zHjY>tB>e=g$jgXbehjM;6d8wJ&4akfKZS4(8lXU>Co=xZ+)w8 za?w;(je|b2ip+*DESLMdjbs@}?Z%2jZ?^zd<^R%{Y2F*NF~}J)GV1G!-pF7ALHf^i9!x@im4(@^;?@D85f>f2ZrR zIeyAas9E>avxB8JEA-Hp7txUxH>V>>ISWS?5io0jkYDB$7PE-C>G=fb8Z~<~U3-iY zQnc#xFJM9HCE07;y_)bk9F0|3USrvb^cs}JQ>|@@(7c++gjpf2-Qo(v+V1Y)8r4)C=xs{ z*8;mzn)|9nqk+uz%(2A>gwmGs*&P9c00#fsf@|IP;1Aqs@HI=gDU;Asvu{D8W!@9( zX~3a(JSWNH_I^ZUPaqA#+XZo$JV1x-8}UPIdDOK;u&9HlqSPs7zONtrU=xi%i=Yw(O^L%nFQC0)COBrDcgFItgfx3^I@T?b31rU zz?iA3l(d&r8K5P39$Kib45m`%EHqbi02kbqObt<+OY5gYwtw5Ugj~2BSV{yMU2U8% z*WPDJ_y*C~J`&RL*8|WiC@#oNRNt7?$w2M9ux$MX+bs8{WWU&AFmiJncdMV1CeUn+ zWElr@vi5{$pj5$Y6s=+@Py=LeazNb_);cO*dpd?*@CQ z|3yk z^>(H1+*B>jwMp|~bZjr5Ny}?y3W;<1oSS0Jq63#Bxk#RpyT8$JH8Nrxw2X9l|A9ww zw^Wiql3(b71(i(FEpgAmrzW)-R!=f&%HR6B^qXdSx@klzWz1%om-qZyj)Yk~towuQ z;y`gtzztgCq0#$07i(mP5SB-mQZFv}3w z9m7dgU%t;kJ7{ zB`&-+7E~9F*y;$fM7^qUc5bPKnwd1Es+zBCIjA&#^+9_qiny0+^{G|t>=i$o-D{AF zldC|C(K6evy8caJygX4t8=Aq3Rj8|b$yW?=z_N!(gua8oiZul3waUZbeVRz7fHgl{` z8E);};9HIR7IzYV{}SkiwS7D40<=0Ak~v{@z}y-w-kw=-OEltiuxD8@4vN%}YXU|2 zyTRKtA~qVX4(p<^*3c0VnET{5Vqe_49Z#@e!g>x-8&NfI1%dsuJX(s#Cu5mh4Hl%<(v%(M+2t>?c4; z)N5Y5sg6TNg>;NhPxmlRCLr3-HjS~uaJ5F_=TU)|WLBpZb99_9<_@PoMTfcj?u1d3 zMcDbs76WY4Zk%VS5qoCIT)9c06~3uVh@YkhDd2 zq$$VY=crqf1F|cfce2Y(I`U;%%W#qM?SAdYiQZ=itS!?!8dxN>Tw;E)wqGviXuIE5ZGS;~RJ4+S%E8 zMhd-p_z?a+VyKg6?ei8Fqrq%~rPpe?m#Pu)|hJZA~)cA2Kk6M5N zuAF~Ce|?S+X`eF2cp+j5d@QRD!X^5U@ZscZsaQsW0v?ffa0=i@rNB4B-LS93%wNkG zn_MlWK{_WE;$9S2VSa?RP)xEX<>3}n7ADP}`rh3*peFlJs22|Q>jsB$W7hVGp|T;$ zPafLtCWau9Egy=ptZ=?JYwItD(;p;Cnq*GNP4SmkD}1u=3{btwr0aA-g0g+7$BK2rNA*bKML%gU z8Ei0t)fg`591s-kVHxIsT02q3x!_gK9Is6SgxI1u>VD{5yLrPuTXV2wc_oa07hGjz zyags?QCi$(Kp;Pf_2hWbANje86B`3HmXP}m0;HE@czMm9P^{hV$?gW8I%csyf5m=A z!uf`qOS=-3YgTG-PI{OMBaOCXA?`vF)?$uqs$1&R@F2ASrWf<=%fpF~7j4W&J4#=c zw=6>yZnseR`4StH>IRh_`+d(Jh%$H>eHBJe9=}RUg5gshk9`WexEN@<_=+&sF>t#I zR#cUeqmX#u8ou)jlfV~+c=qgTKWL_K3^#c^mRt#<>|MYc8eHRM6g^X#H1$yhrwe2F)<5AyPs+W zS4qs!uZ5(~(D$u;nG?l)hh|+j)jGxKeV8P;=QRGVjpHl%@1$3m*?H6`QHjr~P|G9d zuMi{I-AjVX{qhP6k3%6olqB#r&7?TaT1m%|mMoBda{19m0uPrEM5VRt8r^KRJV#z$ zQ`4EcBsN&;0++ocwvqGW#sI&Ksd>euNMai|6;}OBrrp5XC~NO7bzXbl`PNXCFz4e$ zex#flw^Qo?aW|EmzffgJjI!1FJ@li^REOz?@dAdNNYYm}KZWg)S#WUEDOKnpD;MK# zt@hbcZw`0r6Q%hxf{fw8-b#{|ixzI_>hs5H0#vJ)!~uaD>p3b*mPle;4`Cxm!nC>( zhd8LvK&QqfRzKGz4nTfNI=5D^?Ob`lSG((F#4;{Z5-yWkEGA|}Cg(f0R<`oAiIpNo zzX3%Zy~nyb*#3JqReV^g3jMXMnx9s&XmOP^#9ZEitDXt0L@-`cIeaySKi$tNIQQ5Q z{=Feau9p!PBS8?WyZJj0-JV+e%g}s7rc%68>O!g+{3RQxMpKr!(+j(NKUU|ic(pxX znpj4mcGYzi+#@ctC*L$z{|sz&0fEE;BSDygc)(~$nT0H|F@&y!Y|~MxIK*^nDNC8+ z(p5BmA#PJ#ki&o7fb^(s9l>lk^n#yt)Ql5s9}h6wL%ufWAx2V{+33mx1ebMbo= zCy~@Q4&NnJLcuAFtp;TP=_R0}h~F^}KF|AvQ}6m(W;iguR-S~x%6!&Ch#zZ5=E3To zPUrB)Rte2o*Yq~}57+DvsM( z?~v_zQAZsi8BEnbLR71{JZI5%Lv2ANTv8MKp|B6E!nf@pV5S8nAwOim~^L zWQ$D&5SLO+OadKM{50L5)huei;KPdt+unL`4cI|pV*t|7wr6j3o>u?fF~3y(et~PA zsEzu(m@D;CK;X?QUn5TPP@DQU0Rcs5$H$5z!!~ccN;EEgS`YG&uIAfPT(5z#ENfUe zn@40FdiEbfN0qAcss?>lGcqOOiKG$P^1s#l+`D16B$*_Gaq3fQBZ8SNaXMwWh+)j@ zM>d?X-l}@7=~mMj7)U^UVV~)d3;%|8IOI*W!#FZP);Az4e*)?4o4X8jIIb$D`e_yx zu}0-_um4<>xmA1i%H5J{kOkK@^EwS?K3xL*o|^{yyUiTSTOH=5gZ&{+3dpao)+i zA9JfjsxOKd?Hq39v^9XvGFW0QXmY0-l@j|{M~tJ#J5iz- z34;Ry0w5l%6??GZ)UWG4QN7e^i2?X>j14LbC_H?YO|nZ5lO?G7>5>Kw@=VflbLsSo zU@wN1I)Mq3i6m@X%|_DtOw`q?T=Ip=$*?q!4kZtu?b+etA{q0RWdAY{0inj|_gI|T zc-Af-1@w;-qDS<7;3)FMP&g|kMntj`aR31rG9--`^r-tSxsqJqdUDSmZQf;Y zy^gncp-=wh2XuFdZvV4b^oZ$ox$%Z*e!pAA_2$v70@*Xps|pDxCqIHwNMMUZ@Zc(w zjczao9+g^cKy2t8jM3tQcf0ATUqLQ4euc^ARK4#6M%A!5MTXx42vRRJuIs+F-j;e+ z2B6Cr60BCo&*E}7sqoV|Q%l&=^yr3qeqON?@j&I%1-J@}%lKd+4`0kXc3%;D;t{+0 zYOJ(>UCQV~RP&_KY|)x7pWV4xXjqN{sO`4#C7uH0iBQ~C}bu!#H+1`DNa zBQQrQIa;r~N%bD*q_58tKLc#|>x`YW%h%-(D&Sph7Kg^Rw&SL;!%pI*sPIX=>yT!c zv+T>@v>V{BE^~x&e(DT{Fu%B^<3{esPKK`RvS8?vd(9TYaP^x~f)CW6ZW|nr`pqpt znwy;z?Z9Q0Mc)}@shUTG-<2E4p;cA~cYRO(&cVvj%9;)u^kD7kO@tvV>`u%(#Bk(D zM`IjlfyNCTuXGq^2v@XwKrh!6((dUK3GOcuhkEp5LLgRXmvm#6=3+J7{yxG&C-%kx zQ%J~KwJF2?5NVg2U1wl1>IX#~RIaO0X10$>6?N%p5{$?X;zQNlMmbf+XA9~(TT(zE zmY>nAAO}9^oS7bVSHWB8GhuSnsq?wqwPiKiUmblLqPD5Xv2k-6)7KWhtMCK z%&I*I)K7C#1NPFT6BRLi*=73h#SwLVy4#^sP1&eYUPiE#1r@rEI)6t>n8?$e#0u5Y zD6isy!+wr@_r&DOGt9l(T-(DYy73_% z|At$or0bL1ubyJgBC8D}wEa1Uda#m00I})op|`5@=Vop3TtCPIb917~datf9)9{60 zst05-ahTz__h}yh^5{6-0A&i4Ou^vr1ksIAcg>||*Vfq9(IvO(!fX-#bBlr^I%c&- zT3RNs0-DX+m35RVpUK{I_DL>yTl(1>;Zk~`=au@94Jjiq^%9eOZ0r%L9^Sj4gg|sL z(qj_`$^3oXO78t_%er;n-Ij0hTfgr;>Y7rWzPYQ+ZFc`yU28hLhVLTd=B!?x5e);I zW$OfedSXjlxqz>`z9mpHiR_s$WMobi6-}3tDuBzXO}atlFjweL!6wtm>@zOd#W)}tUEtN*32ZFp9JpB42L`kC2R5PW zlQmxten&@$K03^p*y|Gp*AcpU`97SHLgEeVYT&$uXT8J`)z2t;-PH=UH_7z>$M`a& z1DjRhX!KztXAN7FTSyz3f#LaTq~)Sd9U7Q+D!Ah~N87?FC~g5}yWmVY=YqCE7slK+=n`g`t2+ ziH$>aruOk&c6HwJkc1+DnTXBYEp2(s2yAAqp~s9)V%^7#jj3jAwsdKn%auq|UF+&d zVn~YU(Okx|((0aNVy=UBAC!my1+sRWqt{~FWhiiQ!75pV_`u01%yAV}oUa|(o-1}| zG=18XtTknFMDf&CGFHai1xj9rLjjwe zLO*h4#?;kwV+UrsXB`AqUk_KMqxH#vwMO>z+7CiM1F6y91coYvtFLN-=&w@oSk%=s zh{_9GUZatJl`i~&m^WeVIjs*$wwkv*r<`5=+&2GNY)74A!;xjdTLPTgVV{P(kfuN* zJTJU6Bsj9kiCy46h?x|m^g2@TE2|(GGiMzB9o}z_RWt>3T;)9VXY=XE4~B#y$3q&yNg`$`<aqfdC*p)<|V^ zZDD%NNihv|flxg*a!`4B3hs8Xz7liFFz`JaGqy;#AurG(QBY3JrhX7E zdt^Fuo1$$9B1V=1gb`n1p#WKN3Oq+vY5&RcWO99R{g?W9{-;9~UTDSdpuV)vOpKz2 zECZ5sGZ7h!Bt=BOOg*_6kkm?G50P9o?das$_AX*TKL0kFf?k|eKAiEL1s&uL^*H36 zh`T(mg;B6Ot=gIi|F& zomc_v4#C_L6G+)Z)SU%uwg*mTou;7QD4vHSgl6SE=?~;W=pFz-^4wtQfnKuNtOu+1#mBjL*#yY)JUf-2p}oJ>U3R)Y2_2)(-`yW@(>iq~s^BqTHd50592LL5> z^vm#K4zmo)F8AO45kYqvj!Qv#(8@18oh*d#PYT2~tqG$2>Z~)dEoWD%w?sei;!e#B zHWG3=o>5O_W1xFQ}=qnIhh8lE#Ofx&IDEETm=>A*$1Imv{&B?QF!O3|Y&yMy+@)WrtVn4dx^f zj{696aZ$63G%#lemfm9faWo|vyPVd}I{6)#+B8;c5Oq=#*lwK46kE{*wf{H5JB_l}YaLarWv`+sV1Wf4uKSvHVK=cm;;r0!n63uvUDq{3LOEtNatJ@5jZNKN%w>rIh?2a$?*%b?b1f$!zR=8IPCdI0_+!c3#L`6Vr}c~~yAp|KxZEtNLah+J}vK^wwF^_LxxkN z?nce6<4y0TYA1J#>iPjcvZp?L0$J}Gj%5Q!H(%TJNB5)m>)i%M=v2hqrSH4-%&4~=2`A_j^Oy2VnqbT^>gnhf(xds>Cql56Q@aR!kY>D2hAyIQQ1z5fGc`jWB>Edrk1UOhaQIW zg5lmf;tZ)uf@r5C?jy?=OXZ~ZdkgttE_n)zHN>n??~>XfZ{grtPmLsbf2Y8S!pGJN zPbrq5C?ro*2X#qt0E@u0%Tm(#-uZ205BNa4k1^01VIR1MlcJV^LD13Nhu&qRYm z7=**}t95ifLdy)EFoMb{EM;T@mgJ?|aSJUiy@iq+5~DMbD*oCEUcU@-k~e5n@IaRo zwVI~MHiH`^YJ|QZ=*q0oh_>c{7~BC|_ba1~SeaVIxISC5<|{smXaZ^r7}yWtu$XIWcyB zh&I3U0+4jx+rsYXZQvh`jz`o z5)Pe^t1W53tK>;ds^^WVhgst8w6)IRd(D{Q7h(A;&bN>+UwAw}Pv(plhD><4bvM%I z;a{0b3qZnlcam{ODwM>g^s7h1DMuRSb4``FGDJ1oq4jOwA8M%Xdf+t+v;K&1^d^X- z&Gfu=3x9Ecu{KjDUyR3*r6=L$#H{S@UIXD4>bwr4pQ^bUi6HX{vBOSW@JN8qZ6Lo~ z62GJp^f;RRxHTuWn7wGM8l*NyVuAA_|$@@rV)}YxFU{Tw7?}$yr8{K z|3q15VL^~y3U?*4@buYQ=NvJB8ka6lDB)frRdYz^dh#(Efvs1Wm@-Wc0nJOJHPN3k z&7F_50iwvKVV^IBliU7<;b~mzO=wK%g&~IH_6JXcTW@L7BRlupxf|z>>A;#IMyyw`FhvwK9TN860HYWEkU&L|M z<nqYShvelv*gR{d$h5BK;)8H*ZxvtPV*`TXYtyZ;G`RJ^AFVw>T#}wP z>f)_u@D>J%Wq=PC@9COGmS4Trs;IVwrrDfGKR7DxmcB*QMwx+bap z&aZ2RO-GBYoPQjxG#na9CkhST!-)%db~BPRs-Kfb?cB59r94e5s$=F#QG_cHy9V0a z>9h$BmBrnMlH9T^yISg?b3H`unH+<-4r|VLnzi`3)AE+7i{q8mztM=gTa5?#rifdv zh>=+4Zt3%P!@f&R9uh zd*z<}rQLXoF<>zxcjR>G1`eCt`9&l5<=iM>y@nrB$mV8sy3si=-c2Ay7HrI8I&FM4hkhaaQv|qn4=xLY{7}-k1_v+**lw*7p479H745AU53(@UjsG(6kt%)cn zwzk8>Pj>0g)pIeBRt1@YpOm|?O>!Z9>CwNdf8o2$@135~UlJBTxnPf8PU6!CVV1r zWn-`h?8GxBv|w4_;qO66qvmG#4Oe>RG)l)QFkJyrO&e+m1ksS1p0{gzT$rj2q^Y?O zLVXk=^Hz=y-se}3sc57pP3>sgG|F~T#)gAnpPs2YW0c%A>)=q>-j%S6OSN$Z%eFPN zLMm2ft?iem$DoNwDBe|rGlGDXRJ}Gg_KwtJ)N9-@7V+9? zS@s@WN%9ZJ37r!`(*qw-S6fkeD;PvZfY0MVg(A)Dv!b3szi$g~VD0>`yw6bt4J@;z zd!T;(`JN?64ydtRf!~NGJJy7rBw>lPt^nruR&-up&gzO?2!A%jRM_o@RjUHTd{TBJ z=;kaAxYDXJd@ij!ux0Q1<>86V7d26D9V|JvAiLHST_Z>e<@eUiMCRK5kUei4gCoDY zH1bm1-OpurD0V^Cu)^`gxp|fJozV=Nb%#8@VZ*yP#*9b!J5evLQ%DrQM{y6Pi& zsLS#T-PzbTwLem5a0nVJyCHhgOBdE5i zrPXoi-RDdY2^H*&e^r{dh|z!&FK|iECZg2PCgZ}TRQLn2zN7@?;!6!Y1e;pbwZUXW zTvk56?7J7(NH5^&{c52EU!Epq;<2mXE1y~zqBf$t;$g}5>RAanIJ(M8SAB&(&*h%N zA~wdmyXC>i?eH~;yPtkjGru!$#e!fVG^cOOj&1q*on4=0Nx;a+NLzSQEJS^AX zFc2WEYdAUT?L@;`5zRIh{;HBb0kXyX8TEZW+$+^OA1h&cVzVqwD;mQ8uN3o*3+5Xx zOldvl$8wIh73j3ZO5f`Hx2|VKWr7{L(|NcC3d!1w4!DwU>BB&IO^R#}-Od{mH6UW5 zU7aL9?RPAQ6%jwqqY78~AmR32v;o9g&+Vv>`E;*>DTOjy*t+gNmPFJ-BrU{sNj@QY z6gwQOMUQ}Z9io|cE_E1z?CN?WkCg6X_)f}g(8T`5NsUv=T~+{J6?_#Z`5?D~C*Z92 zoaJ*P@gPjT{A$OAu$`$fUVX2G_Tnqw_pM#WJjY%lcCZry_A%x>Fi5*fY=07fVA5|YSCqVHKmq@5~0 zWa7&O^t2QNw^jDId}LuMp~gMltlJB6sq@q^#|m7}{~p^_XtyB)Q84cf&G*xl>KKa- zsCulQuKQd6UT#L*b~9qO&2H89PPMWmSnl-F>Ik+GYlJ{pR7}&kjh-iL!9FLyOr0U& zjb?Fmm`6`;c#2+9B<|)O1L=#Nd$nkzjz)eYF}b%PQPU`tEpqME8VDr|e%pBT_(k`t z)XO^LLooYS-aG8}kt0XDk2fOUdLBmM>H8Tt7U6MK6tq3OM?t1OYxVBlE6k%%R^Kke4JgXz;aAQqOPZ(d`n0ge6)^-?kG>a z`z(ln879m`==Cg#5H6paf-UhZkf6Y%^&Q(hr1c&S60>v9qXdP^uqq;fv zUaly@*(KT3v{Wf|DFE)cdA7+_@kBv6<)&N)=*kMknS%7{*jmTZcNWH<^0mbbD~Gb0 z()%!645ogkkTodC{d|ucVawr?%ItrAGeg-aO{$S}UAXJG#K3sByObBGlY7FRr06I) zV_p8xi8@h!`z$G*-#~4U>H`%$G;pd$D^hbe;X0D?J@10?e1x&+o-nc$n>2Y327qiH*D!WKegGGy5QNzGD_&|im}qK4X-drlXQhT zY-25%zvCV1ehVQ}th|$(F%El7?pD9TBp~1!&gr)s0JB<}Y|%tF@u)!Q>EIl^=f1cN zwn}wAn|tf69N6FGMY94RYMN8UE~*pE zX{&tIYT6@bkk1Ugf1M6%>|{%n2LlQ%4TzZRo{L&vkZXleCy!<450~&unJ)9UYKs@L z8!g+?ft#l{WH~i8cRJ9xdrtCnU5CPN7B~fSXY^)4BeUw{LV!`Cwhd<>UM|2c`q{mS z40AG6aL~Q&|BUn(rugrcevcOcbDl|pQId9S*~!U~CL32@$=Leh#8LTh=bz~qdB^^@kByi)sY*)a0{rz^!U@vP#H}_!ES>PFLX8=t8GIw6!WfU16kP!IO**#Gt z86J?ji&|<8K`e znIl0Cz_?;u$Jf))i}hclGrdpu6PsNqZ71nLokSItVju_@$;^riVB}F{&J$Q~T0Zua z>;3clLY%lZnJ|Oh@^7DT<})1M7n{dGEUnn~UEytmUMU&V!>8|m)xUS-={FOB;;Ufe zX1P_1Sv?f4?4mJbMstdRFYn zNU8f|Hq1vK?=AjyKBl)=Jzm1vcQ-y>fa+UsFSUTe_TCH>Nk&H=O5;*JERfD2~n)3i0I)Z1gzKhbO#>4kuzIC zojJC+KTiBBGWf*5^sV*7l5s>;%$zch5S$&N(a=;)V@hUYuIu2gCJS zTPfSBmaAGTSy|B(RWQ>CLy2$q&&)m;d@0-R&GNIm!u@6a@?M{U_}l!mV=CzLfEIW` zg&abtNTRApnnHz1m8oQ@bhPmzV*n`NhS9sU{pHWkzZ)|%a#FtA_b(4VQQjIXee(hk zlj<>%P>9eA0L)wCMLopo>HlsRy!WoR)Lcn`%=Fe{_CWmIPRDjRU(XzpEzz;_=JO`D z<%@`bG$!lJU9Gx*^?E|?$Z*qaFmt2Pti+ZcpH`0F2G19r|Hw_=&ii${Rrfm33PN=b zj0|H!XN9{4{OfH$?11Nw%JDuR))7B1xWKL5+f$nAf*?%?5QXYw#=Jh3rhzDkMI?v4 zx)juwK^>WbPN-0XhLMla`p_TK`)k3XH#(IGvoX}F)#IP6kMZ_tTj)?BJ(ZKm(u)w&oheb+;G3YqXeCR;RYY-lE9Dvre^ z)Dqe{{oC_!_`UgeeB@t+g7V)U?dSx6xrLvx>J_36TqC=sTFcaE{N@M`vZiOi5nSyZsaLi|?C;!J*{e zCyNUof-JT|Xs;{50AsLSLS-gaoJ=2U>r*biPKIwe>J#CXy7nJ|ae2+Kuk6qc2$tG(;B#%R5*>MhRJCaCC4tCYoTFlIC z?1i|W?LF>S-xjgfZcobhVJ*Ehq%THu_Aohx~h^qj)7)f1$w>U2~^`Q5IgPE zTTxy_Pfy>v!+lz!kNx$X^g1t#!-xg#u3lik(o{)@Hx6^ zBDb`~CL30)_ubwAh#Sv-F)e$XES<+!i_a+F|2lOr33!}3Shaq0EV{cBI9<$oz)|{I z=j!MOdI|rB9~S#FG7_y3UU;M(wUjS~skLgjtc+UCeCG~uZNzsCjbZV{?{Z(qU9;hf z;uI4#ab(J9kw%B?!4&CjehQ*7;~jH}N4{1n*roSmyzM?_n0)`8kB>J>TzVSX5RYGa z+p(A1m!b}LtYG56Z2>uI_?tDEQLE(nQc5|m8;!d;X+)UC$C;Q>e70XYqZVvzufJS& zKCJr>!#|Fn>zq@JQ^9OUbl1AhhhsdY@f@Y~Y;<*J;t`}Ml@z2evX3{wa(Ca++y0=A z1eK)Ayr^8t%o17n7$ztD@u&L3)JsDk;v2>^#>4l2`w#0E@FK4B(sqAe!&8(a@5XVf zmiC~hEYEL!LAoBP3vI^3!s*)c_8%**NgZrTR_&-foe5My`+D7t%Pq@_Ol-ln$Hr$1 zUrQE##`%qvH*zayhhSx?jTygFTEYa=%Q!eDAUQ9Id3Sa7~4 zcwT3h^!T(YyUlUh-Qr!ksqE3k#b~lE_eJMUfvb}A)!m5`h;~fI{j8n@vp<5-^v%{B!7%r?D3iyTGU$#6TgB&T@M86L5 z9#t&(`CpL|G9T`hg&^1S^nSJQP_5Oy#vy<;f)=>_jh3~Z`TOt_`g%4hR42+um>eAd zq7Vd{sBpzbYIx_8qv^CYS=Xdsg$dZQQDZnCRHIDwR2CN?25iqxe}0(sS^Z2&NMv5- zx-pc&U&K^JyD^=04GPJeFPE;^36}aJb5r<}(fOojmrC$j?>w-k;)_$jkRZy@ zQ8ZiA_-l9XffZvZN$klD z!(f?u3CRts-{_U$Y(M}6|ApdTypGwST+)TgV&i@N;=L464!Vj6=r2BKGh=MAyK^UoxEeMFc+WU8^+a1a-q*Psty!J4$h4r zppiyw8Q5hcPK*VV$v)>PV14)LQ_=A+>3>B3EPrB>>p3J?(cPrf1tW=5I1BGPVzy+@y8PMaWQ;C)WnaYr{#IimtES1 zp{(DH+4^Z#E{pg1spXpIB?&_DR-zW~C8`JB^PPHBj&Fc#RbZ8m+7o_NRhAiO8YYFG z=1G`TKI0BClR2nIk2wgMq-n*`rfZ7ia;EAFt2(ez(g9sGsaJ@^XSy9|%Ob zd52aghAfX*gf>AR9v8RqO{5dHw^++{0P0z6cVI4&Rw;%d|oAfE`fb@ z(e@J3e*Xz>C5QAoexgsl_!s?nJvJX%lA2k`Tnc=?xp(emm)nms&0n92EH2;3PTbmT z{)Z&^W?^OeNkkqe<`1?`#xwbohDib1i@IPxgt}x^&xDJ!waOs8bNHAeKt9G zdrv^o*`?XP`djMzUvsd@YE52c4UN_`n#Jdcaecxm`z?jDv^^vDZD!{6+Or4ovMaxu z-lvU_y32#PK6%Se&0vyhhzbM(q2THfz&U!Ogrguv$i8^%?Rerg-q7MwnQJ&ys~IM@ zQz?%Xj}|7+ti@8I=3#VR+DLU)Q)(sg>>F0AQNf{`#bTnMYzv@@`6R&{$E^)-pShW$ zQFdob6B}uCb1_X^hPcw#^3l>dlR@p??GD=Hn4r#LmZ7F7UONiw}Uc8sh7S)%!aszV@7PAU{_9_ zj4`3_IkjB5?xwBn$+y9&V6#N!be04v0$X0kclj!%ysGilylEqgkPVm7;|GlGbNZKe zqrcI5>~80jvWzrr6&$H4c?r;`)l@{vC)0?y#!D0ji6D>{^J64`!d;(Ewp@?2BmUj4 zZ|GGbI^pN5ZvJB13jeTW24Dd!H4{>)AQ%iTvgOWhVEy+Buqk9m!)-pwYcW4QUR}$p zVQT8qmDOQX!A(xuMjZY0$At%TV=JzI{id9n;o?EpK)GcT3#w{Ww2?M zh;u7&T(nH3u@xK5%Lm|jIaB|w{thGPjloa>M4u|IblvcI76`ExZ+;Gjv%kN#5rfNp zPrsg$e*G(~w_<#(u@?XNkt@gr1}jNxVR72kdinQT4qEu75x|Vitc|VOZjdTe0E4tU zW(BP;((G}Pk`PNc`k*R*7CT2-m{)bavvtA)+-wdHy!hu?&N9NP0wfZ;tFd#c8Eln}}{ilErDg9`P;*-3FZtf;(SfGjs2lN4S({Dv~Q=0^^u- zbIVxE1Lmv&^R!qU-G&qq%j=If*N^r08-G9L2n5Se;;d1r+bct`V6fDZ-QE8Xzd0I3 z)pVe~1owT2LU9cv!n*+&KmJ_{{dt~Z-xBfxq_D&2J$)c%HBr`PF6FH>hBXTKFRl8t za9-X1?Wfo4-#|)X&En*%uFkRmOjvEvNM?Qio{u`|8q`e$On6<^g#lFQZj` z&`-1w7ETWaF$6E^MAl1H=0FYxncMOlBQPV=3**GRF>em1)x?#hqt1>~GAu>AH49(s zcX{>8s>B@37o(w(Eb@rW`X)4{j1h_~(!~MCva=jANWAX}mnr(MRl&Hi>LP5CbXS>& zn1*;b{oli2HyQGb*k3ftU2?)-F_BV0`#7 z(ano5ogU~jjlvoYr{90CI1t05i*~dr+2OsHFq%SNEJ->|e*|{Y!7Voz$mN3f&Z~VNLmJTU^xt^wfQ#a`?19 z`OrC7X&X0lo7oBL^&QpC*ZBMp(@d}m+8I%T#jYzf4+fZ6GJdHcSf$&Y3JjidfL5EV zL$WFy7lc5LU}4Pfk@2LVVWPDsWyeW>wtl~@StR!96-sXTm2L5`JlM~OC+wTv!O^&E z;L{uA407m!XfN7qxHlwg*jQ5GH29YN_@Fp#YS?(U_eixdS>F|L9*py)DB_2g+i*>R zyF0}Fz{DhY?a}1POBO3cbja}6Qi*B(>6!522U*74c0rr0d`T`mEcWEpvqQ001;9=C zkKWxCWgTIO=TCz!zuP>ctm8mOFp;maN6#@NYl$hVaXI6WON8&*urTr4S0P@MiW5!G z1E;WU6nJ@;{CEL1{UrE+@?23+=-9k#+iFTOnKM`177IdI#6^Rs%%-w5~Yo1V=aYGzxW*LBpB zvntD5S7O`wK0+HdI{@sBTMtKbw`W=- zJHyKY!qYq^suyuB<`%)~E%$fN7o#~pN#f)#iCJ{JNd!Gsm3>&AnMyqZ)bQ8E zaK5*2rKr_&?C2eMla#;fk0aD2b+8{_nS8;?Qcq0alC7FgBx`VmrJG1(w_Sw>eah~> zPQB%Q@a#(K^dktg9tUtS0EAZYfw|p^1&XPby~5DLwzwZfk)3>yEp3$wzmS{5p}U~u znA)`A(hp10FC>(JzknLdWFd;95?YKts%-x&phH7?akwmNz~l%ETc(HH@2uKYKH;jq-4zu#0J*rk|FD_VGB2 zAYgjHgj?jMw#b6E$a8c5gu4j1`x?`L9n47)Z=7Lv^)6zk|BdROjg~Zd5-%e3Q;MoI z5D&o1qwCj-)LD7YJ#yiTPwoCR+SIx4@H?0;B}78HN6m4k_qnGM_V+5a$0yUz^1|{A zr$sOE?AiAo*3{IoyC8A0H5ep0Mxnr{xTwVrk|P~4e_xszKumI?GLb$|#MMr@#gM%s zB5}Kdf3o-^C2)9C4O%FBXA!ue@n9-B=A?v9r!97%-Lm(3fRp9@0E>E69Pjf~tU2re zu|gh84()XYie(~gzeb@;r*HX04efQQNYqnqW~c}s5$9`%8^~Gz=GgaEru9;{fU0Q; zX&iSSOTL$?hal4~B|FE+%s7LDHniRd=@xHbo}!Vw_%uZK^!V*X2y~k<_;?#2H>)gn zgtrbG&Wj<`gBX^T$A`!qr80)x@91_0%()?%tqet zzy3u=he1zG{0r-d&bI&0N4C|c)0F&dst5t|@CeCibKxd@*zFTZGrRfyW7DeBFG@8; zG#&b}^P9?^Gi|gAD39k2g!R=J3yapQGa2t+rqb9^h#_9-x)Yb6QH@?Enuz)^I7h`& zx**yCtie6utD%wBk_Q%0kFj@d%T3gm*kEG=fuqvt9A1Hr`k7;ZtTHs(Gvf4k?a^+XDvKI_m(Ne=OX6DnBV_F*IR|P)x6)|0RjYfDbQlUf!08io3(}=KDMTzb9O|au9ZA-`V$?H8YxYUe3srp6;aioH4;?Gp{d46fN%WU6g-;G2T+ar@ zp6Q@o(Kcpz=EV`;$`n4R%H|0Zk)2X23LTWVGHpAXm|UyI6_822>wOosfP_d z=S5Lg8jS_^DUKlng%I|8yD?y-esKpLm5&}_RmC`dEwaHo^6G7qQC-)z84jf?p!Od zD1NwqlnU_Jm-+Q`=mD^4pFYI5x>NOn1c18^x{kie$(S)&Y+N!}TN(4u1We00(jn3D z4*{D3b^tS~gd(0aWr0#=JVa=`F4%^Afpeyr7Z-60tCG4Y?dK+lg%6Q8Xp|}lz{X2T z+iJ$(s%~K2OtrD4N|Z#R2vwyC#T@fHrraMx09xiYU=a{kpM_F3HiC)ovkF@NS_bum z;Bn?sM(XQ0&)F0UDmFZ0rPCFHNzAqUC;jHl@y=q<&=A(#14RR|2{9dZ&ycmLB#vc21@u1sfhGRYgU1X7V4~5nS4oyj=QNYB~RX=>4ERPKeP%PX{Oz zk&WPVjws=zA?JafWA_mM=@HeB*d@Ynn*L8-yrD9eoo57^kbtmZnne|IC4fuI*i*nM zw!Jj||LIofAIMAt%-Q3Ui^$S#YV=XC5=FH0(T$1Io#-ax>u?g3yK_I5|M~M|=cll` znA)g`d-IN*o%X+gJ4n^jGD3qDg1&Ynvb3uI^|MbHA0n{LGp#k==quG*6=erc$A=@R zlLx6^f*lu_fnbG6KSR;At>Y?l=l$a&6fIjC9u!peiJB!N`qu^z&S?dp;mb?fFqOcA z=c2?1jy1JT1}?Rx54T7W#GodGu+g5U;XUl;Y9xE9eH43e!a%w&-BcpwqfT`y+A4Vp zDtPU1iQ7l1^k5w9L_2IE|@_xrr40dB@yy% z>5U_AL#zQbn^sdGh7QQ0sT!?|SE8831sai6lt2A5nX`E8B)TfoBUBhH&WDFme5d=3 zRCYS*I}ylHLq6PzPL5NJF~bi)NE%9}A-2v96tL8ZAPu#=V^ke!y0MOpi3IP}%TOrDqp0)$Rg3=bq|K$Kp7eW{w9q5H+A0+Ox5YOmb<6TK)e zl3}X@Bqu?3|JnLait%2?it$vr+iPKlQ&(pTjpykV{jqjiv_#6SU>t(iSO2SdGy+|8 z_}dRJ6NSE04>W7>0d&Bm^2|6DEr%wx$az;&58GnX`ghDUXIzE#F3-g-*g>>~UuJ9; zNip&6O?uy(8+T9&kOLHbIe&rtHuuUVi=!7p>aeN6i(EO`Gn6kAO^`^bJLzu5rVIWf z`WplPb;q9`1#IMA%O~Z1xXd!p|5ZYyFP-8jOA;-XRYW*bGNu4iGBxO<%vy1<)wQJn z111(ZnWw1#Vxil3Ni17$8TVhkP`)0SnB%dv{_|vHyju8RMNCoIPj#VQ1KT1P+CU)~ z27+h`R=ZCX4*w&`S$dVj*1+GtNf{6wjeDN=#PiDee-8n(y){Bf7x7=5VU6svYk5Jz z8=vTPc75k{gxwa*hb~mk?UQETu=wV9GbHR<+CK^ZOl(I zP0Fb(&&;@rnn-Cime@^eHka4tTaRjiM&%1rEmPrN^)k}Tu?sB+OFizoKqRxI_osm4 zBXzQZh~f{nmJQGJKUHZ(R{zTRL>YxC1c~4oCnAR#A)wTi?8QI>I=pkvGkO$M zlYGeWSJ&J`oHRCBiwNM5IfNL{^$? z_%#btu*DiJ6bZ#$@D7xVd=Wk3M}5@~Xs=hM7L-xQ^mO7|9gxkQfh)tCQ02 z&TodKAA1IpldESl(xjD0<*_l*K31~7Aj$btCu%L?`tM`FdAH=<%7a-|##c3jF(g&T z^s+J%1&2%MWihD=9mHl~6P97eK_Xz>uxLIiMF(T5_UAV)XtXN?fq zNCek3;7R9sU}AGHjSprt3u6V67(*GjMJLTQA6u@1f{EIwf@pHjh|^UAbiq+MTI|MW zKnS!~S&m#46oBcRTERWV6kS3IWz{c0M?kSel~)$2y`8mwL7q%F&GCza0=L&^hFnDv z&mvlIOOnl7O*)d+pS65FDci|==G_f7zQ{if+GzMo)V`eRE8lU|_)dI5==Jl8zB37FHm8f8Yz?ZHZo>$gVB0Z!{t{*X?-$H-6hIbbiDO zH`Xqn_rKM6Yeg%5y>;H4OF$M?!%gW>u4+Z!VmTK#{}?c*3CMnlX6DKnN~M&?B4x3` zAtKyLkL~M2X5%V`ZsI*J3W*14%{((HyJGxanf91^LpHJS&=LKNOe)g(yhlu%)6a@L zAwY+?0Rs~zmOv1;DD`(ye=T4vm3p`KWolOzpC#ql$8Vvu&+60jRxV<+v*Cfgep1 z%u3mTfd%3hx5rIvw-&T_L@%}ZHl+*RX#dC@`vL?XVGt;aY+(!4WI<=;f-B29AQC3&3?ECulUo1^7n8h?_J|4 zuD4J{QnZP7u1~9m=`&+~qiTU94~tbhR~;>~L{wiyn^vz#ihgr3=l+=Ihk$&nnWvBJ zjC_&sTe$`AQR~E!T~oS|`eDpa04=l4WX0VWRc#L&o;< znN@XScx3{1c&bK94RTg(Pr~x|)w&q6Iw9}n7^=88M$jO%VHg@V07n10yPj^b()}Wr z#Jzsu^Y>R3dd4&rr|D!qHNu_l<-7c9f~!2j^#Hy3Ys-A}t=f_6b=tU;tI7)whCD-l z2-Nbc$+}r0i#KJbA;cfb1k`gi%xwD zTayCrTjpnPy%sjzcd*hkJzputD=FD=cJ5RaCSBmM=#;;1{#79TN1LUatl% z;4kN;d?w5`>uNgH88Uq|6?Wr>E4~lF+T1H8(sjYfvUhunYUKVgoT;Bye4a6jD7MhE z32E4g8of(B!TOEc6j%6qYj@KlpLn$DGu#P{I9Rr0p%p6qR&w%1=_TSir38+6+e0d^ zcsuISA}Lq+>6iAZW11vgv)*+u%Y|>9K;n+ybB7O`98{B#P=>0Rygw#}`g7^aVp<+e z{aODviTanCSIG;hO7{jM%XF!PC*q_7g(`2zRZG->WRi=D99#O{DCtOw&MmfH3Pc~9 zyX!~m*F3DNA8HxCPq2;2t5Bsol^UC!RgrfJnIlm`s;V5L>{GTvG0Zs7o7CTlYxPN& zfyxh`wRs-kQ#aaC?#1s+sz|uZ+N$>IJgbi560;7D-iV(NBXeC^|91)%7p~c|^go0* z7P4%~r3Zkn|CXow<1Xlr>w!L@M=ZWCzT*chp8vA*+Y9XNEoYOUCx6KMH=j3?eRl8< zp^}F`)4WlBWlr5IkP8qxl{WQ6UKt0)R;o71v8?UxYz zq12!RNffI1a>|Z;K&u66&2FvF3Vgs#bUrjaFqLbR<0;Z$sIpTZ;5mdyw?yX74Z@oK zI3IFkvn;x>c>=60vkiBTj19fqzf|gw7>2f#SbcTPr@w4sQWS=3sI|Luv;S4)G|Wa& zsIhM%3t`Le>mkM*Kc;1i(^M*x6GrHYiO8HVlzuf4HviM1@v@8kApYpSmmdeqEuw?W zg2kBMOob5A?CMl7sl}0rDZKV)Go2w$e_4-$0bxyE?~+I5?o{l-KUvf**nVm1@GU#S zUsL8n{vwfT2)5Tqq=>765Ve6_}|@(?Xj>2+f`?V(IW}&n3u>1@1E`lzWl^~;eGM)RUe9Iv-0sD#3qR`wLS#fP zE>Cso7<)_z8i66S!pv|OIc6VEET|&>Wq*z`yK+f(zx+gcpFj@xD~JPm2@0;$&TIUh z^9v{EV;Cnx_e}7|VS;-lg$Oyq)@-9^Q!)`gazk@8m_KzWMD(H93h3`YRr51GQQ*a$ z+lseb$MrgO!B5>fxc_zo#y7WZ?8q;8RrpeJYPOE|3g^Z_y2S4bR1VXjFvd{wlE{om z<4SfUGO2iaJt}jD=wElIKmYOP);j)T|5F)!^pM!KxsvIFS6<&m-~<rPS$_q6-AM|5k%V=To`u%02)pksMXa~xPCqplbT_2+%Rj8)bCJfR`Ty=+tDE$_ zlL`24Lsw`B;iW=L;?Bo(FNDM16-gFL>&87gwhIalR)!iBS&Ht#%Y`w2bwqG5p%_tb zf`9!o?*3w2WuhTMlBwoTDjoD*I^gLJ!odYk<|ROk8*|OJku?%<^9msLo>|8hDWg9K zaeAs66ciEnpLW-O0aRfed)qCnCji=`CkDobm_}BE^u`7_+-wIcFJR`KzGG1wseVIQ zhDKU*a-`U0_0QT8R=KmDSs5HkW^1gw-V)9gc=KRL_uf0NS<<7h>kIO)_ZMvBF>J8e zL170$F7zFXsttVdy?N+r3!1Br|GZ#*DD|tmKMD=H-M9(DC`6B&z7T3^j*8TbR@dzB zC?`JYmp2p&WENGqK1Fj8#dodNHP|n~l%t{Z!<5P|jW2Xo{^D~YLIm&Sua0* zL{W>WNXfNYBKm#r9d%^GF~clKN!BJ)u5y1yU9ZhE9*2G|Dv5TAumQ9DPa9KZd7bt? z6&m0kR|ncWw5~PR+}{V>-2~!}2Of{2?{0aS**EdS*!D-e>kLNb2aGnZK*q0;SRjyW zv_kVIT*1;nCfbLE;fKaj+oHXSaF7ryb3AQOfwPAK3r6N-dnNkx5 zQKeedYC?Tx?hB>ZmyFqL;;9ZJ_yN%2fO z9U)BkEW(sLEnGLUvn2!ZII=0Ao$L$N9%YbR<_3AiKXQFaRUiQWq@sklkPIA;Q}Q14 zKucH%vI}>jq9iPa0}?~6W~``JF#WZIX;R;r%X#VLHlRLL=+V3yI^43Fu5Rv_gRk#a z^YSTao?4yyh=RwPnk>b8GrCImlU83*`?ZbIiKeu6mmOc!uG zC2=cd)v6~V6XO*{5v`-2JlEze1G*(^d(CmfKL>7^R`Zw;Fmo({`fW!)WNhBLz>Qk% zb-(F(>?Kwd*34*-qu$GY`@A!;ArEWs4ZSk-TtksCb|tUPQC`s!tfgg47a`3|5>eIq zDsSnfU&Tp2CKhLCnj-a5ld=X#DfiI(+5V!lMgE^J+&Z{F9j{Oc?vEWi6no7xzc}xg z|6XJHDtFCo!BgB5E(cC#Uxb8)P%4Rm6M8f`b8!eRF-bZk{Z*1$1AG2GcJ?gOk9$CB zUxPfs%ZQ(!t4?a@Eqcv9S_XGySbq7o^6&XSR_~VWT?Kz*swX0!9D4UR;DN6-q>!K2u_-S@<2p)F_0X z3G{&g5agUmHhFD+`clFBoTdZ9RAVNqH_MuDs=o$9$P6`MbnmA@q4?m9qMwLRWH~1E zH%1bUpk6~l^q6C^?7-e$EMgI})NE3;Ps#@oRvx5k}Cq0fU0oG>7XrG9Z;G)2B|7zPYuxRpu7M4j(_;%C+6uv z(ZsR;(Rtu7C&w-$9HItMOTkZrP{1Zq(7s}$854#aU9ko@Ss6H-oPr5N$h?zDu3h+M zby!j=|8);f@P}`cp!@+RxlGlkseJhTS>Wwt$n_nfQbkah6*kL__D28hMB_(YCHBrg zW$KH!yngWNd>Jf*4`Mt6Bap}v=+R6J(GPmLNty3){%c-2b&ZJsy4y?HbuARN^9xAw zALc3pqju7T)Y)`?8aS(=RfXRE{^uDX_FK4T(6UTz`%?S;OaZVr7|POe{OyvwfYdynn9XDC%eS@=8kdYBus3(QO*Va<8~mhqY>1GP)~V zm;aV;2|m@A5R?fpZ}dm?11#4pe7g>I@U8_0xXDMq5}*~!UDW;k{(kqX&cO5g(nCp) zMxR9r$FqG(0)E)?eQ0v(5U_pAa`l+hJ8yb6w|0SKd;0J&Cl* ziPG4lUK2TPl)jqB;B!{PA2jmL>A?VQO!zGBzHM~t55 zuL9>t7Ffvez`x>yODZu9T+nDsNN(VfCLGSidxu7c$AA$j)=JpVi)Gh!c!jo^mEiJV z+mQ1a62%*`3Yq063mp1HS4wblvZ7WnhxX#KOiN&L>ZKk#-WY{~F0uWroCqAwBHKR5 zxN;PP{4vq+_!)k3-2r5b*^E8|p|1$ezfjY7P=t(iV8IOC@aPH>y??r3sDEM9{D{$S zL8kTaG-dr8+F^~{b-BD zj{P|`15x_D9bHUC3(UVadAt3jY*}2!V}jRK#zM5DBr=kABaC zm#f8X!(ufTwLrn?tJ3Wl752GOjNL2h5g4@ut~aoI?_h| zJqoU$0-@go6e4*MU>25P<>)~+OcrY`Jy>`9{oYVVPT|7?omMQP>CX(Dg%Ir#@DrvQ zOM0aItV9d?C%x)1_4J>`Q;25uC)?^gX0cK{u@9vdH|5h)aMEzLYTp2 zs~_)VANqoLo2hXpTO#G=XacgQERZZAe=G+ur(~4>+I4A+%0>_hf)&*JBG`3`RFTBq zu}ohew1on47=mG&&(fHo>{48_Y3Ty}5K+Rk_(T{x#y=n;DVT+N`V#h%>wX-^DDaZ< z85!^aTMr8b-}Mj2yOR)Lp-<7qQ^S4E2nLTOICWpeqI0c5Pl&V-z zJ!jPlt@H6)rKFP=r$fev+Tf{hgj>UGzG(2X?WM$8T&R;$iDWiGMIda)djNj<|#`&QOtA>nKt+rj)R98o2}Fn2dE(vMN4s+c?@ryWqzw z(W>6>tf6{dnG{!R+P_)I+phEXnH~cq3#JJ#erlSK4n4sN^~NVzTFSOK+nD0R^PAmV zR`Khk2tL>pevO>+m)fyS4aZow=J|v%A-Z(&g;p&*`_*%)lAHUri1a_O%HQp}!p1KY z6U}kWJ{lG<`=Nurytq@dAq8K#!x6_`hV$e0VDxE44`0&Q3nE*-gT!iApMg0Q9&Qq< z1&h^T!_=>Kw;$nVo3C|=`C(JaUS3i^-#>cIZ=YODbnV^?&&|@~BJi;Uf6uM9O2OMR z#m4*2?ppRTHBnxb-1q}3_8(c=xZU6Gb*t3s%KmmFhfAQB;Xk5-=hC&%YI6l0jK`*j zw$obC1U9Jtzm~mraObSU=(gP!M<1qAD3F{b_oZL*WO(*wr-5{A%OqiF@|g1b8XG>7 z*0%<`)oqwNcp6nD)-E(lYTM?$>BwU@(WY$jQSj7w|NLaTd-0Dn!O`DLOMfq)L38%I z8ov=yW_+QED(H}$Afj}}?sJVToISSxys;1|exI=yu{6!s_V2CD)covQ_r1oxj5j|b zZN_Sv&+5Y#JvFK8)&BWa&()c4fA!pTm$>qh<)XyHA*C%*v=L-vUU^N zKK7Lva>K03$J_jR_`u6;on|_vqj`M3j3$vT`K?Ka8jK~2sGLFHi~r>bB0ny@TkbNMoo_h0?Kr2An#(1S3pn{2-&*GZ=|UdY zu8GaV(*i8nAMAw{C0L@7WojOqumqw8+I|6^(l*XfrVHg=8k}E9ufHO`@J6hRh$*%| zO;iL$km$UugcXg^2C~wqku*?Aw(Q+hSqu=NO2(d{mk^cAUMZQ*hN1RT9P5ib^Y9>w zh5_8*X&u{O2uWixqH=1h`bzb;$XLJcIIvRgD^06we`_5te?za;@=z^^cWQpSSs@+H~z zcQ4Mztz^W%Gfr1jk7`tsR`Oz(q`Qz-434&L?O{~9?&vn>k@wyJYJ|5V5xM()ICFKw!hI zX-p7BWa+q0ypTjWw*(D(bljvkj!(H4WY)A#3(e(+A3%c^EjV2tMZ2{FETh`@@8EK3 z&PXJcW&b-C&Nm&+!v$mH{KL*K`jVQ{{Hr) zveW)a6cHpx80V(fRqGTmOeZ-`mOPAU996_R*eO`p_E$v^mNF(M5ZF8N~wS z>JVo=txcx89V0^VDJdvR0QS^Yz_&lwy6ff>Cs+LZYFGUKJ+8F|N!{*ri!G4pk_xeL zBB1w(EV*bFS*-01?#5DG1IqM;ny*F`K~jMMD^ogh!*tbijKeBhlwa+nD190O66y|X z0`5&~3>Vv-+f4)Gvq915E`IZG&+vM3ey{1^r`sIE{el2VIH4N88q7!}>|Hv71T~5* zdbAmnkY~5Un;KKx8iPTizY?S=QQKkT!gEhap6@Qb{_vyusRw{5x?J^{+vR-l{`R<_ zz^xaP67)-+6n*XzoLm!dd~vutnaNln)0${H`Mqks%kOf3zINcWl~Ha4mc~q@mD1O^3HW;_lMFotrf#C+jsIHZ1+A8vByMZ}4AOF# zt8uFb^7`eJ4DpPb$g<*Ls`~TPg-zIGB)_}iWMe+0ba$N6(Mk5@WF!NsNbA>yoD?zh z0WH(8yRq2CshH9}D{3=}tk2WEn$I`He`dij)l|YueP;dnY>#z^xDtW+YR9{BmLoIT zzF$Ca4+F_M`%BfE76hXNCNzgdq{_;lW(UJfjOa=mNg1+I2;@HOFs%pk0sn24kChY8 zi6|OCH?0W^VcWQt5sn*`h4J2BER91%!F zg$krO^G%MseRFn=bA3*y&5B+)AG3UTY&eAyG?e{gdI&}w5s;jfGZNY$RZMed=PX-~y-7G7;wWk} zO?Ndq_B^6KcA+@E+E$VzJHZGhv179?PCEX~_VvKTGV%9Yd40ISRdTXEyVbt7KUYG} zBL;-t@u;^U#WW`QNvf(p!9woKqLRW?s0=%g)t28(jVYQjyR$OxlD~{N z3s@N#*^>w`Pd9p}oWb2DAvL-`;0t9B)TOKD&#;$tb7(7&fwwQ0`4CWs@U6BO>QS}! zL6jOwimIpkoXM+7ON=M!PxQ(g7QfVDz27kzTAbYoFdAttLud-3BUOd zx+ceSjptHE2EPn$2r=!I(VGBQf@y){323%SJ3s(0n;zW)KLM;LghZDtii=$BU2UX9 z$fRrai>2z_`PRR}RD}1au2DH|M|AJ#8fpJNexPr2VoL2;y|xyZo3WBLBBU*R{#NCc zQ+980R_`3Hh`r<2yboLJ9}npN6#hE+m^j{Fi>hf{fDz-ITT-e&Z(%o$tn%O1uldOk ze6lXpxI-0N|W&dNdmO8u_+r&KzNuKRi~e;s>X|BjqT%PKSOZ+s7Qj5*Ro_wBySyU1;CJth&FmF25a?eOZS3sU>Z)5^_zwpU0D5g z_X_Lfk;MdJc;=zhJFsl2Mb)saF?2^ebz#SmVVIbm;h}h)2cBYSP_K+3PAO<8M+Sbgv^-&9-L z|Ks&>1%1T#XyvLIAv`xdN#k+oAU#=i-11uCpQm(lj-kEFx7}>jGp|6Tx|2hOVX3Q2 zYj3c|FuKZ?&AX{-SozGyo8ia$uw&mZr<<84*o4aV*qohz7PO(L0vHeS8q5t~8@#zX3SM zuU<8IQNc$6nM?ox<~ej0r-=B>7w>>?@4((0ACB@c9RRQw%68118_|!n?B~o9>7F2J zgCkdr;%8%%PtM*>h3u7X9McBB!0*Fa{U!@f#Wo(IHCSK+8&d#Ta*)bYCZcbJ%tjX? zCVJ(|4gK<8rs0_^Vdt^LNZbC>kPrz3c;Bk&^yWP6ATx{| z`^XgKlMzN|2^7j-6733~@7?Hf3uwK~z#u6dZX~4bQw1`;VQ#=luuYqJNe*QlAXkZK z3ko=Sm(TflvAjaVSC}b!EBdvor9xR&Ko(O`S^WIos-W|0M;iNoy0&i7F!iFvvG;d@ zmruoIh{p3H1Jj#iW@aWRCc0C)|4Xdz${n|VUWUEhrY~AW(|IZjs{LM@er&gMG`HNg z`s7)gaf;k-JO1=ty-CymaDT`2c#%DfG_*HH5kRxn-ns8}dhfnpo>Vj6<#oI?ANb^^ z%`eUG_4a^F1Hf7P_;`MB^y4@t`t-*}6~kP8v~cT7B#wv3Y}+F3NAq!^4A8VF!8Il;~Cgy9hbD%0oA@`uXA_P&Jk z_nJ#-LXbRAo*bx%$Lg#r01Z{MPG^H!*5ZG~0s+D)n7KqNd4(}ZIg9Q`H6A%1dYW%A zijCO%5VYpouEeL(2LhwE1@_MNqHZSZ-XM9>aBxaE0(!mm(n`8bM9AB)yFAFiIv|HL z?lR;Op~(&_U&g>-$CoFSE~JsMiD?!Ha_AQniiPkh=uC%P&~qBZeu(2;XmZ7@jwDQ5c^Oll^L2KRJcJU7q{VNQ|9DA$-Xm)?HDmY+Y)^@e;fd3zzBAS-(HS@zb}Tg#rcDes7_ zKFppH2nZgd#6+HkWd6aj;L(!{hicYg=|bE|qf6dSZw_lr3kx7>Yxuqv#d{ixVDOod zay60S4zSP^v6SkNhsJ)znR_F2nyvB1q)YB*8j15P;+@ZA6ZvQDlCLC>DOId=4f~dQ2>)uiI5&tZMntnHXsYRqAC}T4 zH!}`qnGLfHpK^X%1t{(F0wIMj1Ti-X50ch`G$T{+j4ZWcE= zxnE=TSN-4vk}bNNyP{qN#no{Ok=yNF?BAgt?XXM-FVpX{qPNB?GZRmjM+d6f-+msU zy2g(x$g|GG5(l%heq^pnpe!4Xc2HZ-hLv@x@d1tytav#*JnmuX-42`=k zrb8~!Z2atGbPI7=$42wm{?}c42r%vC{?}cCse$8RF3T5p69*H96Bjq$xKy!`-hGtM1SZwJ&|L_R`E!PwJqC&Nm`CchDV@s_V?;ik*^8}G7V@9s0|I;QS1~_}l`pfV(De}J*kC%LC+Vc)q}kA_uk|(HHFfTGK3FJ*rjuL0 zzCoy|H|+&O&Bp#mPzqBcH*I_jIg^}(FPS)Qw*+iZv1)gRBa@GWZ6I|WHyB!~j~+MJ9l7t_g{*PsN{1U}y&~xh-q^`M4?R!v6I4?m~z;_P^Of>HHanK<`^i&CRCABjseX&SQ+1W;#1z6BF9w8eX{5+J+HWDiJ2?1hoDq8E{#t6p2v|6dEij=5R z)+7(uFu=#GB#)*9ogA)lpa&NB-mFSJNVXoCq6$yb#=7zpu<_bnDQ^x>}8j16!Fi% zDXwa*Ua-IIN=YQXG16GGDXK`PGI=e26$(scb*7#L)#-O7!}xHVWl}QzEe?i4GENf6 zd-gEJ9N7lK(hv3PZE1S%lgRO?r#adGRs10~g^I#B!D_67`p5)03|W%OnX$+j4iyqj zwQEUb5?yj?R%>rB(nmrtV^m9ET;8Pc_=d!)AXon?3I7i#xo;1Q7av#K&9h$?Yn5Fc z9tyv9xjXo58dy5N*xnFgr7xP%GEyH^E>hRNT zYgQ~fDFajLW1;9!boB;mpFf^#x?gtbG*`w?a0uEIPz;_71KF$;jE$KUw-=G64o>JT6Ih zs`&>Qt&B05e8amV_iAddudZ=hCp&cUz*bCHldJ#nO9%KJ`U^Egg>h@X>ACSwia~cr zCWP#|iqfiG6pEVNH%#R0N9wh-$NH5r7nqHO9EKN9Y6OtwSnK_*a=&rI+#_Xt`>(87 zD##OcCWCRcS_;Cb2imqnc2}QUrZqwu!y7mviOa%E40Xu>1 zKF8?hTqjLs8F*kG@awLYHS*nk561BnS}~C0MsKXP_$$#OiOj5^raHCHuIsE{R*d9?;ARQpE=7JxwTyE>t?Fr70FNH-G(V{^#eu ztzKYWu$Q|MhT|OoO&s)eIF@>Ndc3wsDSJ>pV-e0D513mGcXhbt!lv}d+nVM(T^m^eVNP! zK{(IrrODbSpW{}ybojMrVKG24{qZZ=UO+hx^G)0x?u7_Wcf^+mg(M0m-&LQpegTYN z{;m%HouK);7ZP=dj?faJn!o>9s9E`4hcKZ(J@wcf%T{~X?20|=YUZ!ci~;nwz{Uz) z_~9#pJ_^bTZB|8D#n7x+{ZO?uB0U5QLu8#3jUeCl|EuA{$cRUPfZ}lh<30;!Vi005 zM5@X9lBxnj1LR{^^vg88Q}ioyP7|nTSulSG#%n{LS=Cc1ainp|s&wSpaU5g%vkVLTd=|;mY1>v+V;{L4#gUYMV)nxA^$vIbinwBIJA|o7b-Kzkn;?$gF!Grv zR4eQMW7gb>GRqS*UrVPs6k)uG%+5?@VBrh&c2zQNB4b*0|=a zjS`eDAXBmK+8Av{xc*rYC>@#xZfIrgiu5(K{ww5`R@@p{SjZF-PH@X2+V%4Cl0H2A zo)B}em&?tEZ1AuscRJV-*QKD*{e13yYj6MN#p~}CcO;#Aw=ZC$tR`^ry9A@*=?oWs zm`a1NC&k2%@V2@6yN`;#$8G@?R06Y zJz-yOci0$vQe{aGe!cqn;@E=_MZZ)BL9NuUsG->>l+x1Fz#m4P^8BF|S3DoRT~|5W zxLeyljm{3foHHtx#{w0DfU0B&!rGIgYjv|$j!zjxxId->%u+s-37rdkWMyBdmUA>( z99=yV3U3TkAjYM!U1}5|nAlOy_)|yjdX@gdFt^?K?fYw9v2te{7Lrn>o72nz*E1)R zUXfGs)zulT&UE-Pe~%yFgroNbe7@(Uq0R@jXHhF$VY6eE*xCL0zyDR};D#-Ewi_DS zsvR(F8hf@9ZOy?Za*g0(x^C6^21w#Ry>?^g+(e`me1(1NJ63-BpT)E$^taE&CL+`N z`kh=FM~6lmWq%#}-U^cr;fyILq90K`BCDgt8=@~|e~0(xsr!}4^XI{X z2iV1GLYc^3@N43Q75d^8ky3gtg~0NG0=oEWoS6uC@=qC7o<2wWVIz9Acgf-5_1nZi z*Xs|-ZGgiMwPaKBLVo`2PTsg6#gmbrQNQ-|&&i8u8hM?@->`xm_&0 zB2i9B2ze{SK@;|xZ&Q<6_fvG^4py4J5*eeS*YMU@2nrsM9?_pNJr)K=vVg?T2P8V! zCZD&rwTA$7Vk8jaQBfU|1UT3c9yixzlLuDwSOK@k^K~jxuiyDgFolUw5x}XS6h#>s zc2fMPiTu~3JPH?_U-aWqFSAPlFnNbKIE+%QTvoInqhb?Cu|cVcE{Tf%^4_OcL#1qK zu~%2!O4T=QD<1G-m+$Lt3hf9dliM|G0)ERTjfwfwU!{kr+^U9}1-SQM#NEZCyJK-sS~sErKyg4R zn8b)PdAAV|lX582#%vA8{^(G}@Pqrq-lOApYqhf&RxJ!jV-99X#$W-9YP~U3r~Ts~ zqYy?BO~v#@2>Mcb&oo;%_r%m-bu?VjL`+|PVlBBo786HxamMgZ!|^Lbz12k2sGKo; zJcu%2pbaHEK`k^JA((38+j@Plg*Rh{0$V&B#3bobZ_B3KPxt&grvx^6-;sfF6K9$y zcx|drRUjIQZb9twMwqcF;ORmD=O8wj#nEG>B{%9!y}G;Wwt)SK;9@uqN1hxU!Xgj& z`B)yb-HqJ$G{0>%`(E2ZF5b^#xYn}TGiTUM=?@NPQkEA8L$BrJOh5hiX`;z3Xx`YC zq|yGg62OQBOTPvXT8?_;e}8N)l@35H)f_f-UGDrayLVf@%T~1u)&Pb=!S{98?XB|< zznKuvx1rMq^1AY zrJ)x%eVJj=w-5@!H>sBnZsu*rYg;Y%TfsoAyC#=OhQ*V*?(YFEsH=PL`GU_Uih9gt zva)zAfJlHmKvB!_?+G$pe$elXu>PaN06-O-x-J_7DDvOxQaf*3%A|44!E_IxNt_%D zu(TAs>|$XG{gTw-kGA&u!kzCFEifM7`B#*OL;$ZGSpoBTRM1;fk!_bdLz9JtZt2Oc zSAMGxeyf3J*K0#}%-~2cIS{Zab=~3JanyGM0IwyPC=3TJ{c*kn zqjbx6!2-b{fPRs``qNmd8*&zSUN#H{NbUa?x)a(yA#i4s3u^Em!&R47tt zH9!HsJd`POwp}{g$EeiHF%H#27RvtFRTM!x z!*m9)_0!;`v@0;3G?5m+C{7$dHSaifi_NwJtSND5V=yD`2!EpUGn zzxcI1iktW`e^M}eX7)IAMQpUDQk%Txbd7nv&oB2Bu>}oo5TMrDq}!RTzj(ZTCGeiP z&bdxZNjJ;ry1mI~r7N#+WBya^C)QrUl~dgx{LK%?Y1Lm%k6nLo&!&tCpldF*hyLMbW%72(l}W2UuiD$;-yUF zn2OY2UB`2di@;GI9scq%@NRHtk{J9d9Rk>0-(gdtx4V7CJ!<8kDm1cRO7GB}?8gc7 zwh?fNl;G52vEH8VauyP(S)Cp>iR&mDI3*i5rO>_}=eB?@53eEEHi-fIX|{?$!iMV8E$u=kMy6-SKJ2KIbxqX~U%}mEH8V zR6U(Iv?G;eN;dqs9uWFlI~T{QBS(SVieFv`!!p`U>E%unr#aHh%;Xd`&PU z9{qmW@R%d+hKYqD%HV0IP8?zjw|a2TBgV`q+$d`Bva5N+;s>f|v{9+O;#jP09=K-p zD828w`D?G}b#wmH;?&$;+HVmFm%0|_w7I4TcAJ9tpWQuLxXZb3c6JSaX8ci&|EDrb z(pYU#kp90dJ|O*nsmP}hR~A3=Eh);txfPq*O23=&ct71;+i=@`ksWF(!yq^$LVD1^2ppenpu%JvNxU#3>6z#-MAL$heZ3yb~rPtm=y$!G}lYzUb=~ zRnMqrm#YE}%T@dWyV+7qk66dqD(N|1i!8PbR|Csw_a~RI@dFfGfJiy{$nzjx5!@~P)( zZ%pFbWABg44zs`?FDJF%wc#v%FhG*@KT%O3|7d(m?El&hL*^b0RU{@S`SGQ=&cE&6 z`VHj_NwQ;%R>cx;ZmXu_`a(6DvwU0NEwm@}v)}G*NZ8U+cve!`< z#0qbl@lbhDS=|hq+FkZOWe~x(lPp7lUm%7drInF7D0E0IDeqh^UEsxJB<;UJNsv)l zVuldpe-v`R4Zht+o|V3`IeKK18fv^lv2X&A?0rly=3+lXF2|&Nh8q4E{QcWy)7F@Ka7g_RwIu-PFFd?> zMlLqDzYOYmjNejOnDe%VIf6H8ussM9?V+FPfl*i_5Z)wgAc-<4Mu7AeZc`f^uN5>P zpcFx?10eZXd3wstZS1x=vpgHT<6bE?Gwt(y`*LdTV$iK$p{!Mvsc9>lsN$HAL1G)m zX(aTx=Dt?<@>zB7{rl5T^u0nCPrt|sh=_Dw!_fd%Als;H} zxvwbj5&yP4O|xjegvoK~e=m`_ekflvG8 zJ;UNWI#{JKjDP9XlAA~g;qKeqbo{;g z`>+Esv-Et8Dh~#Y15XN;SMKIQranky80`ZjWr!g%QEhFN9((Rs0NAmf7u;3eh6!BQ zQf*MrapugTCD^KC_tNpE>f~ex@oQ@ZS`lHb7N*Sn^YR}(pKi*22{d?IPG>FFyz~Kr z_p$DT7bmk}6>aRUuo@Qa%&hii6K5E#hC@Xq%gGJ40jg0|eQ&Uj+SMtjPR*cIZn+># zT*I`v(7wr37FU_9m|r$8ll~KKp;Lu&H-`0EWp|&_BwkN8wDIH&ZzcO5-K=R#-BHn@ zoLpry8?|M1LRDDb3%_ICb%-WrHb~tDLsKy$hl_~5hTO`f7PCoS`s7J6;EqcMF_oxg z?&Zc+NV8UBqI^Y-uR<%EWbO}K`Uq5=A=%^=ct?a!evlSkdL}n()ixH(2JJmR4fke= z+SQuT;HK@lg(_U4B`~LozMGhPgXju8u)#qv*;;{EY~hrV_5G+f7gN15XMXZ|xY^*I zEA*Y=>y*e9KYSPUvw9y+{PGE<-s zkMGI^RL#ni$BS<*Z!rRpz7Y_zH?A)R$CLj&Bf2otcO9~CQlwl5*Tf9ZxW+qE=EB)o z%W3Q_>-Ce{h1JROIdxG~+4IpswS0=@)a8^Dtxm#xj`JI=tqRno%K5|kf@J)v#Mmeb z>Ur^G&b;|Jj;i>PtisFKu5Q&Uf{WCs8S+kCsK_0mtP5(R!UR`tw0RmJR9 z9sXqM7+~6DqHSf;ge)I8GY?NdMVK;enN>YJk5gUEK3iDT+NdgRN!#9@MIiwuyFtQ5 zPQfeFYR$z}yNJ#@0IR?ejs$68sATJJYB8#}t4BrEa8+z#B&SF6&u3>wDCdt(Itxyd zV{?|<4=!d$HKjMP<8UNWv-43?X$jD%$bsIFm9Z|dQ1LI9X>Sl^s8v^T)=x)`t_sf^ zt19bek;BF*GKELgW000ctUz`u>9y#YvJl56?R20vo?2E_0mX)(XR z*4ci9AKc7Wp*E>D3f3Ivl&`>WtC7JLw5rfu9(G;MrvYy;>X2IZv%+mxt2c$gBYCz{ z)C$^eg89Vglx3T+%vSCE4O}Cbjyj)e$oF2aU%ehXe$bx?{2lq7)5{9bWY3o@Pr80R zoAmsy?n(B~`ja$kWan;o!*`=RK7+-4Dy<7N?8+f2xI$S>;hIy$J;S}-*d;|P*~gM7`&&auj_L) z`h-sztVOEsYZOiC+r@$nk zxKm>FiUgf-MBWc+T4by2SJM!Ptp>G%C~YX< zx}WIWR(tB(1-q7Y4O9H&iMAS=qP*^S@$s3$87|QLXs=1JumjSAV=v;&AFQ$ z(UqQtWdRAZhIBhds5oqCO*W1)+uXAsyd={E`3kx##4dq{jpb5p(4u!ge$=*?kVA`f zFW$D*I7dr`lgI#JGU>6IS~~Gs9JQ&1r>}+%e4pl99<$yKX+;`}RvDm~@Zq%A`_c0# zt{fGURi?k;%^!Z)G)ljmS&GJC3r@CCUTSjKO4Hgr3?mO2YD%olJ2@+fvPyf$kSX0L zSZLntW9}7o?YZxfsz-O%cN!SvxGz=vd@!JwEL7AU81aR`E>fPkTm5+Dtc~&`J8aOb zxjG}ap+a&$|L&L^!bB{6%^1AVUiq^XJ~=BwvkWL6DBkjQgVJmaai~+?^$3NLDj1N9 z9#KFZAcZn7Vydo4o7q^`M4dfjIHCUD^@$amS{&*7%VhhVN3`fGu9xC(Jm6A@(jKhR zHm~9tDyNSd6VE>udGNg~1=f^gX-Do2>r>`W#@T>hho_7dwV~QSQ$ufGtsu7~D}a9yEejHlq&Z=$ye94GHOH7_ z3V=81I$qYnZ5>pX-5*hw2SaCP!raG*6){$@Q?Rn|=YWLNO>M{PG~pekWxwQchhGyp zmiDgm-^@yr)IXss8*eD}vODsroR$Rfq4+^#etO~$S6^M@{Q6b*&hX$ze+G{Qy`S;2 zyszGSO5e2ebRD}RmT4w;gt_s@_wDPO3_2MjrbN;JY_r7%+6+%=#+s2{xL`3$n@ zJQ9||F;+&tL^jO=3?rUf!d*JZUjxChC@q8766xrZK5Dk}oF&1d!tr^9j<1pn7g^OZ_8J@GXTj#xw3yic?Y}$5+KXB(&otoWI zh15HkMF>B+&*bz*?NI7P5g&!ELjzxQYvrH~H+5u^0*Nw&Z%tUj#+MG&AIf&;w9W_i zs=qmXy_IEodSnVZFTi|-=KuVc_&`2nj_SO3Uq9T)(6}SN-7O$)09a;i=TD4;0ndsGt1p&x%}rQ3jozmIG8EV6;=DL_ z<~bohOuJ35CAKSyBkpG2kT`G{RV1^Tr*Z1qmh8ck9TONT(=qTGs_;|o_q*}#21V1b z^=35>G5>Pz5~UMf@tw+o3cH9aQVZe;5Z&7Gz9W-|_-q{(eaXAUuM0v)v~N40I`|jq ziU>_VS`%?5^1kFhWyi+R50dM=)YddZ?X$f~CyS`f-hC3$J_%H`uKXxKyA)7-d=|zl zzrE_|mv2y=FoE$jqqR7_CFLL<_1@ibEKpgTVZH^hU?d0Oa)3>4^zk<+67Us12Je<1 zcwG&cXpD348K6W5d~@OpCdo~wk4Z@n3y+!WjUAeupW#)Z(WPE-F!tmNrJC_o3$Q

    oG#(BXsX<5lD@g^OV^a`BiQO|!;Pjj(>aeBx|Dyutip3R~!BR)+Y zbc{Uh1?wMa&{P{tm0(>`oWeOjN7S{LER!c3;9GQ-@d3*VNLd8W0TqE(L9}hfiob7B ze|fE-5pwitKeT?WW6(1S^V4owQ6K0?xU;~#TI5d#2A~8^qgkfO9H8_`o~Yg|H(wMy<5?jar!OJCpC}7vSF8atZM-hMXMP0}82La#tZWsW{f5xZ z&w^q8lJ)8}N>=&1-p2HV!e!-ziZfW%X3GkDW?pOxW!H&?ROu4>i&44KoD04iwqrHj zm2T87-gY4`zEKK^|JJ-07sfa4>y18^%HlLKsOuYAI&+m6Lpx)VA7NW(9s0&YvE!$T zBLoA&>4OL&L$ckE%)w&#m?}9Te9q=%IiQk-{s6Vc+DTvvv&@zVaI~HbM|Nq14@*^k zl^0v;Rm!yuxG=u%M#_w;x!AZJ&SYelt*Nr;koDGgNg1@|#L^JOx9tkcCLXDdR_OJ9 zVW1fU`qbL*%B+M-ZkiKjCQ&c7l)N~O)nDKG1@2q}4_lQt8r-n#QeOdGZ<4!>%Q~G&%~ufjGTY#}_prr?2BYc^F*?N79g-Xi1rQiTYF< zAFV4kCziz<`Y``XvyW+$cW=k2AE7#d_Q!57s%7-C>(IEPPhCTmt!j)!q3l?}M8na? zTNN`^E-3vUm7^pnM{ThEkKwpj%yCL1ZY$a(KVhPHjPeS^HGxIKcAD4Ssrnyu^wejF zTz0$3`=;hojpCIG6$l1o*5OT3q&_({4U(^!H!nzP%HmOM2o~?~IT(WmOP3?27jtakS_8*D~3Pb ze+M88B^QN(S%c3y+2N6gV0F*oiU>E=xo~MGs0Qe8k4*NGF zGD}tdq@XbTA)EyAhY!doRhaT0y8d4PL16*^K@WladC`Bp@xP0s*hPgQQ~nD8!~Qcu zg$$v9U=R#@+b{qM0}2D+|A+sD14#D%FFF5f@}D|}{EsGw^6wf%vRzr_5A&5lVgD}- zD6F=~EEog@6wUykcC`Of_4Y_)z%amn!k60P?3U{|#g%{~7wfK6$01zCN-A z{tN!2bs*_O$)yUf3a|RF>3^vHU*Ugb0%MjOwezCE_9WUc3d8?P!+*hm?yO((U!wmG zB9{;UydD6B!Ks8~RDi#^$@aG+(T_OB>&5=R373B2CK~>ohmH3>52U`CE$$&r(|z@K zIFPxU7yGoFc=y^}+=BD<{3<%%y5hcU_O2Xln3iv&Bbz9LjDh#UKm4WM_EkUZa!>UA zWo|_Oir6OtE!!gO&RGB9@Fbx`nl_Ct<)AwZQlk5nSTrac^vX+ai96kVc;{jGc)As; zJ*D3}nJt|sq069eE9o|mv5(e?#^YxRyvF(VIT!_33Zc1;D$n1`b;_(QD+@uxG<>Gx z>J^%GA*Rn%k?)KI#9$r{1Ve05q|+d53G{Tf1BlYyLql`YqwTuij-e z@@MM$>n1q8D&Yz4t-y?Bl?3`Crsn)`N_X4mhfd99No^YOdMVC5_ho2fw27RaE9SdP zE*?_5ds(yL9Q0p&g>PAQ^naqjjg3pttadR+yU#xnn3thpkrAf)zSl=zN2igB=TqXS zOWw31n;nU{H*MT~eoUsdsimHAKhr<=!ka%PmseYh(sNl-3L6%?b06{#Q2>fHxU|%h zD3l({8WfndRvQii&FRU_?eRN?@=L{%mSkiQ_~Do!PD0#w4ESD+QkXu0G7c^UZ4vkQ z5bgSQXZ*x|FqXX5qa*mS+H>g^7Z-#0(*BD^#3w(qb&S_I)V;CV&lm!pimVTK*8`AJ zi7e_6nb>}T!Wi3qg(n?Bg=~cW>df>pe{}rLMu{y!<2RWr%wg0FzvU2O6s=+sif|oF zclVUTEXD8Bjf?AYG^aDQIf2$UAF92!o|u=PH5^ONf}%iZ=?FT_7VmxF!G|6R)-a{D66k?_;#nNH8>XXUP1{(64;sli)W)@ycLFQ9*wGpw$4)x7hI}K}uO$@s2HM zv!pxzzm@tEC_TiJ@%ni)mV1YdrJ+@y8OKI&80cr0#U*LAr$Up_#OVe2YTBg|-}})U zxOb}LgE^|gs=tvKQuahjSHa$%HGN{7@;8=H6MoQhs1w6~2q4DXWNMgmKJZaU!j*JD z`{E<4b3x(L$uA8s>^T9@6uXRm2=m2`IR`?;c;d5fzAGw0_55cZwj__x$pUFbn4_f7 zUTgY%fty3qFV7xEt%8J;Vr|MKHn5C(chvX)xr|f&>AQ67VmQ7g<4HK-wRG(761nFR zxm$>4S2fW=i5!^dr*6&nFVY{Jfq#)#)Q|cPsp%@RqQiawfFlh2IJ9(Y{|o@GceppNbl`9` z;a)joNPfp6iu>AM1IGfRlFJZtgrVpXf#l1iWxxQMfO8o#J{5E=X+5pH3LPT|I|tr! zwcaZ>cDl>(8TEA5O)wd#1nqRK@M)(SHL<+xKSZ zi|w1+PVPDsO{SxQXu^x5@nZ)7PcW+@|b2PX%QU(*?U)WD^OEecTF_Zt7Q=kCOG zoBR23XtqK0)Kqlr9jyR{$?k4|qF?7#=R>sI_S=WrGBV#arM_0W)h!p(04_~HN*`hJ zD%1#S=-xfcdhCF^`vq#`8r;z3YF}IZq!B#%4OL5|3qao%APfM|2O>(}&8BQsr4Tp3 z9sGZMna6C&S+0QL8fHkchxYFHNc+(PgK9Jk0ry6(Tf%)Op%MjaH10oxpvhY~yQe|u z7;_+WGIw9puy;g)0E573MBey~wf|*m?{3e@^-#=YW@e?Sm$X~RJWLNKF;&{RlNWFr zZL+gtTN_WTCxWfX9DthJA@$f*KJXkE_I5y*y~<#xTP`pS?c|yrRLkb3eS=~(0FYeD z^vhq)V!5oNDA)9VbMq|}Ck_$27TNz=s$ExGmJ2l~6LDksXJ91kg=9iXaMD%MnN+}f zucqx0HOv$8KVSM_GiC1hNs_BCp4{NFHk?Y|OVGF&WYjH*ToC=#ug zb)AL3u6VjR!rQspD9Uw->)jO7tIAf$M@EvhYLm&S7noJrlW1(5lWUn)g%cG@+LN`~ z6liP|OcV!96j$Tm$<wMw5sKtQ zqglPq`k6Y#%{M0UPMjv>3O2^cZVBZs)(cJ5s}u6BE{btw!fMK_+A!f|{fTl}C!x6Z zL~3S7Bq{C5#zG3l%tSUemUO&n+p%aRjKP%4=fv=iji zT+6IEgvx3e+J%y}>dD;_9otDvm}qo2T!piR6w0dGWZL=I70KJ&-0;KJvnO2ntm9e@ z+Y}Vn0ld!1Z8Q|Z3CT^>@UjG!<5x<%4K3*g<38f1;w)Vgk&2XP2pG zGcjrKEIhEZ6th671tl&RSRafSSx_(#+3b&8?R4a*4? zl}yzpx(EMBBq$4yL_9_}r4+x`vxZ!>LXRn3x7h!_pKiSLs>}KJM@$T1@v~oBUK>$p zcBnG+6p`7XTN3_ZD#2D0rN)@BIqYLI`$j@`R6a`wspDH+o_3PrW%IXAyJVLg5XPy| z`({EKbYcXvWD@+cb}c>m?Y$em`#FgsW39?nZ!M)zQmiP|5MG~*V45;WMH$plZ+uCA zH1bpM#EoMosMm7i0xLMcC}Y&kqb<8P9GlP=)Bm^15U7L7js)*^naEe*^`uSp}a95~(=FscPK6a?4S>-LqK@Rf86P zT~)u6(@&#hpgGNm+CHF7QJN0!KHMhWb%hqisRi<(wg2*Uu)zVR?C~e1NS86D)5Hfw-YUasp1LU&sst3yDCsXG^PyZk}R(!VCJ#BL$>h5C8Qk z0{rU$y5#!$Gc4il_R-a0px^8}o0&7b#sw02Y(`4RY}X2l1t;swZ8zlFT|!B4uD&p{JzYT3uZU zT8DE^Z*X(n?n0LKlRG`R_WF4@I0+=^lFP^U^GqY=7sJ(os0{E;v!r~r#J5Dpzm3 zSdeE^r)T-n6UF060NVtQ@@ABJ_=ptpc~hY&bg!W=#GlmXV`(az@&u-VSP`29QM-Bw z%HEGHpNg8}BnTu1A8omsoUqxjB3&SYj6^A93F8Yl+gGW$DOWF8xKT2{g3IA!x>{Ii z0Te$!2YvhQ{(R{E^y?;|fYd#Ix2rZW-M}l{*NFcWmNHdzMN{{hf$xtm%-v<1wJ)8g z!n91*gJ=W{be5b$_w${_*MpL;$cMVN(N;QL2jdHNaF`5VXf0yh0i8d0cTNTNJ_1m^ zV*>GqKMTo@H&e>_N!Ss=WKef{u0qeGq*D~@!Ep#C_iwc{Sk#eq&aV_yo7*(U%$=09 z6z5334{qPBgIPp@bM%jY5_g^XX&>6 z^f2^~h`+xb|9ys_mZZPf=AffykR1*|pw8#C#6LO6zYIy6!Bic$W<1BD#(DS4;#IZJ zx1jE$_6AEW9hhou&B*f`SdZOMeLFfOdXcG*ZjC(9sQ~(T%#IF(lI3=HM=Cr%1X-MEpKH6 zqS@YFaWjWsnJiU+b>d$O8p6944CjXl=Pd49>a#cJ8);=GhvtLa$ZufAe2m%&&a&5U zDIA>xlMud)(G_cO9mF9@xX57)nWv={H5REXsv{^rip<-!zWrgsRet4@g*TlObIlq3 zHf(_Pn<~)B$d1xSKn$V`8ezSepyKHqG>)#&@QKRKk*i(Q+#ZeJS=ok#?(Bf_@{-$+ z(r&(p!H^VYBzAalYm2~?CE7LoO=Dx*3R%$(Kd|<+GIx3f%xl59~=MCMKj^ z9q4DNUtXI%>FJZlv{2qR9!j>vm?CJEzyNnDPhgx_(8zDh3d<4;%N?)z2T2_+tmi3`&>U2{tFC9@dVPHhP;wV@p zu|aX-kS}Pi^RV#g=eX@eg)s5`&?|C#Y>dt1 z=O28=ieEw(&C=>H6(0(87h#@7V?jmCYpo8@QCLTjo`l3lA9r%2{MILj5B4|1X{|V1 zk!Cd3Oj~M*kW0fNt*6OAU2f)3$Zz^#yC&{~Y1GK`)%v7^TBF*g~QWc0sG3 z?O#6l^+nEpYEKKyVj7{X92CfMmGdoa|I}%hF_+`IYs4u~1F>gp2_V4Pyy9WD>+<}W zRo}~TY+>&fJrz^xSj*UYBK@m)r}!s#oeSEvmlEja=6La@p)Vlb{vUcHM_*7R>mwKw z)^bxO+Bd7n5>RWF%8Wo|YAn^8@-L#wPAnv>tJWzH0OMlMJW;Rm;ACEr0p_~?3A=Jd{*R;rMDBP4awwgVLn3^I|pshjBbS-<>md0MpxLkJt%9zaMp09 zT^I5>EXaq6f?$d}Zw)${1=kOY5mX+tv?``)dCW-h8s0_>-!}AlV=yggU3lc0I24@x zXA*nX(Jc?DYr77iIJ|yk4^Y$ujXRPzd}NG_q|s8n0vIQz2*gaU`FRsAhM-&B zHl-AKmfg)E)z$X&NrLb*L@oVKEvIf=9c+dYFyRzm<&BxcWdlLV!l3ZIj}~S-Cok^u z4b$f71jKyYjMu9IMIU?%Uejez(C-jmAQXEYh1_j3L|<^ohcn0~p-Ku;2xz{)ozJYA z6+gcVf&$!$FhhKVceVdGe%rV8xigE$T={yA4rgJ3CaOPi$yzpEG=q)P*scI)DXi5* z8v;u10KpieOvAx;f>&nu?doPfd4t^Uuh`N<8Q<7`Jq%`4%pCDRy==XCDb!4;?g*y8 ziuv9U-M)pC$;y=Fr0%!e&1#6<-IMPdJskC*%)eOb`m)AO$6_(wZ=?E;Dq(VLyGeTI6s zcUXycO8G#af)&L&tP-CFjThXK+^C2_!vl)&2@(ydlvTXJ1_~yGo@=yco>cRom~FXg zRBRg*SCXz0(>!hlhQCf3j4PiVf2Gl_OpKErm$9?;sdz&|%%t0QYc}uoJL_ti1~U_z zJR9XK`JK(ctLx$dA1p*JsAWA}sv0sO=YQhR_Q6(J1mh?0;n|_x?#>quhhhJ#T|$`o z+4{GJcda;CO<}UOf4FE#@8@4{T}8e3+Wx0*<`3U~L}gV@A1S1y?y=bV`Vy7*J=84uYFAr;7blz_+vp7rj=_J6ccl~umc4$A zUqA7u7pC_VHDAB`^ASUlSk;ifRe0Ply}=9)zwdjL8WyZpn>_{e({TJg7z8OCj$qP9 z?m+V%OS_+*X4^6s2VYU8c2#=In>9Y4j6st#_hGDwvNm1mYd3fVXs+_sE#8be{gbSggJ?q@Uue<&y zWQj9}wzA<|8n1X1E#Pmua^*B*oL-ydlrKEp#~^hX!|jUJ>2sZ8(Aa%h#TiIcRWNQ_ z>4a2)##`diSEbe$^LrP9^a>2{0h~r2!9BE#z%RIoLGvg4jWi*~O zM!fcEgKVQ)dVZ;x(e&g=WTiLy{ZM5(;6hS>V(3L9Z z#RB>1Qe{)@l%bH9eGm4dyfp@yRXeFml*KR$GM8IYDbv$Qr=a3(39;wb_P%mif3Yj> zh}rEMAtar3<(1iH!!sOAoVh2R{%q4KvH2=cO;YE$)WR)yfVpjQj7K0%tml>YU?`68 zs@tR5Io6)_lJk%Ij~GIsa!>@+H_b?FzVnS&Wv++k1rI!$?E93s3%Lqn%&}MlCHT3T zSMuGhM&Yp#scI6q2^Mk zF}`qN;uWY>8*s?$W{E1l)zIHLR#?kuE}^eRCumK7PzCxhmu28sl)j_d7nxE_hX@$n zNQ>V-ozhV1wA{|EW5Sj+w3*+bVPRaFq@58l?s@9ZG9Xf!n!9^Ub5Tso_n{J9K=WAJaY*C z79@4ss;IcXrsEjzVaz~4ZT`ypHm)ylCEXs+iY?0|BS`y_EqfCm(?l60be6Yc_7eKH z$DUc-vZn-(xUO#fNAVJkx=%B~Zp~^7Q#f`(EMf`7q)^K-Mpq}xY4sXqJ7Pu(= zuKoP-K3*IW6ukoHwXIU;l@z9^!is2wMjmuunm-v>=jk^;8H_=xVGR}aMU5&0LYh*c zsny-JyM3^R)l4;aH>x!RG_%p!C8#ddmZsEHJ-t>pPpO`qYjTxas;2&t9A`u|D4%3x z&%L3>sxq%ALI#oMFi(ZL#o>;-!#kGqEaDevlC@{w!C`WdeLzb=lh9m@Csml2E&HNA zBMhxAX)-Dm*J+W3f#Fj4&vusr>3$M7YwS{jt&fAQ=EEPFZ<#OO=kjeSj?cD%=p(xb zl8koh4vx2~UaM?5a{>!6&i6yc{7o+#FolD~*qU8-?_K7~w^%9@>C!2%bAQs2JbLh) z9h<#9Ej2cAI%ZBR(DSQSMl5J2Aexm-M^XI`u3f-T?B$ZdmROZd8dOmdNh)fLIIv?A zkPM7ycr2z{_(DiPPj4V#KP1~ov>{*G86#66$&m*f^Y;c*k=@L!Wc3=#xzJMDlrTVj zDb`^4xEkX5x)gQQ`%CBymnHod#h$31n+*@Yg$?gc6ZU9v^dGC+~{ zErC5)ZM*!%GFz7mRX_%&A*|j$B_2~T`n3f#VP5$N4ZSr7rhnr_4iML)#IJ= zMi*Av-o0Yym*|r8mSQYIFI5AkV^_JDrmC;2mmO6d0N!8O=`JnLpn6T&5pU1+46(l>CP6Ir|~!YV-)73 zqr~S>Y41RANzp2yMd7{O?r|}ZpDWLX^L@S1T3hP!bcVEF)`ecb^a7&2H#0QEjt6r| z9N3^e9prPIB1-43D`rCjFneL1T(gZI=W)V{ZL;vxY40!UV{`4ZHX1wJ^`@mAq}aba z5#_C`ejUuR{x&occJzF$TO?qiZW!M?hM`A4ZSAndrtg5)+bNT!Q0S$(z3JX+%nCn@ zxge#(!$n(SG^8C{@+jKzU!5c@cDdxYu+UBw)zgb>2WpxbRTu+Mkz`|^4u4q8}P#D+Ov);mu2gdx3~>R851Fs>b-;v`h5j$nbr^cvC64gWC-arJ9(t zzXgBF;3IBRIRxsmVi&l7k+4#DX|jeWv`M0A-21EOw_ZzKvO@cF+tPQ;n4kRNvgPbb z+4onp@H8*P%yP`n;h^PMm(iap#nN@@8b!Up6qCov?5C7zh1({-EdJSEB^^z#-du(+@1odTN=1S&_OyZFQXYCDX|c}dv*$ZT<&A6#C4!!%n`!iLTOB@9rc9+YeBc>%V-c>RU!47+AA;h!qW@-E)c}hI+PnKq z7lN-I>jBpso-npocd>S5~FgL36A@7!tfmCA}veisHD?Ml?-2UoifIXgG|-Y9rAmi!a2ls1Hc^6pf{SE(rT_I_ zQ^%>R({iB1^hX+sS44yEM8A00Is!>kDIO|5%ZvUa)cXfOjMvT(1T#l10@i}?_b*9C zBH{op(wYELX@GX+D`=WYPQevni|9?`cm3?e)Oe4?kghf-w9H~rZUgJru1${Js` zrc4&=aCTKTy2>S-rqjAQM0mC-)=jr~eh-F~%2s1{_EEk)zAeg_LP%t@Mm`PclBu22 zy4m0RKi(3S%?YUq9It0cOpCrn`|>ihAM~m#*IQ5H6|^@{M1ms2c|c>Cqv6UAzUQ2m zKDE(d85aCrh@lzfo5^dDGotKVFsP5HUD0A*8kfZqBSKHa!6TiAZ`X@10&uoa6)$v* zeS{OJ&3dV1s)5~$Pm)*X8&svV+QYTdU~``FnOjou<>Y(0Oef4=6q>nYX#;43?l?#a zZCw?1u?vou8F2`9>o0JfNp55Ne9He=@Ti+L+O#6R)GpA~Qkj+0^HaEOKp^0FwJDbm z(KeJB0Pu&u32C3l3G>Zyk=?CcZ43C>c5X5vNu^{Ygz0Ts^Y(n!l@4#SRnOi#bgt6& zLL>69TkK+s^We(i1IG-Peao_S-0?A}>-l3*6npHa%Id7?&Pv7 zVGWemorcc2GbR$&Pum(oN6m^-tH~=gC(~oY0Na>&aJ4k+mbD0fTc%#VFc~}VObN3* zrgJ`%oh2EVOR#oS^{$37xJwVsm!$rBMF4+B9xy*UJA}?e1yMz;Xb-Q6^<9n==;Wth zbDo>tKh1)+i5QDg-w$zIuH-m)a<8r0b-^*`0`b`Q zTK%4VPyMnE-2A7teLcwC7AH0Jj%ftolL_Zcm#-<7&&s@;bvD;hE1JtT5}V0sXBuwY z>b?q z5tU(S&yXV2U#|jF@a8Jz#v#caN9Kyev8o;=5M0@un^1ImW7o@=>@7hxi8URY!$6{(``2)paBdESw$OL z5U9~CmwJO&hXyhqIXA~br#S!vxokI za?xtr*fX%>fz9RVfh>lv_tYVdUn+v8#(6!Hn5$WdAm)p&u0(DvS^~U!x3_jL7TV*M z^wuikWzkrUzlfFy*~@!I2IlzxAHKdas;!{yHfZqzMT!=8C=P`}@e-_9uojo%4#A6C z(ctbD+zY{q6!)Sb0ZMT%g+M9v=KbF9{^_s=}Bv^PEbIn8g9<4_mI^LFh_j+l%0-F(vE%#e!U^;?TQZT%f>7>b87NFqNL{^{dlgQWxrAWDac7u)qsR zsZo1l&;Gj?4qsMW1xi@+jAS|x>?*>67JJAT~~LwBbr(Cbfyatg_^5~Treb6{_P1pGw zu+3#XUjl3FhGI~>@xc(J8e<0#5)<~-3bDJVXvfZHd>|oFMd*5V<VBGAXV@N3ka(1MI5K3gQIO8l-Z{nVns)E5ysC{|hc??s5Z zV<$sS^x0dx?Kx2%z%DY633e76oyh?AsW{TaGsa6~BEbe>;uE765Hrg)G9XYOuq2Ho z&z`4zyglIZxTxg&-1UxyEPY&t?_jkJDFkSX%K=emFNc)iK~#8{@rl6!U(WrBdg>;5 z97l+wdp0G1-MUHSAuMNv1(`4~$$=Qy;r8M3j4YAo!bsiqmL*jYHkfy!0#B%05@I7R zFUtp{?}3Ybu^7A?_FKuOv2U9(OR?)~Acnd9uy~T20XJ0iT-q8*7qM|XMiJ{SYD%h$ z7qN|2ONHB{cYLh}w&dxMx2V>##W#~d+&ZGGoLUpE%oLf1Y#aE@I)h^Tv@sJ}%hTt= zqd-sJzmAT}(y~_u8>VD{Tji4R5m(VI0B;$-YvZkExz)Jm`iMyydy(9DxZUqE?=_+0R`jP z6_~bmnYun6e|O(s*}#mBW0)*@Ad-u2C7g`$Gh{k?Y%U&0Q4S(x3OV5*C^#MJU13?|L7%TQq&BsLgVI>BIX z30IoJx>7iHwE?&}_#L5`p~|=rhfsj@vBOS@WTnoJyVDsKjkqV2Ztr{P-7LSP0LfpZ z0xQDWXs)$Ku|XMK>e2UDesY+QkqVM_%ceUHIn^R0aR`=N3bNOiH$ zq%|yO8*;n2R=46w+_>H>d$9N3U90f8VaqpC0rhSgzdf7h4zIJ~wxXt7YU8(FDOkXU z+lkgvU68!J)*3iCnN3WDO|cpTErMod(p^6F=L(pvcE2`y#w@rfv8UDRT_+g#$e5Wc z-ODVZLG;ZEWz`o?mYu&VsN2;`3NJ{H@@qHk{_M^2YmN&_+|u!NbE?JkTET{3vlF1# zliKJsh2$7LT5>}{+Kj$=Q#K+IxKmNe?sl^l@NrBSzm1n-mz(*h8% z3H#jDvKdd^VD>{>1|At;oF=nO{d&>HA(Rqkvj-n@D;s6dL@>YOPDupsJM85Bqnsx zzXPR@2%PaKk=WPtsLc`3$fab^pNb;iox-g4y zg+ei9Mq)FbrCM_0fC!#)ymnMQAt=Tec;)-iYdhh95kDX!RQ`#-@4@{`&X1b_Z#-OH z?Yh+I3Xba4yiJO+jx*C*cK=$9B(Ogs{f^Pk8(=XPCKqbd`Of%C2c8pJs>HaZV7RLh zX8ismPsLn)h1aA!WeQ4Z6qjfh^vQ;{k zyE8E!6}UzDK%_fktx}FMm6Mfj=@8y>Uu|)WV_ebEwobR|a%O3^AF~4ejacOh^BTuf zbg0H6gBz4-a)py|Cl2PjaWOk7w#W9Wza$iVjlPp3w)0wG>-7DyC(gkOOEpn39`&O{ zQs+4S`X=V5z2uA(sysJ1YE?J%Sqv_)hTz$8TrrU3M5su5%tMcn*3Xde9eCb1SjXKV z-;wE9g~bztQwD*rZHbf?ZXenBZKa6`UxIzt{D&e&z2gsTq`}e8{6s_|rD38|5&^#B z&FvMG(1z}bjY(y`-GWz&d>tHw%QiHb(}>8*9zBs^`;j0jzkKS{m@NlPJf?T@Fa0z| zUJ~Vn(M@MIa{OGFptf{rYQT4}PZJgwac=fc*c784v3&_|w{lyh7 zHd#JH(EEe$?C68IP5uhA37OG_F#Cs0>Os<;<<8S0nYKd0LosIjxAdcv{`JB~^bhiV+eD<2&-Z+WI zFMlyI9Ze2~d%46b_stiw!M}q$E2Fzo@=*z}L6oR(2K%J=sTncR)Y<9Fw{Oc2gBG{! z+moC5dSog*r|ai%N!?yqpDkEkHxwLOB>Ov*23Pc4SvPOUF0u3&$Bmt*4Y$?0>{XTX zvjGFM-*rguL%iK!(oIQ7fWyYe&Vr^!`T|lG$Gbe&g{_s349?xEy={57dCtE134*x1u%V+WvcNHruZT{} z{ce#FtyvXk)UuP~>uTh*WAf56%hA|xG zx*0lu7IrP`rhtzb33D>M#eI)~fMW7=PzNEV%E+Kvp*C3ayv;D`843pD#KA*VG zPa-bRq2ralm%i}8V$l@U^7IrXrFT1xU!Ca@HODX*th*Yj*$M2h4;7ZvNFg;9B2Pcc zCK6Gi*dXp=ii&&2kGEy3ufWY9!30rYm-|lEq*OzXN5)3{<+*DG)sj4Su>!ufqxev? zz9-%x7n@+ZlJkT-nJykAT)d1#&r+WwEuBJ#R#zY}ujl}!d_)S7pSbCibY9D5iJ+SQK9^dn${OOun%Ih7JS&sE_W zvm}|lxJ~s>V09X~Y7G~iO~U`Mz%O7@xx1w!(m(vg7;hBJ70PoG4Tm6bLB^k+nW`Z~@{ zr-M)D9;?KZNoG;OswRX_u5KD|Nsj_KB?pdn0%FpO0w=1>jIJ7Ot5KpTLNFuA+1WAT zD35HI*6w+v3)?nMcbxcoRNExm)!BJ~(j{WM^5?btS;OV}McmG6uPj&ZsVNu~SUU?g zbYq~#$0Sd{g?o~JP!(K=qGV+c&nE{Gxo~W`xBOrpAjcUVW5Ht(HVzq&h3K$DzPqpl z=Cie>5s$OwOGo46Aj(tx!ng6c$nMZY4~lOHSly)`0U4FyOxTc)*F5 zmv^bX%?9!!;N*%s37=u<2LiG83Q++f>Z@)Q@^WDNFQEp_&6}L)YN>HgV?F%sQa$7i z_f#!MGf!wZ#D_f5t;n>-lvWI}=qZcP&%%UW2jkf|;^-ei_*2Vwb1i#W2WeW~ z_9M`Tvi8`x(M+RiZPXdEG3q9EY*X|97J{z9|7TMw{|xdS)2R@8KhS+D-Mdf00_8`J z!kGJ4|O?bdD>VJGwiY;4XuKFf?mubCKlqd)kK)b2+^A9KKa8+xkMT&u1N#AXIbA zp~XQ2$%&CwPvA6& zQ)pl#hbu77^V9QGGdmXA6%wI4&F+cN-QY7)yFHU__3QHOZZ|BX4J8o#_0lIlV#G7- z_(l?&C0?$5-z`vS*;=&O%%^OYmyn^m@wpU(DGkN+t#7!qj3ST33IZ|cB7E3R4*cR( zzdaJHwQ8dIOK10@lJ78l*Q-T>)6JBV)blenkKIPN`b!%IEJcvnFE`$oYSp(LqOac9 z_l-9ye_JNmP!jmF7T{OF{_|M(!?dp3$WqTJS|F4lb8Gru2bS;ACpFEx`bTr5Uw&yzQE@lYnK-md+)>viy=LPgfMyN!Ai zUz1*ZF0vbBUe8Wpa;FabyFujHN1rF8o@@BexO~sw1j1bDgte-N=`J{2u_Ba7NR66~zvKE8$)E~ncJ#x} z+22J6s#F4^rLTC8di+@3Ku%%-$g`|e)@zRmwWi!|ZP>EI1a%&jOY_Bes)Hry*s$@P zGdlSrt6NOSX2N$UYpV4Nzd1q z(;pn8+1{yZ@Sed>FZw9X&s?I6myvn$6u8BFAUudh9f-`Z(G2!F;L6w6r`=44b_5cZ zE@&-JlxHHY11dA@?ewAG=W{oeKbg0L#u&b&mXRZvd*VE-u1KN{ zEtxRc*-7WAiRl_~{XDPG$c1J3ek8npCE)qinrj=sB0^W#al5oI(XcjC5T5pd zK^AX*%qBn-EFe+PtW{Q((Ro4e<6Jl z-2|(6t29DRZ0|2j^YF=nYLMwtH78{)7f74#Gy?|&p!WDM1q{NCK@S~=rkxQ@%t0KX zjMkGHUlNJQgRRf|#sQNyFWQ2hsGW*P-SZBUODDfa>yggB&%C@cW-jKR1> z6gc<;B`f@NCjjl*wx~$VRCLz7qq24F2-t-X`%I%FW32M*XBePlYZGj{cWzH!!5ixu zL+$%E76W8xEiK3>#Rv8{q62@k5*}I_TPrp;toKYj7K^Vp9=EHouaMi*VzkVwPYFqA z9SG$kvpTncnvke`!(rSzHT_W~AW~3sBgko_**bQ>ea~@DdNWh^w2^66y)GB(8trCh zOp}uEmG8aQueq<{yH@RO95*6s63(KN#f^0VWsH_L-#_6$%AK&XDkH3sQ0v)ABonHik0PJxMf^V~GA+Pe^jPQ{p(#ICC^Fc=b$ z3ctm^Q~k|E34Q+@K>OOm={G9Cxci&9XV6FIFjA++s-D!tA74NiV8R=oilbz&L8opC zDI1;I!oC9$)iWOHtnH!IP|DF5r2~M-4F0JKy_L5ro7phypJTo7@LGkbxn!T6iR8Us z^ivcXlT@~{$}{iL%fJuq?^&*%2e0*`X(!L7=ck=#yzImFNi>j2j<%u4(a5@2JW<5z zqmJg@jFgKADAha!gb@bcPD3JBZ{#E1Qc4{VG}1kzdZo{0{3B5Kp;4N~R3A`6PA)20 z*My@@{cK;xA!%h$Y?UVp*V`jmS`raojH}T6w?L*^IEFOzS?0cduW7-n5e}MI*>69X zNs$(ufdXKnCXa=g1=ZJoYC*8N*=iaod;1ptEqW50<}qfm4)Tm?ql4$kpsj5t`Ck$!P`2!rd^FYxzr!}@OB3#k##nBMibZEtgvuKyAbo;DZHnFfszGT|N*bB!Rs zyKeFvz*!rGwVKadX=D_&$UtMQ}Yu3I5PW4tn3%^tII+JCLOeuSAwibHl zydwa$F<#3J!_=)mp6)lc;RtvKh%?SuIF?ux0$8H1I3mwjZ1^X~ZId{5jYN^S`@S^6;>g9tv$Fpit5=kmId zF;+=^Wo6+J3q9SJb9I<`Vf%Nv;6A#(dx=C+b`Vdb^7q@FoH!-f=3;EF$+IziHo7AX zkLHPK&$>k>i9%R=e6#B=mUHw&6*CoJ-Eb({sldh1OE>_U3u6e|m{rT;VOfd<&jEla-|*YmNM7CKJa-2jsFTh#QaBL4P*gJ=k!8; zT>9KX2QxdVAZ_^8JZZh6Y?$O?6E)vT=vLbix?4NDM8lGD&H!MM+Z8$&a5jqZB*q<} zpD_(C(ot!H7}CCi4>})$ha}1qNv>h>S5a7%x~D4;<8JPv_T!-{D$RSX_x8kVh^Ynz z?ykJ2Z?yK@8rc^%^<40`s%)dWIeGy?K}$Y#6>*U^$0eP{gBDh~`l_$q3V!j@e&*vlbMMv+-x+Nn{{Y zcKwI=w2Dh8KR1l9u1a!q;F|v_4t=dkMxW|f`QdvM?D{9`3Oq2{QM6N}Sq-JG%`WLPd`&!n0S@?c zEVc2OP9!B@2IY~1+4;(-nL|LM_owC$!k6|g2gTK}-iFuN>qmQqB$&!^cGqzm(qBq^ zGH}f;gZK~EdR{jRh`Ap#!aJTut9Pw6my`3DTORE%Fc%rse%_*oW%*fKP0aU*_7XBA zEwD^k%nd6ZN+BKL^dr_AO|=J1rc2H{(&z{trIc%ey_Ba^2br*VhvXKww^DaM=6$sniHchIW4bCG zvO$_Z^-^R~r=X*6f)CfNi}1^hFTcEN4pWw!nb9W+#JsH4l^|f3@QwS~_u9U<0S&ny zpAhRVo%`4(7~1WA*;n?8McN_>xO9ACj<>^t19&6Sg&X9BQDoM!D+?$e=+wCX zY~JnXuQMWW0*QidL=eBP&y3!#>2!)OXj7v8`3-B4Ct&_dbZ-4*7uf%%mqjb14o=6G zTyJOVWoGzNWT;@~(*UWw`J+5G<-cN5g+?W1^Kmt`Pr57(+EJfE9(e*kZSLRvHb>oh zNPu_Aapfv{&I7%)!$##Ui{qG57_YD~`3(iGF=lSzW~>tSM%xyf4S?tGEv9L>WK5;x zHwNf;=>ty3i)%!JkfV=hGFXXx<8Jv}Iouz#pw-&*7ccOn{=ucCxSVIsvN>g+t73=x zC688dkVX3nS`(#=DMjA;%54AYZ|y5sl!cv~bj+f&uT-t%RI9tLGTAm-Q5}!xR#J-^ z?yLmKg#aeZqu3AihV&cQ;3&V3aW6-aYQGkC`#Sfjd#UdEF@q031)n-ibz|0vKIg%f z6_L8*#0!Si+WnvyXd4Tt|8Sjwdm0?jwwSr~Gfl z8$&Q-i*Yfmalm(_QLL|b3gx1I+TRy;_HkqTba@l+F+oxq^VRT-|56L%7o?-iRGPk_*01Jg@EFPDID9s-KpDGES zLpPn-W3b6kGP!u;j51Awdr0_~&*!^|9S{JZyL~;U-Dh0@+P$I%NXJ4Jx)F3wOb$jk zke0Hu5+hB!U->eCW&jkSaShgu&;)uLiBwHI=V;9{v(1tw49}Nzfoi$m6n{uR;ccn0 zxnpE?R}7V36_=b-eIT&{v9QPdlSTCxK3)gk`vf5CJG!2ez76^NR%eP6>|XlYTWkn1 z`@IKxQc7#!xb3S{$sU27x=wA8VL5>5YWl?jvcoq}zgWzK31DDyeG3$XSJ;-jGELQ{ z)OOe+nuaY+8F2T%7Gmq65Mu46OoIP7)JMrf2X)a!^&tNzvpo zDvyr{msoYFjS)^XsjW^`PV~wLr#!`y%-19wZ%#ZdE(e?Gm9IsTWHn~NI^TQYH3A8X zV%>QkV$ijhnsEGXwIxlV_~{-c)h6+mx5}Cz$=ZE(`R-jb6f=o%*N4KF$(fIXFsi`c$Kq7 zjcV{ym5O`%{#L;o^SgpFj|M;3a%|b2Z@l*kT&&2iDq?;Y^S4yjQ7uhhlXkqNgk5DG z$m(-`J!}5Pw*e)}UTQuT@+PUj&8s~h5Iy;;3dM`Wlx8W--OgRRqaSxpUYgt-I-i^t z^`duatlQB(jr6Fc;nCC3m?!!s#=XPkrD(79kgwz0mZw(lsQ>#RXtm9SqnyJD*b=3> zx)xTZKxG|N|NakrAF->DM+zZ@DB>toKQ8~7TpTi0d6<6|HT$*#146|%s zWY$gS+hs1PiB(VWYKhFoYu(op$M0}WqCiG3l351H*qGw@fvFiR&vW?26A~0GF-2H| z;4by|=gIw>vcAXtvd0yB2)7BPR!nt7M`uXyzYp9`y*8F-5dg7$-w*qNpS&@&VutYs z1Muh{U1W74(2@DGAdYwjw|ljg<5#H61kyD>b1Cjx-I8sYn~W z(x)=vk*J+TY^S+9W^y2&DhH5~MV=NvoXftVXmGCUfg>XG?w?@t`KBi0?RCh<%~bQ= znTS&TXG@AVORaKrjL!s^N$-! zZmSQWd*7sn(Rj{U*%6c?jA;oclgG%;B>Vfcu;U~!&9ahqNKe?Y_OsnQ^>OaE*w9sR zS`K}s@=9S54vf_D$1O`jY<=_kTvC|MCZ%|l|%>f zb+&bJ?l>+^mAFpN# zgOEM7E7E7M#d-OsWbSBHT1;V5c5YR-^;T!-q-8c@= zCY9A@K0c9eU5srEu2VW4)d;G;S{dF9{!_fB!OD!!L`Na}xc}zGXx{0`ep6rW zegtg#K24SBfIEUIL@wm>?Oa8pU*wA*#f!%ti#%jd&*iHVRj`|o-z-<>p8r}|1?Q3_$u_~bf&sn7e+1Z}!N+~pV~iiqsqt%%&;2)bJ{qI? zwr(l!ATpO*uf2HuFPB5oQ@Qkve%Aj$l?Sc_TVW8-q&?YGjkl}Mb0}4o5@k)C$0;Su za)>i@gtKg6?tF1vXv&a;b5W~BUJfc!DN{N7Up^Q@So=_72^vUp2Yo6 zSLy%Vc5Cx%wzbSb1X+>KoTvWhu_Pjb9{6;WdHbf%&U}lcas@(xfhm`mjToiO(8H7z zt>2U$S5uo7+uw1II5{!&4-8sV0<;Y?^kd5bC5ppO1BY5$*E!M9_Hy1k+*;T*GN3$J z>dgyprJ8fGeNbl0f{HM-Je4g8B%;yKd-YQLmsPkrQdc6lL#REcqr(iQ`QeR;2%p1Z z3@q*{=$GBeCfF}Q-4p3u9o--B(xY$iOn+|~Y^dd5Ks$+)#xf{0blTXim3~Jbg*b8k zlAxaz8@WE*6K7EWG7x!Dh#r#B-ap6-NFe&%kBLODLkIy6`uj7frSkKv!Jn>xo5P~l z17>t7zw^rNEXO@zja+RFmM!nwgTV(Xxa%P|h(Hp#z*bUal#|rk z&aF#M*7TnXs%)aX`b7BnxamAxR4EC7%ntF;GG_s5 zYrWz*jJ~rw7b72!R&g-OTsO2QXYCGdi!4 zfB$xx{r*I9dmnq|VB=5&GGVJkKdW_=Db42|sPF!o_rKwBsMe{eEYR(rpcR0I`q%p# zi16=^?~F$8OJdDR?n_tcX`+iZToFO=-v6P|A5uo7$1Ah`?+u2I=N$6lJ*<*Oy-dEq zdQwg5^X-t{4kdfkJhbpQ8>0_DAv7~F8&RzWjJA;vDE;n}KQ%TC!ux>L; z`wTG{=Dxt5P8>$+6?CVA&sn!W1#?RhB8AWDhT^jsl>($6X+km=z!0DwKH}^j`0p=O4G>cWCKb)Yazv zk#-l5;E+$vRl^ztOkM4(_yG zIfyALis1!23UioLFiUz-a7B79Az&;N=-h@M99YX=R=Gr_zR{Du$B#^zdMaw8W&e&OytmC^rC-u|BvBV zy=_LEeHK$gILNsD)py;6a2s)wzRj%bhfn>Ro6GN<5c{us?`Of62fP|er1!rgwa68K zx;(pd6txebZpRq=Zi$@(GMDrk{DyabLtb;Hj~k6a5_$hxsmb^l+HcF4XT|sEG1pa> z|MtvQd&k%aJa}hfkhb&zG!}T%caESlSg^%UYy&>8iC#$2RTdV_Oo%n1OgCbsNfU*D zs4Df-E79Iy924SV;P%?4~mf;eAeg6%kZ^$IPxhDtk zSMn=9LGGEp@+t$S@wQAmRv-Sw-7Bl5I+)*DAcbIt!RB**FR_v+Jj)6%zZZ}vx_{y= z!BWj7p<;G~4@Wm)kIL0FV-%MU_gzU3=cub`0f=!Ov&tRu2wBFTso zMI5q`XCb>T(}sb&k1pvgs_Ch5;^Sdz<3=5#sxHEiHCDi&8o?YI%uPYz^dUlId>F!b>fpw-Qyk>lB$RiECWZc#s^o~(LmvDm%; zyVDU41=#yM;-zD9=nxb`A;32S@_+Faet3>JlWzviQuOfNgqZ5J`MNg%M`yZ|Mnj&B zn2}z-ebSKDa^eop_<(#J2wR6OpP&7s!QdEt4^)Y;flMvfi|aXLr#Ux`Xz0>7k885U zl`lA?)>Eh)EpPU0KOW!ruRU&U9=BR8pS@;XXwj4h{ZW z{|7eLenATReb_p+_OMr{Ou64g@vmJ?o@-D^w{Z*bqG;`rjt=9~5}XdB-Qi}~g?^w( z9XFT7eHu8lIU9NL`b%xf&n-_$$&B%g*lpQA=KCS}CO! z14!f%K{Jd}{itNTgr; zU~Taauq-za>h{ME!P{<&8@c7qNyuEm%dM>A=i&C^~k@WY!5Re>YtNT!*DB1 zcz7>XpWgj@Q#AkYWq-?k6WPOyhVz6^js4P(cW-3>4p`p{jXr>CARvay2>`AIcz6nt!=Un16Lj|U6VYJnxC|-!8dZ21qDZ=SYn&XL>3zYW%K%u(+VZoov4YX zTBh9_AJZJ2j5i^Fsz5Us!};EqKYEhD!_gOJg4KiXlGT3AlD~z#wJE>4`eB$R+!#`K z;60IH+Vj%z)=`tmk(f#}PJu>^oNK;C-)g#iLKLmfTVAHpDr~8J@9gsT?#=$yWA>`n zZ8gX)I;EoRXAU$v=iQY{^6x)Io2bY8H}I7&jl$Ee{}BH58;`$HOZt+ec-X*Dtc!nj zVrmKeB5nh(3~fPmCSoNK__SlrI>u#gjpP182COTmb4O$LU8sgwsp8v{pdQYQl-%@_ z>jhtnOl9BSm$$zQv+aM^o`$dEUS0@#5OS%}Duh;)!u}OmX;kVduqe_vbZ}<~;|V)k z+vMsCC9oD_$X@BcQ2yN|{I6IA>KLc*@U$fuh3JA8{ED}{KD#4fC=Onc4YVYCy{c`P zbykQx?rVM_v*|g5BQ(wsaCX1b*eF10o(wt9#U976jBIw6!=M@@;2~&07`K%vY(h~kV%?hk;e}eA0mpS zRMf?6fLEugQ4l|4eWKxyxbixcIXCpjS`D7{WKnb{p(LuTQ*YK9CYfZ$US*0+Z43M4 zcWM?Gx$)(5kn0iyVx)<%S(-kE>f`J8U*f(uY)hUp_!PGYmFgKAryNR3b?lw(#6Ud? z4;eZowYQU4!LD*!8hiVGKgAk$XY!AIPKs@1Vs5rSCG6|niaiGIbrs0h#bWG>@A-bY zi|8=jjJ`wD8yIdjB~)g`hBd+mNn?W6*6LjsQ&w}OEX$YM0Et}cEVhT!vHlbQAO+)< z54eo@YASE=8jZha070&>-tMV&6zB-&&&{jWLSe(6`HK7*EBL3EV z6x%>3E#w?HKrCh$Pd)tuhpBsj)Z%0EXN$6vCo*oF2Az9lno?&oPVj!)1rwJ$vv=~6 z+_~TA>0W;~2srhd+;9Uau5<=@j1CK4KixcYm&o zdXWgb(aJr0niDU5=DnXHV=d%L$6%<#90B8{v_K%w#%PVQEt@8ln(S2=O0BjF$fWJ> zmyccjnlmoTGJie1dq>ys&XDxf#j$LJ9W>&_uS}>1Jc}g zuSn0mGrEi^S`w)occbEr8cjz}+gZQuF)TY$#5Qa=+K z_HlfO2&M-MbGs|$!L#()5!CXq#!pf0Ne|7>^Q3pIyGjI&RrMV|OmHTQYhF!7k4L8v z)M!KLx^jQ{6qG5{=YKmu(URtn&ea0XMx&g$@HqH{VH&16) ze7;WX|0>S~vH&?Q<~crB1B-!7_@7f=b2gl9qT>YCcME#h9Qly%$-{ePKqgvq&PLAx zE`^9TUYg$AOXK1p^^y7+pb2(jq&(eb@U7Q5xYx7&+-D=M`0daOmyW;mSy{s`XbrK0 zg0lp0lyyumPtQwhnc%vDbB=OMs-|fYfdchWDaaqTKf2GR!Q}4Feo0^;z*Jud zn;09>99gayMEcjQ1h_Lr*}XsJ$pK5?WZIL!5u4Z~g6>InQ$q)D36pUrQ!M9{$%KxH zac&rwexwTR-dz?bM{QSEwZHa51N)TZ{g*qQ{ZZb}9|Z3tKY4XxNj)_M zZIFM;cwn<3Wdo?!$p-D(V73_sZNDYj7sF1V!PW;~W*bwLQt|+mNqZZJV>B!1Yk=Pl zhSO99)6m*qXv_o6SC1TjrmeK&ED4aqkz@M6LYm+lif;>vjT23Gwx4AhFWt@<){Z`w2xNT9oyyIXb4+-k6J}Z zMLv_zlQ1J0o3!PK?{(0ESMp1@hnu5+KGDs;zQ21z1v(#`C(Q$UkfHVLj(KU=-rFBk zD%p0s=*n%srOD#N{>@LVfTfY=tjVQGH9SDAMx2}I&^xgK8~rGcmgt6S{W|dk*)^~T zy&m|k_*{N{ZptP7owHxqzA`_kF7tW0W-gnRezFNI3E=Y3!HBz*BgTcWTPJs%o>~j$ zCL$CWu7=w-6bkQ=@Z%TZ`<{mFGGb`YW0h#m)z~^@|s?ze>pBm3>Mr4cP3U^`zSA6VNn; z;e~M%E0c0tTgS?Kx+j~PH)lU)mIKd`C>>9Oz1bI1kLR!7OznRbZi+UaN@```%s*Rg>z{fwRZf!Rtt%h$LHpM1zt{HJo)>k|F875=k?6(ZD;}> z*H=|m9F}d6d}ZD~ z&_yj3(!-f@iEG3jVcJAUO(Eh3*ulg@)+LSBb^_N2a=2%pG}l|*221?yKIXfpdbC4C zENmPt9MSO_HtH00>u`-Jq-sAwP{^xE?vNu2_rPf_m6BGQQs8iPLuF~1zS4#KyTwm? zsK=E%^Yb_GhE&Bo4kzi&+5P?g#+{JU#BWbG|F9&gRyR$uozMHE*{`>9w}q%4y$<=4 zRL8Usa~w9r3)*}Gx*NKhb-Wo-fdrx!lA4}znaZ}-R+2$qX^{v}k7_kXXa1P=7Puj7 zQ~%!FUM}-y?s?=iusVv5S6M-`3RM31SOnWut}T~&RG)KM`4i6e^qh??Lv)-{k$`{) zPghq6`0#1;zVIIHM%}-@e9&-w)F2$CJ@fzp>Qn=DzRo=P!*iNwX#*1eR>u>sS!b~t zFHW%O0yFuCKQfst8$>uBFI@YpuiMww{-!E%?qpoFL4fmFVeq32&+q3B;Uhs8o@1iP zP5GT{jpn=Njw*|eT$L=Es_bNrmV!DpFzbnG;$nj;*;gP?IRN4DQs(w2zy+zEuikG522KctvxRZ_)}tWRBU- z<2dT-OP^gE+H}YZT?DDlML!DU|Fx;nCxRXHDyh1y+yI$g>%UH$E~cB0d$NScr?tUy!A3%J>(3PMVv|s^wPJ>pc0F>R z7tYJ|T^hv8N&tHr0J=R9da54p$@hkWOSuGYbBLU7C{XtC4paqW?^v3N(ff1Epn1Ti11dIIDj946Q8#heMQeieAczC zWJ5s^++<-ALkm^~HAc>4oGc{Hl`|YDt|M+Zq9alkDB{HJP(y-DEVL08L>8=QBuGUN zO#q3PYx#d(FXA>Vz9-?dn}v7{o!s$G;8b~sY0F4Dm&gN6D6{{Rc? z=i7(qgq}BcNhFSCC$>E;=zF&34FHTSl;(M?5{VLZ?|X+{e!c9z_-<#PzPHF@ViXn1 zW)fYu5w`?wp|8zSX=`}$E!JlD0*EdyFmFFo$)^PKVcG|F( zW<(iy&T+pP>(gUF!T0-J&^C}e<<#^2#-SYyYV;#aHWE%H)$dt>_X6ugWIDUppE9xuYcPg)`tJKu0y;Ulz z^9}9qm*syre*9Hc5fKqyx~GTm{4QUsy6*ek}vkOW~mVe0byQ?r!7>ACIBlJ(W00`*S?SrTF;m-WZotk{#{ubx()mkzT4*RRvx} zm+WKX?|EX1ewv0<`1nB|Lu=)Y1F_e=)y368BK)rMq3+7Uf{&Hur6h@UE=J%D(au2a z)!ljSy!w}qJ}Kp8RdlMpyQ#L)NhKRiw310i({&?hu)$Ci=c~Cpa;mDiRbKR0a^nKVRX~xp;F(q)N)CXoE%A!rQOm8 z%X-5Ni%_=CwqRmZYS3l+-zqnu7-|DOW_jr9pW*>8hE8lL{;D~|zNH|vr z<^5KvU>z{hjT9`Zj+Ux?ZV_Ufh=Z`8nNlgJi8U63oBP|(-n#4GuG_Z4E4chvQ0SYr zpcbN(?v_fNw$kqC)p&9S-R#nLz!$^!r!UOm_QFU=2!#-eAc6@5q7h1ePu}^P*(pK& z?$~|G>u%4rcRjyQA^jyvl1U1MOcKH*Vhe9SgY|`-&5A_kipk+uXR$8FitwPygjuY=mU0Dw?8IL2>riX^o<#jEZJWwMZ=ROdc9&aKB4Au9g<* zp>m2FH_J+4y9!MHobXiqU%|t}`;d^0RYD|CAtFhlN-;~yyZw^C+RCipNmywq(?vD3ib|;}qeQOLEHt&1Wu;o7%D=__@6-Li zeY@X(o%!#-L-+hV6vL{LMkx)Ke=Fii-oN<{McKlf-R@yFl^{R zp&%zEyvxo*P%PP_OdZ!yL!TaGEBDE-(2@j_LQzB-Ad(UYq^tG8q|^NV7e5A#*cX>} zaFw2%?)7Jgjvu69B$BFC6Y!QK%4Cp@qKi^qJ8z!;_SWmpT-=ump7eM{x=AdR~1 zYC821^!xJr+xLt+^M+%GIbZ;eCppAL{5%)$bMM>(4)-t9liSi&00R9qNFgUU8yKF}m+w~3p z_(_$SYRagpln6-I@8w!!m6<+$9_RrNT%S)@hu}piQb{VRNsDk0{`_nDSB&w^Q0WLLJcdE*m-Y0gupkCtOU%ti4_l{qc z@zLD)_k8Q<$OxZ7!?~QA?_N9T=jX@W-+lG>SB`fd0o;lmeFu3I@sG!m==!_1*Wkj-gi`bDr%go0&V@a=8=l zJ;3*S-Vojuc$cOOr7wzg``4uf2ZZTAqPFRqO;+ z0pePdXku=sc7O!I*WE1ABbR0zpt`rzt69>XM9uKOaOfy^<%7+Y+tr=scmg4jMUX{B zkR%XBML=X#K{KZGPWVpYy4LepijwdXH~L?u6O{saXRY1+??0sb?#}npCso9Kn6obQ z0h?Z~%i(SFGVH|}b4mw=?gu~@iB*6c$i3L>Xbc{?>Gu6T)s~lt^q!uJ*X<*xz)Km8 za*K%GI(ELlA6LoxrKjuQsQYV0g?rmqQ)!6zG zy>feRHiM^LbG#m0mF}V7S2Uj#GkVjl&ptgKWsI)#hQhP4dP~B^Op9)p4(i;ZX=}+@ z5Q6qeXYYN`d35X7_QigY;m~Jx2v09dPdj-^`W->MNfk|*iS@e_`-G6`^2q%sy-oV< zo;zOg_nTh1nLY1&(NU6Ql5Oo>-7LQKx);592fMX0*PA(h^Rsv9eb#RRz-I?i6CJ?(Itn zqhEIBvt_HB9nLqSsp&Ru`d3!(UFD11+VQo~>bG}wcpiH=rC#ctvR>UDeiI_^#i2Rs-#u?a{8gvpmnMSHMsQ+)rflA!tRMFFaVk9T)Lr z_{}}SQ%J^~o!66_HM)=_JkM{=)J5Dxksw41-Wlt^y$H0P_A}pHh!cYndsYC)+00xW zbA`u2XrpAS8KPdcPYP3UN~Y?^Qr;#{s)ak(w$&!$71>dSwj;q)p`pP6=b?+^gc2mq6+Akyvf zMz`C~d#tGRidGofLSoo^Z=C8==7j}AG_07djM;gH`fAxGcSD1sHE*q9RgXGDx_jPW zG$J7cioh6y7$P^aQi=o)4{LH%Es{wjA-4@6u0H*m{QK8;JImEltyNW3RZ{+ae_pQd z(-;qM^Z90_d#bXpDsR7-KKj!-0Fitr71HB4QJLB*Z$o>Q6 zz`JEI832YG0AWUv0f-e;jzZKmAW^2sb2F7ycp@Ngk~9OenyyCS&fDL%=dxE=>nJ>6 zjO&W9f;-7DOx2RCY~iz4qN>0p5`+vs7{RgmEPeMyTo8u92%BRMcf;N7w!yE41Kz^H zfCl|ro2|h{<7X5rJ)BhIN)RGH3~TNgI~gCtx97g&uH>E@j_w;FR1J9j4&kuxd)K^s z*4*x*XH-aB+W3z8l5DE40Qastqhr7zd%AmbhePnfBfwK)a#;Cz2tZ|gsrS3pcHlkt zUAg2t^-=@E1-}(sz+K;Wk39JfJoeYITS#qW8(_qS`_8ajpfdj8Rhx7NFd*_0J`e5#{eH>*SP@NE$hvabnJnPR86?tKHAuySxp#d+pzQz3({$w)SL_F0H## zW_#g71y=o=)BwI105mM5$Wq_}*%sMXZKhq@Bh_nJ#H}J?4V#dO8+&cUwYROkxiIr> z6PwMoc8OGBt)Mm_1;=o(fDkS`%I7o(3k^NQGTA_7nu#i%OF|k`9RM2y*Ckw)Kn6Eg zjngz*rKu-?1~CnlC84u0&Z?_*N)-fidqXh*%Ce{m5`d80075_s-QZBWBmm>!H(Sl2 zyQyx z=mRZcT9T~PsM(-9F6%E@lfC&I6q)^)2JD7t4BCt`=20L1o!JT%*7;)XV zVKJZ!yBTod<&f4qVqO{5dWMsT1tZl=kfICR!QReFQ@Bs&5jJ{)mVe}nk zAou~91im+X&n&lYZN@UV0VLj$R5>IY%5LvH8^+8i5esK7OEicEa~==@;wwl3$5Z~5 ziAi)IFieR$N+KDWC8UKEV#zA1Q&7%JIa$cWs?|u0tW>EwNSC~`IrqK|{bL9N47CoO z$8|&SkWCZ8N?0b58z?quX%uB9mi#Ete*+VgR5Y{^gXC-|t84?$v9vxZN;-mR$0Zqd!N5{0jv?g(;y%DN)L-vNBRge{Z*QJ0IZ4F7&f~^=H2`PF(;$05wA! z{2%aXYE?$mt^0w(=t9UW(X}-cY*@6UQZa;Nk`PuimY<*+hw)U6XKX2kXDr+kfF~~} zr!GhyN|aQhKx#E43AJQtA|y#nsHmf&3W|jpS`bpHGbvFLN>f+*{O+Ur%wL4j;l1V$ z4aI}d0RD?-?S50%8}v*D6*m7G)hwVfD&+}rO)W5%oA_*tobnI}wpFoUu%NLKOvF)b zBv=v*g9s3s$0Gl3n=t8^1+Y2iw!WSE-;`bXz1OE|i}2Fi@)|HT{V9}PW|=7^gjH1{ z5~hHM_wG$#1G>a3E%(y-iJf(N_i^x{Ko8UWs47*V)UEyi?1-jRa4i&5QcNaNq-78$ zV_ti=R{XcgZ*;k}{MP0--)YO_jq=-9&zBD))C}Tex-K}1~uU|iJf8U&NIm+eE7chvpNdi(xe(&by zn|J+X0zVslqHjOJ;y)T9wXZk!xy}QJE-ro9w4{+~K}lvphMvp$ZH#e(zwv={t z3qrnV59A}m(Gd9M?s?{qy6}mALHMpe-d3hmrUfHSv@q2xB&ssOG*If9S)p>GiZm=F z2@=SS0?u=s9MhbzhE2~u*B9%@N1l22)7XD{w(eiM%g|@%)j&_$01`2Ih3pK6aolxMxK!O!Ah zTB1fJ%*v`U43R4){rvgT~0Y3brlW=i3a5?s+qZ(U9 zYrnefYTFn;&Wi=Gtx8^H+eKx8z*FTA054@qsZZ!g+#BbXRB{4pUHR+`2ioCw!unETs!9IoqB1Zq`~ht4=~eMV>lw6`jIyYC(!mp^&HbUE|)eeYavw=ET?B$7xZnhw*3FcY-T zuet7d>TxgL=L&tFA%MD;nC3KE5VFo65=jJ`O2(7}C^zA7JRa!nlBX>cw)l{nb*X^wOx0LhuyjOJG-qu;V36yVd%N~85cX(1vj8kRzedxGz4QHkH z%KFeUdj1FRBk=fz0uV2Es(qa!wU--FB%i(HH`liGE#^DZyH8!Ia`^VQE#4bKx2_<( zyBy$fJ;(0%sp9MGy83%L9mm|QcJ+2o6q~!hPd3|lvmQp;O>R7LM%}E(jkOh)@6t=% zwY6JfOeI4O)~ly8Mzbqjk&_`>bUig!r77vUw+h2o;b~cwZTAiIy;-8)Csm3x=aM9o z?|MmpcOLqC!e_hP-7{~ncTc|feZUF>-~gflp+Igs`C9oI<&k<^7NO<7xVHU&0LBY0 z<^8P?S{r!5&C}8#-q7!?M|ZzvHg?mKWC3I{-I<>Sn#D-E>jeyS@YmNClCMrWqYGG$ zH8RtXI045NC3p0GOj5s|`?~H7fgQ(pad*ceb@x5T58ZtCcf79M)j~vj zl{T_K@LddaX?rQLJTK#lTq&R-u3SkzZ9^T?q2Ysd%0u}0cVzBk5gN@V5Jd+h|k^6 zCwF#Nsi;w|>${_xrka&b?&9v_p7)+S`aR03qCWR`cW{cYRYx;Ys;G}N`)==dddHpa z@QSFNbKTbERaIH0RaIZlPWOA>sd#xVm_jbi6>#_HsA)fDz!B^PNtXW*VgWAfiZ`h>r z+?m(uV!czV>}Ky>>gMt2-S(k98*%PTeu_|)Ex{Ng4?oIa3d(pd7CQp0Q50~Erh(8M|1lfus5wOq|3zh`(iDX`g52O0`Q#x$B(mXVp314t6Xl2b_9M7vEZ0U;$l z$s$702^O%y36Uc1>#8!thEqM+&I%Vjikr zU}dq6UEE;IyQx`rZ!wD!33jcRjm3~D9!ClUJ&oPS@wAe%Tgwx5=3VWpvUTOX>LFSlX65Xmd0y&cIAbREUTAcwuUznlmp2yS;;RhOgD!(K%f}WR*H$C5XhyX z;3{roij#IAQy^iiPTXS3jjOy&LW;m`G)qGg%b4Yy6DA@U!;!KcVWNfG?R$?jJu2zf6}yBCK#0%k|dH%6jBKwN+l#nJ-V~z zFUR3={k0!|XMEGiIt6>@ndW)!osfeBWFZJiASrD~ngG@Y8)OnCGA1|ck~ugD!eo!l zsd7%ls;ZSFi-pUyf+`cKDZ=EaYcR%BNF<_L_0(#R=PLh?tSM7xiWcew*ioJeJ@?`y zK;==z4g5$?;#4X^DN@rE$f&BMB2^S8-{<@9QT+yhjP}oc=cm>fwRdQ0zBzlHRaL~L zRVXuH006NVHiKZX6*Z*7{G6N|rDZ8r|1j;OaVA`11Qk}L1)0;N6c-2(E>l&80rnmm z63Y)cS;}^5R2QbrOxRT-S5!lTdiBWxO|Eou$5gKQg8%UCOHC@8K4f6A(gfUFTqP)~bo^Vm26=v%1*g#QL@S5h zHxI{>RMVQp3|W$fkyR2M2sI>CR-`_EsD1}w#Xi3e+_--r0(VsRL%Mqbuzo+_!%*p& zX-QSTy_^#(MX_2VXcA*AAOwaqCL}-&iV_MU2|+{GS6;TaKXuJ@{k(Q@9(Qzj^Ok0e zu$@bnD8UXOKKr$2zq@sZm-pYZM4!^CqY9>qgG!T1uBugXja4;GQj}7n2;Nq{K9}wi z{@p8s`5!=N1Xg0t;(uPTv5tS+qFltll#0r%0_W>xw3?Ctq^41u7|BF6EX9nfH8KK1 zN8}uTpML#@0RjL(A@~o_w$xxjBO26UZJ`1R9Tolg4tYa_9s1+H*Z8>~_BEjdD6*8x zVo4;BLPa8qMG}Y~zu5=$bX|2nzN0TVU2}kUbKIntDA@=^go6meBm|;ml2n$1Nm5yY z(Hcl4sYyzLMU!kHh^Uz*u^Oo`WR)o?HZSKnk;>pMIfZZYP~=>qDvG+K6v{Lc2@8eG zGT=sthe{0@Wkr!mL<)&Ai?Y_#z@$xu7-?n|gKqT++eBBa6yroLpI}aGX!dbJZwX}prup#@0m_oS!s-Z zhTk?f)b!&y(8n!`{B{A0y0(^KFIO7`0$_OfC&L%Q&K3tX5ZHD2bY_1Vfuj zK|qkoDlnBgC3b?*2}4V;(#ts#SVam{iLc(X)UIolud7_chR)Q?0>^EQ=rO`6iQe{L zR&PoGEAS?R@fxo-`7UQL!#t^Mtw6I6FU4X(1FVy0X(X9wKJDGUqMnPvR)ghGW^#B( z3sw2tV&6mM3C%2$PTjZn)lag%28A9PcN%t>bMI%jwn-;kiILK&U3H6f0RSKeVZP28 zw=k0Ha6->fyww{{ZfW>t(DPA|;i0>;x!PFi+fdHlsVc$ZAEEI;*Sl}x!?mxrc#M_g z${`FRl^wZ83mz2WBW#;>MWq>-HDZkBGstwYeZZI)_M*`7+Ph^v7U|v5Q6;^<`}$*l)=tcWcYZC3k8hk~e87 z=8}84jv|T0yS{$$b%L=Afi}Ll6@vO^Zu@t`-XOBOaTuH^A@d6UZq!E+2V%A8kIOpM zX6)S`c5$AstX5E&yJx4YO7^dJlJ18n`7El-mLFK}WSd7#u{^O^av3Lh``M^)We!&w zs_V?ZuFiG`yVYA`epHrK7`-RFk|dvd-uA`q7ag@4N+x9UF5(uf{XFkJUrCWZP)RV{ zf+S&p(WKD1rh4^_8}VkyD5JN9OKS9pY?EwmDi|IhM50ho;)thMT~}pf0XJq9XP3-R8t%;HL7bnxT&S>ybf7q#xI#CuX^KPE4q9 zbGEu+&^SC6o!HBsPKvdgjeElHnfCMVAu(Q7g1~eQ07E#!1{@B_x9}hzmD}^xTT1fu zdu-#%_(fg4>7m#%^;{hKt8j;wBY$su`McM9!W&~aRX}VKT{v@^;MgY8;w2VTDk?Lu z_tSXx-d9S7gdy7zdTWOR>XIBH2;g$28Eg^7f)sgT$g;+>O)4V2G^@O?mD`nSsaC2u zL~*;OvZ}m7GN$$Kc=x->?YpMZBTXvGgo~9`d!|d2Ma@$VaVsmZtDCvIw-QIb;P2t> z2y+cf(L+ZnC@LW;R7grvG`H$@{?6;(l0>_KW!=JC!FOl1#j;ev{H=g+a4j*X8Yl zC2dsYe&;}|;FBrl*2E5*j ztRiV7btS<#gsr=XHBKaKj!l550=82yfFmZ(h=tp+Hr3@z3gR*|F7Yd6vp^l&GV2>h z32a|Ra_y8OCUd2tDFlfurrqEGqoDcpfLjMT7!Cgpx3l5(JQ7L%`t~Z#@p%kOIg#{NLCztLX0w6X*ecU7=ZVO0}Y? z^!Z>yNRmO438pBQ>SMJ{Y&b+;N zcR5q;>bEdOUxgVU<$;)qGJ!R=&F?n6eC9t3cuNDql7ju9(d|Al;6d#Wh1Jx&{r9Wp z{jw+pBS^0OyYYCde;d_#tx?$d`h%67!j`E%UN z_GY=AdxmPX0v{y(^n$-#q-gYsYUd9=-eVeY8zN1d-(AzbNUOvcykBl1L;ZEQFNRELVh;>if&jb#moZ6|3!HT8wA6s__60z`sIL z01~Xe*uu*S1K)3+-ahx|UOnFU<=@YLYPyE|(^UfY;x~n zJU9!_kSgLfLNF^}C}RLCk_w6!PRnG4WGc2ohNxXD4g}bO-Pm>zHWLoOXinJ=hZa*? zt++)&?_T!w{4VZUY0zTg7L);n00c{Bz!z4_U?IWqn)&cwUi+B&J=>ng+};AO9rt?z zrY5fWeY6Bew}tNBnmYU3`^VnlojK=lzoQG zfXInBw|Cz1M60zMY~8o#=^Jk{9`-F>{tOtXlgDI2hjPc5?3&gNDVl5ZRk8 z^-MoJr9)=)P?|RQG9P!H&g|45UliG1_4&REZ6^Id4#%Ey!Lg5I(hFXlurBwh8;UGX z6fS_hDCXE5?wvA20`XjZ+2k2a%Z_597CBV8Xi&?s8@EG6A=`2c>8%;NpzXWt=D184 zF$k~;5RV7~Sl`hIAc%5y4CD24yt&j2*AGTrT~gXhNhK{M zvPl^uFot;I9A;xOs$&_5vsP!Ga~$U^MRk!V^n$8U6hRn4LGotzQm+iTD-Gb^2f0&- zNJP#!OP5OKhQ}O7eD`;ETySt6Aft{q>y<~xj`wNV)~v|Qm@`u}cb6tG?5OUEjK;R8aejEH1W4|w*f#t*C!S~PBadrzRJZMNIr zcXvi4|qN9%C#cLYu{Zw*jCOw02 zO-MI+7Ta@VtY-tP5M&Y}BE4e>3>sE-EWoS-Xg#MTS!Rj{Gew1nD<O?Sx(1MPPyElP0W2A|N zZEDAv6E@`pvWbAuPUXvr%7~`ytObVzS9y#%ih{^d0Ki>@aEKlZ2w696ULkw((Q=Aap@$<1qxb1$9P zA}6GbgpxpnK@+sE&Cnc<1V`V^x(~uhBtkHf5E4L4*da2&kqHS22uJq4>-BDDX#F!O zlb&A6&>;GWs7BH-Lk!hsr#Y_V$OIuw3es!}>a8n5_?Va?LcV;AVFZ1~EDd&?11QVEuj@DIo+qmE#k08QHB9PG} z5@>_${5&~FgY@}B8vM`(@gGf|2d3)x-kDuA2>l>P5)pv}U>bpuI;cTU7GAYRz_V0d z={+<*2?#AFh=_(1EHIQoiZPiOh>9&d`|MTg&35!*={I#}W7d)rumu`EG zox$IodiCFr7u-Mrblw_PdX>`K_XGreiU=0p+0Q=r3@^~uk2Is{`6(onvl2_5yLsca z=dR9q^z5I!_U`t(_r7x0zW@+rYuCHAr+!c2g9v##gbL`==|xM5g2?$)fPvzE0x~2> zNRWizH?IO_`Mol75S z`;7Q~!|#i24AG+iGYYG%MW|&Ix2-k_A`vPz*`yI;E$=d7LoS`$ z0DAtx>&(jL08Ij8HGRKk&lB07T!eU%Q0>=p_?1*irp0;uvP)TX1F*#BefQWgdt2A6RDe55*IV?OO~H|8H{U9bU(1DTTv`g?}=kkj{*xS~*l zLT0(|M3PyVp7B0QEql$Do88=P5>njEQ{GLtySuN_LhJ7?+q-$f?fU!UK_j1LgN6N_ z-QByNJ`Wpb*BbUjsae$bj$w&jb#JoeC6@cIQRx?3zC+ydU!1A96{_^6;VpxN8T84y z7Tx*z+dp~Fcz`~Y6R!qOtQhgs60dL6GkUONxt`sgL{)pFs^P(I<=y?%H^gSyJ9mrB zt2hB7{A7}Nw{5h&=_P~LkKMhS)mwXNwk*R|D_7ctxICv ztP^;8a>8@mB$*|{Zgid-S3-j1kwUWB63RWPBh{HKYSNX}))asbOVAjsc%&FMm^Fuz z957`IB;gs2r&DoVZ@Mm2Y$0i7t4-8ix9>kIIm^v0ia|ZpxUqjw3^jhvkG21awi372fd1+qn%1rqK+1E3HA zOA;w6I1vaL0FAU=r)h>866*dKFiz+8O)og#-#$S+!33=A-H*ve+U?!h>ZBL8!KuWlxPrH=7Ga)1VS`H0Fm0k4zb4zB-vO{fF#W@^{8M4pa~?hnmVa8 zLdMOYg+j8!k11u#M)K3Z;b|oCBJUfGFyuEKq=CD((h;>_#B8NP>doc6f`$yj>}kVs zwnA-EM@AJ6hDAn$G#bJ~gB}ZV6KKi-G7XHqu)}SJ5Kv}XK&CNZyUdZRlE6WwFof-g zk~t7;5g-EN7bZbsTqhP7>oGXlY$O{6ifW)?Ftgq}?E&uXdA`#&%}A!fDT5ePjF3zK zf*}|SLVfEn-_cS+b~+kI!L6abZ{R;e@2Y?l8jTbvCL){n-E#YF+k1BSw@s_JFP)^X zHRZl5_Q=Svq}F6C4^O{Pez`FA^*LDTsNQo6#1-^pfd~raC%`a2AVA*fLy<4uzaAR= zViQnAi`C=ze${yU+t-|R$(5J;Te?l}RX4ia?|b#{y;TpH2tqI-q3EeX^TDctB70i5 z-#J%(PdmH3&>p96-tM$teXt47f-(dol0=CJBoYpfyTNCmA)EXiY-YLXG9Rx*`~;DN zNgCCo%-p)~h^QYBl1U*U z1wf0fP(#tB3=~l(v8&K~4dL*zF$pBa6v-Hh83-hTAQ1sE@9)muJobF|_pcs)b1`^A6AuY+{L^ zXb-2w8%vU)3FBs*Q;|MM554fdeS5mPr{{cvmiN!czAaa~9`By`H`Rg3hjm{2$Fbz& z?az;T%&5v_^2b}d+V7*@`@5s16HU}LEHz^6pp#Gln+kyuxS_H@pvr4AS!0C(sdHG} zqf=U~0j(|)+oMs+a;VUD9o>O#Km~*XtGf_jVV5jy)~zn|=z?nv45~45QcX*NtTGcu z2C=dwYO51hnKe$C3@VZoRMC_!HF(|*tg;Cu-Rjp`GDx$%?~l99Z?PgQ32ny%>mK`W zxG247(S{=;URkX=Lh|)kWCGylm_t#*4 zJ}y!85s@j>GDDYZI8v>d)}g3rB-BF15)np91rlvwKvE)2@14QGDs3F-elj1d%W|T)Z{k6;!(MZYNw6&Ext`40R$mVsqPJF>61~0wOk37 z%bB`0B$5Y}+Cg1LL?lK^1S3!;qiCZEqf!XTq(9+zzfJOF4Lab6b^v=64W6p|kZf<5 z@74pkW^7whC}DAw4U|z$jrsVP*lPRoJKMLTC|#?ir-$XH>&|;UCv1)MA{rL+)_r!0 zQXV}J!qzVGBy4ZQy;tbcO@Q5dEj>V%MRL5{+rE&dz3uyR)e72IwW%xZ&i9dcA$(7O`e5b3_lD#G2WU*$l#XZ2e zJj^fFNz1+?g{BKhsqb@d8*AR4_uqZ;;vZga>zuA4Fhm?m3JQ%1GyoI_!i50&!(!og z?3io0{Ta~a>{IA6K_`s&41PBsEe$3owJ=l)A$_{FE9M$R0IcQ~X1+Zk?-L;Q>%QMX zciYVNdG+0eo)AT}+Gji1hREfxi5}6H;LyY{e17}w6ed`l8`6$hdw+K#l^1GFTksk1 z8bJXI73vl>>LZdo$`sa2-9_vy)E1oQ!?H+#g z)8%!H_)s7a0ToPWR;*gRxS6)m$v8M{q9`NIv7XRN&iR9sopD0(2cLvTw24Z&T44sHn=8i(NS z1RCg&!QI`1OXDsL3GVLJxDy%z0V0!cUT5aN_uczsy}RDJwR+XwyJ}n4mUGUQD!YkN zLb_;ow^)J~EW`fY4QsCKm`=_b>w17dl-78qGHGoOLLpV+Zmm(mQdsZ{S~Wcib@I3D zWyH?dWN$^M!Vlry-bIbF!-(&rMI*&>yF`~dG5IN4$njrn9$H9b(c_0;FZ0cGyP`A= znH~%M;q2@W<>@XOXcaI#+k-Hkt1+wD_jbVB`g)VF-0!Pl^D`o@Y_)D`OBvni=ltWXArwzg_ntx7}rjZ$*@{z3dFcy;Q8)~^&Mbw4Yn zV%xbL$Ecj(cbjAluF;cY?u(#jO}RcHTfs`vQ%uoaFciNb zt`M}PtrfsR*jx5Z<%+v;PvWcCEZb?2Cpt^Ua>9pG4LmFFq8I{N zGU#lXO#&=7oyWe|ZgY91GU+d3O5F3m#_-?>~+h9i^lxDiVx+ z$MaNrH3bkdyswMRz0Se@YiZyAqVbs|WUNuG3jRwK+~R<#RSJBXK7n<*KKv{;{z9J_ z=3XRe0Q{8_VM~V>N=Tx2+pXmb<3ZvaY##==X7f+YWt#<$j?eJXYcb&4gEsI4twnQE z(=@16ip=k_uih}u*gZ70UhVcY6~)#DFKa3)L_Kv`T$}Zg;!2^Fr^sK_|7l=4kot~o zwF5^#v`!|}1TGmJ@T8c>aX2Cz6TMhWloF2*7U;=V^SbT`EI1v#6qs{A-pwxR<@dk* zxZ-*q%KA!6(dR?NGTEHFpkzyyycM&)J{E0XF<1OxSBQ!FMqS^mvm6~J1!Z+eg@h+_ zp+#RK(^^#n^5?sI-z3z1;Qixn(e{_wta{Hj3X@cBRq31JdcNn`m0Kti7O6%1>{8nF z88K4<2lMs6uu{TlHKO0`zVU0=E@c1Un&nxz<3}1JpQeb5QP~jE!oEVxd6CSLOTPHa zm*`z(BE#u(2m9TRu6}p*fgeX>N=J*AGX}-TaYhrd6>zREhiVId1zuh5x)!2-{R;ki zf7yw26Bed$1~IT5yVMV1=A6f}_qF3w|c_SUmHZI5z5Y+2ir2 zNDY>sn=gOq*eJEcs4WUnhA)c$rMt@b6FMh-^4Rz5yG%lYT`a4bK=x_i(z{P$n@2O+ zUfH!pJIsF&rQu!^yyf5g!KE^I)mSn^dGOMB8%6w0|AHght5PaV`vLYH#)6NhkYay5 zH}dsIXJbqI)UG6Cf}r=|64LPI{gaX>dQR^Qei7r<_G7<1qI$kJYOJKd33AfHF}T&o zTAQrz=F2b9+U~ld*bqGrGt;i&VHG-W_=$Qwd~5pc=XK9@_jfr)CJdj&EILd~>^7$r zY3GgNVJJ(iX%if|MYF8Z&&p8*H)5wD>r6r$&Es_cizd#dkQfOTFRy zkzmLyG!-C;VZm7!#cNubtng|Y@UJ7R80womRx#mYXKGofG_0&8pOrKmqg)m7^@)Nv z=Z%u9c4%O}!h7M$MnG`lmRYA=p&@)0{YtXyFfZTM;FMAFKX?`De^ZFL_g)%hC4{9h zm@3h;WQpq4Wzt*6w3mVhRBWh3H~2&&xhUzh=rx?lEA53HG{PBPVm5P3aV}9br-MiJ z!d24ojfb6TRSfJ5+0?D=Mny|%soUsjiEM;zS=cy6C-UM{Dia0_(AK+c>4i9KvK&fV z(p2KY)jLKvN6Jijcpb!5NzXTtjBV;&7ag?)MeE>(F+Knq5 zqE|YR5nBn4GOoJSPAOWh7{@aoCFC5Zi^rVcFc_R zyi&LF{MXj*&Gu}1We{p^9t}uo$0(;>W*O%M7hh>{-GpG{C+OkIq{nQ-Bkju=-}Q{UQ-{0P?~*eki)fS0>u)wbhEsY! zs*zfzD*kY)#u@e%xMVPpYZb&dk)J-g0@$I(2)`-V`%{HH-P8>3umxA_Di5!ZXRV)? zABEo5mx5iYhY3YR^`Z7LUqttNF9Gd2LPz04*=7|Yut8GC6h~qw)>LYxxbYFSE(&u1 zMjH_uLqQYs+06YY?EAUC4>QwN(dVzA4?4;mw33!TzY^B>@tqg4&3F7h*J+gSlPcz7;WA=;<5!8=0RX>&5Q6CrYa2R63BM9d^R%@^< zutmU^^7(kR;u(nt*5Mu@&!>1YZd>Q#7d{8_og6*5xK6RSj*jlpklarU&U_18%h3S0 zvkod_6?o4M&~u-2WP{32_I1A{aY%RO(q>*AueMIlES3e4t0wX65B5LJ{abw3JsY6>V`RKf5!Km6Z!6y<&DX;g^)bnWvX9r|~*m@Z1wV zBDZ3+AcFWFLaU{xDg@5v&jbA1X74ee{{ADFc*T}q{MRLE+3Ordgsn~7$McO%#W%cT z{h9W?8+0VLBE9B$f59lraH{76o-0#Tm`hiq?*w$NYAnc-^!2yg4w)#VkQ?RZC`t-^ zj&T`^4V6j&WEp9D0RA7h<&XmY+%Utqo@g&KU$X^fS*lfb`X@pE5yd)6#e0xT$by@#jAh*~TE+ zOP1})UnVc?RdizUiFE1s5Lqo-TX}Hb>_s9`OiG5!LtRCgK|6$Ffy|IH{>tw|-5Z4@ z%)A^Fysl$6It&TiQSOE1oB*-UFsk&NP@?x`9S`;|TodRRYD+BCLzs;*gU2DCE74~w zO!1Es7{$~Vm_LUZ0|SED+8yTIQ3EZ4Z#mw)lyoa<3maG`PLeY#*$zzxgx+9mY+CzQ zOCv&uW%Tr|-;b*nNf}jtupJ3m@L-N0kT3JU4_dWsZmsEGTgguI`Ke+|x9X%%v+*L{ zO>w&`#SwcS+r$2`+Rl@s9y5maZVfP*FeFFPr!3ln5GmHMet)Gg0J%(@-qdVg8%+ zGVX`3VOkA%a-!~O-yt5FFD1opNM4QBKRizita%#SQZ0xwrt87E&-PZncJ>N!HJ~Ez zk`CVhp?Fd*h1K&;41e-6vrPrT@|ho0q^^YdS`cd4ly$u?ys;~L@d%BF{Zfi%T01Xp zWZI&i?r)B}+NU6-)^v$+=lO5CH*(kCu`FRCN6H0PE|&N+F(4f457rdK^z!R<-CCtfox2TYs18oobidNi@m@&WGSD&c%=ANj z-9s2Edy;VF197Qf$dQd_0aDuymDk1H?2+{-E(x?3B=YrR+gx(qoVJ2X_T z7+O8FT>M$VvmoSI=@K-qVuq#6AFe%W5&WW_@z?_NpOOAOjKxf~HvqpqlK5Ma)6S|c z-7GuzVvU5P{TnM*h%+Ygy9DjH7#TyqKiT(}s2V_DkKJDw@1?3z8iEwRZVEImh~?M;E2- z=;!k?Mn@Yn_;m&{_|~lS;M9DI(Oz9!X8p^pwX)oyI12oS`itz*2+5nDE^5=4rUK44 z8wwZtB}{XT(nG#f+`gVZc00>IJy(57A(qBsZmqB~--`IEAn+toHkPoj-^)G{rF@GX z_G^{_KgI$b#X$ZJZV%_y1fqPcw$;ehYYC`bfuLXK*Qd(g52EUHYqLePj#ARA%Y#o3 z4(VJYU#WcicDy%7zQN0L0hvYHcx=IfjR~o?Bs52a$DY5VD+_4-EKdL;c67g|y78%v zKf{{dx6ncr8b=T8YN=hKgd5QkST2_u&&O4!So1LOo~AC1dEz z3hMMOU-(2Z!Sver_|N0nbZlm!*KS)Xy!U!$#mTTRB?w5D)Lr8<+YZiJaVu}1BW?jJ zeKb7>*qR+PfPDlKo|nIoVbV*!(caLYt4LI=F6%ukN|r&nyVlAK^&n4wZJ$HfaDh=a ztl}xaiQDjo=Y^h_X2?*01mD&PQnt2XM6%Z_S{1X~?vq!5>)JcQ&;5w)2rODQ$2g|| zY7*WDqEE~x^=9z2$%yhgZ{_K6Rc|T0&4{rSHXG=;k$P-sf|%;aUp2>G(??98`hYu{ z2oqxdzM)WLsZk&5D`HugeHEVbaZ4iAxZ3pK`rxwj=_=n_#=Q&e``KMlb(~@SZet%eIdmaSDX8#i#=Coy zChS4b-8F~RNnOx4+k9E0gJnw7CTwI-E~I@f+M+9}a6DhfQ*o^jk^Ik!yf*#z>;M8)lE=3e{y^@2f%(IMoJ6xs>p67T>Io@s zSBg(G6RVBtG>w}@c>%A_r6H75F7KpwXZr_w|9m;TkS7v%jPK3ba>W@UJ#exameaKy zCa-#FYcAIN#!KzgPHx6e5an}~*54cB2H7v3z)YZ&3@pWGe%V&Z_as#Gal6cOtTcA& zg#;cO%-<6n-LrrzG7|unJ<4lnA8qFET_Uy@EnDsF3w!bn8>80!Z$9@<>UQ_~PfP2- z{|xf~bMSv5gaHo0u?7JcAmG0MD+F*rTgw5bY5YT?_)W$DITxc50N~`I!xXc4$x>c0+MsD6cJCbvP2e#yU{YKs4g@DCp=uyIe)W%M{wKF1ORnF0~~_JXc1Wf4io@7#=r18o8JK( zyWD>vBII9L{geN{viV1rXaO2j>!YXj{{~ng>J(V$$iF4)0H|Z2OZgwcpj!QRkpR8Z z|49Ac;{T@(6#AjR{{vkJfP*%K>fm7Yk1#<07Jxq3jIJpLh~jtUaPs~o0$3sc<@vuj z=sf;c;kT&%ZQ1|T6#pCI(M5!ybHPHR-wg<0fY1oQ0R0>K?MK7!0Rc|?-If^kX%6TX zR{tmNzs&y~7@Zvk=yyiyXqjXDQ`&zGLacvF1~C5|ZFkxFbF$vFV;6nKb@or+Z@}NA zcYmJT;BQSO9KYPeUiQrf}M6U@DdL1>ijRtc3(tRMW#_3eqTq$*-j+>a2GKYKRd8u(oZNGFPD(0m{QkFLffEM{^%%{o zRWF|w5_G@Id}{v0Pr}4EbpqNP_;g$x4D!)+<;9V)GFY?quRa^f;e2T$oq;3nb=wTd zaOmVl9|>RXVju}o%g|U-u6Rq$lv#i0tfHzlooR+Y)6S|KvHUvg-TYhGkR`U^^m2^M zvh~SKEhb}R6XS`@U`Tq|FwwhVs+!ajl!NnU6*oflPR1q75Ec3RVi<9 zRObRd5x?B}XwpCE^7KkG6)<62jbQyNmJy@4Qvg(8c|7GyeM&-cZbbGKt9w*e&a+@u zwSBqvd_U3^55rrgm)QbV1($@h;t&hMTAxgZSJ-)Uz7TtR}lG6}oQQB;* z8BAf`L;3w;^3t<+H@CDTo@au2ZuB76c6Byte zQvUJlESE9hyuDn!wiGjfTREUQ4BR?HaLvvuI#$St`EcqAsjx@C=AQEMM+=$XwWBf9!tsJTT{a&=LS8-^E9_O5H?fXl|%9po#YJnijd1vr6# z_!iG?b>aLgYLsmgFU4%8Wdh~-mzMd?CLg)BUkA~I`-&5EQ3rbsabS?6783$#Fl$hy zV95w%ZHtTPx{wq1^P6NbdSej3sdt|*L4Ww_kbT`~8gY;bt@gonOmFViV-`vFD7a?d z{il5T@ZhsY_jE``O5fURjiH8xT3wYoY9=u0p!j~yv1|Uy+-k_6 zS-0GY0$}fNYSxu}YBoKM6|PHkvg4_*S$K};oFbEbqOFty6=oJD3gz6_5`Uq%yo}Rc zAl*w)xGs!SOheH0taWIokrr=`RreMMidx_WsKSqWqkmkG8~xCY`?ReL8DwodSLFV? z53ly`udI!Kqlsx58DCksZ0`eC*RS-GVpSk3Qtla-OQn4J5`xq0~7ZdkUJ+7CP`xiQD&2QFs zR&I2BG=5Nq{90yhd=OGF;dpIAVZ^_LmErj&MBYFb_wO543?e|_aC_2P{XajRVX_6t(wb%blF}(Py+$#bbL{5xDoFS%DQcb2Cf^~NGf?J-g`0E?f z6|Ghv2mqeQf9^-m#W-`m-3?b`@=_S{*k7%*TS5SUgxR()9M&~XA`bx0^Gri>h5bMwd}t3IhW?1`{RQzD-~0TWP+uoMO!N}N&bjUTNUgGt#L+%a@ zLKNWHOm$Iu3qju20g<1u3)nO5LkAs3kMNj2TM0E?wsG4B1Ewoef`q1 zw;Dd5ul69<{E*qrjh6C&NL4=>PH<5Dhj-7QA7`=ZA1(_E#TqoTI(sHDw50%@HxSK8 z{*Wu9UH{ae4>&=Lq@vfI4eiMGD$~_A1fo?3FoX4fBkc&6?2<)^Ts`beUdm%Ox>@%5 zWJ3c0M$)vD@-tG;;LW#N9oKKa37ux|1_&+pn6$UmcRWWd1HKJEB6+MozjH_Gi&p5DXqIVl>t?`3MMb$Nh50ZOSw;0R47fBao^3p3 z&E(R=;8JnIsGzLyEocxm9Id5-sMc4vQ^ENR+~dSbxy8!ZDcz0X;^`1$cTD1hfvn4 z>w}k`a*Ni3C_%c_k(41>O=Lo)@ziB5>+Pj+D+*{+TyE}$BW7-fAzGX(d^t5~6`1;M z`0|V79r134rS;Ttbr6-(RkU4h)lu=dIy2SLE%(GYEfu|Z2sNJzcbThuyt`htxR{=q zO(L9!0n2Gib)gwPx}sO_`nN6^A5((`oQB0hdLMAzcn>+b)?o^~`SYgtZ`;Nvmw!7} z!W1c49=$EY?$od3KY*wcxxec?8N72N!=GIXY{S`6%rXAyVDX59DYvjKnCvEl8}fwg z)%1Ro6|;6d$>wA9A6Q};_4D+X84eG9YCAV`0RaT~osJ=o<=$ttuVxsilie*%uy@gq zfrlV?>Eh3<&7N6A!>xz3!h)`B4Nl#o_=@SIgMr7mOKP^*Xnd{MT)x(K*3kL+w2;TT z%Y4G#k5?2w=nc3F^-BycG6^a>l2fttBeY(;7%Kg>0l3NoI)SUVzNB)~goQa|Ai9C8 zy5o=NDM^c}WC83-$nZH+qNJ|x7AG-RfmM$aOu%&jHF--PlHb%oaj*C#!+^OEk*oF<+lOWklWaMYDL{5B@z$LJ+*O6GAaNrfD9SU zN@`?z;r@FtUFXVNLI0hWTIc!JDrNs|JFJ2wDCpE|H*(t{LZek8+Wd?v;A|a5-5Izp z$IPez{<%22i_QJmgWW!rRd@K#ttZH-c71wsLwHntCXAQ&0cH_a#(Wd1U!&Y`_d#av zt*aL0>Z@GIdS@+cgV|Q%&Qxn-yG@p~qqF(@*REYlvBQ&Ym&^&>u1qNl)Pg2esx){BTz7!E3>aX_A>&YSGC?Y}tUt_cd9J9Shl0Tn30C zwR#8uvc{aTP|e;6`GYY`tJGeuIX=$E2B(YZ&a2y_d>(h&tZ#2~{B~@LeudHis-j2F zs8Kk1*Lyvb^g?V3cgJFUnY4~jF+Nqkq>|(!xBfnUz~6g}b^A*Rh4oHrz9R*#26Af$ z-d3_}zV~XBRx(S3#M;45Q4ejeh;UbjK2X;2^jYlp_XcByqhM&b8@~Nna~V+g>a}e@ zX+UB<@k*4Nx20(aYs{%2F;Qt9X^ULp$kq2=XCj=CC6B5SrH<(PticH1sH-8?@PXoeuZod8bVSVyHY`^|Yb!xo-+ne?8 z>-Wl#a=gNTK+R0d^5uPs*;?%ym&0*zCf%&2$r#n$^Tt}@AB$aDN1MmgZygl3v?NtSE2 z??xtMU}<)klbzaYvpYLk9AZh|Ol*yi4kmD#V(9CpwXoYP9jKR)Hc`@?d^C}JMeT#b@ zc?kiY3W+rV0hf#A;u$qzi~H_A$O>|;#)o04r~8ukY-qni7f4YSq8fYByyv$H-3^B3 z2{X6Zz0f^77Q&nuDhe>4r4b3b_z6QB?(TgbWbqZYVtLeDn<$f}0M_RsN^Cpw(bz)t zA$vNiAV}o46JvZxSM~k`H^1ao!{ap~{QjF`Dt_NbWUbpbyu1kQh_5S&=;me+Cd z+*7)z%WRu2C);l^CI+G5g??qT*=pr)>Z{nSb;{j>h!t1`i9bjP^!z0t--~eJAuh(0 z?nF1|rMEv5-b-HxZPXq*iI^JHzi<_?hPtqs<@{yXuw4|%VrZk)q*~!EexU(IFS@?= z%?EcUTW}}2PWnVOb#(l=lRzL4DblK9xw-xVz7l>6RF#5;QJr~m)6sD+dSv3AT#tLW_`p5~WQKLFLiDC-0zMX_vnj zozU3|*!*&SQ|mbI_OYsPkP92-Pa72$&~psIJ{E~5ux0UfH8DVi+L!)-v&=y1-A+L6 zlx8h!@B+}6Xav?LC~IxfLQ`}35GUI!>VXW~OS6C?6nV_n3z*bM>!CDh`{~Q6)&MR0 z83qF$a6O$+-^CQ7*+0MEQZFmlqw?hb=xWEgB3o?pEsraAORZ2Ma(f10A-tRc>nQV6 zfJh~*CQb1#AsQ~~FU@Az0`*R2%gs!nICmzjm+P661a<2PVM-$W!d?VBb1`$H1xIGp0_Jx{0VGITq!6mvp~VS8G}|DcTz(1~TO#-D4xHw4(YUtVA6Y!bFt{ zlcE%wldEU+^HC77S9jrU z<(`H+hHgTfdhAS>HVwP6cXIAHYT1%*wg9%er)w_L<7Ff9ns#~G3%fK8%Gi!0VKs1q z_)(hro-o?16!n&edbxWyI8KGlJ(msrdW#-oi3%o3O?4VHnJv!;Le zu`YmSQv+5wq4F4L*BB#&5}-#j1^@u>_xCX_l=DkhFtev3F z&esH1T9fYVZ1cF7VsMk$@H2tAtnbJAb)4FtXu}IP*Tk}4jUH;ePPpHYn4HCek3LBT z?aiLnthOH;UuMWIzOit7k6A4MVL9^$X~TPJT)>!eFbSz750pK`|J37#!B5@^1cXq0 zvb64@5)q-SJzLLB?AUT|OLy;>K;N+jGp%tE_;06Chv4Oe6x6j~=eH%uRcuD-(hi;b zl&3KzyYEvI*E(qiu5JB(8X*w%n-+m+ElqCkFCphEOgRiI{R^Yav)Q@PItyEH^n|E< ztyVpph6w;KzyR^{a^ZeLKoB$JiF^w10t8^7Ct0yTO${*XzkDI01^_RO0~G3aNl)a90kq2t^b-KY znDW402!Is;0Qe6vd+5LJG#tsV1{Ifl$2f?fU95LAsQzTJR$Jp&uz#FyG~- z|5UlPqg9Oi{}rB+M_C{B%b^5n@FdeCUNNK;KY}^ZegdpUS6kjPzc`~?y=PTM=<||B zY`~jQflNckzvC+ZsY4E*0%D zZ9EOP4GFEPVDM};TYr3SX+r&^xYka2mWRdW36|fS5?a?{v)0|tXQ@s^;u`ZzjUo<- z=(h=@;57&YVoOZrD0~s%78qDdQW~u4NO@!yizO5<&P6fFYf2O^W1~eD@!xy2!zc>1 z{!d5dv_Mv=qUz1I!2n}G3P9E>I8%t0Znz`V|IrpIh+Q}W`mbi>1Vr&EG+fZ@Ef!md z9?#h7Pik4(kcw9BMGbpSHWL-~9Yh*+Og++wMl z<4C?>a#5T|yhpuEizQMIab+i+RKHvuzg)`ZovYhdzyT(2L0xPll2 zlc|-yM3Kb+z+MUeKrt{621xJ#KrIA#l8k=(GvNUw_`rX4k#a;MB2oSS zvA3{FL!ob}Q7BZ%@0$Iefcek%)jwg(W7xaWdkb9*N4F>ORrcd*+FLaOfve+HP~KY2 zwcKsbmV1NTC86TJSo?7^PNpHKhhtx48cg`JXF;+ z??`I@86nC2v69Ae`Y7(_sB8x_G?YW8w{Hh^x$dDxl%~O& z>Iu`wegzs__nrNI4OMsFE?Bj#)e@~~u-p>YVhvS&CXq4MvB5pqCDuj3vr3S*!Fusb z_$i*~L6(XGV=BvgFa;rKU6{@u$*p;19+%EOJlf{(g;qXDCWML1>z*>7=)OrfOfU*q zYwb*^KhVCD9A7=DkmzYJ=73iMtrjq-w4}Lju@1}U@Q7$ z<=VgI;OBu6dM$k`Vs>+FTa}$CyhmWcj6b2K>~rG{At-F!mDcu+`f47<(eP_~Uk&Wn z?(^#Sco#%tI`SgI(q6G#$t5W6Rg;*V?5Ymz8Y=N2m_<`&+OSu$QEDczo;1vlxGb>A z(kcyV%p5!;j^JK@Z9H`-oOX};=*i`LT-25;p2jd;eYCZlxQ`f_!U=MW!T|_}p7$N^ zTN(0EhR)ekXA>Kfbgq77D!g0H>a2L>?<`%E^rV%3;cJ?~(Q6eJaa24D+tI%D@j^0?APN{6> zPK8-@wtL4TbNl;nCcgfN88)xPy@I~X_!gpDubDxHDVjc&Qp!F&^{>|o#P_=a$E9V!!$T;a!t;@QcN>KTL9A<>ua4Jc%9nFHHv7lI>3n!1ph^xx)!=?k|jR(1$so zSbdUah+rsj!AC|=v6n=8?i2&D2BK0)w2zKZ|SR@{(fYxR-k@1DszVjs9GuSWFSIk91myT60 z9Bw!!?P>q$sOYV<8stT=f{E9R9T#ylNa|6)vtqgdack`LIhgJJ&-N*N$U*OSv|u7d}KyI|)|F6%^>7yp`&mc2PLQfqi&A)jb)s9Efth74hBK zmGQlXnZ`ImPv&pOuktQuI#xWP=`&R%SRhWXX2mcpy_W0ZzThqMUl~fr2G0~+IgB3? z$d&5N))X_7)xtNfx(iyG(-NOBNmaQfu9Q@uko;bG3c~ zV!cCBF*(7L0bOkLQiJFvJl5`9!vqY(!umuSo29}2utZkuIN}Rw+*fs%J5jB^Tg^UX z_WZ3o`n8r{ZMjjasVt>$cy%Y79JVSG@U`PxXNtHo3q6tZ4!dtJ1N$zRN9pI}y=Al#<3YuzOd|6b6 z9=C&TM^D{s7!Vhs1T^oh1td;ng7j`kx3Fi;ru{dT`4@M3MJmkCp7qvAQ+dp1t{|dY zh!BIhW;1(xqh}2>R|8uHb@uMBy;1XHTRiec(gLrn^#LZ@n;lyE@a;=_LsR?OULz_3Lj!dTdy2>G@>#ts-eihR z7TFgCDts|#t}lK_5=?Gt6dS|mPKvs!b$lv7K=~J{Ym7o~0 zaP|6P-0{?A&43a$yDHVzfowpL$JK3FRB=|fXwnAZzaFtj>gj~N-r09)2|D*BtT>WJ zO_~Swex?6hmU$wP)rdBnu~b~%u~OeHc=+5W!s)~#?#fJscVRRGL9GgVLA0OiF0Q&~ z&~dab671vGS!c8n&hJ;jEq=7_cK&#)uSpVwJBmaP}x`+83~4!u_^>mOec2Rl4@la{Vkpn%GVh1j)#~m8m^z%@N8* z8ujB3++tE^!4IX-C7b2zf)7b2%+Wi~{DIv9Xl4-m-at%{`>LnbjLHyP0n!tRlI}-q z#q;H_TfmFtBKSmrm8LrCa_#CV*5B!7y#<)j_?gJpB1$}>6JbtLEtllwD^*-^?XPmG zXUJd^D>MBba8v|nb*XQ9Enr(35$J& zy5P#X&eN7IKyeCDY7Tk1im?F=v{{53x$Xg`c-B-0If@oL1gQ|?ehn~bC>h=56V+0T z9{~Z8mX0pfkidgs48WS|0bZYCw3f15m&s{A>J@Kj%`-H#^ChhR?wN<&&!;gBmS1Sq zSuZe6?oI?~b+YZjjXcsdKaw+TYAume`7v?0 zQ#b1LnrZTIe04qD(&fw=z8apFT;Li$eR$^c@=_JwTOGuw>D6D~8>LTmcu(_|$Ka)K z?iyu?0=6E6O3wgpSs&=T|M>o|Z#JLlY5TjBuu$jUNik8;z2nw$u?zF&aIZIcelIH> z)IihY?*Ujp7KpX1?rlpPqQeunS4LLR-QjYFL$=+O%f7xh@7B)PGdcv<(q$o~7TzjH zb(bIeYt6;McI4*fNk44=PuMQ05fUj^OX!_=|G}dZ;~9V(-781`tdB?Trc2HhD@nME=-F}t*J77e!I?SNd``E(Lb?UI-q8Q$w*x_@!a}bG zzG0{Mj73}@GPaV3b+qNHy+x_;-IGlJYx+Pj_bLR!*#kTl9o+@G7RsM;hOE~%0RRE* z5-Mp#k6OW3ArS~}M@GN343PmIiLlZSmprYIi^mqnL_`6S2AkX4WZz}C8<_~jf}%qP zlJ58p7kwH=Ey-lM7}?>ygmh)yn*MEzk2jEVJdvj=BbaIVTl2rt!{ z6?;Bi$wZRk>oar~G2f?Sn<27uAjbsLpI~cvmf+G%b3`-oDAg50RVYoox(u*BHKHVguX|_F=W1&R{QnTG&kgUx(Tp? ztXS-c`Jno)gZkwrsRD#X@|+*08$EWgHFx&*uL11zYD%gX97zTUc# zkZA^gorTQJ&BK!%1C? z1ieOaDmh}8s;sZUPAv!-Fv6~`6Xxa-a;`Asrl2>*G!ilx=FS%~62ZbFzsAJ70Y5$5 z(}~pVYH2sme%B}r12>xp;03ahq)ymb-P74O&GKeCYudoaLY`nS!vgL^H#6VzJN8{+ z)foA5KAK-k_uk4HXIeuHDdFYod#AabF@+ylsxdF;1lO3p&-e*2G7yXG%FEw!B(B$g z&7KRecFOAxjBrR(4$g;lNx8V>_pasEGro@Q8z}qx!}oV`3&7yWfja}?_=-Lo;8avuJ1JCFuG0S zpc{Es-J5S^yQy6}{Oixs>?e3P{Gbk2%<1wp{eFUEjm9{0?IFC$R`g^cArjrBB73rL zJwol$5rNXZv)=>m4jbj*)#7a!A%Zx>R;;VUa6-4dj{dZFvU`Fq@ZQPkUbmN1%2w~enOWtV`2qca{6LmWSLH@v{%y=&GG3fr`V}PoGoG+H6D3ZSR%V&G) zY9J!K0ylOU75sq+kQY55s`4dGEz zZFh)r)>-x4?8}In3=c;YHN8%-I)x}cEWv9NICF}(BAa0EaJDk7r`M_Jkt=p8b*zgt z;-to;)bhOQXAAVlYU+gk@H4#@L0xez=~_7|2YAp-YLE=39A?ML0rjk5v;o)7x7^M& z8@j9%ytaaPG|3*rBu575`yyF^oB~f$y&|I7BQeMMKNx!tpr)cP+&6SY zKzeV|q)SJt^d=ob2L&N?kQ%BY(xvwM!vy+{@*ZO|zTWIeFYd@8S&`O8mB?*7L32AR+dZ6zfDDJZ~y2A$4XqSYE zq0omz^3*>IsD(3=CboRfgm!@)>6>lUKplBUGppNr%RhZNeFSkxWpcBlf%0{|c*D5x z!jRW*$}DoTOBpTPQ4gdD5c4zyZkJ>qkRq6;L{Ss$U4!z?aec!05-Sgx)bj{8A$f2w zXS?06^vRLnmysQYg!YscVNI{Bx7z5_pPb@WM9SBTX|jhI-BzrT#tM2h(yGBwx|{}JE;{(CBHGBMo|@CsK4pF%|mi}7>d z`^A7~c!{uMWQUhKhqcf?Gk(AKb5A_X%{sWwg9wSUbf)oqD4^7FN2Az!hR=kOBg3&?SSvB;dWf z!}vnj*wNsyM^G1Wv43>+N(dkXs&qyl2G#DqCr1Sj5K0D~VE2va#c~{S_=POFqayn2aNE94$wDAz^ zuf3Uos1ZNc?c{MFnCk7d#;Jq!Nkg`C-;mPw2u#hi6;%b-(#_{J*?<3jf|EK}@E*O} zFm`~n=ePesF%oQQ*JLT5`jE&c@2vk|Pm0?ISV3_89b+U{oF0IYvL#u9K-E^LW78({ z8xZk+Cv2&Nu{I4e8~NEip_tV?Drj$&uJ<9Vx1#gH2M*Oo3Nx24s0=YphQgsaBJffL zNrDcsO*mpipwn%-KXBkQo?-+(6Ho+g3^R8wbID*(4sKGmSsaF>KU+Iqe_g-o>Ddz! zEG^g0hv$_ehDm*`P*l@lk#}KPA`}`{E!F?Z7ayPkc)#|@%jZRw=koGHViJ?J6@~Ng znUagzx}N$!N@a6zjt?gz6FGuGawfJL--Z0pD7d_l`AY(+qrT>Iub0OC9$I+-I>5r< zX%o+p;mGaurm|AY5wYbWo7@;q(5Ol8Zwi36P(TY|YMA0%rT~Xix8M)tIfBG&YPt(f zmeEOgWW?pl<~YN-E{-;DlMCuZDU#_GL=iwCCCyDnf{iKVnC&5a3e}K|8ftqsX&<}W zwDNG`R>){`Ux?_~o~%cP1~t&aUTuAV4PdF-&hF)}ew9f+uO5th^gfq?gEEXD1(R zCf6p}rM(bc4#EEkq0|(prwur4Onw0s<=fkBcLp)q2>OV(`MbX8NZ+WiJl$*wsjias zaofwnIJOuvx4aoQqrUn?D}rrDlnt-Q&jOU~9X1}mrsOylZ26!S7ZnyDk~A}A#?RtU z*(vPO_e>dM|DC_vos`WRXk6iy7;v!Bid}RHBbk)VNKObHYJ6I+g2Y;Xf9qs*{sx<~ z@2zi;=Z0Ipn4s*iu;^~sg-$!R+PP6xE%aUDp-il1c&iXe#B$j=?o}VZ02GLGc>1Sh z!=w?mHFU@3MD^a1esx0Hhh6X0^v#{be^>vc6%-_nyfGy|5zjX3?fW9Ovp1ivljDIe zC6Y95^6=qG>ma7|VhklL2k92N>8%ZPmaFw&QHA&&_15~$1_y`6+D#VcT4wMz+B-4O zL+n)Auz3yPsgmgszYDmRs?u|JYwd81GM{h0URnECr%u$6y6 znfHZ6#0lWNOp{xcO=ufr&U?t%t-?QDPO*ty?Kq-XY7gy=EQ2Z!M?+~t_3&b*rMVa| z34WHC{(X_n={g{&#)>p_sdiPuyl=7xT0Zl-cZOlvs(wm=%;>X!sMk4{m)wjz)GD1~ zkV))tW3aNqZ1WIxWCri+$zhhV@qYjbbiXqzK9w?w>(1wK5P#_h%+FZ_8}cE|oqs|Y z@Tx+hw9K$OGUTAsXOkNqzUj_#u*TQJW<5wxPob|68QQImzWef*Y<6R-NtR_)UJNj} z46zpjijRA_B#6_~vjv%);8jIJ05Z(=l?$Xo9 zB>dngzy)K*39%c{l&N@nI;HW57eyOYS^EZ8kVmcu+Fkv=p`ip`)_s{4lpIB4ea^^n zp^q|E(H6*Zl?giR;@N)63j`T0Yy(EKZK`V#h)4Pj`5`uOnsoUyWj)gTa4T?Ltp|`)> zSquCjgI_jJqN|ApMjOYqNZy6?nYFvH+2h3zTMc&+G#a;N;Aj~pOlA^&_5A}5+3K6J z*D=1|SFUvJ5GMNTwpp~_oQkBRayxpBa;K2!AbM1NFPt zWsB<3bB7~2I?v_S z!p84?BKAAYZJj-qy`x_bHs^;C0~_$eZj#16>Y$jD_P|jmO2-&dCW-K89Ch`#wFZp# zK{C=Oa{lnM(fvRhN$Y*LU4+-lm~;Xg<^u=d0h^#t5Tpz8A5D-)J-)j;ii8Au5imo| zl8D%p0ed;Kvx`o=RpI>)3*g2J*O7+5ReK@dafp^Fk*`5RyNnWw^|8}lv}VyC+JFw- zx06KA2F-Q_AlI@upTRPuf2K*>L`i-wN>kz1G{`q^3!Ptu>MwbBz1QLF>h1cN>9w4k z+olmx-4(o8GAPoMc4{Qv0hHzK~HzIz`$~QJNg0qpr`=p!X zgV@Irx#$iV^7yzb`9oK+7pktVE6xqcRZ=X|c)W{XdlHt?A`^sOW^-|bc9o!ymk~$q zhojwy;1KF|G&&h6_fgin`#7|7rNW!eqEb_h(s<0&ozo)oKLRXvx1?R@t;X%AJ?xDo zR`9UG?02uupNZU+85*4Fov{C|)@s7f4WtP*Rx>*OKpT6K1{7Dnd7ImF&J4sL7Hgmq zN~8Jtc}`RDbk1u6qhRUu_0JE%5@G=6Y-J|KSTv(}@1=_hVp>9cN3IJT@X~v{0vxdY z9}q$tz(fEb#1bg42mwX_Y#9>~J^;Wq2*4Rn0O0(eILrU!R28h^Wu?w=z zX|8$Juc{mXyeMVBJRcU|_iC+Psbt`Wd9TA_zwqwy%-x2Zvy~d!bSkf z6o4V5$iWeErA{%xwqEtNPQGPNtGtdb^8c>dQvq=Qk5BRcNqFF4(T&(YcO{!D=a(cV zf%OuPVfj|rV&Q`Dh!40-4Ea%CiC=w)O=gl2ASpQaLi6{}UYb?BE>+Yq&dkuy#U|uJLhd-=G7saDupa;-Wod1K8`QL{1ay~S-I#F~7QZs;t4WhU4ylcqt840xo1sjJPEtU}x)w9TY zMU|E`{h7Zc`NU5MlJ`s8SP(S9*n1at_Q{}Av$=o>6Eft#UYt^FTT#}G?OfbjwL zpg;ujfCC^8g+QQCNF+B|KVm88{|ZImiQG1|$wvbI+ku1q$HBf*pM<_+hAL+hZaLcm zVJY38Z9XUe%ulpSh9a#r3Hu`ztl)m2;T=4S6{z-7*C!8|RbChF3>@xsFsrF)e+1fI z_jAHbD)FayiQ>)o{rSUm=&PAtOgh_8kseatv?d@3lC41L@~x5N@)L0xZ7s!avVdcp zK#eXdV_dvruXA9>lH!*$oG_|Jw7rvL5si1?Rwi|;wiM~oV`IiG~0|BRW^?vwNeW8s(E;$jJd)!pT0?u_mMSgkb!v$Qt{pcP;nWS~pfj~s^5Z!B7UrKD? zpU#}U^xTqmq3JSFOUp*#Rd7#v&lj!ieB0iUEt!1q#*c-3L5a>*slo(7vj)fd};opo3FNHj-9thc*X*B5lB1_%g+urY9&8Jz^AmW z2@twV4>%Iov}~XqHYGJ7NuD^_nWE2W(C{j#px42)`{?G+Gee{KF){`r*G*QHh2ITv zfbxEY6dv_9^bX$Hgl@v7>a9nYe{W=G_rX~62Ol73(ZO#5i}MGLdU)sY zWO_V&;wrhoyv|)u2|f_%Lo0fRG5xy)8(H4SQey<7f%Yw?|0E2OO4F62G*HLzbjaw) zkw4Aen;6$B-!e+g8*RmSNFqbFyJ)(__9Nx!SBm|JSuCf-EA;Vq>t`Ki@Q*=usF=zU z?616DYj_yGo}1UighK=tL8W?*A8Nbzb@ZML((99Lya){eh8>Kg*gU@atNM{@sZQ8@ z6{K1vu!3Uz43-W>qMRl2v%%g~CoKuDd4*&wpdWdTg;)Ad2-_rh>?IBDFGY&wLym7( zPSJ7@ct52}tEH$*`wpc(7O<K;u@2uwp5m5u)$SsNPBGbK zxl$|Mb=E{hR{1~=I&9V5sLpCps={o0jfK~-IeKH^)$r)-{vW-&6Yl2)LekpRk?qDGeNF&nh_KK&p^!XwmJYCEZ)0Lt zxBTFnV?=*D{v{Kn^kENJ#J*YNlnRg!G|?L&yvCDY6)z5B-I=t<9rIG$=o9K5svkK3 zHrNQXF;lH5}2Hn@7HhGm& zz2i|cR$UVIyZ)BITRX^P=Y?Qqy;Pu!xB2d`BrGQ1^fF_q&Lb$)E_nOsSNWJ1Eh5;! zizGicrL1ion42;i&5K5^xHn*8qZ9y=kpzH9rkdqdMGO?mBp6|gChaXWm+%iEO$k`0kj%(`H6J~n%3aM;k*>waNSNGe}H2@O-UO4vPO zN*>0O*ZG5zuf7GhA$4`LH~Pw0r2@NsztflJAU^km`m;2wcweD{j&@w7u=|VLfzxKK z_gsV2M`eWrvT;0rka)cjnck@x(gZvEmYmC30gyWQPd&;#cWV)pzrH=m(%$m-sIjzg z04uDdaR8}kM@zi{eR1?6Lk{(=KNiPQKr!Ex9wBZHDx^upP75^i>o9fb*IOT`bl-R+ zLiQ-k7riTQ{#1J5>eAe1wb3W=B*uQSwFDg{V~@71^!EUnFVDPMn@U)o8aqKU2}(L| z_UDJ$;{y-+)=m9RoJ1P~MtuxALR-Hd(n33+kx?pDW8@RxTE(9F``78`3LFON_fSlI zH*Vk~WA6H?!2ivv&T}6x+b+#rV}l%^3bt;=RJ`>z+*Wecqi(X>nMoxyT2_#RV1dG+ergMlq111JVPR;ZU1}d&ii(TI)UoTh23t6O8PNSwbmjX-=X%28Yw~U7SD~8u~l27;jrvhh#F+wJgT5yD4 zc_Vyg^EFPzF*k+wDK|SiUI3Yg@8f+}1^y)(K|eZ?vExO?kK{l_a@NxdV6Eju51A7F z`y+RRQ8q`M=yd(z_ril7+(+gCsF*o#eL7E|y;l(0CoYC)>e81)#!d)Q^12G~6Yh*n zuJ*56EgSY0pIvPh+eI}2SFE5@2Y(fJy>tnGv&c1+2B2p;1(%*Y)XNZ*k~Jxinnih^ zLlOPoHjm^pTbQAnj;Vq4T5W=UEzFEjp<e#X2FT6A#1Iso(+i`xH#Z>a2FN!^Qf2 zmC_w0!{G>7bANhSQJ+Vot|XL!h=Zqof5E<%eU;o)`t;hp6|ff&6Ud9M6EfBTYy)0`|o zV@(~-&XzNI2r@9k&}Vm>_=zn^sEp{Iw@vua47j572$iry)d@)zsR-=Mp4u05J9G3; zUvVED71Nl4c%Om^N4KI^q`V9+8<_*N&Zt_e=@4qPUhqq1Y5N-$tDjoEZlfKEJywuOc%V$yLIX18HJ{VZ!^ON?Un4~|a<8HzT82^4 z1KVO(dGA*psq#JsNSqIXac@$yU&>}dxTDsER>nsxCxZ`)h6p^lBn zC>|jo_4OKDKB94`!39hs-idaaJ-r8?G|rEvLN$%;50ff`=ui>#Y+m z9KCgO=49~gJ;lpp$R-rNS({^{XCKdYwLT2;^nc1o#d?lq^PCd`YmFgDoX>!zq#-X?}e4pIAdjf%#W3*|1(7O9b^dkuCz23U>6hs|^g{7*Sr=lLIs zgeP}Vl-$2nIsY}22=M=>!gf2Jb08p_{q5U-sV5=ZY*&IQUj|1g7Vjl|8Z43YW`8Am zB!1r9hGv-ofp%DL4D{!x@K3P}WJ;L+pCUv=e{(I`ni#%3fmzr)W}RtfQ)6?`;oB0a zmT%3UWoTw-J*2tkAS5|E=Ud}AUo4qkkG*{4r!rb~o8>X^(6A3*W?Sl-Fr!?0Ar?g0nJ@Q^bN9|c;3_oT%9fC&)y31)Xp^gNsIi%lS;1ldK%sEC##j^=hdb2 zz|l0V22XT|z3J_Pi8EHVyl1LKkx}2;!j3GxUU`1Ayx?|E%Y1#gwYDF6l4ToF7|Jb; z4VCdQ$h=$RU_TY1vdO$Jk*L!dDwO=~`9;xkWg03RAT>Q{7TM?Kuf685YSlm)r(+pNa zwtNdN*jhlX!4RI|RQRySCzxuwxdiW}h)dzy-TcKThE3mp(f3JSKb(Dgo^7_7z5M|9 z8+mU3qe%7efNPtN96LY;CLKIs958bq*}wx_6Mc#|(p&hIdXWl$2!G)9tb&8C`7vXU zf@_;`!*w}G2>vz|8DOJ0x#$HR|G9$FmFsU90hTFcV@i01=l((+*vmUQ*+KGyoH0O* z-R_6=Ba^Jje4OK7x~~;ckh+dz7{(waBjgbg+iy)<%Us@T?g#k*7z`#4g>KLFF&1R~ zX^aMsIdd@QD+oTy{?WEAZ-j{rp0*Z2`s-;PZYruaLSDQX;sF9pV-J82@sLhdxD(}u zQ5+H{swwGm&cr%SPDYAykNivIko^Z3C7@rA@Mqf|Zx*h0N|}PTLNYbFwVKYgMZ~yY z%yE8HX=p8o_;iJ|G%&5yD#f;VGN@j1b{N=G;~jXZewcP>mlN>P04^yFlpBbXx5PT# zkeZYy%^yiDzr_T@s^t_v*VG=cA)$*>g=Cv{_D~1Ai`FQFlNYe9PTZX2eSyd>@as6G ztlej|h&pNos|qquGWRbiE7_ZtZAK2K>Sf$`@tjuiu!XXU($(0;Da4|5I>Z#}H0a4X-@(HgpL+U(y}l)< znKy0)2cLgIZ{X0{@dsn)n@^MOWFCdqiRX(*h+;(iq%Fd4R(;%h!n2xhQryaIwLp$q z-p!H@kpg4m8p~SYCrN?zWPXNDfxZ+ajW*Mc%dZN<>?;GV_Rv`Tt1#ju$v@tLy`p)(8_jAT zcHAAVBOeTE8koRqs#GEwru3c)KOn*H9>)vo?BACvn6V(D;j-)t9*ZpfKx~8}X&0SO zOQK^`ucs5sh{b<8FQ`&I!r16)qRAJ`GLpq{pgLLiFXJ?S(7#$*!qX!LHCm-(cNz?Ke-gAEP0?sk|l^s7?RYz%OQ8xSVS5A># zaO+e1$}Rl&5*#$+WL-1ZX#-NGlYIkUfp4erI^iK_u0m>4*6X})4nbA?nc{$WaWSMu z=bF-g-uH}~q@fKV(*WFrpQqX&80bWcLzvnVVRo;;J7ADLd}0{*C8F_q%R^c&Pr2YaqD}MF>yteHJzVYPzC4@vJ>*Y- zDHmH(QhQIsZ3OO4@Jd@lES`z*#`$H{x*2e6;2|+dLFqRSajVKUqQjSOObi9Id9_X1 z9!u?kv{j^qNq9JY25~12isV&PB@>CeESiCo+c;Y671&T|yCbSViQT_O7RU|=g4GEi z#Rdon#;T9KchPY>&yqLGh~6&;>sA!3+JSH-d@@I&-y?7KxdN`7J@%1#l21l(zK5cO z{5rkcka5V0f*eaaxy$;i>Q-mRcPuw05tn~oM&umcx3&;aZ}6Xp{(7td9igl*SyV90 z`4jl1+S&h0^l56y$~4~hA$nNaE)>3FzB5$RiV+O`+kVcX`R12k;c8+vaq?Lyg+}l_ zN0i{i(_B}dB6kRxCKoq|(1eOH5x1Z^3i2TdvtRAfcjb!wi%hwGSpv04eS5tR+!^r6 zHzI5Wkd(`-M<5q74RbEG!+#FvE|MZe{xpMAnaErW5OvQv#4__lpUmCnRX-sd6DMnT zUuIgSHKt0(c8%IETvePNKi)0Jb#fCkrG1O{vgh}6_q)%AaV%^naywlO!9Gc=b7UT+ zfUhbqV|fUG#uDqgKl5?l>Vu!@;_E(tMazGMzl`5B$?}-ORrh6cH9ud%Tz5R-3`?P1 zI>1qYag)^!vKfdg&3q854tRzimAcoBIAveQQBaRl%pUr(qEedB2 zKSPI{V)hloz8~QI;%v+mfRyJYKTfNgTzPNymm-6z{QbE)9xh#shMg#JURt8MKu>-` z?0_ekf{VcwOW)ezGt{My1}%_4j3!N$fyy~KQ-e62fPXvwDWa=mtF!eMV-_c2Osg*i zw9x+a_7l4z@(Nsxde^sQuXL&qey+GWTm^VU4Frm@)2LlEl1kq&fVP?t)xZ2H3nOlO z77LRj?gTzcaK~3w(dk#X>V6b&iI?<>ZqH`YT|I=H+4tSvh9hN^zevsgRh8cDgqts_8_uD8NsguV!3G z05mo>@#3ePtDTq#!9jOawA}su=KtGXpLtK_;+C#KnAY4;dNgBV-h?Mq}irsO)pcTKyKl2xD<*}{>7yItn88TwXS8QS&>WMvhtHT zGYW+rYFbpxf*}f@2F`CW_zEVRQGAr5Ep(iclp0h<^FW|E&U|@*e_h1!Rs{Un)^Xr! z;h!MSyP?z(jqvQec48;Mh>&HrtBP)<5Fd97PehNGg|Kx`Jz#1Okfr*lwOL!B9mL1L zr5epmc>Oozfe#=4pZ{YQ z>Fs^u{Ee48N>Y<}^zP8vqi*;!>Qne!c*uTXGAQDtVj$$8f&2P*VK7o#QkbH50Y8-xjE*x+3SUK6Zk6tGtaD&k z7KQ^SO%p-6;5{MT7fl;Nk@<_-Q3_rBoUu@(h9f4HZY~Bs_wPg<<_0Y#3!5U*3bhUB z3vB0m!Oj)xUMUMc4r4FGFk8Z5c?fr>787X37xomKIi7)Wo8U)!Q|GcOI=VeoI41SJ zMxwt#Q--9+@n`^A611b^q>u66P*w2`=D~{egseH~G)2uKGZ`5sA5csg?^4jxr{US$ zh3`RkN@PWwI>wp2b|MX5+&4X(C%Kio3R@z;0rX$uEe^xAnjUIe9kZAyaqnKHd92qa z6--JSV`dswL3omPeCaxteL` z73Jr950M+g^I)p0AX;6on-s*TxM}Z_X0CTf&|og56t22h;LL0hfe|rH=ta%?3;i_> zhPtCG2pqv69K`%t9WaR>j8id~CL;*t*wLDP32b@WIodd$KTH+u%S`7PSf?bOo7z<~ zlI=SMQGx#N%Ikk{+uUt zgpIyx)aEyOec)!az{5ZkQv?FBWB`5FEw@KIxE;pxPic46VqhAFW99owx_7%J|w&k}l6ozF@wf{`?B0*Q3m;OvC(G}^S zIZ~LRd%djEtZq2LF!v#U%RGjXy7DWLG!k*xtK*Ic(T-`C&VCVW5k_%_?U_pqg1{#8A5Z$9Onwaz}&GwDHH{ z3vwGQS+OF?`6fW!_M~9;*n>!DmG|ot_0Lba_e3a*I5`;}6aHO5h}!D&^+C(!yM<%p z%RZw{9OV0t#7@6=K@2(b{2O$8607~Eog-PE2i-!w<8hA-K;d?|q`+-eAlE{3?njcz z!PAsf^5-5{J>$7l=E-dG%iWALY=`9s2K(h#16v9G67sK?G<+Tu_rWOvdJ}j)Go5fp z4s0X^x-Boh>0kM;XL0k;_MgDj(#$8I{^L2v_58&QomuSi+&Od}odv7R^-rmidb*h6 z!|U96gHZ>AB_s3G9!^)JV4jUQ(-}lf+Ou6OVrp(KTlgPhEqTQfT*HYOGL&|{581my zahYA+h!bQ3a^hk8-kX`)9)bxweSW*mC)Tq5F>gof;}Cc27Q6aCe@eR*-#B{qG~ONW z0;t|a2ozpj4GkAyF5o5Me-Y?RbDoJC-NSIjH}S9bsnfvTA7|U%Q->dhuXy-cr%hE6 zkD=>0&AmSC<5ehLZY>)u7SvjX;DUaA+{kGhj{z{2B&CZKTy%LeXXEZ(wyob1_G6yLPHWO0y|RytbOSr@UuM0 z#d^>s(D)l#TjjK0@&4HY@ZA(c3#5vt#Wpsv99yaXD1$F6jW0M1_2iI?^fhJx+7G}x zu?Mf%p~9Ufl<4yqhSb!>xF~pe9sd5OIQaQwfk17(8|W)+?#C`QB>{nEr8rJ?+|qsE z<8J~wx|Yx1FvMlvzXM~vrM(T_iF@)cWpmFoUCa_aZebs2{H8y65$2g(xpPYx?{17M zz<$c1xdT;m^%%bUGReOT`^+UAhrpQ`$&jxPP|)Dd3aX*3G@2 z7Dy@vWG<+qpG`C4Ck`qj4&8#|eW?3yDs&aXpQE+-z5I|IX~TMZd1%m`Y#Q$c@5LQ`d?mtff_k zd(PvRG_!#5`c845%9ItU14A7b`&fpQ>V(_9Z+oV@srB!heV^YiryPMiJerjp^*S1f z8Di?`bsU_yyaN23jv?xgO5Yjwzk7%C@A*FanVH@@+XwC~`8lrDHR%wLMnQrAPgZ&i z1n8=+!w~J4=-iAyARv;SqWEoAPwJW=ka{H@|}B)A`C51#o!G?GP( zwPUbUrIKdgD~0p8-eWD^oh{cGqQ5Q!^*)+CX`W#bC6^E@&!PSs%k9jgb6;InDXFJ( z@2X{_dtMGz#yAqL@sNsA3`S>5gMH6XX$C+{Kk1znG2`}YZR@dx))`PW$!Y^m%w9-!oc(X}Y{ z?Csf?x9Gp&IoPjGy><7VwD0e-;z_vt;PZ2m{~%;E#*bOPkXGnMZ)lb$5TxHH5Z(IU zy)h6_*EP^i7(cr2=892qN>RBFX_roA&vE0@PYcIO0OY=-1DF3FUuik)B?o*w51T-Q7!5N*{fCmmubj3cvykq#N;L08s4 zyrV^_g!E3`4dKcSJZ-b=3MNV8nr|RCzUX+jUBLajr%JEygZwd~<@H}B#QkC|KQn6P zXF;keJq^2E{@#B1F##F6e_J<{L1t6lUwEHZ_vveQ|A(XR-*>ik(<;BFk#an0QEfK@ zIVSRTLl_vs=Wb{GJRy)8PuO^=C~i!ts+BcOsjIK;YYV#WPU#<<-8Cc$T*@Y{nY`jU zkA1NIrO4eZ@7_n8$ zRAsVIEoJ+=R=u=#qMoT?v^aNke#X74uB$TeQaZgCu{^MK@PgmiP10H_Y09KlK#=Yu z$USMQf>)O>F*(_BB(K#Ne_jK>O0tD_fyVIHojl7I@J-G;B;#k;ck@<|c}{jgYtl4! zj=?I#g;EdWe}}Bz-0j@Xy%P>>LW5tOzT#4MD7-PMn0D!->-jK`b00p0Uy+~hoS*Dq z6|Ti#`cB1wK~?2`jN8$~Qe3UmaI1aWK({h~{Ne(0eQL;YQCq36(mz94Sv;6WY?iIh zAC*V?kOTBb`eBF9)*kGeXTG#PQ%u1N0>^w$V;&n_w@kkFnetMx@@gBQ7T4Z2wfXCN zyv8F+_N}?Yn$Png3Iebv4=SVF;_%CL#z0xx*7*XAS-vC?$|nN(x`e#38a!qNkj$Y^ zpZ~rLyST^pvfM8^V=ovE-GkOYucPAH7w&jIlI=mYENS52C?rK?3Iskh*B{m!Nx!=z z{%IC95htow+WY_)hDZDhsN_nm4p1%FiYU_dGa2!vz9Rawq4|p^dNYYyK!{N^7MM2S zK+Tzv@&xB%AGb&}`oZws%QlLU*0om0vBVa~Nk=MBa^+}FcBU(r1Wja|JD=~bg^-)O z{&&WB*Z%Y%XOKg_i3Vu{kCdst1ocgR?8}oAIIL%@=$$;9-pQjA_WlEWMf!3E$o(G3 znH#oDeMI>t!)W;VphPqd*Bz@HnR+b`wQc&{I+wHd0|J?ztkaUV&V`f0;GFBVue_1MiM7UT|bc8_j^ z;Yr+ok-vTy{4dph@3P@+6{Dcd_8Gl&7`iWQNx~NYPLawLQl6g=p}!z|1GB)l{fjv$ zgW*O)3RWVe9&p{=mfCS*@Ms&MAG;LH7^{IRxX*~S7>6)!hyo2nG| zYvQjNvEZ#sI@(udGzmJoZuy|ZWU3*_B$XFm<1fy%?@Ob9v1cSwiR&gUHE>JOk{K8+ z>q{BmGvNGt^yltx@w>Up+kekdTU!ygTWs%tttt+TN8IfB4AC0C7p+WtlHJ4SSnH%X z{bp1LNL7>f21cqS#xf}S=3j$lHWMVjs7(Uz$B*ht&Z>zShZou_Rf1LB4dtUW9(0L~ zViOvKB;0GsA5}im#Ya{WBcW&JD6e~uhU3sPuIRbhk>^F6EUHpZ(DC2i8#DPeMlWUR zsZnJ-OZ703={Ao?P3}m??)KeWphhjCm$$$^7jIQf`LHcCt!OhmV>1d& z2}d)gfB_k77b^<3_Z~E>Xt%1dY(v$2mxZyPF(wXCZaIwPpZe0X%~*Jk3(Qatx-=f3 zHgbxOUb0aki+sSjLq8?YYQn;EQ^e;}6oYB~bi~ZZCE8ad`^OH$!YzD2RGNppC0H&h zG~lW+FYjSqHE~n_e)qoE8zd%cM-tIR!c4v;KjrPyzn&Vj9cI6ik^++&x4UqLgRTW! z+f@jksN9ZB0rvz7v$&F{sI-0DjtowekP4g!=XE^;>`%JSZ~IY570p%sP+?hmHG3$$ zXL<*^ay4MgDn+dSNx`OIXD%S{ppTSEJf2*J%+%S0;}DEP!t)jv0?Bm!9A>cW!q4TI|LtE#r@?^%W>O@oYs%!>;tJ1sRvdC8t| z7X{gkEJ)zbv}yEa`)R2^x%sp<`!0gRKX2~h!sPMRn46BIVH1S-)k9&yumP9hhvH=G5s>(E6*(A;^O+Ep)AjW_#~EfJMX=z&NiE} zrmv@z@a@ClZC86ApT(Y7esTOggc;rsU2#Fym%Q}2kT|~Ojc#j<3(0UIHxuQeF&lXE zGa0z%3?K%4&6=27_HFpmutNA?^K5@|A-0?E!~-1mh;-DGaM#>+Z}uqg%zvT4YRiq0*&73*4YESdIYyejIIy7Z6?akwd+!9YOMN5;Gg+j#j{V)^(fck?2{68%kzQ4 zMXVp=(?D$AEkFx)EP6EZBAR!o&1yO#H+$8XwdxpSCIozgY6>jZ(_*g}xYyAk= z_O@o+`*Q@_97ta&@Yl`40T{aF8R~easP0x$Ofl5?7oML3|Kp%l(Pw@o)A4J+4~vC+ z!KS^MgvnFYgUxvYAx{er8;AMNEw*{NIR60Aqc5HJ0u8jfyhfzgf&n<4f61LY z@AUwr`2r$uGa@=Lz$Nw2y)uE1P7s6g4@bqz!T8cuy+c+3vOsiU!A#Pv%d$DH19wQsRAW{5R2tC<3>0d1X^~-kZSJ_K$cbNCo__P54ba^ zu})V4F+fWtTm+NewCgvJ6iz^-q13)b>{2DSdh$6-Ee~meUb0DI_Y4KZQhTyG%k2g4 zLgzl0)n}Qjm5s~JID2wfql?5#Lu*XmZ*zU39&>xL-tMsE`GSbm!{KaiyOo(@ z4g2$zImL3#htFE~&2q@j>LpCCS_+=BW05be#>|;RIKtiD_m>YJ>nsUWLN`Rk&Kx7$ z-R26`&b7vLt#5~imD}sG60tLv6uU_eZg?Rc zP;24-=9z!aOqjVU$u-=sWOVIQvW1t?9{T8c;HtOV2K^H0N6{x-6n57>%@oRKN=lft z@3tMnCZ9#QVmzk{_VP*97^sK{NguovEh~@hhRDiO++sFtdL0v8+QyhGnB9yM`QCDk z4}>8)5T9WqbA_}F<@rZe=2d-NVu~PPPrS}53O!JHUU`1EM_yR3i6%Q`27j{kPu%Kc z$3@y~--NMarEk|iEk9CkJqhodvio!JW5foE=62`gPvi^MVQ)T5AN$IAJ|7>S^leng zlsqog7nx{TmFS@4orBKce3lSj0=p_)FygDy2xn!DvCzJ9nZ?lk>g~9$(XM{_V@q!l z{faGyTtmY6FX?SX8RY33G-G;~Yjrt$$+yynKKmDg7@vRrCH9u}Lu?$( zE6rz1?Tw);CXSt*MT;KC5Td&bBy)TeE$Q)2SBH`%efU2%YP{Oq$+6!vWcG%YV?UB> ze)DYt^x+BRz2TQMo;Nf(X_O4XYwO3o7>ZVf`zKE_O;1s9mwkKxy`eolTg9wE)$qXQCaQzM zaMPXXr91z9EAA4V{mbjr{mq*#JAMC2X#(7WLyt?@J*#6Lt*#(Q?nk@*pxV%zRZd8G z($qxP&#6mo;r^|*d&L+V-+y$=$#Mg7SGxXui#t!TqzBO@Y4)1`tYef0X>bv6Bsm^QkEP)^%lVv0=cR2tZ9iAXa2awjH23z3QaCtfQ}ToO36BtCEcv4Q7-Leqg}H#eq*%< zK;S1l3DN79`%*g>cFs?pcPXqqf1YZ6`8r5D&0*Q_dhCU{h9*t@x5OEsehSDY306{I znXhtkhL@pzpLv)5+!Gsh`#luGt(@YZi6Un6#Pig4qcz)v)X*gIa|X9e4=Oyayep&E z!LM7Z9x)7xU8q+dHOmvtd|=e7Rgm&tOGaaIoRg+xd;{2VdsM7x5A$9*fE-RD8BnfR;y9Q8$%Sh|DDBkyf z@7^gruL^&@#eQLjvbHFa{U=p&3VBae!~Xz6{OL~tB!el3rtqdPo-yUg7u21E#JAE~ z9_<#fu?*gLj{z?(hcE5vH8o|8v-;`nh2BGzX-f(CI|lEiaFz2KfAd%RtH$@zEZ_(Z zn7*?6^bO=(!2AA%^W!SQDuHATnd0_O&r2NtI>~+dvZQX`1#`}!rlHL-Q~#EuYP7Bg zo1`_X1Oam>RIc&$LyBGCw$>LnMd3SjU(m##nQnLY*$_95@dp6FJz|d*OGm#3ny8sf z_1s2oJMK9~MT&?qzjoaiYH_VF@gk_;Ps@~SiF~DwBcZ{aWsGB-Y)sA1u3|?i@D)Gd z%fa1RSqC=WEhB6pe4Keq;i_3d{MFCh0?xgzETAo|URbEgq()@Vr`BTXKq6FHjKT!L zd%T3byEeW|a|2v6)w2>r3CpS|bRx?tT$|Wm+&l|w+EV(oq(V;q&q?e5FO&LGWxA8s zKKh?HMH^kBzT?=0dIlq3tCiSC8WVL`rnsAgxQRYBufXG)M7M^hCxsVHUzREGWfxeT zB{Fu>ru0pcW=xXeM-!|x@}lx!ZRF2tdL%QbEKLneg}Ns?fPD8ZckkxFtf<=o3B|38 zfiO0ii!TQ^Xz;J|nrH6{;+q*+AhnO{jbk`l-LZZ@u!*VbgbK^{_sXnq1bzWfIDTq( z`cJ;k&88iunLODlpf={Kq!jS&Cvkh3_c;C}nZ#913qd8NZOppqnyE53_mk6G-9YJW z*zbSOW%~BKiEdH1>|Z#`-%wdq#k9V61l5`eaDz+@FaB&T-QM11i#}TKxxTG)-Ws7! zdyA#XL)qVP8*3;F1I>)SY?6M145o>{$z)bvDj)g-*DgqC2z!@)$#lpCsb&4Eb6vTi z)0*z^ybULtiu-|J1DmUa@#)xI^QLIQ%}~pF&p=c^gh@W)YW2xUVN>Hp=$6gVtP5v) zje8y_Es?t%q*-pn&mErlVv^G^?2E_mGtPf)b4nFqGU{DB80&#)?i@XuY#SAK4za(()CJuW$3BKD7!y>w*0GZ9jXQ<3ngP zEDaeuqciqJ;xibpTQq)$JP^k8x}AEN=3;k?=nGl+fdBQ*gn-;vZ1De;L0323jnR!R zw$|e>26OlJ7kd|hy5#*^*6Gu+3qs!yPSRDth*1VNODMV86JPnMqc%qbZ&GE9hzIA*^8i0x7#Zpz6Ibc*K} zb~btVF*`kPA)CNb@5lEHGQRGI`N@tQG}?O(*_mYK*d&=gzE+dHe~BOX_dYUc#wXwe z!}X=)0_kyaejltXT?u)f*AWk)5J-gN)C-i;^5_k)WWKDXobrjM}g+pE4aQ`D!S;@Tv8?@j-b)E{{kOD;J#B+HI5BLB{ZrjMJhE>C-{GR z>G~f9`9RN^m-l6G0ED#ASS$hWfd@`hnzhNbwNg|XSh26WZ<)mkG}u?-Kjc zNxExu+~$t*J+_{0N1V`>?nk?yX#0-sch2tGLvh(|_irmN9dnvpnrXT&ZhF)=y7tFl zHQug+d5$;5<9zwmcJsP$w)eN6N4)#9lSD=qQB5GhNXJc2QgtcQq!W>`3IUfvp&SB8 zP-qg94pW}=s(xlt41!9MMO=z!b3Mtjym;;9VGh-`iQjG0#>m<$yVPrp7an=Ld0TOG z(Y3QsTsLU~-Q2f*ue=@IxJka_e3v?D0^sgEIoCY-op1}Ci>NK_Tmy}vS|attC=5!t`cSjs;5-2! zqNklmtQjEq_-WIuE!RZr61LSel|9SMtTaUwn~7xHh9Z0)q=K42lxTeS&P{#Ub1K^0 z-rTHDJ6Ac$6Xg9x+-}bk>^BOgj?Ck^B%RyLZM)xWZ!KI?7hsj zD`oSw85P~5T)e^5w%cwK00em^>YHx_l1k=lxZYWgZgRa7dlh-W#CQi)O}xyGji^Lq zZtkS{c_iwn0`BhHV0~1gpAx&YyBqHg@dw`V2gkvNKIx8?WW~7dSaAh43eLI-?prwq zYgd(XL*g=>x6?PY_BN&v>N_t9tIZtoHZ*cOM>n1f;M(JvJ_^z`XS*vdv$vW_C-!X!}RIHm;rC z)`f1O4Q^gG^6D^ag%P!F+vtfSUR7tfEPf=8t0eyPEM+MK21Wa6+0OIW4xT(7}aNxC8j$s3VXok^Z+(lrq3P!@!V0IfeNh!LJ;^@qE6d|ff z!Zbn2t;wx$g_3M996+vs#|w2Q6%1PQadiSe_e_`tGOEu(NviSQIeNZ z`yY0+ZB|3Og_)xScn4KYw%dRJ1b7EkO}3_U8`urd1b7EkO}CY^v8}k=-QW@69aT2a zRMkRBB>8zH>Zk)e#HPy^JJr=Z*9&)bw1CR012K1fTh?O2FqkdL5G|%qVPQx)N5`iw zefhhuRX6iv?U^XQ9G0?Fdc)%l9^2=e#}@P7m$AnVzIEHMJo4e-B@(rz!Zgt)MkkrI1Qs5~{0a6uCxn8b%m zG&YNkc~U^LZz_e&G8}h#s_w$YVXLD}2jS#(USMom!zj}jZo&?(jX_o=UD)A*>1b9N zwO-UMyOiG4p^d94RH4~pD-XSyQsi|U4qaO|G1GN(Euw4KnLVSeOB|jpWeA#6z&kx- z*c)^mj50+kC@N1?-79TfIYNVMA6%xL9%8Qpd5MsqFB6YS{2rnS@FI{URIMczG}&a- zMMNr7Pm(Ldq=+c^Ahg#Eecv>Uue0<@>@Tl#&G%rx2o;ZkfMEhe3M51Iby0<8s;sK1 zC9EUbpr*!2N|~$;X0#@=1#n_gh!KG-#|nq7ej$>3$50k`w|m4eb^Af@>@$oEy+?fL z@KyMt`M!R9?>*-C@9I@mRbPkC$M}$xP>oe3l+}$ZD-tZolEX5*e@^~>cjx!({P*sx zdd&hM>{NUT{eBD-n?Q{N@DKnZW?_OM{Z#)-YN`sNnkB>0i&>I1WaUXPs7g5@kyv5R zhE4x6XMZ}|AGm*aG0x1`vv|OaFA*2eRN(l1?L~il&Pq9gn;2E7YL-@3W|g8^njCS- zsb!i~iiIl1v1UnRQAq?+B&3q}yY%L#eEs`+?uTOjwWN3F@88eQy>}knFc0+oa{(5b zsw##SSZb<@v1+O+NA%2*1;j|AieXosn}hQ@^Yrh_?H3KOwN#43lq%6uA~ej0zlcA}-m_PqpVja0h*I?U8;o;9)oq90ANHz> zs+nxy%nt1TbLEB+@Eou!xLnCI^9>8FeYNwGjlR_NsAN~n13#b#=k`CR=>N1cEHuEh$JelT-fxx8J|#cjIcGZz(*hKLeGm>@x9sDr}|bdvF}$Jc3|y=ibYfkS>yb5BoU#<=_QL-7PN!>?by z>wapWDR0(gnMIYA6)iZ$6u7mKQ6o|ceEbXj8=U_zeYd`sgO+eJhZ%RD&L4Z;1Ku1L z{HnmK7K(~0Ti9q~ie_doDzP&p1WJU70lf$0_;A|(d8VJeXJi+=o7CHH+cewvn!Cek zJp5({>Gyv>KV1J$h>Jw2ND|aVB~&96N>dY6i-|Q=R!XBQlZ+_{l*3SsRZszlf=9du zzjC+tWgMsCD!-^tzpLVYv-2ffU^5I4_asXU3~H*drCCa5s=%eOYNcgI^AiQkGXzrv zRSHxjL%se^XACegjdi6oBv|?kk}yWF!I;B)nv+j5UA$3wGU$|9(0w8xL$emUyD#J@?bg|FK>@?vrwVe?WCcUN=F#`)^#Fdgye zsr58`_;&Qavof-?EU2-CnMJCGnk-=(BB87Letu4i_J=C0pS5m%oY(S$=zKlz0p>tI z$smGiP^?o@)fe#F`}h0%-{0TQd%q6vH-Mivhx4(F zbkbe-fcJ)iJOKcJWwO~VX)2YpvbLm@tT6u}s;Z)@saaF`kY*EsS0iq7MCUEU+K6O} zad82HlPci^RAw0&P+*C#*}sW5zs66WnKuzuJfd}@2B|Up$n8j&?#)fnIBA5B=CwAP zk@$l?{K9Aa75&X0!&j?#(|RK|(bS>t>$h%ui(hTy4zott?%PR2UEGeTC$#RK5}L(( zPkHwB%iUa_q=8uS|A;)TkSO- zZfNUHaEBOUecs<_o`~M{*~5w6cXh%Ox3?}*+g#dG9~^tfc&hC*)n8nko3*!MtK55z z<>%dob635-IQGtS&h#%FG2Jf?rj*rb+;$xc)=9Mcii=g}-5%@0HSb8Boi%mpd){t$ z8gE=Yp7o`^@#O10TJyY&y{7H8m@XP`UEABd5xr{g_ULNK?vBo7$$O4H?rrwjj(0on zd!_8rTe;o!&yI<^%e*}oZ(iR3`V{v&xTWp$+V?jKYEBU@VMtL3DJEe9ltwt_Sb&LO zfQdpRf|*Fbptx0vSxi)t^S?VDug}5zHh5#nAtaN000M@vUJc<_lVrqKKLYEb7(L;{ zAy&P^Y=L_#zy)C-wn-#`occSw=6SyBd;asg^Y66$t;_oL1CynJT!$wri8N`AwOvaLln_WEjP&gI*W3o4}9w(HrAVddw{^mMu1 zLuUyNskZAQ%hIA{+*+xLc+2ctD-%rMfTvX3VX@Nb++09zxb#O}ESDrv;Y+}fINLvb z?4w>C68kRA{h6ZV;3>;(w#i@t!b7TUxR3xkN*w<7+tQ>0?la=Vu74Xgi6+~H{3+CB zMiuqud(qXCi(5%YbvmS(m>%>OakjQ*dFJ+p5b@bNA)w9(3Uy7l*_oKzK~E*d&tj|t z)qOK3s`l%4?)_>rGNh6TMyjewwL+}jp9mcQ{MVCh>hSO&5#kSkBh~laqh>#?rMa+C z(y-Y?^A~vVjLVRu(k*qHz{%X#Bp5EMcgY?1ZM)t*naY^}dfJo793l=I;*&VU!_KW95feKTAidu` z#aiBuDv}B|RAQ>BQ+3{4Yg;sM0*le$n5uXjm&MAM zXsW8K-!&ILZuZvvG(!;+1RVtwbP$nE5=ICO5d>$0mDSX)R{~VLBVI*a%0x^=2E}kU z@T53GMa>-;V;&eY6A=*uzc0Tw?&~G-i7J9D9Hg~Y+~5ERm`Tk;gai_GQZc(M!*NG= zJ^F+ZAgjB!Xjbb`{;n84eHzLH>sx#Qnjot9hLNgR`L%B9xw>xK`5>HXs-%($Myjew zB%@U!Q^f?$G)+-0xErD$fFa6I(noTVoqES*89cMtuVqzFX~~=e{CH_GVjr&`ih{t|tl1RiAaodzWG|W|C1!Ht@;dWw(s5|5kz4Gk3;J|^;!s}ADtLn4?XjJ?|Jx| z@-G4Nw>VQxh#}xv zZCNCd8r8LQ0Z0U4WMT9qok*`-lFBX#h}fq#Q1E$@N^cZ2VRnQfT55x9*wFWy%R!dQumpmUFVuwy zJOQTU4U}Cx62)AL#2fNvs9%hVn{+Mul0;m$UMIi-?-v4v({fv2!YL%^!4;}y6>kk6 zWDEysd8En_LYzUAkq+2yHq4 zlZ%jwNg|2~B$7!HzrUcC)n>}M`7As9@g<63nTCBcKg_DCs>E!ns;FC><;#u-y(ww2 zZB$y=r6gz~k^+JzG#`My%n6u(IHuR9jyHVAf!^JqY`}|)0yP<|QAr>~`*J_bWBZm3s9)2+x9#is@8+f%nalpgRZ}pvGcv!}2!N^( zDG5=d;%qptm~zgwfzc0J98TC@-YT7TG#_y4I@P;b+4*YA2OMm%m{ux;m{=&8s*0$f zg=VHq{-1)M;q>3%zn=Ns#`?3ab3b*`A>}nt9hhRtP#8e}h(#GyR8@;ovbp(yn`EUH zC<65tdSsmKC==-c6Mta5%`8X|8H+#<#Yn_V6dktI552 z{QmW)D*seyN}!}@qGl;zSf(VReM4*c5ATllSo*M6@8b7o-#=%*(}WUfAJZ_5LkIN# z3aY3os}Psy8-z767Bh(vD6>81R_E}3z}{xtCo2*p3h_k(l1U^iexJokel1_cf^uGU{!=68bMLM5 z>^trL7@NejtV}u9+24&xe=oAZn@xYL$`THN;E| z`v>3C`=DoXQ}LS5=DA_J4E|x*K>9&9`R|wc^Za{k&-3L7mQzhhL@cz*!bl>BNhGLz z|1fV=eeACRmGeW&Ph13pFI^uqGcyd#GP44+D(zI`)Lni3_4Z?zk=Wz+vCk}AWBIMg zCfj@Frie$NOfy(?u$o28aq2u2cj@!)zWw7URT0epMOG#$QnJFVmRO)rB`*|^{{01C z=Me0DY##wqeTG;oX8rl<52%iRnAKGh)Xgb==4+T|uq-r$w^I764gl$@4kP( zm+ya@*UIyby5D~&?)h#!=fi+VfQVumn_$_7gGmCAWhxg0Oi%Gl5*n#!Tv%diqNSv1 ztbZ`H!9k&C6bgYEClz8@Y+-Z=Kwd@tMTzX^5Yon;1v=7 zCMcwu$|jj%Vpu4mktGS%=3)EyPu@sQ;LVlq4E;cT2tSCw+^}rw)MValG%5y^4xQl+V8u8HaJlc&wIG{ zh(SdUZ*OW!IEvkK&JH{87Mu!OMv$)h_W1U4IJ@Yr(L{SUUEg~5VkXAk_Z}A`tr7Mv zvf-(Ycf5Jy%5M0#mG3d#x3X-HGCaIm znBrpQ4sLG|Z#X;8X6d{R$7}C$=Hec*GtPF&-tG?3p5A*z-yP&v)?vHnj*EMHLArNo z6;e7cSZ`IvkS;_IRkUsqtpLgJvs?Oe|0&pa*~+C-QYH%A=0*zW0UgqAS@veAx85g7jdO`(6NF302?$ zLhgoUfO6-LA<$|?*N2gk@<;pr0wEXB1h%M(=|2Pqp| z@rvsem}=n~f@IQ04y=XXpq;$jaLPXf``-~CeB<9qnqG9B&vEa0^3K6$$=2+B7^}j& zrtvQBecUH^b_3a*hRM2j*{6CY^U-0m*xs;B=f7VF>oqpO z0002@raey6>WWhZ)}^q)}~2LTWzp( z02{(7({1;Z6Cec4teNim;%Agg$yv9RRg`NIN@hfuZdN4`?8w79`P$m5%31-SNmS{! z`!h2c!nZe(Br|X>NlyXm0FMFSM$zn2Rh-#d8wyjTFwu4<`azF2c7@bLnbNy!wcw{$ zb|&lN#2ny5owVk68Pcu|8(VrY?G74;vbQ&eNR=)mXSg};A@x4Y*7IoPx;K)t?)2RY z%$n~3PQ=|=ONGHecm_NOK}&+kUJ4Ev4&q?WPHt~tjjOYGxpj-KtVyT3uFm7WN~^Ym zhjw2lsOhP9*TRK`oGTz>W+zCl%1>i8&V_0P3a+bH44FfCjj$p2nFMGq#AkN)5$0s; zvPf#NOu~jSG-j$8<;*a%FzzYv2bAMfu|$}TgAEasrE`%HLCadpt;*$e!VUxuq|_9T zgv1ds8zX5B)i^|R15GSd%^V+Y*6EolXB+^k;vB^Zx`5b$m{Y|<8DiiH3JMiTpCPc| za5Y@zS)tKnQiU`oiwM^y4v0faT~}REYzKEZ7&m&QbS|be<8)v&3sx{?5fVx ziYOup_NqYzP)5r3=Gs|pIEbSWQ;qM<`|Zx3U%uv^@9(RA`u^#Q&6-@fF0*jj%>d9O zs{ARo({kMa27x70rrTckm%ZX#%{l-L0!pV%x8G&N_tWg0^KY`aNhGFaq`|m4soSgo zGzlu5Hrh^Sreg2rMm_4RruoNaW;Xe$nMqwm`)uz#j`v(1nZ*%t;Dmxe%xm8EQh;~E z4nJd93M_=u0N|;+Yw$B;<24$k79vsV_`bE{TE*WkrFT1j{C6Qyqe_vaLEBep!4^v*FILKgvG;L$;0yP;qr0^pN}13T_P>2p;4nzjlF;u3J;Dv2n*RsQ6utzEa-q@&Z8yI~Die9yN<&4Vrm%K9^%6Qj+ z$#rWW$(Z11APkITf?!x<5;ZR_>|RAi%ahlQrEy@yQm8WFl$G77R9Gc$=6K+;w=_c+ zhlOQ2v)htz2Q8MR%1cekOBUm|+GNmIJf#1%p zj{Y4QbuZ29MyENG4Uihw?*SL|f#S%AH=KGN|8=Uis?XJ2nTaV=RFWkXD-(X zwM$eL4n#AP2$fWkBL{yUrhe6~PJ1iw zsi^(|A(&2P8zSeQ=pp>C>38z&?Kiv6J%IjZvwG6_6-jNfRiuB#X_ab*#ab$%CSj>+ z{J%8?Mg^N4<$e$xKuv4#!2s}tpAs+jsHSSFrT${zq9y|70*FMkjV7I;CZPQ<5@P80 zMvrjE*Q-u|Jy0x>A8{~GK~G1X`TeK;{{yupgf&$XsZ|n0!wo^F)BJwh zf4`@F`{(c6_IuzQPmp#e;va0n%(F8rEXHaos+fKlYG5di0)T%z5A+-)I>!_}-n4mq z!%3|;xSxH|rC1w>T6FQFMv(A9^O`mA@9!GXp*`R4#S!wNvXxN;rzxzO8ln=Kk*@vZ z)F0isU$>O$q3N~pdFY4mFr<=8#En%>KQO}`&-6napo7kC;2);2cRAJvAP?h{?cLwm z!_@o)QAE&aQxgE0Br!0Ul6*-g`m>#C>G=xj^=G@63ayw$UatP3zbLAbNo{{zmOz-m zilS<&JVP*YRt%hl$#O8FhA7@Aw`a|10{Mde4%EYZVjJ$ZyT1G8{@H%7iG-j@Aux)$ z`MwPYLH1l!RQ55xW1V5(0l(J& zA4({ypo$`*Y9NTJufKlxpELGh&bYYuUf$Z?_~XrLIpbP)Y~=mk!-tG?eTph6s;Tu< z_fDlb6Wk&jSek(D2b2fmAityqdE@D?J@aE6{3G!-MKx4ZMMRSnc75Q_og6Q^IL~f4 z-t(RL-@m^5-TOZ4Tjsxm0t@#L&`TvP2}n|Pfx+-P(Bd7SfMdDWm>OeKkaP&`5J7j| zNx{$UZ!K9TjyHMJy9;~Uz-u6eZQI&TZD93c9)=H5lfFBx?75d6OAf8}?>U?A8MtSS zH+ci6blq$<-cSsREH@ZpMoc0W*Qbe!RSFgFHzTEVJ)@zi+r4^xMwVc6h6i_#9ffP& z-(=vNdF|{J9gh|mh9-{Bff1HE^N_oT%%1pP42C`rS<20 zKIqZu?^t=*oa=W z?{$KfenfSQGbh z^1Xiiv;e-=ijUU%_9y_m-<5ktiF}@J zH@)_7$ya;Y>}ikXoGT={J1oCBxlPuXyStk19aR7ux=r-cGPd3-w0)O%Q_$vpE9%VB zQ;q%h-dp>b1;DR5AF(Q@^!l>C-jJIH{+svNF_e-y4Yl0p-chj?6PXipQ`4?%z7xmRv_AoVNC4(skFWihwyyGrJ0BJ3V! zF0f3%CS+~4<9wo}_cJ+lRYWWLH!>#jCDmV}*U-LjWul(*SeYYi4g%6)oDw$MA}Uo9 z0JAEU!kYD0O~;!_1iXt6$v7M->}G)auHWB%GMYE6&Bk6UZGqqz26L#I&t2b?xxBYi zxmm|oWOtP1C20YGOvu}BySH~+VR!H`RwdNLJ|v%R)=b6Pppr=xiU}l=?!P>H-p~U) z@9otR#5>SnW5y4>M~NOj;6%=s8)3R3(6v%;wBku7?Ow{3bjrITg~tQIydQ5tmy=hv z)}F%OxFkDj;E!^Kt6jx*dzkmQxM)6tZoI=4W;^V?HP*Fd zbnFH$y2QGa(c@ofb-m{9z2`T#F5?PHRS7IvPp8#(Fx(9^%)@gDXbu?qXH&e>c5PfH zoJ|s%U0Y95%`Ozo(%=z6|*AVGr%NzNFF%bapt8K|ZbR~S)6F@KXm?}zZeoxfYOisa+L`b43$gLgka5kXc` z!QcnJ09B=wRaPTJMlZ*xajPoswdw-NZ)h`kX1-l=k%?z$RpEfB|VRz$RpEx8C=otDAkf zV1odek+$D^yVK`>hVOR31Hdo==55<;+D(`Q%#F6&6*`D@^(yw{+|IY&?&k@2V_*>g z5p@T*qsm`Xj@qYP_l*ubzVqJgEsOZLBPtRaeLCwpNEF8|C#MI{Wc)<@oPmS_C&(_~M=4Ke}m|(PgqiScvl5JT+ zg;PG;Qd~(FH}7%Qb}}$lwrI`^wViyoT+)7CP4$-9^S!wBo_;5tpz3Ne$WD^xxwys^%XwwZ)rXV2{60#joyRQP<46|$2BygrF>wn`HLynL6xE_HR&=j*SB?L_$Z@7sSbzf%MC z5Jdr15k!j-%HPV#Av)%x4@FV~~B>uasw647Z;`aE!Hg5Dx*L1TVk;!gZ{>vPT5jemb!xP1FENEoDH03?t| zAdpC)L6`aY_$57Gw$k<9xah%riKMpvXh4ush&DC)k&F3<)W4g)!@QrwPBk&9tt(V% z;0!xePkG_kabUu4zW(#9@8c5{43H3FM*Vp2$L_hS_da~_=JC#ZPkhIm$oFpPL*k;9 zQcEAowxk&nSkgAZU#p${Qcd$7XMjv>!_c}>1(G3DWU*z1=Zp0}^=eCxJ#w#(=n z6jTUlgg_CtHVv>F8i@fQf=MUd6Yt0?pYP*;Z-Cb#TTtpkpdD*(+?8kvK>#EY+4>z|Z_03nGRjb^X0$@ZE4~QU=JL&oISk71Epv^Py zjban^QKCEFEqU+dud+&{zo7sm%_;(Qf^Z0Fh&6rdAD6TBZ72)JeO~?ZPv5<2>9zOk z`;T`1Aj|>?B!US9k@`B9uzkd#oqaN zyme~wm_&jIA_)Ya!QXt2Lz`xv-^WJ#@uesaeh^6{+htX+D>;ISYQJTh<#Uhc4{C8d z<gYCuCns0Q^c7y=73MYUM3O{65=Y;^oqYH2=dX^t z=;w{~t^L4HgjGdFDV}IKIdF4~52{BA-h1)Hvj=>iJKSv7x3?>u>pbS~ zyeAn?7SEkKEVbKl6FiT%Pg7gkTi7ey`;_l1o$KA+?B6!$qe$;--oqTdZzQ7NV5S+1 zfl4yjf~}SqVP-VsMU6#5&{jC(61j6Ya!EwWp^8Qv9CHZ*BPDPJz|23r{EhBTYu@u0 zi65Jg?F}C}r_8r~=Q8;DTiQ_yHN*JzUq4Mn@G#S_p8%0J$<&hw!i=Y0$j~h6nl4}m#aOMy_Dvo z4|G)Q@~XYu2bA_)z_Ge1xv{!+hs0=5aN!^=Uv^13j$_Aw)?xe=bwG|&pYd$IPZOLk2R@u zj7+FQF3ygVYU^*7y1XG)xLMkR4mwn8-NpADZn_BfXN=C!%Ti9Idju-Neq5`^iKL)a zmBw6MmR)5|gKntM+r}wwa8Z|$W4+qX0i(huj_KWxdvhy9(dhPyqu%r+bdr z+Iy-~5Qszv*nK_ha6ZiJ(K`EBE>#WZZ62jWo7@JxbP?3JYvv%8y`hXY%q)R^ zA*z>F&_WR;5=kr&#Id1S3<0pv2bUaXYg$?8F)!w@>b_>J4Enh0Q@%=%WBqSJMA1_|LH$B|@@4kn*ZuREpT*6iN zfFFbcNhFd9AcNqtEB1F$g0=3nlQS3X>Th^C?DnVP`_1)N%jfqfOh|+zc>QzFm#uU5 z{ zOH_qY!(a`AVALB0NrPb28wS7|1(L*QHVRFHVAwSPY#RlVO+m118iL7yHVG&JJd@#5rU`zA+z;&ac}L9Z}P^y|->K0`$jU@{O$1V^tM zobR8n?t1*~zc-y|PQIJhcb#Za`2|E(QBfkH&VFX+hg1WrKg0q<$;laf{{LqA_jO(G zb^HLp0zrQ1%jaIb_GcXHXB=7PufFlct~@UJ@f8>4RaFwGzT%pa%ujm2&k*BCo}LFr zf;DspXGgvwJV>v+A0mmUDu|e|B@-e5F+~Ig^Iw~g{IBb2EQ8}jX&&$~V$qUQexN@N z&;WoFF}?D=+F~}or;9vDk~+g0kbd9Fe*ZlBPZ)l!6rvD94I=&1*Nfjy`Q7;gj{Me# zt?!<>*CE{qhsv6&ilQhGkk7HWH1!9zq_e*_Dzbg&Tg&DA2`~ZzVLklu&)>hjuDbhm zqp73c9BkuGbFdGrRZ%h;FzAi@j!Jz=I-Cx9boTn5={eUNb*G-sj@x+VzW%?4gpgom zB3^F%MNaytAKRD10~Z1Mu|s0L-~jzTB$7$0vY@TWQ&sQi{3Ud3`*@yZ!!Sh=QcupZ@s?FG4FO_>&I^EmMA>JNnioYJ0Q2({7gD_qs1;gI;ww#0>}_hYAE%6v%KC$}GWi0$Ci9 zl4?pp#YU{ja~BGcB$03xqCztaWh(`Q!9ZLD#*C$`7{X*EDQook`e)twnZJLfxjFJ7 z;p3?X>f4vji2SU)UGFwH%UldygYIAnI53D`JDFt*&c=4HB#hv*Ix6Oc>RSol+g+Cw^LCuI zd%Jvfc(jtu^f~WDvui2F$88>uC{t{dt4{_O9*#}EsNc(iwn@D0-<2YM`s%anjvCat zR~0^D5M@rN504ZtBn2z$te-9PL|?k=(Q_BOF`rG&^zJoP>~wE|j`n zb8?3-zR}&D9*;TbL`&KC-szuAZ=)`J@?{e_owRP}3Xn(*w$p9B z0=Ogw+Vi(fvqo~dl@ki8LP@04u0pI3hU8$M0M?`Q5Q?~Kr+PDPBE8;~BvnpkJQAhk zlVRCj(&807%=Bqh)9G_db!rL%W~nPF?`GP2D}c znJ+plW=~DC;n8?;M0*~^05tN)G|rzIt+Cicqu8YE1D@HVwc@iA@GCs9I5J=c-SKNX zdsbjLO+LA~R+@^&!LgRO;GVJtiKr&V- zQXLDZP|!e`6AC?G?#aj_YOGORXrl-!q~VInv>ic>75i%Xte^&nTX3P-?`AJ}cmhWv zsFr4_Pt<-qhYfI_UEgB6; zP7kRmRbHb+>9V7yI5uxY02BaF21wRsA#sL4YcLTqRcS|xgIdK}Ekw*3vL-BuWo1q6 zi6t7$?UFTlNxrppvZQ1@Vmhs4feX|o&ogtuWT!G^%$OCH?&ZQJ=PydQ=tUOr!G>WK zLDW>lm0oq|RRa9WB-DY_Xir@Dw(gDg7-;)Wc)_mqrKYbuZQ=3V-QC7z?w5S`W*OS} z(*~2c;Na&o56C-x@_U;vklo%q``GC_>#;k#b~!iOo$I3K4_)J@Obbetk0yu#Bi*^3 z)~miP*G;0_3ow9$FSpCrpM8Aw=f8h^ckjF1-;3{u zyIWV{q#%e&swj#@2oGoL&$-X<}Im`OFG7O0c2j5t_M!416%EsGSVITddtaMfdHL?(L<$g)J$3i>jYsPn zR-b^w@*nnctiS9}Yf55m|k!a;rW74f5ZF1VjJ{HruN41{#I4 z%^bn(1NZ6%?mRmtA}XMeK_rktJ@t3z?b%wQy7zA3@%`1X5=igN<2vuZz7w^cpArcq71LV3%)02+*|oyU@B)Xk z6;w)yW+!os=t=YL0jtvIdhXWu=Dz=VujHUcNI)DD^Y^IrO25#Pf3Xk9Njm-?06_!v zl1VWW5c@eq9nU(%naI|F0~wEd`}+OXzUO?mU%hY5AR&;DAq0XH696^))BF4Hzkd3@ zciqNwzC3l^d+xtLCNRK+#2;j{7dT8@^Ryj2Zw5U_;2Ua)iYkJsuX*#F&7AA!zUA{; zLwt9y8hho=eea(0-?P$x3bxx;qQmb;y3qUGNuPOQ8JYFA(Kl29s1g+9g})R$bIa77 zZ+CaMJP7Q$hpX88++OY@4JqbJrxcQTB`Taif`AUHsnTo_CoL{+;BMlco1OOWvj?1f zFKg?S6>k}vyyoU&+oBom&v(7-_IWP$^5WW#=*PQrobiH~t2vb*OM(+P zCS+3BsHP>3P$4UnSS4c#4h4f?m{t&i84FHX3zlU}0V3e%dpq7-d)6m#>qWc1Zb1dh zFu?_Hd+9H=$G!Q_j=WAz_s!PsJo`r6-@5a9&dBRTl1<+pEcPFqQU;y`8qVb2c{g z;HXJPvSF`*O$=1!AvvH6)$f-!eiV0Bt0a zT-XsX=2@=Jb1h++oeA1S0LT)g$ZXW_2TR;2N|@)?cWj}Rc_Oi0RV?2+#m;vM%u4AD zt+AZP1-GZ(!>aF*XuoK&#i4RvJ(*$09|?mmD{k4n3dRaAW%b~03gdnQJ4&w6$zVB| zw9Ro1bI=163>BVKiX~Yl%%@Ar6YTWJqn3zKa1-6QB@@0Am{GbCkB& zo+;GZs$S7H zh1t(Lv}U<5hACAL6}#PQGg4)@ish7N<|%9ad%eN1yUWB#HwW4 z8XoTL+j`YaMK*?s980%m+YG~Y*InCntnVa#Qf}JunVA_Lmq1L>5RKKq(K2GZu8F}E zI3n=bDzw@nA1GwVK@;A$=GSus5JiAN01pfnH@5tLLLU*kw)5Rt+cKt~PmY}Tqtyia zdvAHp>vaDz7aNE0#u-&67B=f(RjdG@_(Qd2UQ z3Y3u`9nYB|5CAuT7mo5XGB-0OX2iR?Be|x)37G)7`XW=mFM_Ksb9M-9G!tB~RMQW} zVirV$)W9U4VMQEL#QR=lQB%O1u;0TyzrTJQpD%B9`S?bvxG%O40g#8tP9HkMOiwr~ zZKi$SZodbd{X^rHQS@YA&vwr~_(z1-AxuNay|$^CpFeZ+c=`FcG8+E%$kE9PtAl> zVO$~kh=Q~|;K*+ zY8pYi2o)P)BvA|(R3UzDI*p1^hK80Jyop4dAd-AbTT5v*sj?9_1CJnN0pU_ty^9dvpOx05`q2GolR<(}$(rNE*9j=2t zsK2ipt7iGB^il+nVI^17)8Bq`o!@V}*Ltq_!tj3d)kRS;K0d?p&ELj)(UZFB?Ki^= zfnSPFM>Y4qZJ#{zq+gI#6%f@l#D!#xB^IF~#e-J_76Yrc&G1yeL1H>jxru za(sOKtlL}q2yGz%Ok2wFJi?Jp_{95c-zGj-)P6(VKZ@0I!O&O5FSz@)X#zS*^y?A`SclYJFU!;^0 z1Tc;F*S|j3zb?LW=f8K8_nu#vh6Ju;${>aeuqVDvF1*vHN_ocf-F3&d9}*Y=05J={ z8_!qoJiT|*zJ2_?aqoNF9CMi)?nMLRHB(edfd>|{ywt;tCed2r%}p5m`f2v^*r|E@ z=X38~`uo!B^lY@iWFXQBNl6I-qZlxg7=gF%zJFZayYJ`kkDT-8*XzQx0xbj+0(n`k zIcCPTS1Pe!kDTcZ#lAJI0nFR;3*UF}>ZT-wAc7&&yYIgH_4oHa{psV?<>SMA@qVNN z0Iw8NQ!?XjIE3s?9j=AVjA5F?Pf5+!w?~H|pE~_r3P_BAK|tMo^Vh$94l3evoul8J z>$XsW{vV#x;z=ZuNhBCNc6`&J_uT`doN;za;pztQ)?(wlT-@HedA@hoJL}J{mj=NI z0Rke|zdjv%uTJ&PE$(-%X0_qT2q(iJr~n$Z;>?S9*DCj&v}yK0kHkJ$ssF+joI$&jmX{s5t_mm{dCvBmy2rD+-lKcFIObPet+I5`4>gqaf9wPb{jxFpyLE;vN72qckYFwK!a?1+#^f51W{ zojQ_~s;Ux6Qqqkqw4A*KSXe=Wmlswn+(IQPMTi+C`@n%cWl5~FJ+G*`Y<;Wl= z%kJWB`_MqM%xAe$$eSm#MYB4WA&pTFijIRh4_Ar^)|9nC*ISb-%%@YdlfgOFo{~|z z(2COJ3Vm;=)l`8fG@(`ZeS$ZB;b0xJ6i~{?Eq_*XHkR3kRg@konx>AVTJ|!`=aV*d zY+<7V(aRca3QO{o>sjbCI`gto>uWrB)_@v5nQunFc3ocpu7i-ZH8p!%-+#)!i`<#D zRK6X0dDf_~SO4u{SD@hc38Z3r9d6<D|N%hEKC1DIxu%xG{dw*33?-^# zrGJ*^B1~a)W`xX|L}e2O+` z{XV_EIyhu^dhkVB;hNF5t&3{{7@_VftKb_7-Z)>9RAYJ$2ItkerbEcHxklMQOf>9rV2jtnX6Xk5$#)olh+FD zlA(11B3Iy$v#+Smfu)5IjcnRb3GUvWncPcpT1n56$cro0w&&9<@7=j9yqL?+a$LZ@ z6%!g<4|K)5o{9?;TpDtlefh%a&nxKIEk)ds8j#SVJVw@mtLDd@!8>$quJ)kr@dZjQ zB*%`PT(Oo#!MC)sR`U&|yU0DPacdVePm3)@`zQp>q4h4*|8P6$8flQ%z7-6C+cd-@yFcOA}>?_h+?Jv(EN5T$-@mp@a0+f24 z4m#}d4+KOV*D_yd+W9-Gm#0@K>OE?zwcF}%kQ`b+vVivq*ZFG{W%^Wh4!5hM_&Vf4 zY&7)p3X)dga6_%#Pun8CqDgpf zzME}Ly!`r)3GBO^L(9hsi_D|nzBI@IF4$jm(}q^_s?O&`=S79a1>howXY^zuHtW{<*{ zqq;OxshD22{Telb-@ZW`XH!N2EGYNnx#XO#_RJ0Vv1JvGD|SoUb#4h!ez?u*pa@>F z_`dJn+*==CH+>V<{VS?E(pB~6CzYWKfwHf;S@vbP%U9m%2t&M-$? zhi66T9I2Iv;V#yQ6jZpzX~~gCf^REt2Wc?_U8q`%H%T36w<~=;lkJKjV{G@-N8`AO zq4E`)U>HbgFIcHiLI=LD&eGmoN*tc7tV}6P9(jure?C!7Fhg>yjM=uZDdi4KpONN| zNqIj;cZx;(D)ZX!u4KmVj+=Rt78q5XhN2O9Wee?^-L?(I{$*bguxr-B(E=F~tIFr}EH6(hDS~n3;=K z$5?Wg8D zD{H^!Rc>%@__uDGLf~+aa!~HaH*aA+RSQ7ACgp1)*_TfsxqBT_{Z0fmLz*z zom|920~Q@k+ZOwyDrT_Ca)SDXTftj`lwsNwO{BGL|`WJBGA^2 zW3S1yc?LMoh%Hnfj%GeFuB(aR;YR?sa^SCk89J`OmhsoNM)Xb$K42 z)*~IMP}vQADY_J2!e$y=nhR;|zXc9=gTfnA&!%5;iSZhP3k!bFDN(u57v31>D0-oLRg&(OW^RJ(ZJC%1#7(c*17}@q8+gSG*OCDf2sTI`9 zmrI{btP+uFHP4~VY6@WY?%YvNN?g#M2Y0E{X+5<74T{bSuB)n#6|7%!eIx&TwUSh~ zX<(o)6H+wyR+<{;a*A3YREVXGXK;q@#CNjM#~J!BNLXB>dK?@Yk5XYV>{dW|Z@>2i z7^h;0bH-HwPx4rgcxZTjEutlW?XiV=9n32z*-ayDSGSeN;&@SRT{IJh>)R0QWDDvz zviF1fga|{Psg;U}53u$da&#E1i*_7-v@Q}&KISMY3PWmsFj!R1-)xK|bSI*6eDVXg zV|d@&c;l}v&qOR~@6I)S@N~2~#(Q~dL?7Pj>%6dDW_~#bb7t~5*l1Md9g98}njTa? z==%W>s9iZLzu&r9@e}Z$&v+P&f5ZLV2gG*+|I2>{;9o=m zq#6X^|NkPwnZF%8oTni`v`q^1*BQk>S^s~|KjnY`Gy)_u|KCaz>WlvC8X@RkJ~YB$ z5I|{y&m)n0Q5h(|5V(63i&@eA;fRG3CJJ>0Wttt zQZu4$W+wj@97yq3%}Dv2n4a~sDMKy?S9i+^mAOzth z|Dykrf5I7xzhlk#YhDlNZ;Aiy0UyJE3JT2lPpAL$6CmKP2>&X@e?t@ieCF|X3IY(S zgR<}|gC+3dcn1E5=l%CYHTZv(_}@$Y53Xbof~XDuo%Hbp`nO#Cl`A}<@%kq;7zW|5 z;O{M}K`Qhhz5s-Hb0@^}@I*EEUu)sN)Ysoq|6d2Zw(vnR5bB`6rTz|105Si^JTd*R zf0)o|z4{UI$B#d0YadtIWiU=!esh1u`6o?xHVv3dIhC=LpQLZh;3%scI9UZ}akJm} zw!n52#AWciIvsYP+pBTyoXN-mGT?5K{_M7UK_6Z|Lcel=LO$CQG5Rh`pvGx*Vfk!d zf$W*ruEM5Z)w4P=h_r^I@q~UAhn<}-dFhg6$av-F@7nhh&@iF7+X91ywI{(NH7|F+ zPy>;E+8RI}O`qy#M>@)`Od(;1Y^d@$C|Bgv;g11@>hEZ`*rajyXUD61d3ky+EhZo~bsBg#VwK@rC=Xig=0KcyAL!j8oLT*IT~ zKIO@;0O=jU$;7$@Qi_G7tZ^({twWvzG2ro~sf>94Lj>A#2+xyrv{dPJkI-OdU)tvuwFz%TBPc>3ZJ1J)$>s&MHV?HDJrI6*1E8mr&|r#DoU^fV@CQU zP5*n>Ff!EGLH00v^b$>*sP(h;kH*|aQR=c63WTLa0uO~zAE_?NbmAY&%q7KK)txt> z*!>301Ra~y3Vt6o4)rLLX>c=+NMW?wBzQ-~6q!rb9DT++>~8=);c_ivSeH$bd>gf> ztcj@#%Lh%bz=el5w^aM(=>%6iT{K4r&m2_m_y`we3QImAt+xDVFm@H54CGIKSKoA^ z;Z0lR|72KWA$~lmH4zE2g9N!1=cvz7Sslq8euMFB_vKMfbv$nB`T4Zpys&QH$5AEL zH^}n1K4Wpko0U2Ypjn!GOfW*2+gobG#AhN9QuBp%H>EAA zuvf z*uZL3XRCU*NaO@|p^7GC{Eg&E^01}@$3_imQ{JmxI@FM@4G+|u7Zi1)aLIeg2dKGZ zvY*V_owRCW(8@->H{z}zreK|3GET~&XSW=9&CW&hXy;TSeEk(w*-PCK7Od2^#cv03 z56v(unbU8&r1Oz?!&)T2*~2}`z7^bCBNcx99@wHRI0nDm*;Z?I=o#kKuvZqStE_RxnA>BGXS$D>zv7gza_MpbcYSU*kH1#A&MAk`;(DQ z>mR?V5nKLoMW^MDZx~L=pM3at^n|_qU zi2Sj`{rZlF!3Zz0gGWf;QU|{KNv@go`z|>m9M2x62bR$T|Ln%I7swI5c>MHlczuDzVpBWni9paxH*~pk#ho6fubEx#sJlw)nc1jGA*c z002m!Q$hmppo$_bC^0PokPT5o$d=|aNOtoX)yxG|cG!rb{%TaI31a{?0R*M$HRhyg zrXWG0uqdLkC`wY$iU}czFm~Ug$-2(bP=<4RqpA2Cvzq;d$J(UN*fSj)qs@z)a+}3Y z_b5V|wMD@QK+$P~h;Sb{SCZws$MTK1eERggUdN*C?wj?)mcf+py`+d@Ojl~p)>0fi z!h2-=wEKt*#OxCGHCtEg?wIP*=jS$2C4jJ>On=9{DAtD3{4or(dlWP$Qj98I3%}{N zTa&w;!-gK7^%VJ{qo`<(Uz&iF>MrD?FQXV63ls{D(~Tjz=l2mhtb(7VEsY#F@pnHH@WFHqsJ^O zti2IH_XA%ED!a#k#~=bV{9w5UU>{$3e-QzQdgpJ?e>#v-MXBfl*oc?_gf9V<#iU-4 z=j4L~QXWghY{iCbLh7$esG&;8dx2CwQtUT&6$#KkpWnS8zXx`P010Hq!up^TT= zG8?IObXCm>u@E_rU?nd;g=F zPJ3Q_@~*y z?YWC}E*_AM&h^#s+rw?$6-Fz`&ZG{~vKE^(kCqM>*y}XyF;D7h#7ae3OT{8kO?_TQ z@O5^j@cfidtZQeXIrF3~b;+zPbq$PN(?=``#+|GyoYr9382;z|+V>A1|8W2Q+dtB8 zFdLsf20CnMeb0;!rZLZ^$RP6)Y}~0Zr7b$^C6<~EJN$7}xH`wSrYzky%jq3~y(v&8 zLeO%P0W{ENe0KCy5GIA0hJ#O$gw%L6M(xI~fqKyI z)EWghg-5S`&K7a@9d;MJurb}Q>n5C@0Gi1MudEh%T)hAcof!!#-b`*c*QUO6gFNiz z&mVIjBp*=OQ6adxB8soQUGtBiCM$!!6Kxx@J)=GvxGXv0gB(OD)7?jj+kKS(%t7=x zLHXIUcxwl@@4Yudp#n$vfl<5uG-8soC(1GzmDJqIfJXD0?7(=c6EonMZO9f;|C%O) z8h%bCnJ{6^R^xNGp5l;-MqPzZEOb(WlfPJKW)SM>7F+W1Qjkd?z#m}HV;eqyrB`>> zjT8i7RzIpV_|tco9dBZ4w=ZA?mK{AkZ|aS7*4k-fX40>Ga)Q!hc!-zDD(NyRyn@3vz48mSIa} zJzW^~;3-F)WYU|2@2Vj#a-q&(hDLp6#>84ZZiJ|%F=&!C{m?ZdVaS$(kXxPD6~aqC zt;6rzk}TRyC&BH=;3#g(k?S`xPV;^L3YjHM9inP7;?zp_9<$>iBE&PXD_RFS8sHzw$tz9TiXVH-i%%;jSDBClsalc z2!N0BS&0A?aq)3n@5B&r1+Wm?;HwY_p&GX6rN&w!xpSb`%;Sw5!n zD7M%~NuZ3HCx+8QDRvS-Z3DdGyp*3KGhr1%yw^3M&xemHxmG229x0Z;JS$h@;gKEy z2^eJzvkJV^zfkkJn>GK#!DyT5Fc{l=f;37l5_bsiSZIFKG)#c=e_XzN^{(pdB&>hPcIvE+akpaw1mS0(AV#Sh^q%2)@eT9Coi%$)r zr^~6TUVZkXNB&kb$l4XIzfka&_K)M$gcdrWy^xkEn_vEE^>0dE-$|PEAh^gz?!=X6(}RjI6Yk54Jk!Eu@sALGZd9 zHHUkFk?8#XHD@(PCD(1Hf8vD_qYl_QP=N+5=PSKXoGjKlq1ZS$+u+pGM%4zHP2k52 z1?AXN(%4hhu|ljoAI2T<_4b}F=NFG-pRzm&=$7VaEwR?`}mBc9rH)Z)?|s-RZz`*V)5Kjh@+&?1 zz{=PQ4)MS~VyLrCFilH{IF0Y@tcqNoixX3d$O;XO-f7em>oL2oqTm_&Hy4 zq&^Z`Jo=MulZLP)l<6F-#1T0xx2lguTdGgd_4o8ZRl8PwOOyr#@4jDWggZ z6c!Egf_@fMVB`B)mf-TtR_zef*-DP*Bg^1g)f24sJSTUD)DMK-)X56O{N~9_oVXkW zlDYau$}6qN19E~rL+3@jQPRDbeR)@9a%i*%UJ_HSi482pB-4NXU1TKbRhV^_ABV4@ zKF5!8ewhbkk2(v(ZTQF5ta^hj58vq89@F7CF1>tvuaK-|hX{%HuPF z<(bO&ZKqCKs?Ce{fQ+%gAS3|Nvq~li%9NI}mMUOXS}Lpi`rDgE)%+gxTVqnjf`_|| z$-By5rYa~tAH`ug3S2t(-6+0p|L~IzzCsk*xF)~#l*$C_%OEy<2R7ar&P*PCF#Pf3 zmS0a~HB8hN-U6?i$iqev4d%9D$qTW4oU5$@o!79P}$1$+x=n-~UgD>|LWo<4FO617cm#ptIn<>W{Gceo56!aspN)`{NDgAPV#peam)CQj8Od-OC`xY8Lb@QpcJpys(rPN zabWJxqwAiO7G2VEkiFYJ>7asAh`oHqY)9F;!1-k7_Icz9k|;g#qu=n-X6E$bED$N*72;I^BS$)gX~7N@ZnOEim^$w+ z1iZEzY$#;WAPnE={(5lR8EF~NFK9j zjE{xRLxRND`ipDO$T$7;XSKWm_<59uQTX^dvDlRn=Tndb63AqQIODS=tzY71pmgO4 zc7vp@+RZ!(-dxrKGTYRTJa7|OSjSTEjbG$9<6y#`2kZw_nVw92-IB5teAiQw8mK}7 zrs`E%I=83DSEER~mMqB?AEH3X~)+ zd=q35L2QO!Vg~}?zxz;K0jSRcFpdCVE+5{wC{^)xHb_la=m|umqDN%o|2BcYl!Qmf z@s)=M=>Y%_6EJ@GB5mMJ4$mJ1;LT`|gI#Ts2_AA8H+&Ccv#}@4T4Z!}>W}bbnh&fAY_+0ww@v=^Qjl(dBd0ggBVwy4kS|*T^deB+TssmY) z?k}|vmpKQ}L{>OT7X)RJqP4op)tJ(+{F`^u^+_YP?_Pfw3?rQHKlgftWsva*6gcY?M8OXk-(!RjcrNf)K>>DJNp6(^4__oN~rgY9Zn^fI5X`j?zl1aw#Yk*>t zK2cpSf0G^S)~)ZhQ5SJ&N9{qd6y4X#oPbu(*s5GVHaTN^L0OkGs1MNBcA0+$l~-#~ zrDPf6C_rdQQ}!jOA+FE6wlgqH>QjI~9sNl_XRMQ0+3&P+>)HoRn)O5D=Y43iU%AkA zGo4?si%61P(61l%%@f^ugmjbjK&Ew5ptZ^+ZE{SW$&tx)5Tl9cevr8qFMJ;;7Lo5 z%nYWdwlLx9NdGjIv)RL>cU;n7EG1AuIt(Ygnf9ym>0*&v>+QRQK)>BTKy5cN<5+oy=q%b#E9a@PbDzrK!79t77iC}AFSC@l?m8Pxco|Ue(CtH)boHXkU*VS99 zZWfjc*5SMrpQ|?szjwv*IF4DPb8LJ&53~|meSHj6EerA>j?>K%BGs*T&8mu?$JTA6 z)3qg{T^;(KV_p4{cD?=RKJwN3;O<)+!Gbku|JWyqlBXGm&dQ!aMOzLI56EL0()OL? zM(f+M1v@?pnpLMZpxWNFy&Y_AWpwBx{fXa1>^}FX81>Gyi>m5Le$|;+_gzDoNLsA`z>RnZbuPE>>3bDXs=bn=j0f_=H@>XBO-42H1ze3hMTdwpDP>CLvG_fa1H{+l1r7>U}R z(=ZV0t?gBJljEs}_jv9g;qAL5AD;$$@2wkI)$|eZD0b((zIpKw3Ep{|GH2R_5{~4% z_yCxQaw&rP-1`~g$QxCxWZXW5+=)VJy-MD6zhD(~bV?BPAa}fN)Rt+THdlJGB-gnf z`qs-;DTRl3Hu<7&6H(?o+#uxcPPq}*)Ku?c>(GKQc-SRQY$E%X^0dj&w=?`}_($`~ zWBv#J8!Vh8SXASW!}gy?Vq6nd845JIc6Lcb^)sPDtTDcaTXOhy(?Ru;R1Su;e2RQ` z5@*yygRh4(O^>Is%J%hgRr*%Hc-*B}{ZC0P2dt*m&PnQ~l#>Dsz zWA;$2^5TwFNpnRT-Pc$P1!N*Au;^UY7Cv8Gm@tcM{~5F9J>APX>Hp*hmN1Xq6GeGA zbJn<)lHgdV?%+Ul0cBsW?fsJUN^E7Z&8s!7EHOy&71jJyP{rG(_s!w(Jl?9e^YM_| zDg(MY+ZT|K#-P^^2^5FQNzI2MHB-md=S0V>N)j08H!(b@vnStG;e~p^_fojxA2NZ0 z6-}lQ_(#Rjf{+Olmw3$&B$4QfGNzC1o9}Uld6xoj*i~!KotKK0g0BlZN?Z42f)$*iWU|(=RP6@_vC4U1{8q zP;fRpNx}Ip;47pEH5v`bZLcj<>gXxjLJd`5dyJkX$zbew4b5x#fN+`Znu$r$+%CfDc8___KoWf;L&IyxjemOktUzqYn zVf+60k3(KL760>yH&69d#AO&^$-YSAnFyy?PcOCQgXY%${=AD@2QHdHXO!mh$7bu2Yl4MaSRLId zML*leI+?QPpJ}P#zWFCczvE={G_r;{b0FxTE)54_o%VN+*&VJ%UXgs(oMr{!4D~K& z*c9Vx*#eeRwk&!_m2N0;Dv6cpjXKDU!?fdDTFA8)Zf}LlLjw*s2}|r!Sp$cOR0$2*G5s5aR5!Ea_OV*|9;omEhnj+Xjw)+Gqu=4NACwSfsmw~~m zM1ZST6fG_}zi?4+ToHZ|KS~*rZj0D9iCA-Z-$FzCf-0#rk<|6Rx&}1w%IGS?IgVUb z?&aPJHhdjVXL2o(wLYD0yBDKiVmkp08gFT#!FuZxn|6z;ti7lT{!XgAt!z5cE;6=7EZ$|V+;PgE$K;<$tVuhftsHvWz5!X1Cq7-7#*Ehv|8EW$g z#~mJXO_ix0UA9?y8A@FM=8MX6EwV#{`DGEn2@l<%jShQV`h3cw(qK`)L^0;K*P*k0 zhPeT`P{+5_&WxSDh6^UXv&e2nAqNL=-1HP;w4k;VHoF;z!!sFPe8o(@lWzlAf6$(E zqt(4TO8WZni_hrvKjezf+^cU}HhQN&+VK~FFMfF_BhAj5MT{6L6;H6tugSLYtZY;^ zJs}>Q(215-zgFS;8m^oj!R{&t8dP3aEmIrkqp!GxFoTJz4-d^6Ztqj=cQYW2Ca3s8 zYw{LmGfqYL<^DEv6kE`hs# zaByLmpKr#-Z174~Ij!$kB{+OE32;TUZdB8S5;2#L3|@!YPHE)>odkz^vVa0Xw4tzuM7g`yQ%LdFhX6wTGZgmc zymf+o`But)4<%WIT+q+9d~x~r3(T**uDEN=di&5Nmy#&)<%iz*X6fbt&4`z60|5{!wR1Gf1dJ}P}z~DFzU>Opra0wT3jb32zDAg zdkfpN8@kI13uJX(`?b5Q+DmaBp!0P<5uC0B!sQJbrsNLu1=D)kf}j^~vx2PdqX?D- z>B*D4$_v&a?cwh3k++`|apxK{%7ptuOEWnYOI0#1wfd+;v6Kh*_0!F1y!kDJ-Z}RnI9NqbtDXjUVisi$ zH!6K$4|LD;M7H|*hw0a98yyI_(W$l5c|86}tp@RGmrg4!>D$|nx)WA?Vk2}C`yI)X zHcL_6Q!Gu=++4Bi)^&E<&?(SW$0l}tw7!+MP$>fOko7_IMJYz6g**i~>G1$-bBr6@ zjnhJan$?o^-ur5y{L{?fL6=P`+0`a~f=U`I6;Ush>ywRjg$$Z(85~9|m@V|!lP(-A zTw}n%>_+i^)KW`e!0Nv03aW6RGT;D`^OU!BJ_oV?fnvm~G}b`Yld5hi^B)J75rYwf zw2sJjxDGrgh2FJChTxLm9p&jan9Wc9@qzCFNb|m{9}u`b#2qfBIKXw^r?OjqbQ_?+ zESY~JO67jM86Ri0tVWe;mrW@!Y+jN6;`sK?i#>J+>QQMHyS52r|- z)I>(vLty)?T()N@1N530Jx7*Qy3O!)9fPZz%M5^=Jl*9;c06t-4~S`?NjuGPmU(h* zO`PjNHKGJ&)Qh;iDr0)$IP=&z)|BblNUX_N1t)guN;FWLQc|hgpvh zFHXVWS6FHKv&M=oA3?>PMn9jsB$cNmBx7Nj&N1vwP_|o$F2=_+T{roD;OE@uGP*)+ zG`|Ay?sP=nVrNUOq_rX|i1r1LPDcxaUFEk!;6ZsURzGh^hdf}3CWHE}9?Qu)PlbsZ z^Z*NJvR?Z(tT?-Y`Hg8KHoWl<+9X?E$r%JKK!$0y?_fdfVknkQRY^%8cz`Z6V)#D6 z5WDqP33~>J)M{Cted&MQ9}l2SBE7NW=WVEUF-CGRM(TLna9vU6!nRMRBo7V0lF{Jq z?mlWs!{L#ap#&&HWre4tc*ywuDFJVB_Shivhb|8VA+zXJ(TKrNiqp;N2xuB}60!#+ zM~yU32Xkg-ae(m8*V%}iTdf?V5?4)YO}WU z+>jm_k-B(@S#x&e zs64#z>%lJ@E%`25+7@V-oX2m-Mh=MnOfE^M!Dt|*N(Wi>mY)0V=A+^Raj*z{+lG>2 z1#eR%N9lG5p5nxb)rg8w1&9~{3oW@o&)H+4zPO>?-Q8mu`%jh% zmnLLs1=mWT7n-cLc~n(W?nQHeq%DA$v1PzN$aZW`<>po9AaQm*duv?FsP0B$~l}KY-qCcY`$|o0zDd~qidEo$} zk@A$zA@Otj4Tp5#aUk5=ade$N{&*c`kwp{K3}N*{fk4 zp$OE#fkI|>Cv+&EU;tr`5cBh+XfWCAzh?uA8(aP_1`@V%xi+`Ui=KX5-^wjk3vF?c6k>bIpSIFpjJZ>f_ z8S&GR2HT6-jWRLphQH6))^5MJ-Us#`Age2_n)(WBt{^Gy+<}qFx_4LMo8{??%K{5P zB=NWD8wQ7uxjqPTxA_@|Anf{8%XICTGj{VU8sS4SBtsKVlU(>UQgXi|E`{}0VN&RG znu&|6-c-N?Kqvvl^Oh0dII%S_mWRjQyplWf7cgRF~DRGdmB@|WZZgf`9t(66bqi4&drG2yzy5c;{ zto(L5DvUkc4c7H(5h#tojW&3Y<4{Cf;ri7Z@8nykZ}D6HMlh|sxcm62Z)rt=>PjaC z6LF!O;}`-w;)BECcFAQpT;3Yr_yl=iU?kB66~&v@QpNCdx2VEr3+tqPiTiVgT?k<;qhBlptfv_oX-}! z89aoF-;Dy8cial*zH)U%SkYWcOOMAq$`IoBZKBScDUkN+Kr^BEQjom)t;fpKw<~?) z5)RX4jLncGSH(_kE2SM0Zd$U-P_z3~8RnI61EQ`Z;&0?ZQ-(~Ug7C%DSZZ~Nlt*2W zvIR2XHN|a-fi9AU%S!8p7Y*{94C(C0L3&hoB&+e%6B@AXpjunhGr0e--&3K4)7cel zo%pHQoj`7L0$HbMPN***Q);lJ0i!x+PNtr0x4=R1_q0)gdtPHp#8=Oi+GCoO~v@7-XYHBqKk#CPs(2neswB^hkSM7pX9$m zc|%V*n(f~OPL}HoVa97iYWUkaY*F%Z4@s>B`F!IgGW={?-Jm?_<5bg(%@2sZ?(9aAYm!tI!hSmigQU?3f8rU3dNLF*EZ>!Q(7M8wTv zzXjYMz57M=rLo$|7K?=EP}(w5eI?6Jl9qt{$*J;m8l7txf{OlxWdV7pslF%UWir_( zzumVz(y%qKnYvb+go??{^ovkTtp=v;^WWn~oa@N}#?cHvE|$&9M?Oa;IkM)*nN7+n zb!n-%?1riO^{sXLRX4^^t-@iqtm>|Bc;raGV-Kni*Hui44X`o=0iWc;ybc?i&zguL zU

    h+_aMo;$v?Ev>tb+hre$5(ZPF>jnYN*-Jlserx&FTP*v*x9w- z{Hj+wGmT~z*$)D!S4r`_5xVHtn^tjSt(%Pa`zxTd)Q!EP29lL*d+sgD)Tuw zR>a-G&|E&mXR3&eqgJ_4~i4Zf*1Vsmk$>-^ zp4!+VzFX0nZnQ%U1-uoEWWsRQ82_c~_RrY%*^Rv91*QB)eluoCg3)xgu1g6^*Q1}U zAIUA-b)+->qT*mpn!34gNpL1FadB`8;Rgpiik|5Ti>Mzm#c@<(?`odc^q7G>^&DC?uEX^E!Owr#0G41wP6koW*!E;Pjj+zwyBmD_A z>}_Ed42o$ezMTn8)YuD{M_2_*kwhSm*SnRLxpw+1shr`4FXAYq?{D| z2URXD7B=Li?WmWhECZvMJ`U1vD6+2=VIxUxK184*j2e2jVt5BZPg{GoVPFK#fH7?* zC!+Q}!%BC~hpMiww!pE&rFbkZHBWMO!g332U$(xE0KY(AQyn~UfbU91SLPi{fyqKJyM%~BS|$gfmHCl z-adDq2ypF@YyPG5{U)2|nV&(H0opMX>p`$w*#@@bWfAxC;H?TCr( zpO;BVlhcj@Qon6_cCmH%`jyMe2Rc74$-PkaQ`XA7k|enK!Ja9nQw4_};=aF$*qmhv zGwCG?a3~rSd%0xwY4eZ!zU%#ID2iv)*0Ub=dn=~BW32P!3^p1zQQ#@?U>l|a`yhB9 zkMK+F2{D`esxDsKbu0CI3xT4G^|cM+^{5ai0CwsAezxZYEUnz)VE+Q@I+GPy0-z|* zZv24)UaXq8$-y?Q&A_B_9F1D!$rB&hy1yIF&a|t0?&k%k$V(^H%zNrsofWjQW=UE0 zF%!tnOqRqMAQ7Y_#xR{s_txu6DLTy!Ki3G%t0a7J$lmBm?maFvX7@i;kxZLG7nT-n z^dNhE0RR_>&s48GbQ^c?^mWuVRO&gC$^K6sDw9QO#LNE60c`Jsx9V9^25%KPx6mj& z(s=W?PoBLPyO=B~Fo`jhy)=n>DpE?9`-+)1RVjk`E^W3);^MOZkaevUhsCBa!gTUG z!w=O0h&T|}LdYyBy|GcQ^mi=RXNqp$ti`9kNXiD3$#|OikjPoK>gVH!GQzqg^$~)? zZu;HF3o~f+voM1^>MUd!vJH=UQOkeDdG(P&s`d^#0ZBI~L}4-MiN)V=Cg_0~s~WQ4 z?BSL*{i>=6fxdv0SbAp&nch1XIsK4*zPv0OQSbO(P_|oGA)ugi z5)=UeDB%$p z7AQ3FdNb}hOy;mdd0r^_jg{~;CPz}`u+zR(B6mfjc{K&p@CF6Z#knjy8e-gD9Fk-c zR|pk;BzJd?H{1d4r5qa2>c{oD?3%>368IkVZJntuw4%X!8Sg2{F*3 zo@M0PL-zdUos=5KJ>bYg6@21zbG^*eIFec*M9#_8ch*OFTDUVd*s&04`}MV%RHb4- zFpqg*FuK#XhSjN1ss%5Nv$L~@IR&%Z=NHs8R8Y#1kY0eIh_`!&D0>ODQcN`IkOUU9 z#vNd>0G}~nlMt1Nhe|&Q;U<-m-uv&{|A)c-di&`jP> z4=5!iSCiR`1~8F0=~Mt~kb?;%Kv9u`bo{_L1edF_h9ZIA_osquKbETMZ~@p6ck=&J zH}x)>r$f;`^)=~Q^N^r*njicC1+vaHl+?eJg?}p_ss(mXQG(6?4`QG02Z8XB7y$Q5 z0c0eEJmz0U1pvT9GC|xc!PQZECDx<=wC+Dd3@9oU{ck-Ye*=O^bPZDLEy+^5pq>BC zHUN+l2*)y8{BK}gc`$!#Xy<=*kMyjvf)SWgi_c4a%}+)mTliAwlmhT1OMStkUsKXZ~x!S4-%6B@GpNvT4+)>cn1O7chAas%(Fl12u{KKf`Az+B#AM& zu_v^137`T8F+}5_GswV_`q6}yf-wZsXHPf?0tb_Ns;uuq>M8V+B|DBJ(oW_={V(^4 z1wj5Ek_H*7Y0}Y!p&jmU$Ayd}?<2)ijSKFV`yZOjY3EI-2+++^>_XITx%rZ)W5Q^L zb`>1y)qmf}Nbz?4Bx=aNhe+gq8{%Ipjp)!({nYVDhyKzJ%c>^mkGOtbD_Xv2X&iy zKz?{h5C*badL|&STZqm8+;A`L|F@O|S_Bl2$p7~x$w~-B9wN9if)geb`rZ;7nn#KS zsY4~!*HRmJjsO5)Fa$#O)rdgV$9hPIueaO4Z?W1))Kw4M~+VEkX}R4KqrIWgD{|Zf?4p3R_&3CTL&S@}RlxKkti@YTxURN)~ z;|r?h&FT>-%y@(*;3sY&bUP}j_`Hdd5yV8P&txFaY`{!!BGj{erzCV+b6?{S;N(D5 ze)?kD1Yg~Kty}Y0%&39iU(&lIqiL|;GQ#V7kh`eM(TN2o?0X(2{n;MR*RKUFKFItR z)&LesL+~2GcL5-3@9t|=VMKfs&dkRLD8h~p*Gq?x9_x7nYi6!21MV9F?RxUK5JsOeV|d^e%6m4^t3!WsR$lzvC&Y*LwQP zV@6a&(=L?HUGaLPE^p7;8tV<_FH|Qr6uVQ^59Px0asnFZzV1#0W=&L}^clChng?P@ z{Ceh(A$-tVl^$Ipi1>(wt^goigH@zskBaYy?|n{r&J(nHb^+Ql5fBcZT3;Iao%A9A+SmUBODJFpFD&?oQsanAAYFL@may@3pQLvp=J(`4;4G=R22wmB#0W$YuG3(po00e;8m`UmN8<0DfTK@Vi;r2b72U(LCYF99%bQpLin|Y-ff!S zXKObI{0==)wa3gitEq+e&kN@6M45Vop&&w85o8qN>!svbKSX0z3#(+_y+*Nn_vFj$$vbs9Vz}^Y zPeOvej0Vy*C?DdtgSDD5t|l*jrH4@1MZ6)*Z+*e8MUiA~m3|!Y0p@x34g*v(cHI&y zr=C6z%#Qr3S~rJ5!@Pyo_|7r}c=5|wqH!5oyAaDBUq9c(@P1pK{xjL68{w$R7-r&Q zr~+f?l;&~wF@IcKxp(!gUu!*>eTHzNMyH;Zha?hC0I~f1v03!iVzM!I7jPrw)_9l& zp5R#!p{c2PiFvf@h}ky{j|;?~<&%`-VeT3>$e%N{GqwHGQ3;T>tiyDuigGPFX74rN z$#V@m7jE(Sol1nli?1nCuvr(9s4guE?b{F;3E$dT8JCGH^JGa#k0gfgQiX81m?V%b z<|j^Fw_bnLJ*wCiA&gY*8CXoj6R;yy=7o7nXKJ8WQ?o1!Q0NeVoIgb93mHc(*e0}% zHtW4^psd_@qgX_;+wwcuJ`v1AP{@XhXLNiC8M6TF&fP}eGN>Pz%}|TKIZS( zuTo>-D$fP|MQ16a5XCqF>iWuTlKYM+NGF7>9C*>R+SZ14wVy#*BV5m(NIj?(F-v-a zvGdAQ(8A*rwG0WXF>(f(V^WFIqQYY|8Wl!q`zx*1m=g8Qx|=U9ek=r+p&ScQ^4II4 z@(O0X%YZFX_mZ28%viap>#eM7L2xU$Q_+NDXB*$)=+A-HNvAcJehpCu_I!GsB3KXH zuT-vK5ra}{RVEOi1Dhr`S&9qFveKmvA5@hIE?DeGxPc<3WOO?yzEDq1m=i)=B}#H_ zND=(D_^OaW(mWCVE`H5EpB@@55T%FN(r%%1#azcb@)Jxx*0Dn*uxSDwsZ&q}1!!G8 zmO0f=%drdQvhW}@Ul793fq4y~kT;J+uF{|d3{k$${vH^|&Y#&I5k+ZrN(VdH5<9BJ z_;+%)J22#=e*@o0&!nF^v6pd=t+YBnI*~qq1_bB#p&+*^r8g@VOfmzS=x!|VLY#b% z*8~){>;VCME2j+;6Qd%2PPZZq*iMT*@ZZ@h6bF0{_nJG19nf1H8P;90nT|07D36a4 zLD2QU3VgPbs-mFNlOjd=6_N9&-nW+5G${7;6M=K(sQBQgx%mA#3-_C|n!wcz)*+91 z7PEa&uOke8c3Wx$jPlHG|DJ3_tkZaNBsm@zxNRe&0&()VUS*lDVdUM2b_zUP;IATN z7c9{qYV_F1FjoZsEZ#~Uh0OA_KTSByK9|Og`s8=}RjCJVZTYjOoJI%qH&S^N5FmrH zO}Y)MNcN{_@QLY|nwOkkRryxhaDj^THQB{^tVVk$B=8$4Wu{L;;JVv5rsbiO`{`yi zQPg8Y2skP2g0}G_xaNKF9_whwV>i2p+3Iku|u48v#F!L9|{(q=f6{xIT;cg;rP_xSRvzeP|w{GLi3yWnEFoe4yE|IdJb|YFW0V z`@Pn0v4!{nnHJoEruA9-cbU#{RVPv?@n>r^u4W-<{3~PG>Qppo_3_ijo?f=dq#WVM zYo$f9*t4BXCl+5DmL*-(skaZjXYitdj2ZnpOmdYmvY}?2=%GU`=2i6YOfNK+uwZEf*88o+K?S_65$A;l2$j!6e)Oq4Pvyrs}U6NAmk3&X&fgUaH+2=lVB#aP` ze<0&QY~L&-J&g@!Om=t9pg6kW4@u4}c*X`OS& z)qPtA)|S$M(`-aaz~|>RY?~{>8y`P5G&(Ti;BBsh#k;LPwsW@Y+4H7kKb<@zI8(N! zXK0IiE?3dH>O~KfCTzVYG}^H;qjkE1-$w_@PktL$IG8N!a*fl<;0oLNV3hNP7sPkw zPldV@f4%6%WVUR{hBcvafmX(G!te2mqDI><`s2@Mkvwtpn}taC#b*1ZuPM_ku;8Vc z2wu;|FL|np;pPN!yEov+6>X7&nJsw(pgoM%%Lxy}n$ZnpG9UurXfVli>F|pGx5e1CiLd-Bw6&iGfq0@obY5VLn{b z(+u*&2ivh#o;$UG)%iLqw00VVvcf-%w`S6|{92_N@P3aYF1`c2snqeLh2^mRRP(v% ziyt+wzrn*+)^twezHcN2vUxf?J1zX$9XIX^Uybvz`($5fWQr{dBGa7f>invuBZ^V% zT(G@rGx!B2mO3tANwu~v|-Y0zcvVGsH%xYS#=^8g4v$m6Gn$Q4?zka_HU(~Tu zEz{LQB`Wql9C^YXllb{`cigGFcu0^_wq}k{OwKFYu@mbO^aScnHoMby{i)l;`>pO8 z4N)i)U_$Frc$0ubpg9MR-TlsLijUQQ74lU&MzU;wW)P64A}^G1K2h(!w>m#^*Klm{ zbG8_Zdt&COJ`>eo;YAXtRZ|l7E=Nw{*S2-tRy!-kYwg=fd4UM)?&DmcOM4~jE(Zb8 zg|}mrOjQOF#MF|hf}Z9Hsvkp$zHL5h#o@vG;Mqn%&*8{2KSRxB^~Ah-=h_YE9X-an zH3Mn%r@(^+Cd_;D!VUoWw+7B$!Q^*x^~`a2k1@0?6uMuju&^<)N98@aH-OS}*m)D4 zN^-6pxvimBzgYCdeI7>`^jH#x^}7fbA`TUPkHwj4^p(42JRWNt_Dqh^3d0#thYc8~ zkAf9zy#pPw9W~lPdU!L!j}r1Gk%g3s0rk_hb$+xETI$q!ot7xPVkeNS8bm0cN%o<7 zlO4m03ce0b_W?E58%lGw%Q_{0;0rP30d)v$e}AJkaES|7m*{qQ=3j|_&(yD!;#B1I zV!AOYGTEZYngncFEYfS)(iP(K#qFfD{1k6H$@IS}rk>LZ9_bD*l$1ct>-&e*T}%G% z5Wu6Z0!}`Ae`^PiAII{3lBX=at?o2NbU0#92PE?no~WNMDtDu-M}AgKgZucd&ffB^ zH&E7HkOEiVP}a4xG_46%-OZt_%Vuf%IC*)c{f|si|FvIsS1&V23r&Vy9>Q01awPDH z^U+yPCX*>a?BzPVk#@*g#MUKOq~cku6zdnYpL^sgL=EAm9uU7sQCu5hvoe}`e-;6r zIkU@t`qX=&3b8Az@uCcSazFF>p{2)-G%pHiAz}M^%qQ?mb;cVBWj!y|Shnnn^!Jf% z%X!Da^K+h=-yjrs96RD77wq-hZ6a-M5$n4v$15IC7r}WLed*CnoM22R60ozDMi@d$ zX!RMywS^LS98X)8z30}2wnj0+4 z?qow@PNUX$Rz)MH&mv9Uu17@uUd0e5cQ@A}wUk%G6$+n(XEf||sQhX?-22o>40Jp= zIK9`sWKu-d{qKH7R11FVR9Ab$>5ue5&(hvj&>^g;!rne7 z>Q|&y!H-e`MJM4B6F)-%4F$&iitWL?dk%oXUeJ=e+*Y7gId+46cyw{*s&MeBVSjZu zH`$k$Z{NNU)3ZuC1EQlgFmYMa^0Oy%08+g2RR#g=-E@0{%7Yn#{p@h_MP0{H5!V!W zpuPU_l+n+(be^t9ZfHN>P4D@2n;!j`JAD^uHT&%sVd{N2`nvm2om$ZRcQ51}yFP~l zB}(l#%=gyfueAV-Pa#41C*q&+09QDO9Q!Vc+NY5;M}l+sQ@?ShQR(k?rCP1mwT+U5 zm|Yr;P(6t3V;?>I?EB!NjBm05H7y;czESvhw7z~-x$|NI4KkK^o2=cjd5ANXn>$NZ z|3GiF6a76Idr&EVKjb0cEiCtS=SaZ>zMrVTKuy_!PFD-&b=j8oVOBB?&oZZ9LuGlY zwdGY^=Cka|!|N+n{f;&zcC0u2Q!^YkH2PC8O^}&fcoCKenrMVYL^t0cL5fTf_Y%j< zPxWda)!NmncQHeonT{0M4DfFy9X@*=r4qpfN`ALeojUVMFz;Z_ad1lWu-q-DC1{?_ z(9(91-*cxla=C{o0-4gD*yVPXd5%s<$1BK-wnr&Qc^eBBuEu0J-V9N&zee$@n)f~~ z&6(jtkD;U$`Mhj=9BlIKqbPsne_rBGs@Sz>Sy=A(fK2Her8-9!2h*J1V8F#K8meIo zix!iG6C%YjhbYfOyi>YEFtP#J1VGMqNnON|rj4Yfkc8d54Y7TyFiI<=lQ3vBM%LL4 z*Pnuf9rmgNz9@G=vCqykc&0Ho{^Cn~fZ%A9QKexAEfX zFBUA$PO46(`&9n3gwCS1jbWZ*IncwbZWsm&HFrV9G`w-9dEn0-@$g!U^D!aJ}($atF(i&SyDC{ zc1Op#Kgf1Dp>^2SEWdeN#9Z>G9JY1vrdMvwxNvq(JA9?5 zRRF*_SqAd8@_jg6>YB<1GJ4=LC}xYhG)e8azG(2MT~U~V%ldwlV{P4Vq~zvHb6SHD zrNq)DD?JfK5z}+q&Wp>Qeg~{_tjF@uM^HWM5P(VZ%6iUQa8}-pN2GsFnJu`psi`kK zBHCJnMNhE2Tw*Ey^eS?nNC-d9okYEi{4qaCipTkRc0+x+_vGsext8d2D=T&z&S!n> zyYG6h#n;n0$8YjDj8t}33R+oP+tTHjaML=J$$|I#)*^-O`p+N}6Cf;>dMvk9nvySx z>u>vT=a(CQf-I^{3h+l~TYqOIdZ*V5H~8=&cS%&fTi>Qh)hkwVo?pm`jQz#3{`|dn z_SeK@2mvygsp|Bcv62us&dwGaa}|kAiWaLbKeD>f7x6d#toq5nMXhy$G?4?DciyJ(DE?mHm=;&3k&epmTj5+#Wp5m&^oRJ3{- zX7-iFxzd%>$eX3Ix(`~yzgW?-%+0k3vx_U=qyv7Ab#{F0-1qYCOU&ipu8UjV5t>qV z8jZx-C})4v(~uh>Iy6U}Ij96Oa$}R1u^-=#f$5o)rah5@qp2V% z`pRl^|@#WonQ;43I&z3y%qv33^0{p#D)OL?P=PB&C@osR? z+EvotpX0ADi-!IjlDL)tK{gvJW-Imqo#XTSZa;Vv1M zM*usx;qvv4A_!|PI?udAALv={SyysEU*S)`UAMl%!uG?=rDym2@OKu`m@sG2z@6BG zo>YGe4c;Ds2j;Dx(}Rzf9txRrhAgTw-1&&{Wpbp#uIzSinXmQGB3@PQ;70n_LMK*| zxn}RBshe*d54nz+EyJAf<^dM2%&4$c@(7K{3TV+Y^wR!v z^*-ENe&34c(En}Di1d-P(%l%K}4?VfW8a=}yi*#JjmLK`|~dC|O>7t7~b zz-QT~E#D8F5gl3g6uIJ7Kn%kllJFn>3%61B;Hr=Lp%2RJ^=p$?#_aFkUaX*sU0W#4NL&$^T<#w`esh3-| z$SV9@T&aS*2tw2)s2%zhVO>?V3S^Z`GW~<(pIbf(XxHB*pEH+C5ZAFE?5}83OxZ5*ZC3v*#aIfIzIkBvfi}kFbw1uUiQEb3c7MbYrO>js#91M2$aD zNAJ~;141-!sW!<4y(W32ogEBkyv?v;nRrl}r+Idc2}w&jL8keG2gdk5MESLI zh}S#rZl3s}4}1Dx@w7q-fgs!BpnB}1T63yZADLRS%|`kCNy2_8^g*2Q5dAY9WTP2* zp9Zw^C-Of48AVMy8CZwih7{qA!Ju3KBpM#692~%ICzR*l1_fqP=wJ`vI-Df!H30XK z|22x6Ok+$;3en)l-_OIBKaOck<*h9qa00vGruqNRL#BACrl|W3*T^{0VHPoXijqbZ z;Z<je}lb6 z_VR8I23P&;=kMQ^=#XC<-8XX2d1cyr#kYL)CpJ=+mT?*#osKfYj?Id&+iAs%e6hnK ztnc)8^-`L15*n7rY2_($V2GG42vaI@oS|MGqa)dtV{64Xj;x1;V5`61+?)7T@9S9K zJ#Il~$WQRI914_XlgKJ>lB^GJjdJ`vg*K4Kr-c28a3p8w4e zON=^;Va(rN?^9HC>bVTsDR>CEFiGOu=lrJt9*^2BMSM*-6_Y8+KA!QTv$NTjP^yFW-Lu z`!uoVpQ0X31&!?~O3PPbLxa?;(u(#K+_@ZZ_$T*qQ(@sug+#e5MOuNZyZzeP|9(2< z)s_=?s-bhxii@9}QXH_wERiOk$#nw9JpYhUQiHu1RfF*ny42XT3$EbkL&o9MySAH;<@v!yF@ zB7cmIVL}?6;B|JFdLtQrawM{bJRv2aj?9LB44Ach_44inN%l_lf^)O+WgkVl)>PD= zDc)msi_BU z(7NrrgTPRR|smHn5bM`c@JghNCsx4K1>+ZQ*o4T zvnA~(O1PL`MVdTIPIw=IuIpsAJPeEMHvQE7NI&1f_JO2uibMlb$o}F`w}Mo~R2y-l ziWDlMBJtqh z+5OpC^=ebr*+jK5dk%1l!+oFWxyCKni;N1mZbrWwSKe zYO4Ytt1!b>aF~=!BT_4@+KoDdv#j0AlMQP`g542Pf3)u(xL3{%Jv6YrvXBv`6;nI#N2 ztIP^`*qQ2CIX|I+G7S(Egxj#?inXv=@{@7Nv0pm$_&8m$hx&v*C@TG$WNiO;^wTF} z=g<=2?{B!B*+S=K5H{749VX9;;!6T~TVn^l)8ddpIp8%BU!3cTO0AD_>!3&j4yo3f zo7Dna{19q!ah2t%B3(UP-lcGTGPN|<7@aZS%UgHH`5rKJCl_Z zRr3IlhwE*Srrp*pQHng~7kPXonh(Z82VM*$4iCI&(z>W>%$HAdo+5SyJCGC7wkEiq%?+zTQ-JNItJ`ufM$NQJKYQ8HWT;Cp*K7t z(uR>|WlU=Pd@j`hy*3KLpc9=xe8OK}Rl$|!B3Q*m{a7X)vjpY zw#1qja^+XfN_kcoP1okSe^LZiyP4H{ry#g06d;bah*Tb^BV+W*??1=83irE)X;?_v zuh?|KPdE&9N%O|$@fJvt(ASLmGbK88-1O^rMDdSxhe6ku_PZrl%9D+uYXCK1zhy~| zu(5)*dCXW1kXFtcP$eyLUARgCpvUxfqeh}8iLM^Rn3>Try0s%P^PLSuHTo64XUh3} zEE!Xp@Xhae$7Fy{VgB|fXN9sv?IP36fY<=Bl=6VtDY~EOoK!>Z?b?4Vzs3norDe4N zz26m?W*jHJ7~lpion3KUDT-&Nx5(>rIaBAFq2l{kWB0NQt|Q+Aj;dV=0oc>ujOPF~wKB=yf%9z{j%%2XH+0T`%IKn1e;=jOZc`0C5B(hE z%3EFl7v??#F|ayGOLa>Jl-ZwpB>Kn-5)p2H|?}ggte=* zxw+>)XnY_na*}R7$qqsxsfvt*7jL4}1SB`stL#!YPdgW-BW@A=hp@lP)`X(2EN1A1%(BzK$6UT?&X7886(DZ)Q_w z$5zpO5bj5q*}5Bi5{FhLWM4NmgyRfT@(q#`GvMQZx`$%`G=SAf`tL%v-WAcPbuHNY20ECru%Yj;_hFxCXDCJ9p#|;>7c>0l!k3?^_W|tOyTh~wM&+=g5iFLN z?d1IZGuSuRKez68%jA=TH8<{_vhg|d-^2Di`zLB=~8a z?YzALW=ydBT|J>BvG>q?)(iUjAo%G_aPKc8qMzaF-CNQ#D#v3WN zvlj#+0f%15M{f;tLGf>Vtwr{8Fmn=$PMy;ICty&Ik}8X18>eIAi5!LEG9nrfLQ8US zG`uz)Gw_*$xIO6)5o9EMIbx83p7%Y+Pl>3AHkMZn`rk1Ke+wX;ivWac{+)KYvG@+{ z)VU6WVbG9pOu;WGNpfliT^9iDm^lA^+rOy^11G}n-G@b1z&2Ok8+$sG***NeE)UM} z9+Hne(v`?qCC6jFsNwVO%6ycEmp`2YP<67fo2BZ(GTsjylX}* zjZd6>`5rKuZJ=yE)mU%B7+ATe>wY>WJhlyMGtKB3buK;Ml#MVM2RTXiC?KmE`-?2h zFn6+{3v%}08GE_iw4NJIz(wLB9#_s`C&j z5WUrw6VuwxpWWcLr|LOgrCt9r&a?-3$TTDo>K>T!;pP_X7)X z7?KcUtU?ZlBzv-ZbM8DC9OmAMoJ6%t9x8Fl-emv5m>Y&nCw2fq}axHC%~S@n#oi^HEf}y zUdgfcYdnKm@mzbh90fzl&ND?|{wEy-mthK5%67=MT4Nhm5~`O#jeVj3ahFo?FIjSg z&Dmu>&7#5Q$Y8O<j+XbA4E_Uo>CFLni)a zOTdgod?qw^#=K;N6}Xtwl0Em#Z87yVbQ;*42~6WwH_K9T9C`6Ex-Z;VkadP$7w~*= zXHPzM)^EZ9kFhf5gv8aw5U5n1eMTIRR4n~t#Pa$LzeX7iO{JX@&5G90z5xmN}>h_n&-rinCPd$DC;5Lm2iK;o#`XPUCsLAJ4y_Q7uo5))@{}NIb+!-oKS68L1$ZVgb z;6oZVlTnqe5Ld_#Fds)plGw@mop!)v^Me{j|2Xt|_kM4Neh&mf4)INOls9~Y)nCCx z;xL6@_HtIB!X~L~;3Q<(7b>u=s@pq1JWuFKo9#l*VU-brFc;3H*cg;Jse$ z;CW~d9Evf8qEN8NW0b|Ys+ecGqc6M>#A98jDBt-l^Ds!cb4Zj4c0*POKNWmCVb0M03)(QR916wy}_YR z^ZIE&WFVDVOd0Vcc@kUP3Fh-(duanNtt?j6`m;i%Si>6XlA1Wh#H1hsx!E%!9KsXp?2QHSbrBuwW> z2L{hmpm6QG@7_}1aEQ~|ve1DgJK_}ptuFfq-_{-E;69)ZY=UQ_nKd$4YQ z9GvaxMStC|+9e@t*ZIzhL%B=s%b#yO^i*$6vn6xM3;BSNT&Rs(20eawLZg@`CeXtXYXh zgc`82+;8UPtINT)vppq{_LFh+E+dy=)qEOEY8Z!@t~@G8ov`(ILh>Or8w$Q}*-dlLP;jTsC|DSW z%(rTrbeElIDV85TE)O0m-E%@PXBY85=zW*e9Un=kIdEze9)iVu( zMBhR*8+xElR~iR!MMdSCqm|r1FcfI{fyMokxs?)oGZiUU^%XnkwxIOZ6AqSP!-qAm zm`VT7z_wB^1^E|c-(5D{-MqTHu^%b0a_z_VjbPaJy`Ceg+m$goIs){9^-2G9Y>`3~ zp27l(@ry5Z*Y*w#+(~M$l$DfV$_JaL4PgtBYVU;Mp1prKDTw`B=CW!sLTSK_M`w7+ zIvRHiwLG@XrMm z>~HKJn*<3YvRoo2GYgAn%Xg7-Gj#o2Xt&2_b8)h({y2^OQ}_EkuAHgIACvfOLc;N) zrl{(`;&?R+tFi%onpfH`akPCeXGn$=2PI17!$ES?T*^=bzTU8?e{9&cxi7Qrt+-;1 zXkzH-m@L^ze-a;7hWxpjxf1>R`=7qG-;nf0Ld6Y+3;$K=rOUtKr1V`9NRm!gbPqxp zh2P|%X(Bz!>@LXPjF`Om9Rl{!m6e(D4 zl7tix7nedPbDMY>iYH143eqI&NnVA|Um^L$w*nL%K{DFZ_S?_|^Z}Z13q)m0O2x>} ze6x`bncz~Ba5K7+-SVF3ud9Fjr+yO8w$COar{OqjH?(A_gDT%XKJvF_Rr3)oB$yowtF({`A`8d^;GI@0oBhnO>PNj2snZLWe z{_z_rci3H9Lz1856+0!l7SY+Ed}P|ks)gAhS|zS;ND zB+gx)LpL=pmAY#Y6ZSo7#>MK3(4X?&tE*pE84TW?x0ylf&=GpnKQ82n{Jf?r(oVBI!xp1xFwxT{uuM! z`@3bGrPS0+r&GpFo-r?@&WTfU__;Sc;}k+dqT;Oz^_dBbl5%A1VEaU%;20T@%+e;4 z%@8aH)-wd#n*B1n9R*Z=sn*w+mfq30=NQkJug$u4MDzNtK_WZ5rOnMcb{io0u}i@M z-QDK<2g4V))jxBc505cUv!8+MF3%dUpJWj-<6WeXGyGhBOex7vQ=f2u`}q9EdS6(< zpPwU-62Glj9M?=-$ru)tSX%Ub^~iD!%K@{dYhUwA1i~lw*WH{(M$c;6spoZm@gMP?uFLjD_>4w=wT)3? zS_yysd_D%!M~`Vo7o8{fVBg~qY)ehrg6PMVDkd;pcV52^Kd_&~SiX$Lc}-^I*}DAE z%t3n1R{Vk>CKQc%E1_&`vZy?V?V0#q9rx2s>y01#H0nifp|U}rvi~G;VqftcVzN39 zcF&9fwFbywic!C4;&6Iwwtx042pmA@J={^S21#)R9!#(-lq|UQrJFl)&g=etEO+YX z)Yte8gAV*rLHW2tI63rEkwN1XI~(sI34pknt=Z#9 zMLd2n)BVtI`yNSO7(gl~+-cAC*VFgq`l61+V44Jwm2d)M+E-afFid#u>3uucGyQxh z5ptZ@E4v;^jHT#5i-Z*%{f%oR=P;z`*0=hk*m`R=K%y8z;n>aK5_D&|Qs${CPyhE3 z4`<)eVEh@wpj(bDJ*rsJKZ}XgPct+;k5IaUXAJ~N6;lPLg?#1qZ{3&jv59A#9gyyQ zJtXV?-F=xZ*i{j}Xq()f7jVNN3&vWQ-jqsyX_a}n$Qt#o*_n=g@gvtNEQEF3v+cgb zb7+-!F}n3enLg_{b}z6b759nTd%P_cV0=VL(dh()o8VjbK%$@PZHsIu1XG#rghE_= z$r&4xVmZ>~;N&GtNM9Zhe;N7naA&s|urqP4- zEc?O6+kYn~PgKg)B(ZplX?ajK zC)?$J_t6J#E;nA}SWfQua2C$%YCQ5>3jDLIQ~ifs!h1l22@oqcT1&C{RcV4%Cp#p{dN}q4@h(0-=45gkSPj}07OnQz&cC>vtrBevmkcc_ZhW4h zXv}!&PJe{pny4=b6xDgGIOgw%PwT;j#BQ{;qdC{1Yg$XbXJNs47?^`K+rC=0BhCxo zh3n|S;SoHIb(qDFLIuBxIpgG655`e~vztG?nj$GW&3B8P8#z%Nd~E7hz0YzPP@_2c z(|P6BHu~1E+7qgG?|3#RszUtpx~a|kK~2`iXiPPsivC@Srr@%wv4`y~u0l0JvexO^ z&u{4^r{52b@i#^(HJOa{=*cA{hAkhtmXg9v=|Do?xZX1N-CKQ*zrsi=wB}qY|29S5 zZW^$p0$bA|nIF>c0<(ya`yj>lLs!c6=0bmY$ImGH*Q3e)0LRYmYW}?d+!gtDa5P0r z<|;?pqr|uZ=wf1!(Z0mH`o|~d2gJLtZhuksZ@fF+`+KHaA-cYpzEtr@e*2FV5P6*p ztVhSXXX2jy3fMoEnLc$tY~|!{G3(ejs4;(D^R)pTV&ANG#Lg|?!#MtyhqW{mWFG*M zv9VSUn{Vn43A)qsw=j{`M}2l0x)>%VL(|KPwv)GnhBvSoi^iU-olb!tOppHZ{kS$1 zB{*z(Q}Ge@6bvf1tE^oQR{bRG%zl_KUu}2RW z+Df#z@FS7PVKDf{%X`GJ?{oqK`$G#J5q&RP8QaPEJ#TlD@}$B|NmAN^^-^PS`?u9* zN-u7jUECa0j~5uEX9VLPY#J~lOhw^vKPJsCS^p+;&=6Y@(Do zrql1Zy`b7y@60cbtL@#RS^CB^`x!3fj)y;PLO!OhzPjc+((MaecrF`k>{$K$`f9lngPoHr`)4LxqDS&pLdR|GHpneq;LR~O%$*Iy=yGM$ZX-qTwAN_WdHREw zb@WdL!d1Z@MIVzJE04;RJf_SSo|t}zNRN8G2cfLjg0EVcDDF&lU&4C7o>wbGU95wh zj`7DiVKVOD;aS0ln98t`8W%Qg$n>jl!Zp~?&y1sBD^pDBRm}$KE5?5pUir+kym^x6 z%;c;+2T!RMfvD=$&)afefA-Y3`MsTwOYii`1pXYS@l8LV+`ExZTmtoEnd8AnB|*sQ zgKV*wbh~I2JW$^ccBv2)>Mh0qUi1Aun^2e)S78q9!4ljc6xmwvZMLqx{*&b zS9CMBE|T?EB@F)Ai}3!$4L>UW1DD;&7Bb-eD3yJ2$ktVreu!cu&9eR9~sym%Xmp zq`~)bO{&qmUrZ%ww(Z8%&7HpFGxF==6hC=xH`i=9p|lL?HI}pUdcn4rNOx9u>C~}w zVYaZ>Rz!&^5oI^)fhRI%1tPRx&pe*&`@rYM)~xz<5sf;nW{k2Ea@FqJhvLDngU$-O z*GiRpJk5s{!$GB0G&^NWG{o$x)SHCbd%J!MJwu!4`!z!Zq{JH9V%O5SVk0pFv>q@R zt^H@`{Gxm-q6O?S`Sp5pb6Mgz?#Hj@m8k+%7`maS#|uv|TTn(e8BOO#B@D_NfJ+@d zt3LO()WY7O!KxsQAH)@7Zpvj(7opo2Yk)D z`*DV!3(*nthBe`oYP(Tf)x=nx~!71-!b7Y>NUg*PDJe*4A9y9yqR z56X+!2VRdS39rslc#0m@lWy-7ix2JEm?~slww1e~5T(_Zrr$`be1hU$gYrl226pAwT^FUa2)3CMknjU^Y(6y(hIiDq=o$87ZmnoP<9wqFeVxx zhp9`&C%voQ@)#~|vK4Agv6z6Au@lxS3m%7KZV836rEmb|28CQyLhgNtO=@BsTvhJ) z$HgZ``yrpg);wTv-#oj+Q|K$Xei+X2;XtrU2VW#^RS`Nb>I9PSvI zWOF=AnvWt~LIylIj6j2EeC{jxswNbw^&HhuXWKivs|;RXyxryo6nj2tEdm!q)(O2H z>maWT4^e&XS)&-Sxl%7m%P_ACD=Yc=N_630Hx9sr*TCB0HPzo%%F;{Xl&3J77m{EKnJmlgI zb%eFS4@QOF6FT-X15=q}xeiie`H8uzanjyj+ zGnp^5e{cKCC%+#4dNH+ZubS~YnYbcWQ_a|5R$6Mdvaz8?b>**wj#degQ`5{|rC8QQ3Wye;(zU{q{iRurMp4AS(I45o(f^ z&IjLbT}Z|7$Qig$;7<=#$CWFu7g3%}$5k--ZeA;t{VT7+3BZrl0^;%#^HdRIm1lky z%&Gutbxn0(rY4Y97dKhw_+Ql4vq31`%`|n?-Y*sS$!q1i?ei0TD<`Rh_V{iGvApalRg$xW_l?~)(JT%6ssUj27%BJ)J$aID(+}Hq3 z5poI-cf$F=+)=L+^N&t}kRlHHIeLDf?Kii2)jdT-cs9$)CS1N9V=Eh&S+WMHy)|)*ku&*9-IKM}K8_NaH~S;}YS( z!rQ5A7&I&4p6%<5VIJ ze6KP8cDJu*?xZn)uiJOZ=0ELKe2Y=%Ax@?y#TM5edLL3#X$Xu{Q{LgKt9T!;&GmNV z^=81Dr?RrRdHhPutx4Q01+GTrY$V=9>nt2FSr#a8?(J7RjaG^HMI| z3kDG3SI6qo>+C?Z&hLKy&n_b75gJJx)kJsw1=fAosoOcI{pIt2jj!#aiNL`kGf&of zm@K1ZyFrE%)4Rqtd3i#w^z|iuOZh>rMGv)q*>{dH3s;;AIS~P+Z0{C1(8Phwy@C+* zJU6xEXNJ^hY6k%56%7M7mLH4vtS!p-+e*v*^&fyw;Pr#ZUQ|O}abfl|a0Gc8m%V_{ zkd7dsxGj1<=~aGs!<5J|txlgaWfPsS{ih{Q(lPk&2V#JLi0*=r;FH zM}_KH=ym0oY2~@ZS`mCl$RrZt(Cn^D%R71L_g6|3mygqZ>)51kDXr+R)JMnQ z)0QHavleM-^-GTg`r>`_6t&bW%ES-IalJe?B^kx?*Cb0!bb_3t5uC{51r^ggr z+Cin18KP-ouX_%F6x;OqP)M(GFK?+bWai_9ZTh;c5>&BLBGZz_aZEGW8HYZTPD(YW znt|CNw$cR*_O%DvGZQ~}R^{LRv%^(Q4#6pBmh^LyZX&}?s*2@C4tm6PyU?z!8Ow%* zuc`vogMF4GZ~Nx9JJQ=kfv=a_8jq9QlE(C2s>%xfu00n2GUmWT4;`#O_!lM`$S)flE!ElXzWY z{=2;KbFMtO=AGBYbZKYrNQXfm-=~)DzO_p^vg+6NK)>$hubN-b{d=-CuY5(=GWzH7 zeT7$G2<8`M2&1i!4Tezj$PeP>52ZIW2N+Y#Bk@LH+c{tBU#@AT5#3i^E+pNW5G zO9<;Wd{~$qrW=<6Qll&z)9yf2U80@90#JQECJ!(cj)~h%Ydq>C>t;vNT z&vg&KGxChunKu6j@RfCO|LCKc-0c$7MJmA^AmA5&T>DvOp3Ya8YqCs#LAex|qY=M+ zZR=OS8!w0(Q2o+;hMU4{O@)&I#f>EfMZI)sX+TmPn}86oKYwvAlDFTH zh*p>jsz8lE3CfRaWSJoSE1kE#^T!xIPITe%2i|)384R>E&I!=#;B(`o8kuje1PBjY zfj60kSs=W1N_Tn_9dP7);>#3xvCnnMC69!hW_}|3_s)(`2f}LyS%gUI&gB`oVpb-k zJ(?`y`UU-DG367R*{wZaZ4%s6#FT(F+$!|M)zcXz4v3JOK}V3dl1nXmEOo#4;qK;5^gl7#`>VN!WEg2>4Bo``Q>o>v zWj(G6OR!=A*ug5tm4<}^5c+l~?zcRWr1Hf!6IGh$XZ#J{xgzB!|6r}r6##pQ)M}lc zQB7P)4Pd55)YR|5pKsWaD%|UPqr$0#1q5p!!ZEs!Ho~+7%Ih=ed6RlsxC;wjj0{3n zS;Y62;ub5m{$agt9W)hYcV9ZLPr)p?EY8weMotdQRzMzwF=7}Q559f1{bzbp4WJ1Q zt})%W9o6B>KRrek+-05;RvB0+$GFamVS#3a&l-;8)OOH-ukY?^%-pz8^!fr@!X{q2 zDTyMVGj;iOGI_>@c#>1g6K#xi|B|$CN9jiFyf2!#|4I9zrEIRu_hL?h+AoG@gup(P z8=%Te4$}E3etfr%X&L<&89LFj{VbyQ=J`TxsIsui-{0u*sFN*nLSg#U%*GL^3xiAw zJyulBKSy9RumH@JxJ4Yk{w$5Rr;(ROqH%&}m~>c}D+@qQ0Ez{grB{7>v+(c`d$k8| zc}D}*93tf%jeUBRRO|F7Lx`N3nMX(h!2GOjN=(0w8_e&JtXsrt{7v#-d`#>EGN}R; zL!OaKaN{STj8FN#Jb_2NFq&w6uzO+9UqrBk8|wIqF5qyRWB$uJR5^3{uQlw&#UJ)T zrUd*Sg39lWniDL4;SzsXm`ROI#Y;_1)3CZ29VKBO(ld^KR?1wf-(yf3{VekO&b76E zS&}DSM>2&ZT8n4uqm1VL`Sm(h96qu>akmqwJ$&6#3qN@ib1P8IRRF7p@sveBr|eE3 z$#|ni{YLFG^~sw@uT>)7K<*q>fg<>^q2G5q-yoZv{{3qif1~lnuMURytS<(bMGVY{ z@W&bXBII@d-uGK_EVGF%K>7UYA(EN6Km$JqKL!~4KZVVQ`?mkR8TbH^N6CHQBp96N zVx<2Y(tSmO!^PaU);wTyrGHOfNOt{1MsShrYA5n+FtV04^(_v79zXi`{litHN+dKq zDsW_=J!#=t@Gg|#)a0rJoN-lDdEgLJxA-&_&#(!<<0mUpSw91`OEPyZNvdNwWp|cJGr37p zP+NWw3G`)QO~>VIzqmAbgg;Fn5Rczdc5y_OkkC2YlQQpA5u`RBSp0=T#B4cW8dflZ zP;KLP%fOR5m+}=2iQ)HNZ0K?&L{1xgI!8h2i1D+ZQ!q?kbUCAWGfL&Vz{6haQl|FB z_BY7@qjPDauall2>0&I|VWnnMQ4Z5i!9L6qLng32oH9hna;$z84xmL?V$3 zZqpfYwPstIK6TFw8w>O7mB@$21xWQOUDsY7Ja=BSVC1a@G0vIJZzOZ0g@gg9zjoRS2%4;hJ&@Oy>&b)8gchtSNi(Jwdl>I%Do`#>VRuLsZs^I}IXzsdAy7&D!o5@aH zZO&H*%;46C%plN`cthr!u;t4^bD@p3>Z34<#u~-brgJ(aa1Z9)*8`iJ&7OyRV$7IwNhnt(1cwq@_mG zvuCQP^?Ft^_jK9FSGPOZWoC_v$E?G|nQXFYf)2H!nINio_EF-o zu|kF|Gu{bSH;E-jK!cfNF#8@=Yc!qR8x`I+!C#|?_?4Wh zAIf~}SSc~_G0<5x7^4jhJ_%C9YUVH)-AFXT_2BIR(ydwasL!EGxuxw?K>kto0afH( zQJD7dVPd3;6^${M3()yjh#MENruVwpP~6zN9?XyCh;zmCL!Sp}p9G^NS0eAFYAGKM zHZRkiJzpS{sTmyP(5-c2_tFSyevEfg zhbXeQvPUtfYVu%6u6S~=7ou?#VeURm*MAnK2uN(VYq4ynXkcva6)^(23XN|C3#hvX zlBwYVb?kezK=JM|L%g{POb|BJlKRjcs}f#fONmm6!oHtP{9INf#aa58OAb#%w@TG* zezUW>!h`}Zdnx`TM6>3Rn8wX6S?P)QN`$U9{tjar4{`j_(Cnf%b&Mh%zZJig4l@o% z7c!gw(2~|mT8TxFqOczZYk4jmT}(#$9D)!-KL*p5GE#r-Yr;}cH#jR#GUBJQmh_5Xgm-D_eRUCQsrAo{S ztQnf#AB>bj^KGce*9-T9qd}=v1eTM7uWh_LP(f09xm%}Q3g_|=^{i2{t_y$kR-<`r zY53=itC5u=N<<_Xvq#k@g_@;-OTEX-C!Z3ELTn|2Cpv9mOP zLq7MQ=LZNF3^BwGu&0y4CQ*Ra3`K4GW{L#}yn72Hh=_`H#e6IAx&xFE-O3f%g-Qq% zYOuhH46gwNLw(({!mGbv9v>A-?-YikuqtL>mqAEVGR7SRGW%*nUQH3(s6+;r&B`)D zDrV88RQGZh!cwF?MUt2oUXjS3UKf&9mqAP0%%yeKzv^G345dOz_ym>{t)@{3H%m~=ymQyH-Ew+ljVmuzJK{Z`XZuC{}7zlkEu~OkgI5gV^|7UY!D83 z6Tza9f)Qb35l!uyMPWa`-|c$PDTPO@*C`Q5qmDRzv!$ozo!lr%^V1oC9NMEK5JP51ph>wBF`!7sWT&0MfG1f3^pIy5!bB`_G% zFw?dx4OHYj-bH=k2z^+1ay1WWD0-$P@TgXZr&0)T_w*0*e58uk*6(P?sXI(u*XzFZ zxtOY!#03<+2P>n@rw!l=evXNuMh*kh%Ik=E$d#>U;kEVMY|9C{Q9Ug>KH&s(y8L@k zx~X6G$Dl?2;r*a*qhL%%A+4^8;$UvU}}zh(Pgoj3l95N~;Vla=VqlB%xiJGlF{4BEa>yo-4kI_L21<(}SOA%0jY zSB-%E(_fLxy_6Lz>$Wr+W;u&#Qwh}5s`T+dT7a@#3Wn&~eQ@eEn;!hV*e`$twWg>; zfwZNlSNDmjfo?P{E?50aD~V6SR6`$JUlb7S-QlUnKTHA0t`L4NB_yJO1P?p^3r9a( zdp=z3+`WB(Md95G0Pwj0_MD2+KXgY*-30IPzTIOYADV`3WXrrlm5|py2Z$1{Y}Loc zM(k5P-g_tQ(O#IEO}Ax#K{=NGF8?^6e5Yu-WIDmHpM4v*dP-A>urm}FyY-@#6zx`g z+Y|rh$sK|7LW7~gm=w{ub}x-Ig~G1sVM_^(@GfsD*$ESut}LzMka=A8)|9S!d81-9 z*(`jj-)a1C>4=V^Z`j)zm4JK|ec5{K!jEt+a>=OT&IJJsMvCyI*#eN#bvD9uw1pI4 zbe&h$T)!L}C)j!zjIRJkgHs9sceeRH7JfDvJI$W5ia!Kt4muTA)AdV1%gvZ|$g25y zX*wG#8V0ppm+K8Izlbw zE7ttIq?7NE~H<{hQZ7t2JWDK_5?A~+}M@HZbbhamPU?0n*@bs z=uiyca#8AvG+#DxlVcvP5LvIGQ1(e_zTku_oS~TgClNT`RBnIiZB5!`|DD?JHXk9qy&hYk=ATZ;&5=kiQ9`kI=OJ#p6^sEl3Ckw4 z_Uq-`Gr>Q+Va4Ga0uC%<_i@4zgu+2%&5G*6EKb_*`=mQ#-7fXR810p@L06?4O+*Op z+&tMbn+6Y70T&a_^{roqvz@4IBEqz7w9*(vNtc2Q=?Md4Ysdx<#Z&7!IT^&QHRqmo z%r|^MuucD9&BHJH-HAzs4^n(Nb) z$L!_g%df-nm`oi!5LlGi%1dm+!M%%F@IB>^|u7+Q&J8E2Vzlft1fo+Jcj(7>>9)8zo&Y$oaL~Su* z2D0jN&O71apJ}s{jaon;;I_xsaI{6OYiJm#qUK*XPw1d2r~G0 z+!v8y3&9x9G~$q2b2%Ynn8GXLPrBukc9Q&N-}TV2t#D&+ekd@LNkRa*8xPumkY|O zxz_SHzT5e+V{!|u2NtFB5LfDAZ}`9m+0s*Owa4e$?T3)qp-&d;3-ee$CV(Fx)uj8d z^H99=(<^^6yzHkE71jI}4+#$}7C%~@8X!G$hsH*m3_fY4F%=r%;L>I#x@;d^@WFXk8%@J85Ax~yuI+4Uio9mXDxD(EgPCN zYFNU7p~e^};_n06^RDzm_}bOglk3^p0k2O<QMWB! zy`Cp`JC+U-+$J<28jwch`NEsm5sD9Q-gRD;UPpx%pU?MVTubIWv1!nY(4VkWSiMlC zemfEJ5hP~kHujj)jan8%wLsOXnzLDKvdsH}B&Q-L6>29soW(GR;+W%td2 zg{SRJH&=c07uOl$$il2xo=Vt6ds55BVIXDU?%Sj~E=6d9(E5sv2Wox2Gzven0GN{k zd}My+sQH@U{u$FuLgtXu=z&Js~cww#nMV!ySs5+ zB@(qo?NTp?bAFzb7Y`R(q}sTg+np2c*vDy3vMJ(VsXcD%)93$j>#wYOYQ4iIrBh<+ zZr6;No9j?4-E!`PP@cQ+$pv|L8FdE}`lArN%hw2QAR)1%V{%ev<+D#@hsUnsMJMxnKX#2eGW!c ziOh^h3j!tOac4yA)w4YbM#5fgXW5?1D|w>VZ9A*IJK|7s7b|irH7W6OI}B}G7=9^Y zm{TDa&F8nVjYezGSH0V#qeZglF)^Du{f^$5!a&xew_=!@&nCTWw(C}CzIBdZsD*8S z<0+IVNKEW<-L|2qch2XPcK`YL$*-2z7g~ZNJ7@8^R_KwoIdI%1)edKqsi9{=$!K%E zSIx;Dt6e}B7q-gCw%A*Z z?wDu;EdAoY_CTVnpijxxbH@|I-oyuNa{!MmXt#$F6LHP3+kE|4dYy{1ZzqLpU>>ux zA6=NCj7Z8c#(CTGNrn^~IEgt9%0#G~DC5H?wmtwfaHd4&2aa?SHvqrEAztaXnu<+O zD5ZbDeps{EK5dEn+~K*hsGmNc(9&pzvU=5-4DoJ=wQ3AGnIQMI)~l0z+3V);;_JDa z6X}``e`y%w!lH7+otJ}qq+Z+FmnP*rQ9>hcDEUFjd%dZ%8e$GySF#P8Gj-wV{(}X> z`|thcoX~(NH#g-y0k`fp(y4-QSBgOu$_AMtVc~koELGq1p^1ct)eN=gc9>#_>AD!f z&&zBAbD>$EC#%9O5>LWM0y_M?_V2m_?qVAgAMyhoz(q&uCW^1F(T&1OejjU1j!Uo2 zLQjfncWr-%mX*crTH0&|wMkIpiExYH;VS>=f9qI4Ih2McRfzKL#VT3|W{XAw<*{%O z0DvgG51Vbj@GL(C(_(=|e_Ubb>cAiQWtudO;u3B{tHw*uD=1jcLkoK86<>DUK)wP% zr&`@jVep@FH|Tk_TxG+eHQ5(J0X18wX3c(6XX9h1JS`+zt-hRsx4@WfLDo~2f`AS1 zC1&o}ih`a^+f^RF4gA%XVhT<^MyTseI3-F1^e3WcDei^Ocw=>gSmOmYXDJ#xG9l7f z7_6zQYY_mTa*P8Odo&9*s>alBG>IN{g@iT~)1LSH@AyXp7~p46j+3O^2&&}xr-oLr z>Lt6Ky&s*rSa!v}Uk<6RGt;xjp<&h?P5Ca(b4#23PVSI%_uz(MBB;+?-s1j-VjBWU z`<>wk8d!Vg6JtA*Pvrfy@YGfXV`+>2q>A5#3fpjP7n}dW-5OZCJrapVPvE4(eYc6A zT3`^i+GHibk>-Lz6%tYUy}4#s?hc(45tQBlfHU;}Uvw97CU`c1u%4l z!y`=Y-Gn$FiBHGO2*;eJ2wpX3;qODRf5zVTPYY$wsA59^&dV<-9@C|K?(Eh1K-oxg zGLbG7bi13x>Q0qvnmufq!Ox$?xQQDA9ru+UN%-JY1@fM0^SBc`Dr!R{PHT*1%hgYlrw#*b>eZcbzE^48AolrrZqs~Pl8gYkwtV@I$K~qlp`b~Z(ZeR-W{llM*Z)bl}&?rLgo4%1Rdn!O`9qd}Z%wm#ag>=(=hQjy> zdaqb{eXvhuG?PV(4p$wBlZk!S;}5U zM~$V1Ur+xw{}*BNZ8<9*h>v|dZ>mEr{M-I5%)B^7~CyjCn_? z0V;Q2xMCzSSS3vcx-7s0Hg@tKn9!YJEuxp?)fJLl$@R&1QIRsPXy!ltqssFA53t>x zD)i$+5)$$cAmlx!;j()x{m-4ZXXw$~&L89-UgqS&8WOXY3?OW%ZLVGT-AUx2BJ$5w zWHGiHI*AB-h(3t|d>|&|CUmbzq#)?ZHe>zd0W*wptK!Dv=9jH(Z4hB4rLPubRV6ty z&tFp4zZz=+MF3_ifEhqO@u5N74&nz4_#fhrwdD6!nfuh5FIQAlQ4A&w44S08DjA$Q zVWER%=U8$FHj%i$!2^71pe1&hPjPl>h-m8@<&Ia%=M6Fc!rk1s??qBNhcpR?JD-y9 z=(4sE*>3sp%Fe3uTZ>)!j4qoRBJaF*j%n4?PGhNK^1G$MjqxK5VyY>=v^MkTeEvc~ zsgswrhwr>Zv!+meKU)a##k9bmN;b)70=?$ur=W)C1xA;+!TtPSZ`w=aR276t~s~lfe}*tRRlBDJJo?Xn7la4u|LSt@9jB zGT9pX_+SvtX!InV4Wdg=B%pK)&e-FjXgd*@X9&U47ULz88zp%OGGhp|fR=5NmgBtm z4z!w4|GFonbZEgwZIa2&XUorAT;DBF;T%&%JO|+(YG#q4R6#UVmwLAbGBzcUgbS^KUgOu#ayuS3!J`Dl`&_F+XAQ6;Bpx^*|Jw zyxz5cuXWs^fqI3U5om=EW^wf4Ye@)nn8MlXQ0wtI4mTQ_R1 z?M9|6Jyes%W0vG6f}rpoXB=X30U`!dzC_H~H~|C_O=hY~#fGVTQ2O%Y^!DXFq=VF) z!QU4PsWO-y^%1_9d}l-(TgxkBmCObZgGCeKh<5FCv0Ti2!W{p4Brn>VxPixZV3YTE zhy#T{lwu?FsCBSLah5`C=mjwln`D9cz6W?j6fF-8#M2gu#*2BL*~wB0^^~?gn(V4C zaWGX&j_bcWiFbS9LjLR26*J!}4wtMHq3=qw5o@m6a`?t(Albk1*MK1;tgDR416Kd* z38gIW<*412A*@zfrVnF}CK0;gALyDB=wat+79)~^*k5v}cfe6+_^~o>{p-#aEjzm4 zOGOIh!p*nuUEHgRq3=Hy8?D|cr(9f2&xM9&&{>!peLE}b>u2KZmJ+Eb1DR5G>%zVr zi!4nll?nOOIjo0obC8e_PftnMo%hYAH+x#SNT$Y)lGEUTXD1B{NyJ787h&}T>3LmU z5*b|TY!Y3RQ`tB}_V~Ebt?^DuC{L?pbuI_{VP1x;LrcBS&HzR-;+Q}weO?D<+S%L$ zddpb`TF3gVVLbqVP(96xB_G&51OHkc_zqJJxYiFnv7H@?;TwaE;=H9E!m%HfA|sS& z=SxonI9BcxVqf^!Ntst6^poV2$D1&!ubS-O_A(T(PsV6sCRVXrjXhf_ zT&jis_J_=h8C{|_jE7!)j+-F=J(Z zNtE`7@^o_Rem@i%rs9QbqMsEYSun}$m z;gRZA-io$ba-}2WgGk)Z1Cv?h&O^do^~Qs;^D9!L~6mIBf331lJ!R zcP%j$Npd$o=EO2dRnD>==3=F1LN>KTq6^+bvZ9|aeaU>eRAz3=E0c_Ks`TBNLT1H@ z5T7Q7=Efu5Jgf~A1E8lSreV?bq%C8sdaGOoG5Dq%xW@NL&&~xnfP!1!z2|^fL0DX+ z4rkhYp46I<(b^H)(OwgDjl|+Xg;~Vf%6*m^-etjNE4L@Ny3gYE+x)Xg67;wq2T}B? z&WuQ{=BI;&6D0GsYF@!RxL^pvT&#Ts-ZiefiEz!x`_4DL3E822GyyO)PE@nn&}F7ISwNLX_S-7WYG$T{K%#(l#iWl4>>An$RTf} z+cl4J17wkW|4t;RI)%s0)&J({@85T!15tnfMr@zF+F??0>s^TW`nqEY#Gpw-Uuqwf zu>^n!_sEtO{&w@=ul3+@geBLPhP@V#I%>X;d`574UGkLr*CP+CdAjh?$`56s;AhY( zi>QBL4>vbI%rsMS9H&$r^HQr}0*<7x0nhOB!Kj;(-BWXt=P=fY>M}p-#@L*$;(3DL3~?_$Z$P&ZAT_ z;*17-PCG;UZ%%TzZo3P$$|8UN3ym^1sh^~lD$wN5B-eG2!T-JcUKUd23WlG52*fmA z+d;nLRtjL-AeD}=*V-5{lLDpaZA9|@Zp3c>EK8QD!H|yr{J*GhY*ECL`mxjY*60gF zzCozz-REDrz(=%dMB~xFwk80IiTKakCA-GC%V)`2p8UXy7(h|F(!dJpAsw!RT3HnW zi{nUwb+_Hw)3-a0wj203d-8|4>g3jqJCQGK#os?^n4QUgwIiQi5xTbXzp|@I{zQ9h zPYB!CAqL*x9p9+kS{etxm|G0|P&RRWzWW7NJ=Wp}W?j#>xT9Fv$4E;1YQP_t~v$k$TZ7@H;ay0GWnf|{h=jZrj$Z~ zyyMZ-YUy@693ji+V^&PLmE(eX)sQC{Z06l;^tG^|=y|Fuf@+w^P`WQ3hz@_Q^vlr$(5*zD6W(EY0wxkZ7uv2C=Z9H-liB zdCp=ne~oBsqer@)r+ZDSy2iASMiak5E!|54!TPR5l-6p|;xsnuugb)&160VGtu-aB zwUq5R1|CQ0rB?vQ^|dOO+&Zj98Q*GR-!w746=ieslrb-;A<_5K^vVNfYmwRLZT|Ob*nQG<-8MSRJVdru-Lzu2tm7o68bmuSmqCrIx{cPU#>`>>~k%E`2WJcsjkilf8)(UxKDgXRb6B;Krh}41Q_qWUwN!X_`>G+2)># z!(y7Pp%HJe3Zgav_D4MoT<;Fbu9rpa=3AWwK$;7gBFpPMr+5o}m?6?j%*Q2)mZ%?w{?4x&)1Y8i-twXT{xJzRqUC zS`_X~azZe^o3E$?1BF2o5g46WnRw<0Qnvyea-Dc}hFsNRgJrYS+qdL2Ld2_~ks~5S zqbZkx3A)C?&5e=z&AGjk7enIsLrB-LV~{Ce_5-T<>1qNr=2?u4QS``m+hQ?BoM+GuFRm3q9EVGAeQ19_#h#%lM@h8$tt=x#Scq#PXnO zvyFV9hPpLd5ndMX4*SV_|0}!S^u>saYJ)L+no|-@q>G&ZjI(zg7N%b_Q1OoP90AK; zp1T5H5kYGh3eJ*WN$a0IZ@&E0;9HPAIr)-Z9)1|z=yweW#aI(%(KN<;C!vZsAj>K`GNtm0W&RO^jv@UEd) zB1g*Ei5t)RCb}?(@#iuU){8X+lS0T6<@FK|65}A)`izVHQCswWjdMpE>{f}vv}sLH z4c2K$ftB~bZBspZoU=FMx4cciw+cK7wDT21Va)3#vxQ5iX;yc}5sB8bYW*K|7M1*u z$ZQ#;72XaYFasgqB}3nev#IIO@z;XB9C!T|Wm#xcRJ}feYC(_zp*h#>zC4?87Tu7v ztwgp8t#-K-mLzFq;m7{9<7)nj5-m*SJ~Rm9ZI5hec}D`E`QAu>6z+FR*I{$?dW#tO z$f!ws+gDR_$1b4?QH4CxldM-c(n+-yRMC1K$D0hV432lC#a6L8Fhkl~y3VguadLXO zqb4h@M0}*4z2w#3t@zOEtUBBlJKm=yt+Kf0tmmJ!+l`Q~?R&J1DvZKRzj=vxO6`El zQhX#yT<(8`g`ats$9!hg$J5sbiW0q?3*KP#z|jtgW@DE zn?MyF?@Afz2YT&37vLi1L{F zI22BQ#Rdu=se89!-M9%f%e3yf>OUd@7Dm{TCiXkORDW!pSn8s-ZP}T)^BUMRGdly{ zx`@~9ts4?;H@L+3oBiUnK|N2&I_!`qzMk2HSJN+>elJ6ZwR^XZJTd8N%k4XUx?Enc z=)}3AEbQ|;tN%o`kwHO2Z0={!4j9NTIsU~WwGo}_F$PovT7`zz37GGi`hJLOtOi}L zuSXBJ_O6I`N%zm2qn%}h9AzUKozLs)Qki1trJY+X#~h{3eR?lm_zSyy3k)g0g@5~T z*IggH$%KG%3)R2wb=l&{PQnX-F**UC^eR;H;MU@^^r+fdrv%qcqh zQ>Jf5evz?(+1Oa|(!963vx;sgK$FWkl9F3@6~e2D+vZK1&lqNeNpn`Y4LN#(Q(UuO zy7@9%)gz4DwsvkH=}iTIE66UiPr8ZCbhqrT?&)qM?=annbg!}wgva>lv7n|X_w4Ao zWl>(XG$*`M$q6|5i;4%ZkDK~FS}Bp_eWzEPQYadRn6NE{ta=Z~TN5;hJa5-EQB|0Y zEE|4%IzIQH0}8_7ZCQ~j*zELqiWtsh_e(%O?s#2|vEhy^bgxM2gb^BG8p30~zx%bS z&^j{f^yR$)hm!xWRwk>fAG+&E1R)w%6B>Az>kM;VwXQ>03U-R1y@dx1{1=xu)ykk~ zb19+kynHt?)h2UCrtOStOBN0rdzuZN34X}rOLjR}m)&SwkAlOgcwnC2em>cVsV#Tw zx`pYJ`a}RpfAcKjN^=!Qp&LEimVUvL%M=>^Nu@c%r0aMmcvrDTgi~KBJ?MJ)aL3gc zIptI}LfQ23eVrn12Mal7`tcKq9Q#Uiqi9Hqx~;c);dZHM(N`RSt%_RMA;kQrM!W2y zn`E%o(~qs?ewXOJqc9x|5UiEGje-)gUhK?LB^e(}M{o2JdQOw`(DMxBqd^ki*ncOe z)hSx>>A_A9ynsQoO@Qv_aZJ*6^giCi4k-g+hY!RC}vrP&xE%$r!qNNFha^b9V zmX7x^hYPK+yGeSib%R^ivXf(;!>110!#;RVOq4y@iGylXl~}}%(4eIdeG7D`cy{nd z8^Yo~NAl+BfGHZgJE6W>3Z>gceeZs_Y0MRfA+B?HJ-V;P*4f@ko{A-X?P*1d6H0<@ zIn%ZdGL~eg9h>6LzWSNXdCB^R97MZ&Z}@yAGQ7~t(aYtsHGf-34)&$Nn+KEcxUEL- z%M3Kl?SakRNL>fkwYM}Se9^@17CrvlNpQB(q}~Y>f36Nm4ZX5ED&AhFV*U6+xIMth zhw*IA!HIjOJh9hzY;ijr3W?LG4YuW`R0$t%JeDQI+Y~ozhYRitbs^OHFGn`ryX1y! z^c_z{F2aL6a#^Q*n)XLh~xV4<$Oy4A?Z#)@oD-*!(BDWVtC)?a;P+^p3g7b7LwynqvPYTvIC z83bxV*;#ast75(ZrJh^LEBz)aN{n;ZvvRg@FT1O{JmpHVQD}z;Z_6=X-y&0w>PVF$ ziW$b3iHC8;u&hk0%ER@Xk9PX+<{yCQ7KPc56MP17ykmi$lSHp74(wFub?4QJc_~YH zsVbY>K_IOvhQsbu%*I zrIz2_KMi}jbo15EIO8;`S-l&Oql=)^JSlR^hH+g@nd?~H^zPW-LKwEK1=5g`{;VDPDbSj+ z!7vEj=aQHUUiY7!`#}*RHW~^IB9B{7fvHn7>0!2t-TMiG%j}x)T6uI;K0a!M!`Yvw zJkoSlSu-Oa6cTT-TqD#PiDz-sqq4Q#BtJbPaCIl>b26W?(2v0{B{AI)u*LY;0%t8^ zXY#(iq>0mpE!nOm` z)KT_4!XfVD)Nu-lg9h{i?2pt5fH)%p8@;a_J7^~mL6D9;{ad| zVsHRb0JDs+JFu$!Z@JC?F@<8z4g%n%|LG|}3IfkR7tBG}i633-AOHWKW7A9d{}N$L zK|@1O2c%`dp2olKf00J}Z`sq;83Bxdf8+ia$^V%jR#m}&-G9sZ{~F+jHRs>f{Wl5t z8NffWDe%&Oe~ge|N6X+pBL$6}{lCe<0x%K4KaJq$hXwxa8`$-KmRRwRpYgw{3;@9W zha|YY<3B3f4LbINP=38f-@U%2ll@NnbN>+3Z{vGahy^m3hLE8OW=Baax~lE9=c;9a zllcc_66^|1TN_>8;N6|4j=@Hn8XQS;5?B*1^J}-#Rk%`_wXI$$aAg6^qiV>{@?4`UU z>~(V`0ZaCbr0p#TH>*gL!bmVZf5Pg5o*FJvLGUBz; zK9h^_uiRR5+=WInPZ~*dYJtcEZV$%G}@MlJjFbf1>R zFx%R?TCvxpuU4N%YJ#V_OyQO#^<+H*2!+uDV^Yvz@0`a-7o#K3-oH;5n05M$Id->ZoSz}E#2OziPNPrV)h{v znKl;6QhE?=R(d$8kY6Sk(TNZI!S-+i$jrW7Pd^h!o{$Q)(n8_ zInNchqTY7a^p96x?YxL(Y+QFW@RHlpSZysRgQJnKuNvflwI-*9=LQ|625_|WJOSok zQZOir5u~-U#vB~jeh^cPic_!Lc?|LT47x#9$28%oc3D7nY1vUxT6CVT*|iNk{G)Ge z6%gGzt8_voaE(~Um_8e{q}6G?vk{~v_(```-@fa^z2!XDFF+LaN)Sc+Xi=t&HFY9c zn{4B@R&|B1RE6uxVO}3HvbR$lPfSapu|VXNN=SbyyYcz68y~}*pPALVa7tMgsn}98 zuDB5|kHUqafLQJ|#U6!X)`fAe#ylSr=1>$j+l+S4!P>|H_n>3Rbw<=5mc>bPW%Cn8 zP{_CYs~Lm+aOs$+JFQ(UghW2Jl&N;O2W2^VAiLC^NWjhw*Ht8*(_a>OtA*#CYq4iE zsyc}Fb+J--<)W`JXy$Z7zuUyuou`85oncc#x)!`JE9EGh318~!c8i83;- zy^5GjTD@w?D80)Pk?L~qwA_irr_wgfplxW!<6s0I+&A4Tt8Ys+@FcQ)43(KHrN(Bp z8{N7jFqWXvmoN}6A;^}X+|G>8OCR@En_T4?Uu8LzRLgmXhMY6vS#Rb%1~I53(s45C z%-krLeHgE}EsP~&{1Qe4nt$M9c?1V!2!wfr`N!AQFD85Cb=&3vjj$l>7MC@x zF3oqwaOBL~R_1lG9eR=)Eu3R^QAT~`x64G$N}Mvx7;_`i(;9E4oq-B?x@gS{{Kz<< zy=NMLWGzT8WGOD50ZefWWXnmHKRr~qNLP>SZ;1Wcm{9)GiJ3g#@ynC(*KEd?)^g5B zUm4f%+c;qgY+FDI57}5#c-A>=Eq>qiVLEz!rn@A=_8`MH$@H}yvGzrV?Qa;xbs(A{I86T*mVUwX^%-_qRPDcDGOuPb3Df`E z2fuL)v33-{aSpK-mKPST|Ib_|Xoj$aH5s-XUwtpD2VLaJd|7872_-~;w9__!C znZEvQ71r{(vSsPv_zJ5j@&_QKx)|p_4&>oU0beJ&Gln-L{9#H0!1W$Do+q$%8_}CZ zrA5THFIV5X(k-MWH1`6aE}R%31R&`lrYNA&vH+;_YGhax=u;Ra^UD1MSkU1^mR36I zwliy_iwQIJO&#E?(enn;QNcn^JNlJ&>!j@6Nn5SxLRM^qI=S`@zcfYsex9lzF>0NG z+6rBhpfF?sCS?jI!4B{kWAJR(l#4siw;wW>KEL;J?OH>~5+dviA1aN+q=62rr5>wn zsh*Y$8_Q*@tC|WSi>oUWZEB^RqXPADH+`H|T=+SVjlzkSt_|0DS5WdU5+E*pFQ1pB2Nmwpj@;M;4lM{C6$;JRx`oYIC(jRxx$+$?p(jal? z2!tDfKncgNOx3ajTL&e=lL$l_3pYvG#A1(Vg)Qrj4`E|HM6-li+nrdq<46am4oV?U)ZSZ~IoA4TrZ2~CQP*BNpCTZtp5v6Gu#7i>Ze9=ZMr7Rt*OmqkASl<#f zqQ(WdXA~v`=O7k^U`j8PE}p#sN-nL(vl2o|e`D*4ys5KIusE?Uem*_-mz zi^Ed@s`8TL1Vc*n#McKqe9rp;j+w9fYKJ!yK%Zh7tO5r(@GE+{+@h!!6%J1+PTxO+ z3GOZ=7*4vFg~$X8UIq$&`}r1sl8XzCvTC|rSod% zIwaQ0yDBC&x9JnJCE_W@EhSow)w!4?I#icdH<=z9a)uiVl8#Ts39Sp2=@+*vmX5g+ zS68ohuwk{6<*|*gv#gPq86=h&b!>)>ZzpQE8LjhL)e^-tw;4>DFc>7txEO4LIb5w( zYRSi!I!bF5O2IW_+I$z{Hitw)Q|1n=HhSW1W*7Z3gYoU+HEUPJ?cKGqFHQOi z&Ut4$3f1lZR79bcc+4p-Zk*F$sm`FfPS5G?uA8`#w3ay0t9`N~-r8t;bDNDbUAubK z6)fPIZjsnA&Y57v?o@c5>0jDR^w*Bl`qrGb(K=^oeY{m^TJ;WbofBtsb3JpLcCFD4 zbBAD97$=2dyhBI3;*wKXv(=JS`8sErcIggsb;mZ_I5@G*NH9*Y%w&9A&_w|xYP6K7 zKweyLU~BEbW5BKm7HoDVB44{%?>2}jt)tKsYj7nNYE!AMPtaDZZ;k^CI@Iv-8wi$G z`PKq`I|a$B>zrks1Y8MK!d+a;Of3eD+M5l^1+rF65{YBh5*3V=jM);kowXG@#!H9d z9TFY3o2+KnSM@6$HiU$Bf#kc}iMl=88|+SrCPJnBWWEjQihq>Y|LXkP{rc?Jx#so8 z56lCJ=MBAHh^WKjLSpG%{UJ|q2xhq*yfo=zy?b~rN}kI#ySlGPT+CS=cwqRMKBaR( zalg+IW!U*C`Xu5zNyb@`=!D8H=K@1iw*m6>8z#b<^M2)bJr2A6Z`U%o%7~@1UpPSp z$Hb?6?-nKBXdL8jMkg}h57xgS8hn%E>BBhtTj<20CtG%m(5N)=7oXFwU93;}p-K{{ zs!liKtd*|fEs0JuBn^~4xn<^Jdqmy^=f2>c36REUWmKjjTWN&a%qi(S&55 zX=q$-*YM@<`)40Wx)f~jr@g~M;|bqE?u{4-CCVO2g(JJ#JTR1+`<<4Z9t#Jowv%F;KO@P3sQqr zIqx;Zig*c>`o%Mos=7w$Us4fE3Ma8oNI#JR%s3n}YyWx(W_?=Egl8#!i^`0{@4xq3-GY9HWK zj3wc>zw-D@OT*r;vz=Hl;PksFrRTyeLaa=u60HI6dzutd}M7sbl zFc{pn3>H*v-}KzT{9JqgGz&9xn$2R>7F{!Bk2mv9y?+hCN#Q-hHCWO|ve|j;-@OT+ zE=3S^BCLi zsd&=@CN&IZ9<_>b>v76OY!h#mio2? z64ZOQbOD%_-5ZiOZcGxfzZMc#PD?%D-0T;xDvS_uAH>S>-88tPL8IZ#)ksS{CQUrI z52SMSVsGXyoymva4L2-Zzq^rL+334`?Ronn#{!aTIJeWx zGc#|HJ3F{%rMAS4>7p(Sl1rGrxe^TR1S`r}MPi9*{eWkAci9D^-TR{V-v^O%C+#=s zKmCYr`scT7)I*Vj)|!r4r?)vC?ND68N};4vUm#%*b07Cp%;mlhM)2MkO&f8*ECE z2#hf8WDY3dORf7JFlwR|B5rF6!#k zokcB{loK#PeCVY}?K|8`%XHzi(x%7B#5%gqEqsoCK>OtO_P2r1IG8O>sKppxMqX$& z}?_$V_w`Z!#y{t@2n<`$xrXhvO}{?wloK&9T!M%UMg zt|!`92-12_8nkG+G>mR;)Nt49IZM=dKs>Zw`WDUrE>s$NIOh~~!N}OmRK)Rl_Y9sv z!?_G?JOc&!rvf6{s3*QRAEkES97Z6^)gGy`u{4sb8^qXT@B#mX3mmwz~ z^^~;5-oH~kF!a%M_5P!`rvU2{P*#Oswbs)=XLys2tE3@)@iRpZ4#!FJ8GkD8396XD zXTRERX`H3x$-jPo-%g}RJqbB?u4iuDw@UmE@g59!8!dBoKWUGM`U*3Evhd!yI9N!! zeTq95LBOHy4m-h!mzWgA>`pD`38O<1!5LZbsk|@%qad0RsS7fe`UT8V!HYu=q^uGR z$tcX66vb8GNW%qsa0?JCQBhXu+Ng>g9PWhD(MBvECqa?JyE?_uFttS}xo)6xKWIgs zo#^B>9aW+U80;2%!Ys9PsAA<b^&0$?PK9CxiNgs+ z-&w+Xd)jBKUthyu|9OT>_5aGmZ-iE7{t3}$`wv(UcKjU|Yrw{2#K!dX5Ed6woe9$X z{=ND4{u9xk+-D(w7v4H~#~c~_shTu;nMk?s!}W?ny#?CXu{jBPs^A;kV71yq+Nv>l zX+8k3!Cvc?^7g^;^^_rrEnn%sN=e#dR7M6abR}+IK`vJIZo5xtj>Kym1I%ckC9Ix5;wbE853i@ z_2aX@6qLTy_nDHB8Ji&1(@V+6VhCp+8jDc5UDzQk?21~5V#NvCTdTNk0zDFk*a>>Y z8j9=#ZqZ4Qi$n|VnYKi>^m{Lv0KSXS-MTk!zB`he!rqkrH5%SB#4r?$V{dT2JMRGW zHnn44m}%-?<-KJ6yA_oWp~lPud=Vb!|7nIj{Z{U`aR6 zykR->J@Hy%pPrtQ@ZPC-j$K##_O(4oxLF*J#)7bNP@CwMjA zPY@xvP0mV=zowj_ui0sS59x5Uw<7NFjjjjxu~j2r;nw85lt{Wqi%l(srMNC%3jKD< z#4By}|6MfPewmPSgfJ?nBK1TcTiKqWLqWV&2d-5XaZ7cZugxo}=$Xwg;gntH%8}9u z>JF2~Y<&nKzl9W*1wgLZ(J72QgjykxPP~ zr0DM27^=Uf8r-riPzB{d_I`H7T}cGkEC8eQq1Q3YiUmDV3@wiuI}A3pI)!>51tJ5? zUXel@lcfi??YiF9FzG=rdF*$T0BUnTYypCMWzFQ$Yk9V&NjzE;#Fg*Fph?|!Th|jz zefFDZ`hG>sXL1Ni+cdC~7%8)|>HKqUa&O2@?Yx-Krx;8ZaoKy@xqJv?ng$F;ZXOE# zcX=AJ;N^DXU7ilZ?CCB4&jsuMJX3_y_p*{d^cKpD|J=>;AIPTiNmKa*RPF#BzjnFy zGG|{Ne)59`-GmmZs!(E9>V>bgnXRb&yfjWwr=jL$fWZ%!4);OvZQUm}&Y3VBl|QP+ zl`T5PFbOZSQ3Jiz1{m!+Rko00L}x&hZ8?VYD|a#mPWeTjW?+$U3&@xLeh3BA_=GSZm_UE7WvL&9AzkW4ZxIS!rg=r7$5sl_$##~uE zn_pZ80eXGm1fFM6`0a+-5o-fx&Tyh|1Kmv*VhSrYobhujn>cQ}dz)E>-c07yWf_@$ zAhCZJ>tSv0w5nm{T)#~-pVa;jYs}d8RQm!_C()Ww8BGe}9 zIuZ@`rME=%c-u_pthkH6fVwBPLlcTtdVOSLzn!gk-)`xr3lN^fwvJ={2=-$bR3Se! z{`xiH7iTSS)fj~%!JA4*m|c=q;NwnW=3t5LyJkPnr);Tkd9m$*UuL>H8|d{N8ozB5 zY=3p$^_Ewt2)cqv_3V?Rfi!R;MmZ)Ao_2WwEl=~-YF{V?h znH`xG)=bwfts+joQV2>f4Lo0&7i3-bMmjNlkBO)-PQEHZgl`xqC2>j&+rgU80-a6h zi{aar4}a{iK~zL65(ALjK7g^+spSFzH6-&$&5zQa@cd%l_Om{9*^|7ylUfO)aj1tZ zxHFz7@9fvhNj1@do_!e%SNPC8T+OmIUUUY%NYzhSO@74@c0BVl@Y?ti=8fXdw?ets z=wK~9Z&jW&W%E^2mhS;gPFt9$9V(H37$U`Y1A9k?2$M_}^mbg^-FI%6)Nz1oH0GzT z{UW%9$-6W#mHEX2vN1r-ghI7HW_*cz3aL*Dp2w4#n~t~q+Q2zBWM4Q6XC zU+N|$vOVgIO1#K{rKVx=nu3)9ROLvmNSRjS)lWIsN}j@HQFB_)HyK6=NF)eYs96%C z2%+Nq?IiIO`)aoSx6%*E%-Qb=P`WhAiLpereR*XE&E!~)xKt6k6#BA3Q~z4msNd4+ z(n~VE2uQzO*2lw#9eM?8o9p!pDaN5=kXq)xC&7qk$yCzMj@Su#mQQaTafL$vjI_a# zYpH4dJ#!^%apMAQ6duE_vfJVY*gjYL^{pSK=DFAbvHskwJSz>7DP4Il)0(bz%onSd z&Gp=g;lS((q>XcAh0d^2TP1>#22-F1$O(sxz*}HoDG&YRX^c(Jnx=m2?WpCnJ zU|YWzlg}*@WHm%;>+Ca5>QQKVeha1bed~pC3dOKIOkv0bZcbMnajoy*prb;}Lc#=! zd@eh8*!eoyDo$CVwYh3&NtAaf9cO9d*;|(}XeyOR3(bfs$$w1~$uoUb(_w(R?I#pD zzRQxmEh1))QVCYmX+->fb>F#j)h$oOk`y4w(>`LqdJkqwHj3lJxP-K>7n(o zzl<(5*%I@z=X3uhkLL@0Z^N7IcE=ue(RR*!$W| z7ouLem)|L`!uYobJ{lIIH=8e-m5T&zysOObT7Gi&mA!#m9j0|nfjlxB>n1}}?oM+^(H;n>OGrA5i=6*H#1SwyCQ){Vruw|DkY4uL>t2B3xbRDp&Vz;@w+|I#9g zy|(cfxRtUmHT6IGmsK`WSdG>``IiWI%F9x3b5umnld3)}Q}1)Da&@S%M0Y~GcUl`c zW{=!EeCV-16E4o?Qlyus0sS6a#~*=)Kovd}E*02ZXNn#Qh3;LzQaoL|j-k*?#?&G4 z20bVg)YSs9h9NeuWK{IQbepn05a@lltilK#t=UVaKGYXkp&W8!SQMvh_8-MYWV>wvqTOVP_;Ws|NcWB6>MKPwUd4;@az=}6VD`7o9I2?!KA2Lk_9 zM$q$aVL#Dj66k@`q@sZA~_#;;yB8&aHAX)99ejTQYZK{y~=R zgUp}=LdiD$of&k#?XmGt}Th}-hj%2*iN zh(YyqVmEC<@n7q~F5f{Hf4>LyXawZ@WZMjAVgqbfddhVxdVAOOo!(ax*Y{)hbZ5T( zqS1S%kodcP+IJi8^S$O=L{XRq5so%>l2Dx?Lr_bBrLnAZolLov{}O>MW2&{# zm7lv?+EBZRZ>Wj6go;9H4OK}^K5kJ;0fV0Hm42d)GZ}K7_SeR#F$09Wg4j86G*k&? z?-xz{KBzkYyp3FGxj84JMjl&5Y0H4=$-HaJnCn{0d~UDS@A`;tB_kJkC3>`{BX(6#J&P2E<(C> z-QAr|)$_%jqy8B|yZ9=MsUvi}BQR){a-Dz=#r_pWFBRHM$ke5a!omWwc@< z4--gN=V#CNUHymqGPvY$crVN8TLR{rYmAFl9wlKj_@pvW?cNT6X9rYGGQR4xyK!hPxFb= zM|(o*wMSArii}i~($j?AG9wI5Fr^hfF-6Wk93LSnQilmK^W@&Ef2z;12M^z=Bb%d~ zfP$$q1j`xVNG4t1qOaO8zhhV$v7Xf?N6ok<=`nw2|>UA&FpS) z6)TAsp&v0H@B~UExEazGc`d&ADK<|{7UE#BK1y|t&7i>>HOr?}pnl<;Z*gBAL6Bw) z#-fEgK4Ok6Ql!I`%tKaM4i)Eaa$d9c*fL>z3yja)5h_JQ;5DOt9Yh-J>CL?6nh*VU ziYTW@Vc+@o9(Wczb5SP) zf#aZ#`O0yFKmy@~!!aKUDPZB`ko#ss* z!D39N%hj6)(TmwLnXpC)`&*b_S!?gBHKA<5lbw3kzKz5r$(*sGVDG~C+w&c4(QJyv z+gh)FhV_kM8W}}z9Xen_zrZ)^(Pm1&e0Ug5vKYsN7>1}LDe%jb5@Q)x`=msc#q1)! zCH!1!Bb~FfP<}0*R*^@s$RJzw3itM~iwszEDK}lf4PO@T1TBQ`5`IsYES<{Ds%O0+ zV{#Pj>=e*WC()X1;F`u{C+P8gGVrB1bK3gW6qP{4zse6v)UuCkm<^U};v`}|i#I@1=nyt_}$a`XJ#x6K?$^n}_&lcF(@ z9-&?e5M$?7cJlt27UsUP-~m$9k_-*GF7FIya>m_iuyIxS@_Zn!$o+%VgU%On%Lw+7X}L!X{TejjK&($ahLTaXjp zL;E0tiy=KcPz+HFJD;rZcgT=8q8t*Z>H5(@CtGLt-qt)r>}H2ub12Ota^5|=7aVmB z+OR7(ACvmw#3Y_w;yXmb_N~fC^1PRKdW2HAfGVy+#^cMY8;GByuO{fW_SLvgvi94P z)EB6!q)evL*WmN*-~BCS#mx!f@mfMP4KvQ$Q|=mAiyQ~=&3QCQLxzKbU?@tP-RZy2l zOUz%bWh%CWowC}~>DJaC_d+D7!;M2Z+dK~Ao=6;i_BRwTxlHAn($H3{g29{bP^g`6 zg)?O#{^c}F_rTeXd%^7LUySGJ8i{Eg9nU!r21ETazO)W;xU|Auyj6*MM%}l$YQk}# z1f6|6y!E9kXx;7s-N$F@U#Fe4ieQEnV-(-oGl7#?T)&D%3tSes8F(9k>Lug(fT@USWK z%NrZ}b|b5f_XfqYl?yr}WMfF8KCt0j*=qUv1*eH6qwXSICWIsQ4Nm4aRKKDx#X4R+ zsbUOxtV!kfqKOA0E%r5cYQ?t4K>E+8I3b3)4LjR9cDcjIlXVrbn}r~Sc*Ambc4U3> zgoMoMyyn1RKDmDMq2%2iX09-6>sGla{TXA$M0{?s@SC0k1#3FVz+~rLeQuyI)v{g( zf>6bt&JF-G&Frv^JER#0s^f#7ZL& z{^@N0PX8C6u(#E6s~v@lrt1MTC3T|KHfan+qi`MbIKU{~!IFWWJvDw~Yo+fOL-wV= za0~=2NzgY{Xpm_IPIB&EjfpVAh*qw<^ zU2es8QMLPXCJZsn3x*f3- zu81ARTgIQT^YZk+R$B`8-IhhK|I;GkmZ7eetT%xb}N|`D@|Fi2+$2 zXE9Bue_SF#Q51p=bun-2GJMRNOxON^%*yjxX&ojrGTP9&GqJzw&T3~lDUNP2FM*%W zR|=9nNkp)yQEG?WhR89U%vHl@YT|ICyk)Fq3bBvfg6@HM39>#!MpO__jZjnY*FKp8 z^T`aB0g*otCoYR&Dv$=@#&3Z0SdJ(StG zbiGQqN`|25?;*E@PNr{2BS#k%?x8XUmtFiU$bnxn6j7=d-TDboZ4SCn@)}b`m?3|~ z^VXBdu&}dDL+6C6c3i^LKaqh)K#*mXmS&=ZrzRRYOBC&4*946=#hGnfbz20`;1PKB zNuEwHXViUu0;F3wtfGUlGXe%abI4o6cMeNM&J+fE1}~lQ_6G<>l5ljVnxOn z>Wf;ypy=;u$swlY!#u(Xzz+O67o^lW{A<_kpz?a|k#rt&(mTA0et?OAV;qcT%3e6c=uOv-O&v~gR-+%tgA*v*=_{lzdSPjuv z=0WFEvN{UpR|D6z!*3xOc6^eDhe9PN7DKr?$d-tDZV@tW@Ej%t`Q@?~GSI|7&gYIYAwv z2gu~05|-+ahHu%cRu0@QX{$#4^olkTpM(=rgUHd70ly4V!k68D1}JtLHx=JFPlyCvd9L891kU86DSA96mXDAOx9h&vH73`gy%IQqQhI!ILHFf%F#E?(O@%W zdoH|a4#RMOZjHzLg>Wd2$bp4EW|^(~7h~aL$f2un?ub@Bx*>cFLu9`Z@GGO%Ci+Cs zYS|^S>6a#Bb`I}LzVTnsaFB3=m1!2t2B5~+VQmNg@Du+&!IIyOa+YxzQz#<~ZD=$$ zyh2MBdGI45kPFKfFpv8H6cE^yla{svC~{da7NUK^v~3C>5f=EPe!hf5PO#EE)X4pg zdjNx^O`&V{wWItO@s>$d^AJ_o8tTEFYjX>%)&lGFYmQZ23%CFSuFy3H37p} zg_e#Q3}TA30525AqNW;d0v{*oGE}-IQyJbSg2ojH*?}Q3MbJLb9pFP7BOMopM@VoW zeeoG0iQpizNf>`=4`E%|F;yFtnu!E-&l}_M9lTgbwoaZ}gp4x;n%| zdM-K3x~>&uEIq{V5i#NLDQ4;IgZDmkG;kUrW?6jWgQ2j<@OWK?8)kzLf28~`-mcp3yXjUbEOP^7_f-~ znOa-zIM-62&>hl~cO2r;jHlpBe8Icfy^lgx9gU<&u;uY8TP=g8__=HE@qg~=A1Dw@ zpY-?Rq6>SJhkw}Ca>?$=NCgOmleIH9m)Hb0s+~%G2Tc?~-#+e~A|_*IXqWO!|MKdg zqKa=mWF+v2s6f{vDEOO1S6QSDBMP2Xy^=N_VzQ!k`yO|N<8+L5Jd5)a0WcJKA@y-I zmzJGdbq7nQ|>GyrYS4hXv8bCE}JWT z0s77OH@pR*gd9HaT-Mv=vsE<)ox3`Ne){PXcm2%fTeHI)DaP>+e4|nOxE?Sne-%WBa{GgjfOQBh%&M^sKZy*Buo z?VD>|95t*Q5}TIMR>Q=UHp9xq*rKYcI;GQ+*6wIR8zO^F)RP>pGG>zpn4Lw$3VIPZ zCClNLIHPWSrmX)HXJQ>^?XSN36B|EJb|P;%JcqwE6%3_z?2LF2S!FMyrM!!#M{ORT zb4c97-my81b6lVJx*#AW!CC0NZhos@MyO$%G5RD`*$ram_cBbRf3g{K+OpE;$G2j8 zdJA;~GHan^kqa>JmAZi-6h1co;xyx2i4$_bI#%H zt^Ws2zMgSOa*@BZ($dU5HMJk2i4uW;*SCQ6;LbVnl8Qp*sPJM6TSf*(N@M_$FY)!q z@JHDDD@Bv{?HWV$_mQvls49UYy8 znA^mUUkXhvOcXe?E({KeJyGX?3PjfpqTG%1EW?;caIgCaQK?W20S_b~#LH{&z2Oxj z1yx!au&0h59CQ(pD)!SQMK1%>B193MkMmEd;nq*}en4*=#@Jr;`HS1s_9y26r8)xq?;2+~2tq#; za}um%gybAsWfL_soYYi)v2Oo`{PgN|>s`;>TmMUHk1o4?dTq0LZNd?s1TE9I;98Q+ zf{4!n6PPhjJ^|0aN9Zz)y#@*A1B}0v>tGE??B_e?P<4fn^%TFk!b3DPZ` z?N~~;(wVC~Gbr9>4gbuOeLVN6xFYHG{foQlJ^M}u+~cCN+TB|+u#r#JD9F_jd)Xb8 z#;!&Z@N?fi@b^x3(8{~eG4a#8BU-mbC~{-FE!`9s8l29pAMvdg%D@@qP;Z~UJQB;D zLPT+ZgocaqVZ&v0E#ok8k#k5dL{BK)Zof=bK^lSf9zlKz(+W24X}YE2oy(v=p*&m( z%rVF+$+b%;GjJF3IO&nVZW3BKWQ5ngk!*AFyR(Hue_)IX>;sW*^bg`Vkk>}5h#RVy zUh2yxWKRTki^9G3A%`CTT&WvwEg(^ivU}=2;4Tf!2_}&Kidxh6Pd`9?eRo6BA2}bV z0#rA>Y$auJOm5qCerSk%!?NL{T>i)uS#ZxNInMgn@Q2iK1vt?Iv?2zyNvVFD9gqcw zJykx+5?zMDrF0@f9gH!rD}6O}{h!UTC#QR_Qgs4V=vGGa4wh~WOH|Tv!Ho)d#z#k+ zyADs9{QQ%+LfkM2HZWmI#EM%R(A;6ix(V+Dd8clVm7=-GIgACJuc(;?_Jxt0=Oaj+ zdS7^(T$ps3r=YM;#dZk*4YlqmVGBcKvE@}(rlNN`GdDMQ<;QeziaM5LIhGPS;lO2rNPKk!JM}ceY@*R2Xm}uL$F#>${}}WPloj#f(*Jbn~tu@ zV$l25Iol4X@A-AXsntfj8ZHDU_S4nj_%Uw6AYf}~_jJU;xmED&#HXk1*YfR zdXkC64;5MjD*}nmdArRp{5AX&w2s@3>7X{h%L;Stdnlz!Au` z_2CFVfIJvq9agFx2&c&ZMaX8_pzZTys~&}c0xrZ%(1Y=6GzHt>b?R`>3}|>(r=MiN z7YjpcqH%qvF4M1E%A|C)*?01|c!YPfq zp{J&X2*;zZd4Z+m(J0GZ!Kmb&e7*%7bf3h(^OjgC7T}Ewl36>~t5Lfq*zSx>q8d7Q zI#FQ=#bC=A)AS5AX|mvy*P(*ZGicHI-wk}LDvWosS6gk$lCal+#PnJ>Vr$TJof92WZwTpl4;leG{YhFqc|p_Gw<9FePmq{4Pb}LzQqU5-Z@s-a`N)>0p~M z;#?yi5Sd`rW06WV>=+hNx$MEfhIX>BM~g+3jOb)Y*O(C**_Hck&_C}^DeHF$B^bwq z2IQ--Nlbp)D4u2vnMf%|C#cwx#NJEQ$dPE@5>PU`4g{6>gMP0jV4dCU4{0U(Wq zv~V*1E0rM-bQ_jm=|*Nh=!yBJtyx@iORSjGK3=*vV7)w@AdTB|5|ommW{AIvFYID5 ztdV%nSGVdcFY$A{CGWb5KSm-c;@qs&))|T2F20YG>u#`so&hgHK4f~WoUM+YM$<>3 z?*~5Rlt@PxoXp-sz-!at+f3)3z)O&--G{OcGo~(bXo)PNJiYVGdEWe5p;$_5v`>-A zuZIZBhwEe`n@+9FW9341-@hB)NW z$_8U8S6^UrGKEx~r^un&$_fUAJss`iy1`QVn=0U}QY}e>glI0-bGjGYuJU3Bfl7Eh zh-Tk~lBoa+2ufP_*wjbid8n|M6zD)ir3JGzY{KdELElzITqM^%kiTvV-bKs-iu0<!yZ`!uyZ+j`XkFtF% z&QDiPKBO~-iFWSTHl4kfD=yZCl_|ix0ykO_fD*&;UBAJNYcornYl^&_Yh$pW>Rv#ByQRaU3B!F2vjlPVU-Xm(^H5QSAA=D3@M}J{T;Y zPhro<`_CQd5C3H!9@<$nM!lw0G8;i8&W!vj$T?Iyv;ud`g|{a<5_-J;W&yL6!E)H6 zJ^(PLUVQZ%SnmwvN^SHqa!Kl%cI^~rJRagi8HIhJ3PHtc4B{@5H16rR8I+XOvc{g; zW=>ILHg^}!&mtfa!lW-Pk&{jdQkh1go!{ErWaNa{UcA8F`S}!cxINr@V^SG+g4API z zoMz4-G2Bu{JjR$<+*CwGg8hEjst9RJi2UAwC;vFhtP>Beq6HOAnk(AgtM|_7?V!3S z@T>kv0FKr@Z8D9&mgt6TrB7=7b>H<%IhT3iwY%sKe$%JyA~r1<`O0M-{WMwVoYxrN zH5Pz~=oYqd$)*%FCQU;E@qjkEpDQuQ(1{&Nur~oUIRXFSWn`zXwGtfnMU#7z#W6z& zEEY9gUSU1G)m}J$oAJGmH7wRfuCLAQc2i6-3o(TmU%F%bwqJ%`&EaKA%{L!{cP(Zn zF7OCiLv=Y5M`7y6aBP)$>>Q?N8#P6SXE#=LlCLp}*Cw7ap%06bQDBT?ffKgQ4n8F^ z_Qr>C*w4MeEA`JcR;LRR3hOJF>DeG!SrU4|+sF@pI{C4%-}j`eWd2%-8!B&CJLA^a z^Ke!AC~BIS1TP%OV6@3xwuIvD^fl_3UWGREbig^k`LkDh)N{uT zuFzdk*ikmJ#TJlE!wxRH*L~pW?bn^Xxy9wSdIC@V71=_?+F7PqY_?f;YS z_&KuHk)Ay~gc8XPL4Qa_Ze2XuVVA-b*Zz9sVWQa=!UnknOUBw;$$+#NQ9> zBmDfyLHU7PZ9j44H1HXb>_vIn&WeGC(@dqCVG>*tFOKXyDS{uK!v^Q!tL;Q z&jS$=Ur$fd025Xy=FLvS6=eLJ;u$l4-VJ(_rqUv`b9U1GuN{R}n#+7$-?IaWp>X>4 zxL5rX)1%Xs->V9b%q|uCj7Z^g6YrXa>(2=#R$HBW^V7@&d6h)}XYXJqhkb{vKe9|d}T3R}odfuO|cO`sU*p)M|FX&>9(6Q2%J{QK8h9{FI7VrVoa7Z0BUO{`u zy)zpPrw(eeMHG=l#vVD0yzQ8dgtSOVs9L<#A~RM*3~3@Ok%DQcQwb*=C}=XQY4XFd zisUi^q}rnNsVa;qlgnu$*24^pk?6eeo0iA+6gtXbk!5&sEStRP=!3hdOfm8iPIR>L zF*XwkD0ns<=-L8d*b=(D<44L}@qEPJMPChY%%Lwq)Q;$gT+a|7PA`F%GM($VjMM)B ztw2)0DUTXv6w7Tk&}fw4iIU4fAi$Xb;^O^qyfEz24~bda0lbCB++QBG^qP{#YhC%~j2#YC@@<${R65&BKAaIo-$ij)Z ziIPbHESA{-i2#Wp+%hnNjkL%yG8k}>ktnGMF()xdgc&4mB^xEN18kQBi74B^<7}40 zWQQRQm_l*^5>dkoawtM^#+1ZEif5Uv>(So#nJ;+;weKf&-aMxq7-Rzkf@F|M1ds^X zEy*J$5gQQ*AZ|7xf;iY|#U>O9Y{-}mw4a|hz1fcw(8)9I=TXUbUc231_pf`!dZ}J& zxxLlh?D{G8qU)kes8lgHAYq6gf?^@ZBT)q83GkJld3%oac&}c2-a$n27riVoBXKrb zaA74G8zC6dV8jb4#__yKLjwk5nIjNL;e{4aEq&;jJ-3}RrLDf%(n%zeNhFd8+ZnIwQ&WhHiEq3sELh`H?(>iqS?(XjAB9b?4x^77_NiInx$t1}OZMUvP zB%8UJo!#Bt-6WDYCw0ctd1mseq|9x(B#_ST?&rg#l1V1@MZ0@cO;uG^WO7JMgvfYR zZp++tM#JFVVG|_0=C+?L>Ydv8%rdt-Yc=XGY`iJT#y4(GXlGWQmTIY_!eyGOG%~tu z7h|5~_)-(dR`u^l(SgeuR{dwax3`<4Z=`NU+uqy0$+5{Kl1U_-^D`vbF55|2n@-Iw zs=d0b?(M3n>w~+yqjsw(-Tl z>sQNULj_SZD`2ryDZJf{?8@8=&Sqi^(cId7*0GjqRF*9OfdGyeEMS3&2M7p~K_G%L z1X2hfg2js%C}6>XhBRof!weyV1_~H3K?MjPf(Rhd1c*r_f(9Ufh#+Bx7|_6Bh#-Ok zAd}loYk1s}Hr$QXW=Pv|NhF=!+}oYq-6WDpB$KCjJe)tYaIgBp-w8(5m$tErpgc@8^J`*qFm zzzq7}qGNE%-vZaO2gfomd3t%${)qGQYHa4p-gWpXBKyLv&1VQDcDf$#qQ5Bpgn^!& z>vWGkbiOH&15L6j@^)YW_n3zSD*5ah@;Hslv}R~~7Y^(zyM=cSXq+SxM>PAm9Km0> zxoHoagAQOIkUM!*+8a{$YMCKjJ9miVDi5@Tz*o6rD_2C=V7wLJc~r^54XhLe^||r{ zedhY>**X1tea`si4C;m(UGQLmKJOCyPd?d<ktu`0SPUP zdNzsLWY39ySato=>+Qys-PwJT2p)S2%p@d8D0~=RCYLY{Ue;yU>a@Ml+sRNS0Fut- zZswb{9SS(xec`Grm09OFAARU8K-&oQIo)EcUn6CUmNbf+t#NK^>v;SX1u^XGS(mU1 zj|Q#oV=EKoD7?6Os#vP%3B);?7%q%^V+AA!z2mMb>>WY^8S%hyEwkGfb&DMK0J0xc z>p^TapOkCh=vu|$!-l}+dgctqAeOG!`&N=cijmXXmvXOpb9q^?b?;`(rHYjfSDAq6 z0DZemX}@>2P+-HnDX>L{JQ3$x4+E``BeQOli;Tg36wVAuHLEcIZEB&Hm9^Au%bvGML!vEfNw;LD+erDCxf>*?nqVsS0yo}XX0I&(ap>e;&e?G#Rf zn%>i%?h4N3)==xc(=}=8r8hX$@&hwmTJCM`k~TB6D$q<-UuL4F;KIgLvxQV0$@J`) zWP9%q0l>{Hr?@--8E1tG%&7tkv>IEri0aVBp>M9d0hnp3c~Rdd>5n^Uoa#WYB&wMj z`U9_bw>b6;TPG>4-@9>&KH&$`+v>GTD)q)}u4WSU-PLn5<#(^SgFU$UcqJ{Er_;|_ zAbb!~GswairX?Y55D4f(M}pL?0!KDYo4 z<^c+XEVS>{zJGi^k!#cSsVlzR&c&o_+S(XY*41mk+?)xEwb-;X1jxl2B#NxxF5JDG z`xde`#SEE)#DjqQ;wO#X_;1qaVHvNO^RiX!%x2)Q8_Rv}X|~3yJDIiFgR?hY$-d>U zrAb|*J!4eUy&mdVnts+;`gQ1(VyZ zs>hE68=k$qoCt2Bt>PuNQL2i!RM|Pn_18ccvX6R2o;~kcaS$_x)$M+7eeauaa`s>} zz)~-XDJfWWEtJ41B;+=0Xlr}v*Vmbu(#!Mh6e=2r=!3LheP|K-K8#T4o9^=m?}mM| z3;2$bONmS>%CG`Ji^b0RVKREfWnO`A*6!(X*^hRe& zOS!|6VAJmb#D*v$jD$MVreh%{^0nUIIZu=j49P}1^FHtZ9qOy8%a(1TP#XN-Itgb@ z^L*xaKtRN9?0^_M8{KRb63UQ;2!aBVhN^?Nb`o_`0hwGVW}&rsL6-90yN@{??o~;1 zxL#u2MBiqx-g+RQMSwAHO^p_OCFsN5m_2xQ1;Vp3fCXTiepgZB=Z^^l9nF(A7#~tI z4O@sl^QGs?iC1-Mwy_(&*L7XSIQ%@oF+AQEZ;I4N9`e{o7X9tiC%ALPyr-iVbO8 z?N@VWL%F$nj9#o_Slkv0QrTKQ|7PD*&YA9d!8a@|zx-)#90NiFtBK z3J?TTnV5M(K!jlWK;*cIG@{3a=9f7nM|UlXDFsL@Kt@Ajbz0R-GU~DWcxREdSz50v ztjH?D;X|xLb9vxVG47d8_r9~}_4Ph5G!eiD!3Qj!Yr*Qt&=G+jctc<%A}4cDzj)oj z)+)n$Lgn;4gwI?XUa{5cS0b0fL?EATV%|Bco zjE%{9N{TtY3zgf>kGtP@r(0;<#$I*TYijg7R>{(N+G}?U&g0d4na}83`zK7-@FOw& zsGAYv)qip9-&(vMKWftJzEg&dP(u{JHlA5CUWc;2<3rbcrxPQ zb?4jR*p86FTvm}{X9^hC9}JV()dX1VkwZ0m#NZ>uA0mP9BNS>=RK4JIX=?ynPk8OW zX!l;2aA$H;E%`Y^M||%6Wea)j@1V>&KH(WEw|je~fqA~@w{H(~m?s&lz-aIx*S%59 z2d|$uo5O8uy}tnTQRP}h6?Lnl^r3oy_Pn)wQsNXxMT8^HvfcHJHN;HuDq<4SMFC_` ziveH@!=7oo=68lg0s(D^>Abq6^93s+%2rJawI*+V_v-Kk@1Yk22e zQgtjJ4~NR_BETH?u6fixLsfX{b+#A0VH4;r@j01%#6gjn@{I;wfxf-3;5f1Uzg+_Ju_~GoJ6;?!)fK zfS(cTeYd;2oby!gTQCsKj|4jC%)wlxZ&b*5`jV(a7Fq)h4|q!*?LHPjuDl%9JD_;0 zU2E2OG3o#i#Cv@Z*nU1kZoskFy+*uz2_S`O(81L>a>KNpPKuE=Ih$igrPC8UAlaBQ z>@b79^|c=NW5;{meJHWIJHUauc?VZH_;S;s?Y5@&+a~e>?S9d{8_ytTnoMqcT|keG zp3V$7C~aBr4`*Tx*=AbPqeb3W zd^!_b?Wf!>-s|q7bCh9aXMpvB2GGq&L{4LyD$l8{t}sQ52ZyW$dwadP)ZwiOhDPY9 zV$F$q1E^-;iqUh>%D~Tx2S6Mv;c=ELr9(yLFEFEbw|ZpB*O#&RC81pIxUR9@E4~w7 zaH_SHQ_WMB)Z-63yFG!^t^wv_-FU_&kTOh)It^0cbzOsZ3LQisiN4|rp7+|Bl~~7Q zr7`F4h}mp1z1vl_+II~OgbzGtz$XCftMHY}u5DJQnD+Z>c4No8X82t80q)0w#<)2k zMw}XNz4GP|B0RywF0bT0*`sy5*DxqN32@!cy?Mhyhlge-gV+csXz>p%@ONUfs!Fbd zs#6ardcs{NXw^k#+{$YYXr15&TUs$n<%}g=buqo>CO$H|7ndpMeeZgrD-nZD2LgDy zidr4|;|6bggk1zscc+S=1MuspHRU|p+Iqt1pzZNzl4I|R*!#(u z>W_P-$0QyU`qtP-klN?q1E{95I-jL_oa`K9yAt;1+ze#!@t|j56`E(a7G@m`MeXk^ zNYu<*%X;wTJ_as_XRTs_vM#e@4N3;HFSsiNcH13z7EH~(qj8CTBzabhbF&NOg%L3! z1=)kDZJLsxIa0RhgPBf2;m1D?{|Q_n1+W;e#Z-t&j=1_&4F<`~p%pH}_PW|rld=uGSWsq#PS)1zNsBc?1=`N+HC8>c2 z=`9n7ot}CR-duC-Lu$)@Y}WVShGFNqwCf;K97=AuH0kvl$NNMjxh9-Os)f zc5lc4en8SzTMhzZNC;N71k22S39LIG;&-9Ep!-+VFdiEew^!XrTg zjUXApSMGatR*XbZyVIib+|b%ntz}~htn&kCOkfK=WR#O=#M(|}deQ*0b43%zZS^(E zl3E2kk2_P9Ky?db#9cDbwP&2)T06c)Fe;vae$)q!Q{%IZ{OAbj5a-7gA~D*D18<~2 z%lTOa1ZaE^@ZtDpGN+usb#}wlnoahk-FsF=wtKn)jrQckmdQ!pv-%q~ofPE0V`>cF@ z=0~vBWV;|{eO0A+kcxdC{W{Kf8>~Ws=%wdMPey&UiO}D$4*7YSAT2^2Im^(F`l|&m z^{bZtAHN^B^_yXVrcnVF4#!%MSbtHwrM3&rA*bTQmO=X2EPy|4h7 z%DgBJ?##>W&%V@qP7DQmBz{jENTS(!MAxBYpW7x60n z5e}rQKqu*UHSpauCPG(!h;V`ijJ2SbK&2QW6dNI(B!EleKcxtMo9Skm577<;J0Rpy z;=XXQ;6W62L*Rqp>T^VVcXDE@3B$CgK%4?`y?-86>$?4k3Xj8n9CWOYokBX{hr$w}!?c-1MVg7q{w)s`mI7c|@yBFSs!=H5 z0OMUwp(>hJf|f4h*IlQI6DlfdhKLn^Mpr7F%FX--@aRNO8HkWTLSnE9v&k>hqjlTt z^?g$}%M!!?g?4YlSyMnjlVYNSzpAQ>l-p$z3Q3R?AqW|B^_9_16>5@^TY^g{5mrh> zlr6y8$VxIhAgq>QXqsg)%HfhVAZ@}Sf|Omdnk}IUlai-XG)Zl?xL}gV+Q>r_5|%ko z6f|0K5dv=m4cP=WIRt^lT^30tw#FkOiCbw4TLmd)mgc{>huYwJa5q^uDmBnhcaHlK z%|cMIUtoF&A9;1NpFfe*!fvwX!ipwaf|Km6eB^!EnOvc!&&hl{F#YxSPMYlK<$Z70 znX2V&{PKdeC|J?(BEuLb!V8BpGrPO$8Oq}A!@o!@TJkbb#pH=4FtVUS1$YXW{f+2K zapSz3QL@6QD@W5zx=RWti9KEhY{9)~y|APu@_tj%fOMq0(T*e#N;~M_=Gh44Xd)~~ zVT5b#L^uv|&Nn9p${IriG7b>yv11(Ah;cY>jBMpq(JhpWJR4@EH`2}BYQU;ry* zE7EIN&N6{SgIau{h8-LuL^g%G(GZSXvcz<24S|X^3D+Wxs*8-BDA05@go;BUJ#@(< z9OVS$WdTyBJTov18I%4bfe9vZX!Wpp_0{LrNAq+ebML7Z#Pvksd-w!OgFwCELI+=R! zs9I$tes=05s|0z?>LYnkj40RJnyQ+1D4?RtK)@USh{Ar0mE%hUjt zG6=%9Uo_E>gE#YSb5U9IDkgMLkT8f)8R%D`E{B>1Un37p~o*Av| z@7yn?2RtYYl6mAV!w5^bT=%}eX`slAQLN0EELk9kktvCpQGQm|_WNHSRX%&F{rg7l zwu&qfR23Ep*#lqO&i>c8>t~6}{6ADa1Hjg^njrv>sxeWEZ~)iz*^@-Fv$qPco_$Bt zQ0?}r;j)8Oj`b#%LPFwHn>K2@Q;w$(?e&bBDH%mcA}nMAA@D#CCqDMPf22psFY1n@ zA^8*u_qKQ`M{YxjQO zB*xkqNhs1xu^2_$ZC`ugug`zaKK(|&fZP;CQX;4-_5?Tk+;`r2dHt>4^l0Jp=F3Ca zO>=&G-u=)CCj;eG5JTAjte?l-*j)WFwo!9=At%7+?M7_n%Mwc`J(5BMJ^m3vVn!w@ zB$XL9%OpvnC{Yn50VL=5$G7fRpTDm6{XYyr7^$=~*9~EbmUyrb} zVct23v{+(Tv4#?v9+op9*-|8mq=~QNr1D?leCV6*$#XL~?t+V)?j0>B>z%FH`|TCI{}e*vs;Wd#UmyqFycAC*ZR*5-q*m}7 zV2{K1+A&bG6%5w>2_)gqJ?S6ox##us1}Y+; zD5|Vj(={OxMP_ISNj5P;Q6-=yzAfu4q9hZ0{om@p4|l)UzrCLFZf@mWWC+Gc#ttm8 zVzJc6Qdq!X$U>V`wXeH1u!t}sASDQTx}c&#B*HYXP(@=E6=TofI}p}aA@$rn-@hgh zny)v3;XEpD!av_eDHUS`Sdx;(nG}^8X+@&ZkVOzt1pNX@`-1Dwa3!Kdgnx>ouWW;1J znI;nx35yLj+Mi^~A@63|Hql!~fsz{8{83b6rtdCUgD&jjD8DG!OS-%E-wlgssKKJ6 z6^x{95n3#kqK#=yrc`YkSftcxCTTU2zIM<&?@-%f{QG$`S%u!6Ta!fBRUQVop|&I^be1Assxz(~Y}c^*<&c*_Nh1x!dMnM?}}7TOMFA`q3f;1K3lDUjwg zfFy`3gb1i*)tQE}iE7B(b(lk0jjM(V7Tm5sa&q1}!@)nh8J^4()bJCu@aTbc4H! ztBF-gbpsN{p`o(K<|IoYHi1Mz1b;D&whh0}d;nwibGx5|!+hrVa?Q;RHdgb7&6mEb za0@}_H!|n-clvB*uGDX*l+9H zp9VWoKAtp~3g&Ux94n5_3UA%cC{aZ0*H5EkBDZwf^uD|WR9efDBP@p^YZv%Z~q z^%U*9aCWS$>{>5@SJ#TOEf>8H(5-=c;t>_~9>ek6f>8KM3nu&+;qcMVh9$N~#g}P1 z(e~F@7Ahcz*?Yr2`{?fe%)0nBnVL3E`*UQG-D=9Y_bXRAyCeIiRN`rMR93I-`0D%M zd$t|dxmESLdwlAw!U6MZUZq&9(`}lYCANI+jw$*mSn9tWGE0Q(nA}!=TI>#fT_yfTA_- zi{5olI$hgTAg7MnyRHOJG1Z+GZRE`zeYs{|F~=Lz9kEd9!ya~E!-Sa(p(V}@1pUPQ z?w;P-r?po)dwJ>KzIDlXw6(&yLp6%}=KSI{j!5YFV73K;``bK0_c8AV{2x8^)XdwS zXv56C*JzA3NhnBFBx*l09hBq3c@$NPc38pVMmh6QWS`rvh>v=ju(~vl z#6lu_!?V;(;h^Y^Z~DrphYr!h{hxh}}}4IGMV-YDVJ5-cmAN+?hSQdQ-z z27gcK-9D>>?yB+v>J?L~>+9yN{1n8(6FV-fJku$CU3~k#k=c#f>-nIY<#LRTyi`~uZo$JZMsoLMZysQ0R2P<*18F&E)tEnh~Y=(i% z%EEAb!+gamudl@Cuxs6CyIhxX&U>K+fO$e7OBc;6Bohf~V{CwVfT~zP(kz%%fT&5K zMv>juO+FM>8mEGk3^_p305=Q#R`qc-92#O}gY|yBHn3d0wBNegm3&gBu(EPTR)LIp z=zQasyM^OqnudyVGX@RHa``J0tGY)hwWDGpnImyANE-1rosFb{T2(=<4rtRGF-TH+ z#9(41ok0Vx9fEeE!MN>+%r|U%K@BjDvkvmum1kgTf|yZL1N-hG37Q4_0q2_r_!s+S zt!*t(f{apG6j7q38C3cd5gDsH{lB|@bIyEteZG1yZ{mBt9^@hHP6<>L2^fILk})C! zOC?CPnv|t9mRr&*LO96nkv7>jHHZ8}sS;W@UEF;6Xxb``DRWn3$uy+INhC-lB?ejO zdt~h=b%Mx0+0b=P{_QEOOby=jtq*HkboFI`28_^R+uzh863- z$;`Nw$y@c4MACITzW-A*B$Q~Pjf+L7vT7=$Qd25Qq_v90irP&{QCcXfN|{ltl*|KC zLI(5ve||FaF8@!ZZ~qSWja3wsP*F`Pl`5t%WD)Ou|F?(u-`cM~<8^)QJ^X7}^Io4$ zhK}bv%=s;cpA|Zu5{4oZ?xdxrzD~C5QE8Sbr9fr2&<=B;i*5DGPP+SDzqH#M)F<6vGNf}KH!Hi#5m#Vj|Cb#aM`Lf)=#dO_i6GIfTL#q4x z?9AagU}8C58EG1)L*5N5MiU{`_hj2;HkPhqNLq!|)>=(hOXKt35y^Monfd!xGesII zQqe`FG;0=+s!b-1q|}=hX0cJDR9j@SYZ^5(Ce&$V8IhQ=itR=EdVIXk&)4fS=Kp7B zvypfEmRzX|sG4ep85kC%RYpe4z_JJ^wGBYCN|G*0Y>dK8;hPjvxmv2I%4OT+!?*eW zFXzqQ-Tzm*{}1!{bF?f@cvYV0_xIVF*~twsBFZ%i5ghC|helz?J=I1m5d?{lh{o8- zLYc%Us*!{c#CC%1)!jB}OHe6c*LMo(Y}=-kw&>R*Eh#H-5n}|Y|3jCs6-d+)HByUJ zS_x`dbl7TGr5eZE9ovT!%#T6OAKO6fiF=EG|Y zO|<#6Y{Mz`Mej7CXj8uLTUERjWg~A!XW#CaV8cbRlE{piXwoT6v7*UFqSQ)Jv9Y$v zw3TB;h@%!YdfQd;@n0X$_I+3W)|4!t<6rdi!P8AdsFX^fsv0PviB%~Uky6 z&YX!|AM_2WT}>kq{RX*}0Y#1SKmeOCzv|rKL+6h^Qqkwp#@@cc%#s z%qA(`xotK-Z^suigt;q;^6wih)+J>PzO&X-VX@U+Cq^-D)0j3RYC2sLs=&l;s(G;6 z85*~P&h&9EON}th{rfgJH*{YLzu_62Y z=igWF@v}2p|AN1G#*sprN~KnmRAnnnQi`UYK!mFM+q(aFZ1LgBkk$O@`<>wlJO1@j ziWa3*p{fo-L;jzIHB0w*SUv2m(W`vfHo=O?h=`7021r;@2owY|&c>V|+`2DI<7(Z8 z4a3fS;BYweIc!a=B3UQ&M7hV#BZd(MM-c|c@=ul~WXzSBW-M7{MUA$xw#`{e)|HJJ zHZ>KEEYVsuNw$Sq1tdg*l4u}6Kfk;Fr}yTs`v22j{de>G+voa;p4VK(G7N4d+K>(%D`SCa~vZpf)%*>gT6(MYuOj^(yqC+9IA{0@T?Y7?+wX4ZiwVPM9wo!>R zp%~1BFo>~BBUPcOp4$7pt*x+CGMg%!@t<5*1}aupD_eVicKv2)D5F_1NrA`0EpA-}UeN8*Cf>{yXMmvjn?k zk{OhWLQ!UlgwYmdYGPGJiKtO>=^~NSrgG&QIc}WmyO#$p z_}v3SPpdeNSTdhZ>Y5g+=&tk{t6xmHwGFHhi5mTHp`TY1 zi+ADtlFTg2GZmEBqSR!@jYf*aY?>-dMU<%2V@Af%C^7R&2uYS|G$qGLT`Jfu0STlAkTyoZ8egh*@oCG zMW15_TN7JBYD@aT#$4|1yI;cREQ+8;P*O-qG=hWO7X{1?kX1y=w=F4f{K{^wjF?;!`#mU~i zZB3ZM!ol3;dHcUiW=zUi0xc!1N@7VQLa|1pX{jk_q>_>uq!}oQ{SGpEwPgG_U6-b7`NlYWSgpY^F3$h6~h)Lo?>&L>7A`JisfMq)nw_9CIfTqxFieR-OYLG1|#6(bP#G#e1d-|Qx9afnogY%Tu9BgPp`IB1rN==Ytrt&Kg*reVyzaV|^E)6ItPEC!Q!U$@N0W@8p)z|jCo zECwVJ252M$zaQTna#KI6HF}x@9S){Bjoq^bSr#xZDIm)$ghC6i8W21T<}jZEmG#|# z`55{=_t@t7ecOC25OP(wIpS-3_7OsEX5JhTNE>8Dw!0lQM%4#uaT_5t8x8 zFt#h2@IC|IUoqx4dOSEG3ceg)Q-Mg45(L9#c(NdXi4X}D3PZ04 za#h_b-D``k6SsGF4myh=78dU@alIkW=p7?8Gr-7GeU!TyRS>5dn$X2-O8J`$?!;X_jus6 zgz!Gt{B(Nre*EKrcF7{lpsdKJj|;q4o<_#;`kgmP0&gl<_;msDoKESO7kp0j!=~zJ zW*@75y6gL^uD)BBZ|gD9FG}O=#o2rJ)9T-aD!aZ1#tO{N=Y zhYhvIusAl0G=|v1U){Jb>X&Z9ufF@91IeDVbM@T`oA|O8lD}0( z!mZufu?0}Sx~I~CE@8j09~}B;&9bc^7t|id(Qggg+uV+eeNW`w&{bPiefQb$tRFk) zKA(4YHs^3V9BxwFbz;gSBne70_e&EsIjPT;dHbG^pWLqzt7q2Vbe<<@@}ZUoY;y4zFlbv4r_Jym` zCRBO9zfHdb-ik_XY(JY|&5}d;TSd0pVKPA^l0syGsELud5I+}gG7+gZOa&0pO|sL7 zkmQZhhXJS(KL9uN+BVq<5MbLD*n!cA&cKiW8+p_z19&@al{Z{r4qjI@=GK%cJYz#s!f)tUUn~e*(7nv(Ri_+mg2i*RA`@QSq7(13WF}!{Qqt}|? z!HRRFqgvxS(J8hNXvS}Dy3(LsmIG}|7{De?fIggIba0W{(If)|kOIUY0a|-S4S7mS zx~fi$>WUmWimScsq^yeFsrjf=!ipOF`l#)&0qgYdG2Zvz4&Y2UUJb)_yD2TSHcT`i zN`;{uVJ>#gkB-}%nNN6O0o(9ES!@#uE@BK|tQ1{oHUt6f0T7rw&xUkb`OSmJ3AYb> zRgWX#5ULyym=WJIQ%K&fY12iT5mpbCFDek^PvWJ#xAW<(IYdtkp~8fr0>f4_rG=Ub zHc@XVyM>HyqF!)zP*Fl7J(u3{uV3#y&ph)r-K~o5U!C@?FTZ$wbTwdW-NJ44SHsWV zfQX_ZcvPxbkeZYJH}QSPkz}_TjmSv_7{h48jp7i3LW#yuP@>pEIV6P0%fwrUDpZfVM19fFu^G@L_$0w zM9w!O5d`HG+-p+j#BN9kHD`OL)H-+8<&vuN%IWWy($)PksfDBNgCYurZB0YB?%%%q z?(XK@@19+E)8fc;?GrwmbLXYUyQA$3Mr#YrjUNw(d>${B?)|@a(NN?ox`yPwWM{?Q zJqOLPQgND_fhis#9WH`X$BEe-ikm`knSL+=LnrHS0R;+pUj0iFM(I@vcvi&~EWv;V3fsYr zX1Qi;0qPHmBUNFBu}H)n#Hex*0Mv$@j?p=UKq@Q+r3xUeT^3%cl4=_Jlo(DDQQQR* z>EkNK`OX)d&_LsNQV^8oUBDqrR1yaq-mD1+DAGU++p_m}WPl@7P)h5rq%y)CW#?Te zahu8wU<7Dj09yVmc=aK0-4E9JlWwV{xIrYac>wD1*dxpU2yg%amv*pslHI|tQv;@u zG5Xh{jle|6s?g8}R#gMHSpeOnY+mMM43;S7Es5R>a3QyA(5@~*ny*$k45=y12^3F- z4#*t$sSFjImg0vzS$eS|d$u;IHr_RZh>bXf(__f% z8f*(SLu5~M5h*mPK_WO2D&m#cN&p%H6sDgHh*~MjcXo%aRFWpS5>$~b&C*%hx=@Lv z4YHD=gyJGv5z%z*Hf&VHM(d{OTdGA%H8)PPWwdXYL<2Xu%1K<&4^SxJ(#{naHDCip zfto3EebQt_u}2(%BRw7uUPZv-2p-ZDTgSvM73cxd>oa#f-w)cP3p{Z(@gK+x%+H5p zQ9r;+XB0xoOl3)hikB%u%(O7s9Tc;cn98F{kmn>Z3_zmcLaM1sqN{`;8t-xTuUDV% zj5bs%#nMqAGhDyOe)E=7JV-(xA1bR*BX+e5t*+yFItEJuM_s{;XfPrMFbg13iXgO^ zA*qZ8#x!BBmB&t)0T4BS>vtkagCsCE002oxEgktztiv)?*qawsybrCTbk*-AS`8;xjJ@@>ZC-Kf z7q4BYyTKVG-!lBcu-%GFDBHcgR`2e=!kSnphOM=jGGHjgRbq+;$pU-n@1%kMe*eG2 zsrK*F{=ge!{(s&7bV-u5O%x+DBrQ`*$PzrG@C)GFm0rWhE4xp(xCH26G?v#B+WtuGf=aEXDONntffMuk;;w{ z&1uyGkX?axv*5&G6AGWZ-=BOOuu*|Hd8JJ;6u_-P`Iozg70HMgBX8F>TaUHg@2>N+ zy7Ar=^?AWum{ek=>yGnk-HKKq=;Y5`zPl%E5XDBhN15g8&k^GlRIRJu-{oI_(@Z2Z zlL?w=%_P!EGke;$^?rV9Z?=Dj=a~5%@A|-Pw*5a3Sc=feMMbAHl(LGdU+E;0Yxi#a z^C(T7-`Me+Vb0awY$P*Z^?%*pYdAoX9>^atWF%EJq|}mYMT`3UmEG8N$8p}a-D5kg z#xqeN8(g;{ktQsrDc!ktH9{M2k-qZiDF2Ze*>KDkrCOZ&}%XYQ5qp5Vwr|y z`uhA!is$XNE}uPiySX14O46-fR{nhKc6SeWx3RgV@k(hmT_ek$^Ei{0FtVJxvlVGP z*;7}|Zmrh-ec#mplR!;|EU|+OW>YfSC%*aAv-L`SYsX#R)vIl__58G7&XDL(GF%Ef zQ(A?~64IhG6Jl(lIxPy&xQz@%ETZXYs1;Wv%C#dzisv;|RICM6iXXZEai{&spZDop z{pP&8-dFkz2xf*cpB+1}Mcv)qqjuqBRC3IuG>t4E-Y{+te_)%5u9K+K>)U0!6_WK) z-TTe0&aceSnqq?mIOw`DQpr}n^cu>rKVLoO*6da$-+pt7PB4}b<@J|4xSXxMyM6`A zRo|ZjKYii$wrl&J+TnMeD;~k5X(^ z%loIC_0K*4L^cEvKwwbg{W<2LW+)=Bw$Kev7$l|!M=rtCC^z%{7f$U){|tY`F#bEP zA@-qA!*njNpqG5sp{+y*g_c{^P%yNcg+hY)Wy!`J)g7s+a+AQ5(nu2h^pozD`S!nA z$}X($MH%{{2}lGI@+hO9-c;3B(?4Zpcr!uyBhPTxd?pA2ApZz(s+CQ23sIER6+|hN ztde_E`gJ|!t`frxPtp=Fq%HK(F3qIYQBf=z7nvv^YG@Hh&9?lji=J|8n$^v9&!E2| zugVk7Prg3@e|gNkOEW3M5?5cMIsR%MIUC*Sq{G0``Silz%q@H$^D`D zRaL5%5hig|vL&HQE0qzyamcJ-qy>T`hdi?h?iLkr!sTE0@%vEC z8D&*XkTpEs1+s)s>O1KqB%eq^cU$m~^Y)9MI9&bBW`AfadFJYhN?45w(iD`_3TcT{ zhCTuMCo1S zO&6oEpuUS2-R}V_^>ZtI-*_R%zLV~|1@5? zczD&hwWAfg@TH&Qb3j~}KVQ^926&w3#`O2ugvDTA)UCpPb=2tTAkRV_WReDkK#)*? zK0>QJ%;(+nRcB92<#^V?YQ@O5w}slZV^42Yy~}p8>$zV~VXRwAwoh2Z(L$)vHAGd^ z)88D_(2x=I!CAU~mYp1%xsSWI@40E!YktX&eZLrKww2pipBlO}{v0tI)K5*LV~<~T zZ;#4n#mj8CzdlQTVSRk3#8xa4{!sE04LsH^?&edw`Zsd+ z)id*tr0v|y6za|W^Sh|?t9O3;kX!Y{uWal)@y=K`bnRHo7qqnWqSMffjEo3r@YcDl z_;u#Eb=LhicSXKMdO8U_QpKg*8`!e&RUTJH^w&}BtyqI~#6UZ5rKwrQbo9Lqt(1jc zC@fx%3=qW(sw;jzVk72v?)Yo@9O+v1rhAjMys(M{-)*69GOV6#X~q(M-U$Zhhs5{+ z*fRst_L@6=()l@!Ivb*^+TQi=x!-D}GgR3xsw5D@*<$JjNJZ?ol zHp%ugp0!3_yPogMhC}QRd{)fm1r>@_6-U7L=c~kt7#5SDAju?x4&6z(vIB_ej5hk) z@DfG*97y?8x-S<7)!GukVxMm&tZLyB;u~a#s(k3y{Mb}K7G!|#47Kb zB7Ix0qCl*3Br;jk<&NGp6k;?%&}vb;>vol z`S;#DbA4&~%RdU;`R~t$hvgNIHvK(vNehBNvl|r*Ulc0$dGP|Rpt-5+cAb!HwTV)B znS%vnJ9A`|6vInQ(Mhg|8%f)yAW*6t(%K%dmtbo4QUHjsRjJKQW;Xb@#n40{Yg7O! ztT3A(r7Bc5NHADz6)R;>u_Xqg$fXd2%Ob7P@v6hPYgGeFI16=@kctA#qK%sMycb&p z5Db_NkeK5q0CF9OumMd*h9eCmGKnTN(57-8Wdjt5t=X+mYD}X=UUHoX?ti>_%1+EE zja4p`VkU}SB%|a?B_NQipPa4z57m!=g66;Iv+T}q)#q&D2Z`bF5Cla1N%(kmT4gOEB}z?NnyDg5 z0TJRyvo~ok-H)dKVC^FN-`DRs+gH2a?yuj!z1rN2KwysUyAE}hsFiA{oY^T!moSwl zy{hC!){AOatM)gm%(s3|5%J)s_8QbD@nt}V3JqBu&<}9*%+sUIlUfpLwS{fb0*SXK z@QXNNs~bsEa|84Pq({pxI4?jj&Wjtp?ZwST#Yn?&0^@-Q0Uw zuN4}NjYgv8+}J8HqQo4xG+3mh+nl-wI}FVsM%=EI!sAfN?%_!sxIX)Qe9zxBW4!P% z>ql25FU{|DOP@`@Jnh63UIid$_u8fmME4fGUvgO1)=1kvZTq<~dB$Mv}ahCe;OwZA#&LQmhAKT^i2i%lN@#TG@C zfrP-)gFz{=HudK}ev-qLvHeEO;Wj(Tsb+swmxFu4VSf$7CYcC9Kck$$JTBIGn-`nNszj`fwnf2t}U$nEgzb;o}`cK3XQt=?7R|rDc zAyD7EG@exskLYN)GZL%gLy8@`=}pv!%nAC*Jv@WrGi( zL(d%H?Jd5y=2d=Z`~5{kMIWjW8kv+zg@~&t!wp2ru|hc+$|I=oY3%qIKR?kF$MsohVp^eArHZFDOQeLQOC*25;S>Z^ zT&k%Uuuu-y^fmkJ1NDZk3@Q;Q844SgJqHa*0i2LfpmX=d{%o; z_pDFl6{KjYM52<4T4`BN_v)*?yE}UAb61}lw!1IxU)Ozew0a@%h>Efxex*${NTmr6 z^kE*V7=?m1-^&NL@c(>!emM3*LdI11P3B>f0L;3d+xrN9Jj`-LE6}px@IrU^)PdzB zsS4NG4Qu&yj3kwcDO5y8q$2NspSRvlf1k@gzRJGb$DRJv@$MIX>9qKSp(Is7GyWZ! zsMN`Sz_`TjNJK;xstAxML16!Ru4F%pGb<4tU+}1>NAv~55-iTZ z(uP=8zSk=~=hj|P`~;&eSs-;j!vgroX$dIqO9FK!M29j|w2*AF$Xg6evT!t6YDw&X z9#6+lSZ>?3yBve~7$wGNSsEagl(hn}(jp5PE~YZWSu}$nwuDK-Yof;%O0ZZAMSvA@ zp-v=DMGP=fjIEg%C@c_xjY5OMaAX9;!=adK##oly6_LV$CR-(_GC>W%gNC{$0}w3+ za5f{#X|6n?A!-cfSu2n$ASVoLq$`)ljzTzb-Oa)9@y<~D-i` zXYM+2@R?2EZMz+U${4gl9%Dv^Ff_%EA&a*@?|cu(*gk&Vfa?0B&oEbc@eI4G#BIwB zFj1GH!yI&l5s^Uv_-vpun4(e@Z8;#65NBp#A_>efD9b`LGHI~Qq}qZRq)?#~Q6`DQ zF+na=prVOkb17LAN~u)_RZqcRwMW(}$vgc-pUHkuZ_1My0ODITfuo(>*?}iJP#`HF zx@4x1JwoNULc5&3Liw!llYR4<(7f@*#yhL=e(?8&Io2KVj7${fSq`XTvmJV~hr4PG z3Q!>3^V-F`xH~oJqOPE%Sh*F@shvZ7W9<}E>fYaYd*1hhBiE1UUh@1qnDRZZ&1c>Bz7fGT8Us?z4y$K<8}@PvC-v4D-&+~uJ@deK<=!fleO>G| zF|VT8zG84y-xxaV_c5`elV5(Z8`-Ej*!*uOY506*iKu(RH+>#cV_#9{u;?#)H|+bq z?lXQSx~a`6EghD!#}wXcbuWk_-O{V>%K2Z0Y1=lXKb3OZ==(7WGx7JJ=UmO6*uN!g z)HZibr*w9)^kS#qZ5~2yOZo;pd%DxFT2&=d&)4JWyh;Wx1f~^0$SQs}ck}MNQo%^{~AFv@=gX|bA9oT{hSb_*$lV4qy zj`eO?CWg0QgptLMWo*^BpFK8&EbYBq?9}9N?i||S#HDlvT8^|);_qu;4z-JRj@j&+ z(LLS2oWc%0!>eV{ufF=)K)<_Gsg)LeKAqk7cX!frgBliU}jktC&|gz0>|PnQq12gU`yiCRKJw))$en(AqsI2X4q6% z+<78Wh5EKkRTP=9O-oSUk8Qr^5AUCxX{>R}#SNPx6O5P$>vRQqJ-m%o6W5V-_E6tJz-VCz3j!;v zj*{$b6pNj87K6$S?=I{0_h_+bAeK#bWyYFaxj^M|7V?LC)$awPLniR`<;OWSm34$~ zno5G_b;aLK8l`27_jZ};7Ic7Tv*aWA_ey6bVe!UM2p?5QfThQ#^3OZK=8a} zv_o>yZmUDxkxmnKvO1%NX?P!MLP8Q{rd#bXtGR=mGC{>b(m!a$r!|;4# z!JYSsqGj=7Uk4h?M&*Po(W3(iFvN1S(3MzNqxLdx6Bx%(SHr{e(|xy$W8p1dhV;p4jn|2m&Vv77zp?NC*gI)0sk+ z+a?Hw>oS*~_Qu_Np6&~|t}qV*kYr3E0wJ^AYU6AoZJt46U^|8kex5;$8+dQI?%`Mp zRaX0^+X*m`K!OVhBV`G>^xq#Xpl_s0`%j(kPkZO4UZ5WLMBPo(Rzuh-3ZhEFiXj5L ziEX|Ou@u6Bgt!<=MI(69jl6}CF_#<-Lkx)|qy1ch!pRERX*Nb3kg*{&#ES|_Bf!IM z7FaH}ZE`6j5}R$3NF_Gf1-7Y?NgHnoi9Aj!sfO6pHHamH91YV24zOERAs$j#LLjPm z>LmDn{XZYKx4N@h%RD{})J?t5hn;=5!#j_BcIjiUw~qanAH`Q1UrWpCrLFwu)x2O) zAF%v1jY;O*8{3&aHuLYJSTX`ML4!nt;csi}ZRg$heehTD1|8u3A6Pbr2{?*WNnyZo zhQ<%hVRn{3SGN7W&bAQ9&hw$`(#DJgkd8HQ+Aod`p<;-Utvoe1%wSi#W zht7~a>(15r!ST(pdcZ$+1F?M@$|1hWklz}T8qiiS3}ntV-P?4NM;qA07?5!TrlOjy zmQ0ETAEHTy3Ol+JEYV_kWU{azXc6x8)8(We6~r^4$W%$&*;!vnhzkWul|ofgOwClt ztfEM^N@65wYE?3o1!B#rT@^~yh>FArkd=s9CP{RWQ8Gy+NhKsw3)Ta@IP;g^U(SC8 z^@cv?b<3RY_<5>^#vc%$epnzPELbSV{IdxJH5Eftt*VxxAf4Tgl%A@RMU}A|X5YGx zMgg8&$uB3m)>EQtWc`{LI+`Z_u(>DWa#YNq>S(gBwq($&+pH=`p56|{Z~8o zh;)e&Ws*fmS1Au6{d03N`s~l^X!HIAME7Rym%Z@*h)93AWYb9$d|(tY{%s%d`~3fW z7XL`JxrNo5J>Xn4W~IZN{<)b!t@HJJ0#AA8$1<{Dd!K9i9*L{_Kd*FEBS@=NLrG{s zR&vNLl0>6lpVz+qZ`1kB-`@E^csHz1T#6P=eM~Dt}oM1Tu z5+3|$Kew_#R^fh8FElk`&vb8df5zdQH6__*)1TUo<=C0}z6eA5efiPud-yBOr}I@v zh_tj&uql+Xnvd_be|uka`=-6C@7`|e^T&YsKvVG{hwrGNVN}pi_7R9IfQT_sWQNKE zra#$|r}6w34c-;~g#3OgZ^@w7bq;FpUT#m3$bUbH0IN5ywT4x{e0jUAZ~O97Oc_*z zE>uD-R!N|1BMPj_<%EH0MwF;^Xj;-V%%s%OGEG%f)GKIWefQzdbM&6;xu0@=t!%e7GYKhHSsdTc9QAI73|AEAdiQ7WE z6N@@g%RtzQvX~U9S1Ka0l|OQ&c*dvqrA=Hr(^@|S;uWY>65i+Et09#^>GU8S{;*^n zwA0+bbv}Qu@BKl4xn?MZQ6y@uFo=k+D$hKZo_DJGHkpMr(eX1=* zhGXNhxxyw~yBg-Xmd5FhFre8IK~-RWH-#U^kGk#Q?vu8R$&YeofY z-G&G10=Ru4B@>g#_4|H%eSKfHD))`tmrI03NQwvo0!W}hui8HDHZE9GLjv%8D2KZ* z-d>7z%AO3CdT>DyRfH8_D!B}ZPF?-&&KIVN)WkFYG0n+VToA13Owc1B_WRQ?#mn99X`zZ?=Xi$Rwxxc+aOr@W*sBHJ)<_H#6 zU%xLGJFdwkch=px(ikZmi30kVCWKwez{r-3N?!TYI`SAJ`ZkX)eqDSpR+#VZV=`Jc~C~E#E`UN&76bNAY(I}AOtV&9g@nw*)$ky zEz7KRn1N-Y+jA@^nRl$y16M%}HpQ{W-P|b-9z1s4)%SMmw4ZyN9p@_$#|W%yK*tfU-M`7K=j_WEL#M z1Wp2k%#p~8Bp4P(%!Lz|Zts!y>P1Q5$G&N@kgXw)fMkHNz-pK}3kt>^9v&MELGkm0cDAT{-cmvD zA3lRZ(L2m$`u3k#fvxh%Mm)EAeWE?#+u}P3nmc!M-gPOHljVH9qjrK&v8rnYM7`;G zyysoWxBGYWtWIaZnT^r;rXC1>&idRR4u3oNm@gDtlUD;>SucsThNk>$KG$4N&@0_F zfo8G0^Lx{~ceB1do!2!xL#wOo&91@s&y9T!Bip|OjeHf~-SfGyM&Z{LOcH8Y>TDkC zRy*N>!T4JmI6?5heia=D*LC*%{;#)_Y0S~pN*q&=`JVfy*jsw!$K74bZfnlmzHK_0 zs<-Q}obLLm_U2>h&SM)>b7R-tD(o;i3{08bkGHw0nPek*)+kjM-C17G5C@KC0y8k? zVZa0r?|t2}uUVFjew}CDo`|V0Ic?`;>(}kbBHALx16|%jId4|grHijUd!0C}sk_&~ z)#${=vaKrIh^W;-MQ3%oq!bT_pk5vaXt9*6(u=Kh3)hbCxP5uj)!#i@4Zh90bxE?( z125%1F3@sa58}nalQRG_3d7@XeJX048?{6=JT~xdC4{q_hUzF zZsFcV4%iSAc`SZ^6#?be-zZa2!D}e+NUho2tOFk=qx%>CSDRoW# zhhFX5m0O#2_3D3Z^KksMOS?Z(&nQ0Ud-vHTI-~X4mnt{iDxb0fWS=%M_0xVvW_`KU zg89|YzUY#g2*5>+7$AZVgKOm5e|OzOz9OH@Q~HQqgQb$^#ZYiv+z4Vyu-T9^ONLKw zh~CV&t{UgQYkMK>QdQJFKKUYY(K3n&FFGG>+H!jXyo%t@X`n4w@C-2k9F?M3Uy4$< z7{Q(Sst9WaCZCw^a%E=_fm*;q@gmfyk8#l^l19|nOlD0^kkHqMNr2EHVN;BQVF6~z zA`4&-PC;&Ob>s?Ex4( zG*X<`@9E_~v%JL<4HcNG7>P)PXjw^AtaO>rpLu?MZ!F^uS($bAJm2^6wm;9~L{gSm zYfD#+XCgUNk&;dOt!roZ-~;i_@Zp^OlPbQvh8YU;+n!A6VMjkD%b8NAJ0S~&{*p<_ z`@e!&bqeGA_u7?tpSyAX-BhY5jV)AZMu94~-#%Zfr#{~|&wGAi!OB=1o`7K_vRf@n zB_*_~l9YtWkrNvq;9t`<6HWSTKt)M16Ro7QP`eB}YKTaM=$hRmnFI)!MHGrGMFkNN z_a%k_*+;YZ&F7~-yM_|(`+!~lLi%B5Os6dJrt6Y7IIBM#7vV?P)iLcM8jc9Qd(e&7b$6xY?97uL`BskmTIc0X(e&V@}OK7 z;i%v6QTH0OFo46$tzEZT=J&OIQdUZ`l9gpiD@kcew3L-CQp&PP2LD(4NWzs!k|_;T zwBdqPDynFjR+3al?X`i5jmpTHy3{U($hRcPT2x#~X&|wrR8kzI2!Oe2=DAyzBT5x! zU(Xlk*Ou8XXM=b6(fFf!o*Vsie$|@I!@^BI(Dp)00N*)Uy1Dcr51<#{e3vdao%Z*3 zefRk!lFd_+5mz*mC;9jD@96#f_vO%>_dX9fMx5#0?$>QF)zq^`q@ojSf0^cnW<;Oh zEya}Gw#E=-7)UHc_^+@zv?%`5o5L^)g9cR$L-mtq_MhL{4|;pd3q3&X)I8@iB>0dF z59#0^bK4VGKWq3F8>FPF7>GV85K;*sKddfs?B^X?yy6v-tfGC=j2!a>${Va?c`Y<``fFNW!1( z)c)q>&2y=SNLj|h!hIwI;%DAKllwnDeV>hg1E!IxDJq(1X-N2!~|u4Q&uc$*+61JfF(6;|40mg!b@s+kG z#`<|)TKw~q#)#g%`S+^b@vqjeb?5JrNH9!kQ!r5*Ae96r2%sVgr}yg3*KoJ@-dWrJ zKE=Me^RB&Xh)=Pa8p$xpFp(s%VAPb7K$Alx!z7YS5>isZAYfn#B$7~MlB&sTL7>|r zWYwh7Qduh{NkO;bM$-Tc8b|_HnYS6RkmpEZG(ZfU-QB?M;Snh!K>*I~I=e-!3%hFM zyRnrs5U}hMB$lk9WUDNSQpffA!|RVrz{)@{XW!U<@<}up0j~i5!#wiIy;WSJ&WLFE zB$RigDCf2wWZ|RR-_^in{yt!_0g9qcXARMN(chiagPil){^<{uk^qSj1Vn2EX)ME1 zRt>g;YgPc({nHsY%*N)`7=v?jXu(B|xN5tuvmqI3(U~Mp7%Tts*mRLQF~V`too0>jUB+#UC>GXuA?_k@4DrffozU_p<=8=V;5QV`(LqV@N~VK*PhNg7hSD?G!jGLN>Z$nQq+=G z$thH+Rhf`H-7hlR3%IUFo5y!_S&@5HF>zk0rJ z%`biX`LlldIr&J{QYU=AlOQIkUJEEK%SFgp0K%9cJT!qIa@@q55+a&F+ejpasdy1q zilBsOb#!WLTFSKsp`lG`rK1Ed?mhLrm(H(y z+cbK%@@>iPyR0gfnP8PMfwc|*5-0{liGa|;umVEBNER$p8yM(R;S?+g9F9qu9hoo( zWU`E4hzQ9H(h^g7fH z7Jb_V=G*V1K8!wfPSWXBff2}J70AmGGB`?AwC5>8?FodXHC7RFE2N4M5G7R-f~<^% z4q;>)Hr7RArV?Du4J?0U-u|RJzWx5c!!MzN5SguCJ3-Ti@5wK|Sz<4R4n~$RM1U78 z?w%BcOMUGN*cS)e>R$jeU9!)d3RDl!X8Y%WGd_Um*N@?TY$Vy;A8P`T6nA8yr@b={ z>dAy6u!B+#r2yXxK=xeG?|Z;{_q+P+4NvD>#}BEsLy%iS+HD=`5LC6ZrshpmaAiE+ z;%6VRJM8l3eT2IyfPQLkzi?_G@sCBTMx=s8U=viw8%(#h({a`masC^5tkJn&W*(DN z+Mr0Imt1WGhXZtu9$nGSk#3X@-1^&J6O2q()%AV5%`M9sj6)5LA6Lr7qkGq8>HUmB zna?X}f~M92ZEY$jlrZ{d)QNlbb`QHjdz!J%Ii$&~>4wGgr#UNjECeuX~$T%Sf4~N6> z@F4B{I$Eg;fWIHagY*=9r{uL?)%tG!)Xs~rKgUdGcVbABd|Z!Qe~We<)6atae|vS7 z&coFhjzwr$4;?r6-STa>n*R8|zOLRqcZTale1{<#ue0g*-QC}JcM0cpOwj^?Kxx+V zSVNvw92eV|a*l1y;3dU&Lt~19iaFv&Bxc87jz15r3KnD0Huo^K#uoS)?DFC z*@BtfNM*H_<=e%egBbOmz&yr7D#XNM$W}}` z8e!JDOzk3;G5T@1f0y0YZQqq!er@^V<^oa;p_vONl0iizvEc2KSS?8TKpRYu z!39QJdAW=P1OPB4i4Ee^f?-kx91_ckt#e#4ysVRg0R(obd#>%wypXD`nVFIkFl!NV zB0hb+Q_prjMaSH!k#9Y8HKCx!lQ~9Z=2(YHrP*Z?2H3b#>Y3Pc1}5|$JS2+INE`UwAtO8F<6lWhL|KE zH8`;iOdA?>sAmE@tKJ>V26He6QIJzD2s=ZuHYjE9qB3jD#FlAKoFd~$kf5Y(OoXXK zapF!8;6d}o2qrE*r(8ZetYvY(!OHsIZa= z1b|Pg`S$yB@Pa?&8MrCc-NZK&#lKgnWhrZHrB=yglB}eZmA169RM*}{G9bw{wo0}z zRzfYcrYUZ`HN3zN(^N`?35I$YVXW0wNAGSLaMe_ki%_k7df#^0UxS3{Q#()6AB9C2 z#Y90+R6{;<-rk*eM}HS)aL)YckFNUGBz-W$5k@eQs}z%J)hxEMR!J0KKp0MD8YII^;|0AH%e~A4 zq>wdT!c^}lHIS*tkl*j$yXSfNfTBe~Q4v*F>+^lQyyt&oZTlq6)_8hB2%{j#qQ+0i z#2BKmWJrRHL-)_jY?Vp+Tq4kzaetB@%VrvhyZ(e2vohm(QRoN0W^yx#pGucRP~h$;+K zV;C%AF@{wDlzC@CtoZ#I8G&1c7l0rDUJPR6wT{o)10Tk`J))@-@VQ=O$s~S@GY>9Q zy;W~M#t13`EMmb_Rwj)1-z)cQzTU%}<%7$jyHFl|@2q1|H-*Lc|RH>Y@S)#8{|^DSZ9*@4Bkp zmAyLql)U*ARa9a#w05V~U|HvxF#S{A)S`>RPuiN<4OvO zqA^w>v)y&w`TJh<=|@Yg@~b(n?^i0f@MKj+ZlT01#*6KVW1^ukne{?+5UkgX^WG)g zJ-wcL@kS)HqY)^em{MR#OhN{tz?aY0uIu9de=jw9`n>skeM0#$qVV5gzk!sU_cbTh{kQN_Wr4YuNjP;-Nz&5r_y2EUHt2gDS|-z(6>TWjU8B7-3}w z2@OjIIvWkv3Jxo43j)Pb4=KbVa;7B$hGM`ZY-Lg6JxR~QgdVqh+uuNY=f3E?xZYgU zyb~D=Gg{FC^#YJbzMID zyR>}nq@Al1(c80@E~5LS>g(Qdaw_-hzWYo2c(&++to>`ZE1%Qu`-gXTbH6+5pFP`pu3X#Rsa06kX1>9lk9&K0 z{lQAB@~>paRhH>)>hs0E7oKmYj%&*2nW+tgNJN52G6&vzP#P&!4AU+O){OP@HC2_? zg9M)35Orp2=W8i!?_qVWRi9Dh9@(Z94)xrv^cEYK?yD}H%&4zlYH@WQayuFbun^I- zFcD#6J&px^x{J=`){Dy5!n3~D(O8em>pq?fJyBxr9ku{K)aQE9)K3e$>Ka0n#_Jpe z_lK7G*9N!lB02`S*Sd$k3mC?G$6@l^*txeKkINLy z%>YIMMi5AmSTaTgoEz=kU8kW!XqpdpX)2L0A{iiUrkPZ7?J263qvrcs>3OXi+F98w zl1}oPtBR>gs@kQY%lPGiAL2gSuKX_U68fsbud?VYDu|yL_+xS?AB@Q+;PBk2ACnR$ zK@mqKfva2Ur(Kx$S!LDTYe~9PPDykxpW@Oe;REug1@I4-z0E9E%}GY~G#Xb$UvO@% zM4Jh+rnI#W0bZE>;j*q3eUA(t^wu|T*Wr^Je)}v2#6Vj^uzkzomOZaT=8 z6mf$d%Am%wXwnTHJ5&ZmlZK9D%yLAeh)_r(rdwec$*#6k%9}E~ULGbuN!9S08Jo~=qWADBN+ICo8@522@o??6egW~2lNRh|( zo8zjIf%z4jPH2HMqpG^ugL*DVW@kw6f*N7eRQZ7)$@=T=`_ig?3_~ZrsY0QemSe4e zw`9YF5J4w=#0$e*8iLTpA^9M1fl_HSwfL|hy!ot=!Pb&QB%;U&y-cHo^g)#2N5a4fVmxOPOfZBE0aq^m6*f`>Ci-s7n}}eUdvub z0>gFeL49F<>(MEc?>-6@g2;%i@!aR_b6V^B(<*sbZ%;bP)ktX%Nk0;i5oFxeN!*9o zf%~){i?}AuYKo%SNI$3pddnR-&Cl5(x3}_Z?$-?ofe6tXC5$1knlwbqKu~-6>&Ne` z;co9mwRgSvbc7F~G$O@S6;x6xD;6wSAaM_RRH>ggEbU3?Nerm@c1;XRsqU=vRjC8y zydqslLLRz*d71=rf&SCrNFabWEVipFEHim~ zqRnCZN0$!uq8$qZpcLNd@3TqoP7W*mK24II~YEJL2SLH9Leu$e#!lNkvk zD4+(}j6F<$Mi->Pgkhrom#AK$Mb%Hge&B|)r!}B0xF+}epGmQc0YqWh-`{!O@6LPJ zUr%h=d@8F{rN^#2)gFW=!H9_f_9pea0;#DwFyC6gYJQ#Bb3PB=YQ6CF{6dt7#bAhv zsw`;cSMJ~3(bB0d{40ods5rxqf!S*Nu9FD}h^_hR@6XHgd9PUjUrXNdN_Q@#^YlL0 zZVca z5v-#^LhLpZPD%zwMa>qg5F}GTG|d?i9Ho`P4wR@THWZS{NoPq2=QL6z4XhxjNhOt0 zT3s2XMV@)t~c4Wn_at+IH;ckW0l{hhWkvNGr@18p@Sy7w$}&+2Ip2|lDhJ{BcwyE(FYJb z2HNez##ndU4>?t1sH|P98@JVt7w68;bLZv2z4y|MqwiVf^KY4Lgf!pdQfPeFrwFT} z#T1zRCBALs8Cw5pfrG)!zZXn7tb(zmU zNc7QveRC|uKTYe=ci(iszbNIOm#^-6sr)n#rDUS3OY#dp6h7AE*ObXgu2(%paHD*Y z=09%wzka@J0y8|nO*<0igV+1YRg9yWNlj|7nD<;?wnO)Ds@>Zxhjwh~^msKTLwkdD zzYO{O2t)3C7o$b;Qsb1Z?pf!$)4WR2Qm&;UHuFwm*rCbMcgH?=_h~Aov4D+OvYwdi z6V@)Rn%f-mi6r5nq#;uB;*0E(b=QL3&i4l>ZRSPaC9M%iFRatd?a6;Xx4!1v`TTw= zyWDGzSmJn^+&B&zs|AZ#pVvYcTUT3ie)>t@ePEJNED9ZyX!Bop=EYOq@uT&=Tf@iU zYmr7amdg`T=|5|0j3Oemb|Akc@x(%uwA__>p(L2}EcmUR8)u?uBTFx1&_^E~=~z*N znxOBf{QUKnUiSK{+K&GBy}jLSgw4OVcWjWEwi<=DsUj#SnSgI1b#2u} zo=LJW7=V!wf~vAevLq21CD#k(7r%WrZ0=YqduY_Z4TIJ@qriOVo72g9i>z@?dsHs( zCC!(J&psw4i;mJmL;yOruCr8vv=IjaAp_;w66d>7g>CeAwle0K!1d*zR=PUV3(bcmxn7-%VH^UjxWrXCt*0$X6$n4Ibq1 zHMWJre%Z-;nAc|&Jdg-5A^0(GXKu9*Il%8US93#=4Zt`AKw`mU1&IWJkywZ@5Dp`v z?z-LGhvBe>-aI5a*gi!kzI(bj4}%m@872w?3o_P#5?kGBt1mFJLOe7_Qd|as1R$~6 zOjAm1iU@HOzc(Cs_k7ZFFAv$ldeUp(ZtGpi#si3XW8-+(4ijkfIPi;l;MCfFH>%xSjbSRpYiXjKJ5Qc^?`AqXg5JKGospY9v)wt{=}9!KpN_61d4_iIPX zyE?An;)eIg=igT>p_iOBkoMbGdtZH9eEX*6WZgVFE1zD~d~$u~HP5y_)w`^(ui^CD zI2e#<(T+v*lb_N~gS7qGimvab&voy#5j{a#%mXs7-FKODatS4uTB)Y+VW}2XM(*KrUm>TG@sIUz6 zZ$ZJ5B5CE&;5e(Zb)88KcY$Ogj#Px+^<)Bux_0%d1GeDA3xNf=GAh90_~>XOg;vrf zkTzG+1bBpS>R&!s0|h+@alT9LOCW~DB#BXDVv;CG49gG^5d=h61E&ppUGlHo?)x}S zce>Wkp%qq0NKj^E&`B>letli>V0udS&2p!SIdy>ZbQF4Od+#KLTkoFx%KL)F5fKzG zRPWx_rXA6DqW^1teS5D@WRvj06_Q+(euScl-#*b<@*HQ~`n~#)1VlbQ12GE?j^YGD z3$w+CYir*3;0PoTK|cO&krHX%epv=*z(H$vP{2RTOD7Ym+cM zXFh`c%G|x5el`e-F+9`GyUzE6?#@k5rf<6IR#!albbPACssN@*&e?dwu`xPjLqNkB z?(}b^wU?6p)!*032}Mkls5T_hQIyF^NwX|yfdm(?HyW+>T+@5-{Y&Z?)Z&OB5vouK z`iOPd`}x|5A`lQ|mr0v^blv#rf$rO6wi$`5e%;g6f32S&PazjfUDTNF_Qixvos zPqp^=eO_#6*!%7KepL!_7MW=%p8}|&iXzSwQIHFk8_&{0A6-H~G69}?-J!715_ZZ* zAXefXunw0f_c&>zwanITd%YUMFX#$_u|z~fR&VX=%bc#>yv<`;hKt~x2znlhz(ud( zzE_RBM&^E9Z^pjs*IL}EJU0$+$Y0Y|NgZyeh@z;+^>?3n)6E;xj*Y(h za_0{@m0J81ii#thvK#ibbu?~{GhFt<9{H9j(|%dlc}4rG)jOzicSqPU5-2K-2r+~x z5{Z^Efr^SEDyqrvy5;NR4K(4VZNHaRnHtq%%}Y7o`1V zr1R2g^8-gJP93Q}OZ~f^cF&XjA?C{*Y`S7Z!~XB{{jhXa--venDGL{YsE(RkLKU1$wlRw}WNnD2YW4*Tnj zdLIvM4mWQXs~fQ+N23MKUzR|*2_Y!o!CPoH`78zm7nnFPq zOt_|%qM2NdUiJg*2s6RN@rGlBN{WNTTa0Q$m$e zlBGz!&1>-;d(eS)bj}ssCiP$#!&Fx;b|*7u9zrdBT)yUZhJ*diHa<#@Ab$8Qo}2fn z_fhWw;A*&RNJVYN5=vu0u4|}^V#&H+zn>2k*_WS~_ z`qJ^QhK~RS6a7>4*SjcuK0ke;;-U5H+HY$GF=mv!HuJg&|9+kbBE z?)>1`F}29jj1nz7LbXGXv(aytjz7SZ7S+x&ZI4rCzmMp=PWf?H0P4Qlo^KE+G zQ&w3*hSLkK$l#2E7^U0WZMcKB2nYnznbz0Dq}7veETxv~tgWeCFPqi3mEJ|_@{(B* zQ*b!=kK#TfJTO8Kf=A)^-=|SqYUUMD4H>X#A$-`5(13X;5< z%S(Avda_XEmVnVRG*QN&O^^Z(0D5d?@^kM!-CR)!enVYafZu?2{(cn0i^5SxiqNG5 zCge0>MA*U_vg(-l$ACfGNI5ss3LHXPj8;^G3 z61V}L3g3(3^5Muofc?Q-7_Gu3alz?eggr}o9wR0J6X;+M9z3+VR83kGOM`&~6J$Gx zQlLD3K>R?034sJV+$nLk--iSsA_yReC*%x3p9pv&OR=~7>GK)ePh`8j60YujpMA(@ z3?}#3{t?Pt@YNc$MQEz~rMzDrw5ck%=Wg!q{P;Y`U>ptGpe|3Vwdwb7PQKUjcR6C@ z7KH`Dqv4)?7t(h9-Os+?y0ZptRI?eK@S``CHCd0PrHF)M7?B;6Ya(KTL=a6yvE)$S zh+V$o$aRxo{D;5iMGzi;LymrY=b=I%rZ{$#U{>fu1>r`5P8m2tlK?gGd?WV=>5wkn zkP->jBM!HoFJmN{3KI-AOB$iJWsVXBLfejkfD)Q+=x(&ryfKDWt4R@~cuW;lRX`Xu zxw#QrVkD7DAizeUy~r>#e$j|N!{o*p7reCXZ%JSw4sNLsq#Oqr1U;%7NpS}w4hVg; zHlj!or8I#W0?s?i_9wJ8m@?O*R>>g;f)NVftx?p&f(Il}W;hI4fI`?uo{4}CA+g*o zy%LvmRTc}aiOq#^tOr=prj)FN~e6@S~(lfc1dn_ZWldCEmOnVlBPH8~_FC zP5 z&N_YjvIYZ7MSoYtS1o(e=c`vLEMjOa?BPUeUk>yPGQLHvT-rFf3!+mFWR zeujY9No~=z(PYqUT5Lbk7xgrSuT4YGu3+=UN2^Z*EyUC+^oWPUrGbjsFyXI({Iec* zlRMj-RAE1weUI{e*?YewP_A(RWfZ~eY@H6$snpoKEz%gH&mJDO1ETdGKLkrA0+`5> zO2&*p&=v~+H}Ttt=P&ct$N?FNTH%r~%DMS@sk{!LFzV1*sjP_IYpXy}<44cW?`>Wd zl(n1d*WxGkqD2g{m2eETnIL(%|Dmaq7?paW=OQgTl_Lc-YP0#)PVm_`?Ii* zEZ;xHkM?#Rq4A2m#%$3~8u!R2{QA*TraT%aI0hm;^-A2U6*HcFF*f;4KK7Faz1`$| z)ei+?8#c^ZDt>vRnPGXmR2GyamMKQeBq+)!?ne0j`i+U8MWD&$QCG;1ttJjdc`9<1 zoO#bYDNu?msT6~ud?`eiM9kw!D0qgSX2Es9_~L5U|06-9K9Rm6hr-CG*{7@?=y4aK zI6Jhh8oRE%)3M^iTX|ce%yIfHuEy$*E|d;6H8~82v98Q&e0@ITjvgc&u-31KagED+ z`5SgQa~G=5mvw}SfT)B)8Nut>Z*Gs0q9)Kj_H!HTdbz6wns~gCE{@hJ!{}n0#l@N6 zf^-3YVy!=^ULHOYcy+dz$1WCRd9X9`F*#u0#tTF~8IVhuvSQM&66&kQL zVsOx~gqg^r2z6FDZFvmy?iO=AmF^2wM$>(N+K4jgT~SOJk7nCFu^b8RjR@;W0ZS!hm)+QZ4oq6sG-W@SkK zRFJRh37S!#%wv*aoqdK~^<%oKfb;qo zP+fy((MW4#s+|vTiWAM3E~-WsH6CSl24?hC!TF67oVr4=5BlTi@N|}c7m^)> z#5Z_kd`OSu*QamwQ+Ge?yh04LS@187CgJ#Hu=Y)3Ut`{D6z^>59Hd`#}F+}CUy zsc9Rmi+j65T}8CS2qi9oLMYHiEcNTjvvU2wUX~pVb|nUkOGnb;hK_7@A)o!X9=39d zx%bY9)#g$5(C|d5>Sp0J#mIN4UG>l;nzk$vy;8$a6Fkl^E24A<1bgkm-oQPIwO{MQ zt6_suc%LUv5USs)Z?4Pjm|cJKJU*@Tto-s9A2ZmXZsJAiW?XRw?`p$-1qEW@gZZA1 z;1%1pe<_PXQ^Ja{S))l&yuQWCCv0|miB&}hPn%sF$??dHoy{|@2?*$G-==SKc6=9F zxC^67g!4SFW-R(9c(;K=k_w-`Nt?bv?(w4tp~3O>Vwd%wni+JF z-a97&XK%3EeY-EzZ{$?UNT?s|a(LeQJq{FJHQY2zHLujwq9c&2C0$0+;`-`X5C#uN z4qTI+u71>ux{a3_lYaOq0^#~=s#9YflX>QuUHF1S4^JrMxKdh=mA#=p$8KJsAQ*@` zU6ESKHaf%=`?B3J=)qr&T>-;EA-1JTCt}S6d3%~2+OA7}iGFrEm4#lY^<`3Cx?!X1 z*p-;TPVkp6Ulh{K4C*V0C#%0H_3@ta_l9lv)fJ&%3ufXYIbCL-&#>2hvNn2JM(l{9 zA+dyc3Zm-ZfD33lwDbw5;RpBc&Asb`T-tvfH<4hIkdgzkykW+Pv4( z>=0masP7BG4@fdxO_Jf5jV82{F+FJ^%zxEF$k)X+h?n8S6~aXb<7z4_;(y04KPg!b zrWj!M@EUvg!>*nav8E{jEA#YaY`Ag^C~?;!pK35O>v8iad>iEA^Fvzf3QIh+4L=5j zDYXu%TE$k}$KtLB($j6S=QQE)ETSjrS-3;Vt$8NH#ti(DBCyP|v{R~H;1EZv@`dqU zLh-dVeVsH8&Zd$_NALKdN5A)D0ip+z6zVg(E^?IBW$SAK-`DM-CNL9{sr1%=4hk}V za-*gU?db~quxfmd#$3R>r8Ut~J);9$!m8 z$GqM7n4l`AL%GgUt-dje zzX}Rlz}S}}VZVNAOfP%Y=^WTLbFf6YMvhlITTEzI(97Eme=tyr;vYH%6qs9Ow?N0> zIT=Czrbd)jWi}Q=GbTl$ak0m_<8584{+}tQXAgW~5_aT5TCQ)MKU$jSzHT^7N7gYo zblbmJ<77)FsJae46;{4T3UAtOcjXpxdp@Od$Y~F$tKq$FUwXJ|L%u34_%dd7RCG9% z9LD;1fD0G(D?{6$b|z zooHOxgcRZC%4`#9prk~5m`CwPvEk5>!mgiqo1OY0^;RwH%f2K}wOs)ECqkrqDf*E; z|6TpyjH_K0Pd0wg9cZR(%>b-2T9n8z3Rb@@(bx&zH(M;{aPiCxYevdYTYYUjuMG;t zWF{W?Oz{>7<1|;lx%wj%k*&B1gXoISx8_j9qoGO5vecwe==&3+ zLBEE!U(lcAm;nkp(t}$EZ%>qhJyIWCB^7t>i~`zvpM{HJ__lDWfb(o&og$xVVMGXX z{Q91%)hmv53|vEYOnKisAO5^sx&ev?m&A85fE!GyieHsDIuB25qn_39ufAsAQT#_2 zy3cr@r9KAm+TB4gQpZsd!qE%2(_uV1{RYu4KwfMzGVGT-`Q*6QVoklTrp~si@ccaSrSe=` zF~e(%MIU|_EZi~RPbaC+04AkYI>@L~beJ!ywaxq|YC6I&>-fr0EbwonBM|yC0U_ zT7#ck-r7)mVmvKN&C1JqZuCB@D0)ledUVG3SN80o#t5z@=`ELjE*MhEn#61<72D&#rW~ zdKd+LYs;PuU!A%YEhJWn+6L&>7dExLsa|!jJDOswdkksPHqJhl=y3!j2*^+|7&jtY(ydTo8|daCfK^;)Qyzvtt8_`|WYb^7@1l zVNV9;^Bjm-#^NXXV)_C4BMmc2j6Zz)U1=!C0at-|4|JD{JoGKU%BYO~4C9W$BpRBS z`$8Ri^d(R+N@3tyKj?TUXSIiW&^GAhFPc?pmZg}r%qBAVkG!(?fs@O(^z^Mw4M6{% z@HySrKSUqi3$K00j0%B#Kgyq7EqP;Y!qMe`AnkBCH zIFh~X#7<}&*X}K}zFH8f*LbZEkS`3s`Cv2snYcXI0Dpv+0(QbRXUin5+#?* zB^V|cJRcl1@6PVApdk=qW%cXC<~aKSx7c{$_?o0KVaUfEgS+0}`*c`_HLxODps%5R zSDNL3B)q@$+nSV2id@qarJu|BWN@bFxeXr5XnIa)tPRE3;{%TH4puJjwPp*nZhEk-l#T?6V8)V;;$7ful&;z(n2+flAPAAEB|{FXxgyaHBwi;e3r?FBT$uwj-vp)J zypL#1L%MZ>8wW;eC^_`xpp(Zu{LlraqrL;M?KtVD2_y6hqS5V%!h4rb>(V&EeA`X9RDn>pnzo z1az1YSxS!NrrM>vc8?3VTFNHAg1MW(|4dt3ZRq+Qg!BSB5x?_)K^YnFLQzG$Wd9dH z21fiYQ6^Ra##uT1rjU?`|FZ`1Z$Lr@ys-Zp5dT9X=l;ezkqm&}EjT!rApHhpz)SX` z<39lz@SoKGhX2*_Ke@jv62E-@1+<74g0$qnsr$F!{|RB(fmHziPm;+0h@nOPgOUCP zTkar;cG4nfp&y z{$^v?Mf_8YT=h3WjL!PoVMs4lL4HB#*}t6`^I|nSFp>%b;2$0T*!IP1s{d)ce}=*D zO0_jeXb~@!B2|%I{QCFzx02sHBxU8_oZkZl>GwcEi}D?i9D zr=D(-2nm?k7<9zB0(V<4gd3429`IQM5{NOC6B6+po@NQPcyV{*XsY_^PUiv+t>#n2 z3eZ>s=}f=Gg$d_lYl!h^$kO5l?2-M^mf!y7>H{x)RDZvkyVmq+2_^i5&nP!L`8L0Y zaA1bDp4KxJ?FUCuj#`_GHZY38*yQy6nev@MvwL)nBN{Sf&5ac1NoNOy?ExXSu9}D| zeZq+cJm9f6orEGfJVOJD5lhEE(GIWb(WfTc%&NlD*ApT{L4!L%i6Ng z0E0V*vnKD>UDIdbvz~CYl~#tlcs#CpD>Yf_ccj{y*0)jd3&FQ?l3vc7&)BGr%<|DW zo!*VcHG$PeWvmNdXDFiSv{YWn>fo&dBKsLq^($yH>7XJFbQ0!ISh?sW^B!1$n+Z8r z`qM2f3z^{6xzn6CijOcK2kHS?+jFwPmVksKNEVC^#e?aT6!NSrrrp6|)Dak#Zpsg# zEx$MovwnA7(wers_g!irec_?-tga0(xZd?v(+(wm;2k+d?L6bNQ!9}|oJ>gqE^T%b zzak#l8;8u;4t(%!y=HY{LzDU2FiAPfVB?;FGR_Q-;Ip~JyTvhp%`-acCD!gM0gETn zc{EbcP*h`Mk#X?`!@xeCN|;}37;&_A$!gjU1ZK^lu$JeH2?1S4*lTZ0nggVwUg|w1 zidO$G{b6`w^#e7dB~F_yDWw9}3vYEqG3W#%3B$1B9jTW^y|FXM2W99ab#vMt^kDsF^-LVG1S(D4Da~;l%VYC;m5dt18)3pda2wAX)m;<{ z_zCq=%?|&E+CsVAXnU}JwN`LveYQ)niP?jv?mrayf$FIe))-{v&apSLKme_Ou54V*`VgY5#oiR zjLdiNUP#$WD3p|LCDJRuM0iRZuo)<=uqI0|rXVb4`V`1u?-}=*G$SJZmaMcwN15nN zk)QiU44RCz^)1cQd}F$Rgc96{o=Fq0Z-i-?o_AR0#MWjZD)v<=GKhArmT%i;aBOy9+w6@v5ebwDa^6u4Mux5Lb$ ze8qE(CYm?5%|v)9!Vl+i=R&m0nhO$51TnrcH!VMjeqXBSJ4bPhMPDRgSZOpXKnH6G zI1|14MMm887l_&Npa$Ys19`Vf-1MNQ`te5%wR{h#ts-9-61d-=K-smm9hzkJAq~SkwMqLe-EqJa9IT3r)7T{W$$#Y_RhM(8-qp(aa0`(NT+6?6feORr~~@ zQkf?w6zXY;319cEXX?(3=Q`_FylT9TPy3Sg86GirGBkeHgE>07{Xi=HY?hl;tE_oR z+oiiTBAaDJgIXPjQ&wa;bcN(Q_8Q~I$=JFkJ`CoyCe=T@dPIBn5-HN6u=6$Bs5Gp$ zS=U7WDP2n`J~{)n^_lwQ3GX6)VYL(SiQVCuKy&9RXXGO8-XokPss?SgfdZ7SR1?Hd zg6Zkl)D&3cT-v4u=Wg69CwEQ^xi-w+Dd^L}Lk-k#b*K^X5GDxOA$`x)dD#zK`U=WXB)k(rV^gq$BqDl>$|I?( zfvku0lvLrrb7u_(G4o@52p%#l3H2Ik?nFI8ezCb`>voXg;`^uMllXGQE@-?G4w47~ zyF&!YdiSWG;2r^c>F;X>Npb-hP(q5#n1qe~gjgs6Wl=AXl9EYdm;62F_*>+^GJ?=z zyG3mU)=X&(h_-12(#kEhpo)Sj&x-&ak36`-McNt(504T!rJ}3?dAkzv!UsO6Mxp3E zXdq22CZI~|WQ|6mGsa18rE3Xzs$vOZGBA_Y3?d=Dy7={HNDwpITV`#;TYWM=W$2sM z4DFa&v=BxW?r)?~>HFL#Sq`AQY&#|wp+&`(j#M3eYK_#gQSHtOCRPRn*18N~lSTPWEN*Z6KehCL&PF=Glv;pN+tUGb{aHr-}Y%j2B zaeH}HgN0F>I%;-;OH)S^JW2o2QtHO)VCC+AGnu6HlD)pJ^OYNJ_f~{`kpmLjpIzyqJ4h4N0g|b!hnhqK_lX8>P zhGds<4wDsAqZ*+GvYJ)JnsQef?S>=)n>M_bmOAosZSpPEWIa<$xT(9Ty$7Uh$V5=F zW;NekfyR^?t~jc%;7+~8MBbS&R%cw_(2_Lj>Qru%YST_8lhK)Kl~9xFPMxZ_Vroib zl1kJ; zREyRQ>)ma&4TLIulNIX?k~UUJ700x7$hUw(?U$YFoZ3csq;C2OGARZ{YcE|>s3Wsk zai?5uch|1rwBhU&)F*FuX>saosWVz7i@?z~;nP=KjACW2h)_lS%X0Vj&)L9_x79yC z1wy9>oDsWJAug7cHflw&?o}Y~5wPZi4mb3!^&<7X(gDlRt8v%)X1|ko)Z@QU-_d_L z?+j$Of1Fbf2u-_1(rS2AaSWfpziD^i>$vQ-DK@xn@=U{y-s~URb)<0_*7_VJdcNE8 z!*gia2AOI=$~)AMhz+w3{ro7JpIzKj?$w-w8sjgaK7V&hjGb>!ag4V{je@Y)c4An& z_RT&sCeVu$2NQ%kxY68e=q&oV*_=J0>#Y^u#=M`0cfD zBy$oetnk?8l>B9{XsmL+^&m$BZ1babECII+7yTV{IwJ!OD)7A)8diEwkP!mQL2bJc z+0s2=6Z>!t-z@69l)JM((%`|_B>CK|hE_8Ih_+-TVq0MS?7Yi4WLSZzjusKpwe;M+ zy32LuvP{2uFo(EGz+nK!3S3m^#cp0>tnN*Sf{-=$Wd$IYCENnpFRdD(mX?%$<=%Po|a;wMuVY4F|b` zb9pEt^00~TxZMzXSWv$xs7pgd3K1^IaLDdN+!Y;3>@s`~cpms_FpkBZfh55l^*xd| z(UGH_Oc^?gI;c&rWf;11pVqv1DMQ$J-n%KGQ(cp5A+~Z?Ff2EP4Uw4hco?TKkc$o8 z7Ba+MEtu{KU;gSE@bb`QU4_Wa7fg#|AicF`!fhKw3Fk<_F&;9Ga)OfUf5rLr9%^S5{PEjLL&MFX^}d%^_&of52YFAfg2azSYBK6L|Nu&R?Nw}zIj{3L zEEx02B#n=AOZpr1-dspMNmBH>x(+gIEp0P4_njw)WGx@Eou@EE)MjS(5*voOhBtJL zLyNYAK4E3hG8g};n_uvU_Nm*z{uC~Da&OTCf!Jx?46Lo-eIofaOx*}Drc|gn$&c81 zLg8N7deSOjj~=eKdb>b_!yYq4g|TnY0q@TL#`uo8R6<}bfW@#{%XWEp=l7UB6e!e360yJXPm7x% z$EK&JpG0wz%Wc5lt`1~dXmL=(CyKckLdm_AI*v=yV5YN`insxzqBaiXY+I?{mW zK8bLAp4~RHmZdd*d$#lGWEU{nUIEQw#?0jF^YiR?Et3QWnDF>o6V;&hT}z9P4g&O8 z*6in`(f68Ydb7aOz{Y}hFyI0a{Wy^xGa4yk`w1nCsU!N`%?aVV`l**_JGQD3;eEEB zIO6kxR|Pvq`FC@vMmv~D_-@;L(#s5D##6o_h_5p&U=4r~aEV!VFlb67M%L=7;{c@) zE#=af8#dFhC`4As!bfH-ikEK89?`&@jmgk^giO#_-hN0>8%!I8#W#r#)KUhMN96c!VT%IUfr(WLo79!*1zR36CXSrz^O3i@&k;dnKs5kZUU^WUC znV3GR9y*o6W{q**zpUbrL5H>9cm#XWX(B3*7&PYOPmWhaFV8r#zLB7x<2ZLeogUm22#;8dkhNrNZeV6(6ZOx7r zjsin3$T&;A+uDzDCTy+g;r<;aBV&5$WbDQ_x@sabHc|`@X;x|iW$P3+#W)j=A*awt ztGwBij5OP%eSLJLNCTifV&xW(5U9stdMa%FWDBt&mA62S7L1ud8a{Sfv1L8+OW;D5 znO$@35uz4x;{4taw;oU56&55+fG?GHRqT{`Mjfy^j2VwVzfMc>@ek4KLuO_HY< z(AJe03yf8KCW>*t46@rd8j!wblDV|=Ee^J>>%IiBoZ)wJTD_^m90myTd~>)#@oX63*4gQrwWSfnC+&Hi#R|!|zfR#s!DpgYTpJH6lY48QFT2qlJRycaH4=**e7S8~tF5~04 z9c{l>niXs-v4HEMR%M9WP``HBZa?u2aq+}ZJTO+Um3^Nc*PFwi@M*5$F@)O0$I$#B zvQX*{EfU&$ILi`?Lrzl_GV~EtUbq^QHu!VRq~P{WtthdrCPPRP4yBa;A>`_Q%*?WA z4g?O*hTDA*mg4;Replt9bgVK#)gDFQ1C&G0796wgta+FQIJU5OO4NLuoq=j-8MQCw z8MUsoiqbSr3r=wj8|v3%C1qTG-7zce?UJP+3@>Ul-RUug!JB;fxeLK64BVddU;Sg~ zEd3G7UE#r#r@aTn8p5(6^v{jm| zxpKc&UresFIN>T)mE@*genCs%E75>-O1TCoGJ6 ziJ0i?Fi^E;)l}u;b91eIoa~joMkeWPg}D+Z8yM%}U?876`OA8uP4oBe@OSD?my6xK z_weca%YNauF4rn9#ClQDd?2SsfVT4@na8&;vpbU8Vs6vSGP9_znl_E*b$n9h*o`IG z#?Z|$s7RKmuCK?Lc$cYYJB9i7bYC)Vj#}*)HfBzDk;=+29KZ($T7~ z9#i*iF8giDAKXlJ9!hNushy#rSFtBIu8SXy4!|n7CUH-J!IJ7fu$vY?VG}kRCf~#s zJtM3o26VTs82ftCT77ijc?}Po2ylRdAEax=waI(ivl=9t3^_Mebjz$3HVqKgF@Y3b zb~oh*{0KjNn1iIdU-vgz4qPP>x~KMjnL}WFTh2}yJcAAorOqBZ!QbINQGMwXnhbRH z37HRHw$wQqy9@s)ZTtP6Nq^C}?j(Kc+eJ#dbZ}tY1zSYN#2%|uvmYXQ)ag%*iRE?{ z2B%eKg$^sWwcPll_MdOtdHaR1dmt8<3vG$d4eUKZRlxT`+&n2g5G6C$58e-M9l`FV z%`wU9IoOIb`Z$kUzhpu$P+D#Y2G0b?ZFzc9YPPYZZ%x^oUjk{P7_=4JLT}z|C7_pL zosiakm1`tld3u&R1|7qP4Rl`d;C-RI-PL^62WvBfnMt4i;Tz6%(s|WkcG2!z ze$v16?-CcI>c7Ox%8ytxBB$((qFhhT;G9-(QWfMLSxs!HK2U8EC^~*qczY#JupFlN z{COjr^1WPw|9Z;7vT^5B01K6ozl}X>1P^i5w79#p`cTO}%rvc^dT)bU4jxG` zzwCPmp(PU}$(OFGl5W!H473Pj#{N9M?8<*3?XBcoumdmBI?-^2w2boU(z1S~vle-_ zvSEH~!KUbtmvDVeNCap-4u_Rf3%h@@p~dG33z7en$OwF=W0^v;I-Vw=E^F{yuzWzV z8Y)#r!qP?m<#NZDn+ZibdsE}5VU9`r2O6et@R4;tlfHCzq0Ny=RQfZohDLZg0R$mZ z687MMtqE>~tI;1(Y*SK$oEAFV$K*uLAwyp!FnwkNi^V%X(2|Sc_&_Y)N9WK;xLl4s zV?Md@NZbuf-x+FSKlNzR6nvgIr01iwmioRNKW$=)!=Oa0qI|%oy!Ad2L!=q7Wi12- zqad@!%olMKv$H2$N$rN7F({3qKt3?RqSOZ3tIgQ_Wn#2ch}_L)>!iWTn|I4v`SsBF zFH*(#_}{;1B*rs~DL~xxm!3W})h@}2-F}}V{{I~JKUVF!O<9Mj;z4enr4ZU=Opt-tWanDj--h>IJKA z7%Uw6lxGq+?erTKKfKHj>nn3htn~@ixwQ(}CX1GK?w@y{^yuc6O>6R%GTUj6>@xUw zlA-23u-vhQz&v!Zzb1~zYWtTQt3QPN5yY9`>9s}BKi_5P2M!d17qpTv)3@P*1NLTS zCV`o-R~?ly59;z9`lgu;sp-Of9Jh>%EuvLqg%b9xJX$t#Q4IACBUftT0Yw%eQ?UYu zBnADYELUA2D!`aY=KYzOOd$B+vhfnWi7-b9`=!1yQ2-Q^61^5Xf40c3YbqS#*`lFY zO~SNe*DMm#pWu`cB!~r1kp?A+gsE)Y_q=V$_ye{+(tgW1@~*Q&IDkz@!VJ#8Du*)# ze&_5u#`PXp8*Z@k@YDmGEugPiU`EXnO0o|)Cq;HG^Z@M>! z)uzZ?oiQ}2r|(HKYc-4#o+t;_T^o*bi#rdy6PIZM9$bCfTGh@jzdkoZ{h9SDY2Out z$6R48T~!O-KmC4ui9Uip+ZMrGI&e%ovhm2qNAJbf^}j`0_-t9Wfh(VHsso=rLA3e*>1}*%uA>iUOujA|E(6RKytMZylITE<5F?jvc4>yT(c-DjhA7 z>-zP4g_^ipx{pFM8gh8tTU$@iv&!Jzutph&9+1@{=v=2wJ$0KHQn)4QccP6knpOlL z)F_>525PSIhFSL8q4QZ?iCli~c9)2l#UKoQS33g9LoBOP`0|5(53tR=yqAr8;rzW| zGj6J`ym@}(lf16C7CR5)Zx}Sp(e*x+zrm;HpZVDoS(p^%I+!;FhJ7 zsa%VYU+mR~ti#3rFZYt)1NHw%@0kU#^x++wJ%>`o?L4cs?&}tTpL&(3QpbQ`*1S|E zri>mYhrkhMqFt^N@txPVje?1WBB7LkX|=>&yAz5*!`(aDe*!WgQy@)r_mw8R=~E=4&0qlo zf!@48G(66!B`Y56N|Z0|dPL)LgfWahfJ7a^B#!S}*t%nRQGOBr(lN0$i3^N5U zB}3I^Lzl+q+Gr1IA|m3d-VPpZ>AZ%xzFHq+iV{a}KId3m49ekb_iC{MdiDC|!-9pl z(cA2RsTlij43q$uczhXitIv_zhp|i%v_kvAb(<;L&7o24LE5>p*tX30@JdbAB%aeZXb?GRag&%U6!K|Br0)A!sW6_lMER|!OPmOuQwcnU zbBmYfX8^CGQTqq(S2aA^<{%IZtH+@4ub@b?0^l5dNDP&PEO&3YXT7v05i7GLiWhMqpd2CfILdyF2J$QsO(GNe@` zOJG0L%DaO%Fh8M9`oon0` z#P}P!BOI`GTE_yxOqHl5Jz*=IhsFTMmuF7nVXnQIM3O`-@vn?Jx(0_|zw(KuWaZ%y zdwlMX=5UyP*Lhf2Ai?}&yrs8kB#_fVTQgg8SrAS@zu3<(HqViw|A|YOU*1-{cg$kD zQtaoIw|ju^8B|opl&9MXu=<#?LtC4r+rJd&=w2*e3QKIOE7LmVZ_(I zxr>i}G`<$%a|2_t=KfDah|wE=vx-W%(G7pG2}6Ow-7@H0cgUpPRbm{`PnMzScZ#<& zFg&Y6r^X+-XsEvtQoHL)rcoy>XQ^&HF(*u9wq8_#rmEG4_k8I}qguM(i+5{V+-5bE z{RnIm`ew74m(CS4KH2rIZG_BTnsC2Fsj9c3@JqywHm)rR+$i>D>H_J>BjRbsq;|6M3?{-KF!Mh5?bj8n5IO_Rm8%>?mw6vVqmzUlrvSMUQ zVHn<)x*+G`OsXwyXaPW6| zH*}oQH-nkB|YiA93kO|5wuC0zSBTE{{ApbmSl7IW;Trx^kV7eqKTF`bSu2X6FST^){HYmmA1!fjT-j4fi%4BnBm>)B@S?=My(zMfb) zYvl_t-xGiJmPbmqo<7-^-08Jegq=*e^a2h>W#7zT|8ZY&#J9E3ctg7u?j9VHin~V% zm~f2t_SP6Xhdr&0QE>3=GDgSkQ>q8(eAwH7s@H6`yXfA(BgY=|%9lbj-20K{N+u=s zyfqBKrPtHPvDfl0Mm4WOcArkv-F>qaEu&v1@cO<8>SetODNuAVwV^i{6Usl(gh5n<}5&CpX--38!>Yhl*b7;2Tn+|&GANP#U z`1T^pQwsC65IORldy**j2b zhXAKNvNlL|h)Tqo+#|1pfLwFgpU@w$ycEr;8@c~DingL0wOiYU8 z=&OJX((#*A*$B6ZFon+|;{Ew(v#q0q2U8pYwB^!oQbdLEsmrYH8w7z-ZXsKx-!)^KlL(KB3!5A@FLw?l3Ud|zbe0u? zvqFsFRx4oK0%|mv-R7!b&*O`V=M%ZAltUW^YqY92>Kiw_(TL}rH3pCL2)mQtLU&H) zXhW&#KGjMfb2;X83+&Y~|4@$!3E)Cv*i<4Qb~vOe=M_6S%J!+~soS&rdT?MBtm9!^ z!Gj%?T9kO0hQ>p4uIAW~GAlwbTCPkzf7oW|TJ|yTm6Zp6V`+@>NVa#7_aN1M zs1;R>)n^+O-##=nVtls)@)}G0S8>PQICVrNHTc196U4ZC_a?sK2!w3;vV8_LX?}m2NLf3<{%4muPW(WwHV(zuv5CNt)u$8lL(P|g^t715Pr{h<;oIMS64ZVh8mp?9WYls5D#RGNO|nH; z&2)k*1lHDP`dgQ2v-sAKb4}E2+Hz&S)GRJgk=WZm3GOdrX-zDdhS0XX)w zRwLMy9I@l4vr$m22R;x=if@iI;=bE2kEB|m$s18#EV{QHK0^^1H=~n2U}4UBtv-~Y zbf(o`drEd;dQBDK#hubr*v!jZVnr1XR*N6Aq<}qqUt6Kxd5AY{ElIKKE?M`+_bnWP z8?P^?4Qy}Vd*bvC(DYucGagHfYms9jIb%Hco*b_EWIWJq-Q&)L$4uK^fJHeg&mRy& zh+Q@RpDy153dS@u@GdrS=h9(V^$lDBUFn{#Yz@(-;_yD{*^5(j@tHvP%MQ2|Zj>=j z&mNKIkUF&)-Fe?xl>l^k{tjR+&_c8c4xMvFYIaGhz&J(>@dv9myke{o?6~| zCY$suY3XbHk+wFt%S#s|G06b^l#0ZSP`Na)KRkpsc#;_iquZ-FdX6-RCFaPbGEK#1 zj~j3CPe_!=YmT%#Iy&r3Z;9pdBx@$^2htNyXF^d}=>j?8yM z&-Tf#>f^3nPj^+XXRW*M%QOWO>6=KgU$l2b*`eHrHj;eu{Rm#x0!fzb5w9^C@;_P+ zQkH?(149#lMZ^=jb=8Kp?Q1F&gc=|khWH<5g}Cjp1g)}7 z(!^JY&G(0!pP8}+dZ7}c0RUO#%(NsY6gJKsXuL48+xTFjezEq^pJJCyJxCW@^VbD- z$z_PrXzez#vaO#{#sNT^zZ>=RU zrHTuIfsY2?_~&oP2RpVYyAZf&MU2*UPVu1zLI{NH93>pbXx8mx6A(BI$}4~3wN^u} zxFNh_pN9U%>(c^$Gv${b7xH@*qmCvJ~q$v4{7G{ ziY-Xquy#;qEF&|vGSZizNSwr{+s$AZeRYU91$@gO*F-Zzg7%8NSkDZg)u5g6bK4ytPGCSWUnnx`0U>4aPNt}0d{*)$kvwpIXdL(9KW=2 zS>vqyn)^rHL=G=IWG_lTb|DnXSlpQNUK=t1Bs*aGa4DMm`? zJOJ$J+boBV;K}~{n&mZxt#LL46aVq!5o+!-@o%pHDU0gDYJ*~tO9lbk{_}|XWz@N( znW}NgmUF$@4Vd(PtU%a_0lqMrJM8DjQdm%$P%#`oYLq+xDTW3h4@96tYo1xgHY!HN z#StI&z2uw7+d&;o-Z2h?$f^3P;gTQl3bfKHPNhgT~MB zR%{?L{%NZCgRkS@B{CB-r!T*iTU}YA_9rIH%*yfzQf|yPw~wiU3)M*GjcpdH!=E@X zOJ!l*D=J(elB6h>V;CZ>x`xWGwg7B$tZgtCvlHRMB9S9Vqg&Z}ew_5CaXNq~6yf*R zl2R57nyY<~sN#^U+Zc%nfx41`5=yiObB=j>abgW6DI9YjM&R&=G)u0#`;;&Z`;eN4 zpDnm`HkyN)kcwcwaX_$E1r;CXTTE5j@?6P>UP*g-wK&aum;F1u;+>2Yl-MLR^Ih(# z+&)p6fPQ1b3}2*Ub=QP*vO))y8m;AV&?lWF%h7bt&}=`GsdodiY9kvoeP~uox3>cQ z?4g%1Bz5lrBDMkfrIEK<9zY$Z-;-S7df(FFz6Qp_khG#z;{~fcFz_>kSRPQh8bs6c z4n?3%^aie1acorJFNFX6DA6H!3jgRIG{C22d$~Os6}s@f*Pi&euHK%O!GCcpK*Y?= z6_LEN^>#<>Y|>bs!7LvKzt{;PgfnGSG0hxAxUl~DcJn2WpuxkJYQ7tKanSLl z8;LOX?*R;lidBA}Evo+1t%MG?>KO~^L&hPm1qAN@p1a2g(7jN>H(_d2LF2uH0| z&d2kCq%pT-3KjxEm7!i#_idF$+Y_^Ud49R!^YM&`Bj=6hxF4$eYNk+!g=ci2>FW2z zFS<+J>0B{V`J)k1Z34NxK@u)6=Iozp2*bs9$hFN!URx$*6Nx%ATHQ9wML29yTM)qr zve--zR&Ofp^O5UJUWJ~kJZ7P_v5!l!>fOj6+sJQx_TXv3}>&q zx-oX?*PJ6Q=RmYE!C74f<&qQlj{!9U`v?Kc7$c}wvIqN3zt9X;Cc~%-$R3TyEn~JL zq-QWF+~E-;mh3GYouMhpNbA#xyKqVh*myHl>1k(CGT3@V^*uOTf$0EFdvT%#2+dFI zZ^*A&NyKahEW8OSFrlTap&>>K^B2|j=2y3eX2>1CvgIG{Zx7-a>;yl4BI3rVf~u=D zzyswLo~K6(`~C{aL2KQG*HJp9$PWaOV>*TAd^~9e+}}FmsBo$b)qr?%(uk=R?)|uR z`h48>NHS;C8Asgnxh(pC9!ZJ)9k!-{AGkYixn>#Bk30meP2FBU*GjAZq1FsQNQ_dltzrDrq+czfs|l4rAJPEn^;_Cci`vw zdGlx%2vU$6Mebs|S=E@XjTh7%RAEf?`!GkU76`tJe8 z9P|_ClGdu`t>%ZTaRi_$e-X$%{PKGpzc)0kqxFBU(Tm?d90)0-DRX6nAb@z?*zGI-JpT6*9$6e9y;uT7501XogdnlwqOO{$9! zx$W&Bbslwf$=}@4#t3tc*?p;06McsGq<4JAph!>_iL;c=2VSk zP;%?q;8%E3)X%Ki^H8*01? zO{hXk6HPf@0(IDloHAUmN8sM2GcC!NfU%>@DdseVh`LtV*T5+Fw|xn?yzc3MPZ=^Uu!B=VrDpeO;GK~fsqts^-!P;7_Z0 zL?#ABU|i8l2HN6V1`7-{RRffy(}^u66J=?J0B%8*IJOt-O$HtG5z=S+m*7CRO|oahk; ztr5Ikci%1F1*9W!3rhxzb#s|Ze#9oOYKaQ$GSIzyr&##SgfzRGjJJG3JDf_&b$|Ze zB-1BNA`I;cr?)SFn%@-waRq{NWe$~cjn~=P+ zq9^=o7@edR7s_-^aK8K+aXa?HW>XQ-zqiokpS-4-@4U z!pS3M*<;y69}RM;EP`haSNz>!o@=l`k2EcPK8xyp0q3UW-!DDAH&0{*wBf%BN{k7A z1gqs*m*MIVx=}0Ba|e~U^lVGc&=;{GM1g%IobdFoy88Ug<_GpW7)7`e-|Ll&*e@)8 z_KvM=!oGc5=Bdp=4j%mT+=9N}iPG$53S=D_ihU9Xx?%A082}t2K4bURh-|kFxo}a; z1>VsZ=E0>5{_^eb>@h}u2nr404ww7>!U#f|LE@JER~fMi_?V-psk#;(bs=K0`f%#| zFrjy=5y<6Ch*HFlZ%IGGpV3C+h;7L>nGxr^E5i6^Oi{@1xro+8%OnZFD(fS#u1mZYr$oSw`$RwK*L|>~@iV70q~IKxDUwq31=}Z{ zeegTRB?X$*epp~Ydff{iqdolNwsW`nlqYkY0*RD~SeOr+Uw#bq3QE@HD|i=RumkRY zfszKDUN<#yKe~&gLCxpCX@<-U!OU(Blkk-yBNp&R$MDerar}g+bpSPlVrNQuGPFdR ziAglz1R%AS9P^7w6kMUFA_RXC7pa;V?%f^RP`l5>U6vvut^}ZrgqBN=CeB0os-O07 zsuBp~EQ9VSnYU3L!9tEMH+Os%5+1%jDj66Al%qfMGNNEc#sW}fHH66JXLqflzS)Un zD0^{h3rC_c0d#->$7yp85_jT(g=iQL*7xOwOQ- zuu7zGr%7P7bsevn&197Uq?}^YY);{O3sPjMrG8nLrAKfoiK5A2lrNH*1$dBRT4qR3 z*v*bcDZfWVr}7T$90YPNW=Ky;^Oq#dP9`$v@x!Up#E`0G*#gOUZPbXrrS@RDDbbxzIWTv-rMdp@7?t@G9=HQ!%W!& zd}Z4-AOQbeO(27mIYGlbg9k1Hhy=i+hoydi+<{7W>?03X zBk=8hr7owPE`t7X>eK*wexIL**ex)IG&oKDVbSURZoe_EnnakI>NbNuJ zS|3uG{GLUjCtRWMP(zdGUaRZUYN$KsR?F8}J4c5mgmSgxEogdll-?iUZIl~!L|+UB ze^GcBOT_^J*|xd?{;&QuB8B-`fEsU=EFdqCQ{x(XH&nWHv~K?bg)XTMoV2D{y#;9b%3V(sFM1?ycq8aWfr(JxOi6BmRVTr`+Vnrf#42RZ5TLq?>PuN=nSy8 zw-4}NhC+7=vqfH@uRum{e+U@RJjWFh;P(u2#~|A4&kZR|^KEQgEZp$Dxiasz7UWPXk={sU$mH6K&JnxR~Y+QO|!Gw{ob?RJzkUGL4kg_yJPtQ@V*V% zHhsOI=Vj|LK6L32`Bvy}NA*T#qBz{}!`g=yr_%u-VJrNi!2m_PLP zUC{@DLNoCvNIVzs>XR}c6PyzSwf1+xAK?>&v3#$(3jcv^?HORY-r9ozdxqqq9S9*<%*xH;fU8$irC|0!X}+jryPjo zkO(-r;28YLzWn@Brb{j?bXpBdiULbYcrKNX z4F_HcD2eV`^XA__l#<-{)!Qhj?xn{9c=vA8EIW>7=r7Y|y{U+~v|+t~wGp6C#Dx>w z?%uR))8`te9re}UafhY$Nl5Eg>aGoCZ}8)30b)7-8@R6L3w(hV{EJN38jiX-L3%(s z&XC)k{JQNtPvUY6IKSa@Sv?_KoRyKHBR-7fdB(710f0xF$FqV4Q?fJ!` z>>{Nwa#%pL+&4Fvt&dcVwbe`0qq}HmXf3?GQy`@IbhXu^q~s|Or{vO00Z#$1AY+Ue zJz-NDH8K%X0oO+BCG=QIQX*i4*?Il;`vH~?lH^T`jjh7%9ahv(zN)bEG{n{T#j7H5 z6~q)xgVEWgfSZsuAhGU~>q=r0zKx-@ig~w|h$&H3Umn2Os2N{`4GdB7xz(o`XIB}n zJ`N>}@NJq2r-rjHuJ599psWMyr@lse`1f)fR`%}AI(BZ|OKEs?&n@ZEUkVxunAkH@d~0Xh8q)I6u%@JzM`!GLEQ&OBeKj5BX$}7#_y^@L zGxeK9xSQ|n)>&HtA9y@*0FiuV?%`M)ivCgh*JkQ4cu;_et5z9HEr=23b1;AG7<5N& zehN$ucTqn!1YC=a4MnTG_})JV9^7ZI9J_CpLArIff9?!KUUipDdtmKLgRU0`WW=LK z$xm~kx(rVKwDri67paY{P3M_bhgDN`uA&y~RgJTySS? zV-|5`f?I&qKtO;?#eVA6PdN9n0j9{7YzvN%%ONOHUT$;PIr5Ja8v}bjg?vLHyubIY|Pw7=^9AMw(f0i>(koMK% zGv{l$2RbEZegF!VvT$qr<~I%3OLR&POz&s2mJzojl~!{q!;gbY`W&@%5kuUYsVAvLNv z63CcZhPI_fV{;Ir!c|qwlEv@3M1F z5vA0#p{FMfdDGQTVe=?_2yc97O&;qWLJzc-Yo9r@+vRdDyXO=f=6C>ijU?2H|y2N03wY&Mr@q^nByn z`7b|g7RX6)=hpVk`=P}XqF(XA=b-9LJvjF-mrECxi#V(@M%SrquyS=5aG21Y36qub zZy(9h?v~)&h8==4=&#*Qlyu*)z?+=+wkX78`zARtIdVgl0oE6T#g)!lUo7%f|Mu!K zFq`b#(A35UmI!-Vxt8hAx5^T^M$3PlSyAH~C~J5hYgo+r`o+M!6^q5zl-oq9{TZh7 z3bc^ZQ&WPF+0Zzc=j*acX%inWTPGi5<0R+yh1oZ6d!bA;LywQ{svC)38|@+HMx?s@ z40+1V$J9eVgF}DyAM~D{pi#r6p%qM2h{G-9-hJrwgEU#W19I~x>zL7H zEE^m7ty2_b*FFb5pOrx-F%=@{&@teZ*_D?3_aD3Lv*!>aFsaUy*cairGKnOeB3sP8 zrTF9=T$T<{fkG_{U%eviHZyn>WQk*`9fvV#u~&GPe(5OVcvphrn5vo#%HwVXeJd93 zGbmOHP9DQxslVNZKbzENf95w8~RJdYJ&eOb?%iGZ(#D5Y$zB1IC zW0K{vp%|N6-4WRtu#9LzfNajW-eomN7pRsM7hQ!*^)-6c2+^!L-p^{9+JruY=Ye=e zvXlpdE@h~p5}hVkp@wg{s!+?hW!|eUo}47nii3UFYnsdDgg<$V{~lP>)Yc;W6WIF@ zC8OC!%AcNYk<>eQP4e~muL{xN*!gF&YCKYjYCVRKj=1ZGZ@OpSJUURG7((nYDDLWq z!dyf>bVL1o)MMuEC*F-@Wqm9CxP-(Ggoxhee7O)x*zrhuk_r{g%s2%?xLW)hZ8(+W z#x6=m-43^}FUx%67uC^D3VsK;+j%nR+RK#QEjEw&_qoMpgZvW(Z*?QqFRnp{?8N8> z_CqK9;Q2CM3On~w@f%Hpx>K}bb4mx$F=_;5nAIgQ&A zgiyALFaWq1DwI4eW^P>!vi;`A&zT$X1NCD2=per&rNpC+QEk*;STgQwo5wNsJ8Jo% zSh6#|yge;T{PrZ~J3@s)oUjzV(hoZ{`{+%nz4!7jm;skfiwRY%I4rp-tM;M zC%OljvKE^<75D?QJ(aax$X3Noa4JTqZCLZ$p~eA~c?+0mvD_7E?=ROql%DIL944_5 zaF{%t8$L8T3+Hm*2wC{?gpcC_Oa6ZFQ9$BsLt3?WC8X0s?Nlfm?e|w|g=vZzkJ2rN z_$)c2DS|=M+B+DS50S4hxBZy^&j*U|D2tj;KEIg+t1n@Ju05#5y6K>;pZQTs=jSgM zx+wMF8TrQ8-R8ps`+Gdz^h)^&oALCBHLKy)jomw|($l3&%r!H|Cz3<14-OxK*%YBJ zubqvj8h3{h+O4fmj3;xhz(TJx>tvg*+*1E(xlQ8jCy~NXQt2N?8l?&+>~9dnGWW7x z$3d#2^ z9nMh0k9BT1>yi%%i-!lI(_v~acG-7QoG(KqRmFwaauJl&P^~a7g~Di9H62g*JBwc1 z<^H61$RY+$d2sXK^rdNVCq6QmUF!gwnsUX@?i34V4}GRRg))_B=>>TsJCASwyy&)u zV`}$QA13o23^9IE-7xnt6KcsGgGWY6YE+J-!4D0c1>n$7lNoZFna7u={q$&ma;eA( zm3X8NQ>qOyQqb4XdUGO7OU29>q7;tjZC^F^bU(M5t;hNtIc2sM1ygHNp|5+1N(V2E zhk6Vbg^9^OomkTq-4>bC>N)aFit%fWP(geUF9$nsR!~qvaiU31y7ay%#2=xgIZHN$ z)87n*nTM=S%W^C7;PWK$00^y<*p=5%QnZs$qu7xZ6gF;RZd_AbAa{}jNHSnwRxIV?EG61#SJLs_8FaH&2!B=%Tj*A6)b=dt3o8mFCXlo=mpZYlS z@TZzTrkhk!lk$F>*-oBhd@J5;{fN#*^0)IRylY2zoIyf!#Lj$lToIV~TuGx`v16SA z>os$=pBw|Ajai(tW_Tx&SeDH)rOOJZ&t1$DTtXZ5k?VjqJn$Ou9{8PK~>5Os!S zH|oGF>jJlGMXmy>%t%aIB{mo~5`4`CSMM~JQqg$#7*Z|2-DI)Dy3vK5>=0a*;Odc| zE>VeI!u;jcS0?pC)?pfy(o#{VqEa4iFN4#bLFu(43K5zHWq;dVhi$S(VY~M_*YIdR zW#ExAk-`ts@0lJod34QLJ}R7tzm2OCo^MsOY@-8mF$Vk!FCytDv8W@zO0r9Fhuz+5bNhE5W8bl6R6{}Ekuc)2{_7|6ODcAW=( zgk8&o{w>Td-=3j`{95qiL zbJb~E*)9n+*xh`YJ2!soGI0GMdy!A{HL_)+YW+|~J8Q^ngKGi~DLq)W)Z zKf0(8Liv-BuP-xdbRz4mt(WtQ-}m#KX%Q2mkMeDE1YgCQSji#!KT}$60O(;`Gp0WL z%DmpVeySliFEWlYihonivDaYk@BDC99wS|rT%)Xo-9#GT#*QDTfe9X-AumaVfG7tw z+)|T1Eax!r&j_JPbmRzmB9Vz8TJu!PRZNzuSYunq+RrrJD&2d0V=r)pgD1}7+62- zG~+@MQ^?+P;6{!OUC*Ysj7CMv9`_Xaj1UPu$-Pk!(^Qt- zAB+#><@6w-Bjcx`0S#UR;c z#N_d3DSK%MAKph*X>%^zrP`$t8%Y~xD=x5aVOA*%6Y_C0s-kjdZy!u2cgUOmbhNgY zcjD+nM8~gkdY=I63Jmn$Xa287il|U2Rj#g0(eCe%2V_?E!+3jAH3ClL)MOOdbTk%V zP|om02NM)y0%DaTHZ*ZTRpefl#|6mBFw7%V%(=wr(5nN!;nEp$%;pq4e!!2&*ajHQ zYO^w-jnm;RsAGL@=KQ=Yp87R)2NU1KtyPAWR`#y7TE1H90V5c>Y7hy}#7lw*7T{q1z0`L@RrbVNEE>y- z``48^O(y%}PBW>w@!vu5UM0l%S-Daf6z~PMy*(G%3G}ChjC1xiE+*oJhfBHEad-$meFD+;nFX9rb_CaawapDr5`@Hq!RW$;dh+%@_X$FU7^o zQ^fD9NvU8?BNEPile#<=vZ|O>p^gQ$8GFq5J3DRsO?T%XHuzRNw=sm7R^vzw&zDJk zFd3jF8@-~U`^D+PW`-gUA9VFKKfV9cEa4|2nJ{V>D6QLFyS$1(QqbMuh%lZ%;(0= z)OO0n;OG+;GrAK2Zz8!Nk`4t~!Q4pE{)ohXM6g%=!B1kpAcMcxXtMFSRRG!`n>nZ%D?^cG!<0|5ZJ3#H`rMP_Q?{dH=~;I`kWOy4TdwcyI4Q+cf2(r44TZ=m zx~)A+p;7Fy#M{(LjlaoM2!IL)+t77um|+mIjh z+Pm%9r9<+UiB$Qp4-EV*OB0DF#|DM>B?UVzas5l7-dRZEuObA&gg=FY%U82k(s7QDXc_0UvUw9K)J7Ad zCIKjXGBH_5_xC85te>zgHvGgs;S9kvPV~x~wadwS4$drsbP+6(V;rLrcaO9-cN2yYi+?7uKK$Qi;?kngr2yGLxYNplZ9h2cDY*1=q#CJ;n zzI}w;RzEcVb6IEPc1lbj_~?HuWezidO?XYd9*UM@<#1E{-Mvb$k01JqGjt*js3bzh zRn0I$_~g#_fG=AAs){Y{7b<%F>++)etU=_a`joCM|B$zX41`u`XDukWE+ebr2DFWt z27^2#|NA5o_%GmT$|4;6Wfx$BM3W#hD+~QE_HX_%4B`R>i`|B-9{4$#46t6W=MC6y=jnHV{8+C{G%I8W2EnM=pI>>Sy!2`@yNiVz;z2LOKT2V8< zV`D?mC3J!;jz_JXjHf47rI4{9g(X2*U;fy?=lCPv*7H{=^d>A3HA8-mutrhgy5-l+ z%q#5Er!WiuVJPHf_~pmTZzH|1m#}4$Ibped36H{bzuNSfNiz*pI}5!TFM$_9;i0EZiu%9&z`uW= zdaIvIimE;YoHc)`s&z+dld6%Yf8T0j^%O^*hRW1BdtRO>R@5oUn8+V*Z@(uNCZ^2{ zR-Ur05cLN8X>7 z9!Lz~6>3Vnync7hTL7v z;W z@rF1EKomAfw&V9+`{~CY(i@I7!wR=7+nNyGzBXv*?%cbaV|MQ8-u#C44mYEQ4)nTX zjWq3wwLT}6>n*hmcdn%Ii~jSSa5;P4xcM$;<}vt3N{Of)x>}38Ci&~now(^Sc(~~e zIya$D-7PAzElF8NJPkB-rSWf6iE2l?;?Ng2E_O%_u00A9YtU1aX{%svHbE1ItY4GAshXs#0d5S^qTOM9KD$NO| zJ*%X8tz{XS4jApU=eSlqj=cOk~$D1g}kk z(vwrI315uwHN)Hv`i~~nxiyR4LYcS*N5A*Q13C{jEqHFvUK}PXlu6MyUGwbx4>DP5 z^{RRXCgSN5t>iEa@%-A`O+Vp!mmY4c~g-xaY7XIZ?%N5X6N+|QE}Oj;bnjW zM_WfP@%IKIhfGoe95q)2lE3^_pjV{kLP>d zSl=w9ymmru)mGOYZ4;C};_JApmpJb8L2kei=bEUuuU|m$V;$?@#X&TA;|F-ZO%?gv z@!AGj-}*wv>$7Us{zICQQ~xiXzVutPg@Ka|nRPcUOW8_T6KZprb=%fF1E8}(vB6lx zb#$^KCkOo6<}Mk~;Ta-v6|Jdh);~&ZnZx$luFWDo z2}|Kni3(4NLBg8EUeSKv`^L{A>f#muN zKkoGmfDcUV{*DNZDCFL+g)p9he=&rHKpy^1{-ta!;yxWV zIv*k%d#PCB&l0Djse-l5fG1b{_=Y`(B_GjSRc8hRTDi>T%Ldb1UrM%~wL=AQP19aI z{YW^Hv*vN+)AXt+a}>fMR4ZOgJb3-W-i;@Ljxl|RdV(29!kCy^oGn_=gMxJjH>4z1 zlvD>TTaGknj^bzHBKKa_{ZckLd;&xOAxE=JjW#hZHzjI+W;)RqpJ{+8VH5e7=4c@I z_mCwcCR|j3*d#i16gR9WIcB=?KyLh(p2DdPw<9Z5Ikbe5oXV6b!H53)?K4-f30sj%^sdA2pf7g9GGt>A8h9g~ zb8j-EZ}bCS{VZ5gWV2Qg9J8^}(FOmHxhhqGI{#-gv0&@ zdqm>*Ffjg)EC2Pa@uPl>Q%x<4eB6>P*_tuC=56Fc^xyKOH`tR8tp80+%=}k=_unST z?D)l^1$IdvKdd0LfJ@ir&+|6Ot8>weD27<7cB*zAn|Z~mx*U1)#VS*u8=6>5)Qx|P zw2mj*8an6vbAYQu7920|VXna=W6$C+cQI#hwY2E9!4YFzlm$JRW5*x%EAx<7 z@)d!>r`7bJeBHmW(AT>D!Qnt1P?{M+t`FyY3d$f)q6v&%G$0_$F-hNqD@u#)rbpnYO(BAMP3y|$CCwoAqJSnQ6> znjbh^xK*|I_qkl65}@R+RzSZk;JN!vfHx(RoUz!jQLxZWajl&^6$e?EU;e1GGTel<2aRyF3@tzTK^qATjxSdMJZ+&qV0 z_P*%*@JaQ1GXIhaz{|+^iFW#LOF&!H*YD^sq{Vkl0lBLfxlpsJh(~(1`gvj``1&T{ zTtqxX_|-pmkJ=(U zq;Ujbt&Xp!XAD^D6l7C;cX?!0E2vf=ql<}}%qw&S@#DrnyxCFz{!{??cl?G3fX*lC zC2i=6mwb`J|9JlI~AAhnho0BRvujb>??7$9f8iw8e9$Z|kke1)$>3x%s z{j#Qt$glZi+n}Y0kE9LXLTtlJmi8~!eF_EPZ(r!OcnK4R?sm>LOHzRAB2T%X{=`!I zB`j70xo&ysOsc)_Q@oC7PZ5gPcWIcS|O*} zI@?uG+qx^4&t8$khFsOUDxpr>iG^LkL(D~gxV7wKc;hsg_dls!VEIW!H2fV1O-+Ry zuTB7u70VKzeE7rbr+U+1H9xhe&zBLidM2;6&|9LxUyyqsB_Ln*6M>W)Wl zaWd5ZEtT`DTN5)ln)5gj=#(nSexFutQrdeBy)E53PG!tKe5h#w1sy0m8`jAUM>l$y zT>X}`vsOv4)~>4QVPi<;;MeD1Upycp>O?!j^-a<$?R6|s1!iL_#)frO<0vK>ecv^@oB2ZB-l-I#m21eR?^CL$Jx-<7U%XB5JbRO}-4T~yv8Y*63m%yAllbpJ( zrC2PtTb4pD1pmhW|jT|Gxbr z9ea4w{e^*8GN}QIlVR4RrST}gbNyrRHY8v=zwmPWa~#F(bYTZ+7mnh;bb1BCTq4D? zIkdQc2;Nh8pQsqMN#bvKy4?$SdmPu*4U>SaHM2EEy=73E^GtouW?oSL%?hZHlW5lM z^tHoHLR9&?dj0#8ht_|kC7gzFdY9=8eAP|^>%}u^<(gj$tJT_da*OufTEudum8xUR*vn}wd`^x|BJ}Dd#s3mRCZD^BvnNQ zh{kMY5%~NQuYaAvdlT7)2MbCGofAGr*Bf1m_XH(fB_(LNDF3E=vb( zdxb%ysa5vM_A#@(_CTXJu~3EC{+r|Q5CgAYr#@EQN$nh^Bnmw+Nr@NLftEm6OKMs# zxYvxxL4yRPBu}$geM9|}V5rfxMdHes^5{lvE}Urtk#`Zly}c%t!M4LlP@q$tHj4v~ zaIqLfy2Qeh&7#d9pZm~aFw)j`JOOJR+2?vQS$Qh_ml3&=VPHpCOIQ`FvkoExu>kc9|vC zr*0vG5CONqTAi)!2Puo~KgC3GHkhfTmD!etHR{pqgfhr`s2_&k)<~X@7Qx*~or_Ib zcd-78dx1eIxL;yJ5THQ-cv<1;GQv0|F_v@S>m4irA|&zShLdt~TsNKgy9NbXz4xZgz#Hh+El>z97X1(o7#B|Awb z|8L@8)gz}ptSMqF!V#D7-%jC#{nChZ3?lmnIGQfm^B*UC`=Ju0VMYAEwz2t|Z8}ay z+0>Pc754!pLxfvi)wncNK$@Tmi2biif7yqH6)x_fQi!bDyx3|C4Ku#wzG)%}+4&^h+OgGw(&Iz0y$q*Z{i35-GKIKjJpJ!1we-9}CRsoiC zFoB$E?fx^U;=$mTo%)sM92G|C^i*C&-1LQ1atLio42FS~rt1Fp)Q+f^Q9lI>f%CKB z*UP|P%vMob7XZ6_7W*D~8_8gpM#s>~Q)lf1vA+ z-MJU!cl7Uk_pqpci*G%uK?@2AQ4it_L zh9wKUqXWg5HY$woYz&3dI~Z7b0gKc*GA=?G-2a+Dn-5kY~OyYp!EYv}ClRqOKmxQTYB ze`u=1T1%-c!^ZiK{#PHn#}-=71rQT@3Pam;fbzSIK!DD5q^lVJ+V#xQhM5!*mhxys zH8G3U@8flu{co7pM$S-uvz%EQqWPHe{13qjt9mx=w!^eTom@9(J;Vm)1CkP=7XF)g zPU`#XS8HNAcgHGR>~WqDP?r|qL`d(cLu4J8oAVuL`1`K2#;-z|KZ=sP%5}pGD1WpW ztr6an?TW9w$5A=_<^YHiHMXVX_!a*xMLiiVr!NzYK}PiW7tIu=({|9bBk-tWWQexFT8v{^gU5s1U4RUFe zI9VWqPmhm;7%)SJOwjkwiI=ytqNE%@F5dbGOnU{cvg_3Dfw-U|A8=RUTjk$bH7zLl zI`#t!9ER>x-7Mqm%Cni${3Ti)+rKimyv`V3d*^)Te5!=DMG|-fDS*1N2$49!X$IRS zKvOCNDzc)$7zHp8P-L^xrvlDp6-Nk$0TXOcDH#yP&-LlJ#@+8t#~*LR&d8}32Ehri zY@UUB9>)$9>sI!SU3vA>yjHeltpx~Rl}e0D_gG~$c+ku?fLlrt>hVa3l%v;nbEFaM zcwX|J77#`5?)%N&q(DdP2g|Ys+io~LOD2^BcZ_c%o<6>~?ym2TUC@5vBtTj}$lNGTt76=#1lfNIm-tzaa54^2frCE}tRZ&LY z0-$z2^xgT*c~+`wYFetQtKXL;cYCUT9H>OERjR6%DpfDL?;Y=Z$LM|PxG7)=7k5=w z5=pyRHd(DMDikZbwL7WGxmPXscZZ(!FN5*N9EgkV`_=C9D8HfZWvK;K6@E6_ZbZx3 zRlzeiW!>v3bV5R@V--pWh}ha8*v5o}HV8o3$}C@e^ztAW$c8rKeq`KmA_g#yHUr@m z>#E(QOrq_TcF2}VWuU)46De61Y<;eikpFYX^{3Q1CqEG&kPo zyRp7`B+`5*-4z^QGA1@e3}Kcw!3YLrgJKZINggFraDoVi!X^x4LGFcg3`#`X@dlTsDc3~8p9HZN0KnnMF{al984tG zO)y!F<1H+3G7FMOOpr+4#s0S$0Nu7iQr^-Hh8XIohVL*@&Td#>*+$;M2c!~1B4uhCbY^P_ zh}vkG3qdSI^1?>tF@tu(an~a5eRY-=uzA^Do^bAS;9@$Sm8DAoP3(%c&B8jUh^^h3 zYm^w3pl+$G!)l{;gddac!OvJAjwFYyICIGjA)U3Mb;scRLm~n-tqnGUn!VNUy%7r= z1u}|fGM+rvg8&0Kq6TNZeA2;ji!R)Gnos){+faOBGBpHGUgNec+rt z&-3rpardw8*{`dWo)R5rsc)M+?~G35+hE>5W=)*$@*@nDG|4ha6ufbbiCus`4%C>ZmxZmrO5GKyvjs|=)$WU6(NO7Vo3p265?Am%7TGJ<4& zY^~U!$W0FMnW0*h()y`oo;k$0#uqi`?}>6@Oe0P-mX&K(W_Z|!0St!sUbDLixi9bd zRxubTF+pNcwYJzY3RuL5$p#`gNC!91@AiL4ziw&&Z~i2Nf#nLSf3;yGR;rUMu_S+6 z7{~Sfc>1gT^Iv`Yo^!&9D|$HHf{)f6+#~`^C;ELwQAH&b)ThZ5B#Xbn41u4lA*nxn zbEnq`<&2Y_`F88yWbT}e=6P(JRuz~r8y>!FR_eC<_q1+XUeheScfxYTLm@Z3ge*~zks>0hu|!iuke+%ku==1;-)~2P8~!f;VXzy1 z_rg2$#I0eGsYX#nDMd5=gn(@L_5WuoYX8&TeTSQY4RUV$zasCcs7MFTP^I@{l@cQjX6~V#Zt)XtiD86!`-bQ7QE(4Y-Qz{m@$<|(u zCCGKX$}?(iTbtfIyhmYnR_=TCz~wl-G4uA!#fDa5%!bP}H3BnbHZ+;*Yg_M!-|g4l z{<`btF8;Zv<~%beo%L1U?LhQ@O67ezw8X9vwJfAeet$o&*B#fV?rr#MUF6)$qs>;T zPecMD0xF;slF#gKPIo2UbaZ;QZW+}-EDy*1!Z3UkJhs(3rh(9(KdqS0t^@SnMvm}UY} zB*fWKCNzv=V>2u_LcMs;F8@Ah^!v^{clx0#?e7=M49*&*7@}M@k&&#V)1V})DwQLW zBTS1#$qgeU>a!%)T~RZksX-KyOUWch)7$)0Pub!4KiN9wUaCTX=WEoFbB zW42wkU5?QjxvjZsOGXSOqQYYZ2#gX;n4?1Z`TP8}cw!SNPOkJ?VM7W&{QQn$KD$!x zFiNl?zUPgTY!YIrv%kK2^PUw`z%PDuT9}kF1UYhwo($~#I_Al!8lt4u>OH{7SmZxI zlfWQ-uNhnP{%`iI{#1HZB?VCm5g^etx|U%DcklQ2`TYKezt`)mUU%8|JiFy_KcJ~e zO;XcUMNqoWNHwp!>GXHaCk~u_I#BCV8^o9)FDUVu=Fi6@qHB?ob~K$aG*~?SX~yoD zwqvE2jr8wz(@%w8bT41u`2GC;e}7Nr{coBnVG#wUvob7*>-hffzs`5+=DyL);SD^K zSKby^f&9g~DXLh?c>sqle|n&K&k)g?kb;G;_nI}1w#LNasFPA1;d|Fwq zYR_c8=wE+-UcCCZpM3k*hQ9WvUo`W3zROQHHv^;z>eWgTil8Y_7E)0R(+;JjVHIJ* zl0u9H(RXglTZMDD>!pnZQ6o)E>Q+%4OtmaZB2ol^066|!Dx1Kz)v5dGRg1&lh!(Q% z@9Z0X)*@OPDMF-_l(kgLQxY^nwrTxr8};$}KKMTm;p-3W{w(NjR7M-EpAeY?KT)Y@ zK6p4B&^#*Qd`Sog^a36J{a*ig-`afqJ_ifiV_JpN%Ko?msX9@(gBg=Ta!3wxO`Ct4uF|Ej_8 zBPvu5AB&RU9v)S}w`otn0r&zReeb@=@R?D_v(=_PBz}3dp6vz+_+aW-R z2&5B%)rP@TVG7}Ki0jJ^1B8kYPP_sfK?d_27;0sB*)lH8j{D zf&hmQ1uKO|Fv=>o1z^z&fgF;$M4@3I5J(ENa%2b?MJC6PQ4TymcQ}*Jqvqni?aTMQ z#C7bu&jXIH9XqW9?zl&i=iYkvzHdSEbX3e&yhH2S)AP^JFc8=+5s;1=TLiO9ATpF{ z%y=0ET7(fHV5o>DP(qFoYQtj{K*1!FB6wO3+`)1JDhL;h<_aXrD2h)vzANu;PqQrp zCM-hW872`}3Ud-|nJf-K1Wl=oNs6WzCr%h)BM9ucR?Rh(lBrZxGXs*TAYw&?Z4QNC zO0bqBl^IJ50~r_q8itibG8TUPG2j`x!2YoQ34cZGU)Qtr9>`GTdmY(~B?YxnU2gVx zJ*WiU0j=E=FUr918vqb!uEEpM-2rkyIeq6ZbA0Zs-*Ml95=;g!cmNSPo$%ZW_1vrk zk7*m+z|G0v)sr%S>sRLC;m-J1oJ{j@g(NrF4@Y%qj;-gH!Vn7*5Ez6b=JspKmEgFP z0x1dgW9lW0Ee{#PwbDN8*nQ``>L-Ym&IGdu2Ae2ionK7s+VD**#m#rwO<3;7-FDi| z&6iK>VO|dUuY5{hBA_nN_#PTW?vr?QgMO+Tn`eIchgZB8(es4lv5)TTYdvqQ4Y0m$ zn5+uCN74Pyi(@3&lEZ!WRlV;>ZNLSjm4_sdW3J#IrRf$U@6>tn&~p1#vN z>NoWXEd-S&g-Vy7eamZK#zaz?LvG%8P3a_#p4Q5DKIvUm!`=lDk_eID9&nK&L@u{` z8}nM`+}itts=d29Sr2@sTN*2^>go_Y6pD3RxjYrPK?qlP=F0@_x66FI4f(;f2kw%Q z=DqIr^y{4Co2a%omtwBetI1Q+HO;B+pv7EQUiEkm8Bh)va^%5+u9_%2_1J|3b>Zeh zpFmVBectOPpPHB3y!}0NUf#&?asbxo#dQ*ujz1z%+7^9vntNWVkZ)aHBaYc$mh0~A zg>Q7YVTD> z$Lv1*?+wZ9ZI8So?~3T$^;C+Ak23Pg%DljWh$4z2JE3hvS!jr)=Im;)awUmn78Ey% zfokAUZPivlEU_??p|eDq840$5q=db#U@!{G)nKJrnJ~<<#Jg;A>}v3*6}G^!l&qTy z-rslCSG~${E5pweW2?JYarlUeczKD0MOBnhQ)=?w^wp0luc4t&SF+t5w=Y7HKJgS% z3)h!O5SLAr+Tv!)qeGY;@|urPDs;Jev}R{zWiC0ctUUguJFe{oD?WdH^piRB7g{u( zt2V_@a&gSr*u$gMcX~591QCn3c4_*)%lXy{sPh=lyQ}Y}=o`21(SG7y_V>GtpT8{) z`P*^`Vl+~?YzDe_2aab!rVzMbSP2Sn_M4w_4U9U5U=7M2O=>QK?M8;O z1Q8VR9k7hCc!ppG5DDhk&30??cJo8t%d2$~PTKO100SGSEijQb%P>-??p@1#F1g1f zkls42CeqtPY^=;FR96~Q-cpvRb9dcR;#E4a+Oy&XTFd6ET3ES|dwK7XNY5&p6)8>% ztdrdZ>Y6X6u%KClf+rBxixdvbi4+uR8ABUlbcn` zSdoS_r|sv*iE?-n zt&u_+)IktD>Tr-Rzkfs!2_TUKXr@z5dPxKASZB6eiW>@|&da&|X7p=8fo<8l3;lCR zt?-2XWc|D#Yb9PEBtGc8{j$sX`*Emp3@x|6%+4SLJZy-T!@C z>YA**r+nM_-MeZfkcK)gySpwLsI;UlRYe4oNJ$kEl(bN63P=Kh77}XbEAImj?xx+E zH?s*Lq{(op4X5P&MnJMo)a}n}%OU$k25N%B&DcM=qYWYP%$m)4MCte;4ShTj&yU%4 za-Y{{wJ54; zim)w_5R!e}9sa*sJ9?5_(1sy#3UzZ^ZOM439~e!EH#y)7#gLaRi!I>;QPK`hoIhRJ@;m0 zpv`6b=lh16O*5sma0Wj8J9{6bKR{^%L3SPn=gbQAq5MG5KiDt}lYO)X0BcxgK)E<^ zGJ5NoK9G}K{a=0$+3vUY_h>lv* z_w^JKDHI*2)w~*#G^Gl(n$M3r`LzzmXMUy+^+R(;xrCBr%X64Vr)K`WNrp}H0_5>L zvkm$71#Y^{fkQqZ9(y;!i)z12qYLNjp9-qS`KGF=1u1F~Q79@!RjJSvv!T+eqa+BS zQUZz=nHGd}t4UOgRaHeUYjx-DRhqBl`@Hq4WauW(`9&j{f?8UtMFxthZg+PuJ9oVs zWVWy0m5QKPU4=ijyCkL>%v z!}~99>-YN{xnJ_7nWoGng$SZVln@uD`#bn(JF`c%NBmPe_~uS#kO_Y+6+%?1X({v} zXadMjFZi4HnPF5{4ctD>AI7yu->m19cv>8(VDf^pd2&?u;E?az_jG$L&#D%Fs8;n~ zo3vl$riEEWN=ju2sHHVsGy2W%&3NWt$2G4P`#oCcjx#Rf6=+%h_>xLNc?1*yfvx~# z{_RhK0|g!%try|pHg80BbNSH@>Wy6mrP={NSFj|>^XBzyVf}xtznpZt5i7(Ld_gJIpt&5bpKbq8@6ngKV$X-Y?{8nemvHHDb>42VMvBzL1X3!+ixvox zME!pje`d>=CJ}n~w${O{mh!%zHJ3cDS%|%A)~P(|wW{-pdFKrmY?ZBD6!ubYG=Bn( zmi?80)BSkrvsjB&b#$uU8r*F#s7W`1lPjt*Af<*t3ox*Qc-w%H1ei!{Fp!WitHo#t zmJmlA4CPfpVk;t0;kHPU7$9;I5daWIMN7EQWH=ov3=~jYFhC|qU^ho`?|0WcdHb0` z<4)2Fd|kfK-HHsuHD;o@dQDzK6&e!sR+Qi@l7%&_MVzo(E+il#C>~M~t*1*OmQ1LJ zaDqh!Fo0#B;bBZ9D_F)=M=sNQ8l65@9X$P=~PvfL1|%1)5wQ9uHe!!l%8hyok) z_aA$oy}e%!*yo1{u$IAz#tv(VbaQuc!DSMQl~61&fTSp`3!xGu%FtBl1R1iEtRmQ1 zGN>p;BM750P>A7iL=2ht_5JrA?EW#h!vu64Ja6=h(MNd~yQX|o*2mRzv}r?%QLH&f zhQq#i8WRm{%`}izE`k!;D`DNlE_Aw2At!ox6{~dkue$HFRsz_dr907UNUG5sp4Enh z+lXHpZ193j z(NM0s-&H|eG&9^ju5HM)jtf&7S@k|pPAhM4(Wt93MW}o;cY8owxJ|EosP4;WuDe-Z zHH@X4tJ#N;_>;dAYfiPjh+!vg-d zCE@zSBL(fNN|tr6y0*=A=`->yYT*6htffUwEv(u)*Bb&nOIEn~M>TT#gr8 z)$1*qt=Vb4Ro9S^$V3Ssz+`~Q7!n*EJx<@XTkf`ZndQ!vu3tCdjM&zC>KcG|OQY2D z+^B8Z&|xZwS(c2CKIjR%>+myd>i*5X_%b>fboRjgGT#-zRjP|~Jo|?XS%OOird{|W zv_jsJ%bezUX0E&wgI+fu9RsKg^a^IvS8nq`71W*Ltl0az9c6*NOQqn~ z;hpbnU~?oHla2ybAQ1r7^#xhVy7v~{D(VZ*wptlY+Y($-Mm*sJBxDjG2t*ECSSPbd*Kseg)%1JV^aOL`tIw#4?`CBhTCmjH$~a1i#G{`F4hR( zHF0JFc-{!~zBc2?Cn|mdAnU4#+$Ipb8D$zYQG#j$U|B+~z!EqS1l^7x`Ks`Tu$+$K zG&b zC|GgBBLGHbAt8}A;E`czf@zf6B1o%PMKvsfQ)F()B{Yf}fY)UpAZo6pr{AO2FKz4} z3G=?cfkUr>`twHX%--L-?@-tkP^%dJ$z8lCFR|T=(R;O8c9z>;E|c%8Tc+RNeI%E9 zWyaX<2XJ-F*W~SeZ?itnu;lEh*B`Dl@9O&ZpWCAJV>z{&Zq-)5s=oW_^sze5eb%&> z_Wi$3=NN?o>$e@2i73t)g1RbTOqses9!lySFqW_o1z|W&U}yqBCsMUgmbGdgI8RSB zFOD#lZtR*iFDo(vPiRIcQVH*&!;%O@FhGrpGzdjf^&}ufco0@Xew)YL`|%?A=biXL zd96bW8s}J94XkD!iyo}eTd0CjJ7tJbmvBX@qhuR+km<~DsU9tqj5He=~pqGOq7>4k`_HS!YtQgN7dan0`ut0+Z zF!#~Q22v%(P4$yxq7Yg=C81~q7;2fTbfK>KzT#0RXrkk|-!BiBv9;VPcX?Le)y7z~)AXVyY-rSU;{Egfite z7ZDVQjFvRZQzx%~9;^AQ&cR=F@$?>jdmI4-1^&C-2aNP#Q>mKF$lj}3IgL!7C0q4) zy?zW6>>i(jLLdrF|tPkWrFwba}=tvnu@%!SqeN-OO={3gcq?`UA z)1g?k6isDSr6{L4RHegTv(6s-uD{<|jrwOO@Q~D#^&wO}-08|4zN+znVvVTLww6it zOM|^tfrw}JdA}JG&EF1m`pUl^V0j@gMzFdIOOKc3VR{O$Js~GSe5=_-l=OMoD63)ys-`n#uCC`!X zoH6ZHona5u)=5&PfzVY|2&~AGjVxNKsz<^AcI2_1GQXx59iBBTnh)(}1g*-3jZdu4 z2>`#}ze*22KUtqO_};+&7H*VbOG{8_s-ZKbZ=czIZo7@|9pAd{_P3a_Nhn}IVz86> zYO1JRbN2BTHY&U>YK^lR#wlV|RRKgr&UQbq9{t<*TA*hvx#XJtT-Q0SO|SHivgeQx z$WhxUfF6Voe@^9j_Mqla_ucb)=hs!U`v6)+U{Y3^XjKu0g)F2+5?~I!b{*pt5U%RYgw?CLH zRUIu-)l*ea$f77Y!jvpRqLi}ewWf#_Wn`@=pw>znC6riLa)~)*(v?)z6I4}7^!wcX z*Ie#i_)-0x`#d+w*87(LJyaw?rAkSpq}JIrR{fczA%KZrj%CZYUAvvm>=|hpBFzlw zZB4(T0F!BqrcoB@wvOuQWr--04J9eGWus$$UsvwEZ*_h2KeazuGj%BC2k$?il*>K$ z=m39nhZ48@&%yTUkKHHmc8Z~@D5#ZGF!x>azWw#zwVlRH`lqZrA zxgm@hibz2)FxCM`1g0%+3?ww1k_PTzHMawGfQweBGLjO(NiQPIv1L#}0Cqy=0|Oz7 za#3MIW;29>DM{Cm8kQ1WYTF4UT&g`8m!dGa>T4L)JUTb(VeeR|Fy&g)8)F>|Q7P(#+ zYeIl~!z|6BW8H~wuoK|i(KmEo3(GRttwUJ8N1815Z2~d&F^E=TjC7Eg6Bs0O?C+&4 z8*oLm=DDcu6=*BYyP4vj-FCMen;*^0?D@BOebDN)^S7FNv}5`1Oy_cEFH1pj;q>cT zJ|+Fs{s4}okJBb2FJ#OUyX{LLr}x|U$C3MNUC0UL*XsjEdHAs`{c`)eI_cMU)+61o znfqWLXLj~rpxc5C>lnA=_1u+JS@Yhwk4pNN-G4CiZ@%r4Nm+JX_f~cB8@el~M|~>0 zBsUlU!H^O#m!rdcvuD*=s}frSC}Yd!y&vX9j5)*FH)Ruh5NvJ7;5h6M5VWztqjd0Ln6V#*}kY9 zDO@j9*my4M?96>CT-MAD(V#342?S8>weN3M#+~N-r(km}*DO-(dR{)64f=Zf-E^tH zJM;I>XuMd-4Tj=nVi|x0!Uk|4m~n(L`|zh@c;~84(v~vYrkl2@G#F?ghlW!H9ggAQ zaP(z}ci2yW_&+&zid2daG;FwYT<%>}xW+Dvk~XH-3cGur{Rkv^7&jjqeXmX9U=AVO zx_~V_fv`y2z#9h(5aKIC5Fr#wwrJTVse`K2rll*ggaDO;W~2))Sm2bYd)>8o8jnT$ccKvK09_51x zEA=(T=~ZHu3JfM`}>NFqWM!uBecY!n)}z4$^ZH{&&(dX|J1qee{yPc+OIKGG{&eItxs^7FqfZi)92*n8@L0B5tXpktfV7v7~AV${&oI#Kv zJVdmom;f5wTg;acNS;hQkBsMR?b;EbiVmUx7^6J+%9(3k#8A|*q{}*UHSLU=1$fTu zWfW2x(k<}oZAmuUZP%%L^^4=#dp~_onx4e3;U0GS|@czg-AGO4x{KeDD~i2fK(K-NmeFz)0kO2UCO zktmIq2!Bv=rvFGo-5OpQGbR^M*nYWr%-&7icM18HP5MF}e0%%#U>^J1hL7zUD5=a+ zij|>C89$$Yf3NTQ-`DHEqhEQlb(*Sy&i#IQR!ssR2#`QXHj!kc+bU{Jr4m|MQH`dU z%9SdTx9aWA?o}gSz%9c-Nl`MQwF)^^O*Gg_32Mm2F3>VrYNARjD=sui3OY!jkKeom zsA#d)cw~B2y8f4C%#{lSKTD~TjC|I;l;6jXeDTtI)|<_+LvpTx`R{w%{D0G=kX52& zL@BWh;b@kq83br0hNU4yRdh-U3aT?iMOhm;LZ+&rs*69rd;E0tz8{3$9p?VYz3Tq* zyF}ZFQaWfWx#eIl9l}ZSvPl6|Q43I2Y>BKzwTd>j`Cr7gkfM=7S2Z$$2)V7yi3TLG zmsR*)em*}p+nKpir}qPU-p6vNKYL(u=rtiLmzW9c0)KFsIrRl){~Ct@Sg5F}{FIb| zND`6+j32an@*+hAX&87fd_S36$ktzSPg=a}gd!jS#8>k|p)9+U_p<@w8F4jcJm`AjK40CekWV5Pm&jsD1oUF%XjT_Cq0M>ca*@_UtS? zWkEE7`@5=i88z{&!g~S-=y%eoqQ5U}_urlDwO{I1m5oqP%4(<*L~(KdJMZcb?);dN zone+T_Q4E~z=7i{DO!?AOI0M6$!~4`GZUs?-VWyqYLp~hiBxG=(Hazzkxo0Qq$#8p zDM9=nIoyOSC6r2%2a;4Pg-CxxUtea*l~o~7YjTO;5dPPq(4W=szn)w7#qI6xzl_Bc zAqoZ)C`^fxNurT~ki}J1MBh*B{pXkOuGgQ(Jo(*np8f@l0Ki5-ViXej(h{=6zWvh+ z&m@p#fj_ePVUQ5RH~R_D9qNibAO)DI`}G|CcK-K|@E^*=P+0{{XDM> zKCSmTpsMe2=Kk>A_IMu<{y!rYD4_lzh=UdcH4R@sRQ^Wu_qsI0NjLoiMTW8+LD8b<*J)rM9VNm|| z7Y}tu=sVuZvp-RHQV%6Vc|8IT;qrd%ek7kVPk%}P+&__Gj6I zJ@eS-Du;9(9_$|Cz@ez_y(y2r@4owG+*UpHjy*Yo#0bJhIwio=0@6rUwn+v^q^lMa zg{fk-88fC1Ex!qR|RT36)`)hO(AXhh|$u zrKt%hnvEq;=Q*{3QgpSOT1>!{lEUXWRU&IToK|%?{ZIPbKevB)T)%IC?{@|_6fIq7 z8`>(>P=*QtGClXVy7W!_{O)^(CBxb&)|U1SH~<2bN7B9Tdp*RC@*CBZGZ=>I_oZwv z+&J17d#z~j6W#;Eo>yi(ouTdDXah^m5zKq#VIJTCCrsY8=QfS`=BT||z@8p#D(Q!e z*c@KfwQnD7umt%ck?V?8W$85(k0NS~_TKK(>B@0uWedy5y$sJr1w<-jvH{E8AKv&& zfiG&m;z#)I+o z?{^3J1%DqMwlBmPEN+ho3Ozf$!O?r-ySdH!K}@MO*%rkXE~_%Q0ui@idWYNj=N&;Q z!G7|iLXTMYNRAa2@%X=4KY4nD_<{^!x8!%_yF%Hj5id_xP}*i_%)L(*O0zDjN_u|! zxVPPYL|Nf`Uq7-pT!1PkY~C+!g?BkyyreDBHDhMZ*F;QG3bt0&VXeJ2nxeDa%^FxA z8u;KBq-4*g1uFhEESp!Uy(3p~=NV%+s8Oobwl0wF-NKUgA)0e{i08f1mO8SXPpxJh zlcS%sMqqj$k}vYVlY35-akrG1BdQY``&lnh^&hQEyAv*t5_XZ)q7Pl{-svS&=IFML z6?NT*dN;}WZAuH>Xi`x-?5n-1a5d(w`e5>=FP7)&wN-uc_(XSmj<|!t?pWC3GC{BhxM1Q7ha5y+ zTa^$_At2iU0E7+ zgpwmdF$+;ikuYRHBcdQa^59VG&xqQ*P_y`Ep+KE zwVyZl-$_)h#%Hg3Klj(=BD(S#2N&{#Eol(NL@3W@73+@}?M;DnNJt>kh`%8FOefI`quQFZdU<`JwBL#+r^gjo0c%VVSdlxg z+aC>vbOt(uk`E6>m^+;#K@7H2f-yPQW60!MFaQN0OLxbZt-B7Us=)MiBNFC_!KV)h zl?Mbpw?_E%o7BY_qn49h5dzqoupya)VB1AH>#5PK;Gx$pv2$kX6nC^EWTWawiu(BS zeAnV6q%8soDVYT<6wnY=NPr?pOuc;g-oE-gefd1T({1kz*(9F`sHzHrELB+) zL{Sk4eaUk<#^=VX%iYy9Vp>n&Ggjxecm|C3-WjiZf$uP&G+_-5)GI{%h=L+2iCI|P z)|YqYxBEQzT-F|UmR$H?i&Jz>eou9hK{GruHnKn-z041)a^Cx>XpneF1#Jedd?LA? z{bl*1ChBdqA@cw~L-N6jkx@}pRYVmCxXYbcndgiu!s+!l3tCW^8L5x&b#VZ)1 zV*)XXlNhQog(fj-uh}M0NV8Vitz&AVZCKja+O$=u+gdi-i$V%O52!y$3GZx_BMvY$ zR5G{aeaLHvbp~2{vCZfvz7lxDnk%3rGD$gG_HO!wFZL423Du9&&er=?+K~JP)3u?L)f1#ZLU?0GLV!7?9tWAAPwvPL<*MYjxsoY|PO~Vb5yw zJ_NiwEP<~wQLM1Do@HdLS8g8rFSir4SpJ5XssM<+KK-Uwm)>q>cFm`r_T;tJ`a(iO z;Z#`|NJx1Cjo;=4#N_3~yVgS(&QMr0B#`YAxLIcTvnwxf^WQs7)@LOB1r=3bBBCQC zo^!mqKJIqR*X=bmzj>VRd>}v%q(zJv00T0sp`(Rp$Y^0@wMXfhg>O}IP~QBo+pTOc zv*Ud8-Irzl4v46%5mrBq4%&Qe(Vq3az7^)_z<~hzAfgEZ0d#rJ?o2ZZfxgfMmz%;_ z;7JPClu$Fub!Rj0eLc6%zXeAKlxCn9fWZt=Ral6OMO9Sh%wC&y&y3?-)!vNp*}CnY zS9)t?C!z!hf)Izp1Bt< z6{wY4=5efuZg-#9aBTQ`%#z(QFpbe#{N(g*W_G+Cb)2xB;B*eHCoP44>ciZg!P&#K<( zyPs;JS*Mo46LZ$LRllOGHCgn*+d>dp3%=5H#4yqwPbqxg%S8H?ktXL~*W1!^%lmk> z)fUUYh|^b>_K&7HsaAa+`mMApGpm*EP0Xqgci4p5NmFu8J@+l4 zd3do$&lVwuKdU0@Uww11>ULS$Gv+(M@qHGDYEsMV-5J&vv-N!tvSa!j*cTtJlBH5P z(f3IdZ!aEY?AtBvQx)3tw*KxLgzyGIBP59gkoSdor`eqLleAcm!oO)g`ESioxFndi z{M`0}?W&X|-ls@8e#2sIU2EhfWh>uZa~)7V+!l{)7@uI{x=ht9+ zZCxL6!0sz(a_<~(yM0yC(C`OjNPq}0vyk!l9s|m9;srE^BUy>y_5foZeOlQw9;Pb+ zB4yWymu@xA$jf2eGy(F_<8^vaj$BF|uED$6tX4fH;yvbuyRGhdvs2GG<>jZCa<7yc zxv~hzK>{@?X|H!%eOJY^eNLvYEJW%wiXR*7Vgr#?PY8zD4dZd`g23(!ck)>=;|cJI zz)I-jZX+9|ggYA?2LvZ__QUS$yRIJw4m>-wDY&JM!S62Icp&!Nd-i?zS07>=82F`u z5D-IQ(CrBj5Md2{;%AQ>E)|b(@Ngm~J1-2RClHyIFbS^@2W)Nd_uW0vLLJbgP*h{| zChihfD5^83HG)M@RCf68>Y{|IxOsVo+(HO|VKQV)7!fYys6JHipLal&7-ui}_52^e zyshc?IeAsEaM&Q@GqQ{vm08aF?z=@bK5y^7lBi>L!Z_urYTqgs_PS}?Qap3!#-|D7 zPZ!7PZ|T2%oA-7K%wGw2cU4=sWSrkE@SfDIxHOd9`h6t&3|+LB-wfY-+d*Hv2UTGN zBnqab>%+1$uEn!)uL2Ho)BfT=Ec z5#V4rgLGAN6V6qqDyd+JAk$4z4xKrj*LiVoD#i)d#CGT>QP4t>-~+ns1_wng0}x3j zv|fy8jCglwTJmpb?GX;sCg@Nbc+p^FQ3T;ZH(H^QCw9eN>s>*NF;&@AQC_%l1H}V zyZTgF5=1MEXF@sGf7TlU1ic&nkYBbVLzRQARb74)1R(_EhrwWZ|r^K9Lq8F%4582ES#8HPhVO z;ZWUBRpDV>sW~h>vP&5FHu=*k-0=7!il~C3Xv`3>Sc)`)P()TLAd0Bwyerv!<^7k# zP5$=e39W1L)B?mPM2R7)LJ+;*>XUW`gpR1Ypx4`Z&kdhMI)-1hVG1raCzxt)ZN2ST zemnduQ5Z=ek~}@{uV3rv|Cl~PUTmx`W%AM4Xn2x-Ng^V#gptoKjMZy5M)DlFTII?- zGcYNfbkErP=0hj5hkkrgkkWGky-avj`TMR>8bVmfAjuIc_iKgkxuM_Fn&z}Rby?;C z-)o;i6j2ofMr9-_PF}2;EvN^ZGgtz6lt9t1E^(9eETHba`0`f$hq>!|*Dm+V{o@4^ zDheQosLP!F<$0_xzTEV#Jfn17-?%3aNg?;E5m81$XiO9CRKE!_%J4icT$`fOS@lDK z^>-j~JU1klK?r(lmQS!zii#kJgjfs#VoMTAYBZEZ6;%3le(zrE?=L1ZoA&R|Ng?$H zgxLxdBx6?j_UiZdS6)QrN(bAP7L#<9EPw*TkXTu?q^;S}RYoyUA2s%~)9q$=&eit! zS;P(fvh}(-#Q7CjuGBSEEB9-|G&8ZA*GrP$JOCj^wdiHsJUsC2hJt?Dpo%J@DzD>a z_f}OcdClZB`B#~toc&zAbguM(e1jBL0eap~*9wR0j{d@6UakbP!b2=M&vb@+X(%)^ zywv-jQ~=8_nY5Bgb@<>b76?1vjeeu0ny6~3y6WJcN8a~*o4Was6w0Q)IqZC#;W!0V;R_K(v6iW8%ObXt0%V3E zc7jAGK-EeH2@wnoSYnu%P~kZRY=eO*0|r2CVxchug4J*mB~YOI9%FOs=e)XoSe_j9 zh4JDyw!?%W9s=z!WNE;#kr1sC6pmpH4~yfy&`LbpK0dc7iiz|?ax|$3N(Y!DD=8JKaIq9bVN4&b zx%b`YO9y8!4gK9_Wj(>V1QSLL89P0wL1MJxK00PCIpDdnBB-A~KLD@X(E*pZ7~ISU zJTMLyZ;2>z?~k2J2)5d&Yi~<({N#MT`4Eh{>2w_A;kLYV68vrQwqEX1LPR7#n|>$g zdbZUr&FP6?_*CtqRZ@$E&$A&_!|fgLeLar$Btk3Y74_YqWBWeOr@g-`31pb8>1cV2 zy7@Z$E9oWtv0uk>x95QlJ5+1#7vV-#JH=Y^iz{VR>yHk7RQ79szR-K~ZCaLWHHX0j z$*#q--h+?3&6)ei-4(O0kwp#n>EpL3_JtMb{{=4id{y>YitTn?sq?d_l)VL9TTQb# z9NgWtI6;d$Efm*c!Civ81Z{CB?heHZ!QCm80>#})a3~h6KwH}Pe(CeP&;8$fzyEiC zzi*Q4&d$uvnVsEi&e@!^BNSigUve}9pV@c}d(M27Z90V?ijnx^Lr?5XZcyUdm*Of*L7FPRa=SYUzzxQe)#>^*1h_=?2Y8t z(#^$RpLO5Wu8s~=Rf)x}G2iw3MQF%)`=h^^T74uDh{O&ydl9JCV0UEy;i_g+Cffb^ z$kk5&-1y<3ntaDV65kfqSL5cd=u*kTcc)Wx>(mm>cejN{VGJ{7+M8|c-LN;-M_1};-| zshSG%@k!@~Im$ zh<&7)drPZDss)jYd;JTbDTX!Itok(%y=c(DYI$Ph>ZMb4#MG@Ch8jAHYH0=A{XVLqczkpWuDn=adiHz@nm73j&{bdSOiF)v_e6;$c1$Y`(q)0@=V^ z{?h7vP)@6a5|r{>!e@W)sy)Sb{#k>C6xyP|=Xo_I;f!c5T4*yG&GUdpNNXM;=ex>g z#-UzInpv=|xuL@=m^v*t^3)vEk1s_LJA^Ri<=}0$&*!xr`gHC4xZ)j^JkF9;d!f7? z_}X7Y*~JOo_s}YB9V5K^Jzje4*+*|}kt!VdQh``ZrTKg?sjXHg&1W1cY(2Ji48a+1 zF?KX=j#v?5O#BT)ay6g;kQpx~szXd)YB!zKJ^`%)80g?G8of7F z`LpRy(0lQ{D8Iq+?qkREeeJ{M@*xgOJBTy5+TG749LxvMiDa7kPXCON7yCWKj^Fm4 z8NaU5r*fY*0$d<;Ms&rTWDO#_z#x;A(PPl-ncOYE7TMjx9b`$w_|;R~!(+EORfU~l zL_vZ3noNRQ;%h>}Lg1-&_Z5Tz#`8Iwmn{pJ0Bup&i48J-Z z8#EIoKzoN4Ge}EC&dL{csjS<^;|q_8TN^v`f;SYEP0gT%Ez>zZ9tfhA0L61tfDfsJ z7Iaiic_UUYC>PjKMBcIGx;n`XyHXmGrFWCOE7#HGV$0ZaPtLeV8q)?@l;@cC_q7lD zbUsf!yQ=djO5Oh#tUo^=YcdgBCl$BS*?NTwtDp0SQgQkf!(clQ9werVf?a zB-dpfyzL-*K^91cPMX7Z#m{?3x7~XAR1>8VDgof&DS8=Eq$X5IOFU$UI<2NDm;_9( z&A@E>2q_G{%WnKpCEHaz=xe1)nJ~tyWROIHDJb$j`3HNdHS=;+@clKX1JE6`y>X#w2LA~F?wdb-)R7vN5VZgQ+A|?QBu#B=!j`wb& zFMV@6Chy3VlrULXa^Jf=J#Czbhh>4k&Qi~9m%??YZoe6JwdpUalUuW)%M-hL&L)zI zlD8{%{#x=4LU6P7-OiaDhcfO$_N$CUL5I@sZR+{MIH9c6-1QD&ZGrtqc0tGI&v#%%ePR+XzZ85phQ z{{HPtMkk{BtU%_eJ*|lL7lN{Gghjy07izeoCFpS_=Mv|;C8Y`J?&OSX_>kxJxl7yNBp!C3#LR67QT<(#}UEwKe5Iza9FGU@?lI^sLmCKqM1M}zPW(2& z1G{bS%GIi1?TdquA{wn?CXn=*aQzE~O8Pqz?W4oAp?yl-u55M>6D^8ikD%2Tkt=hy7~UB<-jb+y{9^n!`>ghxUU`0i@Up)3Hpf9hs>Ds9AEApY6~SC%ViAA2y$^ zQoMsTwTe5=;bzt|o*{g_tse8vby`%~LU5%#BkEi0W*WanoxJ1tKvsDG3nRt zkGY%!3>O5Cuut&ebHw`1jkSGP$e8TFz7l6M(~ouDNH*iCL{@52MR|OeZ3-zIK%I-6 zZTXOvCxfOju}HIVa`W{{G^#HBQWi6J83!f(=(~a%N@A9bdi4}De8seQMLe+3CNdUB z(UD@h3J_$#<-%=HN||c0nmB#X^O0n)B2-HT&7)}p63_hJVDny~%e0*kEBY(naghDm z!fq6ozkeVAULvtZ) ztG8Hw)j!W(Vfpvfom#Hh%_XS-uU-bxH{Om{JJ?b<6h8UZ|I`)imZ4!KvqhLbY2`^KfG)cyN3t7sNG*`08VvjS z13?hfKPMo0QtVe4QoQ}>Rqau|!~DV5Lps#t@)5k{)7Uf~V~Lh&H`o=pOxnIayP%-7 zaGD#{2tey?5!QWiU`CPQ$UEFu?9lIXj`tD2w`;8URnJOLJx-Y1d&XzPpT9kJYh}8( zK9#D!-zfvwR{a%AWD0HF%>aXSdTBx%_c-I8@Qx4}*yn^;B^`eNGbF8lx9dzE{)@ry#>p z)$`;m#YgV5Z>Gn^DA1ag5PW~G)i^#)osVcGmpo4^x7QZ3lsIrd#N|SDa`9P1iG>EE zf3`12lPRz(NLa;G6k_qCEitYUXjNr8P<;ioF^;r1O-@U+c1OmH@6=QUHM_#d3@Ec! z`1D|Sb-^xD0(d~@B?~WWTxIfR3=Ujf(RMev79qI`M+_1*loYYn?$=l4jJ|}1(59L9 z{z``U2FP^;{`&?--%sB{GOi{NK~po=P4YikNemP|bH83B4YquL3Gmw&nD@#{>$x`hU4&!HJR56R=`o)QRGHsJz#^H zu#Np)*SA!74=EnW-{;*<)@V-Dxy0NrgfGZRKxwvIlvs*y)s_Hil>0qKNW z<{M*7J7>Wb&(y*)PkGF=bM`M&AZZ9{O|~#FBxE_irZ3Z@Fl`*>`r`aq$Hc(IHGUEZ zT^X1V8IRp;#5?=@^5F7HIjBkY4p%hfivHMTfQb~JC_<53$+q>C!m;7V7=(w6OgULY z*tF@Rw9+xll}a*;Ft@|>oD#thNM>uf@VObFC#n4(CXA0}htEN;WD zOE`X?h+6f90o1iJR2TI{*f<3A3UGK)?3p+}2lPDcdyyPhKEw5DRd&ScOWc*cBHA)L zW@ANDM=$GKOMUa}$7g$Qn8Wycjzh!(N@;V>*tS|0v?|v>`XAivS+?f_Hm4* zG=YVc0tCW*z8!jc>>?X5xmLya0QKBq?mq%K_!@mAQdTnLhC*uq*e!GzQ4S7zrUjd< z?!4&~Z>Z(t^}+$93Bbyl@Sz0NQF76Hb6$x#JGZ8$Hw)!Q^l9AgTS+~BGgNz2b-sLf<2?|u9hjrwhhG)$k^lL{sbr`bt=6*tbJ?V>}ZVF z9A&8%Nq$Gkq`{zC!GMJf_IS_MZiBUZ18E%b^ktN9B{ zMo|yH9(kF*yI-Pr^rkDGcMSzlz}4hkd{P>{BKC+Twy%JsJ~1x4!7CsIkWg+C-H3^J zoi|2ivYs3jL*7OiyRwG!-J?&J{ezVB23Fa9N`Rurg^%JZ&g}rI*1Dj}k-(=ei*d<# z1?yp4wF=dAL9;K_>KK4BSDq^?2I7#u7K`Ip7>|$;1{dWBi@km86q{34t1}yz zoufs8W<3 zX@(tGlXB5Hl6;2CIZb(e+G%=}7Mpy-tu$XuO+nL57~gFyql!|ue91wLE#0AYI>VV# zaaFfPEYpDiERvUFJzCmX?=pj`1*X&0oFNeb3+mz67YexoTWPd-mu$gfi};z=3!;yuqi&yO)M=Qija`YI?Q7OMcv#IuwW`wDMo0^FYdYU?gWDIUos_4* zy3k~Uf+^7$#q=uGO)*sR7BKH{<%XSVjGC}!PDZRPnWEE@7D!A;lU9wD8c(D`PzbpA zj)GdTMHx^j0$g9V5dy`pGEM4eiFPpYIzyQ%OeqU-F|%zuk`42fXDISH;uF@v`E~H zvlaA&Nouy#^4z|dunM5*IwzGYp$lZk@_vbLb)|j&^2M+3zlOqg+OWPktc!n7&Zd&A zK<^FkH7{?1_1J~o-mtdqhh94$AtUyBeNzo21aUR`Q4S_2iOQt2JZa!U?YvAu*phP{)%e4 za2Tv1;r>Gecft~Tm9Iq2@565pLYv2^-CwF%YFNCBWV?N}xXV3db6&Go9$5?-=L{t6 zZlKEtwt6F4WfFeg%}_oH$mO^GwXTUB3U%YxK2Jt^gi@BqH9sP?NbCg=Ru&yab@384 zC6kXj{iphPBhn#QV&>Eo{Zzu;4VEK|{ZH7?th+2useMWU7#X488-LAKm(u{s9a?FP z&TE%4hX9$)$@wn&yYsUyv!!VF%PK*mp&7Xua475&!lT3BU>a#k`IZ=6So<4Oz$PARYkKioR8 zB~A@-*wdOc$lN|HiBqw+1#l9&Oh_k(gbFn>G~6f0mui@_gch_I4w z2<$x$>U)@Hs`5ten-P9zEMLD!BZ)D85q4B_lCsa>j(-!x_x1W>!}cfdz+x-(=x1ku z=8&6a$w=grotBlf>Sf+Q#K79a&t8s|3-X=1%x&DqK`K0THQtpStTRUZ`^J*=*uWB(T6)xz zbwXov?ojdx>KDX4zKQYid!p}~b59bj3xu9{-E<+BBH&aSO8QGzuh^s2`^KJ`vnQHx ztvU;p_6`IVuyDg9LM%N&Dd}*h@9CR858p?Kfn3YM(lniSf*^>0(#7G!{4BQDNWWB9 zMRS9}nd9r&yUoqX4sL<`2hcFgf0aUlII#K2#r66+!9!+op!27~8AHe$(aD-cSITTd zLh@shNCTL4d=A@eN0(RsP}oEtg+4p|tL%-IU10@C*OBLPp9m!K0a#1?7!0upo%{4< zT7hlR(d47KXs5ubqv}$f1xRmQtUh87J}sxWx-xlzIO7Q!pOUUM<7A?-ubRX*riZxS`)jk_`!$;24M(O4avli-zLU^T zQjdB9&q*E47A0ph^O_{o)G#u5aX9m*(ju0_z2iJ8`PZi|I&5BJjhPzSGNP6RMa;rV zYvyj!>Eebs!@|5Ssa z_oC~QqfpZa&KU{S@nqgb27-hBQC!A*xigvZ*nMN}fy1B#-$_pm|S)Bxe=($kWRtQmq3 zWjwRl+j^}sdBW;Il8H&>Fu~>}l!#Yz8?}0O4`b@`uu#PcWoz%f+3tt+$;H775xJFV)JWV1 z!EIWFtQYlYlajf)?S^zxVJ7CQ&*UDrAz-aj_PfB2A1JxG<_vy??vR1Hi6j8-ro}3E zsd%G%qIDylKp{z@A^8CAb$DV|J!w`bl}t3~J=N;uB34t7Z)9-=k*9Hm`1ZH=%q(!Z z^lEqEuc5D%^}M&*+sA1bMDZEq36B^wHO@X^JqwQS2L^iWwMXSo8r9U7Ws3yj9FoMP zVE)TFSMqhhfn`&YfZKJz>X+j71_fVNMT*|t=Ij&uQW+*qe=X^QwXv>&1I=<}zI%`j z&6EVbZ?Cm$^26<$K@FYq^XE#4nkVrpdJCJ&cpJuh=so@dC{D`Cu6}00xBJp^Aw7z_ z!}PAT2|CSod=ckgTYp`BQ;))L@(KUL>xEpeRLtONJLc~SUJ&h(Zh5*X*~Vr?DXhF0 zO{w4K6lxIJEt4b%-p%l6w@W~-Xi@)Cf8NFe-c{mlhxavnPkVtr21?oMfxIK(Sbh|G z^Ife#!hqz+(f*M5ei&_;72h-C7%!|jRmg=K_jA>2i%V0OQgz_bI_j^nK~oDO!!ltH zN>xTXl%Zed^;v}X`)jc|s)UH4D@UyS1ND)0i!M0I6Q?Vk3;3f9R-el|ieeH(fU4(? zIs9p`egk8mhce6m}l5^ zfgAMOEU}3Oynz<|f%mpBB54Jf?$!nY_^MrVnaCYc0(2$3G|W9P@|RuW2|YSDbd}ML zho?y-8C-iy7@F@DR~meBxqgP{+az0SxQ8$an(L=H-1HY2v7>uV<}Q2BMKSkIPH;w^GL(iwYtBrktOyr{ypNEH!~G3(@6p6SqsMMSio)YQub z)cT~_Q@Y%Dg#=O@!{1qJYv9c9LNxfzr1h(r-A@&H_^*1iS5n|h_@l5bE6($<5i2;w z$C~Vt{RYWsV!Jm_3Zk;0I*eLRZfz>g)S!EPC*n|^Sf3a6-v`hx>X_d?>w_|G-m-PP zmh)vhnVXI*1Vls96w_S3Du69$HXH|DX_32mz0NRlIdSCQZ$7}byP%fN@xa?Y2mqDz zD-GVzT~Z4=f8wT!&HsxO6R}e0Dvk0 z38bU|^gk#mKraUPhX4T3g#VQRFs(_^kr&m-0!rRL35I$E6A}j?naBi%=@0iWKvwz- z2P2iKA~ma`F#XLiu_gul!7;5-*#441j}8a?0i?Jp0IZimCk8;zstgBU0ROfK$wFa5 zzVeU~q-spa;-AWx*688L3KZN(Aror=@-P4ZdVU1cA7Q|Mfj>r|XO&{wFf;wJ0{J1Y z%s^p6Qjz-qSdA1w&p>{nGmyN$06jYVul!GfH0Cd$b^0rFTmQTGzonQqOz7eNo526V z`^SWTi;({9Mf6zfzX+sidH;6FpH}^mB~@d~P-8=~$t$y}ZI}S0U{!z`Gh0>}Gjo1E zvc)J&09q%S{0MdDQt~q9>Tpu$Y6qYy(pgAHVixE{{OL!`0)SeZHL}0Mk%fQ5A3yyA zC`>fb;r|r=9QgkR$YJwua9c+j{r>`5XC@@=k5=^XKl%UB{|7@+2meL?Yp9WzF#+_V z!~av^AAWT>GW|b*!t@XR7l!`dg#Tgvl_RyFux0$$=KMGI|0tk`qj1<%$8L1~5Bgu@ z{eRH@??pAX=x`J!020u{|FldMJvtnj{RN~*Pm`+BMC765p)jF`{}K7)sz1vAG#1JI z2hhX+vp$maUp?`U#6LL-)87~=K<#e~r8*ipB9QNJuv$LzpZ*2^sjrHj@wecAOaEB- z2mX8&{tehjgYuE^ejCdDA45>?r;nUlQ&%Cdt0UKIdO3}^^|NpDrFk?c^$YtoT^Mdb zQcD<>Gr0Hinuh??npWV#5f_PH_9ai7p^iwzmAt`EB1+m2*Uq8qFMWcMYEN|}JK=O; zY9oFd8eGrGy(>wSzg<6bq608^q4OF-F`wbQOPbb@rdBLPoAv|ydf^Qy+w`?^$ZxqI zQ2ZQ=bGvNNds&Mom(g%@}BO1C096u+hK-5+x~`^f*$(85!R2fjwz z3VpbKI+ML`j;DS#t95KWzxKs|ifRC}wGcmlTF}cdAECM@Mf{9LRxSPZAdgf6(TA%zd%ZW1wvK(u zBWuKsE?cPHhXEQAUaKpK8vU_)u-D0aA}0i>&k~kDTaNSE;)n8Ne)=lC$&8*-A_IPw zQA=>UpM*s;mDHB?HaOlz`S*pRxa;bX!q6e~b_HP*Y?~jFojIHgO{f$Jq&!;gK@0s* z<438-T|;^9ljrX>4;6o|6}J{3rqPybWPf|0Sfs?O2MIk4u2j(Zfrx!1M9mQE+l5r; zR6j1R;3r2dcIBad7ZDVxbt#tn6u4)(Rc6vpzFUf|1wtvyN&gfQx7F-UF@0DUFsKF@g+eS&wxh8#pZBKry5l^=K>5cuf$BFusW;|ywREpvfH8_HYjW+}P;ONU|@wwzdmOB}O9p+%(BL9^- zjQ5o8CA7TA%OtZ!+pm#1#me_&nV?wTH$url%E>)D0%V3itoOwOEuG&C%JK%JP!_2} zX#2=&9^&k%QvC;S4Tfsv;c}5!H5SK$%;SV`Sn0*Uz(tSjAe|)#z{j|RbaaiMm`!|) z8EE!`QrZEpl40x$UhPt!Lg{MT)-$ao_hYne*jDsSElHrN(HkP5Plzn(N<+ww+ny)9-U!N||JL6E z?x1H&@NG{Nu@yDS>&Jx!`(#lEe_nQ$!E(Acix3Qh&)mDQRe-3HO-TDw(|TTuS!Tj*0`a5L7|r6+PMh747pMgRN;)hx0@fT2d%q_4kdPuVdcYL%LAre|^2g9Tc@Q*_Hn( z+%1La5B!(=YbwZ#(w9=QAIUNyq0l|0=0Tc;@gb@5*q~V+>5sSE2_L_MDBhYHfEElu zKatonaw0r60R5{<*XUMVuZSi4ZBjXf7l^_JNgLHQdZJJ=t5UL5FK;|E0PRA#|K+S} z^e^@Drb8(Aoq9qacS19=e!cT=+lJ`ky@XPl6JRX2MvCoaK=}IO~5>06K^m2atvt z4j>HoBbP$a0+a%P4rQgZr2xFk(mw)J1lUnS0Dv`j1OPz%hwwL`oPPZqd0q`b*=lIisSTjSXs)oy^!8?B zs|El5>ba34LvN#nxrcY(T3nF77vdlef`O91i*jvwOfK69G(&-_MMS1sVGZ_n&lp1> z{k|)E-F7W7!#VQ@pVRtqtP+XqXV_>vGMzsi%!94ioo6rslRqB(51TxF;lY<;9-3TH90PhkJgqMKm{f2Cf z;IO+M%VjGJFBNAV%~35)UXo%)>-k**~{%DRb|L0|?BbeVV62n*@-)W-Ovr zM_X&H#Ar|=?*?dGAf1X8j_jy;0BSgQ_G>NFEI=s`06@Mu|MvHPOX&tM0gMS1@`V7h za1_u>XW^H6P^dk%GOHY|bE&8dlU|IHG71e~C{N^8i9|Eq03{6oz>(EU2UO`Vf3~5H zjg`XyX1EA_I1|ZQNMo#!lYPAyNghp{rKj7@N)nFp{pnHH;KS!~(2p$j&NB282Ls@w z8uK$zX0^9|(3oeh-Uyi_3YtXZ)f@6qICa)^&{j}ZfGChl{Ir?6P##l0MKh;PQ9BR? zWqAi>x!9I6U!rnN<=B?IDh808fQ1|=!mSs+$j8StAA^lLk1bN#C~8`xpi8-I3LT~B zd|kUhB6X;EX)3D5jvAR=Wji7;_k)tTG(xmOcQW?q`EofZ(S*_-tec0t_tDIDQ*5;A zbaa!-UsV#BdZU)^3IjRtTc4a8EYmb#v8)it4(w=)?f4SXFbt;Eo2c z{YHL#BT^?F1#L2I3zS>5#Z0+_y=wbz7H!s53AwwlykTrKW;RfrSk<`QG?}@f!RjL8 z6{#)=RkBC5nC&4hE&PP+N0t#*;`(to8Ziac=&BmhFb(Q*1i1}1$(&i^L#Dq ze8bpn%joUf*ao^AA^3j%SU>Z9aJZ`7nsIh6c;V~w&&RV0frNq~5>_!Eo`XZtj+ z?6K;VTTmi&Ud8>HokZgUF_zOI-1fEA06Ax_tjl9b&oN&%t~< zQPb96%O#s7+E%03nmj<7c;8I_`|L$%#WKzanj^8)s$8_qefz*(D1QU zl?68XD$1=wRB8}c0@5vvyzg~x+1V)HJAG&l#B1qr^c)sIrLPn=Rl5{CI}3@tNP?__ zT|)%nyl$+F9fO|8C6V~>yALCTZZs)hrhi#oxBeZmy*}Ct&c76_C0a4U)vm$jXWfgA{C6JB#QlOCx!;gp5h9lH7{?AGVC%@^ zM^}56e;e}fZ9;SG#nm7pOg2Vvj^z-&NYn_MImLeCPWH!RD$B&RE9X>78dJ-O1fNt= z{QfQ`F|J~yPL&?F2=ff1&0L@)H<2DH3F@)tBuzGtU>+!}{GHKZIp|59-Ks~i?so#a z6>?tL)#d(I#ydlD^=4r9Thez%-*DM2tx`YkytHZ>f15Pxc<#M%y+iHuae>>lU9G1o;K;F5zAYGAe{^1+Mx~68lQo&Ms_)*2TsYu3@;eFGEz^R>gGL z_QVJ>0(x;&%WY)ErJkNUg4`|EG>BJ*Lmckx#I(i`b)Ft@2~qS&k${KqMp8AlrjoFD z1Mek#S-)FDyR*~KA%-Q7+xi8IO~9PP^g6Wpurm^)uD&P$l#}4!r*0B6d?67QMB}H~ z%Z9HDdmog6_pVcY{TZ9H|AeN{uNL%lCl*n44d!0uv95_s$_?)q7Ldj-Yytf3b8hW-CY)PKGr8ysGNF*`_7u5c6yeCL?A z&OlDy6%3R9^*Ci5`bEWefDCidjD1o6IA9@#dhuY#d1ncA!I5_JI&Z=l-DZwZ7Y*Ss zqzz+c{%k(>#>oF+q7V|450msrEUatlU~BhX?7e-c?I0JZbZ%U%^Ea2A)KKIxV<%B> z9i607wDr#loCpaH33zyb@JAW9m~{KB8zQ8tT%gqpuV7xAl4e_eSI@2#t8z=4~arxzAhS-0Q5tY_&5G74!RL^IFS9ySfnN+oOR>g#rRk_XqHc zVx{$ocf0jMnxg56xf~FnwBC9B;N>z^wK}wa5L$OZQy6Rr2D7yVK;OH3_`G#Mtl}*@ ztI=2$g5kbn4QmT2x7cdf;*vx$Bt4}i5`XW#70{u1SV!5{)1&XP*JoQ(EE#2uNcY!0 z1L=L6;8^;a!O>WkhEQ`*G3rj%rCYq2P0`g%kHFv)TG$W~do5$MCBNd{FpKq$*6ea6 z%yeQZ*DP{-BA*-2Vm-rPV@CaPz@jpf7J3BIG3X}pc<>dsOsLhe?O|V&7J@>dwza*2 z%l?o)$wMCz{=<~pZHnk&pzT4iMlr>Jg}|}vRQ&Q}QAg%{R4lPdWDackH<${T^}$5{4H<*pv|5A)xJ z_)6Y|^z{_>_2fgs@*(!Ht;W%fkP7~zHSJ{WprD{4-(-W+QJd|F_O`~1uixCJ;hPoW z92%#r6Fh`!`4oPfzC0f1wR;=NGXu5a!D_;c6RwJg+%ER5;3Tsx6BF*%E4n~B3q3=` zn#H3wY=bQ;M=5)&FN`(J-#@SQz3Bjb$HR+Ui@pIEtPcW#cw7WHcs z!rrODiuJxvuWdc|m-arv-3oyrwfAPKeM|Si?>=FKIP<}wwLKsUsFL<##ufjQu(0p* zE{MTQM|OVh^hYxf2Qk=+saZbAq_0;LQQ3Ry4tsDh*${vJ++lSLQFv+G<#y~PZc*b} ztHoW=C+2VHDY@kp^c~Bx`|C|`EN<`2w7?Su*UHRbjpe1oiHs2F(b7DVzp?pDU2_!S zStxdgNoG-f*X5VZbSd;5Hnks?8>^6~t*vI=yRz6uzD9*&3IzGqy8184{I0{?Kiw!Z zv?yMpZ|j1MRMCcQiT89KG+spSYha2~YFH;%(>OajEz4bM3O(#_*OS(D+xU}{HKE#& z0BI{4@p_Y6!M#+Z9bWUj5d|EV4rS5e=j6f+FzJXwKQ1*$ps>C82VJxed>7a!7H*QE zqie!Be0OzKxhq?+?X6Jz&DpchaUk-A%KBBF!Ll&9&fwd$PW5+%OyjwMl;*6P#vi18 zK529Xj2(l?geLnwbQuNZo$IGB==4wZ4x>-vP3cVF0(&tyJ?kPW+b9eR!mXJnHdgXw z@+6Q^ex@&aW{zb!P(BN_a3%&_G>q#VCv%%f&D@J`^7qR#Wq3s!X411vvuoGY1~k5c zZ9$X!Y#q!q%%BO%2X`b2YOo{wj*EV$S2-$*KzWaJ7g)a{xDb8@y+j}~98EcVPH_gN z%GJnwRmgzhiD9o@Q@o)X?80Ah9y+uoryP7ZVoyFqtEWS{%oOlA9pIpJc|2HxHZ+&h zKfns)?=@AcOsmo=GZgUSC;;)^8$AODJyMOZb<7AdKcAz6BfZ(!^}_^;b#G-N!-CRAkAQ*(GUrNtns^6LyoXO7DgC&CVha z>idVauKL9a$)ejL0>PwLy$Iyo(%0SFX5$-~w;@(V3oqR88Z2~(wWnvAKFOf4xe32S z-UtyS<>4w-ixZo8y3L=yC(6<}=kvG~&O|KpGt@cX{LzBW2QYj~g+VcgJn211lQ zIo@?l5rCOGN^-c#e=3awd<`XvnBQe2N1X|`lf%4EcEh*x^eigd`@0p85ab0nO8&*F z#g_0||HF?-Mn?L+J}@|xXW&YD=@a4-5`^@G>7(SZCF)G%@8G_^X1aA`0A+a2Kkk4+ zrvYtYS0OutPv_1WeIH$F#%r*UhYgtvfj1+-z5p6ztMah8yHRIib{Y{Ecx&A|gKOeN z2f;f#LC1p4c)&l>e~dg37VgP6#wY}g#f4b8p5c#)(OEg={@7fZ*JkdL5$?f%r8906Y#LLWD~m>o%e`3j01jU#qr&!H!*dkj;~XK<;7h z|L!;3tB~1m|9C_8^7rG&Doy^yUjBPWNx0*Vfa6-(x@;{x|>- zufF~Lv2gY7;v>@a=ebt;YajDH9_pl>8GHEsIak=W8-m7IyKRJMSiDlU>L9OH-5A6J zU@*vVFIUiF_qVc)tnQ$T%~}rd!-K<->Ycb#W8ahm?C!uXLc&;P%8otoyGU*s`ep_V zn|rr)1ghIomIHs^R^K>;QwHL5e}9SC+7eK`zufZl_3VA1i~ZSJ{P5@xfoLO6yxdn- zIL9ukYtwd^IK4vj9+OK2%V zjVkJ?lQuL!NL}EUYM2^g^fRHy%NZA5&G=(HM%+G%@}s zqm7Fn^hOiI*S88pswxKU#aB&Q*D~e;m9&8Z8<#JXNT%$}7hKw_t>t>B_2HAZ+?&M4 z%`rc@$P<)U(p4)pLjV_8OrN~4E{Ix)0%c1j=dB%E0tG^uMjf8vs^}Aht@Z`bd<-gQ zc~x?QA6#-hy%Waa(Zqut75b&iHYDyH4d(#m6&-H3!9B}6bFV|%9yf!F_(RuXaE7l1 z1B0n>e$m!|XK-BJ2kh65IFEs7hfY^c)vepcZWU7J7O1GVAh{b7I5)$W=U&))i33fp#ims^{6g97B(o%$wo!82rwdv_)9>J~hBZP4wca1-H zXoOzl!LNxzhlcryOTJiG8{2YbmKqexGDL^A5Bro`xPyx4i@^aX>kz`dm(j*8nPBzY94iA9P<(4j((;OQ$ zp3esubw&znHk4zMz(Q2&;Q_ZZpBn5@IWIop3`mwWr+S|z6J9XDBDY-|4`%O=9Q6*e zQs~6njO7)jSG_>~W?u!N^{xeGuS&o=AHnHZJOUF=jE~ejTmuHuQ!8Z$KNvMRBIWM*`M;37VZ?kz;gq5&4 zEUR<%TUOsRn``w_zlKsF)*`{zzi23borYO&3*;*dsmZuAjsy77F-3Zjs z&|qvO$j-gpk7%PTJTen+m3R$8O(`}ANCl_y4hM@zo@IC(BNpLwY)K;~o>J9i#vUGM zpnAsuSIkw2eaPgR;ffJY6iKb~`r$KKX&a`VI|gHTZ6p1};y17b#PFcu6{N#yCR=oY zN;4~~&$tFyJS+Ha+gAmr*tB!>?37n2zgn0F+UC-`aR==$s@Y%8RSledq4YrM7L8UQ zaBMj^{rN$IvBU2A`uay)@X>|V0o#wIjEyE?f;rg|JZWu`BMbBj1XjcDWZ7`3L?>1v z73RyA)-7`T~0Uf?S~U-m?e&i4eHc$(RcoaTns zlT*Wa4V|4K#3>TB+AGR!jCUQLP0{^kD|!3dacwafo^=?TJ=+xV7fh>Q@ICWLA(^Ms zijO4S^6|L8SQopc3~LfOKB!#G371tG(tKImxEQ>gy{5>%&V97pf9cMZccgm~PnIg~ z)S-Fu+`@wr22Ud9xs~G9Ifa&TElQ$7Y@(Gf{4*Fra$qu-6ZOOeF`t^ zCtKiyuift&FW_zLt6)bKvVP4Kty9)vR~IFVX~v~#=Ax$NbMpX%p*ya)S&V$eiQ_{QBK18_-a$ost8n)IacsS1b+}6fz(zt6x`w zU&y^;L-J6_^8YaQ-ce0;(Y`26niNrb6A&UyEod)^!Gjq#E{GS(W|BiYH^Yp*$fW$t)+@jRx^ z-X0Te@^2cN%RwVw4I-&;7;b;%WU~D-A}lcT=tH6wLv*Ve5;w_|&wueCV*`U~><%8o z+64L#YunPQQ%n7TUI7bT$`~=+r}M`}1vMzZQ)p)pPhvvki;(pg@f>IW%_IB65bGwP zWxlT(WP_NoW=~zLXjWfDGg5Fb@{HP&W8S+iaaXQUG9+m=>0@$cKXS{|&> z)6mcNQY2p{(g6<+ml0~Peoj`~M?X9mE?m;@bvnY9*M}kSeF{%1lAk5@%J06prdjcLO$$_3fS9QNF9cjA& zwwpc)NMN8vabIZ`+-=4)+{TF2s7w;H0_ybg@1)M$S$8y^Y#h zEu)jqR+Vm%SVW`;yKcKla1~#T4FuLNm%?i*cB)h7=`_8(q8V+r@YXt@wy}I-wgbFJ zm`2@VmVc_wIU55Y4wGw9xklh4VZsw-s^$(Dcz=IbtK)g>2IRdme6J(M9OE1xt(gFx zK)RQN^ng#;@UyHJLP$kPnC^2-bPV~JiP3zA|7#O*A=%YqrV&ljkAK_1v0lE7ohWdE zD7AfIaZk!6MCr=MR&F-WJ8 zl#9QlJrg_s99YgcWZ^JBAhGGDZf_HMnE#aZ$?*5xCIYOe7y4A2=X&`Bexf5bAtC5H zR{+G@GO(#xXU^lPqkfTngH9dwl^*fg;Vc}^R8zHE42=Qr1B=zeq}#ycaPSDCOFJU0 z*1LnZW!xz1g@+q(l;W{P{tk`r(2aUEhqZ~=Dj@4)Xvnk(-=(a#dJ^%P;j7Q~e> z8toMt54lI^o7}RPoZ3pIMjI4SBxYxNPoFLSxu2M#D2^N_vB4c}od&I6_ z?h33&R9UQCDAOM;*$5ScCO7{;t=kTsqh76aW@F>6a0^ove-7Z0`I9o9aPbm*aJpsXjq7n!@xb)_?_Cv! z>W2C&TQ@n7)zPe^XfBZW2GJc+gD2bMpb1NQupUI}1ksG8TQp4-^BUYq_8SP;{nV;v zBI9FKJXQpCOP0c7BiGsUWjbW;-Xad4#0Ae3K-fy(-n3@n_taaQ>&-Zsu65PyMPV3} zspw`UwS1WqX5mQB07SZdD#;sts+a2tG7a+`h*t4t1!oQaW;_xcJrW(^xR|Q&)GuCr zm_thnGr6IAL=mMK&SM&N<2tlXo-`3F zw9488Iwf$c*)szV5q~|TkKRI*&RUK8TW4SMBMAI~}^|@TSiDnfWt(`R4f{X^8G>P4b-o#pOV=BXOjd zD|@%QOv4LBIe*v8d96r?>QMC$D-FWW)j&=j7@7UsdWqt_+V(AFa>s-_wp*e^S%{8U zZoK_WZZ-_Qi*N)i)xs^Dnv11V=RWru&2-WGYFX8f0g3aR6GI3@@8q2Y6@dy2W?~3- z&R{z3qp_HbLWX1{YaW6j)*Jc}DsTG^FS=iwYP_?xIUOxB{qmn&z5= zeDaOOOehcz(v{aAjU6>rrXV;M}hi=4y$;VWBA$x}yzsIfj6^Z?Bn z#Aq|~+yg`dMifV{*x!_uc4mkL;(UiTWYs1OJ6j5IYcI!T)iy%hdcY=ZnBW;?@CV?c z?Yz>Y-mSci5w+mH+4#{Ql5W}<8&U!$CC;BzG5^Oth0HiPB^RGM)ElV=8jrl|7vr#TrU3*@2tGJ`H1jNj3^7! zsyAa*Xnu~}cU`U6!BX%E3&{&*$KQd@lQ>lmCDQ#+4bh^Uyx#g0adB$*eQk7iJMy3m zt4GVgso3HxPsrXXY=!kFFeEt^nC%|*0@*NqJk|+W34GFg3Hue+9&PqE=ZCw7X#}v-_p{EviaMp);MG1W~3fniVq{j*#oO}aJ zV>|(E3O~57(o0UbBDRz5t1we6>vMA$SoKA;|F#m5DM)Q}5$*RqtOP~Ht*yI_9?!c! z){Aune8w{l8ivS1Gsc~aFE}&+KEGp8YhhWqXEqYzN1P!RGVz)^yC0~x20GGl-%lj% z=c?b|{}{k@rd_R?xF2`R_|0?EvL_RY^m;w(;_M;lAV7P-<=clI?Kors zNHu&EKnfCx{>aa3Fb?b)oGwDj8jiRM%F=pl*q7RFI+aC2MIlN;t2Kn^Az7o%jEnixNV zs2QI=ce6bC(v-1A`tB(}(H+Sxqb<~C09OeQ!#s5psKZP^VVJh0W-@W@V9pudRXApa zaJH3I_Q>Z6ZVzxPg2o{m)xZ>@erP35G3soXxn!?krj`Vn--$w$5ftKooKH384k|vU zI|r!25@Vn#ymZt@OA~mUP)Jt3zYKXYh>pI%*FK@;yF1Dg*=1XT(Rtmk^rmSWagVj$ z^p&>J5p2N-c(9zHwZR8ci|Wztj}LHZf&_cIy;UHnfk50$&!5Ymlt;JpYlv*eKxca1 z>932HI8r$_-hU|fOdM%%t?t1YYb(;hxwKn zRu&7!yeX3_MBP*}e)U}`L3W_{xaCxEbW&8 zXIBF+x_a(d95Z&^{>Y*Zt?$v@2~E6L6&F}K6=i{!jRSAz_4Ky=a7H(fKE`Q%+bhkB zCy!$-I|^^SVPD>uw>sSLux6m6wsN=f5n>if!VngJDDhWKUp0og+N*^e#M4c~%LhyS z$KU8v{)v}U-U^|n=1-MxTj5LNpe0%*-|>0ZV#qh@zQfJ@^0TbQ>F9>Ul+pw0j*lNp zJ(JqtSNp~dqggj*5me=1Bu0bmprA-b5_8v7;0t5z6>hE;psd@GaN-C&(wTk7J_FTx zx2-Ea;BwH&1(%bS%&m5yq$uA5DvqL?7ye;kb11 z3*h?JPin->FO}!KA5~&p9Ejb)9ll!2Te=qjajONH0e}nU@3GtZhLY^|ABFRi*fPqa z1E1b22hmS<2Qj~3xWiOQf9O-7pJ-u0g%+}PM~V4^$X5_3i~izC(N=jL%C+r#Dg4P_ zl+Hg4Fs@N<()(5ic_Dd}F`AIzB}^)rd@Oz{C=k_HqQWopoI8@5%6p+SC7wyFrw|$) z%1p$|sykJ&q_}Eemlm=>A^7&V({OgJuNGWs@g@fGu@`!Gz8ESlUlFLrzKzS;i(M$6 z(&d_q^(R5>R^uyKOJ5o5TyaFv_ZJ%3@({2ppQqK#wpelt&?jfv^Th4;ls=ByK@9a|GI6+@dW8qr5GHiN*bt6K z)IRBl-!(#>?k@`~w~XNlcNj_6fb$!3J03q*J*b`uJJDY*@vyP6nJ^izvx-aPx)Mv( z6U2#ct-(;~+bn*zGmdNal;^Q?2Q~pQ8dB*PSO&SHYfb@W4ffNCjRBCZUT6e*hV^f} zhGvP7`}By}wpf)i+bH% zz;*nPO4eI|ryMl##ZMFfp$YB|%PvQfs;4gOqsB6w>b>FIkht$}4wo+{ zGO6t^+?@ZoRPWIJ9DI6jB;h=Y(z|o3>?61493R%*L9IU54v~Md(h30Yujs~sONn2! zd<(@74~Bz@C0L_!ko!pZm&suo1d#{LY`w4d9JodCIFv_3ln~5Et`#K%=B^ZEU1E=W z|0vvZI7%jDQSB&{?;gLWSNpz736^2k-&s+dosiurmNg-(&DO-}pa|YCl5)ued%jI3o5IY0h*=%e1m!+j52q zkl<`gLi1J^8XBo&V|5b>0hBa47Z(o6dXjB?M1XPXnnC@wycGGs0HUjoONUW*UysMk z-L92b)}B!FrCFG}H#awT9F1y_yx9AkjX+3Zd7AQV`%PdB*|i5&_nj={xZh2^9^p|` z4A_a-y+p_5Vk3UIwb+YpDj~SV$J6QWehQ2t&n0loVbE49^9$VZun$wA5ZAmIi)zjZk*JX;7^IVoi}n9HQ`tVr!Bkp(3zq^a}|p=bC6pWl7W__rCsH3 zBZ>{peNy)V6Eg_pKvw~UcFdFDg4Xul_2o~>$T9rP-pa}dz;oz@WTr=1hblELFm!97 zM|m=mJTd>0?kUHSRlAD8rGAt&!^P#cjlkZ}9TSQuSXVbTJC^L%r2=3WEm3m6oDg_6(ci_Vxy^_XPBW46a-nyA}?|+iBBhq_3o# zi-1knm!)sC)Gl|$ej;>sqj$qfI{-_e;ph=sV;cwcD0eOJn|YT#j7Vobc&v6=bGj#D z0N-nl{s20R$qfb{0+z!ILQ05ohcqsSa~zvUrn;n>`9-j*h%#%Y@-2V3IWPS32H5Ng zv(`qi!6w`c{&HXqaCZ}Ke)*DtgoU}VxkM>lFMYOrMjUbx9bPKmMqKV9O25*O`AFm! z7TzPoFdRO!aFZbxUMf}kY!p6Si-Ag;2TPSO83?%h6f%>$?}7B91BxsPyHs9c(BLoN zxk5#sP{UziqX{idt;)*eDTw<{pS$1^nS2iYZ>X2=`HG-R+ z9@MW|MMvuXzX8Pm|Bhl5zDdJCH!iIIAG~=RqOPv~-;i@TMQ`crf8pl;kB_{F+o#cO zKw9(xbVpyrxE~$qiZTwQxW3^CqU+9Q{2w6pf1%wpg!eyC;1ouf9_fsN!zhy}&NT3a zShk&fLOUBiAg*)~N}HfSX>1!36-u*BA^n`d^nJ%*XmBqUPevli;OjCp#5gd@88C!_ z)Rea|-HK@QO=A~U3VQ$KLY6r5Ib$)z$!8KjG>&YI?3#21)oD8pjCPm%;6I?@odsY> z#FypbZnueX%mImv$H)w8kvMBHkLLVmK@jI>YrdSkw*c;W>Ji!qM}<;u?r?$VP=E$n ze~Cz#KT!j$#Vn)KbxA9xRgKCu*rq+?kh4m!k3ysCiT*y84+ z9zE1DF7EZe~CPl7-B=)qO?a8RZkuK>(gUq!NMD&p}p9~C9#z%7~246_{!_$vNp{*5Ht{Ib@+^G z_Dd-TiyoQlqenL3TUK`6bo`L&&W_X9Q9a5s)6lYx>np@O8H2j;;`6(Y#Go#}7?T9K zg9mv7sIu*g0<3DaU=VLHu$n3=bj4vz|x6id5sPdm$y_6_aiqb_I=Ke-I5h9O+ zlyUq|F2*n@Fk0=+f3P&JCY^iPf>ht^z&t3%!@xU0=p!1TK)omMf3qVzX?%d<|4r8T zPe7lJ5l2aYdQd_R^br`$@t?#1S}=i}Xb}`ertD*A*#CdTF&~LqzWZMRNlEC(aNy4Z zK;H2Y_^FOEiaMo(f>QqQA#DLiN#6Ls$O#w9X(@b)XmiC}o~{=J{Njo5#g_YuW%<6b zP3OZzdE0po%|!UAxoJ0NtU4B=2_SwPR}po0(sC!h`4!W(BD~)k(30>e3^_U#JCP@h z5MAQ5EK*|qbqBmc1SUKZCqkWoZ3P~Vn$yq9x|o_TZ*{W|aiSAm=Wfh7`DncjH1B!w zKA-V<_ikKY`l!hw#qGT!+JlbkA~FGcvqQ0SsD)?x{WDHiTuxJ4)ZBgNC(4w|c$B77 z!Lkn29tMCa&rXLdPz!U`Ha4{;!_5S&gs)zw{ky;+mcv)oUfdr5S}%of}y66@QQW{RL9(3|e4Lz~3Ov92jQ|M1z#6%4d` zD2JDour^PDntE%_tA6gowaG-h_l}G5-sqS4XrouS1BrDYN!^9LCO??r2OkoH#`u98 z_%U}}-2U6xRj+XS(j8YR^e%K&*W+2W_UKdI-115e%#pQ73b%k17l{ zZSj$6p*WGh!Fn(*P*>WeFae7%m4%9Lt<8TDuzzc(dgtJ9ny~HU6?K6_*_M^oHs=jJ zPO0p@Zv!O`bm}*P$TtDnVF;0++rE2qCxyywo$ZwNy4&U9WKki<2qacN5QBLR@pdqZ zlLNQScm?0OX}j`1*bj+pmUSP88hx7+bn>eWo`V-GI#NO52O9vWr*KnKo)u?u7X>)ry7cmRd`tD!eCr)GZgraw#V#r?VBCNchC-P zGVq*P^H{#T-!cTv!7h(F$8X!|r0Y5!lMs0~VG#>4gL)YRB5n=?RZf#`Z~xYWZp;%b z?%*H7)H$prUXF6By5}aE0CU@$Sb6vcChj;LO_)6Y&Y`dYu-CXpAP6X<_lDJnH(Ovw0nYa*6es7sL#6z6Y z44>IMz~NtF$JuH4_lrevPW<))WAB&PO}!0FYgn|9UTsO}+a2Banwu(`MaCrY_YLQZ zn6AwH#06m4coCz&aRD?jLBBwAHR3VVQw%ywclH=SlbqeFIE?4!7@sh=1>m+0CPwe+ z?|pvEn|>Ikp&v>9OjjzCyFb~fQhu{PA;%aR8Y;H`q~AK%iR6%s@H_&26CD%5R~(U* zZh?SV#CRAG(+lEu!&dmoZCPnWhzNj*&+qFL6pY7YwXEtQi~- z#jzy=P0~mA-cX0erza}X#dG09m3K?wzx5BhGEoyy5I1Yo@e3)2cx3+XOm$32;Wz&? zJ@`n<>1;)Jiy{?Uc^i!lE;%|nJHwV@YPPmTu4P@UYrN`@YoFV#2~xEFY@Zo5)SSrf3unENz96Znf+YK2qCE zS?`T)xFQ5~D$ZIhG2RnYEF%(S?vYEop<7qa^Oaa_|Fg9z7H~1@e1s z=ofu6NifAq^cr!M-hbD`V|pa-Hp?5_SPpourY9-JYEA2k@_4EB@?N2Xz6f&E{jPJ>Yxvwr!GU$F+7ZJ?))bR-o^_K#(}w zHra64hvDW+6829P11DelD{bGbI~B`A578N#OKaGFT!b#T?<>2`qjjmoK+N|O5)nO4 zMv^de)^q7xhjSxcf&OnyID{Yf@paX09a>;R$gLPmPtD$I&pHL|*H^9lB6c`i&|_*9 z9Kmi%%@_H{(T3PU&9V;&*ZYZpVkoH$u$bm-olAfKx%l1JVo=)tOFSIi%V?UsdSd3~ zzWwJFJQ+uv%pFOs_B9i*3|@6n@(A8T9j++dI4W z%Q9M+ZiKMh*%^sRqw1@tlO(3uzIl(dSG!W+EwSBKyNFm(`)Qk{CEwd44%M6NnMn9{ zu)n<0@+!edzBD(@T@T}PRI9+j5Z@yzd0KLdY`u$Iy%S-Jix;ao?79a_UF*okjiCe- z7l0w@fUPc!h5GWR^N`wkp!Gp0vI!#JwK&zI8(SvnM{A-MLMWY&Q53G4Q)|#I;Xw$rl5ns7Jrj= z#iZjCMsS^Ht5P>LR6*5Mad{$Jz!^92wh;C>0^?6A}pwPw_C!**v|7Hu>h#AR3 z39H|{i|I(OK9qR8Z4Gr!^mz_@Bm!wX?!lP*wMFqf57{^@ue(u{_)~}btpWi-0|BVzdPJue>q(Ce>Y0YS!vyoX zCy?=W#w6SvIv74tP%0#PeKp|o@=KhkB9dy_L!7G))6F|2748>qL&d(5ob~!Pj}OCY zZYi`$O4S7;k_xD-x}U2e&Y2BYkPfiS1utHRMy?+6*QhXBV#d*>N$9r5A)P5Tmg}%| znd{K@&0HTIe`f$$ZupTJw+Y`0xDk_Ov*7Lh^g>jdzTvt>r)^-4kLF}P>P{TzNkt8+ z%TmC;RU1A@5Er}TE)w*_C6}dp*co)As11$hy09IsbRL-Sqz4h(D6$igM8&05SQVyL%k?-{^x3}!-^S*4N=|P(NDb^YpW3O&zX`yv)Kz@A;w~Q>b|pEK z`_`wxHczTqT}F3IOG|?qB!RQ1)o)+KFDs@POXwp3Eui#kYnyVT39mjehNE@fQkZW{ z5?)dxj*i6T_gg^)MSQyI%wD2Zhz}}IyVzFwil^XZecR3H9uE27y)1qplO%+hn~~lI*|Sz z@rm#B)C>K2J^b_5f%}SH*BmqkKi>GZ_Q6~0_#RiM+d_)Pw^K(a^ zj^h3C15NdX8w;H7MsrdA%@|^H(}5?2c;465+!squAQ7lg{0{En7%z|4pO=Qhe*-SJ znp|!rnAlgg-7TUw)b9}cdzgRb3+4zTRbi%L85ELK~vy$^{<3h*inOz!FNTpVLEPv44tY>%SqifW6hPYJJD^p-Vr1P z5olN&S^DU7_Pfh@9Pa-+z8w4by=kr!(f!=N7~%+tqa@rpycBZ&RSy$Qrsd20_s8>M zx2_aX8NNAjwm?slQForYr%@M9ezx1&v{G6)-R_*EL91e_c0PzVIROr*lyLj% zWNdiy(XQL`F81Y9^T>3H(F<8BL$rD}I^c~&K*3tMQ-SFtuX`3letMXSJ$YsNg4ZBMX*F7Fu zL36JfuibA-*~?lPx>!&LS^@~yBX0Hv*yC%V`+XA{Tn?wKxTmCQwwpd&TgJuRb7lVs zhBpl*nm`gaNeMTl+tYwdfH7&fs}b@EtuFIFNB^1jLgFtoCljeSWXrZzUX(f9QjYZg zN|gDv#R6yn;6<^J_{#nZzTRIh16NfUlti;rY3 z6IYI>+~1C%wqV4D>k8qLHKS`Y(ytvHFAZ4PvGgTSCX*IV8h?b6&i7ZGrIFf2Y98*_ zGPM-N-{+oaJ9URP#BsXEeD-`FESVt0Kc$T0Hz`|m7F9IaT*7iZzOj1`WZhFfo{>&5 z7b$VKra7C;)%Sqr2Y*8IW7VI(6#phJEi3ZIp}K9MNn~>Jpm(B`0T3H0P}GxLmP2tm zBBG|-OVSn(H8|&PFIwCx&G_0%ADDycVi4c^cESSqHORNAHm?Y@b|DU7irmihSS_9j zg7~H6jM&(`e^g6lQGjnaXEdrlO7Ujm8B)#Cg^_|YRrYCYX}(OpbU&bzp>71ae0rkp%=L63>0*(E>;anT*fXZFB?6={4g7fELU^*H7X&RQokqn zV<01g!4Qy*muhk;>{q&7#1p_EPnTo+f<8uBdru22`I0GOHA94SPJ-txJqqZxI)mJQ zM6Y6d)^Wc}&9CP8%7t}s&ONm^K37!JICu)cXC-FJYr>5!ddWpo;vJ6@nz}t;ip)Qi zC;RxJH^mJI3utWE>+PSP+_e}CMh$zsd(E`QwJzv3%=JQVWP;`O9r;E~@tX3l!db34 z-*COokj1a07+YYlr8|f_xXv1M>80a!qhnQn%gz=N?_cZT7KPyUTi1SY$8&STR=@D_ z-2VaFu9zI*4^qgK0;LwK&@o6QC;$F+LhIgia=t~`s88OG-RX!fS(_d@!BS=dN_Fm9 zY64Aofxs~OuRqc;0^F(ZE-a>7o^kvr)i9`F`Th8Eid@JG284)`1wga!pXNV-xIYXG za&iqcf$3kyd!%=mg~mUvFp3xPp(tjel2MPcvoh5udgtnGoJq0-eP!2WZx-BZ-!4tB zjj#f@zh=2=Qk~B_*$30)GSoh>4`%mE{xTUb%D*qhPGtGWA2_8+*y=vZf` zk{wgwjmCWcqWNX#RqDu=YMzX3iWE}7+Y9w>;j8AK-$4&!n|3K=%=RDH`NHI{)!{qL z&~=4>tkaPVRhg(DW`%Q?)S@!SX8+8#l+iRJ{mS&T;l?`~&j+mjehYd0I?TK&->&AB zME#ckC5^<&e{er!`X{e7Y996L79&&HRTwUuga%ghof49?{#E$f9WqH&U@Cz;YHvEVT2E~r`b6q{e?%(d@ zK8;byOJ)r!5_Cd1_mF>;6HX5QCPYlVIOP`kt(T;~+RnZH;GZYQ8xNo0Nm*a$1PC{p zlZme+3`Xg{H5hQOZrD!U|Hz|jKlIUi!~m%{{aa0w5pa#iD9={jK&iU`J%|1I^WQsN zpIMCz`GB-e0@{~;zN=s<_s0C)*}vaI#zpVE)7Paoo#?K9m>3rQOPNYZl{7NT0+@Hz zGy*JuN}oy^6&%8r7Ct{prTeiEZsvEl+DQ6U@hDLGvYq3<%=xg%DoqyY?`%`m8|Lrm zE;;`=Gh+8H3}P+~R=jbeD@Q65h(@-yJ}+G_xpXNbKZWj+`O$Y;EtjK3ghJU=KmFrM zt(@vxs+GTqeX`&8cOQZd1yY^qgf20D@nfal^r~;sIs3dUTmSC1y6oLMkdt5s3&~D= zb;*oYO@8sq0BNfXB&g@Gxo@xU@Alt+^}`=H|4hxVVd63Qk8|aV)2Ey#|C{WI`?FYm zGF5R(2!u`HVgg%>rZkgnA27-F1(-Nq9s)X>Uw%b7#=%+E6BB+vGSqPjz}N?`)}Kp{3F?sOv!f1)F)wkCrB@ zPg*r|_Vq`V+UG_|``X-#Kg=_6Ngp2yd_nooBSP3O8o>w6nzI~7JApx;iw>JT|33If z^AG94gZ7uw<|%Z=Fgkwj6rEq%g0Q8C)hGYgZo?V!YPK0UDsim((H}-Gl24ro`{yb*m`0Qh>$Zqmw@(_P@T9};7Ff<&M_&n$xWYZU1pDG~EOE(_Jh<{tW|)vSLfO}yFvn3w1p7_93G zr`Yd(k1Y=?Of3Om^qTXu=63w-*1<7)*J}lOR3Aw{%40CQA}iM8|5SR~E;9a*2q=!z zEr}sXlgdGW(oRws`H(n3h7;1dH%lxm(PWtoji}9qP&k&N&$YmCC_mFvZxm?cY9gW2 z?J8cbiz)5lDzko(J)yHdfB9b3fnT8~QBmDzB_c*_tTZrcx9nb=N9sOQuUt7irhh_# zJ|9t}qDHR?OSO?-nP?%#g$*k&#CBFkLX{%*lon$r>x0nSGia#KGR6ZCLxlQ6*rVdLz3n3Xv-L&HN%#oYw+N476*|RAHfn$7SQsgQ7FHfiLc1_3A zZHv4ump)w`?uO*k*e|}lTm{b5g%TIQ`u(o0Rq^!EP|XP)ujImpH_LMxvrFW5?Op0T z?}~5I9js~JQ-#6Kmx1#@-O)Qt{u<#~Bp)^FP*JpWWuI>)kh`OE$3YoghFf_UDE@gk z#`zvRRs!e{W1)Jb@(y}_>%6EHQi*uyROxB;GA9$sCQ}197yOK@N@4q-BY228vnNCy zhR4%j7950h3XB(~FDk{8j@e|=K^`>s8p+Ihj?tN$6RUHi2hoR)IM5&Ul6fj>pvk8( z>jtyT-C4L)2yeQHmLPpLgMGFZsJ*tXpgIcC+qqQYYao4@<(Xsj&gGvU&kvMobOXOj zJ%PUBSHbppUh>AeymcLs$guq8G+cL8B~dZXF*BNE>EGs=ve9ra>g{l;$Xg6Xg&1Cn zPgG0)I-zpie*?EXk@3QCO2S+sk8(9W{>sMN^LF4+2qjj6yl3Ctp|1P0@Vj6DHSEbf z(FsCzM+S;NZohpvho6O`(b->o^s`Mt#{(&cJFa0b+@jJv3le63?SL)uZW%R6Y)8_J zU##Bpq|6wkD+d6I2Z|ZIUnuxwvgjYb$;vE+OA0={Ic>^(myg%ZgxAh>^DCf@G9TV% z2Y|xO4~YxXxy&ZQU(8GKc*e(8R!FPsbjts)DNCw*FN=FLe7 z`VsV1dEp1aW^Vw|YNJ7~!3!mF+Ppe%#B)0Br1NUVG!Qh&)>u2(NP|u7ehniVrp;By zPWoV7%;&BB1&y#p0FIZ7Z~!={(!q~OF&l7}3l&;km+*;^d}Ce+kbjX?BF8CT4G3xj z*z;$rW;f6E1f(`eGJ}mQ*%G#Te2tWxq$OFUs+2gMU19WwzgV~kw@KcCCQRRrB=SaA zs?mIH-MW`}A3s8N7!lq`%kiXS#-c)1d0bwkN@S*-GF3G+Fqv6A!7YcHYm}bu{iH-! z{LwyZIsRm-rO+T*UaVv^sj1VRpeRK{n$x`(_Tw#tQW3cWn1}H;_Vx7D{lad31a;id{HjN zBw+Lf*G&di_@)bAnvkj-uX7a9Q#W!PgLZ`vJ9NGt<4Fj4pGJj zi)Xhuv4v5;T2@1H6B7DC0WMunZ1jj2LAKB$bE1X z(NRXAn075M;UGJ1gpz&Sl$++_C-ZBUF7>};WHu90_mcscOIALNp!tSG`qt1E1vQEU z%hw2|FC1+0>=w{xv;W3rpg0^tC>c?r1+}3Z9EyV8un>S^rOuF!``^Q4l<;F!5z~h0 zFuN|Mpy>vz=P3p3>pgglew&V-M zKkqUd6lyMeBZq+c2!4iqxgZNUt!teR@w|gRrjFr?_DfyJ?i^>Z{CICrN!_kib5Lhz zrNa7sXPbWp1*O?9)zrO|uc@)0e{I**?%M&sBC9^dH79m*B&Kx&+L z!aHguH!N|UIz??xdLUkArGzrp@i_c|;gF>xxiLQzs|qe>Za> z-!5OHe|#6{BKdgKlolz^*g1S3M$6b7C)%`!N&iLte)^Zw>nD5BAruF6HuG92`P+5| z#Ya%+m|4xNQq|QS*3SW5QnOf}rBr>>=rp_wkQl51uuS!1431}eI8Zoa|6hsgWlyhJ zd=5V8kID_n$xHIfh;sY5&Ybj7`H{xI^s||{9(OE>>`0$ zafiB{sPL=tZv;LJk8g@lXT`Up)H-TE4cT3i|L$y5DnJ~JDuuzmdMGxV7Uf17XKEsY zL(2qsreq?mec-d7x<%aTQ1#rscU%yu!yH4M`Q|S3IsQv8KFQgtvwqZQWMbpH5Xl7n z{Sf{D(7?vekjuj_!2`54Z5kgRIhNa}5<~y|{7^}x{5grZO3@`Hz$PA8alpYK%fHBm zTLT<)wh!>_f^#=)^MSI{9x7_GzaFLB64!|+k`MdTS@O>MVkQ+Cg1vJ~S&LBZKhS3E{GhRt)`fzw7pwq5;I_TN*-85B+yAF=K^#5FaPX2iG?}gUff}a|? zUpyoU#EG)#GWiRS=u$J;+l}dfwzfbfDOEn8?9aS^W=`%T`%$-lAA@*H-)$W(Zc&-r zt@6&-^5`o0GG4wk0X8+sa`Ujm7eLn zR=&aCzyHz${()>Tj3~(snkuRAIntiq{!@#2w<{0*ytd!DzDs%i=aooo0jfXb-HBXW z0(U)DfB#P-U?#D z-j138)LKyUAhKO9E{C}d=w!ipek9st=VU9$XoPHk#>~F|_o}H=kUSg6*Xr}UeHwF6 z3IeVvGp25mW!^1*D&O~%;zju_RelwfP|R2CDkNy~2&8)HG7l|V0bVexM@ZxUm3>F4 zpE^_0%;@V-ffCcvn<);%j1rAEi)!%YcOLyQp}o=WS%czN&w{W4MLDrxtpO#4fq*m@ z8MbUkR}0LnM#Y1c`n!8Bf}*=wkGI_M+>c|N4M!=D1{UtzIa8MjfDeAusHv6C3`VHS zGYuN5UN_;z@^Z%9oLZv(ped>oDqT!e{RHJ7@%mk$eJNWf#=L)`{QqV9@vvxWYv9js zYM;Zysdn>=C*w8$!WS0nE2k>%Bh>Ey`v8foO1<7hq!BcT-v!#kv+Id*We(XsQC_0g zBTxmJ?tl=jlAuoCEQMwb;hYkHYCdU2Ko!1Lz4%N>Zbxj@j`wBT4OPKUCOnyD)e6;_ zF4fmE8&}D#l^viD98W59r&kUR^_t}|i-SHn(>ob67?{2FVVeXfd|55DliXWq-M$&b zF~O!)aJ@u}EAAu;T#h{~&)F)<#)zbwg|!n1>H^m~!1hDg(r*aYiA!;%#5#)kyxzxU z-6dg=C2V^JE}HPn|EV^}QKMJcd{R_ttf$sovs2pqDVX@7@EU^6SQH*Qe1M?Gz*N#! z+V4TYW~$?*py9~(y)PEkqysIB7jKmrmjDaWZy)BqRSWW@v2z!ne6{@C_TkxcuVle7&hPi$ThMjUCr>95wX!@wBYhTE^cP z2ub#m-pQ1nes5pLOv#x)50u^Ph@VRDy-_OX0O#}cNyZr(`LxYWkx)&jl1jp@C2#Xq z&OCo%IWk^|U2pqk*`BGwcBOe9zF* zZmRb|lZQ*}cfpvT`rfqAk4@WT~RB+Gv?2iFK?|FA|E$5$8V06Lpg{|N9QTo#~ z9(7W1WJ8YQc|2C~#NP3x$mgTtuP-8bcUg260iUWz27a$QCUxnm=5+c5l+<0-g&a&S z3(pN{pe=Vi%psp^nqPZG|5|G|x-+k!l`XQM(0jI*j9WUqnPl5ZSSD9YnA=7#d+V)FA3YC{U6g_ z6egsCiadP#71a|Ln}ZS=U-0G+-c=G(^|NP9p%nmi7?~CG?izM{Ad9p%Sa&YE#y-(H zzP1u68MIba@K{i4jtds$hdp-&`(YR5^hEQv`pA$_G^JxFDo-uhVtt~afgHcc;oT6-~HME*0s3>uN{yaJ0 zXgXin6L(uRe>J3O9+F#Z?Lx&0G3CADX8aPMb)fiK2h~{{WYpF>!Sp`$k?OTaTqjCT zl{?hc8d%DSgQuG%=77!iN`2y(7?2KlnMsl}pX2;h1m~!s0Ug87Ah$`x8@h6BZ@PvS zZzcl1qa_o61f-keqob<;C52cz?f0J&${tCeQAKFHy#DqDyh&d z$rnT#&}mB_3;I_;6+hAg!DiRsv`rpI`TJ`h*O`ugpp*>o2D=-21qSM}nb{KNHHB1N zE5LotB<{;LVv`HQXD=Ur$#r&bX+@+6+4Zxedg}wLUGkQ=>|skZ*E1iLd}bq&LuZ3A zgE2Z4M#drY++%$$FnzJY+r9OVDvWB~Io(&}1nFr9%kg7Eqn}-gz59%g0R@+k@b~Bn z>pxClnHaGmr1;RKrufS~Q>c2v$E@%yHNdN}P^5M_q6G6&+kO6L;0deN;@g$GL$eu0iYo3ZeJwbC2dFDDeFCA+<0oJOV3H#;Qt zStpUJoDk+KlbGeg3kGwyvr+^g1zdi!({a?S4Jej;RFRXEo@k#BSQ02T+@2PgB#m*h z4bA{$dloku^=0w^A7r^R{ZG3Xz{};6_VE&Y2B{vcI)Nn9KA__W+$txLWawb37(USQ z^>Ki~*KvmY>ZLl%9>-T)2DKMofh@t6y_}6v9=aLEDj%)^D@+4Cn7=p!rD*G9RjFZ5 z$jZ0C`9o7%Q$xp)p>ZCWEVOF%^+EDFFF>tX9Rj^UmhvFp>PwjEj!q2QF8Thowc^$X z)^t}eK}*T9u<7#Qurd3K-hyy@9WXLSW-7}_BYW%y19&ZD$ro>_pP%r z>;K~GJ)oM1zIV}31*A7A(gP@hQWT_jB+`*kq<562w9tE3ia|<1s)!Kj2neC~5`uzs zLIiSz5EHpt9}OH{OU$3#By{K1-_R=MPwY2 zlRd#VJbSAn#eOF_6JSZ4TfkTI+}NW?h36wAMtrWWt|KN@F)NVnkd;&N#N#!}ON;yDN=A6=v~?9F4gXOh9eWBj=ZaEazPFa zDL_gpu}$!@cVFz$_`~tJ+@OW)|8NbTUF@g^63&Q})F4JCZsOx>L#&lWK=>;IT(vmRfi9HD-DJr}Z7z}~iP z51{%*%No0>3)OA-XLQ5~vX~fLpMc-wyi^_Oep`K6{<~-4`r=&n3YI0h4unP}lh#V6 z#Iu3T-U<-$ppo=?9|@2;GftS_1f;9YmrbTmI##VGe)ql7wzY$_Ig7YhuhQ`clX2#} z8y__-wFWBgiHJ4m+~Y6@b*vd$R^KC|HFJITO`^Q(iCHlANKO9M`7MBqM{$OsPOZ2S~2`sr1NbEE3;3^wifAN25y8L-)q=0Aw8 zC>%|E%hPz=@tFGfF`2th^~p&ZnL^JoZVN@2^l59YdA0X$j!TJq8-BqGjdJhCV8#os zGS*Livr!FDnDF;8#txYM&uBN}fDm@~qtlcxE&hz^G##$CDjM>A%<0VMk~ZT#;Ujj$ zTLD%l;%?KDkrtZ$f|jBC)xt2@8705W?FE8i^bXnjiL=AGW)_Yx+Z zLdrplhT2Y#kUQyqL*gV(@vp36e>v%=2)d*&>sG79WU-~f;osm5#-zq7`*)d{H3v@l z7I_XCc4w|s$fLlKF0cI0&A}Dz=Q1u~J&>emzE41qHql+`Gs>sPQbYh;w-+-_9# zk2Asm{zR>|s~&7i-F7>c7<;6OG6ezQ)siv9?j>uwD?&cPNc!OR7UOW#5U()PM;QR> z_|UNjSQb=!!^l0k>N2_*qxTg#cJlPx!_Sk>9GO!fJHdT3>rpHB)^LykX}_B+cPvE>nAESK?WuS}BXb%fTiCOOZd!$Qw({{7% zJQZ}5+^9lo-rsF|wGM_m-z$*pZb9|4%!@%M3tns93O*gXxi`_=1EU=Ve@4+PjItUA zzgDJd5uYK-iyJ(+f_v$6z(0F`9IH_~OQiSGwias*v5tAZ+#fcNa@+qVHU*7mD*F25 zG41YDxS?LR`=dYmOe`qGv9$Ww1sxaEIZv(YDz}ELCHa#IDTo**9+xlbe=r=KmZTjk z3rt1AeKaju{NO%f+|kIiF>{wV+W9z-C4bLqZ+FGJY!C(STB(Y{pqa5b@xbw0FTCX; zKE`X=@)JB^r!}^rSB=*SSzRK>d0%}mwz@_PTSI{cxVs#3>@0@s3fgo>UTOCT2UD$sRm2(Q<| zw_wZ0ADk%Lq~7DX_Da0HrNv`Q!iKxs!(3+7Qx4alLEWBOlcHCJ+H;He(Pc68lQGbJ zZr@T)C8@^I4L=6r6vi&{f?#(sRK*l;?qFg)@R z`=8z7(0iZd1=3&`#v3nqPUK&vi{UE ztUM5E5bdnt{{adT>5(dxM}dIqu-v+^DL8Iu0Y)T_-1&e_bL>DS+P%bq-CRV7v|;52N!Yogf2{On70|2#zN7Q^DOV* z)m2Ypte>V1L-bmOR~y&c;>4Z3lQwMMF)4dwnl#NU?4Gzoxz-TxEjxG`A!eLEA$1IX zwEN!6FVm8HwAn`Vu)H_{K4^|ZG0t=eKw2hfACmQ|p9svhGtcrAn z8Elje!+#@kcCnA@73dr_rI^6Mzq3m)+0nj%w}sRhr6|wFWwe~s-dm;>+0HIyjb;fb z1g(5R@WVSqy%lz3Ohp=uAsy(Y!Tvauf9-hKQXhY^ap3z^MlE3rRLdDcNdY9DEey<= zcaq4VSZQy1)L<$=zQy~NhjD;}QHZgWkycG{%(kk@ox`%>cdLwlu$VLXtZ4H7k0GE; z^@NFKpM;ZU`40Sh;GA`HjhC?#n{GVCL$#{umP!RDxM#LACvqZx@bN4l-hoz!H>9im zUq#Uj82oAiOae9*N8uKi8r_0s%pR#5Q!e=+krRtGP`5kMAi;#QB}8i=S-Cr#F$FkU zf5rkxS^~Z+=sVXMfZI*nP>lQwjEUBwzP0}G(36>*+?+`GV?LgXu98@gHsWJ49&JwT z6Q@;6p-DvU5?UwnZIV@4ey=?w%WYNlSCxaPs;b~tc+iKw_^$uWEVGCtu^+I&tjD*G z$50o!-E~W+dHi1t{roe+yV@#QxZy|3Y={{`^h2h}SIvuWsXnSj#VS$C&N~b4&+CHa_?=?ONh9Q>IaXHP0DHS3Pj07h6){JG8R?0#Ie~c z5zer=eTz&DMT4Kk>$NF6Cbk#=@csHsa&A4-+u1jF9l+8Yz|dF?vszY>MRuC@ZFuR+ zFK`x&eClP>q!nA?rcd_# z3;~>sw1&Ez9Djxs66G^@o~xgXYP=uk5AQjg$WJ_wSw5N)47p!o0K!N<5~Mt2x?%hw zF6h&<*Saya{!iqw){Nmqu?p}gi9z4zNGCwZ?P&T>Tr9@vXPc*<69xXAJ4J=;giW=C zg_-*!oYFgOL2&92tZb!Pxxmq0nX5zAy$N(V&xtzzY0$UCq4lg$;GRA&q0)mmc}S|l z=E3a(;%_0rNjaO+`{QN+7Gb3nmz)6!K=x}uFE}kR= zPi89fmCdxBy{=!>0c3tdCj56L6{@Y^o7hKKZnMGE^1)02uk}U@JqqtQ{24ud5^+!{ zW2yr>6XU4W<}VjYrBaK{D;a!6^pjw)TEe>N1%l8|hIG^)}DMDKlLR{)Lu9ilb!cMrVhtlnK|+pfg>)=o=yyABbMQ!kh)b!IfGo8{+0NyP5BeMv z8P4@8L9SDQDb}ywvp830bk|sEiEwe*?HXw#yognBhuks@fbtIz@6M@&G9-eC6(@Hw zQF5c$V**1M3NdGkE#ZYCG8H`S!uI<(96j6s`tg1GqpGG6V6eHk4F^-N8iNb94k^6% zH4B?A;E93|HB{VZrxBRymM2IfNQ-J;^s`^c_@TRso1pw0lCpO9mdt<|>H^;#UWHDi zeD>}g{}&GUV_-6I;`oIPAiydfIf+?5<<@_5YJ4Gqr?2)E-SZZ6-VYzWQ2F0Tc?|b6?ybYJ0`BeJPezKg({~*lQwODevX>*V}(>ha? z43h9Wm9kRO5KX3%QT?rb6eKe8=<4v|!QsK)>LsDO$OzIYho2O>ES`_(1+%e%!O4!hOnGDxv^6q9{6|aCmEwrQagTiW(+fTwiQKRV&WqM8!mPN1UA4S;Qek zu7!;%8r^EK?|KScG)SKC;K5RhM@ILPYa3ZmC6f zL5rDK>I%aMfU9buII40A77AT0Q!3&JAvT&{6?IM6B2-_79$~QkX9cJ;94-vIcO9N3 z5=jDt4gYKMJ6&x%9K&{p1h;!(bC9?WneJ1m?EveH^+aigd|IQ(d;@X)p4(ZZ^uc0G zhp3G9ezRVW)(sSlr3T@!k=<{DTKELBTo(-*ovu&{^f{3#c-V*f8s@j`jja}tko6CH zJ29Fi&kl9G*?*VHZY9y{HyITr&Q@fEb56l){(GBw3uxXgW-b__prH+GaxT$V*esA{ zU*TtY(W01DLKXPFWPtxg!E}jw<16yL2hKmH-Ck!Qe0&Vs&;>mnPt?3@g`3s*&4_XO&VNp%)56 z{dU(ZYwCAC2W^wX#C&NNU~-0k0{phJg7%hk+P}ujD2gNGfE5n8X(P(5mhDG$T^DFb z>yyCwXLtVG`+zWQ-_iR9U-yAN@o}4xZQlv98BE_=g!mw;-)gjaw`QswT=HJ?C6Qda zPIq;0ognrJt(F}Ar1HWw$i5hz$&|p@dGd?7CdLCoaUxCAFR)!Bm@}DDic&un{v9ut z#|eJ?$S6N;j2}ME`6_AOMcAXeEG;YO@}V8hURA&PHLtuKi7?WBeC0{|Vk2B4L$()D z8mJwZ^xaa3GD4QWd8JuBhXYPs_&74g+L>p~zb%5~R~Dy4`soCpbpsfdL#*6JjVH$ zo^_{uxuJsp*g1Ql&-pwD9{f0Dy{B{fY?T;$m zf4F&Ws#EAkg{z#`=(B7X(#x}+U(?grJ~J5cfro8!ZdItc%7VzDx|?D*DJjHGF~xf+wt+)l^y51ft8I2C&ETsF4ZTn!PjlW0*(Dmrkhm4 z7Dp_DjM0M6%FBxO<4-e~R(~;6KMfSC@sPw|#M(cR+XSF*ON92jH8}hk4BT|D{BSdE zB`L25C_Ca{S|n!l0^L8aHvyGn75BDwR9S3zF6&@bjtlUOt%86<(9PNR?DY{sOTVNo z)EqTpzx1UHoLu-&eB-qm@sutUFh=fwu9zJ+KARh>>Ec(GI6W1KLk=OXc8a6-Q zzpc^}u9O@ImB^T_Hz?^LzbRx7Rn+S}E%-#v`}Tq0i=gS$qPM#=ynE808{up*RJzsCtI?m8#_H8O>NX_J zEPoJ4cfu$fGCJuku1sa#ibA;HqE2h-c{K1oZ!{>4Kcl)NAlNaTD% z34n{eH71E;f4oNSyn+4G`x*p%*Yr{YY?k~K8h;>CW}HY{Vl7y8;TlX~I|;|_(3cQ4 zx@J2u-m@H5OB3; zevn5i=c`d(ISDL2<*3r`d-x)^+l!~G6zUp{kx!R2_>!-cZ~l(+nvhz zZ+tlFs{knFsC*`P%oPkIRS^dGiATc*-b0~%yVpiaTe6&?EV_^OH^dB{ZTUV~*jrd$ z|Ji1e?==fr&m7aY47l3)#?hc|Y8+z%7^&a(xjit+n$^C!;PZ?1=__W7B)xvbv^73V zsnD{k$g@Zb3Cq85uA0cm^ZJ@RTx(C48>p!9#Yi9uiiBEYZ@Ia5NW=5OyMcY z(ZX$x_dONHIf8n&N94j{|2{D16AjknkRE(m3My~v;k#FFsm*vNLC^_j(AZh!iW8K z@tbiv^?ok9+A3ZV3=<)a?;K%yP9=}2+5UM>unhzLaQPbW%&-_8Cz>9Ce=C-jHyH=jv`O|BdvDUIj!m== zFw7N?5&XHsRbOL&^~{SWS7<-iTAVVLXkZ_((vfruyppZuSQUWM5CIG+d2Bsq=UX3b6-Hd&df5_%71n|8O>uK1=rj{o2U$yDO2@b7_MgvoLY-)fVp&Q_&Q4C< zJHv1G(|(a2>Km4{k&OS>6l03$f|GD17yLxnT!9?7(Guow6GPhf%hqibS<69i(T*baFGvD<4yOEuWIrO(!yjkWpwXiME}v*pMGrNHAb6$6_NL{vo5 z$M=hK|90`{W&9s<=iB7*PTI+ggT#;)i212HbD)wv_fb@{`rNN;Iiqo3LKI?kvyP~- zpgcFN#rTxMI9`gXPiG{@)Qh!v?il@Vn*$QBYoCQk|IlFUHw_7DeeM6%iw8a4xSTc- zpxDZ3L~wH#*CV54fIB!nM`k&#tx9*OGZ-l-HOWwoR5wZ24~&kp5pNe@#oRsjc_wR^ zKumUeaV3O@*b%FdsL!>e7`3#t7*5_+BL~4Lu_ZTETyu* z)48h6`3G~a>+p{{&K%5|P+TyMYzQ;ns?z0scn&V}WT zPk^rx*1-9;=@-m4ITMRskH?wEB^qiLys-WdK?@(d&XC<<+PLMyDMKAkN_S?%#`_B~ zGH+MiUdyzoG)X-lJm6d2t~|lKm&}PfhgG(c)5DiUxDzSDUU(?Q*_yku5|i zu%(dW7g-PDC>ADa4JpsPgJi4Z3%U(rJQYTaAR|t}4{=Gn5^P>q5Q6=z3ZHRzV!XqT z#9FSZqlGUNSayb6RoKy8L}kzv3q&U2%4?bX^G3eGC$E+I>vi~Km|STRYp4XSoxW`o z?P@m;{Cr@PPH_L(UkrNg_kBg4?BYHB*TL{fMz7B&G}FuaAqE%gDs)%=(wK4a)xump zH+&$$4?8+ad`q3QrP+$T5NMtNAKT#J1NqRX0d zd9F#6914QLV7X0MM1P$PCVu^q0RBrT*)1=2Z_Jtst@__@b#WWY#yo^u*`c z@*B;W!#p|DF+0KS@8323YE1?$EQ@YG3~x8?aS-QcNLC?Z`kg8yzQD1yL*x?|&$jM} zGlq!O42)HM6t9|XBebJ8>2z>)Y!-SOy%);c%uRNAMYiw23+YA5>j@i<4X|b{1UuPJ zanqa`Z)@lwJdJW;1YT|ap_B2hgO{XTo#AH}`a~&6+^n)YM03{yfmllBNADIDiiH5x zX;XeUE_yUCbnGO$yeW?rYZ60+^%uTw$J+8Zs8fMPZfE7S$baKzl*|>G4w_w*^mM6y z@&0C>rpqX8vUr@JrmfDfgHEgvQ}V*c=d(4Ii#_oVUwwi>`}7xocxT;?hdOBF{GmrA zX3^XZtTFfCPY^4+RrW-JS--Jf;QrT^hPTeicbMKMq_u_@bawiI+2c4BSX`RKj#_sA zIB*yX$D;~^?oyH$MNZ10a{>q$C2S{ZJt;x{|MuLBg>AzMVfN5H`7YBFZ}^B(LlV5F)jPRmx#;Zs2ap=J+ZTMX&pLiMYM+Hzr^|YKD2pHt?{;sBvy!S z0iMm%>r=ax7|+=HwD!*(9Dn$@w`mMb@^b`xhwBV_&?!6HZCj8_XAP)3m}iiWC=oI{ z7Ehccx5g(Zrmf6cBSN!Ilsit#@&--*wYy z{qpqE^Ls{^6{!ou3>(;-jA}@*B;y@Qj>DNXc)~>Ygpv0qD2)-+poTNB1J%)f+ zHo|{1G=YKL#H7fzECIwt6EUiB0)BRr_M=$q1&*(nF5}l-zW5!o6#|S19H16FemjNB z{@tDv4dpa6`lfIAN2MsAl8^8=kQoU;a{G_Va={Yw=DYp6~X zcgw8!UBAEBI@=1tsDw^Mo?B)u5dKz=O2sqGfGre13=`e|>(IRdr$IL>n6BH00CnHI z|B$o@XXHH&ACwfVU?FCiOd>I=LRn|3?Qjw{b87aR03iXY|Dp`A@sRx4*>BZ*9m&^& z{^zWC=F67$^MIF~Mf-fq%phSit<-vA<9&2EX=7+%QmPdWK)rK)Bw#Yn@hj8pWamkg z^i5Kl$EiA`BWuKvHrVW`)|rrss@*%c?s!6DLUX@t(SIJ`yDl~(psuQLc(wW zIGcO%y<0Wo?F`t2?a?DJn-&C<42g1A^|+qYmQC^NuI-o=4Yd_8AAmppT&wEtC6H>XADyg1Z6(mx{#@ zFTP50Q}9Id*LKQJA^fdzSjNn-)}qDDqYV1(tee3LGC?@h*Ct_#ena}(Z=YqesdrL} zq;riI&@R2O=AW_73PA?U+5~oX5I|pX^PzaV&fxgyhn!M31V=n*tc1+<)Rk5yc4QA} z*STZnT1$Ca3~FaV9_t^h8`t9oGyH_~%0}W-+^RMS3WlEaI;%aK%eLwU{y|@7?$+Sd zztMQezFKGvU}bG)q+qp>Yf^6zmmU4dS%cdWYMT>gUZr~`>25W$w*`{VfAoM*f0|z~=rTl2y4i=w)SJ|8wzJ54Naw{?olW z7D%yuL~8u@_tvmw5Le2l>Jmf0VlK`F3x}21p{LUJPh;O$73%C7cc-Cg?lTjUWVOzFn`s-C9|9H%+hbr@Qfw&+HQ9qcYQ8abz(Pt z{uRG)Z|BLqSNFs(3nPLQAMja-SuG@mNGuE?@{l-Fut4;wi6H$lL&~CmUUxP|XtqfO znZ19`C%iA22%CPwDmNnyb3HD%-E>|1(*5y;cVTAi>j;69cs2uh(CR0jcTGaxU3f$! z4)KFTMNUd@r;2BEfych<#lvF^7bx^tVJ6cG3{h0MsQjOa)xLrl5mSPIr=;*qW{}Da z?SDAnpT|Is!J%sM5E(^S=Xz|*jcLw&n_l?r z0{-;z;Uepcr>6HxTNetu#^E8tI)&Dy5XdhB-ehJ@dI#RP;T3XHk^{ydZdW(l=B_}2 z@JCwnyHJ|tb8l5Xhs^1?Qjv|(mBp^3-+4MX3XL$tqWY5QkB$kmz1u4{In2*t9YQ{7 zb1I>bphtD;vVEkL-$gV;{M;zQ0xT;#SKE#5TA zH1&~vw1FE6nF^w>OX32#fwC2iE#>#Y9?0`U1Y)9u&ThCs&rVB^a_>F|fXu>lwOnm+ z!-toyqjB*8rPdoCgqW;YzrFjpz?aAzJR&?a_0Fui?P?%eTe~%$UgpFEtQzo#Mxp-=Y(D4pk zK*jqdADvaHW?+mQOAJ*xe}YoN^$hy;{pb0Y*y-*9yE=>QwkR3;R5;NW{eO?N7yvdU z1&Q|jftN!K4`pPwRIvV?SV-Z7zx9VVqGN?;J7JxL*>e7mvZeK%-gtN*F1mI?{w@#t zzkJZug=vyuwno5~+7A_jT0si{K1~@bnDnOFg^bK@=Z2%uBO;C@L}0?TXv^G(f37n! z>2sWnB&{?;jk!kk%Rn8nlbkO5`Ic;>tD56)eUm^t-?(twnoHrq+ZpMgfsP4aDOKj( zyQF~EeU>+8kmLjU8kLSkJhZ>=f-*(p_b2%^n5#*d3LwKBrjoio4=gn{;z(ZGIDVm! z{*z>Am57sjS#uvF^64>uwy;;nEauh({?Q~LT=t`dAf1WM-mRDGlm)co&_5%N&3A-e zK6AS1Asemz%<;QNo8cN+1?hDmaV)rj%w zLWxO1aI%ZwhY2`Jb;*lK6oyfH#rHvvmWeh6*fjj&9Iv=Pn;!o55VI1J8=CQ5+_&xX zam$youIC3YH=4R4RpkCUF!uv!j<2r%V!I2DJKczt?7W9jykkUskXsBXJ;`0R?e~yG z?Mv&Dui~GO8Fr|AG9y+vo89VGyt*jBtA>RW@;eBH?(W-gH_iUTIfUk;iV3c)hkvF* zJ5FExTzV@_20Lu%M;dsZtdok}&GQfwlWj-_Xv{;0ilZRtI&{bh>JWZuyO7YWc@Xn0 zIYkVfc&Cy9{qm-fB0YUvlFSy#=wqLymScP?rcSlv;G&P%btDf$7%|khh$Te`%MLwkE6-|08jNos|CjU*92lIO` zPa@L3Co+;51Y}tQ@#jHq;CL0DrL2f_33p|$_4|ju9`-pZ91?>xbA-};mN+$GHq5m7*Eo&rpQU=?t0~do!0V|mqsXVgg z22LBo&dS(AhW>0SHswefpE8E4^T&e7r`f>90m@5%=KX6u=*$j(^hBP|v@9)7{I&0h zhiaAa6Wa!T!Z3^uu|7-vkAm&jgMQ^!XF3T!o8xm5M#`?m^Diqi9n;`Vkk>n8xclD7 z;Nbv_ky=zoUR9!?0zqBC@rKn;nuN-_1$1egBIW$P0z&T;L_YICMyS;dNsdY!%q;Y3 z;x`bVnW&jqZVxPc^lsKLah$VrDaf*^$k)?Kgi$S1+JW(-_s;TtgAW^q_vM1aoHBGi zy_#?tHJE$tEbh$N0{doZJ1E@;GuT|GLunwKn_OlM(POVTG)diqjusTQ?pCM6d#J2t zwUV9}B1unr(TK%`Hep~QMUFL0_-?+Z-^xy%o~VznV%xh>PRSuh0pg0x3-5{Aw9zFS z+_#Dph)o61<)deIet`wVv(ioK)jQ|6Jp+Ry&^thXc4_q-Lv}#s4d&uIK>fipVW9fV z={46SfNsf-P6Qy=&wD->t8zG=p~XdTu%m5X8Edc;r0I$+YV(hMGLaB*0YexVx?pVt z2X3i1ULzaaUo?!Tj?G9sKJ$Ir=xjB3Q&~3%?<5JC!w`TJ)ii*F2 ze3Zv8RPyzdDL~+p!$t21aFpOEg3ry?b6cNn;ib82%&@&MF)iA5y%c;RpR%`mE?z1+ zYP0ClFntsM)vu~5qlpV?w&(ggSp9s3^8STJ%dX3UV@HYT7~1)C71w#t)@gW%z(+u4 z`Doz(d}Sd+0+?C%hQBlood5ql0#Vvt5DTco?jQ1RpfPh{=pNDlE^1gNPu!-rR;H{X z0^hoa?1jJ<(=CXsP6~^k^;SqunSL2X|I&W1{iB?a5Fr*zoA|Af_f<#L=m+Fq|9bxo zv%=l6$ZX>$LvVwErUW*pp`_AyOZiw|I_Vds@9&N-#C;P`aP4@t->>I{o=-;UJzL(B zxm&bRYu8&urtMp$AWV8@VljIh(8XLZfxGuGH$8Dh8~m&pBW0esU7o%BIR07A&*h;4 zjqxh?`^A+G^`N|zETg$Z%B-xqxJ*g6LLC9()J_o)s;=nXa>Vu~M$=YBPV8;J- zgqM-NzWB5AvhY#aSINfD;dbERScDtS)_n$*AaV**33yUWKj|7lm<2xAIeZ)%xQAW@ zZ!GuxpPn9h_lvSf^X3UisC+%!8R?7F&8ie(;Qr_Ml=sO@{Ye!_#WnL9_fYBOW=%B$ za{Z6x$;n3N1MlEfEdn+;Y3%grI&}dP6rf9$SP2He0crrHXKVQ-B=RYblhU1@h8q6- zwk~HnqV}{-qgF3E+ikGlidTooC~EpyQ-^rryb_WCMx zi`a;6iM7{PW^>&f+}4mpF$fIA%OSio0uO_5Cl&4pY2Qr}Dn=>|CS862_is$yBm@%? zc^!%`ws?a)!**^Gk{01`4>5QeG(a+P!GUQjIwE(S2gC#UI9$LmXsoRX>;c@IteYfK z84|iW2~m(@RY=y(1a@cc4|OI@LxjPX>N<;pnTyU;4Xpu9=DRd-ct!Gi4B8#T*ZN@+ zvA5DZQFK;w8uE8%ZU=R7wR9i=5K)t>*a~b$~l;4yei9k$zc(yk+WG6UW+JKG%%0u)$31(Gc8FwQneGknQ=l56R&ev+yy;vxe8 zOe!4{uJHJ?i>t7ji@A#9*-P0QH91^rY-GE{siz6pOpPW+=;y(c^$!bmR5EK<6{Ic$ z(EuY=W&7NT9|qSUk8ziJXZX6f%cb9kTc-d3V>Fw}cnQ$3X);4|m(P*taNG)j2C&pS z01?_uX4M;>f`#~MF}RFwaUvT1yW+b#Q>!0p z${#z=RWy+4aQZ40^dx(jLtndf9IY8hyIE>CRVp?G#YDSXn7d5VN=g)TfO^R1;tZgS zQ%W*vt{#8U1EX>;?&~U+SUM!)#nYtGB30*?7AgQ~ORkZf|VQrj32PeFvCr zOJ`-f)GAV{^}f>%z^fW-F$Um>g>RWWrU+hVGr6Bdp%^NMaR-}$?L=eiLOusR(gtHp zrUZKaTrd;{=02soJgoV%rM!yiCJlbTn43b8ej{@GXFB&|HRQ1?+U}3sGq=aJEZqXH zDms4z2R$fb8&a(MX7tebbPc=186rl$#w<>(%{gG@=S{JD9&A@`=k=)|{hD4qN^kto zdg%%HME0KLwx;Xo0lvmIcYHOuBSY20X_b+|+1SP3cK#AtpH|hjBq!C`B5Z&T!1x9+9kWq>NBt(4VR-2%%^sQ>-a4cR z^vl*1s3OG*9&%^jKp&52XX-l6Oumgp2-EP>emogF4TsUd8b1$`>r@CCYaW-W|4OiJ z$o1WQ7x8t6X|;gvOWS5<|9crxtMT?uy|$EYIb9xf@k4P&3O)@=rs6xH5%A?R4&eje^}>*0ZL2OJI5A z`x~*EQYim8(Lh&emriEKRBBn$fYTR9^{*!ptwFDCPu%Qf4{)GdS@?BVFRbt@$>1-V z-i==joogh#Dncu~>{JC~UpC>2&D%0ths#S=6qaM7)n7I23nedPG}i&*y7Qc~DeQw{ov)M5fnQ#+Ej_)SRn|R3`a)GC!1(W+z(+Tf zo5TX$kNGKDz2`*DE%?)rCq}gDbm<}mx7g>Xz%@41GWs(sXaNSA#}RuTrgpZl_qQya zUx$sn`Fr%2Q=K&Y-uTEX;6R6Hk~imFbM*48W8r2XM)JD{RKt-UCKCuQmAOZrqfe_; zqYz^8x~ovJW~8+St!x+#05FH1ZuU0g_+dk|gTZ2S6F)1*pK}j@lgR zqa2yq92)39OJ7{KPDtRsaAX1H>!kl~U=_0jQM%uts;MKtPbK?G%XA zNC_{$qCoWEA@2Xq3N#^l@6Sd&^2857)hx2ofAK8;q6Y4{8={~=h!lm-h8>6f2p=Ng z0FZ*n3gy55vka)w{iT%YT+R-{4hoX~?+?TuT>vo@vV|Ui>VBsNW)1t7L)8wy;eL%q z`FYA?{H0yzB`K)};!_hPq{!r*TPCibFS+g*Ld@$dJDbZysh}k0=R4RD1QJT%t^)%0Fb~LAdt|rX%B$ZVnO4QYqhy@5P}u&eUrCp zEgJALX5G%1Y|gWs0Wb_J0YB87_B8{L9+$L~k{AO3GiDFN#+MF#3wr=J$|?ajRF&M| zBx}(xPwR`qyKwwmr8^r>OL(o-=!|Ir%EmMF#tdeFo_!KEDCmww1z4|&T11%qvGg{2 z$bf~7pV{vKKGg;kNw9}kEd>cdz#=+(;t3t28-YgRGv+`;%MN&@pMINA#d-=T*XN$5 z7<-N7%NZJZBZ+(Q^XXt04GY!K5zdG(0%!cOrAGtvaZQL-kLuH|~**jiNgqn9}pNH>( zbR4KT=4TxMq65*o{1qFRAqBdkz4Lc3O9xwSL@yo5mH|@$8iLPrZu7kk5va6Pb0Or! z)rLZvl5~24uHebAe0U|iseph@nzr>UEWmfQbsbi3IFww$t5Pe~FFA@6wzn@Vvcgll z^6e2DFjDep04+e^%=hn6ad%cYX6EGDNEoqu z&8-W*#rnuM7T6uU^}$_OT6r|1;sus4*MAqq+$9edi|pH+<(l9nMDvj<|DxjeJ_pEV z%Fb|`RAUSx)~u0Pg85}0Dao1uYF*HA$Hf)l^l(xMcYZYs@jSeZQ9RGo zGJ6L$HZk$MHB~#&irb4!ftmti%zoPW2VWsBj*!@>J1hGa-OXmqX1s4z6SROzK!vzn zrTq}z>xkH@SQ;8)C*($T5D1-TE4J4w9h*nKCKHEpKljf!!0K!!zX;J=nSaw8F%aCP z#6{SM45eE%H4sXAlijM};PhJHR8h`|oTz)g3WQFufhhn#03jXZKlZbpxOX$KgxFEI8%}80yC+B%sLIHk$#Z@wIcT4^|_>_z*y|uMzd!mepEVIikxdom7Qgs%ZVEOH}`n~GxjuV%moCT28rWXq}=kNBu= zpNG0PQ>q5MT=5J=e~j>@av4p)xs;sj7JOjDwjnt56>CQ;Uo88$c^4#fw!Gp58giqX zK#JCo){uL`K&s=|;g1RhU#33}^DMW%E|fLHk%bh1KKm-<!a-H?M@s0@f^1iw3z$I}M0HymsoxgXi4raE0|J zGwaA;90C!57GY&?n>ICnWHadZqusk!y1{2h(HT7cVasr@EoZuL=`}=usiJ*%r@hwy z)3hzMO7qj&y0RNKD6b6+ny?<&Bmb*)WG?b^9?WaAGd}rYlE97|VmH0DQh9gw?9aDo zLI)Go4O=>6dW#KXp(Z7p&I0?0$;?5^^Ikr04S#IR(5Z9)Kh7qZ#jwJrbp%=-&c zbbGgpvM7CmJ47~+d-o#yHG5ZkyViq-r(FuQ5k{*KiPLpmL0w;1S?{zR(Cn``dq z#swr-SmR09-ofWC?B}}scfiK~-p=BsVD*1K;2--fz{VI}0;NR~6&-Q7L!zM2Ke-rq z7&7`6tQv_NWd;Frz%jJL^6C#%qKt~iahev6MzTdmjKqIr5>H~3N1dFb@gT_-?Sbto z-y+Jq_0xek^4zM$b5ojoRS#8(H%>6Ot5P{5*{KKv}Dq!jLIMg;d-!94Q?ZMG$F zSTY{{r+8}f44YdsZfQ=7$T5N~kIhWBZzz7?G**d(pNe_3(*ZHln^0iu4IRKW`Km#sG^H3sG3Z4^XRj4ka2+ zmf{=$=9>3uWp5|}RAn`v>JwPi*v!brzbUl@yd>&3Z!L|i*5T6QM zs_b(q!M9o#wc1jHFIuP9H5h9fzzZ#MNillOliVosUqycvfAX4> ztu7EsxgZXlF)IZ_DKpc`(?iszZkZ&bTTT*A>4`!II3MC1TMS;~Ym|d-UAJArfSL8! z-WQr37zp~v`D|ASXG7g=n5QhQ^#`*p$nsty4NB z$XO7@v%w&kpEl`J8m+J9-pdW%xv$GKe$c#kRs_Cd&JL3<3z4poJQxctE6n^BDhz=@p$^*Smnvs*po-zzAGfLE?l!iOIGCN(Ni3& zNBs-+7yY;_UH0q3BGaLvA09H2M9xF)H^!v2_3Q?m7evb1u+W{!M+AIG?P-A9*&ou3 zVn=4DSTSP28*poHhq5_I4Riw89|pj96GFF4#{9oe-I#m=kG+%s5?*;H?Vev_K}4r6=-4B`BD6%H$FF5g4pTT%@o@O{#2O>~x%=uI8Ti ztag8TL=1iFsaMeYQ(jou*0zUrb%uvv2P1n}1<8rV2?EB3`yU`8A!m6x5sh6fU&1=~ zoH4^+JngeyUICy~1<%E9)GrM@BB^oM`Vse};Gxs2V6_F8AIVTMW6STRVDK|t6K#P| z-${kD2@|Zne^L><|6bSem#Hx2xfwo(d}3xrd1~b+g_OLw^|taq3@K|j3S&wy!Zn<@ zGyu^>9i8E!SBK+~+!$2g$E}bv1`r_pK>Bj54Jv6HC5R z84E8fgCEu@Pqy!3G5(WXI}F89yjPd@U#Wocl;>ygz4r*k-pN<8pn=8C8_NA#CSWEh ztr;^g+ry=c!%p8Q-$MT+>&^N$d?yw@V;@Vc>joDlBiFg}`;xev zhs)lUA1LJh339DvD;2kwKT3@#{mSh&0h1v>Q*>fSwX|HjnF{I`eCZ9RHe#id1;r8TAb zZrzr*ThWuSKv+1W)=Tp0>}wPNb1awzmROdD3SGvsNSfj%4Jj`D&E$*i=xI_@3jhVh~b z;)27A$!rwt0+dtYqdw!N2;r@VvR(orG)V$?EcqSy+l>tE7Q}?NnfbOufF038z!dt$;KXU&N1 zv)7Ymif)*bTrA9v*Jj$YduBrq>3-|H^vTO5uabw81+g8xdCL0}h0<4A+AW5^3E96d zEpOk=$}RKq!0C^_w`BJ^X2{eDxjhgcmHRu$ThjrYm-}R^Du&lJNu`%bZOt_Gmask8P zY9zSV=ZxTr)o|r-Yh8b8Ws2a3>`1;A^X1hYw~v2g({Hc1gu^XA$~rL*K5Rq`O* zUK2EHWYTR8%Qc}(u+SB^?G3v#{3e6$L^%;MFy2_}y42tyDE9>;$O7R?3u!#h4_ho| z9?U^M^280K)gtoWeZpxLD(E-~z-YYg-p29Kdo(e$Z#G@cDxVI@8GZuZqcOr`T;IHe zkrkJG?+O$6P9o_I4$&=HzNm>r28hi>JmBirzdeQKriYVbL7^L2&>pG%pb-g8f zB%gP~ipE%k_EhkUDDaxzsdr(o6^;?k5 z7#V5!4?36c7V@6GP4OkSA5|uEhNWFs3O1FokNjAo>I8J)B zQ+a=N>DsmOt7QM$;>rzOy~0=L`L^@a8@9+Lu#Li}i~*}Lo6pe30iy(8ev6OPYxn&2 zhI%)Mo@SIj9Jk8%cgl)N1M88GK$oTxH|d`BmP}8ALm%kz_W84{49GZ!0@AGg0?kHE zlr}Oy5Ig9$lX2-=&Nvez6H@Kz?2n40H=h2;ntsyqqno5>JyOLwCtoIC_+r^2YLo6# z%2vm8c~cn_05Pyn`WgYh%}1YHo<^&IYH61Fp(+*#%CalB^TT`#32iD97JknEHQpVa z+CkZ(Zg|_+J&&b4;hu#$5+;!gWMQz`M#>Mo5B5;CQp?fLdB@fv8vmJZxFDKLO_PR# zqECUqHaT8lO!?(pgGtJNfdaSX>U*U_lHXHX6}?{=w{^SirFB{??QN>}83=aCt)~f3 zUp;m|6s0IN?{2=v`;k#ztIt#+O(zBl5tUagszsMW$jCZT_t`tv+3e9$HEAP-j``Zz zr?9cBDtpY^3KwLDnK~9$7^Kv}s{6HNZPq_$kz<5Pi=sRQ6dS0m_drWLt4m?&@mhqm zZrmn%_gbCd3i=w^9fl0*4X~*=XHg9nc}tpN&2;k7s!7+eKGw@STs^4k!k2#8^z@=y z^UFi`(n0HuM28cb(gewn%^Pq=(ov1k%hurW47<>HNRN}PSLltBMHlVw(Pj!;V>{1a zM90Cy;F7Z^ff#dtkw**ndMag_4>y>Qx7I{#K)oAfh?r-QpGvV6Uvp8SPc!3n4Vm?B zKlh@e2}%#vBUl;U)fG)^gy&6PBdzX_)>|Xx7IL|R<=gJClfTp@kF9pd_VllzF%waB zv^RZx=AwA`EJl5ZT-`obHdAEo=jr&P1aK%vk&!dm%?|Ro)95ufp;R&HnO4Q1{U`vq z=I&a9l9ASZ;Huo+!e+pQbGQy#By>o2A8RH5P2_E7F%ed6@nOhqK zW4Rn}$hTeWs3L1iaf!m+t}S6AUgFH6O)vOz`Y8&%LbTYd(^q*F?uaDshgzG&ufEXZ zJo=4Uy~2Ud{G%nIC9(Ux+kw=J>7JhRirUW|IkF`#t!rW{%)T5Tm(!yOJ$|&Vv}zGcM{%<3x17woCw0Jv>V<$#l;Wm2-ScBcO?T z?`<7trSHRmwdRs4Wbh^*IAF)}%uRRrhUG~prdAvTH9a&`;VmVHW}%d-b~So(Gz^#k zX2P!wqsvozuJOLPho62N1vLKtDCwZ&`;S+?jY2%VDn2Q1@)SOXJZWmF$Wc~TU6$H7 zulyN(F?f30Jvr?UsgiZWr{WlhP93-2a2&Ok0mVzj1pq(H-xlO@I6FI+%y0}TouqM2 zt$Urdy;?vj{d|ZdPQ53IlN&HvOCnEdL9VgIf8SayI{g!iV)K`~u0!}0%HaI?E}OZ4 zY2_krjJMxFzb1VoS0RPE*j=r$2TY*Q1&<)Q$$J4@UD03bR$VJ`Yh#Hr;(B3b?YqY6Ue{w|o_ZyE{i^}p{dR5s0{+_rhY9^=UH6Kr9Qrzs zq{r!aa(vbYpNPqT>3fI931PvyeBd&8yAGqr3I)1VkES|9g|NuV zG@Gn_JFYj#Nijc+)x7(B?tYz`-i7lG-FZ`^{DVQ?tOQ!=2K)RV`r~-=(MUE$N`og4 zw66U^bJVV7zKuJ6eC^jKnkbpr2r2O4d?>cEiRIQJ?>Q!h$?9F#X_-HU=mNz;ejqk# z*IJo=ey(3K4t$z9K;K<(cJHP9o4e|W`8Q(KKrUQ+ISMZ3#{99aqe;bF>nJMUfL>xQ zk6Y`TuTtx((d+rmfHP_?MO_V7-yCE5L1A34Pkbu*QRV6YtvTzjvq z1ZwL99&YUNh$Bd0W?@Z4->NaR!6G zGXFxfzfld5K8+BwjO-)1Kd76#S?;oe=~|_ZXM09)BY2TD@43DNN5w~LvS<1wH;R*C z$&>6~KR>I8y%7N=f8ogV`wUgdjNA)!%wR?7C0$xU=}H)r=((1&N>GB+b8AUP0lPSrC?Fj0Urm!S6sP4Wt4ehHo^-Tj+^z;4U)MQ zs-=?W<{j?BP|)*7UKobH#^$rjmC||6a;t%gZG&v9 z|EjR*1Ib$V54}--uZL#mSh0;$EhC5NB8lAVpgDdah39-*#>tZG2QG>%hney2VX1+W z@=iDtvlY{j4?cbbsNyP2>=E>+-pyR^UT^sD)S&jhP1U6Y^04|hkk=->ba_o(!oe=Y zUJ*CDCUOWbz8KONAEtTrMBeP`qO)QRIG%1QXqbdo$eWME?BtHR+nvU^u6Vn#t>1Jw_1tE8&aq7DD_Zu{UlTy`+iE@5qQ4TJY-zX(CJOVrM$8c7(CWPoz^1Y z+!t`DEMjAV&S`f^E%nj(l=!G4v-Z}(^jSuY{KM*^B+CmSnttb57yZZ;txw)=)Fbgn zHXr7uSoBIHSF(%qqs}Y%Ub=kXo|s%R)%zgbztC6QKn!u0W2bk7ahtO5YAk0WOrJBMXIck5mr+io1zqudR4_O!($l^(m(dE{Tk%A6dPG@;c*)bRe=%g@>U)?4-O z71ZTz%JbSA&Qu9h@!mN#^0aKdix_@yc{s6MSe+W`@=ls(rX>bd6}Ff*!y(*c|FWcb zSvr{Kq_<1F>L@JR`E3)W3(Mpu&ksu)4b)I`Z^Z!Dgy)Un0qE^!PLZ^!j?;Yl<7IP` zm%OCA>PNoD!e+YA+}Kgp$5k;TketJX`t10RPK=$l+`PrYjG7ejR zTLP{idcU{)`grxP9}n?^(*L9X|3-kM=%2hu{?`EiXTm^(#K<6E{jdEQ{4+z`vWNow z`~W1pe{%Sf4G(!NF+svZ-2B;&nD|9R#FU4G2k=k&b0&#uT>ugu0Mnmk|FLC@{jZ~m zwQO-k|77x4t|Uf(Ihs5cV8{coZul!FCgw^50I`Bd|2~e15(IK3`mQWa2D$MT7lA~REOAdH60f}11HShm>v+A+k~=DLe~VR*i$|FI{Zp0;XHZoo(se%1=dD8cNI>c!d%)- zzhL-rQ>NY2e>XItyogz@!XQEePRdoB$~|exdtB5~vlDT0XH^L@s7Q?GRT5k7$|38Z zyb+(o`v#uFfLb$$sZZmze}6>A9~p`AS)l$ggWWPD3kb1yB?*4&49Bv;=*ZqOO!;!T zk|XZ;F6C>>DL?GH&u7>^dFl0zGLAqs{QS;cReH0q{;Jg5)kie?3XK69aW1tG$;%M` z=@^3T1GjBfK(Yuq|9!1T-{qdf4Q>^WPMIQ{noWBq;wo6xqCc!eddkkiB9p)=6dt~1 z7W~u)ADLV|71jkR7x(;iZPTyc>?)SsleEnEnD6p(l9k7lEZ&3kr$uKyeWvoe+=C=$ zUZj^Xt5bh_b}9S^H0Ft#K&)T{_nnGR)NQeqAoJQ- z9oaB}DA$g%V0G*JdNm%;ar3)~3K#t~h1Xtf+5^`54V5u$3Xsi}m(5;PiFdLpwJKyP zeIwb5G|z-Uog%p-bf}!svtG;JloP=4Rkb-w{Vg|5^V>dja~Y{x1_}K+0Y4@zZ%>Dz zj@~10zbsAck!6B+s`fpF*$J-tj)nuQ475^pZktx=Pv%alrAbaJ_i2WYf26NII<0^Q6svH;o=%# zkGR;_(Z6%3HTeA&J4qYr8JJZ+r`??V+XMC{Q;pC^B)l)hBs&Lna@A1DmBpcYF+dX5 zkA*H0^1J9Om0V2a=FhObDM6D8! zXCtfK&p&b)x36)_QaFeIKx^QoIF#90pLGz}bt`3} ze~71-HP>(>adnXQCs}{=2$6*@_I?Kg-Ia&7sK1N2b-gzto@L0ZziP-6J5Wc^FULTC+$dKec|7 z*7bv$g{af`CcBAtdh({S>VpDfdnkSej>q z6wdz}vGgBkbD&|~Dp>OY-*9Ea&F*a$W|DvWq>j}F(0;v|*}4Q8go%3CCjl>mS+pb|hrRI-c(2$LP7RY)m+ z#9k}w+FWHuGq#aGh^cx~0FRxxzQ=0FInRry$c{TM*+yc?a$;HLBa%VZ(;>;3zpNcqcG z&SzX8)Lh?r=$wXIue!hP#rGYa&DvIhqTWg!e8OvX0`$D zHhk5ht$yK#i(z=9qmlsMjX1q$PcJr`kG$*Q93#KK)uIYx*yo_zaCGgF3u4TnYU7S# zBF$zbYa=x`x@ry2WW~hD6BxQ*!-uKr6Ao@`IuT-V5sv`Jb=_xY&djeV0{1KJw_ow! z=6Y{Hpctm|b;+w=jYkG@1AvUFnr#egRj{~SlEd>TtGbp=Tax*nZ8Z{-ZTR55xR6SJ zOh$^4698|a0RT_|!h}h$iON-#B%<8wKJ>zXTls)SW>F2sU*rE@guA9g;W5l@o1LO$ z+yJ_Y`K4#CZ7ivWNo0JM$k{70*+hi%td<|~knvDf7*z8LHv%S!Yl@0S9a5uen%E3L z5&6nPYF=RgJ%Bw*qv2)zLlHjVVZOU}^}gOLHatAfOWDp#PPH+NY!DR_5fQabwPAkp zg~@>bx0h;dNwpHsee~8>+}E3o{2Ep`bnLd+t5pQ#hcwE2Sab(|?m-0R_iX`1(;dkC zS=iTC)BVyAEHyqWEF3-nG7E%WGpjs%je|scv!hRU!zzNs!`dMs4AD2<43vnkUIq#` ztY$X*z0<8_Vof*j;`bW($CJB5^`-kjVQV%efGnKt~&3Esr6!;ml425_7Zj zzKlnMhE!vv2`t(AKz?r@eSmnPb~SkV?pjAj`M6wz|7dRsb81sMFf(F^zAPRb=5mhE zA56c1(u@e3aU7|s=M#*qu-6|Q_QpvEF2;6c4Q?Xr09Mdqo_N|3^^f|@hQ&zbId*D( z8X}Q083JA==4crLNVN>fnQW+K+tLB)T)QI2roU4@vd3c~LW#?40;65@9Rds%yz`+z zxvVM;Uw&9$qP{AXla8$krpfrp?K(;p#(=&0mkOWCis-g*{yMasX3!w3NyX*Vs@V+I zrAY?RMF!`y1a$(VwfMPxI!5>|=U$%ki^s>+7aqpSYJDz)YpTe2JRUzxOLR>RkpCMv zGJR;XR3PdP3ivvA5#+w3O-;VdquJExC(pS;$L{v$fuO@UZ|-E64OV;?>`>nKo9#x^ z;aOqp(2rOCPi>-*b4L+W%5%YhA7#f%fR#(xwWr-k*%)jmf#{C?wC@H{xM=CQLez%X ze>*l=$H6fSYT3Td#^vKGe&m+EZI}r-j4FY&d^I~0_I#w2$OER13iRwo&n0eqkHbra zdZ%+%F>WuUS3Ad)Mv|nH?>7q~%0JX6iHPWWYT#>gnVOLEbNIv&JUVVL7nrP8TsMm;16`_tYw=JnBYyPF5P>QHHA}FW*oN zHP}hm4f0-vpO-$SxigOt=QpYCU~5?e+Gc(0IGORhasGMwS=>(nmMflN4|;Fq0_KJ1 zgp65;5Tk2~5<&Jx%VGt@2eruw2b1)B7Hg#&-s~PT;j1^(gU(o5w!72@yBX3)e|Wz# zS@#}#k_&l!-~Ubl|2Bayyuf}6TeV>8{}N*;dlV3s;rV%{kZF&zDW2K?A<>h}pXBzm zWPZw|SfN8B`w{`EVB?D`RZhWMR7iHj?I5!8(U_8!|dFR2`x zJBv1M#eK~te|%8;8>!`k=OT<}y1aipHwYEr{b6X}CPJrE``bgy2klHRFR#8`Uj7jy z_V@P`e_tQ_Tj%fBVKRby9` z1X~xpD@zngzX-837b8&CV@hx1bq7D&mP!@EcS~0p+^etFUh>4Q?rWI63JeDQ_+<&m z#|G>LzqvgI3_8&|(TQON6#wRgj zaK~u7)Et8aer7{KqT}m3)l3Puecr_zJpQD-c?taS%A>x#dM}r217UFmxuE{`g5*e@ zz>sf=tik%6R>Lc`dtO*Q0ro-dDPld}RdZ0Td&a2KVVv#8_jagn$kJla!CT5mRa6O!j zugX}47}VyaMNAn#jBDB$+y^BVzF~1_pY&!psNnAL89*ZKGT68e`<L!$`KxpiGVjaudx1*pkhGOf_oA*$$J_=k2f2O91elWK&Xvq zN$-FOx-Z^P3_s9vc#pbv4!yMIIR@%g#;@3PJJxdp=OK`&W13D6>{dDqab=^>*c9w? zfz+B7k=M0gm!*QKbM%JKPPOk!d$~8BQdWF#gWPw?TqswCL1aB-64ga|Dji#s-iXQ6 z;?y_{ef#{Ojokw68JJZw{04?SAHUgMh)iova#Hr%u#I$+co%N7f?4Wo*6tFbnvz&~ z>%i7=*X#&r9Mo18oeo1<+8QLBvS|zHPcJsrJOQiqR4%>kj8e;{Rx!gfEK3vKL24?FL`K;A+4lgLCx zOn>R}OJkUB!(PAr9r(aR$Jqw#g{gNJ_g-@MNc@kk+U&=*SmNtn~NL< zOU&tzVR*q-U+bNj4pAf2IzhJI&=H!yWgA{`BZVQrw~(XQn?aJNTstTi)g4ILT=3OO zS7(!>I>^+qljujJH_Y!)tnR9(y?)E_!Beg8paBYn#qKAfg+d$dH3EVss3NEsC}hic zK(m7h$1rMBK2UJoikfpK;BWBwZ^-Ky>l^iR^gZIgl&rt!#$8%u8-%ZG#;HYIO5^c5 zxi*H*ZTsnd<%j0gpPe@?lkum=jgpg){Gln-)@;{SQ09l8Q7L3|DHS9HG_s9emz7l~ zK(;WhM91F{FzmP=bwltyTvH6kMkB8OSexi(KLrI<o}CF8zNmoG4PKaa90~OxhKyOg^ z7xk9BDC#CYpyMq+|+-wk>b$kOPgVt>q1>S|ZLQZp%Ykia95Li4mtc<&+}*E1DZn-e&QM!Z87AG0*eLd49%nzhA~B?o>; zU&ZU0-j`~d{&2gd^f@eSQ7T+t%w1)ckzAi84r`PUTlZ?A1&)=V^j-^5mP$i zt_m_V+7#}#^*X&`Rw$G>mps(C)SNr*7^k24oo|G@U)E+oIjAY(YtT?hRzNfSeoAD1Z~lSL~_=4sIf**AjHuBm+Ns^(cFYyi%=l+r@!98BBV80>!LI z#E-_=wH8X+?Yc+>Je^6FL+(kkztv|6hZ^bO872m-y;)I#`MC-Q3r z`?Xk1vGN?=!PMx+TYd3#%QiB93T73E!KislJ7b*#Pj$fzBMjdCH(Y_ZuayR`4aiDn zaWbG$59Kdvt2>#Sh~}6my%N-M|J-Hg+Jp*D99sVnscs%NJ`Ir(JEW?Wa#)-$VjXci9Pc8MgtNBy6h$qRWr}p^1r!cVzn?)E4t<&oNV& zSy%I+53sC?h|{yostlW8sSt-q@6mOJ1>kZJ(T&g{`!rJUvcTOq&FEuCGDhx)stS!t zGEm&d#;G^g>&x{JkUU$VWX6eZhEmG{(xfsY| zKL*e;la0qpUyvM6lVk!SDp?h%v}1Qw{Bcy|IoNUPnAaE;TopIKvvZz zZqCRKm>8ydB~1AjX8*+#;Ew}%XmATtWX8?!DlsGvw`-{RkUao!M_2xp*?;jQY3=%_ zB#^RWMrP9S;g7+bRNAg~mE3Y9FJc*gY2Fsmp^3`4kg_Au|W zPFc2XG(q;!?jZ(@zs{iLAgdY<=Aw^tkAq0BZ>k zIF6j-zEOTQw6(^d9?A@H-rPh;hbz?dX)1tyqI&kEN)z#z%-J310G;b2ALpBXAJ@R}~_rkO|s2(=V6M=Pc86eqXS=Zvhh+sJE#F zWSF2O3opUZ^st^tjuhHC7`F-P8JG-#t3-Cx@?M!}&=gba&qxYx=}%7$d?N!HX3gtp zwfw|6JT|tvi6zq|HPv8XjQT^$?W%(9)Om=dpM**-m~0Y$ztTv2V=#=u?*41}oN@=1 zG25)4Wxa#I$1j@M_~Q~^iT6s!dVLeSL@KS(Pq~DKrz!PTtDI>Ufo+^%E;q3OK=9Mo z*|ok4Lrsg6cg~b>dPf@qVRwN?`$Ai?0gx8(1oRXf?o^uKex__UZ!@k};!h5cbn6_-Vxw^$B zF!Q(r-cg(L#bZg6DaGxy#>sh}heZb5MS2}&aGGGXGJVe+tN$pKH1J@XL1lWbBwxN; zF(j!pTWVBxz^|Shou-R?*feflbD!B>NP!jtxk6jxU)x~b0e4TUj0M#kq@3RrN}z}6 zapyhdAhMM-*SUeF>oZ%Mh|jDIEn8{%SlQJW!El_Tm2WqT+4#qVO#g#xWJ_-Nvg*TnM8lG!G%`8_jB;QlhbHH^|g6X-;S`!Y<>cpv3-(Z%Dm${EPlqxvPI{n>n z=tO)ta7X4*L49vrZ{#ArBG97*lL=J0nzqt&4xmbZhsjEsQ#Ga;b2xileUW75)B}{W zEVk|zYV524elEFt*6k1^pf`TBD`{S^idC;kEwix`e`2)NbR*PQau!bv=C`G%7`lms zHa%}}c$k@SFW$`Er?@(3dp!bIwNZE4knDs%HPmrQv5y&G2v+S4b7#K0VX7mHm&CC3 z+vb8sx)^9Z!k3(SSX#BdxpC&ozf%Rbq*tJ~&JhZOnXkNo=sWL4^&!Z*ai zJrqqpA*@ZR75ls6)duzY21Zxvvb^s(G`82buO6xI0astT%sci3oRMom>0esC-o~F+ zJ>0D+Myx=pwp{z|tyW~}?BjF63Tf!!+?E2cECuLrqO7Sh{(}2WWXbhc{NCEzKYHK( zfedC@DV!2y8yeggSaB;JJdJAU8Zo<8gOoy>lx1J`(NB-J_8Olk*6eTJD62&de7mu- zYOM<>4mFm~J4hfoy(h6oufu%JY3w^#M2B+!DU{T_c|+f)Z%JDI)K>JoINqOR@5TLT zMf17HmCU2NFrv}+Jh`iuS~mzQM2MojFYe>c=ooyttB1{0)FYmN4mKyM8z<1uU6{AIxJ4aQ&;L7wGiq54v=X)J!qYu5BBv zlvJYRR!`2%xHbpet<=K}a7opyO;2cnneM8Ea@4oT#a*guDC2MMo}Pn~=u^lb!8;Wj^$57DM>QY<-M72Gij)fP|>2MzxZ|URQ8%@l;AZsR{G|kC^^&2Zx^DTnm@9mp5wX z@pV>WSqvyFQ&JfW6XENQ`r2E~drLi^;zO5@&C<4@SyLkpZ`?T3<$q73kf*AO#&BD< z^M%o^vlz>s6zjbN=B0a0!10akhumoD4JM0!yp65x>Bej!riKar?0N^6={x?p0 z#)5oXVLTLy`B=DSdZ>=m7SPSt7Y6v#o|9j*$ejkGsfY^rJu0hKb9-e0D$Cz5B*&d* z24(Ez%1uV-+4E!f$+XCMZLOmvQyLl>2&`8WQFJctE_;g@ANGVHUS6BrWqj8U5h*)n zTY84noL<#r%NF?$lxxP57kFdX97njodpBp7P6hExKy0oyIr>F;}umgq`q?6RPnhga*s6>H8BdfF?ed! zYIbV^wHVtOqp1Ox*VNk6eOi3Y)pkE_5zV(m5$Eca;L;I;fu&@Ux>~(`PZAsT6Sy(r zp*b{1ey2aEkNhh|`D0lXGr>Slo>bdkx{`?`e0mFo_fm(&G0%-IWGIj6HEC*6*>Nph zH@0f~f?1m-1Q{eW90H*{HOZGZ=`b$JzP}l?oqSlD^Il3Ua=jfV91+*OhAft*eR=5a z*ptf5AO9pC1XI8nIydzXh92%n2AI6;5l6q^>4=P)^F@cR9^hf)O2sOMJ6bpR(tR7e zTi2PY+`E!`8@e{r2k;Hsh@M^L1T1j@fW0Km!woL)ZwFzSwkg+aAZ6cX|!KT5|^ylsxKMC5jnoJGFpW3y`yykTOSu<3rJ8>mD6#QTxb} ziO8k0;@mL=1C`( zawrcY!(#%A2ewlE5WuW{S~7*CJ}5Ah0)AOuyU*Vpf`OE>?aFZu0B-4H`RxZ(P{5*% z?(!BEl1iY2paGL8?kwllSh`^rEwvN*vABZo>^YY{QdLXvj}~vH9a&?Un(WciW5|wo z`_R>SK<{JR52?MvXreQy;%I_uf83O~GrT(pYq-e>U2K(DOT0X$pg@LwR{G*TYiAPb zEsmLk6g0Q5oz2b)!qm1A)6G*4jq>rioL-mQpBCFJxtXJHH?^rj$LFt3Y>gbauaW{s z;EQ1}QM__UhhzCL9DBii=JA&B?v_T>i$YYwA{c0xjB%f~kuQ|y&#|GKyA&!-TrOdo z31aw^W7zDzA-?9I`^pWF#xB}y0f+(!qYy%!PeX?qbkEEy%09W+tIDH|KKV+&jqP|| z%27_k>auTM5u?FxVdXT=+^!D+?rliWtVPIln7NzMhIc@%D4Iu0uCkiN6b&~d;C)`r zuayZ9%^xoN0yjLeBKiu3ch~%BLU{mOX&aM$9IEEnH=Q{GcKP;luBD46KnX9PxxRp= z;l=kkF|mOMx8*XvDtE=)m!OV=<9YN6&D;pyp)5 z9J9WA5{t^lkB(4x*A*wl0AC}t)S@Zkk}Rc~H8flXV0v`^G9cf3F&&R51STwfrRPS< z6qC+y!&^Ko2JzI5V=3}IkL;0bh^l&{K~)4mM1rb0poA}!W7xdTrL)Cvrmi^DnNzu~ zm#99Eo@#6G7sMW@9DSb@yBl>~Jo>zBHC8txv{Ue-C10p+Mglk23ww4d)Lw!=_eZ#9 zUWjbT{KW-rOnlPW`1Q}v-LjdjB!{(@PdMHP1A!(&p4wPaU#^k43vQjiz5DTOBs%OS z@L~r9Ui?Y1y?qbf`S3)>GY^}~c_4_Ry~5x4D}1DFH{4UgQ0x(WM(i_t&lH=>0^!5( z%}17|XFT>O&wc;V=`GY&PmEn)6`~bRJrAtUTyJ9Z53z5Yu5Bv=2Lk}yDBol(2%C#& z1pscc7iKuedAd$J1za(x+4~;=@X-+_10F_zh(pv85JA71G6?w0lT9GmWm7CH%{+>a zpBXLLyts+Ic`3RTq>XGZ&l%>vAV{1c33Gm0p|$B11bOi}47lJEe-79sWX?avxxc4a zVs2Qej3paV_8J(l)FDR+h#|Po27X=Xx~c@Yz5vi1y5a9-Lcf3xdY7*~1-_W(ID#FtHI-|RAFTui=YqFmHZ<(Ss zzmOAO*zZZ;XVb`%>$DCuh){g5>9N@{=Djn4Z9A3-5xe5?U}SA>Rqjh-=DxCY%=RX( za|4#;mfK4eOI8vvQAAuvY?~dZZ>QXs3R{Ev(qP4x9bwan**Dhp(RtZw>KM0}l&v2! zxQN*s(?3vKD&v3udHie;P6e*GY$8{ry0Dg$uhU94ZP*IXutxCTe`DF7i-WWY8#Wdj)u34pW655R|U0E zZB_lTOQE@5R1m)MV`e<|K24&ehm7gc#^@WzutKKea2Vw>689pDrLOxZAT_F%c^U0( z8s7_hMo-D`Arib&f2VmH(@fb4lS@~GmkzJ^2X5AA)V7_)GDZNX;+T8Pj^BZTJhFl> z0M=AOk}*q^1=os_2+&j;rg?+2^9>07yw;T6rkE}_nPj76`?yf&``PWl<_9(}qIjB9 z{m$9>BM@zB(%{C~SZ}g{Ytx}dG@{6CYPFa1JTLB6FBy1`;69dak&{h{$5A1o#fw-< zcW&iLiAe{n9^C7%mD_LJ9}yJIm81oV3!<7|M+!jNle`; zZ^`y7&!KX=b+&{rm2f0A;3k24VUJ+Psu_9p0v10`m4bRHjpT5=T@A#Z2{~;8;L9v@ zHLad746M{t>nRKfPYnox%{(;~2BDS0Cp-Z6p>f+GIb8mT<>Ud9m)$)a_9dfUUukK2 z`&!0V4udk46rA0Ibo5HdkNh#A!!=T*EBvJivUYHBYKqeK$QI)ipiA4ehA7ZwKTG~x z)Y`D&9auQXz-DZq%Kaxb)IZQ-wXL@*A=Vifh>95JE6wP2I)RewP*~YbU zq7*DyJ~hEdqmiKQy`3Sf-;Y*Uv3KX$cO=Hie1cZYw_!U2cmmN0C3&K-G}Vz2p30TQ z6*^2!>(?3@kV`kKa(#aflogbbvq}0UeYCXstW9`z(cUsZ+_f>>-tLArgi%J^0iBIC z2VEQ?)_P)R@(@#{sUI+|?#8TTjf1l!&Wp3vL9-wq$`qeVzz>@Ul4Zhloym0N>yPoB zid8L*d@^_~s97^YZv^lb8*qk`!!V2>{Fs9^JgrRdXES0~%r zGm^zXmxFCZYqK+zt!ML6E*_@h+Ol?RAFP>G%l3xP$TV(}dXM*tQxt1zO0$9or^lz( zR4%BbSFYa_=No{6C@JY|iZEhL?frej`=#EX=>mV#rghIvY7#Mj1?56m-&VqK)aOh7 zM4CMUZ4;a`7UYm)j0DTSC&>?-&|V2|l~1>UBi5Dtrq?o0W|nVk*qe-jX8@Lx&G5R_ zK*aAtdo6>sbKzP$fi!!2`0dA{WD6)FEt0@Sy!LD~tN&1uH=^0$%N+jba2EBXa0S)C6;o%lDi z0#a|e#qDlzUsd7QKFC&xI=4XG(c40vM{05mYXTr}7_~!YdA74dj$x!titM9_+jqRW z6)M-n#rRxCvsBT`U+N7w9bCG|>=AxYR^I+*GIvmaPMdxlJ-nWCkPk~?POJALV&jy! zR(Bb6PPIyq8BhQZ+ypHW*T^2DZx147CKO96e!8vWj}Uv2*razd_OayJqJ4Nf0_O!8 z+_8FL7E+7BL>XVckMIVYOuHOYUcxRoZz=Yspw>jcl}9U#7MDhI;NeQ`|+NPBpDgkYNzTTYPJf_{G0 zL1%uX$Qz@nZMq#{oSVxHAc+pR6RrVEUD${TpF0RU!VD~QJ#2pXAZXL`ykx|@WcztQ zR*-*`{46*3t(sz_!kvLjz5byKV(dM#CQMFXZzOpx-0^NJTt6JzFQrt0-`r*Z_3;Zi z4kq@>S+Bl(-RY$K8o6!)F-KM9^3&(0OR-7JUo#l6n7FTLouMcTy}rx8H8{RMg{;K|;_vd$Lu4iT1vPxq97~H# za$PUDQJc-#2={W5J>2Z9kjoQn2@*F#w>c4r$>dAJtyAl`O79!2I+%9Q`<-R{m9xW)ozw0Rn=vxJHTd~-&?5Z zh$^Bq4CypSo0$R?bMaLbqN5}U3lzeXiSIZ?1nd)svr4vQ_)Wd7M+;}0C`-YY^4!YP z@mS?vwmirXwl(}2?#wpXUlcXxk38{)M^6uhmG~QmLMU5c{t2nGvuO5XGN)q$eJ=a{ z1gAY<++K1&ai?HfWzi7 zPP=55!XmT2TdW;QMZoqGiFeGqy4^io2e?~s7hMw2)}U+Ol0e^dV!XE75lF9kxZ^07 z(@1G+)$L0N=q~?U^FrPYvR|N(O)?D4-?YY`ow3?hC@_l{@9>1coKXT(DxdBo4?K=( znNtUoL)rj}sj+UKjDYEvg z8Ws#{FOIA|Yj=$;=vklDYf{Kv3}5Hwh9yts^2KZC!K@d<(e}^#@5f(CXmfVw+tp@2 zXTW3KvYuu@cyf9bj>0+cSb1Y4A=Qb9)_i0<2a4SiJh*hR1>s)Ayfb$o@Us;f}r(MZnh zWg!TdZ9{5xzvP-L>Zm-F=XHMv=X^B8`p&!fknscdD?IhF<(LZ000IeRJ?0hC7xIAa zhCXa4I6_UH85`5ANwt|BKX^RUzrC8PT1n#B-x|uL3YK4q+f@@kgO_HVnbi-R!-pft zJTW~#9g(7MJc61dh>J+G?<*OlaxjpPd1!m~pb#=3_zQGojLVl_0A7nPX$$vVIzys` zpkqN20d`|A$lk-93O4{PlhacWS?j{H^NJ^e;~_7?_lqXDk-qh2SX9`_QhiHV)c%Mz zCADIr`%MD-?S=Rcbed#zyp;6p!sb;YnYXRaj(!qmz1y7a6~W;*cUENO>IgQr1;5NW z@;ZoHqUAzfjt(z1(NQ12Bw28wnBPk1o|jihw}*^lPPAlko4lhOMv=qA(6VQCWd*UF zg{LHb`0NOBUgywQ65m3WoHuop*5+G5oo!@h+Y&Jx{>Y$~bBuY$e22nGG7hu4VRhH* z`TgnHc~3shWPArlkH8w~atA&S&{Aht+7aMYs$g15%N4d3R0s>Z>r*4pvej|UCzgX~ zv{P`pOX0Qh8IoPh_yii?6n@x9oExPL=xoX4{2*c&X_Qy((+e4*}x| zF*q2CR_0B+EsO|}{SWx`FZc_vh9W>vSGI8H$IVCrxF7E7k8|inbjlWn?-HB-1)lS6 z>|BQjUIaDZY^AV6aI6w18jbhD?7%Ak3^yo(24Iy4rNNN<1AhTH#ZdSkOOeIJ+tjE}8|Dh?%RB6k>=Rly%ch#@#*epLPYe13tU6L9R!4G~6UWG13pN1*@2Evbg- ze27tl(9HyY6n^+476gLGGQ^V1BY*K3B#H$36Hs;jg{iIo2WZMtoaKCqA0c9&kBQMA zy*usxjko;^cH1PtU_h!&fXA*XCZ^>EMfZP#68t+j2q;>>23)n$imk)3AP^prz!h4u=?Nl zDt%1le+ni1PjSiK=lym5|9g_v;T!X{>c;YFNl|TJ*NC`cs1#b z(TWe=8GMX~sQv<7Bj;SY7huu*ioME&2nPAKp&A&?d62COZ$0rzt5U3| z(+#YL_CT-9*JYzR64d9`8@1>ca}?v4H&d%UUnAz5|E>}6&aQkPD?JaXuwJt z*OxPx_?!IZjd>jTE98J7X6qRNzTs7S&$|fq|MB(S;cUOr|1gT8lxnF`YQ)}&Sv8A_ zQKN#`HDc4+#AsEm(vsAOS({k3YlKoOW~;SH+FG>|q@;>^^7(y#&-IM!dL9@5B=LTq z`@YZp&g?X@J|=*}@S+f0-1GJ_1n@%Pb8Ju5rT zvdtEwCX#r&l?c~nmE>74Z4ihvA9VG8pHUMk)PWi000DPil`Ro|`MLj`iY$Lo)u~kP z1PiXwe|68_rf;sT6}kdN-Mi_*G|u>4XHcN#LjdH+VoYLJQiWA=?Bj2=ZsHw{y&cDK z_yRddvGm!of59Aw{gUiLit);Frd^<_bh&&=zdIJt4ryluZh)ni*}gam(1|<{Vxs=+ zp1MBOu}o#oGk-}#bkLa)ao2#UlM|4Er8*R36afP|vc2OF%G{#~dP^%q=FA?@dtCs; zNIX^q3j_sjhDJ`VTP;lxHhqq}P#AZoAdqeGemH)2su|RQIwp4Yh7lz<)gXD3f5`Sr zwqHC@56^pZKRZ?$q1g~_dCboUBPPofW^T57>d=p{hRB-P#Hh%o*4pv$V-E~rqkXoc z&Pi%0hCFjH@r2dgXZvUmG6}H?0?EFHM$Xy%4eD?U&FzPGd4yC60HqK*(M1252mUKc zTZH`ZX-x1}zYhmXCJK8??F@b?pFPa1Ypy!b-ca$Xo4rf@ouMm;1`NQ{yRurvj1I)I1o-_Y+JrQ)64!&$JP^Bg1&oQP`$Cb}itF5WYfo#Vx`b=(Zr0Pz zn1~L;t9xefKrf+EHVeZxqtgrK`2$J4bgeh+B$aWL0C{KD^J_R>lQmq&tzc!D_w$eE z*4%_)AvQLdeXeJtNVi$42OpWL`{S^Sg)>sSTY;D3R!2t;CerP@%U2`NZ*#t59~)(d zAY2o2ZUERHH2d7EV_K^vYY>o>SBX5Ksv()n!@V)*r(~kFvTfKp zNqZgspSD%k0|lpKYhVH1c`Zm;rJmTJ{_1bX{YdFI(d0d!#W~Cd zjQey2AEOpALK^1bBX{pon@a-2!ZcYU2j`x%*KDfrl6Gci7yky=h5p%TH+@1PR$z7j!bi0MZ2nrtWLx~@@r~p=a87mlTKLld#+SW*%T^;1vV^9OxeK; z=BK8x5;axh#he!|xYfZN?Y@=VbdA4YtE*v?6O+q+nbOtQl4{~>ixcBywoo-Q z1`0reC14|e8(!q~H*}01$Xdir?zUS6+GmzbrY%qOaaITE>+!;7QJ$h{vn-i=6fuy3 zCLPhlZe!7|uFf!5*^iE_R~zgL7A2cSKK?R=r?1C#bu~X~ta`Z58!mY#3=VrKXZXd! zvksduJEQ*S=_s~Kr|eclljY;TKg?LhkXOa)c`r$)btDZU?t82Fse1t9XG0SncvxW> zV!XR~XIDS9VR7hdZNE3K*E%TIW~208)vXBsa{eMsK`MSs4!gvly%7VvKY@UpSJ0-j zf6`YA6nhjowzF7_9AKmKZPI_GEu`oc{o(^(=~!3wj`V6IpIN0|1ulgrwr-L@5W;aoz5k`Hydj{8nlL~DHnK-Q+k(Z87 zOi&h+zeGJAMnA?sBey}-$BG_m@a_NRS65r$1iCNYV2&#jZB<96(uPxAWhU%d7MgUz z{d0RCaqRWnldr@5WK3QOl~!n#?wAfuE!&`QYMRyW`rip>{!)B6=el?~FmPY*Q=0P% zhg@KBq>S=ZS`jO2%FH3vh(7ftV0h6Yx)^JLrRk!Wt0pz z?>?#Ng*j$A%t0LakO+&gX7J89;(EJ?7obM9jq_500biDJ&#+2%biP=q`S;MAw>6h< zr^(6@CE|a|kVCF#H+%?aL25&&Bc~UJUOW1|M!7n^`sjovJ3XWg54>j@=Jq7l%x;*= z{zNv&{9V5AVqnPSmp?8)Utd5eSUj6)@|*N$nM^L8>o@Mm3GnZLd9STj##gK5ib?1Hn`vlwsWwW2Z#g>3t5YAAJFtIIEIB}kNyHbz)>@ANLD_(0)~S; z4C~c+Ki|KyJHCLE&61A*qK&bl-t5x01FCAFUF&`%zBUS}A--p;?lxB^p~m(&I_jqR z&&cdcc?B_V)Kx7E_})Wsr!=>& z?hxuTC5qhOK{sfNTd+}Ogmo~rOe1LyS|MHKB@qHy!C;ofuGaPp&ayZ+%0HNuCyD9b z$jhD!?rM7oaSr{Gtp%s=8Y3q%vU*rvfBcIHjum*JD9t;ne77d0PQ!*YO`MDWe3x?T zfR4#*9a^~U&vM6#x=;eUC(O0r?xST%$r6M^=4B>X9K=%6(my01wA^|T{UlnD!(<(f zZgp^|C>|0m%9ufv7W-Z8U<%rHRnsp-r9z-O+d5;^cTQh2P4X59;Pxc$tX- zCz#70`@~t42wSMBqx4=1Dg#nqI~|pnI@&2vV-{>Z{p5SYxhR@NycZLEcE!2Pt(;5 z_{U$yN)KDVri4VE#CZi-jkm~poqmL{!$?R4(0BC8I7LF&e0dNAb^ck`q~6_Sgy2FzNW-{vKmf$``yVw$K2^Hn&r;Qp2LSGU z3AHG1{KE~1ie$sP89VB?O3$x8t|1^mV$-W)PWSlB({{1h4@E3DF&~fK4Q`r8DiP&p zHxrWXSk$*Jo;JL>O0amKzfEGd%T{^Z0LO9A9>zq%9Fa>Mn9qGvCVI6FME@UGnt^$@ zJ2pKjHMq)_4PbpG4mV!E{fUr=m`o0vFX5XH5hil1o|lY|y4R-NXRbS>-R_xtY*hND zIg)8jeWm9|&iN<$UVrRfi^02as)hOdf=WmDTICD~vQ+ zN;-vDUAO9dxWpYv%t|k>Ru9UI3&_93qDPx|ZKE`@;y_d6FFn#eeEVvFt1`(jSdtdI)40^_ln}E>~ug#P5ksuEAp;GWZbgQxmVPZkClA; z@z-4Oxo7XAonQAd-9jnLcOhE7cI`*&``J(#@ZSEu!}*4~K~8 z!RxN{_|M`+9Q$pFb7EHZMIMU+r}4CB<=Kh#;nr8jc=)V4F3xJ?R zz;7Z0atroM2=}>ZOm9e3$-ldaay*8>OkvHyO_}XIh;dRb<<#mx2i**G)dmz&IKFki zA#_NRAc-0QdXEU()vo12Y*E75$j8KqYT5Rc`JL_qM(6(PVMBJ7jn`2At5ad4#2)zR z+}vwIz=FSc5QoXcUV+x}NbX12af*0O-! zi-G8_f6JGS;}S|_=83?Ka@T4@Xg8=FY2UE(>h2c=ObzzASfC>U)f~tC6(z z61e7(#JsVdn=iKR(sBm02kh1?}M8dpXJp_^=% zhn75ts667esKg~q6GD_9MUplf)XDhhqfhc_5Cg6GcYMYRKp4u5NYp{serUL4D&f9YiY?sKvB^pIi-idFqIX#DMt6>yN!p)VKb>{hXWJknnbkwZhxqJxcMMbG_QhZ^f#R!?0i7 zVsCG+(Bm^}%^~x#6r)yFPX^xSt;>hntRC)13x~dEn`Qj$TwWT8oEKcl!{K8M_m}dt z6l0Lf)g%^%|gEr<*mMNZ|iWFQPT7e=D5@?2`R+G?%dmH3W+bRi7QEEebX@IV z12J%LYL*30d$2jwp1m@2{SvfV#KK)}O{Gm1ayy*Zc9Q$x z`zel!g_ef3`<~CPGe3xTPoz~k))4)>wcg0wswJbY3JVc|IwKaViej9nN6K}Dyl=bI zR4hHU?K*J!R-&j~k~P7##L&c!O+y;3wANoVgcTK(l>uSS49^fjxSkjL|9VJS_POIF@1?n^*!qCOi+dLAf(E)Usw4o(`+eZQ3xC$On$zBtZl{^7QH8r*#8%_#<``8{imN3&vQiQ>lW>MX5np&qOwuCGypu90-(ixu8GJ|^h zgXXQTY{BJd3D^QVW_xM2f!G@m8x<0*|2V#{6kH>Vqb6?opkc$lXC>$e5aoqy?4J4B5qe6*vqft( zLByKCer4137F1NCWmayDe$skXkeKl}wSgF`I{P!9e0%>dVPK)IwNFfAKzH4$ii)qk zw)&9VSDCH&UMGC#4x#7Mbs&>F6-D7j3che%Gy6C*Sm5~q>nKY3G8s;K7O=SJSfWKm z9paZV_c#AdkHdZI?RN8OGH=X$qh6K;q%Eba=^Ns@Lgw44F1yHc?{i|VwBOuR>l{&K znns65i-9__6B9{%9YO5r?ZtO%&Jj9Q$@M3b-IF~Lk9o(74xA_|wMWFWi=cXq6VmF`r@|oBEn)%o4yTT2pt~)^&aYMb zvX#=zza8>v10g`o#3_?>nz?Efa7S~=+{>iRrec~sA)^(+B43wAVSISb(qdKA+TcVq zB`(!F*+m(O>1xqv$=ZeIIiBIpdzbygFzSEj$d317yO&9I(Z0D8u*D_xwif@D2|vx* z?pCa><#}wtJtAN1lAxVu8iy}Rl6y#A-%#5828{YmWL@{4h`&X$Yn|D(Nt^}ZqeN&M zFFfe+V<{NdkmD~L(14LyjW@5^K7u|>yNM^rWL}g$l&tyoXGB~!&t5EWJ}lWET}W=@lv9H{I^5}kaBqSR}e@ZpYMF7Bpt0PB*q;PL6+mFRm);bYgN}Mm(KT&G8azLYbMGl=sPOja$#4qGD=2cQDZtr9jvQ^z-+)K{_C}ko#$GEQ7-Vsx zgT46s{C$KKIQRa|e*6+9*fe*|fpD((bh3C%EwU#!_f5swas#fR)s|TQFnVGR-iuiY z3UKgtQbR7}=jN?w5EXx~oa0v3GSZmPjH1(EK&mH2!9{}t_gpCo7~tQ3!GJv6G5l-( zfA|m#D54-o`Tw+C{!&u4tq!{g)3Suf^M*)>mD?Sv|9Jxp`0rZdBT?+Ki$^;%MB^8W z_>jE(-rg8OZ_FIthm38~y9t@_4$8Gt;y}Y@7yT7K9f0x*v3K#Dl8-L8Xq{Q9l{N6_D4&4n% zh8`>W`|0IMp&M1FNYGdMQ10*fuO7SJa_*-jdz|lsI=@fPsC@V^B>&WV!sIKrV`F}J z?zS*?1a&>kC*Y<`iJPAEX13~BA$_+|RZ>z?_M<=%9B?^eQ*~qAfhFRtUQ_lY@5_O~t@2FrS#&V2Oxx;tIW_)a$%f+GI z^-c3@jja+x4{L`2BWSL&nk-kKbbsCWwy@8)6uDJ->VpwVdE#D#xQUGt9 z|Gi?Xydzfk{R_$ZH?qg5S#qbhjN(8DFxO}FJ2LVSA@KI{o;4hR+!844^}%IAQ2*sa z|1WoJ2Hv54b&QETf`8>d?ocB~h?f1oycGc!;^weqH?5>N^0>zmKD@_AI%KLV`jikY zqfx)Tw&uM9M-%6cJnm)Asm;h@JWaX@xYbV;tXJB$1`N^}v~n`0{3m{9UExUau032j zwmc$={NY|^Z?m-;(`U$M#&Fn&%`dq6xnZTFv|xg;4Pm~(WUIYqY`9d!uE{fgv=N#ruc*tpqp7<@jE(RTZM&e>f#$m z$30H6nfZ<_J)yaKvlBH-oxWaDiIc}p_ngA`9GP#r29or+dBe97JnfEd@0&QTK$f%X zkYkg(Svz4BEx5(WKwtL#pAueT8ISb$yms#jM%pUO7lU0Vb>c{2SpnHoyqi&%C-+J75vBsj->eLM89GcV zdghP0q-;`#C~_t5D5w4CGY}v>$D`?tqK~q5_08@H;MiyHbk4~-kA&CwJO0Q0Wr|d$ z#UR4jI2{SVBFVBOS`G*VVpBuu$idOzJ50>^^>sP3lfH}Tu{)wE;~_T5fOVbA~-P6Pg6>*EBJ}QmCcO( zN-`a%AZ4DJ>L~>iFqnN*vb;eRf<3*=hVMfC>_Ri78hM5snEJ+wqY|+G7E@{*Bl;?4 z-@6IeG{ijUChyJ_2QL!|(p=>)796BYpi*TCjBMHM~fn0@AcGNXapu)=b;tA;ty?Lg3!HPcx z>=q{e;1Yb-#~+sh5Ta)qp!maoPGNe2y3iz?l8(+}Pyys4cr-=1`D_7gtp-nW{rKd9 zQNUc$@IU*}Xr$XX@~_*-8ut9eToF)~B6_SIqu}!EEY=X4n&wOEEm#RK}#84I1rqt5XOVJ!{h`eQ)@!|f?@Dv`uo4Z}-1j!o9 zn&D68(q>?TQ9YyFkU`=d+T#pWR0I$`yXf-hCAXY?p9_pRBmIrq?=elsf;2aZ=HJDk znMx$krLR?%lkc7h^drn-9drtPO-9)*Sh&D%ixU>!c$#fLOWH!pIa{miwjih#(B9e)P z+ZU$46%EqfByyV)zE{at4qyxJ-v1ZJ^xu|1*Dx0Wfg_siCWBW1L9_#9hUx#(V*CU; zgkoCm8(JuQbbAn6C+NlE!mNXUh(#6rGbziGb1594zZ6nRGM^<~$nnFSO%jhNfU z(b}X_L2M`kI1#?~Q6PO>KFg-ImOP%>IYQ4N2^fFo&f(+-E>CAJxg%#RK@s%g->c*Q z_RdD65%6(|5qO_(3-Ari9q@Zz3G%{MchI23qi7ytYZUBfT#=9la{E%n;>z&~@G_0l zq{-~f?H zYjcmmD*qz<+EUQ9l;vP}PyzGUMHn%HKoSPATp~IpMhwG325B4?wkDP{RFm-2qazfG^1yJnvuUSiV_+K+r-N8h_=m07ep6}o z`A_-VHyr)Dyh)7g^Ep}(Y+C=t$3?|B4PHCd{QQxFGOyYY$W0X)%qJg7j;F+_Yfpjw ze-FZ*KA_C0;a90FirNlM2e*_37;sN%QGbS}^oe4z!i|($Q+a?DLu6)OvAigG%W68w z7zq+!NRGG3f@)=%H;IH;HIPpOb}wEOk%4X(ru?*;KP9NHSzP11W@aVD@jv$6*+p2B zb}x#Q5ArVVL~XQP@R0&|0zC%u*GQW~i<@t3?t7fY|9wU!L6LVuzpGyp0AQyE?4?pG zHxxx`q~6%3cqP5_%n>Zpy0})XC~o1ACEBIC$jw7mdhzrYS9+g3?pS|&WXW=UQU8+= zqg=H!miVVs-`wCipru@!{&9L--%5?o+?fXaY$kdqe5az5SwPLb>@HB``yg03VfR*k z7M6Yt(0#owej@cU$h{qyCo?Mbt63J>g}UpA4Gd;zcwnL074QG;a&VdPGfwC`hu3b# z@~N%WK)bugWUr97z~*}4pB8I7mE5SgPCc0kz)Qc~CU8it8`cj~yDEYdQ-Wq#y+v$r zJ{@x0@d*72GT@yw&W`9vXB@|JB}M06 z-adZ>{u&b%g0~Ia3wc_lpi#L^8$$i#yIOeLOXoIec(l(G z{|zf-rXl)p)=TJCT`neI`;e&}iWz>FWL%Xsp9hb&Uede%3!h&g`;cOa7OzMi`26@5xT&5?-#IQ%u zVOg4I{ly)aQ)o7NE@Yete6X@{($Ep6q>{I}IJb~LVK*l!<4)+RKQF``k(KxUmdE`5 za9qP4)N!19$1a%3A(nnG6m;aNsQzP0_SNu@in6*}-b(0CoekOC1=U~b$~MOeZ%T^) zu!LE>XW_nY!05hYWy^eNPY5{r>z4)Yba}?-br|mNp$3}V^XDN^vU7Pc2G=#(M!t*x zGT|N&xfybNf>LJ(|3;w8(*Mv)NR_a>6pxxqJ~OR0^$iA9A1jO(3gghZ$y;gQZ3nR1`0M>)3$@|HL6EnG zb6STzu2Ye`Q47I*7q)e^+TG@W1{GOVC(pW6PCif6Nm}{csW)fXB=r8byw}HN@dl18 zo&mwdy3ewF`1;1O0`SYWa$6+umU~Xk3vsLU0fSObso(oEh#EtA_jo&Zug;E1$vNdydbE>oLVLhEcheL&D>)ca_AW18(B`WU#U`~_N_2d+$I``_V zZ{Et%4vHcYOJ2rM`LYVT%VViSSIQpl)R!SL=^X4UHsuTvSOxLiX_+8oWZ_Y^ zA6IPMpzb=dxZrA3@7$QBsb$v&4o2Cu7sax6VTd?#GyJ4wg@gc$eq;w9NR%OSXWTM> zBfri?6IvItk2W#C{>O1Z8WcL55e*K@%aqSiJTbvz0hNIS?TpuE6T@27j$jT0lwd3q z0!aLy_y2F6DpH03%N*VAE!=3&t|rIyoY()Yu$(>1DxA9Giyxg_a0yZU;o-Qk!irq` zeN|LOzY*|zLR~Zw=r)u+tkUm$?CViL9*P9tI~cX_>i4QJ^ip6hbOwv|TDs?P92?EbQxia+dk1jUTftUiyTKs00qJT+Vak%Q>8N zbX^iO=cDuO%x>CW|7LoZT!+ux|Qy1s8Lo!MP9qUrkP7oOUQxsfni%Z2DtXi5EiGS&n2@0-8x z@s`L<&b(U9f>Wi`>n|DBjMP}8l6h^dPB{sWA+J9AJHm*0J2^W)-4h=~V$UwF37i6s zw!8wVt?A4kUuNWrXJ^x;hNPg;R1_$RmMn5ZU5K7(Y7})f4g3py7QS8dNqm3j>v@q# z1CEMHeecp4xx19w@|is4`&*Zy#;6H1?h&>%l4SbZt5EmJJu{^xZb|&cW{SOt)uRyc zo902Q@%ch_xqxp8?~yl(bHGXPcpzA9AR{UNN14gxdly&y+UO*FIj{M(jl9&i$STjY z1B(_dob8AnPVJ}f9OB2ISsP+jIw}mW==C5FEe<+}ch$u+N*^9?v&Y}q2GY#sZp|FW z-uW-m=MmAP-6)iZ$5ih=7bSG0z|N995z#jTJn2Wwc$y@C zb$Mf28PKO0xyU23$}mtaVj9~5$?_IXii^W)d9Li(ksU^g+IRoCxHW9C{n|Sbaj&f% z9HOU5dQU6D^zna;flys^pg;$rOBXS4e8aCW_)c{1(Z3?(-d2|5-9N;suu0V)5vwzs zer=9%CKp^P6uT(DReA~I@f0{6Yw*Kr&vN={wL;VTXbeI6tDvFKN=wGO@#~Bkvj~Oq zT_FD}%DeE{3aC8Y>?9C-dy5JadwyT^LjL{vnQb=bAIx2Sr*>z-nnl!@vy5{%yVGb!`e zBL0P1eer8GtV>Ii&%6OmSMa{^NIZ8O$>|vmX;98?O(@CZSD2WsvX9h z_4X1?JO2@jt{i+N?v8BY_tEG$N^EY)t1mGM*y=aY)_rdVWzKyC&T!96o~)W~DE$46 z>|p0@Q!Nf%5cmSvSt}|M*&=~}?vLXwucb0bK7U3LccmznOT0fU>e2W&wUh0kaffgU z+Koqvip0k2K`c4`XHf15#%|0bHbb&Sszkr2nb0=7Ea>*!%Vvk=%vs~?0r0Nwo2kVR z(&mII61D*Hrd7Xm<2sx6AVg4v;^!rl_`UXo81nBhAU66UCUOcN7K2B6z|}N0 zv6&nYGl&Zs9p5CA<=#}@!U<*344a$%(a~nisR0@*Rm7NJF`gunBF{(%#`uWwlHB{zSgHk_at55={fQ%}djD5_=3Lt)HbmbIhi+=**fIPLNgziO~ld*WsMTbOuOwpYre39@G24_k- zj9EKFot*u5;xY)a0&zbZiD)NosQnp62RC#eqAIPzS5om<{&PVMc+8((P>*lzrjqUW z%1jfA`X$hvMT%tsMjSP{-whq>;=OG-k_V-MhWW3>->TgdxG~;I zSngQ%D}Fx=oLj-4|%H8yGx2q>n3jRmBNAv z@g=kZ02-dzdENNtwv^rE^7@AgE0`ve<+fb6Wx!W1fL>KnoA%omf>=OmiM#Hg>rIfL zzWZoaQ<-~$d8#}rOGX6D+-L)A3|x1qH_8G@V+**W&PCU}`=NN~b!)r4^N2xCon5Tx4x-^(v@58ByWnKTXPu0)E2^}G(- z^Cn=HrV2J|V#-zmGM5Veo?!5zFjJ4O9X(c?82j1wx)p@{ejaWO0j6*VijX@12ny{V zBZiV@$fZDHQPs&n;|bz6vWt?8ps?@#Mh1efq4IZ{&_wk;56or*9*zru4{%dZO={GH z82t<2IT^EsA;2gLek+2MGat~c{&tn_TsX+$RXiSyTndx ziGCk%GP)tE?cmrA^{bQd5PJ=qg*dUnX^huOt!+YHea-QAFzm#re$Wn3b&i-g6x*}y zE?@Eq`(U=61t`XmYXvCHk9U>LNi~E|QkUpX=hbau~1w9@wucGM2A)}|sTzTo~K20mUF&z(DZ{PgL`>8A9KEsI5Tt+~LVY?CLN(LrFe0)yh-lDL-y<>)@KIKnH`UfK*S}pUl>^%_}POd*#U>16?Cqg&o*% zdtbN_t}J^#ezgb*n{uU=f+rNB1BZuKgrSPs&*Ypx@=#Gx)`yD6Q|>d{i}(wTJFM}% z^yWKUz09{+R)&_lI7Gt$|E*y3mdF~i5d5f8O)b+pg6N}8RF65uk>EJ~Ss2XCb;Clu1Xm=sGYh`k_S?1^ek0St99R9+;hA1^_Tn&Laxm*{j=>%Nu zOF9m+&c0Sz=b=_QRB<3Pc=pFcUAzFuhX{XsP;$LN$i2wXLLkFR#re6?#%4LQ%0WTo zSXA+I+a9%$H(SvaKew?I5{+Q3deC`} zItBf`&;%Sh5y=Z{V#NYn5~a7Ea{@R7|FN$0n7{&HDt$ z)zzP|6t#zczgep&U!(8!ATG3rZt>3%X@Z>Nde>NB-%`8X+6gYxi;s|?W8KEJ@qoMO z5x3M4v7rW=vs~=-30$chPxwFGpnU?+8W9m^r};i0_`lBNAm)I0BC%%uoZOvvH|Atv zM{}X5mADd4(6}vmEGcaTPWdq2ipoL9p=(pEuu>v0cO>~tbyhWT?J<(XtTAp{Cm6Nu z?^U-^WXf{)bb#cMNPxMWom^Vb9IbL0Om#tP#e?Y}&H|LlOFU3N*Nk52-9tQVn6@3s zD(7&1KSoAO+P^G~6Lp0!l7!jmZhu85y`>wBza6^B>5A4#W=u``ASOC1KR_ zQb2{OAgJM94W&M-8Hhs6v`fQ`nHiqBji;b%s2R}cTDN~&y+uW_nri2p2~bt*Ud-ui z1fio)r71cdOx}+k|7e!--@O_IQWt{cL|pY7%i5+BbQKnjB-&~v!e(5FK$C#0NTB{k z+n2v#iaw|3)tY#`*WG|Gp3T@Xpfkl+*V^=;mgTdih0&Y&Nkn`rtGQ zHGD#`gYq-ll_mlBmf!qF(Ji?yBB2#oYnQy2+IWfr3N3o8Cuzc8-)U)cx3^iPdM(dv z<1+Y^f0zT}%um4~O%9((?M}a9ez!%;Orb z3#BM6Vu-SG2Y&tWa{}ae+(zjLoba>iC>Ee^R}g`11^HC7vM8$u=k` z!c19tTJ92Wiiyt~zT;=k{;il`_L>jR=Q^BjJqdg@C1RZZk3WtQ0-({W)Oi_n*Eq+( zV&GaU69-4B87ZPdql5EgsYr-`@+mxqoKq#lNu$HeE|5f1O%1W4p(IHgw_;6q&YMl( zr|qZBL?`tN_|nxf_#W~3Gq9!rplF*-i<&Y7NRl|JAinkz(?~iNrRneSm)-BLAX>G9dpdjxD9pib(}sLq|mo2|K^zQPk6Z9`HA~0|7g^rAIzL zCxQ_%RPE;8>^#;mukr!j6xK_KI9aNy4CrkX$iwxIp>xbt_mj2TetYFB&bW1%)4BL$JXCCn_f;52WL z`_}Z2Mv9OuZY6CmTTaH#9>nF~<>9~nefBv+ElnuB;!4JIg>hyE$R!$jj)8O_;8Ta} zEl_Hj3_)w0A(g?u?11DVW;xxbDE8bVkKy$n$q4x z7i?A0Ro3k-!b8Xk&<}11YTSZ%Zan6b40Loco)j_3>skRJx*qP{6u`iO2?Zi~smWBs z@|*^1AfS}Nz>vy!U0ngD@oa&(`8J*TlriJcA)xCO_rd5W2D9td0H}TAAG9xrOze8m*SnkUCXYeeAAj}V z{?hj!EBgCPqo9^#(DlpeF|nnC-Nx2Zu##4};J0?gYc&q!&F866dkDE+ngcqu#-R`qhPl(N(P-u;8 zi{q6o3t!AvyN%n6A0uY-2-j)-t=tQ%CBFqb)o7JU$=pzKzmgH3ss^)0ilWpDsh0+e zu9OA(Bt-RCk3cIM8B5+DFD|$suD7)mPbmj9+zNu$_C0rQ4C%UiZk-9e>STzq;zhS+ z(nIPdun($d0Fod6KL7NCWh1dw_lnq^M@F9*=n-$1PcG$IPlgaH?;^nJ4u6SolNC`g z(#%Z&FzKz@j77Df(LE1aM=G4D2B#NoiwWS2`{UR(WIJTvyos>arEFWxX-Rdft;R*L z2`qIIbF!q$vodX*Q3Q<4HZ(UZ2TAuEppzii<e97yDnEjhG*Gu<9)7`AddWlv69}+EO5xL63?)@|$n}bs+p6=B9_z zPq45hvnz+WL^|cdb%5R1+f_V_>4YTS z`SAoTky27^IcxVa%&-5g^`m+p&XITHcAVIpcd1m@Ufuwwlrrd03SI`OsNz*(%v;P~ z&|VrTW?&N-t;@0WTu8=XMK!uluf9Ir`AZW`or#5aB3y8HQ8SEG&XwI%NlDrAjdVqH3BxmSkMwhqRw2z3Q8V=Lx>dh{^A zcEGrmi|Np#a@`E#tsZ;&Oh85oyI~nvKB8`0TV&3*pOOvF`C@G)Z-#4ctvFmto2~Zh zCPfSmdlcw9!uJIe5HHu1!u5uYf6;3t{X2}+1;meC_dZK&C z5!Z)5SDb8u{JQJy!mxA737*+lf6@ad#Z#d{@hVe881GYsyW+ptc!H>fVJjuoMO5D|Go4)01+&)eE1 z>>?G~;LFy-(!EzED3ryWA-_>Jo?|1MnM$4#t5{ZD335yo%2=EBFv z{}@v#F&iYzHt-(JdDo<&B`wTdO43R_>s&I($yC$|5Awgrv3$#n&)R=*MD19tlXNY` z`GcI?pm|EX{ZqMkT^c5IpB@F?56QQX-hnFPcP7rIS>G2|WD8a~o_S0|3ZWn>MwaW-`rP9!|X+vzp1gj)WV;LTg-V66| z`VCWzK%O)!lik;6<)XCt)I=AUHJ@{6n^7XJk5ZJVL$oyIKt8JB;V~wpBI{A>%|ZB4 z&DYb|+9H(bpTYQeX9i|Eh7$Bg2E9~QcHJkGG9@O7Dn-gFh%q3^_?|1VY5J_+9Mlf^ z_Q~CB8k!jy$thxJO0f!M;!|b9?Ay}xXQerKycOwQ0MhBj-?j|g5>udZi|YtLSu0%x zq22_Z)czmry?0bo&D%B_s(`3iKmkF(07~yjQ@VsEA_={BLO^QhB2^F&La#~{6MBmf zf}#}Zy@U{uE(8cg2!i;W_`K^q=ltHa&bQY2=R5zL0oLp?_w3D-J@?#m&2{UO1>LXq zatq;IS7Z8M-MO$YLTR^hauIeEos`vt1(J9ojyffu8j9o3xv(9dHtVz>J=M@0lLbG%uqU29{m5zQ_n#|8 zVZVo?F9Pf279F6F2HUyv-rGxG;}wPeu;*==G+f1;YmU4;(9BKo5YFSBL(tt z48x&=+5!We=6c_KJC>ba2@Ne3zlo;MuC#bv^MB(5uQ<%osK80*m*H}pg$=q^n7bA$p)c`y3le#ZO97J`Rzzzd>U;Y0=JJL2D-0JZT|gl*-}?Y|*Ueiv%hNGc zy)8D}64uR;&)^ zSFdXYTBQ;iCCUj4zADo-0o1&lc$uATuEvbP`3FFH{pctMg`5O-guWUh8$IoINxu4{PM#}41Q4Q%}4*L!z@V8X6)yjeOzBr?=f!ON_5RcC*H>mTmw5wJV@JD{&z z?D}^wT`FF-wU&E~Ku6cA&WLnO^dX_yW%c(=_^}Rz}tmX>Uw#76~j4un_O3dj9 ze&!X&T%aAR9@a5RDjulc%irhFs{ME?Eo^>hLl%#m+?XOi44>ORK4ah2wjQx|CUQ<0 zH0lj>m~6}-s%v$BPS*#Atu8KDM!b4#tJK`O&eEZdtl98iAx~wRXKQRd==ya|bwU?y zReyK@6Zxnx(R(CR+mg0CWDTjGT@Yxd91nZ@f)s|mQ28-5!MPV*>M02Zdt6*qLfWPXBcam4 zZ~PXfW-1O;y``nZCFVZ>Q}d-MBrfLIp)v%BLIg#&_*Gj(UR0RcEjT_~Xqx;Wl0|oK zE&ttX`pb_uGV&{4-v)-a1-qh^_av#!Z>r6iRDSr-DPqnKahCshd^T0{qYzIB(6x7& z;!gvw8&!<9m%Gvj@jT7aVqh36rHd>#(;T0nPbgj3Yv39M?b@{mc51J*KuywbD+mq9 zr_UCQ)?8?LhF15ObQm;PI8MU!o0V8*R!tEgqD1^w$})Q+#2exJg~OA~^5bd$!CevZ z+9y9=DfLs9-_Z==wIS0G-7=&@_b<#>$1Nb4UhoD$mvL2 zO60ncc{!g^j`A8wBDXY5UVUMqpvmb6jR0UH<{oAdhpy;}BC+fTYhJ>Bxuz+a1uubV z45~;ur=HGkdM(P2&YY#HoEf3hOO7SxUs^QY#sURb>)QZEK|h3{Aqe=Acc6eK`vKsx z&#<8(HRS}5wo)+cyKGp=Lm4(@jd`f*Re3rAKi*OGGaH!zSn1UJVD$Hd08A9*I_C`l zHAE=t^UKThNIV7Get0naR`5yVf%L{(2)2LtoO$>>Ac7pPFf`@&qDNIeH?;-InU64x zn08UhEjZdDn!;7Kht^d_LQQS*`>5InzqNn$Ekme#Qnac`-rUIYuB`w^UYNS19|Jy^qoq2Y zt7>&)Il(k6nocXJG^rd9kk{VP(%^0=M2H>^?+PKo>pWCjkyQPlC&IJ6Q)Ipks|NPn z{*dC2?*O$6=-p6nk)L7VwIiaqoo2Da@m;RA(G)vHd9O+@5+d1USrOjLE(~Th=_X7O zzMJ}ab;<=^NLauAoo z4PlnTYseq-biM+)Pn#q&#O}s#;W5m$r+b2VXFw-6?CJ-y=GR0tG8tLcrQn;u1KLV$ zG6CyZ_@$4iF9)Ummcs=h^drE!0trY`6CyS z2llzRetl@pHo}r<5cUi71>AJ5&wD^1}BUCd3^dr z|IeQy$E(pv42gd=2Fijg%OwiDy~gPr$ULO$xBhtGE*C`lb zfu5I|2T9puO$l8?e?|gcydN=$Cv7i|;os*s0#=c(u^UGv^V#G88OE^QFsPf#c_Jx_=e`G=mhOI9F5gcan zzuvbz9AWSxA7N$x7#WH1u<$S_9KSGK>^vtgQAi+K6Y0(lS`|#)n_0-VvA-o4E)lFU ztB01n<%VpscYigL^@gh9w|*QAtQsLyl(irATrxycBE)+N+1DS#4}v=Lksmn*WA|Hh5YKa5^fX8w>>1 z{nKQ3e)vQx9=0ZN^eH}bzu<(y%>@oK1~foh3$xuIQcxxHiBOuL&lFw zV88vEBH3G@FYD(-+tH-J0RbZ~-v}=fAo+!)xA?E_BCbcfTjyM-5uGIf8KZ{FHImjB zcxTZ3Z_E{Kl3F=$Bf8tRa~1sx8x$WWzxQeCU)aPZjP`@3VU-48ot6erjbTU9v}qc z0u~i7p=|&`HwpPxT!mkS_7crQ5xYxHif87NP`Dwq#aimi@H_3Fx!(d;jWrO;{4 zj?&NQtL5#R3SS!%te_K35taBJM!DZDN z7&TYdb(~R$IeH|z{DmAVr(ox4W2M!;WuT%|k*kmyI_kHx5<2bs$r%+o;5d&*H*aB5 z*8ePqe}X3t1j~sCig+EhRm^7UHIupSs{2v}tPCX2ZpdQVKb9vpupqUho2O8M+0Uf! zEw>7J;RP~0prXqaqX>TqYA+^bUGr;?uRdl0&_v3cKNsi&fkwBo=>h4`H`lhHUYecg zXI^@iAAtEfsle6s8G}|4wl%p{*uaH_YY;%u)QEh1x@bPwedy;I4O8{n zYfTvil=&?bV448T_qsF#>=l2A^{b0vR-+4v<$Z4Y>V^(|qChtdvg);2zn+}+P`3P~ z7YP#^kzwvzzm?WL(~XaW;*P_b^$D~0Bzn0w`41XCoc~OxINVEh$$0tm1Vws)tO@PN z%}sw3O2JkXr6NF|;gTSr^ySbAh1^UqLg#`s#cv<7J{O^~UAVn=0ODdbp|k|V^Z$&e zDXO`&&3MP~VX)x#l6f}a5N7n`ZJfw2GH`Pvwr2fTh(K|H8E6lI045Z%G3GPAHpnNVUq6P&JtITJ7x7Gx3owqdF!bA2MLGVQ52WEY8l`)K~Q4f)+qj(7{@9y=YjBod0_ZQ;fI2U;T>f zrHt$vzp^^v7}xBt!>*R_u*#um{E*ma`nv)x*T=lIdBk}o%r*4aVd!BY>8(rxUlh zD{mKCcTencTqFT3004u*@3TYPQfP#w>&T1hKee^>DpA8Ao= zYTUA4|C#r}VA+02=?(Xb+H@A?K4~5nz^koKy}vBTCXYJLf>2Qxhv`6r2&loEP(19E zg^Gu_1@HYrblPJ?F|R6z6z=oj!9^X;?q6bI0o=l4igtgWlMZ_$NZd+)NJHRoSq)VHHNV!IKG)Sj{f2g@ zfxGvoC9$Vxi*3DYgQ@oXIt+j-i&!{$B;_AJ!ujHqcffA|!2U45(4%pPJ5$tI8}z)$ zDaHIlMcEmoTHv(^GZk0J!&CAv@?z~<%;rijx6+dLXBJv-*m_mgp8;4~!q8wGlYQpf zTc?f2<{cDe1zi-p*u#@L1bPXenh94qeY?;e;8$DJ4qrJO`NVnx0PyC2RX&>X%IrBD z_W09^UZORScv(VAOGoV8B}8mI3M18iQhDS>vb_ki_Go15aPZ4n5j9xhO`#mTTAk3nkM82+}`}SuPB!h zBF}hV-Xt+@hR;1!0HI;u;%y#~BmC*g?JZKv8o;dH`Y``GKewN})r3EyIW^P}hvTmtg@L&E`ra<#WNtNR_NUx3jBx!u)b{< z%7j$G(x_K( z4phau?Kox2FPP-o7!DQoYbAIqT^u+=T4K?h`~1Yh^zl&a?xB3q!WJp4T9K7^A8Q%z zxgb5!Qu}y32;r2+GxO zfNcCgsPb=3`~OG$uQ6nS^xVrYz-qyXvIIJ~9W7JB;Np8W1%@l7OG^-?gO6RDC~}7J z(lDE1U&+2+HuqP6?Vk+CmO%hVM`yxA7NIm1RVm+?UeU)?})6r>=)=O1`D~V6e zEoZ2hE@8J-_=$}~(~&D0eu1ODA&-6b`wv?$a2>3ey6cF@F5+x~8*pV>u2|rVfmqld zG%axVc;U>h>YQMP6}D%jz70sR=^3&MIJe+=6BxO{s^6$`oD$j8b?E^vw#xjk?n9mC zC#8&}rTXKX`ssD(+iE`g%UTO<73y=&iCwWz*I)wB8w%JC)xmOA`?$2mY11excVHut z7!Qgu9zZc?JfQJHTP4oihw(SzJo^wEeCx&_=sQ3{wB0DbCn?!4-}(}?z^|ZnX-P9x zS#AI4&s!`Hg#NsFA;-$h`m+@(j{jTYj+Bv2`qLNY@mKQ9!=YHPskQ##*Q%in$`%Pq zw^Y16_!KC8!S8MqGJ)svx(h{jag=&oCZ!T{ecawp7dA;j9-jxGu$>z8>=HBG{N;4XpDl|@oYv#+bbX@cJ< zPr$*!UU9{x>g0*Aiu9MthG0hB2odIN^RkoB3#n_D&6lT4Glb$e`nA~wa=R+vZ?2{5 zrwTk5SylWMq&%8dSn4ml=5>T?FfuG$P{hjSwW(kT!DaD}p%q`7 zzfUg(EHg1`XNxRg;47K|0ayx8dhMWt+x<#vMoMW34lsn8ePzG(du{u-fWA2iAiPIK z727g&zLGh#yM8o<+4{ATces2sHB(EVY|fE~@1^TM1yJTqe`WVNp(ktqT-ki=-uA~y zuAsx}*G#R=LkMaQKxN=rL!j_?{RSV{SO1?DBgikeH<)rQMTGEGKNdpdwer4g7&aYW1R>ACU%GO%j#hTWA z;$V9Sx%Y^G#zCqj-RL-E|&gIZ-Kk272PxqKBbpr@{NnVH7$r{>6w|tHYY=2*`EzNa~he za}{zmeSY6a9ivbkkrsF|H{Bd|uzq-SCZ(fGp(H|RoZN|ruh~;?xctVnh>)Efmbxl6Y@~f0`wq=huwjuV_%DMbp|D^vGg_bKqG@b z@`DhoH-iYDm?I2Tmzv z_tUMbzQYT%UKz^Kvrt89Kf5c;Eg1t`1`6a-lpqFTp0m7ZJO{~UHc3W9ns>U#a94In z@S3}fY};{b*A(-`EE$ID_QEsV`QsQd4Y~YQxqCYfgtbjVIStwmI8gSDoxUzx%H6T& zt4xT>`+&e^FY8{1Y02{UvfjdkF=EVT#rvsuZ%2JwP4zK@w2H}1ZrrP;^DB5h)nAY% z%>b16!k)mMgVeaWv9VNtPVQ3{{?c1_3Cly}2EZ8BTF*P2#y;hGzZ(rA`%g`W?%IkGiD%Kt2kjeP2asj-@y`%H zrEmffi>cmfRv6K001@GoD@uf27n5p3iu-X&;E(?tb0J(M!+V!M1Eh{W5%4zG$OgWPP8B-#Z>@ikL0$%%4u6L0;|6@z zhf8S3YrXRPuk}EpjWK+q_~^RtIFVj9m^;U|i>X8VSH1i5T`g5J_r2m4D6W69N}Zf1 z<^4Sqw~Ogs8bZZZz=ctf?|AoA&pItkE%nj!Cpl9`A6lBZAQe|Fh3;ln{GPUn!|HTd zsaT4=7RvAzmqVE{;hAz4-s8ik;(!6@QJKq$ZSY%w-SNA=kpU2$yPb(N#wz|I7lZ8~ zYRv)YZaE5mZi*x?i-n6o38Pz(He$T-GIdSN&=)Tqkl={D(h&Tq+-`8LQQs>$zqsk> z4yz3@4?w!LFi1!WFOl|4rhl;e)~LXBQ6GQV(MtiM&jknulW2)qpcTO%)~e@{4lPh9 zn|vLeIefc$nB!f82Q$Yd`gcqktIMOXXtOgmXpiFlnO1>oH+qw`$WgFOgaSGazK{z(4c9qZl8xUW=tM8h+ZCDpzY6e54IkVxiTR&4N z7289pXMp%!2V_j-%_1@qwQx8}hRgPe>7~_!)&G9*9Vxf|YD0e${>v@|l768uhT1+% zv&H4s#cU{1{8R~=6E5S7`y~m1Qh1!R4o&^wI&2EfaqKNbhP5O>thHz@+C?BbK~i#h|m#= zfzXLTM~9a8WlRhOcSM;~WRDCS9)|D52bmvWez}mG&M)!+%H;+99<^GdOt1^sf8e$~ zIhwkvYEk>=Gb9rF_?(mAUHFOcFzB~8j{R*hWf}n#n*3ewp6ETFmKFH>Y~t|6BhEJ{ zhnTKd7M`d(GqnrYGkB=gMj>(J#oO@EquqUC1(x)gg(ZEeF@O2Bx0M$-yqdf*QW(*p zAEQHAg#@NjY?ooB?8kr3^D%urteDV;V#Hecbrx0kVHj4_rdn>|ZM%~Iqm&K{z@Vj% zL^x5x5Uz{MSh9am#Qgr5`&}6T2nxHWMwN$$HHWR)Hjw3OeD~)!7elR&hRlP`2sWXg zXkT%#02owx0G_)O8yla(LK{bhFlXyiPh^q5RjDY{2xR9lk4;O`3#G+ZeY85CfjnX) zf;V_$)+?&Da_a4D&y@(^-%p0l&7PT-lc^!hqA?#0j}A46fAoxu|7A{!l{}F|i;D-y zlDeWOLmKR@kgHj)b#O}6O7P|1DVPJ$+OJ>mlb)wQ0D_7d!1bf}r{%yUzdMMSNkaKY zRtL5)LF~y%B;cyF>A^y_W$=3I^!$v+ip`O?P4nS~4QWv33*EnJ&eq03)K zzAU9;zqTf&vw={#0t*{HZ=MAXW`pozYpE57Img@c*;a_FE}Hq7%;t_xRWvnDJFDBc zSG!D`3B|enj$uB`Xdn5?yp|~g{n&EmRtlorMqX+)2ROk$m>|K9!1e|@Vzv6>-auo= z;cU4$g%q7Myhvk8Yub9DxY;2$!m^Z8ntNfgFOPPYz=ar&6+?%54af9}i5Vk78P2&N zNv(R(gbcoqEh~n84lAa&=CkI#eAj$(C3CJufzob$jA4FB7i)Opx`6$~i1#x13~Waa zI|cVljV)BUM?&JL|L`>KoOXNx)nFErN3m_d3}j*t{n^*A(5-A^Cf4HHa{~i}0py^0 zuB-NDewOp6^`EBEC_ZGnLN%6DwhD3c_LG6wTW8bZZmy*{ok20PP#2#xj(L%H(){6I z+1EuKhKF;li{VnzrY8Cr64dx^ST%|NFxc{Jg0h8wXtfQ|yznr;+6(=#;1n8Ob!O>3 zf9f2L8iE>FZTQV?goeE}fe9)pVKP&^WsmhJ*twchq5@>vaHDtplg(ksTiYp>BNYX! zkygQ(fqe4(!dXY-UpCUejrA|9F6CqQFLf?u*FR;xfL&jAHXz{(HvS#x?tcBwN7I-c zFdHh(jyRNZS7ZE78PyBevfW+sxUBcq-h~C8C@S(xrpmDJFR@9W6lh3SH z$d>tQXsxetEVLD^U9BJI{DI3xuZl|Y)N53|!ipettCv)lJUtINZFNLZQ$i6rSM?puU@pR(} z(3<6tjbv^$)GEyc#rLsmI9sj6@tTvi`*U#PP5$nFWP@qHl>xA#TyCH>B=0*j@C`tX zTfKXBDXNQ_nZvv>-px_@P^>ZZ_^^O70dsM&U)sCVwX=JhNGUel8wwSUjf=rOUP>YV zB{-%Ob$T}wlH$g*)&hgkAMx|ELaY}3KUN00Z2G+aQ`^HwBAgT4mmI9`Ae*j2wvusd z*vD8GWQqIxC+Ury@lQ}0L;S#HqaBhFq9|zYOVzr5?y(HnwZo=uLCjsyYd7XZy6KyW zFK+pFVJ z>1gY~pA#)d@|c>P_E)>9EVDpaMmi%kXIB4%svrGq+e((jwvj^VnI~O?pWmrcjbwlF zJzGCHBWw{j-gfMsAFV9DVYQ6}2-LK`aJJ3EHb+e7uWTsQ?(EA*s(%KkG5`Q5Gl+?IXM7WdMytP;2v!t)*A3H94F#1U*z0U>QW-qx}qkndZ)9KeSc(b56#L z49(aC6T4f`IG8R71%sX4=jo)jn4L?Vn`$7RW!tu(H_NAM9?9+c)Yu%YK=#ipj!sF# z9d&7WvA77rufke)GJ%W@#aGRvx@Qoy#8gG-fNX@mbjE z;i6!(NeeQ^iNTHvz(Dolh49dCz2hex@K5NLlcSZ|ER^Z%Ls}Nm>L+409e&p4H93Ac zX!(&l!4bcDYyS9B=cHBeIZ>9*irSSsg0bO4!PU~J8S@#H;pQJSZ(fTcTc%p3vT%Si z5GnV%Pu@7(6>jb5(|z`7W+X>SqECuN3s^x7(9pW0d~`_KCD)w4f1}hZ_(E9)9*86MaM}D%crgIGw^+{I}S(x<} zWjAWTb8Q2P8`97`SFwoJit~-^H(jYZeW@%6MxL^cjSS(6|w(rzsew+#rMp@_sQA#+s zikZgjwDDNs7HBl?oVdG;JyVMxS~x#i-tt~)qboXMY&RhFv_Hf~t$S~c|b zHP1vLk~OE7Kl*8J+)ifu3PQw4dI>pa)#pl8p`?-^FH#X|ynlRUp)leQB2G{5y1rIS zDZiam)R4$E?MCe~oT!d|ZZkiB*-Mj>a;8L)GRuohG5yKOtokTN&+^xr74>PdX|fqD zE|Yo5vI*t}<)XTlS|wu!k}~$Zo^Jg@9M$WrgzcPI9*7{{e!^`t#^|# zsY4>4Gb&2tnv4Y+GG9MqE=y+W20eXR0VV16-0MhnDc3MBHpaKUhA3j)0b71{ONLt&WdD7hh%31_Y!LM2Dicb zr);`%a+8^52;Ff|HAoZYGCFZD_oalf+oZXih4Ezm)2fQsQYB+%I-loUN|GDO`ixyX zL<~@j8lKE3?Vdzksbo31L{FKPaYh5WYQgwMWM>1X+U+LsqvPtuDT^=fe!^bx&9sfc zKpw^Yg%(l`MW_S5B4FK;OX0)n97zN99TC&$z;)ppV8}%jU%C0bd`9;#FDvV4`3ru; z&B0ywyL!6o0j%TY)tL6S!FmUzP{UR_+b-F{WDZl}+sMY+R1?Rcu;Q6*^Q9#?wXR0> z$Q#p?%;klQ%5qzm&NYnh2SgQTb5IgUv- ztyP=Li=4wq&Y-Y5FNqb!LzSPP<+C~Y$J^8Sgz&+^!_3p$=-G)G@LG3rqqocgalCW% zR7Bw5@TSSa&FF7GOSD85T^qMs$NT07Wc*%Hpzz;acVJ#W-)n$Jxyzuh%EVKR_ zI@=|Nq}+~ZS5ciGPic`UMbS?TEDNL+JQuA)f+jh4fj9Gqp>W(M5xUCI&oZ^G!1w zTh(0}lBb=U_WC|gEVE9-Zw@*esY8aq*RQ6BnatzY?iJ7aSId=F7w1!E#nOmY(fb2T z*}hS2jXk4nYhVmAEvM#HX}pM$Jm!9-{+MFW24j-lc3JH1UI)|k1O8#q1O8p3S{`5P zhlTA*?nkyXP8=o4^bqc?16s`ETb5VKbKuA)I2PR zu`A%@vZ%oci=i)1-ga6Ry;P^Jn6Z-qk)Ihe!KJ)Yd&cJsyBb!5%)HJ@5XuuyS*leq zyLs^wV^N=YodlUJ7BPS*>U=CK)xBYJwW$tQjs4NnHKcgc^>$60XyV7?-=@N*POSb( z>dD3MsXE9VX;oCBw^XHAc%BR5NrZwxI{)Fc#ZU6?$xhOmQ`(w9yh*#eT|P#HS-QMI ztdc8$pEqK_VEsJsx^2s&JMqQ)v@gRWzWBI|V)`-Y3bZ&FEjG8n^D)#Lc>yP97CfUa zqI}pj5n|h{yyedtasCUgK3f~T=rLe|_jph5EbgCtt3kMg4i*}7Z%S(%>Y;HW~QjTS2#o1`8_QaTdgG03m zNg4X=6_vN$m+8IbE#o{Ejh*SL@a1*n$jo)S-CMGW9h)9Y_2Ow%sZVN5kw5q(kB^N7 z&@~vjMJpqM32L~+rr;P-W8aT1zPtSNfJZ}W0r~w+0o%=}S#o=NN{e;u7s2 zLeol*E1kyIdQ-s{ixPug^JKPM_5o}5$u$a3$1PerYdM_kX&CH8BWruE5<#wTDS2@u+GqINNHD=w$msqD=s?^!p%$7saajG}I)Pq2*9*0tmy!FHT_#EOS!(cD@o?plo~W(@DF#9vUbga z?5X>?X;rz+%!%uktE~tUV!#l*$YIkYLUCgLSid`ub$h)lqbKw;#8GYV2kR}jiH~BL zU@)~8YKYhAdvVZ98RA#5I`Fj-EZWmc_**+<_q#eZr;1H z>`Y`n;lb%-qvmanHxIJkYf6oEQujIRoy}ctOaHjP)hfx-9%_LM-C=(`HF@8t<8dbo zU?rr2x#iM!xO~%zQHiu|!2aAP0X^hL=f`td;r#2cN~X_wi*nY}1edA@UYlF^(p=R< zlsvl4uW2tKtF0>F*kuI3Wjx+&_I@rT^l8Uuag>`gj*ZJG?o0aptV=e|Rg4ef+T2FO z8<7X_b_v+m3-TFSj7^eu;Z&n*x9ub=ScNjns-AWV%cVF!@40dtB`*p^D3pkarIvy8{)nQJE{H zN%#l;d<@O=<>;IzSDjcubMN$v4J!-X7o1hR8cd&|v;qTzLV9W)IkU*J4q25lTa?2UQ&;E>$j(0IYwDAN&%6szLs z@!7ifv}Qt2e{K=R9Y12&*a7KX`vtdNFPfemr)B*4%ZT=lhY3EQ{MXuvTX?v*)EG(S zNBH4pA$<3-`W$9>37b#i-0h!R%7WL*3D)d`s^WJ#a>V=zPN>|Br#x6HUsmid9H%i(OAayV7L4(-@Wzl zbt@=*dYP!ChHuU1Z;Xw1*RPh1*yFCL`%;A#hJEiZ&lx5hfFQ1Q>!pp7v zJ>A<#T%usgRtugn#+dz6z1lJHo`T>*{3i8V&qx*q?Et#bCVk@*$td> z;RQWK#oyOn2k@I$6Fm@S-;u>335|)yqi-`>SVLL5*nS1=1ERb47(ijT1I0Z zy5GSkUSEB)m`y70YKnkQsD~e>dJpH1SekcFh@(lKVIS7<@;#*LANjDI{Ktt>d2;KR;Y6jLShqInIiqHPojJ?nTd!f?LD`$Ki3iyEWJtNU@9YSG3x^-1_eHtDS|w z*I6f={063KfnDBlZKx9RGeTj~o@$#=%@1&6puVM_+hZ|gqwrwdhd|8t+I*Frjr>{p zI%sx~)VM!4RkL~)|WFV%j`4~07gpmH!vBc{?`EjKnS0%tGGhx7#37}T}D+Q$d zQQG_e2<88A&PXxK{%!o18a@9`WB@b<0KlNk=zn*ee;@ewI)Fw>|I6Q8 zDV-^m`7`Amn2Z>u|8}d?Q~)EB(cdKh5u|~Xr0Ei=f8Usr=n_h<>i@bAWCQ{!eeS+4 zMGgq0R%HZ80}$$}e-lvBOVdtISgQU#qH+16Aw|L6>Gpr7Jca6?tiQef5O2`{TADnI z=#1zHU)<3l)^PffhY|20ck$@of=u_KXAk{z`%Ys`bIGxaS-f^ zm5s}ZzFt%7%@n7U3M-hf<85N^tuSNSgN8K3A!+bUyu#1?+T4korYTlMz@)HUVriLC zD~*Y8LpG#=dd^afKoys$zuZ&rVwxnfL$;QwP3ixxxBhb_#C(;pF+z@Ad3{C$Db@XP z4I=K@3WIsq$m(2=d2d=Y+U~{$5@c7g`h2zq{J|b~eL_4rpZejq5P=G9?T3IHo5Fhc zsR3>VaS-#B;)ibqOIubq8m__TuavDe9+Fc;Z;0v~KG(>u+E8Nk0$t9ujP{+g(u$MiHE!cn3aF zC}_1d4JmdK3Bb+7#nVl@CG*_~g3~|y$-{iJqM%299$>>`zUOn>22=95R(evMXF>^! zd-CRE57mu*kyli_J(6bb>7HH7kC}@e-+BAc{R80C&=0zL+VGo>Lf;V&xzu%-oPS*y zC;ZZcdtUw3X??^k?p1pl_W96=P%qVq`>Xw}?^x|P1idfAA3^tQ20ngp2KXD5P;+X0 zx!Q}v-@a6*)Gn79r565p3cT`Qva}dB`%ZQFUf>Ch{ljXGTkTsk_aqMKpv(#O>x!?n z#v3#2X%P=O?pq(bDA^+rP$72&&~ zy@G|UaJtfLC}b)NFI3!{`5H2tY^>Z~FMmCxGij3*WzD2mHKa_pboU6#o_Mynm%hSA&u+rcC)-DkU*RG(jig z>HRBz9HJWZD;j#P?Y7XX3Vs4aR=&IP&v#AgTL9bM){HN%zk>kx0JoPxR6@qudB(_> zYIG_GM>SBHxOzeyVVHOEO0w~*jMANViTCJCVs#k#kW5tIdnPvvQyBUA68SkSKHEJd zV~{4bP#HOom+Ht^AQ()aF9I;$mY1{`voJD`l(vIJzU$%uFwp@36%9sA983TJ6=M4u ztKOs+fbIr>NwRftlUE(dmRDXa-4J4OhJhPl-qwY@4{uP-Ugo~vsO9lK<_B@KC*>?TzyoBTCAPa; z(8gumHa2aosNkbBaQ*#*Nw_?CMr(m9YVnyTvfMbIu4UB}S^7-2UTN}qfGX9+<%eyT z?3o+k7lZ&~$g6jW{8}H}hAxa>N&m>W@U7;c9MF5QtIIuQ*XJ^9EJ3Ff|I~zA!dlhX z_*sSI1a#UO?egePkX5nqrAoljBVC5n7)E|$H;P1fIBIU>+SQxS?}e!rBTJZUJXp2tjfFB-(|~WA z)hlZY;pr4^)$5XymK?IBW{HVor6wN9p5}*HE5;s35panJjMHJT6qYE`l*VD526J_N=ar&Xh-{o{juI7B|hPui& zmi)9TQ@drh1<^A*#U?lT6v}D$s<{$x0)w(9;-5B|SX5TmThu#39o^<;QBby0$gAdh zx8}s@dNA9RD&*bllwK0DIewgud0J=?oKv3rtj6altYi$v`Lqg*@qr|};n|WQB~#ih za#NgFo1m;!mN#IYuqsRFjR6x_y_S}Tuy*2{sKaEItRqL2!z7e#I@t}G%+`ay0Ztr) zC2M!rKZQkGBs<_8VNrOyi*A+Ecn(?Qy=mFzr%;Dt(brH1l$s})L&Q?cVbVf$0tS5z zW)qEOyKAXcZ`NdKV(I8sr`ItG&>MRe@n9-1)J z?A5a;hkd^G@a7w8eCPIS-#U?WVE+2@Z93*T+zJmP;PcUptA%zvyvgL&21=C#?T4aE z3L#H!7*LTUHK(}l(odzp>EYBiF_()L_F@YdaoZg-DZB5#6hfn#Nr7!TXRd6t)x1+~ zIxo?=*%HF2-y49j)5@A8R&MmR@11=SS+-lNOzwIcEt2KQ9k$0I{aM#+PdW+JTwrwNdLcn7_%>#a zI9$QdB2Wu&7u7;U_D+#>)aiR4Lj12nbgIWZUxl4cvpN<+qQe+m4inY*EyAp?ewV%o zbYY8u&j5d&{6kw{}f91b267+}*V|?$EeH<4$mb_QBm90yNq{ zaF>wYxVu||H7-FKXxr}$@0mF>=f`~YJ+WT6?D9sbR}*B`icUdw2bSNf72?!V6e`&4LIoT?&fVf0(r~6 z6>=^ju^Ws!Y2Qpf!50yK65jy7y=5hifT5yxkK(tBst$yCIbZc`wIgyqYwLrBpS7vl z`^lmG@S{(h?^$y4u_5DulA~K=l*?|&E<+vS#NUD5YUf6yGMcm{QLAQ!gj$fJ&hovC z-aVh*ffM#7MnCnwh+$={Ya6816MQ~Fe;>cI%Y=R)O>{D3d&WHAr`ELG_-o>Ou;xXiIQ%y~x{;*h}*mz_CF6!uVL`=~Fq zhwCcds+_*tkP^mcc3kc@b{yv1lLLO4EuGb(R4p@UsUrX>3=gIWTb6t)`wQ=d4 zm$GbpYQ>{I7d8~r%f4Ye`Sb}fu={Ab3F2J|-Mvz>n!Ie?J;`8?%Qu-4i!MM5TnxHC zGRvTV{7m!LNc+V9XykM^gK zSHR9ij}#V_|Kr)4;h@^Vb{)Q#G8lA@OVGbSpPw91i=pgH9T*)5@eq+|=JFZ;XjZ3|0!;xGx{#$~W!tE;Vs*0G??V)`psJN*mfkpXHhF721 zM|WP~vn^SPKAcwhpgU0>+8lZ^u%ZD z%3yI;K2kMO+adBhEk%Bj3G}F30r2xw-Q+4p_w{2LHnF6pR3*IWGoS>91 z1IZ?#v@SUwDJ$r)P}uIv$SDyy7pxw#B$xip0DJ3eIK^|gpZ@SeE6AK+zdtacd$IGe ztN)ncZQ}aj4~RfZ*-?EP(EpjxFi4c%Qk8~PnkWirSyB`#z*}i7XfRq5oJVqrFD)9{ zOY|54?v)CFIUu4-etrg=w#giAI%S~&P8YF>jJe_bWPt&8a+!3u!9@Fq{sjKgiHEwW z+|_RylW$My&YDV)9?*Rp!~cpfI+dhPFCLw$M8r9P+EL3NKOnz@|Z*`mq;u1Nx z_Wxfs`Co66)G#D{QBp+57T_D((3t^uuMIc-kcmFS$R*)nqTRra{;-yu)4?=R&Gyi1 zzn>b)-mVhdaVs(~I>P+^PuNsCS1obomepxW92sseJpy<&Et#vnYz;c)A=TD~%zdV8 z@%Q)GfLvRTZ2*&oDc;|6e*#qfV{h=UVS`;v;%+<|Oaf+uKf_fo%m%OUirrt==SzS8 zz1DIqv2c>%^5^t_s6QNO=XM}?{Hbk@=B@2H`sudz+D4z~G1G~-#3aq>0yjkcXs)qd zgMk@!So%?c>YnM4JDP*{+AbERFd;X#PItv!h~7=d@pH-bf%11|Lwy;Pp;MxaXk8Db z+*#U|E>09nNpMC2rpV%(=XkP1;ZF)ql2<-PQAbIphbqTa12WwyMguzOW7G z5nV#d@5lD^OMHVj^rka@nCb~Qs-o`@cKdCaXAj8~h2|FF_l357WNY=g>l))YY+p1* z5=f>EjPd`5-k=XK)-TNb_vZh<_TAlW?`=Oc=s!nUt`?Q#tf6B$dz2f@H^LcGQSScj z_(=09J)Z(!N)vA(#5F#XCFUnF2uZNmHS%(IW@gBJGg2njt-LZ|$Yj3a%=C>@9wGqw z7O`czBucm?<3t&UMV%+%gJKAJS#PBl3oKi6U#$&o92c=6lk)T}q?7gRlDG++5a-H% zK2L>NN{be}48B+j#->Sp9H`%t7)84q%hz|;s9;(t6|>t1^U3IIaHp)ZLP7t;rqzwQ z1~q%9EJB;<0~2*$wYCVu*xf4RfeavH zpY5(K@Q#!Ijw@xs7Ce2on&djqOtZ&{F|sX$@ldn1>r>5nPz1q@RvDgP>sj+U%IaEu zfNVD!t(nC88z3-S5e-q{+}=d`a|VJwhxrWe$YGGGrjcqo`BgPMTZw$lyQ( zE0=~9M)*ZoTQd8wjR}iflPdJ~@p@Ef^Zc;AT*Jq?FuE<%EDqGg_`WkY8;f{XEAbB^OdM>Eq90 zRs8Qc=JLF4U!A_*Dt~lO*|PKDpZulHu-E$_B?Wz(=Kl9|ovZaWLn7WZswAPHD{XRy zTrk)sKexM)Pa8$;FgWE|DYD(IMi|_o#>R77L>38-39MondKzX9g|w(M|I}}{A}sr zjEQ}feu~4!pGa&!v%v+q`OMGbk?#2vKR?F>8>QTh;k2P48Pru@Ro6SAg2BU{4R}xE zKHq1>VZ*>kqPxzXL4ORVp84NetV?jCKGy`({?{y)%|KT-f%B^Zivs-x`ZsRG^1gu7 zNFy^&R{`oA6g0qfBdgL-6tXTq^>h2ejpP&-mp^IQ{a_wSmG=X>$ zI~*Y)97QoGMS@$=gJl1DRUOxiA30&ykrX|7jjWvdCN7E}?FLP5A(Jdjm#;? zv&Ypki=r|AXqB*;c^0#fB`=r%XH2P!PU%NWgO3FV>*>p9=_VJQzE3T4*5+6*9``2zML#6E-;MhOv09^8bTh` zf9e{$p2k;V( z{f`l(=nEY4_xW9J41@G=od~(ib36L$4D2ed4S1*KNQb7GtyQzJbFSJ>32Qlf4!uk1 z6_5`UPum;n)Fs5ReTeXp=o1@gwW$+`&@{ef@o#j7mbMLq%tPvBUt%Ns+6J%Hk0Rbs zAqhN%(UgS6+f%c@Y|m--*vED@qqe02VNgJJn)Y^=b%5@A?yuN=8VPHJCA&YU{Vc!s2-!T_IDI6S?UDZW@7@&?V=n^x zzwK9eN(A*U6*vX2zTRED^0f{Sy~fm8i!N~!7r|Fw_OSKcyhb|MONd~7T8R6I;Jccs z4x@vZ#i#rZ4-fZ3;R(4FJq3d^=9@2kG%ZVR_C3~H?Q2st#(X*}@dk;T7bHEz>=E(`bAs$jC)ppV8WD<<0t>JZ zF5NOIuq9Gy;e$5hbnNYBg*Dx8klqm78*$VpdEQ|hlnov}YK0AyWN>g0!WU6emvr}^ zZs%@i7<(ub=%oKC`-8$DG#BEw2~T~liV=&`)iK=Ymptm()aN%xNItoa3^qfPYQsu> z#oj=0=wGMOd@cfAn#YdWEh(Q5dN|tpf`h40A?JYuvP5tC&z9DS_G?7(oo|wBE!T7S z?TF{^-O=uUJHb2h{2ke54{QLNPodAUPM8i9H>)(?Mv^kGTs&6v4CZ#~z-Dy=g$1SE zJ$?UoVey{}ivP+=?)m(CyZgUW&Rb8;u(zk&wU(sxNHMvj?(Qwz8d>j@ly;@nxWZtN zzTQIQWdy_gfQP;Lr$sxe9)ZN)`0te4m<~!N6_cmwVW*U}olw|KU1Oe;FlDx8Nr8hcTJj$aQFzQrN zLfUr!oWidSC)mH5>!`IA+0bDZ?-L6oyhPykg#_&?ZW>p{L;GCVsUd;^;DZO&v_Or3MTZ+tH?s^zC^ z^rDI1S=sI9P<~P_4()+JPO%8bRdy~W7IkY@4jAS(Rv*clNVRv1z#f<~e8`QZU?S;= z$TrQ8iob*z=QXHMT)BDdR`WYcqGch%PbIEe1NaR>Q3H<4#$rYrSyBY?ddN$}0#juL zi?5F(Z56$p*8kTS_^;moKf~bPhMMrkdXDA^ezNL;#1{M53x%uA|9^ zuaxh-F6a*%N!I#TSHvZTX(?)0Y+oclj>OZ(9QssH>Hy0 z-`=$vf-tsHZ24yKNauB9I%^&e*)m+YfYuuY(49u#AX)1C9%ch${5oh<6^pYnd*YLM*s!^DbI0^K>X>rL(6jBmNX0lJB~e@8kjs0fU`9<7IJxxpy=yRGsAc0P}A)W5{3Y=&BkoOhRa5+TZbJ3X&+~>l4^*zEIAHBvH4;CW3-Y6dC5%It12=D=?O?%uOOfI7dL;0-{FU*>bB9Su8eRg z{$^zx%zt=gi6O%#5m{*$%wY!-M-Ogg?=NH%`|wI0@YOh9cT3WwN`wPnRN%C-x+{`ouk)H_-hyrT!X_LhUQ1@E+xi=-e$g0TxBs= zFB1%0{&|yzupf7|u|=N>=Mh_ZA)x@R<2N#^(mZt$TzdEV4PFBJ?tN0K&XGFz3}NjE zFdU|WOA)27U5(Dx020dz`IZ`OKtRi}+))b703C$PCsht+IQmN9UcrUvd!{tUBmzrM zQyn~N8@d41x1ue;T-?tUZ&Vt8w|bH2JK07{#6D5fV0R02wmRz{W-$kUftwdB_<%!F z7v6t641_3Uwu8Ot&wlW}Y^z`;)7-P5jbX(|uhEGkS>mQ2iiFx2y{_X14DZJPG$Z-$LqLG5ZlEC`E5)M>L6FnXca;2AKDi*q@DFCVZ$mhi@ zqnRe1*&J8}+wv_8J(jjMLSB2&jy=n}6ccZDrH0mN#25mD#32q7h`w!8e~pHo%XMlo z%nfbH@hQl)E}joz*F?`$hN6v#nV+13{>TL)q+*0E&SeXK1eVB7ag>KVQbPiRhAbj- z=axs2`&0$*w{VGiWzStiTux^0_T*)KuD_;TTsLX2Aj_4NoFy>(nVmr#4o%-pG!tKb z*;=8kHr9XWpg%{Uk80?^?<@jcm+MZ`gAc-{oxNk=qtggKNO*s?yxhz(GYaJ% zjc-R3H=vpN9(liq(GHekz17RmAsJ~HV(dOJlPh<^vS1EIPbs5W8EW<0j=nv+InnUy zzm&hrrrk`lg2uw@<=6Al=@$O7M`7S#q4k2OcxL4soR*7BF?^l|hpw(Ei`iEQtn0ax zBP@8EICl@i{4T?cWqUC2*LV(WX(rEt>Ss?uq@g9>7WGt|HiI`c_ZY%`Zm0Bj`+W6b z2UZdGU-1sweB9xzgyPtC7gnm<3k{;Co3d+Ep&r#!4E0e1%;4)RL>&G8yo#Gn_%j<7 zT{{1O-sN!XP=ObCii-EZTozy85=Dp!a_L9kQmNZYug3}kL;p&!q zYhsti$~ZGZzt<6=<-n~x)I9!c1yZ9zrEmhnmbqO8jo|aXW1=h;Fs34I;A#lAanj&e z36ND}y#rNChvT96;B@umQf3nhvh6|pfd+E!p+=b* zm#0XpEX??dmVxZsOq`h8sB0><>{V(5je(eW^_UbtaNLYkh1r9^fhrN#aC|&7J+ zRR+IV3u*zGgV_{6id4FSjJLMCyo6&bGKH%9-eJm^kQCY5qs0(aChREYK11S|hRU{a z2qWM%iC8WpaA3Qr*UWhEaHCP<(B$`NLVz!2gk75Nd~3&Ut{Nm-3Kl#blVo^k_*Hk3 z+7$;oJNQ%h&ou@;!Jeoa>#yHwlJc7;EYG{dJ*4^H*_-NU>jgHVLK$uT^v~MeW`NdA zSg6p{kUn6eYsyQ+C0D&~L|CKfk<{Jo-yuZpf6%X}>p{1ZhRbjD&bYpIC@*m1c{X1;4uPV@mS>9 zZ#8pF4~L+(&Lq39w8_qLQA-GtW|9rF*`#;ILgOS->Bm3RO0fq%`wyY;Pp%;5?cAwuPoZ{@6ofgnO-oM8$_e8 zrlqi&B^0Rq?2UEhX=89b3(?|Y1|xagSl0hUMdL;wdYH$Sn6eo&-<-WWckFHd-8NR;gDXng~0U~?a8BNGNhDd7TB*=rjfhnp?=c= z79r5&G}&wQ1VNqxZ6f;-?BWMNs5s*7$~)3-@~7W{4_Lgzk(mUjArK4|t`F!J=jcgi z2bJT@>-3HLY{c~I<*Dwhihi_9$z#JYC0dmdolsQlEuqeHB6XW-#7 z?+$(cHI|}dzPJHz=zdihE7t=Z)1dkJX9S{zRN=~xGgJabuFykB0lCm{+5QZyQ&4SeC z^0>><4`OO?0UZB!Yo6gu`HqO$IAC2L9t~-z5;HnUwY-E5l|0Up_n~7xU7;MG%g<#y z^h67?@=Y4F`;&^j_DTvK9?;sTSb(<40@eismr!CRLxZV&QVIJ9_x@z6@#)7&UMR3_ z6^_(TGU$jbM{*rL*wHdi^Z(Ky$^JIWC73{np`xM+0Ok);c`o1shJHx?>Xz~R9V zX2v&^MkDCgtWmkAX7z#kq%~1a8+N9ZkJMVnTWUZf;TjGZ=N}bcR$m$#tH*NWs>wd0d{H^)EI9$7qZ%pVICD|ETc7?TD`N@S2@~cHCJ3Fu?*X( zmH>9fD`GJQs6PKRV<%0tYWKGNf`W++@Ddk8w#3||F%5`b1NQ_(OQcG|-v}5z=gqH` zGL9Q^m|=loZh-`*c-SK79(ti-L`s5S?%!O~69; zDCUjm`t4AIE~NuxA)|sdjA@$8uqCHv z`%AByonArM(nVD1KnYzNnc}shnvNb<$VP`y3^_2{d^k0uCYs&9!VWgh7S~x>VR39B zDXHJAtHcXwMN?$STlLrL2r2Xqx9nuxr8G_+L$}A@XR)Cn5F&Az33b_-fHW~4Sot%Q zWbV4;Z%dCj{9ri;D+Tx(*Li+%)F7jmP0b_%HpxSmZNkl>g>Cdf;ZWh1algNK?r47Y z>cSzR!T3?9LlEs*vKzc2$5FFfk>MLtlX=8`W2oR+pEg>#%SGuR2ELa>boB|=4K1_e z8#EY~xk|aottb8Ouu*28;;wez=HdP*X6{*YK4PhC; zOQlJ`dY5GxKtV4$jP=Mc&T&wwMp-C^wG5E0+c;$S_3s!d0)+bqdDy79 zP49OKpW5`(wCMfpylXM>ijN3-RiR8T)Dcz6>Nk*DAH4UgdP}rUCiCqRuC~7`uaC5{ za93;hqFFmvX|lt#NTeg+3C7+^ig?x-uNiZqmY4jU-6e+2kdrW9v7EmH1MM6x)Q0NI zYQFC;ENtnb_^=VO2k#>vw;7BW7$$Z1#kSYS% z(c*#VI2geP!N|w!*6%1&$iN`NEBk^h-oByTtoivWEczQ+#4IP}-8|4QDse{INb;_qr4GrBL~jB*XSs4a@tf zJVh4$nIIpYG&0M0787nB&n5VxEN6?P0R9}cxG8{nXXn(sgXlx{7RYgYsGueM12?F< zg>A^y0mVmYBH-DbS3nmtTw96Vx1=(2dM0dW_iEm4!*F~aY6e+-hIAGe&K6Z(q($0Z zA;=Q>y$q)cCnqW|puj$UOU!<50{~}HHMqISNr+G?eR09WUX=q90BXX=SR0h{6&)Yi zpRF>#rAm@*UKlXZ9O#36VHPX@J`%H9;j7p~QzEDVJxysm38e#s5__Td5FAkDg)EOH zSpgMiu|GiPG7uy5iJzlWTLp*j$bF;*btx@dGJvy;y2+M1uI0Z0Dj!2-);<)NE;geK z1K1z~ZxSlBJy|B<9xCN7^mjU$eGq;%@(=2`em$I_59>8^3t)6g#o9&Bv&%G5%V|I* zco)pL&$JerHL>LqdhN|JI@zSWq)mLO#Lf8_l4%$h84R z)Q_y?ju#AA`CVEeD^A=NH|ETC>?p8wCQ%8OokHxn_ZL9ujceJ_(T%f*kKr1udY^&Y zTrD=7RA8>pp*?z_Vfpxp&QZ}cG2L8w`c2WPk}!XU!^x$VLR1^-y~NjEcoSRk1!pY% zED;w#Y=@hPZ+DsdB3uYMq~V{Mk=H(^7StgzP}>IMs7dCJXYPYlwunU1g@7DGNs!XD9|gYPIHrc^Eh{TZ*v64%q80``}2tkl|l34m3AuT#qHBD;=D80kzsBg(VF(1soO@m1aQjks> zWIP!#+@7~^ll<)`8|7Luk)ncIO)vz&GlZd>YXxrvjEem%31nFl14`wMk-F4dH?#AD z)t(9jS9`fFK0`)N#>VYv%GL{NYHq;&Vuz6~PWN44IshrinU}Zg9vny$I z+)-)!TREegU$7SGBN)hu4wl~dsIwELeYw4mk%vYdH}$1?*p$)Jg9*b3z=r!?iSX(G z@9iiviX2xgtcd7|Wkh-U0y}=cz#?gac! z^So`*X}P)RMO&IJo9GTCb0<;s`^(QN(~C(0vT6qVz=$zIr#Ri2MUc*o_0f`R58!WO zU^{roH~VaL_=jQ6^~RB`oo_~&wS$_5WV~6ndlHrtKn8>uG66HjR1Mn%u@r}*$%gr1 zV7*gOsmP+i_Sn?#Wg30+l%L>j0d$dKncWEabx9#|d$R+I!HfhQcQn5h`> zBu~W_>+~-ybfW?ot2FE4EG|n}&=H6Xm*ci~Aa1r+I%!DfJ!HR3u`kZ!JKx()q zDBKt`3XR5AsH(3XrY3aF7`3x-ai`SEnT2K~v-imhJIhE45( z4xx!L0ZPh>7RzKfM2wrl32_Eyq{6X+mW1iR28=de(jG!Y(^wpZTx=h+i;jU(o%{e% zRU8L&be6w8TS>8PpJt+n+?B5bXBZPGmaFMoNV?O=d)n){pc32KWPs=~Is>xHaYpp4 z@24(WJC21KjFk{}xui+654tE&8VUOw=}AjkEof=+4p)8X2Guj9N6;PN`ey4}cOG($ za#lFn;Ao*+?xbI%l5+aB3K{5 z=$wo(#pAFaZsS513rqB!{VRg}yx@H6U21%LJ*Gftjo`*Sr3pd5L%e!51@O8r-AG%@ zF}f~cqfV`#w`;f)j{pyfox%d-%IjVgNnj&n5UU{cms+dRqUb?aXe_HM9A04&kivoSn_ZGxm7jt z{+(m7(4Of2FW>8%iZe7E3^C?mlu- z9d>42D6luitb)@~X^Pj5nYQj81~hOc{@@OdW@*thg@vxP7v-{wk2ov&yW2f@)PPNR zTtgNfEim^R!SM$T}Ada)iI?nZ|m#2{f+C#%s0kZbR=cc&LABjVkdn3Qc#}9 zy@T?0J)=j1w+|cIrpWaD02Awys+sbzVb`E?r+t5DrB_BHgwy9n(|w;mH`0*5`mjpz zKhB7iUW~ckqev#{lfg*KC75foC-sppm8lyfMMw}|&ZH_{_ijFmwdWtQrE9I@7Ab)*Od%0O=LAnN)5&@=>Z$P(1f0C2m8x2t zDx|aNz>^x5m?Au%!WD4?=0t=HLjaC5<`;SjV+>_2iftUxVGd?XZ!sDy5@#0~HqT0N z3Ihpp4%X}j^Wc4(qYu(L{;Js9H=|^RwB3d0NxMYEulJwaF{B`xeKK5%Q@= z+jmEcF2`n9jef`eECznP8`>G7=?TKi(d{`NliRTx1O(l>db7Fg`02$uxFou+H9Svo z``?l?%VmS8%VesK5r;+QaPXqdb@`ob@PXXj+f4(226cY>6t&sSl=_uF;*>!~`>hQ9 zYo8zj)CE7VZZ!@JgtfmFaUc$&p1#6B!69!M%&o|BoBj+6GHtqCB_Mk)nY+WGwa+2X zvYaL-Ct**wR69?SP5jl$$(D-f{(I!$_>&=52mNe3|B)tLc~Kx2NBo(0=D)*Zxvb_c zB#A51LPRrx3iES|D;n+yw(d8{DbFgU^OEKWBBqW;5=ECTXJ&Wwz&{969 zW?8W4N8Z}yg)?qm+wj#F378}eN_)7Fr@PNEo%t=vF9*heKvNbaThdj@gBi;qs zG;&Do9~qfd4rtu+f4TT)^c(XrBZ7;kHKRQrWWTs}@# z&_+-^+ZcCR?k0lV_oeM4Jla z=^KN_KRWydRMjA;3-1Qa<>EWQFp)FdHqbu|yXECYx#pnTGDODLQ`s7jdx!VKf2+J6 z)sJ)wIdpabKu*qd?#&&#?OIE1{)qj@&ZRgO1kywj)T1s=ZgtHRl&LIR*Qj@QSd0Y> zJLexro!~p#+Pt?-5q2)sW4lI+jvmI~V1J|O?(NE++0EqTMB0b(1x8BSw@=K>j4FKE z-vzkXGV;w}JFR2ckBA;-zM(=SU(_&gJa`<=<$A8~;Ba`Yu*EIPYg#?Gapix2k_f4r(oQJobDC;PW_Rtq5FWMqUTN!-qEe-rD2;RP24B zr18iVFeu4JWlX)IyYXkRf4(yfRdA@QQuP=P%SbYFT;lJ+lv;6K2LCo6e|ijOEpK5Z z20@^-@plrXQS|CM^u4Z00$>;cHQ2ZI5-}r>dCM}YeS@$zPc@?Wt!d-2!;3OOLdaZD zT|H(_x4T|Gn=e%bw>zbOz@`&Zvk!>VFXNNKqh44R&{f{P>CZmXm`2Q&HXW(#cvVN< z?jRxhr-%CE6G8Q2OXLHr{}%-9ob)s zs^m#c4a-#uM}6H3RrT2=_-P<$;uG=4Mq3x!+8_uAB>6EM9~FVkd${_~IHM)m@olNOHhL(fw0y~-7CTjk5tL^>!h}y!oh><{|KOc+Ymc%Ul`~mK& zZmRv+@ZkuU@!!IK5_K}@z(<#{DDZf-0}9Qk5zl!_$3KK7rq>5%zl{KV)Mh`j zrCM1w@V|iFc}q;wfj}CXAyZwIqQk;3zrb&>o!sr;4Q>T50QrQUUA@yw+QIMKw~nxW z5S!B7G7d<|xYHZ>gTn0$`X~8c6JiTeF3;_oi6uig0n`wuy5(tZ;8hwx-~3E)APW;F zdu?qQCk0qxv@wgW9lb~Qf?SEu!}IdNTcBI!f!4gQ+Z&H228?n z0{6n3xFkBNw+we*FLqLQ4*bN!Jq56dCs2 zguhWy0`4XWD!W=cWqK5O1lj4%H~?vvGl~JvF`}IXrY2;r?$QACzIk>r4KyRHme=aQ z_)1ioxnNz|gXr20091ZR1~nrrbWiQcN&zwPsDx}-~?;mUkYQKcXGIs zG_zIVxy7m;rE*DI`vx|-f=(P&KIg0I3c5sNy&NCURbuI?r2-coz>4Ia$6fZOcim23 znb0$_%2C9`GTRJC!x0Fb4>W*6Vrd)NL+mb!f*FUZ_#gqlS^{e>{3h%rC1U6DJEP|# z=Ci=M)b|yZC8__I09NLjH<4#$UDXY-%8GalAK_tCn9&BqCf%I?F>$qNMbudPsXba( z@*I;dUS_cspep+3(MI7Drv(&!M>Ajv1Zt*{23xfeMc^d|2D8GP+&Js@JqFyIPW}e&Sm@i<&O?Ir}u!Z!AJhOf^i#A z=aZ++Lh0#!kB4jB?v^+NN+FY3a^BaM8ojJiy%js(AnC-#WIxvzh-tty(`l>jYNQmM zaW}V-53r2+%h?Hikhm8?t!F)}P+;B!3v!+QohbjrBzp0%*3J(wL?rn8pZ0T7BW@8; z^e}yJ6B~j`WU$K0J4h;S7Co0MpN)wuIgs4V{wpx9s-}=e=KD^G2_JDaZFvpc z`V1yIC3qUlIg^MmcfeO8;V#p$xq?f@wW@ENw^Ej*B?ri>j4I{JA&FyYBtE-O?&W_Q z33$~F(-4DekE4giqat*|Y%7HT4PjwF0Q8sweA1BbOhzO6kLlOkYQcR2pv~!@nJtxy zC_f9L*Fs?i%=aogLW1@pbGu6sV=ESBY7ZuI!-BNe&+}GeRi?M~w@YeH>#jR7{2I^% zxD#Q;FUst^!&MRPUQR~HuS!Z%!I8njaL&ctNHummDvcgguf6vy_|hTaY>qFI;# z0)9s&3W^KM`o6@W1keR#Gr11~dyyGfWq-?N#aiaYP-#M)ZSy>2_wE0-B(S`-+%M$1 z+#0CKjcdRzGOvWvA03grbooYeHVG*nfoGBiHm3`e<4@PQ zJ)rcAqPP^?79fk^S}N=W#PbAMuP-_QpugfCIDJpYz06o9G|ykq*JYePjTnT|Xb~@% z;*sJS6QWXzRi)vZVsfH$SW`4Z7nzK8b~i}Mnr;k3d^)QWnby9ZgiW?Mj2qZ+boN@A<*`h@8Ry96)+<*&IMs5~*u^76JKcG`Ep^r5V zhgjH3b(%2jpUU6sD4GIZW8ORBa)0Uhwki$?-L&atm56OX`gXg&p9Wi@b zuaOogksq%z0~9s^tGCt|J*!0n{Zn>Wde9S+P$2dtH2jtIZ5RF%NA@DMSAingl--&5VJ@qr_hg>EYw|uSp3HY;4$BZ03c;lyVdz*f=~zGsruI z`yp}gf!ei85Z{(^k}1NofG`m5ZZL=H3WgGD>Qvd|5gc@+(NIiS#0*wlbl@!fL|hEV zf9LbJz4+T-a`~3YS=;@0XvEk!?vc)Rc$G>*u(Oig^cRfs=^=Q~mr7CWZ!x{qP+%>7 z5=?CaKLZCoVJ4*EEc`O4o7xx6w1QzVB-X5%dBj#lL4_ltU1d76W&iX7L#&|`s+8Pn zpMcToXTf&zvr@|mhpmPx^1r8Di$X9>z?LL5{JR|k8|Du2S<2iQaqtfWA5go0xAk-O9pzudt=*ZJ$>d%L6}U z^nG^|3cP_`>wh&lw)x#X%Ni^b7EpMgeIib)ZUiOxUUaN6+Y^cZ8$}OWH07mz-`3%Q zzj?&O#2dwwcwD~{Mu6|IO?`#fUPbu}xM7Ey33YI}m=ULKZSt zKNv|Rj7nRkRIG0X^P!0{|IE9IISM+~n<%bV7Jc*sQdPdyz}z6gLF;tsA?vw{t%9e0gi<{BkGAfKLknJ4y*U!>tLwtAb? zMB0C4FGjeb;$H*8x^7~hzW#!Ndq?0MIXV;VC_TZb*S%NI<&sgB<9~(2Tz9trwK!2& zve9``B62+|>}%&sNVQfrV-bIn75uKOi#q>5BETp(DssFxJnErDAhcTwxEGtXRptuK z(XILqI(Fxd4R5{Qs?VA8Ja-2OKgpI=E;>5s<@3w&&DR_C;uf1n+qF@0!tnsUJ;37x zd@+h4*L=f-?040WNo&ckTZgY9bsauQ_{(vpPv8W~aH+WfA$jK<2Z_p=nDQaaL+zTb zlEFFUiP~dLGPGp1IObfI{U^9KDlo4r;>GJAqi0_nK4$wGi>f^x`X1da?>S?;vWU*6h{ObV_bV z5L>CXU-?KSRChKu37atT>FmU7(vbK2g=Lsf=UU$SzFjjed)%z#H~`qp#}EeIwMR z^;7t{+~PV>GAlOP@-Td8u66^_K_X!{|7~>250zMNgM%I9)a$am7KLY^wyb3VNbai+-y<~C@xe245D%ZiLz zBn?VVI_dRQgW_6P*(xlotj2(he(iXYm!h9UFZOIPWE%_6gfsBHYja}tQ=1LL&x?9T=)~)sb8x)Eny~`>MXb=b zF|tLW^}x0=(z>Ow{QGAuu_ILnng57-J@`;t`U%gRS3l8~=vVpq;_&JIzYbtWg6BwC z3XAy-Kl9<`g?r%A#(>5(U!MbF=;ndkdw!&+4@W844%{`5@kiiR+$}NN=uL{EbwknJ z$OS;1O)HA>?}}>9r%HG(ALVRswe7$;2`je9Q6wN!r`PK))#CvAL^m;q-85qyS5!zj zXE8{KXAUu=-|TJAe;a~PuB^qV4GajaoLGyTnALidpH)*wRk3@=S1LFOBHxa1n$lo2 zv>he;pNV!_%q%Td1e8hVj!Few6+IeA#+JsNEf^~bf3(vOB(1RD59iQ_R=S!32xFm` zs=Y9xxp~eyQuMxsqUi1g{Ppg$v~kAt&ejbg|5N+>y+p5&z?`y07ixBaEn1oQ3f>03 ze^DBk7ov=v##X~U_r+1c3X4e~WDRogy&wfXaU-U5s8ME>pOOjG4ln6i+uzF7MRCSS6c)M6RaW8oRLcQ}@sUG2 z+!BQ0&x}U}c1eFUmB~nfWSX4>acnf5VG*ypZGmt)#C6b6V8!1MVdtDGoj<)l-_+1Q z`4)YJ{}a~pH+yHDfODsZfb;H->8WsTQCLTglNf2rYyZEV-ldzfI1@nC4=aC?sy58e zvaL-CvIOSn^Q@^cIIv9rV$>!P6#+!EIG-A@Vh*!ogyd1MR{1H-2Ri~jCS6R6lJPsU zu(4*pHwpg-6*c*3^tmKJYMVb>Qge+*)i?Na5yBv;Myk6x+V1{;0((G&zeS=VLJ0^e zCQB-9rnpI#Orq;^MP#h8s+XfGWhPWE@J(b8NA>ht2pA9rYy->Yfb`vARmqrVCX3OU zOovb8B0>@?Acue=Yv_m2dOq!`e~a?}evy!bNXRgZkzhl`D}Lk`qRq$K@aYThnw?Ik zTou6s=z%S%$_WA{$mDR2NVdohAVVM%vgkG<1Qo)jaw*(35|V`jgv8>6Sky@XXpq$0 z0=w0CespDBf$!CFeXe(wYc+Ld!nK)TPZ#tgRzQRa83;%+Fp^0GkH8Lb=fcW;tNZuw z-ET+8q=<_#69~yLB@Hl9jGuMCJ@4!4{JZ(_U!QB|o%65Cwf4y+QqW!)7eRY!ay>EBt>34H!@11$;Pd!)0GbU*agoE0>a{ByupL@QG*L`mjLV{b2 z2?!8vL)~oWzl`I3Cgou$B=|abLTI!Lv{vEbs)8OUev2U?B0>^0s2zFNclaQEN&DJ# zeY_9TIom`d5-`Y&$%K;_MBi$=*UtIt_IFu#Hh`7@QIrgTbVc>OA{~U*q?ENwODdU5 zDOycwZC%C|Xi#a^a>kNVM9C)SIUs#{G4LLS6A1~dMnuRFqBJIq>_$up5M;;@IT8WelG!Rv zrsPXPkx8iXErrRPtgu*h5iKIpD#15rQ}AC|W%eYZ6Ga@)v}jMcYA>HT%jWOr@0ZH| zD*alPQlk>EP>f(mNC(Ox=6yN$e_qXd_H$Yd%Hr+{Op#$Jl2L**LqXWH)4kV)*J=*O zt9r2xpoS4_((9K}uC=61l*y@bA; zPt|17&nmwALBl;X`OTX5@-jjZgn&pzgcNFK+Zthmf0nK4_{Z(eO&`46;ub8P{-cO~ zO@vfYT#E?Agpx8cLtGT!bM0S!Zs?BAs}X$;`2=i^4bcQ}Achgf(HUk^GBPgtT;n3# zR_1YG2LFFU;QCkK>c$DJ`LvKDQrvYnMd1DVShhlnD2!~Djbf0HkVyfOdJ5;g8y-Ns zDf071w35)4Trh(prXohjR3WCC6u^d&5VbBNR4xd_vZ~D+LO_9NG@PUYN)xe3-fiSq z+?~!`z!)(mF|zh_lVG?MS1edXGK~weEjCD^V?sb}v1AHy33W=yC4?ywn{=CXEiwvw zTzVwd1D%NToJ3C_JFaf-rEp$z4iI(Y%|1N?kSrkRbyXvoDvZNMQp%=tW|S42jb?O2 zP7_F;w%ZuS-`)Q6&wNFqWzWa`m3y}HFK5vrFNNj}t_7MuUUNj1eK9w$H*SF0Tex_f z)wjBa4zNuSeBO^0M7g`ppw~k&MwUPrL|uZ%BNb9(iuCc#$8-R~J>WP|B$9)nB=Z(@ zqu>=D|9=mkuT#DxnGqj$X7i>Y@s*Re2_|C9B$8FiB}s-S>;i2ixQ}IC)e00e4ehQT zTJQ@_(6NMKCoam(^iM3xnEFj}ySENrarN#U{I3i75t=nkA4fvEZs_BW>@xeG8Woj0 zb-I=HiYmTUEPd@LOT>3jNWN(Y?SDRaJ_Ej(m2Tw)_I+DCJTNPvTUr&*scA3audhVS zK}0|_tWcp0DbgT2`0nOk^9~oxc7z&FxvZX zL;Is2eE!bLkLGU?zQ+1WE_Jkq*7BVn5Lty@^J{CnT3cX?`0~xCiNo4q`;DO#%))A> zr5ln#ig(#tLzf?@O?5n-W>loOkzfaiK&XsDl9A2wxISw>xpwq>zMw{eY;t#w+|9gW zGA#%aJiURS0?P*WEqs&l_ln3fW^p#AbJ4()C{dwA8|?DZDcJ-dks%}&90Y?@34;|e zY6PFEI3QHG6+$wo*buP64B1%3AndUl40I9t=dC*+)o3(eiPLgjxK$G}CLpQ^(Lf?i zG?5yUAxhOKL(Z=ii&R%&!72bj2&5x$^Us|1w)3$313FD?Nr)ju(V&}cI}r~0(n3!F z9}{74ZgfuUbH(8a?UJn?8b^YnFPmV%Y7rkv_n)he6yhHbW`m05n^H@uOg9C=c){obu;g7bgvPgY&u1CAyd7y4ta|XM=tVlTjoZV2@z($svqI1DY^4!lno~ z5;e}%dlNriFV{w;NLz@ zStmnmuQD^0iBqa^tRj-qfOf zp(5<7;PaQRIn>Q8sgY~ckzywRhOPLTQY;T^Q7QE8$Gxaq;cI847jtd5WM4Fh> zO;<;maZ9}z6D*RixspXxd3yKDz3LClv4V^xVv|M7ms3gP34oASMw_G@XYG-aX@<@byNl2Gvyy1sh7% zwN2$YL=sLD>Of|c2%|`XNkq^}90%@>!36OGeNE}IC$4e$+d&tE(IdgH#XWI#p{ z2vH(!i;%Ps^Na+1SfB-MqNhM8P^kA(BM4 z*%0QS6&6|C;#lkLJ#-j73F3Nr*PJ|59z=-*kBEl})QF>N+NKmpT1FNRgSS$S?yr}Z zCniM)$*drOPdCpdh>~g?s@w+sblh$WB$AT$jNOaduD9UN)r+Z5QiI*99|kk}5v()E}EU@j}~*eQzQcO**yZBniY z+0bg+#a3;%dtdGSEf~~ACS{ppV%eH9QL&`dn#CZ11}cZ$bHsnWKeZ}-z5jFib6n`~ zkryWr2rD9txkia8q(yU_wG>FXMM*NOWl&j!rJN&EmolU+Hubm;90t&l`>1=m@?W$J z-5d%v*OOjwqk`~^3oMm`3m7a+ip4i%s#Z-|Eh1J;vSzmbV%zUIxXA?&O=TSsB>9k> zEZPPGAyP_+7%12;@Dw!AWCx#*+ox7VinlFN(RFcG5aS_%LE%Le%oGC>07Mf;zSi~u zu{Ll&LBT=6K*od$2mugi=|7KTMns~7(rC37u~@b>jL{=(TP2OF%GJNl{Oq5;rXSaz zpf&tZ^y)5A)pgx|sX-+IsL>Nt%7sKsj8Lesm9+sm=CH2*fz=7gx#a2e>o{>7oA0i< zoZ5)G1Nh}6sR<)dl}s6>ERceS4Tqw;Ks5g!iGnylRw$X40Nel~f!5D{_O=2h*a*cJ zwzVdMMdh4CxFxE!NouONZVV2;d$0pw=rLKX{YJO_)P=}ZRIy1FXE4agOe`Z+30Npm*Ns{l zzD}XmX;FZ{7)3~1_`U8lyUR>0nElsx$!5mTec1RI_V1@%|d9K0GCZQC)42c#V z_1?wW8bfnsr=)-(7ZOKfcQ=EdJm84*N+u zB~ubc1xSLhi(qnyq`He${x%J~{q}snJofva>{aO87a({+8ikN+0YLvcISL6w0x_bd zBKCS9TLl6NKjODvE@X0!S2(VHt932qC4ldH84hSb&_Nh0U})w582~~kH>SjH2ti8< z1WExefM|da66gV_3c*H=<_abVpXBZqEgB|?MoSV}O_DZ?7B(@oY}r`Fi7G@%5Vb)5 z_pbj}m>zzo`cPJ=dV&3`|6u$NONZ$d2BN4)XsryRs3ffxb%dz}OfW2oAd1Tqr4lJt zqL`s`VDn%nd;M4So@@yhB44y8OB;;p6sYK!1pgSxk;CGGK)|GgYNTkerI1q3L_;6v z&%oOrWDStWSLyZ&TB917s5KRenOYg5D6K5E_qDhCe?O)BapqAM^^i^VSslv4SNYpx@cF-SC`k#D zVu(vlmeka;>1#uT6-ctBNWl<#06xBsR=up!_NinC$#MTf5RULc=bz054y0|Abv8t# zf(y9YpI={q2c!-AI@b0M)V<6(p>+g;XZ9P=hM>W14~qr101;P5HG+$ZI5r`Vt-on3rGqXPj?XUXTpr@#s&+?=FxWn2C+A9ddg+-~vDoT`Q8kj*eqwnLNcA7=X zhgO0R5az=J0ZbiHl zNX1Xmkr8*HH$S`m&?itBCquD6-@MqnfK9zuUazk!c&)6rgw-^xQovrOr+WZ4z(If; z5+f9G$n5?m!(jjt2$ih_7^3s5?}9vtig!T75(Gj6BmzWd5jTR_3Y%`Wz2tw<{+3G; zK}LweBBG8F4+CKTK0kF|g{}TO_IO7{i5j&HIdQbjU86+89DouX0vQE|ZWS4q6+snR zY#4)N14@dP6KKFBxhk2e2_P&O)c`H4v;k~5?lmfs1UBL%Fhgi7RcSL2D%47xvt^|U z8F^%l+CuJ4MKFxbTbHV6y4FLUA%N$EaOOGUM-}1Pup1Yfv%|nm*#n4jUKDW-G0iGO zskyXrIi5*z3slCMw-bvO968L*!-yhqEgf&ht#5iCSs3!j=9LOrdzl{8JKOAoYVup4JKp6nM*X2> z=dug%&YMnv&0akvO}+qlRgJ>{ps<7CMRgj#Mh)IpRZml>p4b*E2_%&bT3o4Y-sw{I z+B`FGCP_6~iVR5wi+p+tFp^5#&*pfI|9+jJU+h2NLuEmLAbztRpU0*+++T@bB1U9CmgFC1i%+z|aJviJo zgW2_XD}OziCXT|XMK2d?mwgl+&)t7o5AT&9msO?XBqv3`n8CLS@k*gLX!I;-?%lJ&Q~ihmn*9@ z0~e&B8VEoIpoF0sssxIpia^j539nGy$LrGGKTl-i&$kXzzi+dkgupzsI68L7ZcH*h z5I9-+EKI-VlqfF<&@cK(iRc6P`6>g%78g>_=z20GD=X^WSS|JVZm^{O1K*V5DQy>eq36;cP zP{Jc+f(5{eBZ0&U1A%>W=PQ!D*!V_3Z0bouhgBsAiIz$L=E%q#DN@YjWdiJigG3Or z2syY$5F&4qq^hMu1$1no7tL>7UFK#zR}BTNm{aM z+k(`vRd#{4K#3hl%P%>=h20ht1$SdwyQQ+YilwQM9y_2shTKWUCZXhyvniNh2Z?h2)SFH%p-$0q?VRUIy4Yifxa8fP41_ zQLMd7yTAoWa%`gE6lj8)O@~dv6Ja3;*b^axVG{uyQ-=cv=h)i@JwBFz7;S+Zd=-MaZbw*pN2q1qIP?lmdm>C>DYMG(ZI*prI5K zWC9Qn4z5ZJAcDP+1+oH#AK7O5;mlBskc=Qpl}wI`S^{Ks_oLSB&B$K8H*9jx4i7mT z?W{xv&TAYw$CYQBlPx#DmG(~AeJK}e*RwNac#R(_if_SQj}SRw`&ymyA6_M)UJ>k+ z+a~t!vnV`Z3^&w3^6a+fvTD^NOR}IRYuUJzZ`nSE^9VS;w^XE#NhMWDB$7#?pR0ZL z;I6i*{W7uLDby~DleTtZ*>VU-W-i`eDvb?s=V>BdrSun(1pwD zkrL{F)U#ABK?bCNaNTQkgLHAVb99TY`sV7Ws?Z%rGnY_S;sx3TAk`pU#vl}dbb+ft zl!DJ8imodFy-i&;m>l?CF3SHI;~* zkpk#a?E;ZnqzdFxkREl>g}_3%#DR_K`1($mGT=!8c!ElTh1JWD0=ZdqDj5KFKrU7D zFa=FkHZ8>{B#L!SC`Je=A_RgBcSt2>tPMu)fRO48m~K*uaSA%sTA{0_tx^OxNM+Iv zpe7I(s0c#)u^Z=l-m<&ho5?%YXeMDMYOA1?oI;{4DDvz;GcM6yb5<&rXlVqvU27_x zxvj8JsyA9@ZGfAq71U8TqEgmM0lVG0t!`G}ZuPq5D5ndRP#0ReP+3I+g;mQIRo5Xe z0Ci@oFbfV+4nQ>#OWhM@ZnSAsLo;&4cXaCN;+9!LN~Zd|4aaHoA38Rt4fhfN-(gvkaE>3#7P>eXqhNyTB1c4 zFW?yVzu}hqKYpK{0k@9E4eZ!Yhqg({h0|g8ap)<@C z#0|T#6|`4ISb=JU6bJ~`byxry1V||MbP@nqjlc+r%P0I0_ArEmNn2G|Le^#;S&fbFa$iy638L}1VF#{1AQA5+BM%ddIi!4GQeztF$UGv74Crz3t(h9 zqd)*2QW1N;u;u`CUiV@Fy5bOVFg>G%4swj;I* z5CH1<2E6aH&cy?Q_u)2dwQD*PVh;rmTpG6qrpPyjIOgg=@p zsHlpXNQ+BE(yTCuGyL2(V(4UiZiY1zrZJXc^Q$N>d=PPsbJ zj)*~S;8=~pASRDBsw4{B3hRO#M}Onu5_Q4iE1K?ER&`04ZBR>gLKVreJt``Cf9 z0)$j|)Hg6d#R}kmV2(fnBKR6Jd>w$BNHG%le!)W&Iq+DaWFV%f6ev*dx%gDTSKp7j zJ8hT%n8kXi@)4)@Q{*7NDz`jNJx-{8CkD+eqWxN_pNG>AJ8KLLP%N&Qb>%9 zkc3}-zkowPhuS2}5HNy_1us2*&;zInKnM3ay*C!@ipY206fOemtH*V^sh|eOTm3rG znj}Kr6*~i=nQgdW$zUf7fCUjF zC@CQ*;n{|Z{WZ($MQcGOfwopvrNYRzkzuKJ8Vjj3$4RD(NIEpS&|W%|_J>&N8+nOl zMUGi*#&)89L=FAUnupWRzjHk3Rd23rnhW&q)8Op;-`|prID}}ljY&lWGmx(?n*93w z`Fs8O9rN?R>5O^&(lokOolgz2Wi~|(kL}EQ{_*_i7t&!Yi}vldsf9v98YY?$aj-KU z@u06tH>16tA|I7QpMKo0)m{6&)=BKCoaZ;B{(|pu&2w8{Ip1Tm^mB2#{ zqAHY?mQ*;{L1s6bY)kWr8BBu%Zdtk(*#j zvsP#;Di&;j<%IRmICb6YWxE*a5#!!raPC0&r%J}mXf6{BHF)6(AQAu)DX@T`CUuhYy`)RX>lussII401GmGxV(P!4`KLb zeRe(ZPq*EE`6qHLP==ouw8CRfvU2^I-+MkmRrKJg*!orH9Oa*V-*gv(3M?Wj5i%YX z($tR zs*NE)_}J>Koi9C(rsvPG^CY@iDN0h5 zrG9t$`R4lf^YicDuW~|dyR4rnhQc%fp;IKlGtl$0fQcLFDiVN5#@QI= zrB(%onmY$i3OQKCD}W%EleH)#F|`n>uzGt78Lxei)*lVL2OIPDng|>r63PQY1%#33 zEb*oZ4EF0H>c|G)m{TYpXo9D6T+8pR9f4>FLL&wuMhO(`6vEQ1n>rc|$im5pRrghQ zv~{vV77ce_AZ_ttysf+8-Fa>Yu|7kiC(+V0V}^k`D*bSL4?zSpm_@UMDK~O&MCdez zz}F;zY`9D~Y%I~KBT-~@aKPi5jH@&dIVkhpMKG<6tN0ID0z`d&{?vIF4;I3HeHJV zbzAp$IV6{Na!DkUbl2S&r}lPzgjSEeG7a~)V@iM$KFqHw7wh%q$}2<)j(o!Sgki?_ z*PAQt#oz?=8@f183ekgT^j9D{v!eltm^ZWLD&wGz^IrK;g@BJq-hPJ{+%>#Px?s17R@AQlS9UfI+Sb z$}2&_F=I^wKxP0=iw4qF0IC`-oXSI9YfRxRh*&w1Ah0`8gJ#Xx2F2YHAt?t=HYKH3 zj~QyJs3$6g5-4OPW;<#GEt0@*E&?F%c!><)_7D&R0nq?ezz^aGN;J-vt3*LaqAW{P zh>TQ8`Qy)D;QROMh#xSL2OM9Gjl&1EQ}%O3OBIr;j1cbGgd-720pGoS&*zLl_9ku` zuys3OvM6emo7tHO1ebQ0LCyMC(*v6$H)|I~MbzVFA zf_|H~Rp)+Qm!kctD5ye;ilb7iDH1AGO)E7K&%b|v-1+aWb^Z40XhvoT1}1=RIb@fd z}sWWop{Kg}w#)iA2%x*QHTRm8xes6`Ec8WuuCB#khH z8X-k%C_Fko%iZQ)+D3&voXE1Mk%D zuB~;j?c|kGiAJa-R?;Nr1foig2uld&tq2PtFr%1OL~3P9krFA&ef@j-Iq3|2r}Ok7 z4lkfSt19)iCQ3+|Kg!Zj+}y%sXmKutm7BvNoH7;+a8n{prx2AHpj+qmKHn4PvOiSR z4McwIirs2=8bzbo0)yMJq8;B)mtkwM6y$u1VEk^B7D^nQ1nf!p72ce~4y<;!MGB&4Dw zgfb!|CRN%nn?gp2clDuGB2e|ta%ef6ks_jzLX6@@+;|&!0nA7?9)B79w*yqGyZ38@}ITvz~Kd_jMsvQdA@=Moy3lf-b)99rB(8o$pwFy7!G{ zsO4OUdVALchgy*4X9!tATPY0dH6xZnN#^zl??IW!Aclc5vpfj=@BmDW{(bla!~yN= zJ_7#p=ZB>ce}M&32rRQwH7!vg=I?SDM_#={m?nuNfUsZ_^eKrQ3Yn7yUC4;12TsmH z(xen*32FKIF#Eb}{Xw(Cm*Q?zpf5!x2d_*Cp#x@Yt-<0OXq(~J6xB?(C>3R5)=Gejj6P2XpobmYE^JMS7NoBgB!+3`@K71f;A zt+-)85H>|}A>MD#qeN~{6Wc!taWw!W5Di63fIGSYG6KvgJM*tkyf{1uu~G#@Oy2<5 zV48{cwT79c8X$QAxJWkD1cy)q;9VRJv~^`%OtbA#jcQAyEXPh%nG;22tYKQCO;y=V z)*3M|)}`GA7=Sn+mr?{>p=u{_3N#3&p>*vDVXz&`xnf$ojRFOk3Kl?#3y2eDgNleX z97^uOD7M%s)2m2BNQenI9=+q%SFbra^S2RBO$T>@fQ}=T-1EKT-IP_s+T+)PIOi?I z$0f7g@D3&v>%2|D+?YcS&}I^hK@pHk5a>~y3jpMzSQ%)7gq9cxk%bya0#F~rKY{q( zcRqJ^G!{05!Thr}Wq#T)_<1AV1P&czrhCn8uIy}~yh2X#KA4bCGmyRD+}}yiK3(R6 zU81YeR|@AW43sqtm?6717OeqyQt~pguu$rB_I789?aFLv0g>Uny0H1jma*y)4MzAvh;51SUU-uFegdZmr{eO?c6|IH@?z>zR1Tvmin~rq0hdpThCJ+ z518AqMhp8!gnd3Ld!yl#?9TWx3Ei+cWEgKDn;JQYT3#A@<$3)3>AJ%L&uES4 zw5E5~;dnkh+Yp0Mx$|@06F@pju={;^bj-0FJ-5>8o;bE0WY$TdW)bbhZ_GynywH*< z=gN5^fEGwnJ?SfnRDq_OB%owOMvI?c>_GF#$m|(7gLAI`;V+ z?7d@!SJ*N|AKymgkX5*BjrsBc@mo6I*`tiz=! zip7Bf0lzyp)zSLLdtRsAT-hHrx0SUatrl@QrCol4G1|F%GuzF=w~c6lkw@4)ecUDA zssK4*K#WIeC?XrqUAA2lNjeIXA%aH`k4v3tkc#VOE--C|1)4<-O&}R%B4>cU?B}V> z*VUU)pG!AHQKL`Mn28iNuplo9A=x%1rK51cdfi34k4I0RCWKa-&wjYKI39;=^lW@SB7`1% zeNjh!DtU{9y~I*Tl!0Lc#lU4o5JcLNl#UT@5QO2w!CW+Js=lR6nV4n~qA65VKzd#b z?hL+tuc&$FjYa2Rt9jySSuAQ65)JID3CIIPr9!DCMMfu=o*cWYwHm?GH{P**oqY4> ze&vJEh$4MXM+ihBl1{0;@DqjYHl`$b!=J{BuZKI!%bW|$oq$R}P)gI1&_-AsDn(jw z)zlhCfSN?UzdI29IA@KI0ESLI?(|ddar?juHcHbxuc(-?hZ6V9d+izDV3pAX`-hX; zUC6X+AvXKK)ACY%_I>56hrK?`%TpHjM=K zB2G{OfdGO4-6#&M*ibpb_$nJOvK!{KfhH5$`3?nkO zaIrU?730uD4HC|SO^YYnXd9tdc(9{*1+&+?+?XGlQl&{FN{JyNQX=UTiH8nWDQ22r zogxS*E=GlFWU(S6x%1!7eZRhWblY^)R{QSP#8HezOr(ISRH<1ltfHFVlF$&y?E--~ z->Z~b%tMPvqD7@tDrQkN=r)29MI>@zAs|fFz@VWuE>oPckjjN?AY+7u`S^7H!Rvl? z;)-2SA%hUIWGEwACwS;#qa#tz$@a`RM@g7BvIjGxPI7KLj-f_V*269J^?*NqJa4x9 zKe_q8e~f$<3Tas_M50PT5RxPif#L5AUYEF}9Ij`aejZBHmZ?aMhHFTc{@!#+q?*=l z@0A~a1p*!Y;tSmd@bxPHWsX5gC}AF_FfR%BI18YiMJT;`&-r5dz=ZF$$PYk!yd*Ur=j_IMGKG5-;7_V5p7 zg#*GDbx1GawNY%%VsB$f$x^mA)ghV*zf?>8CU{rA{qdmeAaCEg)tv8JH+A~ARa8Pk zph;1rRiu^@WpE>SeEs`w77(doyRPjCXdzp!zMJ(R}6k3mfW!DS%H29naPdViCU zE-n!YdW&0Zu3e)Of*LHjaV0K_5prdRS&9P=Q|CSXe)E3y?*9K!s{s!V4!v+cdDw;= z8`hm}*0#PBEAG`_xl`p0=~Lpf=1y__@H`0!(xg&UqGYnUOEs+^j3Eluq(woBrfR7f zsZ)FN`=5V*o?)*uba>!g1A3+Je6c-3_k|?hV&dSfh^%gCd}(u;EB(G_wgq@yF2fi)~b8wJI^Qy{>_qAQbei? zQo_Y4Pw#&_>iWC&$Lqp<0lo+(cKs5xOj4Fe;SO?wetmP_=h4r6HKuk=Z3e9KFj>0b0c#=g7|Nm*B#BH4a9}b7Y6z?# zpJTW2(U{xAQCiGtZe15?tE~}o0+G6Xm_XdQmq6S@ce@@4J^AMP%RDPh_|Kx^SfLpa znITk0DYcY8yNB+1o__C<73vZSNg|z)LWnSD>UEh^LWoa!+iBQY#}KgTBXkr1)6tpv z&$GCG{9V6id+ZB0VY1)bFJwhBxMon9=%<0d4AsKFbTxi?&s}HBuRb5r(u(D@B+iyv zR-|UK2`gA)7?sL8Az2WLNP@@do_l|TJiJ-y;4lyYq6j3`F{((JT}s@R-`ibDbvPDS zb3#O_lQS+ydBQ=NK}{gk!f`a50M2rH_axI0_7QE-2JG`$7=a5}3*9q7%5(K))lG7|D8Vs1--RTWowRvCyEx|;{BmqW& zbpUjjwB@82K*j;y*y<(Xb8DPAxyZO#(H&Q)yPkKOsCC-%!Q0MbqVR?woit`egp#t# zDhAt90H?2R4M>5l2q1xl_6U5XFaW& zlalm@&BM-xAysWIt9Yk~SgdS%$`HM{&labuJcJh7$$M1?5xJE%YrI|P2rqMJ(0kFG zGsC!A-C z+8*{^sXX7Shi@GVZ?knRC~Z;!?Te@TZ$A0s&yK2H_P?W(RbEuWHe)y6U7M8)KEvUf z&&#&QfbkX%I@J!-M?Q;oHDr7$-#?@KF*{8s^#j9dj_|O}9i8;<(FtRoFH@ms?eRj# zMO;|KzUN@~XH_c&@Kn;jp8EpYh>$+5)wnEfWBWeyg1GLMKC$Zz-N5j3B588!p_H3^%z->$Fn|GGJ z@1M>&B)yx@-UG(!HbEA8)@70Jj(wMw=g6GVvnWU!Lsh&={>wB&C-0E#RhfTx-$(S2 z)_s6gE@SSW9k6&6+s1TST1?;+B?2e{05k`I1P=j$dZGpFj{akfP~j?A=XKg@Lil!_ zL|D=+OuE@aPEPH<6CeXk6|50Yps&a!f@gzGEN~kCk%w@ zu$4x@!laPw!$p8upx0UofmlKoY|zntjKZj#$8w=tUb%#-HX0yck$RA_NhcuTfH2qq zz9&dUCAv+G6o62k!sM=7#XTpg^Rvs|Gj8{OqI9CDdJ0rkMPDKCB6(M%-&K`2m^Yrs z->-g#&nFa1acho}YomZo}A)!~k4*==x;l(&AC@Qi@4VfU;Cc=mB%gtY2ha=+6 zqZa)5Oda!nUw6!V!ZSv$`$tckK46Y zkP~zSuhc=XO9i4zlJM|@Hth9M);5Q3<^_8olr9w@%D}3`2$~oYF}4UcbvL;PL`|19 z*uV~hk|fzUq|k*B(Qf9f(==P40BmYl2tyNk6BWT|cv=C5%}}AI8L|;@MPXsQlGCX5 z=0rINyy+UIag8W;rN|u6$!SDMUL>lRR$v#&ZR5-3a_tIc1-^h>I()`ynMoE7I~71a z0}o^OlVXnB2JyLqv}JxDlG3WoB^Ft+TB#jc(*)8f5>O=+P4^Gl`0}@ay!6WZ7@=Mi z2#JId1QRC6J8#&MNV5VeDAW+?cuTQhslqJ9W)aFW36M{(zu!lPX zktan)QD&7I5n7p*sbxj7wAFd|Z^$mmxzzKLtrO05bQk9FPUj%@Cxi$m*qIQ>h?tzQ z21?6`Wn_RrL5E^iAYsH1gdsTnP*P|l2xbLUN-R;};h}itGQ5FzIGdOP=Qkc4xy}Lz z^O3p7k2$U{9B585ruBVp^OdiiSLFF25uCV^OuA8_WmhNXjtie3e*H^tQrqf#<&|Eosce69k%6iugUo{D zd9;dQ(4rd)hUn_5zPA4%y#1pMMF|E+eX|S5Zwzg6noEOrQah?1fkyLN{Z&u{y?dv} z(c}D3mY9~NS_M}Yu`I;rOvJMyHA@n;mFMT{df#lA*S|Tidk!OyW^f9kBqj>dr7Wi0 zicNA!B$7!al1U^PVq8hL_U9#_h*_+v%Bn?&Sp(B69DtXYi6O~DvYV1d3AYthR;5*0 zgibL255LoXZ!B-;1(uYXY@5tq+q*;T4rT$ZQXIM8Rn8}TMDAd952IrGf&1T@>bJ{& z4eLCwIyukZe$DyL{PXMjq#>pe!3^sn>Dx+;N{TSRx^XDtaI!_pHN3p*^Y8WbSIc=y z_=?vgMX(|`R|>WKSd$fDaHUf!6<~%GdUJ42J9CsFJ82v!E)=E}p%SNl2JZZLU^%h< z?6SnHIC-Q8DnYIq`pZpLm|n~D?_L1EciE}>KFKm)Uh6I!h7l@i8lHZBB+MiYOqByE zD1`tRNMl95Dm%A^jfOy$rU*AK6nFR(fJV^ILi zx==p4{QN*O2HhLkpR)Ic8jiGZd{Nqa?=1K9qR%sNwB#;xn_LD1 zfl^SSYIEa0_+r&}%d)vaqZ~Z1bwH+2Q&b)bp||ct2y4ki>)$!syZ9s|BbgFJ%K7)p z=I8Y5=QkVYx~l%djDxD>Xe^9lCw+eN^6KYbldOMhF7E8Ag%I6^rPUQ&6+8e0L$LCL z3o5jhxa6V{a_J?RW=e_OmrTfm0hVl&NPw=$U{a=mpp$Kn1l>c)<-;7y%}FXA25HlszMATuPq`;bIhoz|!Z_wx+)sK5PZPv=`_WGB-DT*2a#C_pAeLcOgZR0tl zl1h}l=s?U=3CP&jUMT6%2G}1%%n{(0fPL*I3gNoa_!@+doI5fUl&T_qy#|!M=NJv80kku`^a~=Dp0ncT3t> zvOBd#@=KQ3j2ELWuC(n|DkKlPoL_cy^!wpH`{<+k_{%om7V~WO>Kr6{s{RUq!f;bz zlOi7UUwcAF>-gxhWpVL8K@|-csE*4|JA99qa;dfMKp8KxS9cMq3qe{`HI}l(*zeCU zDY}m(s`3=?mi@k&r|++z`QR@lSg~?N?LQZ6b!VFE0}lP_v8M84iVbVF_PfdDZ0ycB z7uewLtt?_+AE?1~zfA1KjJ!5P@CoG(W!GFXL?h|?Nv%()hvK~XY%uG zuo`vY8Ly{GPuc5`YXA%MTST$^R%f&o7oVZ@jYbhlY_Gf`%k_t#0jAx};0pIcPEoQ< z2g5|Bx)l;!-6~Sd59K?K7}rl3_dddHqOir#*eO=H^;;q5H`2K%tZ)mtqkWGUSv4)r zrA13R083F3R}0Q;9#tzqiXSZ&yh>Pu!k&BcP0Mhqq#}ui%d^@L+nL%cg8{KBfkpLw zpU|t3pFyP!qe5YVfVRwHfxw@wc6&{A?ML~f9n#ci<#-QwEOtV)B8w$gj8ZDLm^&Gw zi;{2efVI^Kn}!p#z!K@cW2t?fJ`?-3ZVrRzck|7~q~o>nTh(7>LP>HIj%>YZ^V8%; zZ7QfmT>G&a=rD-6vxijaJ`6Nm*2MNfU2`-oHP@(zgQnR7TZ{L;2owYx&Qvt+DRLG? zHbzDCHWkQt+tP9M-@91!;z;hEmx+lRJju|VtoDJ$^)VhkU>93zFvTUwQ%Cg+aS+_@ zi%-rC&>ATm77|AWaWfHoJsDGXNZ_t0iUl6`^_g!BE?zu0k4i8Up)n%G5Olcbdt}Vi zKn!JqPp@_h#MfsU`w1i3#+A`b28qMG$U0~mjpC!22l!uAI)k8hc~?N|Vwo~Jhx6tl*_Aa}xC)tq zX^VnIk&~EV^@rBYzCzJcN+<_P&FUlMy*AztE8GZ2(D59-cC2?;&$~8iZ3t75WK|Yl zCuo)?6V=N22}TIdLP~$@p#Itbh@m$=JVAV8d6l8Ne(!85FtvdH?RIbwe6>S99~Xn9 ziz3z)oSU9V-fNRT;|l%JZrIb{d1feFL*^ELl)nvP(llVeVbbl*z$G#)97vsPu#Tj{ zSOY~QufA<(Z`e^zAQq3nU`r#MP$W?)ZWy(=JtO_TJ0Vf(YQ?VKYF;ZXn?#ZEIRm>( zlPH2UlEF5u_4;U#Ht_-o-ty-zAlYkZqHvbWppk>>HNH(Qf?e7e1z=E>z^T@~PozZY zkh53#$ClV4BxlhoeO!7B`v*LkB82WUjIyKi?myeQTVDopNtLR%j>{5Z0*GxVRTkV; z98ERbE4A?~XE$9;fQCBQi38t7)c%@F+W)c>TiW{EGE9et`Ogda@uL^+yUNt zr9TzXr>{(~TH65vw@0KuG?Fj{G&xXT4hEJ&hJzuOn<3Ws0)*DJ*&fz)!LBz+3Z5u* z&&@USPfo!G?;=;$c`Nog^?!oBqCYHRsI$3-M~F4qo*e!hIHBqDNDvG^zWbse!u z=VQ0!h9chjkLXOoXa?F?0`*rfg(1CfDBucKxiv0%5>%`vWFxITk~PAM{YW&0I98Sz zCxiUSxii>l=lVS2NHr|@@!{cTYofEevq3#!MwSXr3V+p`a$Wl2hat!USNO{o(|ZP5 zMP>|npmkfilGIbkpbWj{&|`i3_kqK`uS}!II+kK_A|ICGF~XzREs>6gtmPtma`GCN z)FmFAwjoE5v7y-K1<0+A%GjF(gaw;@8rW6MYj1QKcoScUO-B+bOdJ%Q$sdhc+M2l- z>TEU0iq5m!D$M%a@obi|@8MCA;q@~sh=1dJvvyxQn6LY0ZR5UCY2OA+LQA)d`(Po~kQiH6rHWuenfh}iN# zh&%Fj+U?M1rl$3)fGHUx^X?B75HbeaM5YSJ6STjuRm@O%sG}^G@s{~*-Uj8$0t^~= zgz(dJSBFDxjg4j8&QZp*TpIaS`nkUq2LD6yY*od*POpF{87g|PyxCfeFwV0)op<88 zS@^52rYaLqn?7v<$@`?5*6)n))udY1OogZAI?Sfj{bG{}G^k_ng|&v`wU1f;+G!ZP zEFK>_5*Z-n=HyH1CJ z5sRD}ZJry|8d%a!u^;;NM_SOU64q$fIm;j7!w(NS+vJ@(2ymiR7&p6WS1=@fU)5qtJ;pRKB;T9-5ZC@C zPY;J$s5t}-1`7&cAXVD(q4@BQw@@EpiDZbWf@Z^}Q;ldEzb)`b3GWhuPV^0HP;NGG z_Bp<+s)7|WwOrEQ={zA_;DJ46ya5c~ANa;YrO0Wfjq-A*?g~B(p^F>sg3@Qrj(%Po z3Rv39U+-+@H-8)^C|S9)dFD#i+C8XdziX`(v*ZZsyf$$4kiu$7^lMo*v%5iI%_xzS z{<`i<>0?PpEwI>V#~N1YK$#G5Kd|cj2N#OfT4SKiL7PwArG44!jARHt=Z|lY??r<* zi&i6wx_@X4K=Ddvi$1=YLLw2~&Wyb8Og1cwgkJxj)N9Sm=L&A8SNPneeP zNWu!zBtH4_$kcf~W1;y63z+hsN z-NgN0Rn`u**30pe6@!8s6pweC`WQ&%PLLVGtVxeVuHKY_`KIzr#wiE-Kzzxw{VuV@ z-gH3aSNsIf&MX+0X8&8Dl3UA!C~xwpeU>6>oi=Z`s4yPwF?B2ZcdWT=K;@Tn+uQkZ zMaycI4HG^Kc{qkLA(x>^^M0YRVxngIz9%<0iR_z`_#N%eLm{!8QNZBQ+^Ty2-arma z3;*3%KLqnym(1KtD?Z*Y!(^ZY{K&W#%M0)BKgjEE4H<`6Y5f$z-s_|DUXn=Ymul+u z=LGX6)B0#p;R1!S<&H>W=dmhdbd^Q!RdQIeb^7Ml8v7X|@3y9;D2w?+1G}N%(IHOi z+79M|6Z7d<)j+H_@LJ5c!xFIcedDK4cvZa^lS~ZbHpve;x)H)mrF5OK(zyFq?&!=R zePhp7nEq(^`$nIoX^LA(D$i%?a3*bcx*xybU7>$*No;O?4*i;+>Z51xsmdI{1cj!} zx@|EWP_>7!3u}cU84NPd0vms-J+D8~YiH5p{*Yt{3~l-g)AHIw5!FZxfFv5wM?2yw zjGlfYtxO=4g?RTHx6q?&slH*ME1z#FAqh1(C+~BJI{AnxMIg*5*+2zyvEsHxPN^>Y zYl2z2bAwwb$Jx-oEw`{^?(t#LC6y{_Ts5deb#)n8ooQJ}W}t{nJ-6=gPTNeve{8?V z6TU(E*8>CONsF%22IEE2MX5Z)rY1OwggvaH4twV5@EvWE`*lHJo8NQB4(&A+I`q8N zv8`Wb0ppKw0ZepFB1P3q>=wims&8Gia(a0nZ&ppOswaF+5HmU*Wci-`<4}Y>N^k3D z<$B2AK*vqKj(mIdk2YzmR__&ZX`7t<`=)X$0=Y69jN_1-f$_LdK%Hyd@HbqAbB18q z3|S&7Q^`*cvpQ()teO1bFmylz+DOsjYvpeH%_H03feeUd_Fn)MS6ww-Ok>&=?^)1i*0&37d{l8NLto=J zh95p61Hh4-V&{e1Kxm5=9>dNmZsYUU1gAr`!_)dc7)s2+ASK;n`2L#nCwX`0GNMh% z&2ayQlAJ9zirSJ-v2s%6dj!dt1dM1%SE9#|iaH#@QG_?Kxszh{DWnblx;JA;sB!)X zyA!on@Xl0hUGvNPpNR$06}&;aMTXCp*R3foJbgDWhSlsT!0h$!uD0DE>$$&9Jgi_n z-9LAJ%taXOY7?Q{FG9zdMqseNz(Z7GK>CV@*MMjE4_)Z2mDI!1u#vj{!*B}+ub22Y z0&CAexu@s%o=?=x`@dvUBx3Vhw@~p151-HCpxGY;5$DzEPf|bSAr2@L?^G~7h_gWr0|jRxOk*`gNPtSE&(k; zA7jPT^YFs;F=d0rvA(T?A`8-Fa-PS$V~*|HRp* z``YDdHV--c_IUeOsY)fwVP437PjJmVzsgZj<~k97`WtJ0Ptx7f@8Y&Y`-(V})6r6* z&B+~87noAJ*XSTsG|r}#1#;^{WTGcYra+qg@<8`Y)i3Y*1A+T^WMbRVS%GbKUWUtp zJ0UuxZkf67T|hV3(FhB()&mZSEt8}!qDe+5U;{Dd_@!T#uBs6yN7LySuV;5ZhxA7` z>?)53DCb{fGOLpCJ4?TWNB*+VZ5a`-RLOtV-rA`bDfOXl8;t2%m!SPztS&o$jBk<( z_WmNY8TJkGF~qJQga!NOD?(79;8h?A&C0OVt2E|We ztB{*Vw^ld)n2$!=cf$DFYPyV0)G`p3gH1_3bjNe>0uOrJreQI&Kjz)uywch$<)gn} znf#o@b10Ye29o6CAN8uCf1_VzG|?8>#2Z$zTjl(`mappWjyrF4gU5Y#M=dZOrhGQN zTinUunuD3CjMqGJE|hY<62187S4#jLD2LW^t-OBJyqwx!UGB@7tYbdn)d%%o>MRX{J7|tIzlJR%y{cZL@8{Kj!{g2;p$OKfj>^6H%IW>S+eh@kap|$+$zz zn%o#YE7!a~Qly+-4qpx#f9Rwwo=s@SL_XtBh(61Q2jW{kH{fRS+D*eQeDX3hRvvt~ zqLGmKneqjz%9v{X_nUTYK5x`m?7N-mpw|IR8r9?#AMR$UxbFiVy6ip?ouXNc&U!cc zvb%LL=x?xcXmujTFfl4c1KD*_jU=?7{T)n~Q>1`*yA>lqW19rAw%8Eb)2{OBBtWDR zn|v*{#Uq=X0hn7U>eJ*0NF_4sQy^Wmlvgjo&rV0@Zwq}#_f~<@iT2mS(kJH5v1=4c zXcOg3xzrO`g_%J9TPDTh>Xa{njGy@%t|K3?QTNx#i2E!&#yhI&*B{qo#uD3d-9H&0 z$pKgu(^nMQM|!RMWi0umy{Zl!$rV1APtZ%eA$J@UODmUx#f=9frlC)Mkcw5YwE;0u zG=pSkuwAbxSt3*j4e)UJDuG^sVl!WAS7;2se{_9Tpo;_?{^43eAR0Vo{PaYnMj}Ok zg#x8Uu zo1O&@LI$?9Xk=c>-sU?}x4DPT6Z!v=MJ6aCn5P@stsx#uz$bpM-li4Sqm<|uPVtuC zH>oCAb7;y#^2H)~^WkjLHVWRl$^j31$W$ZMLo9pyz_f3Eo|9UsFL&g==@$z;KWIr= z9vDI63QzlzqQk%&%IVa4{=PwRaxH`9+)xMkHcb1_i;q6_@CP5H{8h}*wIg9tt;MTe z19yH1C1egHOor|tuAgPsbaJBJOcG(rffA4%QE31ZY&OVTTu;4-B;duJtn@H;G&N@h zDrT1g;NCQ1F= zeUC%f(F)XFqeJ46(K~koa^qCm8!XaC4fBBj7mDnF(q`f%v`Eps2o4s7?Z{4Cu_2nlq&Td6dR+}EmUVjTXe`46qwx7_basD)s z1kC*y^8Dgs8SZ_tZV`SlAxvS9V|Q1Pnr|Yv_p@&3!DYWFr(rCuU+5wDRj|QQ{l|0t zSYIXIK@@|EDh1*Y9>E!7-m-VwWh5s(YP3BFEPr(CPYk=`+rcy95lj2iGPMu(@(#@D zXBBR-^k?YVpW>JPm#y#HVhH6rSWBu0hp73AV8)CiVu;g%1oDB=b`&#A1o4oA3a4_* zE7AUzS4_Uj3rtTcv~Jp-IE4FD^a+NDUo87KG7&k=beYNo%%Eh`SJ?gF z!NWs?Hs1v%r?Z_2`zjlBeO6*LR8Z5(x!=oVF(K-z>d`m)%;cg{K|qO^C2=!uuQ$*J zNqkUPfmPdLj!203uV#F5b+})_#x-wcvwVc11zy6XrEY$Cn1CGEJ(}WL{*ik2^KU$T z!c)uxV*+MMFoMsSF-aJ5gBq7zhXp=qY+Nk1b^dA9@qn~WDNlWX?~}wicHrlFR~O`< z8(z!^iq0R&ubRP!TZX{b&)~vK1EqO=pz2J+S8pDT#X@UlP*B~gWu#5z3{{V3%TUVj z=HST5gW0mYuf>sM#qe2g5q&u(ngDuf$apC{oHhnAyNxER3+^FqWIq8*KjzWyHG!^B z9PlWm1*X`x3ke;Q=^NSvmB8Ud?D`Zn&;&gIh)9(!6h_t!JW9Vbri&&yvcr&FHC!Q8 z=ipFh$pKZ>>^?iIm?l?8kF7M5aWHAvu&NFHeg6#kKtDfuEyM5p15Kv<5+(Yq%;$dI zGW5;sKwo(1%M!%=SFLeL@JAI9p-i12I833XPk3PI7jOT5{BV;U2=$`y0HR{0Bb6U! zV}vPfGEyupwDjy^WW>vVYD}h*Ylc=bjV*r&ma8DZVle3VCfDDib+E_4!-U9re82n}+4$SN*csW+SfYt4og z96^O#rhwbqFJIr5+&v85e8E@JOSDDPv)S>WqUB)EqUuy@TOw)3eN(gTUk)iJ(KtrQOXb-x&poOID z-R1sQ-0p3~85RJ593q@sBltB^Q3ofOn4~0FRs`{D z4ZEUMhN4T#UoDS-=1-M;m@;} z&DMm+D+Mw3v-$6nACt;_=c#aRUob;od-z(O=^SBl_p_#kNyGFGt))$BO6|K1^=N`i zMLSi06GzX|(VTR+L7c+(DTtSgUVgC{gm2KtCrReN4BY=*68fAp(6;@ZLgr(}wJTct z*ya>{{0n@)eU@Qwko-?et6^!OL@S8WF7wY!A)wH^e0yLP1Lp;xkql&9$i7q+bh3W` z*jdnQ#aGY&pf72o8dbZk*)obGOqOsqAu~Pt)8f=RV_xZI>lw6$CwC(v8)x23`#jv4 z*Mz^-ncleq+q4;_stS@TZyzBEu9Iyd)o};SA5zwQCZ9N;k`B?Mt4{T4jLNwc)k1HVa%kt6aO+*U zRoK08dE{>`cpQBn>WX~)^35}?Y%dqCBsJ6(H$3jw{#I4^Lkueshb%X+D@VujidU@7 zQ}Vz=Dsi*?kyGF&9y(+RKQ1nNu549PF7kVBu5YF?GRa6kQwvcHqw}K;=gnITmkP1( z7PGWOtrcJ@qFkvV(s6_njI1MX?~(5zlKYdDvnND!OF(hjp=_CD$6KZO50&eyoC(zm zhF&~RQ7Tl&Dl}wWU}i$?*sr1=OH96t-5bbwdvgs+CyX!Ee{wFF*qux3Q702r`Cuw| z@Oi8K*lZ3ap-)U930wFWx4hX^w%itWKiO9y={6Vo_g-siV=I#J)h~p@w8L6AMw{N^ z5>SELg{UgRULs<1kk-5GA7HL_{R7DbI)M+T*rTmZ6F_v$h0a6%C@eRb*LVwfs}zGS zJ#v%uG30bWX7qwirRn?ny1j6z#2Cah61A+ChsXyuu0}U6O2f3ODVAYx)0OUE*dkn< z%H+*bMh-!7GT+mB)2z{5voP56rMhOxl13hm7lS!sh=y;mCDN)=6f(QWu&Riwdxz1i zu{~rulRy|s!-)d%n^%x9@X~46Czs!kmLHLfZ@Xgf*3-&T*SWNQV@4~0k~lySh(VDQ z&)e&KhHj`s8`fbDUd!2_EP_T1RO@w5Y2Ns9+L#>;DzvIBPE4W6mcQ-9=09-hY+0I_ zxVMAsLl`AWf|cK70+Wb*i!W%`;{uFI0~lmx-heWYo~gq9O=?(Z8envn?eFqyT5Tp$ z6j-*+ANF)0T(FljiOV1!@dItVUHi(+S**1gmhf6?YU(af`H52?lgz}0dO=i&_^tI6aK(D1hwZMe;f8Rti-@{% zl9}?xuC6H*N22qiaNuJs4Ze`#M(Z8jdZCp;pKja(i;Gv(-H zI6x`ByTh-SVb7bz*YqkGk@Bxth=c7uo-PT|22#uu@%D6yRmO5^!BF>Z9Hw`wb1ZX% z3oRNeuwW`1Or~^ZOsZum@q*aVEds?*PLK*mx_9z$THBlZP2&3J`*SH(R2Y~lQoH+X zK;$0bBl)0q_~rB&nbc`2J~m5%5e^@KfBYEGO5W2t_4op@uc`)R_oy3WspRI=zuQeH zREMX<;X3ndrsd_kcJ~i298;nzPFfjT? z>slnoUIo1@_jbLj{|*Y)j$uc^C1A4Smk3F3`&+!@)u&8;$T5lu7{Q!vKjl`ivAAKW z31xEuL1l^eZpVt@gPY1{;!QL)O?CQy(he!(*h)O8Wm(08Le9YlF58U_v0gXfmy_@k zqbrxpOpKKV?fW0m5sR;g%CTkWImdN zh!IUT-8`G6F+Q4{7_vkMdS0aQ^@VO7`1e;CG)jc*`x_DgD)u(rraSg97) zZ=J)gieg@r^Zzks1`msOpg$VO1!dIB3%9$6mW zpsbu_Utp^yq_fKjQru=r5mYQfCyunzbrqy+j<5lyYJF4yqzU)2Uez zR~;2c$E=t~&>2w$HW4lqZb-(62}-J`idoTQl3=5U z@BFuM*FHHs=tv9GeNtRs{C=XAKfc)M(IWE#ksPYNt*4?<+aSlQdGI{#Ss=^EFVVcX zKcuH<`TL#3#I1P)8O!K~g|kGteN5vmn00_=qyAHGj=PmP&0-O zX(r$K{mfl@?$oN;)hiRt9obsXNuCp+_XOU`UM{c1^c06bbKgF2?WfTpm$vvpQ{r}B z3vbX^Jn~ki0-{Z|o$26YLTR9xq6A;3S>E|OurzN{?GgK6RA)IjJX71RWwFSvSGk$W7D{Ov3r`enI8SsAgLH8M(Pz9mtJQ&$qbW7Wt^`=FYTjo-gvQGhJwX{5qhs{Hl-YBhHqMt@B z-wJz59auinz?mc56_d70%!Ix#Et{o(Z}_lXvM1za;0~CG>@V`EQ_oVrbK10NB^@@A z9Aq(S!&C?!NV$iOyhzfB=7+g$`$c} zcM&azf^UXTl=d&%(0y2S#Ikl72P|*9m)D>qJk*bDdO(r8&PMbhdTpVs=K0yMA`Z(E zLR5|Wo5Sxrp5MWbaklT`21!Loqgo{BX1L+n?_lAZ zA<@WD4vopI^4DnDTo?Hoz7_$$!b)jRawf1ERJjRZkYKmYpj7HH-YsJ<3%ECqqUoVr z*HRP~v#*J~4heeDS3mbQKI!%CH!UlhkrIMLmW?MmE#5OCSjaU=9nB&vpK@Xi5DjBRoe@t*b&e7dF8X6^dRnjrhG$!zJ7MVdAjUPh}+b zmM!~=-FOOC(w6TWO*xRnR!Y6zi5mM{>z4b54TgmVBT5#NlX|2B z19k|3Z1KgY)*RuH6fqeu??w4 z0TWI2ye&Dmwo%Q&TYvHQi@;S1+EQBd8qlr&1t7D*B1OeVo!SdA=M!jp4Z05fLkoAyT`WBny zrscm`3$$PM*EQx47JriT^I*TIGkmX^^1vH_M|W7_T`)T2qAZ=-I8^ zGgW+;GzHF8w!7tc-EG+Ezq>YjgVli2r0$2Xx!DMzY2bVcj%iyu{62^Fn$BqCljZ&p zCjP^reB42aW>mj+P+B91bhu^87dKmRVb)0CkTiSm0oPklbU*brQ(RT-wOC;q>;MH! zPWJ-WE)1TPbkK+d`#uYih?x?3I;g>Ri7rtirBoI!gVyCEANJg0oux;exU65532^{1 zJq~FCo8pp#4}$jfcJ(obfEL-27hkCB;%x&m9>NLpcAT`ncQd)=4s{cajfVf!oyrIu z(z}rHv4P!|z$!@$6iXlb^Hk$^#A*%_JVX%LQTm>8d6R4K^1P9S~6t}eT` z0z0atm63?B(BBvET6Q@V!Uu37b|#0IDYf!3>E5D5y1Er~n8!=7Czs25HxRq+7th?W zr&}S80(?6#l)Ur9`{YKbujJY8DErBPI25;4h?d@%jHSpLM#P_0B)RpdXBf*_K)V;T zw_Uw$$4Iy3f()$cY^JI$T0_lM%16c8+tsw@p&UxpeJVwc(Kbxl3~C1cLbKMv0ziTt zl0TWr1|Ur}2sC68H}t}uwo&Klz6?F23(PePd45~!TnD56`5o1O^q({$01|_v3IGTN z{0p=~DrZF85s@IGjCElDok=jz!SEj; z(eDx@21M|`ia;m;m`Q{Pe}kk7L5yY%0FW62Bl3X}jA{U2G!*ckAOu%369z;A2t{<^ z{{ayCUjj83K&1Cy90`PA3k4vcs)oeypDa`kLK@S{V$LZ^8Wt- zh)}Z%5K794AV$j9gCa2?BL6>t#DLJ#|D{v?_XYxhP?sv`zqyV`toHxyZT}r2w1Lng z5DGA{{;g;vMn(`6K%|1i06+k#ARiF{MielZnj(__j*8!^{Xal01pM1QAVU9$=ITL- zkQ|^0D#YDFut0PZi2?BcK$XF;-n0yfK?Sv|2a33Zh;lW=AVG{2Ya|9l;`bNXI2iOP=1`VAly2t^PfZV2K^@~uX01&)?X90*DJxscP za|TcqLecD@i2nRHf)G*=eFpqX^!tL~LJ37;_@5j!M{CMhM5TX$!~j6*{4Eiwpr^E0Q)C))65D5d9VgKnx&+_}>DkoB?QsNTC1e+Mtf; zw_1ph81sQpL{o_n$|q7~WJHuRAb2?vA@Hwm(X0`5|4$2lNB_gWg$VT`^?3ZRi3oO% z45;k?_66l1i=LgHgID@bYFG5zrLyMMpY z1xt<2&ax@3GQ4AQ;Hw{hM=<3FuUl58FLO z7Jnq9MZ=|8BETAU(2-%YveEPoSYvF z5?KFQb&3Z@2_^2aI|ijnbwWmI1w>DO$qfu87?G_ksbn|I42 zb)JhZPZUyly{G1!lCTsO^Z`WP3PmyLW}_7xCu38yVUdSY9C&R*5)xpSw#F9Ce$o3& z82C!q;z%rLZ8f=4gpmgB@5N6gO&TfG-Ge>~E&71J?1FDrW^9}^$7_QW2?3P6l>Kl< zWEw19OLWt^HzD1-w7l(*?sF2wwiu*Pxs^_qJ@Oq?{Ac92H7qLRxIrxXCM^0VRQwm@ zxJjT=KPsLzyFC^?ls%k5=dTEbHg6RY<#)(&);brcILL8#5egd!N}VU< z*hBU|z1Xcu{$N0q;4}OtZ)5jC#Scd862YSUUE%(BaE?V^h>HKWZDfZ=O~=mhYz2-+ z`$qt@t_=U5Lq%i?fYo$g_E_p)fdEth;I)o2xY{5aLOWJsu~&wQ)mytlQn>o_ORhYM zm50(7ctbshK}9^6QIEZvJskuv(5s5k12xoP#V9Fe>yWE93gGHU;G$w&0i2O5lrY>V zn^Me(<@HG0<9qlkI^Vp@(~mc^CuJ)s-cE^)OhA?;N^{q%mdrCR5vpt3@e{7d1lH_^ zN*JV%6j(X}Y?z0l$Wxt>K5FWT=(Bm)SQdwniSlb}A(NBnAsb zZSEoa)@#;+x7R$LK#MCuLzGy#mC^P?m9LYxq$|YkGPJp>Z1~BgRy)rPZ8bUUU2E9$ zvYh1E@l3Beil;|SSx^t*(uU+PI0e%`a)4R}{eV{gb(Li%_? zcOcEK>dyTdYJtAD`toIfY!VtGz0Fd~+;w1~;MiQap-RvBY<6@}2O#D6oFXJ$R8Boo zFALZ0iQfwIhIA_JzUg|8i!D_~rBJJ;<1yamQu{&cIsjLuaIjtB#*ybKqJnCKbzv=x zo>&IW+%?fc|A!A1KlRGd_0#dS1_HkjN)A5;3#=x2 zxD2=*o!GMRHQT}deJVgkA61bfSaiUaA{ECysGRjIM5^i||9fKm-wVnXzwiLsJEJJbx&SWS6fIs)wv@2LGFoE;$naq}Kf~*}~65I50x*T2AKl|Ae z|47d!`&~BI~LFDlIF~z+l&%aWRh*L{;OF8BqS&-OsXg zkTSvl)92cf#_uvlMZ0-$yrmPAp7;inz-S!rk7+YA1)a&)+vd`XD<6);3a@ED2w$SZ{Z_8<44v8$tJXxkYk576=rw` z4)Y3*))c}IDCy_L_Q|H^{2-Hw`_f*&A)iKag4x>)0v#yND($L^j^Fq5Qq|yu`LFwo zobq@mhit>AY|EF9y~N?cc4uQ2W>DdxedTNdBIV-gFYQjL+YEn&WfME|d%;q!&zc;^ zr(_O@*naVd34dy!e&YdB7Zg5$e*OdfD?`JB=*AGna(jyOG+z;kcUCA-M{_DMlPr(L^YTz1H2E2Ne&x*p%w#0Ukh5(J zWO~Y??rmTWB@bfmdBRm5Yi6tVqLgj4c0x{lZl3qIE0%eVB|J=nstguoc(Pf8y5F&W zNDGw;U4#!^9w;KV&Lbd;99oQ+2qUKKKq%tAAtuKF;)Bh~Fo?*@!}R-)MxO8*YwcR< z>&$WE2QGM&SX)>s^euj4)Te|Ue%|Ptxuw|IleoIgxM(_T0u;xa8%8)8t0mIO{3Q4I z8raQ8e2f#BmQI;I5FHKo$wb=B!PAgdJT;k?HZN?v7vYqMO56UcnSXcuCwfhxoixv1vT<-}Y+;sZA!v)n;55qIR);UTVFsHm_$vlICF+qR@$`BxvQJ`-(0 z2emc!z6^g~(h%_<@hy&k2lX~^gNOItpy3dPX;D0fy$pwi{e;OV$Q(l=0(5kbxhtG0 zWozM5f+@|sQH}9eZLWQh&Of=Y8+Ku|`EjU7c03mDb{N@`A#_=6a~N}k3~C}qcT zSf*wXMz56tfk4zoBU3SQk3Wnw>g&{ct7BRS&-*W+_Y;X;`pYapUX$*Z@Hmlhz%D9c1;hdGdJ1Bf~&$umQVV`8=-gx zwcj8Gz9|8&-3uNJsn%q<>f8E&H7noRX>_blmWg|=v0k?fWAKm&E!?M@o9wR~Ggw~f z{O|2ZX3aU--!{aYfB`?OtyN>wJ5MiJlY+N5$lOBXEHxUQjpER4+or)K5qH#{g(4Fk zE@GMYsw^}_MGbeIqudv@7GtkclZvE`)pCb+Hgh8}X9J26UBH6`ky^cQ1nrl#=+~)AcZOCEDGCpXGe`gGMyo5Z% z67M*lpKYnRw5-XtJ~(=g$1@QjnZ5wK?iZOAO4-heq_*jz-7;R_|I)6=+3-#1xO(BW zeRgT)1pP1pRpg6-hH3`t%BikBzj|Y8@mBW2N~dDB0rlc(ww|W7hyri`)}>Hb;5 zA4ZDcVAFxE{iX9V=M{n0yy%UN9UKEvUPm(XTF(+Qhnm+W!fl)Wk4by|GyCSeFgGnE`oI z_jM!*XloC_3O+^0oUfKRr1EMHK`OJbY>b#NFjY|NQ7H3C1rn*Kj^a=m^cY7AG8yxY zueF_VFMyQJ(UYb3mvH5`APyYHGvwq|tZa%R#u(J43L6x|3yhrZC=7t%mZkuT8=-^5 zL>4`y>ImP^JZO3_@MPx}cPlx2GGhf72^|xAwt}K=ro!uyw)8GyGcDk%PqD)1tnQe= zt2oZ9V!bWPiEWbx@%B7?Hy9TeROQ2m$%Y|*euGN$X3u-^XJpv%G-GjOsUe}GpHKSz*{x*r7fWLp)^pg8 z`$=Sycm{*QuBfRW5p~QPhW^`)Z`CO<3y(CfY01C;YjTpJZJc_Z?ygl!Vi4rvt3+gJHOb?2h&O* z8SYttCu>g1Zh?8P$SL}*Y-a0K0_Q(Msz#5BIe+dGf&YnDHNwbjJx}1AQ8i>z>!0MT z{-Yn%_!Hyy_IU{X;pd+YMtAg=zl<5^pZ;+$-u=5xRA6f68fP5t3WK#Sa2GALpLahE zcP@qgo$X(7-nHGu`LY<$-wh|e1oz+hP-OA^NaK4yZat6s}?3F7bA@)3A56xBzwcjFEkg3dH$!e_N$` z{pVt(Ty0ngnp0bu- zdSa1dz6pK6PT+GP)sT}JUyDRL%3*zxzpZ{Hx!!e+eM9G|37PU>|6r5nhViU^Nb$Fg zu$vznui`&(lwYErVT2`+&*fOmZeD+7d=*Oftc|r39rrKU>8AZjBfMk+T;?_EHlr!o z_6{)c6T0}#`M8)kOJ6Py6B$kG7 zS35c=J@eXZ(P_J4ba7Ku;x~F7*89GsC^pqWDV$Eoh)Afy-tqQ>G3h$O3d>Dhz>i(r zdK1KJ>QWJz!eOb2;<$Cvr;>!h>Zvf%@CxUn3Fm7*yB{&C3uy-!tk3Hk<@hA!(MfbGk?8*Zk>{9qyWW3kG^}a2opfEf7Hglc zo;NJl6jsk*SqFoaNZzjfd$Hnds8jorP*;)25|lJ_@7hvIPh%M?B(3%MTp{Yq>tx-Y zU1tK@WZj_Li(OypD$?))jrTm_5oxfAcJ&5tI5+G!kX-W4HC(dh+|hbFljL;paA+fp z9YsbH&I@tonmAeS-dyDvOqs3S0eKSgmL;B=GJm;=9%wg}I;AHS2Vp1@SGdA<>R#ad zleQxd^rQwZtQ8@jvn|Ax=Gfn>yImm_@7oQ@Brw*Ft=WNwf0`;I*%vW-=P!7s2MnBr zE0{7)a3r8zmS`AlhbVaU*2t}gxn6Lr8oq0R4>UFbx>QwJQdYE$6X z@eZr_uI)>bUC_@d^%r0sDsUGwhJJCZcctOlxtIktwZvH{wo%s>Z8GI^dc}K6!&wIg z=DNrgiQ>gizMbf3u5ebFDbrQj?ljVEwsLhgAzfx{V^4C0rtJTZthbD6b9uwPgS)#n zxE6QY1S=FTTHM`TyK%SD;!>RAt|1hM7I#e`xF%2}NW1@s_q-p^TJ!N)&ssBck6-uo zyO7#Ak=vMKP_k(}7q2VSv9_P1;gt`XY>c8UitBzi7F=rlh=^k>mRc45{YE*GTM}6; za$8CoqKrS5nDlrlBHVU$uIo03^~dXyY$=fjk3QPyOY`}xtYLj8nVXAL$4Jd_hfxqy zj#O;J+XZ?_Yh7YvK~6ONlr%b5uT4)=qk$Q7qhgKQ#jpG)GXB(SkA9*Wy(Nqlo06M? zOsbX>cbnt=k}k2!TtSIKa8AQj2ya$Hh%~tKBBI3a1XVu^TvQ2e)YQRUlHxEYdp&=K~QwF z?OZ0rvwc_V0u^S>y zOlb1>Lh=Y0pKi=nAN1oTKXh;MX%xGEb~WJm+E?`lbWn+Q#pzht6#vz8>7B^+d-LFq zn#X|!4dmNh zd3lRe=ug~z!KCYdyscoC-C?jFepj2X>x%*eeD)LCBR#n7fNEhqo;Q~dEq)2F%67=M zcAp0C%*=rMT)Kau5+=?QKX2Y#^!xWa}?nrXDlqVz5 z@-H-5*I2Y+Gh_PMi0M=Z+lz+rlDxLb&4P+u{O~W}@@b=w?12KP8pK5g;#mvwOKUkY zlCSx(CdOD~NHhV%5!KqsFX%U^%EyTCIModf4mvCX_sC+l#her&LGf2czaq!llR-cj z)m{kI@YCNb6tA^0KUR=dy`_N{;`XaeI#g|OSzW)O$BQ#j$ne}Mc4*+3&}1ty4nebQ zz;L%o%s*q*sFOV+T6%F+d>0hx|I_KvzsNu6wRVP{Xxa|OPiU%}+Jpl71NAEqZ{C(`xAmkbNyM?HN#zuUy|+>z3?Ia|7;tJ;Hi+42uP zZ0JGc^otRH?fd;MbbPx4SCq!pCcPRK7$@B~HQ&h4`V}4)DAn+}Bpo@C{_c*sSm%rP zC(YE}V009eO3~=uYM|I(jrT6W)4t9M2*)L2`gE}j^}Ik>f?qqCtHbv?Fg zdEwk5`pr8aTPs@wvCV$r*{<6}{Td0(lNamAKxAffq=r&)6YI`(NwJPl# zwA%51_FKLC^pE8-af@IovJGW~?uJ#B<=Nc^BQsNNV8~zZETNe9`%s-BuwJNg&gCgP z*cZ&(h-I$y6qbo~=$&XlT;lPi-LCozFSzS2TRrUo3gx)?B7i`)9`SSWTAclV+oS)d z6ui<_pwK!0pPM1aC0_)tF2(zPIxE<{Ht14EsjoZ%xTHM*WT{8bX{bWq&-_~f(|6jV zkUIkkEDQacRsQgIY3#3pfmOi$ivO}%kP=hDPV2`GUEgqm}3(M;)eyW=;$oGu; z=OwdqTVu$!{ockrOZx`~=qe#ylfR$C z5^69QTqnbRTeal>x|MvL&syKr#>Q8f^s?M%Zn50EqBFj__YIszhp#WYEDF8IXzi4Y z9PS54C@YjKxNi$LE1wwkO=%nc;x_b1#EtN2+tsd>^-Cr7I&!9u%r?3gzZ{@caz&A)Q#aY(TYv_ zb6%r$tY+DhUV|>Aaaav;Pf_3-H;~coakY9lDl2hSwjG zwV+3?@tlRW^x&}t2Di)~Nwwlt0)-}a1Ta7Mwlql-s))8lRKIh>k`%grh!AXTorJ(Y zGN+>(+KvpS1KX0e2;-ET#wz&erAaEn{6_2aO}4h;;s*IO+TD^l#Q;is#+I@vg>3gI zTlhCd;Afg7Alb!|%^2&=5U&mAVyT#Os~NeYxm4+bls=KO1e9DKt60(u z-nCdea5^Lwu0kzpLtfC(8UcVU+UmvjKIHo;js&cV(Ginm%NEbk%=wo_ubeU&@`yXr zUNftMNa4OLnAa*%a@Y!q12+9!6;#Pq_y72#&}@9^MHch+IXj-^z#bnh4qE^n(4a>?0yF2-RWZoHL~oM1#O1P z#$$rIH(KR}*tofojhxb%dUE4WFYnPqTIIQ*CbR*HCvl!em-!->H|X&%!o0=I%!iza zj8UO9zAe`pmc?y7J>xk?`AN?Gt0tzIEnYWg`V`B;4yYQ6PwAt}G%;kzhaM+WuLVud zIfQ={+I!_3+-P5VmQdJUhtO({&^srLA8YUsTExL7MoSQ58FEp=rY*-#rTfNUha{~ zf}mZa!C$Mye*TNQvZ4cH3FD}uMez9$`GeC%dvNJ-z*sHhGPsI71ny&`7|=%hkwE%Jg6Ek;CrfQU^-4` zT4O^i6B#BW(+_Qi4BGRHAY9z9PQ?#-T3}`jLy^=lPR)nwh1ScgbOo0K#J0an`DPFu zfy8xO1moR4@pujKZse>fP5%pUry@K)SxH0&sR9|7u_4jeY^7Ie_2BLF2;pPIU3kIW zYbMwPk-eYAssw3b(zq}1`fp#vVPNTS&G?jx7_a=$xr~)~lGW3&$KK-dJaKnx^VdEB8$BT*p`TPm(ydmjIoH73ppvD$mxoGc|OKyxuMmA_UL;Nsw5(k4;*UM~^ zuu7@1e5W5)0^A1;7rvqaUCR zxZHn6G5wnk=-I63UUh)3O|(}E0woMxkTLc z#wZU*FkNhH^#x|LDxjxV(5V^I6P;foZ1WeD(%Qq6XmY59>}Zn=7Kw_EDW zaR`@Xf@1N>TB7tm4xuTZV(TB(wSCmo>o56B_`#}AuO^MlidfnBklSw(T(T5!~9u~jh zm$k7hfauee? zp5(=rMGhRC$b$?S`E&!X;kl;Vr+FmF?(${7s0(iH#p2EL3IyGLQp+0qx`K~7EG%<& zVE4@hTyj*ustHZDCmtq9Y5VNHW~~v+LJ{S6FciD;V_mmdp+jWH4z{XlEXqdN zP?QuF@6-fR^?mdqR(>Vg_g%G6tQJXrzMR&nrSZ9G8mP?)J=1Nb}9`Iy-a-;3PBAcV-K!ma}px7`) zbP&(E*YW8!A)cZsn*z{fvh!PQ+s+zym{Np)$DnlD`L24Kz}R2WQNc-H8I*sJJBs++ zPdE|hOB^7>MJ`I&ZBB}1MmsDM^6mX7qpm|z2A=F?d8H~ir5F_+J(@k<_JIH`GFhuA z6e-(6Og<+qo2XNGZf#KI#Jp90WX3*Ig@4V9_N5Ps7V1rHDD@uu3UhWPx>8L;tPk?E z7ZO|;ZBy;|E};gW)j6M>6oa9a03K^QlX_b7b{_jXGi{Sr=u~&k;2$p3cCgQ5wF=MQ7ilIn3}csUjA< zss!2(`P*1;n6cj2Adp0)CVIojfS!!M_31^;j1MQeip06}O_US8%d$i9@&Z|85>_t8_#u~OOPaFMZ3^vKIg&v9{-)n#ugi@*#`oK z1?_e|ztJzw1$`ZlHi6-i4O-C22&Mp?<3Ng8vGDCo-6H=0AjUA*7(&S6u8r%3NM~q_ zvZAy5AZZeTL9!6!@xxEW#=b@o*?fNhws?{0gq)kViQ>=gq_T$JW3#g{TeH?>PrCF# z7c60->C2(X)WF*!LVVRXgBalE~}Ex^KrsPv}mQ!3V_ zEdSsRWpl^K0BUq6&!>-1l9saur)*=Q^z4i5R*%1ZVhB^eaWFs13Bd>`l74N@A1U(Z5~vT3 zJ^j|;H(@>E+V5JQZ*+F3{VqYb?*_87LnH5{=$9X9g%Nh@Okn7_-ryEhJn)v0VZt*| zwZ;97Oh4s0+6m$$G{?$ab6BNySy|2bm(nMO8wpTQUE?)fLYV{)R}>@Z>btoTli9h_ zpuwQm!*}~jYxx@BqE3rutu(sG^&H%YJ_L}j86zoyOfY+~3`85X2Da%PsZNC3>Row; ze?ODfR*kS=iAg{j7W(^dgL|dW5Yw(!|H{;NF9h4eXoX)OO2TzMXgTlb#9o1Tcfp6P zx7{!EMJEqQZ{8F#K_i>eO1g!#%UzHQ*8;O1;U-wM{?v>j1+HrZB zNLo!oH%GUzomO}CgZKDtMk~6AtwGc{GplJ=3^g6Qc>&--Hpm+%Vj@NWQ8Liki z8I@<`+7JfyZok~}XRrr+RLHOmH_H**FBJtvN|*>^6~Be?3%$SkMKXonHxjYoQS)U) z(>3~FOVF`@;ye}-l^M-;pl1CYlRHT)fV$uR0@qIXxj{>|iY(U!mMI9{jo$Sc{BSeW zXb>mWm?GSX-`*zv-dw}gDgRgYm;-CIn}!?Fhb&4xVWPecT%>O7GTrOc2|1>bTyoK5 z_O99zD_GzQdpr{(oVnd~_nijdq!z#oBq8Sg9)NX8cWZ6T#L~8<&j|32alLlmm$3 zV#c|{m>Iq-q+_235o9TH6;NaMV5S3A38}M;u|8wz5A^(Mb04h zjaFlVK9nR8?BN^iU>OdU#*JmmDoZ~NBrCeP=7zjl*a2GgW@y_&GwH;07hd#s8;Ztn zwK$YlM{`f*K_3fZccoEu+*wYlTF2js ziGAIFy`7||coCu}#_cu50B~c%{*AGi{@Y91n*0O|M(BjFjaFNUx?QaXWDHB;K!m3- zn^i2IJME#39^peuY|*8)-0c=~i-tmx4K+4W7jzh~+4iu7zy z^l)T}zc9fs##pg~{@;h|MZGv9rxn245mA(|SwM_n(t1ZEpaMI!vJiysiH@9Cgd?~) zvC)cOc6}0-a2+P;KJumE15kymR`kEYGnv8d8~g6xF_X?lMWhQX`G`6>pu{-q>j=G+ zjG)kNZGF-MIvbH0es&8F=zCJuOm+_EkY4=_4<`(&Zg=eL&p`BOGnBC&G3(X;riCaC znl7J8945^+EljITg*0jN$N2eql&Q&EhtcSOxN&i!1 z5%cX}o`L1H8_44u05FI@)U#PJvR#ASNUv7lby7SZS*tlJ27@7+14b}+u}l{VekZ3KVq*8KPbnpC9*!!$4>(1nl&ke-giz9G(7+d{vq# zH)yi_s%;k7A$B5!9rdVKn!@4xh`+K(8siKz%SycqCYsZdX4;jE#SnyvGeijQ2vz>M zcTINlAz&3X8l{UJq4;P|l31EqUPPL*<*(*s^A9d~;>J?`u;xQjX72f?4cXN%c~|!1 z1}Wm&jk$Of@zK+U>^X+9CjP=Td!51|8AIkvFrBbgs+5BI6Ub^^DQx}IsK;X<#}$;C z%1xiV%#BOx=2oSLt_Ql@(xOY=XQ{)(-!DS|IhRv^`Q#>%X6+?BJ;av}h%hMY?$X6i zh>bz3$q}SeI@K57p<;Knp$9O_XT1-zGfXgUg6<@bb8j{Lss|7ipH3eq-(09M$V1T> zrx1ysPa+`DuQoGSkVmrn%IRRgeJ~_e6fjuyp!XqnVQ@2Qb&y(6K#H2NxZY1T$acbafjWZ8Va%v>gQ4-V%*YN#5$4$ zr(I#%9F($inZ}pnC80&JO1cyL%yl(>RKzw-hHPn%e_TTaE4oMCe)Hby`{5zEB<%op zy}1$u!>-v+hx4TbIa&AyZ2TmNc(2B$;!Z{Zzi`IFcR0)8=Yk|jalCThURk;Cyll=6 z6<8$n;TzvlCqVHNt}rN~|^mW9oicd-Bn zA=)rEu4U4ayQF(-NileR?>4q+g8yvP=cOd}sA&1kYZl1<2afcxiSq$0OJK97y&{A~ z(=clrmfJK?QsC!yJE+^tCnh_bJvcI@^WWEU|#71e%@|hj{=S zecx7R;Nj6#TY|98?}3gtwOrJxGqMidO|dvpuUE8@;^AzpGxR`uCb~RZ2b(M#P=4#_ z3rsosVw9X_Xopek)d##w5-ioFG|N|VP)Pgu;w>mqL@OlrpWQw$8SUk8EYn`x1il&_ zo()ungmC_xjHp=ji|ece3hgBxoMkQFyejfmGw)03y2qvapXxd((L{Jj2J z?cU_Qrdd*Z(q~o5!1T(pUa4Mo;7f~OvEwcH>C^ZxuEs&VYEAi+4g{gA`JN ziJNp~$nFEFSMiasKy6_^eO>iZqXJ#}%K&iASLkEgY8fHzlmue*60c5w7StNpJfAp% zYiFiVN3GUX5;6D`dDigr2g|AAwFWum&-0}MB76Y5Nm;bMb$aERX5q^j)P z?)Ly|c^&taP)}I5<<)|ZN{o;Z85tTWz@{-O313(qez6-o_xsYbmN0f#yp4b>ww8JBg5mHb1FKUVZAO|PeX|Mm^)9&S8vZ`Bpm0;mhR%_zkWhv@ zPA{1Q=#OnzzF@BU!CISF|edfP8TrlF#hN+weHQ9~`Be3OdL zl_NQaqXXSBd;JIVe*?ku5}BFSzKhWCUu`GH!qMntnh~;Nx&vEt7bS9oPo>^gD1Rb! zb`@4uTo45Sh%{&($H-A?1?2Y2VVUIIlX%#jL9=zr)98}E>Ea%W62DzTAFMyNn7R{{ zY1J!(s07{)hu98$qWc1=cE5bl%LyRe_0H?$NQKCYy#KNiP?{F-`11k-w%t5-n>hF; zh&Aa}WBS2$Ty+_hZx>k)>W4yygow8RiFoPB*rcJ#qv|2OA9<)GziTs!5v_iD<<@w9 zUwD3yuY{doX}1?yEYJDizO$m7hIyfD_aqR|;#OY&j6y?&1zkNR(Jt59$_u|A+}F=; zY}n^EOgJUQiKVef)#erz6^cAiFo5GQ$sYH~mygc7S>!HYqr-81K(=nXTme?a?QxQz z!3y7FL7bscc_=c(L9 z1)vGuH=O6nt)T~RLR{>qCnLrkTfb(qvm-nzzU=(1pS)$$oqA}Kx}wQR(w9E$znpH{&i{CziAcGcm3a`<}O28K?m%Cud!$c4=yxYs=ET z-)cglYob11Q@k~+vMVD?Vw&Pe)xU;lH`~OVei#iXp)jRaNheN-T%^`aiSestdzMAH z{)lk@t+0_qhRnm1(fcZbA(Q(kELfKC2hVv+WQD3LpW+bVfgf)*u$lwblKyoC1Nu#R zOU}p?A5_&P*rH2yW;>$hiI@Zj*r74n;~fcT-?-4;>A9(?P&zpk%CG$NsBa53Lk1auRbFdVUq=L)3gbKTXp}@nJNB0=} zY|~eW3)ppDaPV96)DjH+is;A-$Q65 zd7me@o$b}N(TO4pJv-e*C`3wjXFTM=0D4it02>JQhey22qzpZ1M#Mz^oQ1;=GJWo< zegZ#8#Q9cZh7@XbXZt7?Caa!|aM5VP!Y2o+Ev=wivVE_xEpm&`Nguq#zUn89rk5S! zjgnCisAB_Dl<0}#hBXw6RFny{J6KXTFEiwOSqHR&>?b0_-;q1RZmt~r5uH3p^WaiS zvPm{56MM$HETOh8wERLlwPDgMkSjNfRyBYJxWi&2B4ql7UGEDTX&)Wd#L@_B3>&7G zE#_FhZ)-8R%2zxJpoij80iByrmOlH~2dNLXQeKGt8z_>A=6yJ<5{7j8T2Xo`_B9KS zGKHOOBrZ#Zv4G8%72k!kVvJb>({?CEQEim4drzx-=)L{tgpC3`5IJQQC>xlSK2`Z&MYM&?tWQ&w-Pc8mD3w`?N~-hI&_T5+7uH(pTYT>hS!V zAq-J<%`ZaDk)cE%!Ztw}BeCF9Rq<*pm4-6L1wToWA z;;paxpw3>znU4ED{g4Avz9sOuwkW$`d$ev(cbMVj>+e6~dHY!#VJgd2)*Ab%F{9Yy zolOdt)Ms#b<7&fB#_wigsuuP#b=ji4&7N57cIHumaSxxessi>eg1z$CNFFD>iX)^Y z(q>_th#DBHL@VY3v%}J-J|U`hJz+kTUEy2yqyd{}2GpFUPUG~1cy)b+6nydBhwk{t z5V5qVb&PsGm*J%{{bY{pnK!^BiK|Y<7o-_Y>`Ib7bx_wS zLWX4PqbyDeOz*EDjC`R%Y8^fVv0Z-VzMfatF8*hS)=qK!8d7-vEyY#%X$g#+cN#S{ zDjna1cI7VYW!Hp#a~ToS;69mvE2zJy`1MDyY(Ha{QTDqJ$S^NNF9KOLy;Exl^(YCF zZ1Jcsis$!Dll)lRDN|of<7}QMn+uboo@aoZy~;I+Xff%+-vLA@}8CoDK6XZ~H_}arh2ppPV%-F!ikkUHO*;gTkkmTvwDcvvpl z-yitF=ofTnv+oNg{i{1hMOb`DLocUf@LL{qbzxRSZJ|qKIQLWbta?1zxSs$&iWs&OXiz%Ek&z6F27zM>ELn=EWXZ_xd*3hFN8dH z^d0d$wq$U@v*s)_d^@rs&$(q&bbd3x3O{O^vn0^{IN;%`BFnxRUWXAVSXAwL5Fkpm z9Uk1*EH(*UQAi7!XUWW62v7x_gNQ3r}|A-^$;4v!- ze6jA_%07Q7`eFglyFrwbcZmND0SxFv7qe)4YHzfNg6ws6m@J1&xz%b>%!Z3C9u&`N z050S0NqK}TgDr7NEc@P)+Hc^RsuHS4FYG(EkyBno$+PKyqbF&ZkrPZZ+&mVe6no=h z)R55ku^D!>P!YHkzCdvFiHncsz30($96UNU6WeN2c4rc^)Eg`SCTZDm4^1dm4iHwi zc5c28EVa(eNRP5s^hp zjq>jw=I~)Isn|Fg0T0MM&dvbB1-ZXJBwucN1=2YLC9oLU6x|=P9+s%MQx2)XLrJZZE^%c8rWQ zNlguXOIyS#1w+%o%{VoJ0;D2G9&*{MFyZs(t#00&&CEA{6nI+^5DH17I|MLSB0cG1 z&~Ao2V#14`S3`^?I|iO-hnZg1zsT>A#GDVrbqfB}xq#*c0`C2DZGm|+(F72G%Pc|? zT`~_7?CW5Oq`eORSVGORctQweMWZ0H`~L)-yVq$b2{DjZav2R_?_}Ifahq6`md;bshu6KGU&(q#1++&g-UrV|=_5_Qv=m9lsL9 z=@6t7CWO&gUYVTPXfPpa4A$N&IkAdtX}^%G(|own+vD_Ls5M8DSmq5cE#?g{%sWUX zHB-eB)FH!1OY~w~Vu9lc%q?!k8(|HU^oc!2qm0-@jO5k35t%iHNkuy;LG=gHnb}My zji*}1LA93*&c3{%P)Jl-1CL6VLgJSwlK0~7=&V#6tun3cL?LZs7(-HEu;uZzf9MNO zfHP>$SP|4a+bB}`o~~Y^`(0svqksS}*Tp7|h+*h(zQQGh!3sVVo6 zk#ti@!nQN$pht#x$SH24=GTJ+OZsT4@%tistlk?*@+`Y`zS>ts#auxpf{)ha7;j

    xZrEd> z6;YY&SqF~!+uJFZEx#cN|4#H$u9ki*{jfJga4W}f%Q;~cwfNUX1KJN7C^*uN=hmF(Z`7JJ{lfb zx8ag_6}wHFmQ*VRtCfSuT0Pcs)+F!_gFvxZ=xmgx!LwFM%HZ9A;?hv|#ZjjY$J>&- z6Y*6!{1j4Z+=_~Pzb9Q>?3!As3>|9HOL)$yW%w+eP!Ou-0~0AKW=%Utn+?2!lYk`> z@IA-v;blOMuhFM99Hu}8w#hM2A+}lat8dn`vWI4VSM22M`zk0qLqbB)O^Hz-zP?Wu z_(~pvlig2h%1bun8y0OLok*poMr|7pe#oy%pIwE@%jseB9~<;Qq|Z8bb;S_@k)^)+ zlt#4bZ8Rh#%EmIcqou(m{lA?usqwk%@d3iXvL;mBNo`Pw;ys^Cocwx3u+Unvtf+|T zM`a^nHN9p3ggcr`faocR7KbYVjF@AZSGut3X`jMKdXb-cudG@&t^**59?J4Uc_6=& zu*7zsiCfYB8Ni7xiaNwi?P^t(qpH4SR@gbsIVEIVKKD9f++&9ow~j`b&OQrIC)iM!k_J9oTELxEh7?R` zLpf0pg_%{`#vdit|N6lg9NJzvuF4eNCVkB>D@AaxnQ1u7M-0({l38sve%f}esikPjEY3-1}lHY9_e>Qk(asQu%O^Ul;s)%B0p2PPR&E95;LS(IX%dn zR~%s#g8hX(x^GXW3|r$E5#1R>8~keKBaf7E{HBTLsFPbsx?~K7eTw%f>mmbiwGyG4 zsT_d7V~=Mo7RDw-YZFF!Dbtp&sifD%mSEO)5pHdBZiC{&S+psnuj3>(PQBaHU@+v;lt3p>@UeuB01~SQEtJTgeV_x9 zC$_r*41@*{@a5&_&*k_W3sLI;oB}`r)Wm56+HcPnEedRvlj!O8_Ieo|$vPInv4^1& zd=xlI`c9xTF0qN5bC)#vGo-qhibHZ8sZp6BJh)1;q=}l|zD0M;S2y@Cp&DP0L6g58 zTJ-a}0|&f!r0iJs-anoxYrjvtv6y+Wi_A5{xgO36@3!LS}+9$GjUR z(${S5Yqm=<#;?~0eNj0ydk7n*0o}E;7=9F{g7N|XM|VQ+6mw5pvR>}r)GT{{5+S+BXX4(rYL zb-K54IRT1s>?JP||D*c!_rH1MZC?aR$68c27<%$o?_|z>clui3libsPt)Bozc*Cd~ zp^&+y{1>`wUUOowoZ9gkzg(-e8UtYiDdHhLW!JrFaqlnu;#%;YCQKCYYHs;!A)i1ap?V z`gg72+~(?lNX!ghOIcomy)Sz-CcH0K)fKVGoQ$oxk6^5CA9n{|nvk#ue4PxIe;rS~ znr=$nly^;8Y^v?2_=QeS{|m4f0W~y%w%#~MhB^ux#b&?2bz>~^9cwFP>o0ImuD22g z#s2dR#(e{080u0Ysq9WZR_GSah{nJ8k^SvWgUsE}=rFU!xiN2C93h?Uz8zoTv?-Uw zt{-my8XXcXybQh|2Oljt5w}8rB}z;J3x2ptF2T26`b~UUtyT^Mv5ThMXj}{p+*+t& zVlR&T2U}VR{Vx)Q9QhWNCdZaugd5A%-EGZZxSV`8QM-|M{r`}CE)Ao~LJF<4v~Y8N zD9YzHwv_>I{2`fn)6!D*O?K{Iw}=+w{cE%e1;gqe4U#P<^4G}zL8+NPWq%)o&-1!z zCm|Tv_zL1G)R#E2xn|mc8Ot4E(iX&CuRPocfy)mmraSIP>+tXvl57ngbcwmw*G&zh-N7%1jN`%Nsp zY%6e?;y5eja>f0VPjsXeKcpMKcn3$@!-`^oW6?u?@(fJ#MSsEOH*N3W_vtfw`5^RN0D=!habhmQ;!tm2i$t|fF71P4Uh zYDuw^W!%485!RA-#^IKui>$KWAsu!_Iv%NbtGFtdcQW` zhMEAq?{5nt^El5rGjmIrGoE4f#WXW^Q2gSHyhC^{B)Lmh}?;EDB8hE4!5} zP~4FzGe!krG~~`I{aD>l|~?9DF=&}a4d&*P-gDywNHykp#*t-kEFYllE3I_JHn{H1vbKXL9w z%uASLZvq+2H@7cd1hZnG(V!BKEFaBwf{NYvjkcvKhS5bQ%ZC+bVyeEH(pcH#;a*XW z#IW^<48aNvq!;cyGLT6Nl!Fp45-FcE2qXO zf5IV|RTa~&4$D;7GCu;s4{v&AA?`YB>i@`V*d$REYgD!E$dSES;qbMNoQ;UDrZ45g zQlA&&#&>i>H2%i=alw3?(X(5crO{KH^pXIoU32Kt*#L5X?I{)QtN(|OKnKO!X&}Q! zOgPCSzHkz|-3ae+WC8H+$>xiAVI+&z{QUL~SElsA{Jhm53sD(q%)$?F*dN#hijc_d zV*A>=`Wo+aiWG#0Nuv5wWO+nWd5gv(Ez!oRprW0m0Q0KM8~>wtvsq(_+)13Db+Xy!loC z{PHQ%diTx7{chyH|CSDv^Y*<2p4!)&K#*RFz?{*xQT0fE0HL(Vc!4GF zKOA;6X&(aPjF{&GwXy+jKys?}l9lzjlXrbD31`oJvK{V3vk`Isfz*>4*#D@boqP%x zLPYMOBt>7OF`jWyVFA++y=#3n-pc&>tZ&BcPrGX!x<$d7;)4w3+h`J+A4MEFB&xQw z+jBS@#DCB3qg5r-_n<-sB2pYe&M?HkbAJ&5{Bix(XA zM^YzNya#pcKYy=eTae&S+AEuXo}>eKf4kV&ZPtmiI;CgDs(&s-cSY}kc0JA4=2gP{ z!IcGzTx$G|d}LL&39S6%Jaz2@?&S$QcC-H@lz}IAiWR@mC7 zHHpgOlFZl54=+kABzE_BhW)`mH>jRDS;SRnnc)A`hQ=Dx7PAR_Qwx2S5}#fDC+2+{ zwkyzeOxG0fPtHejKGq~w!6_Wrk@P{8GncLV8_NJ=yO{>VT90ax>TYeih}iFqVl7kaRNB7%z%s=d;lv65mTbd>o5Y99YJ?+s3{`^41v zeo-MR%%1Ad+Cb zqoc9^3D>=p9s8jG;~LD)c{r5&qP9}q<$iu+<`n&wJq<*rswRua#}%&d&#?b7W}(89 z)=rvqF|20b1#fqk_RfQ++N!_i~#nMKt`Uf)+f~j!JbN^34FZml$ggS#$ z^vlo9lwn%#s)rC^Y!!v)j6Vu*aA0=6lk@C?sG-^w1unoIyBc7EkX-$BOt%G)ev(C& z#l6Y*ei7pTQ_{N(nb-ac)0HC;|F?FPHcf@BTUr0T&BR9f2M@KaaUO?_O^Fz7a`z{I zPO&`6ApDb!twc|7I4seGlZc-iZQ4t2#xRbK2CMp5$Tr@LmarXDW069mY?P&bC{PKD z$YwlR>HtU{Z7Twkh{~Z;tOqQTn<$&U7yCuKAq?$b^jsYrh=egCpqKAhDfZ*c%YcpjXxhw04l` z`^&WMvuTzdmg!Wg)>gTaFsraYYx`#@m3Y%+>?LIlhq-a}?-J!|RP_wT?swf?-z3I(vZ^A*n>_?2F4(5s zYxU{+W)`6JT-`$w&$-RYL)QU3^@)moHnCFi= z_t35j27I@CORZ6qE0TWI$&z|?^!05DqMk*^+HK(F!XF-c^=R&cd`pNDnEOWoQgF=d zlCnCW_WQ&qe5cMQ(44-hU{X*LJFEp89C38l?Jv=h=%w|PDk3H1yduCBDuar7T5!7H z5=n?zu8l&LFa@_|0#b8=bcv%$4G3eYasjh>R;P214ibf-O$v6QXYCW>xy0Vd@)Hi| zHI9euirhYJTQ#nJ_2;d#7y01$7q89?4VeKksyLu(;+8iymCZ1=kiNL|ber6!&a%*~ z8S)c}Yq+uM2s?gW8JFT%K2Lz6bmF)TYfcprk?r02UI0*oNUJx2f{k0k)>i=PQt07x zE8QfgP0U4`-u!<6WI&t0?zOiD4tQW!%bDMIkmYZR8Ftl>+c_s#+jZ29sYx68LqxxRc3n?u>&jhr)= zT60>{ClP?C$IR`uJy)I#l$|wWMmPXC`sRZEt@bsJo5rW#~wDbJtPfD0Om;yYz87s!cg}lk^urakV-t$ zPH)2|hD3paAsYVo*&4bakn8unu;0D!R}88mR|2dUU3kfDk|K3&{2hDd zXys+y`&|!>4QuBxL{QVEh|&eD3OHEE4tw>oywu{jII~n#ZoN0=8`$O-C31>qW_$B1 z?btC}@k^}~JOEVmV28j@DxlA}`5o_O&X>in4@X*)zL}+x0}dQBJ3YP*V{$;jf@6n1 z6TWh8gcg&Xur7QV<-wv7YypfvjPGtlNd;hzHuNx}K+c2HUT}N&!8Shg_iM};jM@AQ zD4l0`tt^J7I|Z zUSapNY_z9-X2~{-az5vL;^gA+vh$vH4&lUkgzw?P<}z>A4(@S7l^b&}UtCUB>zLBD zE|sN#<7IBGN9}#fAyKI#T8SX78yi@x5wUF+lWi5e>f8Kp&)>H)`~H82@j7A8?l?U3 zq_WXcvf9#DNi&qC%cO-6>27*Tj_xa!izG5+rVJ9o%9!!dT}VmO3>a1z!z9Kd21XciOZTwCs;fkbD7wg^ z4Wgq`u^)mRP6$(HAf|#Xr!&9K)S9Yvo#E~8*J|u>IiB&b+H|L!^}=#na^}i!7A5PY zb&C_18dFfw%_BG1RnI-ZDREw|-W_x>LpnJKPkUF$KU4H=lq&u6~Ls%u(JSMR%%VQw#6KEEfcw7bD& zPDI|3YAs84m0GITY@73nPD*V*G_7G+O&#Q8CzjOQw1)lQ^DY+$FA^*A{}?GPL6Xvu zQE13XMxvmLNkx(j$joLHz&?CC>pedIc)72)?>4g6pW+knpT?qQ2Q@6JsU$HiH44i? zN-V1_jY9M!KA6Lw@44xgf2BE@ls`N0mW=T-NeSuxo~PPU)s{sYP)in;mb-+gL!9%V z2I3>f2io z*U!HG*YES3*Y*A`8rJXmC%zbG`h5?5w%VwYG;U7pmn(#2-P^72ZKr=figRzHfu}hq z51T+SCiOtxQZq!7cu2tk2$BKdf&Til8p~sA-O`?`wHr*^1x-;$j<{Kues-Ij{twTt zD&<>G*TtT7#I7pqi)J2iPB1KkT*I8=oWfx@>H5c`jZuBGPF(u8X0Ci&~#k z_*lakQ!JWFHlm7>(Wx?7nj>mTHa66nf~(cFzi+?a@%7@-=E7*!gZgIA@HT(49-4MW z#@lV7O02@n!=WmdFoN1fM5MEl$pW~9RH}v@%En=soWu;}6tylML_>9qs`7>g0ptwkcLLmafTKpVr3Q<-zF)|{=(%Qut zVYNnBm696%UjL34ELCKW9BE5byVXyvrtqdx*6hx4_u7|cCJVk|clF%$;dnTA8IO8JdzPsHDi4trm@>v|^&h6tv2T zOl6BQW=`Qhm)3s%zW;iDeLLgz{HlC)jLp?!5Nj5thomR(JM^dds($lX-`q1KpA6@^ zkcYzoC=?2+LI{Eh8dghR<;>p9?sQPq?WChfjz-RMB|?jl-ZqW?2KoGW%W9fi&eywv za9rfHnw@JZpIKElH---0^lJ%WTJHBSBMU7Pui6~+}}r=0QD)Hg%I z*4J5?*YKZMDQZ(hYD*Q0#bnX7MT<==GMTlL8j6WIB#`ocPO-n=e;X|(l)&2WrHBXz8ea+Z|A%g?1-0m;Q#?TA4Q*KQ- z!r~2s{qwA`jBTYDOp8K1jTb`_C( zj$e6gBWgYQXRiKz_^Zq&6T$1#uB7$BPE|JG!}Ds5k*M!1j~;q;0AHo&T~xJPl0^ zvqomHpy){_LgYe^v5(}s{Qh1Xc71+!BeYzV-anp>4p*)wVd1p48s0Cij%$M9bb8MpyepAz z^1=Dv5z5^>WY2#1PBMiQ%72t7r)R%7jxth%D~ii0Rv1e%W7S_Ca zxA*^u$)uGl8)lK2YDzSSn@ioTUUmORf*-%bKgTjq5MWdVVlgCnB0!RYSko5!?{@M| zkFH;?_VT@!wCWZqnx>2kf<1jK1LA20v1`TbThb{zF6|tWYno_JMU8}l=XKjyj zMlWBh!5Ld|k4~_S)RQPzuqxJGyMFKhd%<@I5)}e28S%dw-?x67L=8M`QlmvHR4a`P zBB-h>Z+>EJ=J6u0jc`)DI=h)e2)ybRB_1nUd9!-9lEyZl4d^c9)k{f_hs>KjCmy`O z?GX-toMC>8WnnrzDB+?D_rQ_dAmQ8}2QJ{t-aB7(uF1V)1x457^38F9{4%I1^gKRO zH@f+u#M8^bZ4AGB-erBsl!D_!d0ls97IQDinhNY4j`h!SB5#IW~oin9+p$ zhv7c*&HFn$zOFT1&onI(>XoSv$GAG1Ea$RrV8nOZIhIS~x!*o-k+)fI6O}@uRcMg) zeL?aX-I9W}63&-v!&+o8J@;-g#IE61STlQqy~R)nM+RdyA$KR z_uqZ?W-7C%?_>Bgn=aX#t(rK3@r%2a0(JC}>*l8Wt~zqM`|413AkIo3c&@$peGbss zISan5>^bz@Lqa-hu8YZTRUc-J?cqyC!{CjNpW6i>{ylm3$ca}{)ckqV`HvGl=*NwO zC(EDbYQ$XAwG>FqB!Pr%-*Rr(C>v{YsaB;WVx=-^qSQ6Ix;4`xDOC^_2q2`1+uMnn z@!qp~((f)nRdO_}bXaC0A|G)11_tOm%TL){*VCf~=5c(Rt>sr%ar;^IXd!|iuz~U% znP<)`MZ=bo-ia{m^2}PYkDwCr-fuN8y|^akW^p1Mg808Dh+(t{&D_b!!(HSz9x)j- zu@G1wkwPsE?CDPUl0u)%n{HxV8ddOSFS zn=uA3gnn_8 z$411^f+1jy4QN@THanxsyt$dqZH=c)9WmC_WEM@F=(sw(vfL<5mZ~O!RR&>(3CtLE z1u8n)G|dYYU@NU2??t`mmezPDih`;@o0y^|;`cSYw=l?HJ`9%UXt`WVW?EKj*@JrN zHRgu2QxQzdZA9MH3@*hJf^Ruk@y8qlD5P>J_&iBVsb6WG6x6(^@#q4Gqi+aD$(ai3{VIlonatg z=Hd8(fNca2m)C$PbhIKAN+j?g!YL7h10|EYa%$#v>#w<}sg#?gEw3>;l@`T1nsE1i zYmXkL+GIRpgVt6@u)%>5kW(92xVlPD24E~CLU7SeV#nw$I3O}n2DCK|V?!0erNEpc zXk|z+(!$R!N6!aH&1UGH+0iYScnPTI{L+fQ0KxnH-nHK3zjJ4(u3k7moNbkOAuE45%>%0K7k&OC+pk%Slb8oe<$PwaZ^aKVjyJ{X-6XFY&8z5 za}c7UrA0=lL{e6CqC&ZfDQiB+0sMT=&)=tqKE6nGB&-MRE4KbETK%T7+Wz^qHvQze zZjnUic6VLcnIwC>V@Q(~GV5rXiGXE8`D$Z7I_nqsC5hnZ4}8bZNP44^mxd)$!z7OJ z6zISi=S3seWgVo{q~(yQSUlyAovXYnB;xdB{rh(F#V;5v6S;QLX^P2u=^bGiOXKTE z)J##7xAWJU;;F)3J$_^B3SF_6F2c0uV_8 zf1gjbtXeHC7kCN;DjLj;k!vv~C)e}*wzu=>U9n|ed(gFt$~Enw8Y8ctooubk^Xo*> zdGC8eVexy%c$4ztE=ttrI-gD}j7uogoMh2j4ryP1e|?Lx?(@oiSMiv}F^d_o0)!0} zCMUgXUq7EdcYb~Qy~Q`0&*9`Xcm98w>#jW3x8bk$KnV^U`ce@pBCe1{sfwk6h*6u8 z0DlwlO`hxO1G_fF0MD8A1vCKz!buPJ-+@Y6ppCYbW3b5#n-s}WNm6Z6^KGTA=lNO7 zrhIzrotE70{nrxYxje~!+ZN@`$Jc&#so7lbC!0poTd`g38&>U^mh!s#^|#L`@jUU2 z$mb`_?2hQ)IZW-R=Ut<;@4L2H*H5*72878#OJh*?w%YZ5e~$e8?T7gbZT&b05A*i( zmh$&F z^^3TE`kwRN9)ar>g7rN)u-+k&YV&@4$7S0YUC)+iHIrALukx?#(KRq6s$Q+Nx7Vki z$J4__{|x^AG;94Nfh3+E4$+8}ZMG&=8A-~sl@Ya8X)3g&RiukkP~`}r6|*xdQK?ef z^V|F1f8LPTAqIIr#UjYUg_6>&N+_C}AruP(H{{j2Nb$wX17|CI^;=hz+gG{LE~5TC z&%fULRoHcT=Eb~Zy#4b0xRZt^QuOIgtWe2LyYus07bXiL>wdGE;J93BW@oQ`?b$BO zN@YW~v{tc-_3J4!=|<5c;m^MhzuW%(^Hka4<|pyyUvSO(d_EKsrL}4$Y-vTKTz>c6 z6Ei9AZ1wuglf*xYQL3!TB*@4{efji+39_A6e7td7uKW7O-`V9G z@mH03@7GPLTftG3OIr`8)6VWirvIDSy^m^vS{r3hto-94j-Q;eVOmqFhJpUR4bvXr8V+fZWFXcU-6CB&#W{qVQ+AJ5~D5%=Bu_IW-KC-FT) z<0DZ@H7rUM(Ile8LM&8KR9R*pKJWX)<9V1a!30H>%k<`rj}Y8Ri31Ry#!X?U+eqaO zNz1tJZ4bMen$&>15qidb{MA1_@$1(uG4_-46L39!dh6!;XWcn;Np}BkeB9peH+(yc zR+OSLh*VZu+R9SH-^}(eXUsfj^XNbi@1GUZhU>0ZomJqdsI8G$K}eu70Q~Zw$JFP@ ztIcS{KKnz14W;a+U{JA&8k*soVM}fe4Y86QXfQK;fwpz;N1Qvmtqc4PzCfQs5W4x_ zH8GvLXnqRax}+@2T|EzkQN* zn8`h1d1`u1h$IpufPVlA6N;+EQ&xalrlrE!Mv);YUCRt3C{&P%m>(FxKn%ccZQ~Z>mgq(TzxbfiknBw~Pf)i)f z3nkK=k#WIf6vgJ}c_h8vpRPdiq2xK7rst6Gfj}Yv%3`2lp;p7W9sz0qps|y2WGXC@ zIGRNkO$;i9X|T%022i;yc`bnrflq=p?wBs4H}$T{RoY|w z=065BKhLG8F}h>INF?8$!9wCUqumSU$FdGW#SbDsPu`DSlvr$`0ox6U-)?rC`dV-} zLEyy;SV=s&rfGNIXVQX z=NIl5m*T%Qw0rjcmw$chz1&%g<3~a`CylU!kXEWTp|5V%nyc@#DT+1n1EG#yVy?+U ze%&>%DE6`@Bw-nmb?n!g>qJ3eKxWz~Cjw)jLM{A0c|aYavjZN0px?cqSJvr|@!40~ zcnq7llhG!s?a>B?EMT7DVlFqsAxn2+K=9o>$5HTGJo}VfG$qvUqT3wCgiFo#tVnkU z)8-yv$N+o1j1yw5qeKtTArPKWv0;s%o>H68cP?FAWfM8SHNoS?L=y&hC!#MgqJt|9 zfQFRG&G(;Biwj4`EU7SoW9pnhg^R<0hp61O&7I=ZnM|V=Q!6CO-mJ|Nsdz_%3Mg#U zC6XLgadb*(0f3VP^xBMZl3^!ufCCh82vKk#5je_IMTQ+26+s!bRl~JWIBIG2En%?i zG{-_56JfKHs_ScQ@V0~~o*<-?u$hr#q0t9xDOksRWF-98u6w}Sw_1-@<+jSN7p2{{?CGghf~X*Qi<`@Bh>D`C1WG!PLYwAyoP0}n zu5)20UahhaqCoS!ZQwxKHpG>3imTd+y;+%=c`2Gg9W|}iu!l6-oJGu~wnS?d1~Nz* z3${ZXgQ;`pzU|PxRPgvti~XMU0PguZ>ozs)n!XJCD?!l_X-RplG!4OG! zfR_|SiuE)KA1ovuV%ACVnn}x)?rWG_9*M!)4!l6>(D;*pmUx{!5|cRoN{>|4uN`#n zkB<1ekg3!Kh0MrjX*Zg=gT{CnL`oKwHtf|g^Eu^O;me!L-gCEGK^j*I`02txUX2o2 zM3@#Ru&v*0-*f~-7a-VCg1o)ByA~0gXBm>ZnL6>EW^pMqmT`{hHQwaoH={`mQZtgy ziBZ4+AUSGq1f83B=+&&98basPt-|OUgo8+6;54KtXD*=Kh8%_ir82N>*y0?<%%@Jd zM9j>?gD^%x#>gZJZeDt1dM0vLtliyVXkb!n6Y=n<_yq^j_G}0H$smeI5ki%SsEr#H zrIaaJBs}M-!_UXBj+fS3!&Y3cF%eXmyg6_WxaK{W&wS1Mdwvq$uCP-*p86cb@y^z~U?{@2+<5uU&ZOIj1GA{I_rA zBkrNgiu>Qs#?xEgCi8z9Q~PFlDk6BIEh|K{s*15~T3XcfKK7o+<-x#GlFC9&k(MsAx%#i4)%s=dyFo{POz1^#iAD3d1Vw+0Nn1zp#OjKe7EkeD+-jpNX?9W{KVr{uSM2qEt#+BU&X^io*_vOu47|0RBhy z`5MT$@YTJwd#l})Nib7M8@RjR^yl%&{3Z9m9tmawv$9 zCS=Y1yhzm%2&llvu!mYb>^Z$@NvIl^*|{v8r6Qf@?e&M9=vJjW^TV@q zlXB|<77!l}57nO}B0%ByAFk)D2VHrd9R#y~o*slhzWLZ^nydHCd#}mNZqxR${;$d{ zmRd`Ri%_jIBO{kfQBU>0{y(67e4e|v?_Kx8Ue99;V;IITViN*(@&;NP*pD-j4PkezQGa$oN}*7=ix3T6HM z*{*Da$n@+Fb$ttUyDJ5)B%w-HT3@h`_nyE#zOzmK`eE}P{`<~tcMbA;hh3rM!}=T5 zrKO;it*J>0MTVxyDiqpV6pF;utt}BPY*70?yy1OLzMA2)UZBhT*%A)8|PZ*@W#u?ghWfuAUADKu>N zd;1{_^Xs~A@7ieR?u%MmX=!TFEu$$=wO7fPhtBWU(lh&@dQU_|K@tNbAP5kE|4G`B zn>61W83!G?R9*v+yRj%Es}AZC5g2pn=+MzA$ItBszqj7vZT;JwH{T52SQ-w1l)v3I zso>z=pJt7pWG4T&e@pm&r{A-=_sl=0mu)F33@Ee~uwRGv6xj20?C1b+NJ;&(7NsRp zl-Ym=Fbg3VEEtLBn16qNe_wyP^wx>FtT0!<#mT|t2pDX23HHP^WW(kcK57~;@%to= zpWE|3Yg^aRu;!dxpT3dV-?QN&SYd$|BMc1C)%bkNuAYgHeqrxv=?Hl~=%Zs+Rh2a( z2qciiEdCCD`^|@VM~3JiX7pD~iV#7V7t097kak^G?Cu+Xp0RelE<72-LGFeytX?eosTi@oMkkU zo85*Rrd&6pc_|FgRYu4Y5jaZ;K%pY$g3eeABaBH(>Tc{s-PY*sB@$vRg+#VKl3%#UI48SjDZa+{~2)kZ=-+j1Vr;%bGKLN~? z@kHShAka`?h7X`U%pM)j^N-^#u|B&LAz%q9ZerSG+F%edYDWm(cnBEoOkefZY$IUoOkEH^RPMrPGBO!|1#c zLWs|4HunC3X~H`G$t|pwHv1dSuNKvI?h9-z6;zC^`O9Nxmy)%AeLE$}K49J5rE9+X z8NwYVe$Q$8URbK-+xEWcnfKp)@%iPupI)NjWSD)Jr`K0qGU~N4g8s){_1{__L*Fr% zo^)yb^XD^cz7;4}FzxaX+Z+M0@s>UpDCU_MU}1xQF+Pp2 zHS`SnCX}eR0pi*!x|9v#>bF(A=K2wX1Oy`il5zF%_j$_!tJPFqF}_}QThasKE&#g+ zA)A6;*2iFA2Q>CRNY^ zYZVhx4)WW)qKK-hh8^agFwD~A)&bBrf|x_%vIuC-sESx@q|uNyrI;Hgrpg9{$dZl? zG-wmg2Ut2JO>J!9U&~NgIUm&ws_($#*&uICPY!T!)SEL)PK-Kmw4~uTb;C0(5hyV; ztGZlr=74ZxRM(2ALW*U;0|aZ^(8K$_3}ed0FEfSj!mhsf?R;!P?|$s6`Td&s5tJq8RyyHNrFX%0@3(b}S1MZc zKx*YieEc8ob3OY`3+cjjq7GPbehN;o5*60BtkceGIZSZ1GUD#l5u#CNp!&=P1T*o# z(AY?4Iyl1UHW8!>MxTMkV$r?n3)ROOULZlJoYDm-B;updIpHJm&u$B1ht*0wCiae} zvGE`CbuYpSq_kH zW&>@6Ojxre1|Z|`ay?oBjDV)=0V)#-R4LS(@AzZ=;oq@+#L!Tl1ajZRRoi1!k#}z^Z4)N{WhBC&wSMR(3)VRJ`#}-K@dn8 zDN>Sc@r(J}1%mLpTvc2`G~!Xz42SS;cEFvKa+CofIFissNzY&h^nX_U>FNhoL%-N- zwAgQ%HXypvLqU*~)vA6^?%r;z7I02Dgx~iwK*_>88H&~z5oUOR=0^XsGc)(^-|1fa z@c%tGI*~KS%!lLq3njbv)m>^%ARroM^wohO7yDxyRH_Wv{)MrNk-i(RIj z#nWv?yI4PiUyt5NsWqwJ)cM{*Z(Y5I_NTLkvU~l%S-{=)jRvf1UaKRe`?D9jSKt5- zzGx%&m(M(Zc~^8ql&wOvjixD!LX|5~Euf8Ts#Bz~>SBB6@8eMOp*%Q0LBAib-J;rJ zM5GwAA*l=)#XupR{u!_BC(qBC9qi$wu%v5izv``--@~?lqEESGI4_heK=BMXS)QLj z53`&5?|br0*`LQZhhg1{XYs{O(WgU5vN|amgtRO}rPF=~zS12){&(6Y@2_trnJ4qK zIKmrJ68lc)G-2~ahv*ZZygr|P(=X%a?Vr2O8)xIc4|mJ3 z{t0HjES#cuBd(%x-JNie1!|h2Nh!?&ElLdnBOz+l4J6`l(8WL5$=mv;oGFjjUvJwt z@bsX1hS*M_^^o(A0E9R6ArTo7F@!+^5-^re?b<~~j%{~bK}!#z3jhL{{RO|=j_lg_WbPH;a$*nZa}+-$pRjq z(Rc2A`R28|gZ=%j*y z_U)wGlMX~qrhv3HvW7C@M{-Wz598<9I@X|Y1V4FUk%!UNyE&*Vdk$#xDr+reH;dN# zr+zfmFSo9%K2-kaW%_@9F8!Z)>7D1H{o@vuZK8`&6spk#R?$=&Kd0ER>}I}teb%;h z_VImGm5?o^HprxdER>=uQX>qhWhALtWUP`&C1kdJ-_^nvAze#*ptTtg$bgWIK}1?a zTp}u{IVwTKC`gk62)L@23>0S8T&S1q;DTmPbI;$!*C+Q$@ZFS~*|CUoozx+to5&Ns zn*Qh6B>C^s96!D5d47w&>YE?sPr%GUIFb<@)QGfBhAL{MXray*O5&-JWRaMXX^9mb zB{pRQY1*dLi&3@o`1!k}>rb9$aPTFEZL}*COqvF&&`5zQ5aAqx;5SR9x@e4GB%(2d zMI|`dN(`lxgLT&mMv@DwhF1jL*LPpbY@%iwRTzb;WzDJ`NVyB+vhL3z1EQhOPLV`Y zbDM@R7{eEi@xpb{&XE-|=2(IyFfgzIT&>Go;GYdzp9mJu<}pjh4w`(u$<0_;j8MP=2GS(PUiI52;gwtg9I@HQQ$fb@>^m``rw(onS z?^|9ikgW;u?|~XThu=i`0z6xLN$(xrz(-GSym|N0!%;P?3#Skz7&Hhfi!xM1IUG)4 zOK!^)PMUPo>}FST=OTchyo*__2b7myE&} zd#L;Yq9{=01A8ni>Ka9m&MPmTU)S*KxW0bhwEVuKnd_v4=|f@+5ppg29e6ELht!W0 z|3A;AtpGvn0>4d5_sNhitEcq+xV`7IHxPUs&bF_?{xY;ad^wMWeg{3uf+4g%^sk@N zzMoRBVCog4<8_jmBDgxcUZ84gc@@z*0fU!1eOKJxZ)rQLRtNP}`1z=wteUYk&JMHJ zLfk{YPEdSv?pm`?OYc0+nzd2ol)M8cNXSGZBp3+r*tiY2l_ri8Fktvrj0kYc?FNE_ z$ZeP!W(=iOU820ezRd^_gb;9{qo4*5g?M)8Y;d7thJd#1)r}@*A4DZt!F)HMmZ~>w zDvQ0d-Vx?TcA7%w1SczbdjI0(F) z7a&4o!w$6+ECUjN_zx&3@Y$K3-?%}{Yu}m79C$i1vM^*YFsxfT7#s}(1xsmZD5{97 zaLF+7N~d~W?;h|pD58oeo`_40?i5bjN0KHD-@(F33C24c-Z||7I9(2QF1Nxkeof=B zbkLxDFqF^;Xflq(cz1MeYmWp}QTcx-@gW?^lO6z2|#@zNoDs(*nd97_4HfMhqA*V@3=-cZGQF@#4z27Q47bWmFd; zU1d>jAn+mKBzB=e5Im2FJP!F&JG?nJj&FB!W}%T-nA>a^tYWZBuIswWr-ofZ%2DU@ z5S4Si$9&1}ccWQdoT>=rcuOnhi)~OdQpT2wTM98XuXJnOZ+hnfUwvm6?j|A@Gx6Lg z`ojs!6in2Q$I$WdI0=Dxb3qaIWnS$2Z25}S?qfhAm%>%bIe!{-epFEy+uxnn9@HD` z@Q+T#acAMt4mAb&dj9;myQR}i4{&}@eqXZ7lJ>GL5xU?Ro}voM0MrOr5J2L3BhS5f z@_KGT#vVPX^&8EHiZ+7$(qwMkJ? z57VQw+n(R7_?%4+xO9;H4@M#%Eww0CA#VmEM2iQ0?ZdqH`$2Hr48r~?t?7sFIm~mk z+Y>z3n~INT;U4#Kp<6%D3lEl86fg`dF*##1{0n32Y-SXmYkErC&`54q>u%s%oR z(W&$?*v5M>`HDine>Xpquk4gEdZ9rO=~uqr3b3DHBlP|beTbiLzI^WYo9FPpwvD9~ zg{7@%iEJ$^PlWT|fj)HKh;e>DrEd%4ntRo6$MM|LuqTTs)M!?*qY+~7KhLY}yxxDc zzBSQqS|BMk?=S$;9nX24+yn1>txm>6BRl5u9;d<(*UvtFu>DNe?fwx_5fM=l5m6EE zVbk{VZ}>#$g_L84n#n^_j5JDp`2K&3`QyfW81&nve5>LsYtDjOPJ=g4A~MB(`0T>1 zEX^r=91mM!?NzYyosB#pv?1LKp6kC~*7IMa59hnGK;QAhIG>ZbqX3%93lHx1&Cjg# zVs8t~m&Jtos`>f%^VgZp{j=#le)BYQ3`HV~KavGx7E;)Z7R@rQ$T`i;xsA2e`@W{% zwf8U2rn5VK8H5OV0T>7o1W`Z;#)?@@Aljs>No|OdBEH%y`sUl6G;4A8^Wf74kFUPYd*w&3%eOVix}JB(pIHwz zzfR$^J=RX|!voBJLQgRF?LK~z9`e6=&OGPzKamD27$>h&hY#s}x_$fU1N-R8FBU?O zsHmsLzWe)6;u<3Xm|yPDVfSa`*4SASfy+MVr+qr*e5&Lg?_YDKerI0s%A->I)$i3l{S=Vv?*%M5tn9qdxyS{r3P%3`}3!(YTNetg$JD3 zsaD2~LS~916BQtqf=>|S>@fG6$pn4h^MSU#v-W5^G+-*JL&jXEJs=$j1OVS;8hiK3 zY@1D?qgF!@)EPFI>_bKpg3J&IXxQDNuFkQ5P-j@>#MNerD`oy(hum{o;QvZ@HnAmK|zq-`a& zt%aaeL8<)>|8&e)2ej{(W-a%K1>iZI{b%wnD#J$ARB( zJT$_;ao5~IQd{MZ)hzjd`v(lX_l0PpDeb8M^Y>swJ=`Cq<&Rh6r>)R;!fn5UlN+#|DDM36!35m6x-gj5GJ=;yxg-(0lhle^BXs zt>DRZA9VT9-1g61QUfKz2xKaa9k68%15mx%rLMGG zFS2U+VPonaUcT=WMw?IWHYbF|3h~;ZUwrP----)05aHv@?MmT5>hjGsT1UpG+@^3A zio3s-uNgs|Uak4q!Mz81Qqpgh#vC2eQ5m4HYo}@F%;&gPPwRcX|-P zKwz-P3M7&l_6>5-9|o}7a2Sq#&%kbQ`5QWHUStH;eBMiZ)L1(*toKpB8n~_?oN2ZJ zAtsg=S{Gb#Jz#D{6y)a!G;|Z~qJst<(754HlIY(@E@)|zOClTr4MN2}LFCYoOae3H zj$~0W$0I^z+EFDBW@ob5!@g%UY2J+qDHIS8gChn>3@HxXxGp)AGVdmfOx32SrNOEq zpllLKGkUV-J>sK3c#i8!_^-=eHz(Z}cVkXpLs1E3xFeG@K4@+aAROJ(ZeDwBdOl7K z@EPQ%n5U$9?uMdzbl98LY|7RS0H{e90Y+BA3BUte5l=&eklxmnM%PUyrH{dr*PY(jw%Vnnay~Uh3ZXQMFFwSc=t!E+9s;j7Y$8A{Gy%fs3 z>XIFJG>sZkqj>n|ceAbm7nyweoq7Z7k3o6}K=4LQ1y&n;2-FPq1fqux6oY6uCIAS; zLAh-laYrTr9sJ630FR@&iJ&+nD131W)(KWd;oqk{{4WZ;s`X4Y z9++&ykIfVub0I|@lr5ocF&mg7wv;n=R-w#hvX#dZde;+S4K)9!N$8=A1Z$3Li zRGr zS=<_`gtfHT!*aVex?s;6W&?JmZ42M4Z*#AB2nPwZmCm;7dC#8B&wZmaXds`ToO-i| z(LaXrZ=egVtX^I}ro0R`i$itf6*GJld@2$|e@-a5o(D4k zt8U>XSR6t_7^NPjf=M8WVW5d7*7Bqi>Y`A* z$x_w(+RRa#H7KOmg-FRpl+sHS#Wg&6{`VZ2@WuWx&+_d4V#GxN=7y)GzR(87z=y%6 z+~8@*{+WIp-!grIu@s7;sa<^Y;`370%Qw&z1vRrVJ{#Y31Rq>}e%Upyz}?_8W~gk` zr_ya0K-Z^m-i*tMJkj?ipFPZpeGXx-gv{?vai6!~kDmL#FSp2Vc76P?RS|_GlvHR& zX7}s&_v_~H_3rs;DoV*&DTbDmqA%e@S(7qi#TG0{nlZnc@X{19|6S1liiMgo5F!6F zC)Sa-2LunBJ$E(4CaFzmE;4&07xX{gftQ#L=}l4_})wSQZw-;ihj@EbIxf4&Um|lnMQ8qpIi6CzpV7;+TONg zt6Ju*YM(Hf3tv+lRC`eu3>mHib_SdkNArqaYkuxQw*(Y6d~W+G(_#u`*@ zE9>2Te&4Sh>eub9hRH-l6c!+;!(8xzu@;~T=%t7 zz_bUJJ~8-T8?p6n3k*_Vetrr0C6EKfARPkornZMvSG1I9Luc#L@P&htkb*|uPZ_hp( z)H~0mNX1kIR84wpzVltzv^yjN;p!|zSs-pcV)(MX?qQ@6hdFeJ86PIFhJA+fKYC~$ zq!FXTAfxz&KXVww132{zjJ;)8TTK@z8X&m4(**b84#f!+iWHX;+@-~}!M(-Z-KDq| zm*Nz6XtCl@2-dzQyx({1-uvUOCmCHfYi9E7%$}K*cZKKh>*@NwOTxHS&1nCxg`z?v z0R=nBZC0nmjP&*&B2HaC6nInJE#V%Dk&y-l@&_=Q%64BWsR42{o-~`~c+&NlFdY8v zBi)M2u*2P-lfMjDRvE0ekm3Y-NI!F*f6r$R_}1J08=bQ(qu;U#5I#r}ld|5%`9bGW zMv+4p=UAbs7rM1mH$%~yz#}B_pBRn0 z=68q3BVIS~Rhw_EUU9n}51)$OY(&qHWMVb5XR?{t9URLO^f#opwGC~r(hT11I#|Xp ztu)`z>mkARcSjX2t0OqC=S%)f_pEqI@$JEC8dCf&{8|Z(>dL3S%{*PGZqz^c;1{wH ziT&m&{@QVAzX865e)wb+t_$rrdpt>O<2q?E`NDJ%B)y+>{kU-b%75Sa#&n$U>dTh` z^cPId@9+JPn9lU=?gISAHFya`2on-uMPD4gCmx#$sjE@ld1{!Pb)hJsz4zkk>HZ}k zf=sYe7>+}Cy25I9CH1X=>y+m`c0q{8XC%X)SDkXAT&)6KZW}}N3Ah3+R>>=T;XH%M zI?)(I=Gk%*rRgJlDJzw9mpx+NNYr|E*oKYSS}@WbsEwCOB3!zz%?fdlVELiOLlX>~ zukuK8dvn)(|9VZAZC;2++);h6V(3-Nz=<5*+e_mI464>tD8Asvv;NEOurL7gRgccd zEoo1;_hs8Tw^IpLo}^9mDSaR=(6m!7f(by_MHX8Y*U7hH<`))YrofHdU{#5*VcFse zV!=9oz8@DC$))FH$gRLv-;4jD;W#0aVHd^CQl*g2ko=rhT5?`xsgd!~wXkHiAM+8AdD-eNHf z*qj)DbS&%{7{E~+eNmij^wSqM$@BL594Kp2U=R}~S$;Tv|A*mm)s+f9GS64#nn+*! z72E-uO_rL0=kfwyQogW<&dG}q5EJqCE1=^~5e)wzi6~SLw*?m!VA0t%8};39P+#t` z{_LUK$(}DjNsj*}aV-*8V_ZXU0kf7}4n?7G%*rGVE{XvlOWM!WB1fV9&AEo}zalMA zetJcNj?HI5B)R!=dSw6Z^3A;i{D?W;KzL#EYk`Ef6~8XA?xuU`U#od=D7!PpVf2qr!)a$KTvqNX&3TE-{Z{2qdy!Zr+QRz z^5@d;?yK}{s~B_R8T708*TFmXK^?-SZlU{)tm`#@Oh&2c;8-nX{4SiM`@0WgjT^-B zi*12J^J0M$S&MJEl2{wg8sBcd24RFhT^nM^(5VGXwLj!a{z3l2sTmth_-E{Tv&Ze# z3nslE&X28?hIJe66(b zXO>NG!SaJ5IuE{o->S=X%UJ0*)rlSK7A}&Mn4OICwXNRcl#C!@mR`zaD;k62$yk;; z_Pdx$VTMmpwpw*SniQvDCoV`uyf>=E$ydZOo%E}x8WyBMbX^C^Jj zFC8%64J#Ulpf1qm6_0!N?_M+YVB=EJ`AARCgm5;mkCAlL zh`;iP`*=DKl~sVl-6I;|;}g60O6$*$$Cp!-dgnF)kGn6zVl_3r&gufy$Tvrof6GKM zx^?~m*JrIuyi`xB{P{4AmkS&D)V-ARX?pKmaYP#wpf}y7cgRqUm5(Y? zA7lj8p8{NwT2L_AvZ&fZ871gx;sAUt{NSM1Bq(gf7+=0wB}So=R203h-)uG6wXJCN zU7R$T;T5zM)^TMGzcDNG2_4gN={)Wh-|rANdt47VWi=Q_a!?54oJwDPgk>2(zU<8n z*5BwXK>+yqOjm|pdLyCWHMcIhr5547ZMBH~_riYj#HPC4I!x?UgRsY=ceIF8-S6R3 z^Ix+BO?_}$aIxLE$vx!AxGQ}I-yhtwy1g<;TqTVliUWgjYRTrAqMHyTxoycu3!W2ZI zb1ey=PaU*7tx+4dn|USi&4-}P*Bd=gF|v2R_mEN;?jTPesqBmVampj*S2jM%n;U<5 zK$ob-CaLxs-`MO8Y>K;j@!5|+@x_ctS)?WOz4zz!ip&>h<}RHB>-U`G7k&aPB&|F9 ze&tR}w)F$kgO*<7%{-}BZ-H_f$X|Y!E!gP(+9>FyEcJLy!ydkE zf%c0c;KmC39u@hvzJ^J}L9`8C7WzH$tOPh2|M%fAT(;U!ZrZF+wean1b6K7pSU-UZM~bx5 zj{&X;wK>O|TRLO&=VE1Dn2r5)^Z2MI#o`1!Roh|N4A_GeuhPGVe6SZ{lY9HCJv7ud z4!9sU^>-b4^LnFJ`2mi)Cwaect@5t5PT|^JWEjUChnIL zl7+xdZTG2*OPXlIHcbdXI+B+@>ptAXeWI@1GXWi!%3V4`zN%_+omOu+Cc|(W8i&K% zpWZD}?!I{?bcvPVMtUZd{4$0f3zWv1KD`htn!&*sF1cc4$xIJX=HVlJ9}+h@tjZV> zh6fywvx@4XG0AT9RwLUzxheZpN;V_AxXGnITmhGilh}N8ptn$x!>sD8s%RVM)3{-4 zG0CXLWlq$^!g9gFacEJQec_l`L_vvgT=B-eaLXh73)2b(R$&w+C=|j-Nt63zO~@Oq zp8Ig^w|LX3uBt6GP%nmxXUBcD6ZLDy-8yzc4-95FUnh-mNsdY4nyhFFpG};j97C;9&R`OIMkxiIL3^E;zY`fmh~A~SL+mvNJ4rD zn$8m77O@vtS*#Bdq?wYUaTMhOqs z0)*z$*@%e=)=;sc^(VtLi#Rin3%Fsk5)uNlMSb;wUG)HZ=*QO-gS6wrIG*?Bz-69D z$LoMvzj&|^N^chpVsDMn z;V37Ip(%D(P4RFZe(>ofHQGAJqTM2hv8-vqt~+b?6E`^Duq8gc5!V(@dye!Ov*jXv zh|^)c=VOrMx#SN^WIDKMT3S{j(HV{tSnIVHF6b){og9uJ1_!~K2|WfIa_EP_8qG+y zK1j0_(-q0fs)Ox$a8;VM1ya z)BF?P9q-LwYHtb6@NzBhEN9AbsdcG1E_WFL|>e^Hn0Sd zK!d3J{W@1HjhZZEZ8rb|JfpyAM-)4TN=^_fu|YMmdy8`BM563|YlqRd3C=I!c3E!K z%Ws<8YS?>J8-6n|k1nOvHkivp_G42DeW)M46^DwRQgXcje95 zo?t3-a*c|dz*`Hmo4XDX>>0<>my37Xb7(xcHg+3!DA-UeQ@>hjTzKC>nrq0>I?O>= znG`BnAC|@k6ms~)fb7eN2a@w;V@WdzH`rd3mVDU`-lZ600$ud?=2~r5fM{nimnO5A zi0D+ms0+S~#T3}e{h4T&aJooF8!P2$J%#`6*^lg$g`C)XH4R1I?ml9_{iPT{=QVH0=uME;Z{BuQU!Lh%<#65njp(zH!i z@5E-Ed+-_D+;E~4T&+BgnEKWA1WG7qnzJj)@`irr3qm5AV1^l;!zah*vqnDG^^V15 z3ApqesowV#t{PO`2CESRWuhwxb!D=ZS;85MH|x8Xy4EWa32xIA(%$ev{Jh_GUhi9! zNe+}1t4H^eVaekwAK+SFN21Tq#DCXVrX^yulp01J=Eu+O$dsZAw>kQ)iYbMHSwmBB zc_}3IcED&IJdt#b8j$G~UjK(F57z}LYq~7s=To&dMG%R#5d7*Me!k(?l$<(WtUbNL zPew#pC{)}Vw?5c^a0u9MczNw{fLJSO*rkp)W&b$kK$zG5TNjH{5u6%nC@s0mujbrKn%S3vx2B+y4vcQbXUa3Nw06p%^^F#h6mP?vE{HIrqns23u zD!u5K>N2_8p3uYE`2c57PIysSX`IZ~$|5GC76z|*pPWJWoxdPQZRlYymipYhHq&k`*XE9cU!r9Q(9I zWf{Bbkmntj8D>WCx|UUw9GThZDo8VI8x*g?#kX78NL-$hNC-*r9FrY=W2cGc?!+$- zOSYdcAP|SJez%>aA03Sxgr$>PJOPS?g2eUcRnN}%QAz0j3R25!e?KKlJ~=YahoG!$=6TI6Km_H@86vOnXv z?uJOjU%v)+WEGd42d+iCaDTgB*5z1WyXh*Uo$nA-Bi2qkSj;q~=MQ zYWa&dH}JDBF_G1|)ZPi_0WRm7yUl;f1D|$3=GC-6jNEMd@dE2(^)Uc2X$GGCggHW= z-|z(;DgSI7LBRm{hDb(H`)uEqzXS$}HwH#X-71s0hW3rsVR~I{r3Ccdo^{S?7H&;| z_*v#ApL`4&L43fOUw9H7K4l+1!6FcSgl+08=ZyS$S*#`MTxY)RAnB%A;5g& z-_7;SwLK<43_T2AOk9jfz?8g9jPv`N{gC_XEF-)Gk?2EPs8rF;vbs&1FdmRz27^%Y z#*xP|N6btyHgi19b|f^t{O+4l_+NRr1JMnoL;o1PXXkJUemsuo_JBg-Zj ze;EUb-L)0{c?Ix|*y$^|N8OM-3*$}a1ud0Gz50ZE7j`bBDaqA~rlhy?I&fDUdP?*= zXNYha5@%y2ldR9M2~R9S3n+&YxA~pj=H9!;3;NT9vOv)El|8C5Eg7f7Fx1_m)&(Fo zKC1Bv;xF4RqsB3RFedp;{*p!$lcuJFzY||&2$9o<5A?F2;S9Q=ng2QBkGYzd?W%YI z4%j)}F=NC*jwYFD34}t2c0#>^#gx!qu=pe{GxSJoZ_r7)1xjufB>(vtR*7&-Jb1D8 zduY%EWt}J4gVBYqbL-O;{89cb8M7UQY=(@v0K8t9!4JY?k$K0SAK+Dt#dnr=n7oQm+sf`3(s zWR2$4emnW3dIfKD{v9eRH3(H|Sz%kv9<@UUlw9TccnF?bK7v?;x&NLU?1L@7a@+Jh2)pbpx)|Uz2%ALVq0kCnP z=!V|-cNU9!*TgoBWC`aBfe&vlzk(jmE`(2>ie*qqXRoK_lp3vCH|hM6B4!mnzsAx^ zJGUAjG$7_%H z=~nuI53*`F`c?Goks*Zo#D{rm`&4kA&G3U;8iUW&eb^tX9=7cjU1_$Jet&%x@aJk_ zK>qwK>GTB*lM$d1j0XN1t~yBvZ_86i^cvXhF-Y}w$r9kY->FR0#i#<*)N%b7PXcn`&q-j!sci$ry3?{12E7Fj$a~W{Hc1Wd}jZ*?eCTR zJ0X|D9LfY-me)3!-1{~2w|UxXkxhN1yDhLjdU>G81`Y>>2O9RsyVt5gH2nl`T0l(M zF0|>RP)=-`MG6N+HG56VEVQ?(Z4;B{285^rhqv@^zqrf6N7lL#%LHb^Cb7&^NE(|i z%)ebI7CR>~;bmd-n6V&MweuBZu^zh(?qM2oez4dbUO)#0_%XwodM4mAKynhOlE zk16mOXa~jNHWdj~w@}7lsU{h66+x{nCrY^}<}D2ElJqB&Erb*s4Q`OFL1gDbuW2H8G2x#5(CU zPDz#;#V9Aq0+6kgQd@OVjc+B|wjti^%N#}dtX*b8d@(82Fe$JgeMl&CSg>?LjWawl zsyT)vwKOqHO~pddx*|Qkw}~>--nx?OOKO3onXN#wc5()|bS^Tg@Y}3CxIrr}wuH5k znlXf+kBN;6lK+J%A+CHPk(!b<%32wlii=>Jgr_hwJ&{Kvg|9S~FIj=P!LE^7*@{&l zbf!XOG?Nrftwe^9jNLj_Q^nCSiexOKX-!d^Z%|R0BoSvOJXXswlbv5#K$ponDgmr& zWu78P4Nl}Uw@wV@RaQ^|6Eg|O@ge-Bk7n9cstP1B0EQ5*tEVOI>k3J_xHnD(xqbaB zGTA(f9{d(xdRMi=7)*paH!5<_u3xs<&hp6Q_(gu_#$NXZ7*dxjS+@xr|K5cGh=JlBJL*Q@miJ4eAEA8LCY;J z1+73ftOvgd_o#52;*&L0YD*!|&U>@#-30f9GZtv#8x2x7C$u|L$tAopH^0Qz3-$@g zCFC$n4v)XU_HHjoT0rvxo#Z#wAT?mfyiPzzust9f4THkDi%-9#lA34|GTzWz!1>CTQ*-(ml^;glRf^6(RP_9#GaqXSk%GKNT z4WwIyk{2`lWKB7FS2e1!V{0H-urjsa^-07{MYdugYLPF)6ndK5QCgNI2lWbnLA`Ws6Ca&1#ObxeaFa^js#<0@Yh_O^ztM|)wq_G_OOH2IZ%8Moju``zh6pA}0DZE#*EX&l}@r_4I@RXxuniV371pYP%kL%Db% zEj+M$f)ZW)((oS51)72cL!7xVMe@U>`V(ZWJ!X7e;QkWzmU}4{>x3kridz*I-|RTU zuTk75gjR^WJZ>}ZZH@=$#iK%s?_{SWM%IZ;yc1Et^%SyqXvmLsNsNy z!tQf`_^PnL?@UqSPOEt7t2&DT^_q)%psOMV$4F}$!^!O;24qnTSL06Fci={&XZ)xz z=cnxbd$hBPxw%#&evt!9lueQ$!{eC`i3!rwTUH!h67nl6k^2tgMIBQ85dn~Ao0%g)G&bOMfbb>NxPP)|@aAYK%WhHhz!2Vn zp30sP>^@jzz~1e5ST)r(SK?MDC_RB+r3(3acpkwOC4AY0+!zE#Sz%CA05 zrvWz!p9tLO=7m`&7Ix^MNS|#_KX`-60G1@*=} zCa`@UDZL9Elo)6=bF?2RZAH96j%B4%5YCAIMWx0fEI*lN)1AwZF1!hEgHmU}j{C(e z*0EvqnkSlo>UmYaN^p^bXZo1SK(9<^NVso*F4-^>nIO`)wej(7pAB~R4g=gbYd0Gw z@7WP=!O8r=7wv77z}|>1@d)2{MJpu|V3gj^6w5I@ogo9m9zyGBD+|p#@wTVbn@S5D zv8$)~?9I4z0JX$kSym-?zC1bt5F1@4wFRz6_c24jIZ~PAwdFoe!3`2!gI||kr?*CW zJWeq-L$Bi(0Rd{#@M4sSSAM-OL9SEBm6R>+cQ@!3!o5bTl}GGpYPAbA)io;K7e8W7 ze!sivOP3r7GxaScsWzr?SLC++R?`(Mk}dmW(*zRDrm-Ho*3>{A2cj0!_+h2pz zc;iwW17Y1T=$*`b?Y{2dktUIJQA%A6BlnnvFdfRN(pEs>DLIUSWhy+RU^{gn5R12P zkq6(szIX6Xk+I0Mb)R%_S(oIZASRl+j(a$@B0ej=263%>gYTI`x!TFl?Qs^C?E)u)?6v$|kSvzO=@wE-3`Vd{ADT8*W zW@N!Bzh2zPp7v!4F6{3H;mebx_*HHT95zk_0dOod?49jY<9l`N09SuS^hD*amPNF{ ztHW^&qqZ%xIi?%TUp8T8ogEuG#;oePQP%s}c>HT4oA6fFj2^PEu)uW`wAo0-Ip{Js z@40vjmi4X9J9c~CgTv$9AoA&QKQEBIiZ^{zKz`|Tq^3m`C| z;Wia7{{k&s3Jdp!P<#^}nbS;%S1h=97A!zW9!$ElYgu51k=`(0+%Q&lR+sN2xW_O1 zQ^i4cqHp@w0(BPVlc0~lA@_+m zy?6taAe$C!f8xPuZuuw0ez9e1e;e@s0wMr_2tZ|5nrRCFSOb8eK_Gw@>_1pU03^ml zWyVAzfHa~&nGps6KoE)l021iG2><{o9iR-dR%Q%`0)Q|8M7siP1^c%W!5cvVK>|JJ z5Q*pLUw{CRKmY)mS^9I12>2`n@qr*P|0D4~`TvAO5FiWyKxIW}M+5*S68%puNX(fC zjzE|-06-a({)_`bDn*0{Z2**^p)klZArcsz0YU;lw*f+#s1=%O00KZDz(fFQDiJ^# z3_>UcOnjyQP{IHZB4ChKJ|c|<1rQNIsB96eN%ARSB*meLWcmOA5*P%8p{61dj4%ii z2%!!HiHYr*7{LxnwgV^Xv%+$ z`hS}8|8E+EPy-1JMpy?S4e>=NjL;JHZ}zzl{w?}%KnX(v{Wpn-jJRO`JM)}EnDV)^ ziIBh`01=`Skuv_}il_lRGer8g;{nQuN+b|kX)z4ZG{AEU5%8ZnL>0gqi7|*d6V3A3 zPCyu<71oI6KWp#@W9BMCkHwLhD)Lvw-Iu5Qc@IT>MeabLaLMk39{sx}Ir@9~EId=9pbd5*ycHg;S6mt90 zGI&Diz^-5T{e3VOZ~O>%tU4{~Z;Il2z7Ga_7mMx~l*b<&B#3^cjSu@B0dfn#bxd>s zt}Wax=y&T0Vs;$ARNL5qrEQ_?vTe>s_tQ-RzplSR7ul_}`iztk6=S2SZI0gfY_`E~ zs>tJc%B-!%XTs-Q&{Q1K8@yRB`mxq8vlc=&O&0Y8h^seg%3*k9y_*r>;;xZ?|91MGBaClsjpi(ut#GkIvnzPPPh#LU%yPNcN zdhBL#pvT3jkZ}C$Zu<-Ah!i3wPw?-&{@f~$$y#E^dP9t6Y^EL; za=aGs0e77Vr1JDfF1z+U$@8QaKKuCiVg&KvlV5)LUYM?yqRHEL{(MA#pt;*h(d&7H zf<)Ad9ZpMG*IO;Ee-J*)pX5_Mej(DCW30N1V*jU-vFe}l#JU?qp%r_Hh!$?0^s96$RL7V!tQ5h(c1GFC>bB$H~F5XF8l%X_G^9lW}ymSc;lTd?wP&ABqzi_hwuWX?Znqdm5L`sreC zx#ndzO@Op|JlR8I&SMlon{Lt3is8KcL%iC4r&_dkop1jD$9bi9>X=3_>!1LAHMoLQ zll`2`(`x7ltfR9^hjEBby|&HEd_Znuj5A?@1$|7S5nr3`-BYT-+nEojRx18T0LmLF>^%0^mkT>M5L-Iqg-I7(jV ztsNmoC+ba7=-$tx1weO)K37?er2}BE8a*xyQejic2L|VC|6BKe1+7|I1scF8tqOer zt~xkDMOj@#0D&OTN2HQjZVMQk%}2rHOVlDzfB+EXj5jK!AVzrv0+PyGLJTI>?`kOa zR4D4KjPsz-WF3Gd0PtdZ4Nk|N!gfTj^CywXL`6Djmz~6lJyNM1Iq@G7ZPv>_JPiuz z2JsUu>@$Xfiv60Eai~pX0G-XbHiI7d67<(5H1uDEIg)+BA6 zLP7KL@+O7y<>jEI*`?n6_FZ| z71?u;#ZbjH8O}CS&6>|PSuPGyQ`>UY?KtSRjO$F=)--54m^ZWxRXbTIHx~*v>91*$ z>JPIcPH-=mx3CvRV#PQp#OVs^BN#Lp78xm!mT-PvG&C1BA=wVkDpU$_P&GLy7;@UjF*g^-X*TF6wnWZ5na3*5 zD$W~5vv{<$>&Dn8Q5y=z=vR{#u94WTHngZwEkrLjXqz`j3ken3&pHK14=>WQ&p1)A z7dcT=lTvXg#5gcFkqsA?57m%bIFT0eR^l2KHW>0K4v{w0#K}9VeQ8x`Z!S`(DG_|q zduoS$#Qr!f6FiH(WZIv1c3z4XwTg21ei5b=eI^bd^PtREEYX;f zrDA;D5l-3t6TXVLD{~N2C$%$uD1n62n8e)<%ii!ciEkZG9vum#O@NPpDZX(XE^X(z zQx4p9lYWvo{6q3<49(86RdLxffS;3 zGbBQx(jhl50ptCFGtB+X{k=&f&*Tw8`E79s;>AiPDoJ|f2~B#sUfVH-sdp-bK2*o7 zWFE9ATGk_Bku1KPK~Q?63$j4ZJMpbt(Uke{0Z_Y zuh4t*aFY8*4qJX+qbT7Gh;BKT4SQ#u8U*&$r2*(n1CC8crJvZg(VhYuDH|(Ez`{Ep zO|zj^|3V$O4Rgh84+I?>ObA4vDJo{fBxUguPJXrIU;cobPIQuvumzwlJ+V z#peJN#Il5284q7u`Yd%H3Lur)7h4w8(fUj6Mf1v4oky{`1WgeE+`+}cx3lmb#Y0^c z^O<+EnH{?l#08w**;BQJ?2X;%)KCt%L$-2{zc|@f(a=NWPhMgAJMy>})9=7xxqVW- zUIT+E)~g56M5qpYv+H>N&1-ez0kjXB_kLs1{CvK3I&TEqJ*U3itS@)t1+a>=6yQt zjPToGJ+WZ&NsnP0aCtE$rx{@3)&UirIjmIUGwHi=+pUU}x_?i58t=n!VJhQrzuVBV zWVIo)X>}Cfhk?GTQvao!z4>md)V=b}o|lDD7x)t7oriBreGY&%xCyHZ&f=QHe1I0G zGr-FIpFTA7$m8*O>lZ@pu4qX zPZ@6Dv@7VSY@vpiw+~PzuQV&34acKX?RM1X3iTiOi(K7&!-|)ftGpsrsr(mO?a%d$ z&QZ^89^HjWc4$kf1Fe~bl_6a)Dc~zg!&N`v-f29f$dm!ej^>M5RE;uOI zOW%c*3raQ-N01BVW%TqBJx16TKX_uc{W-|Z>J&?JG|8DisHX_vNhzGsSi~9Y@flno z)-h}7eB05dxMYlNpXg!l0P;%cG~*QD=0wFF%6vJI)A$s^hFD&Au4% zR%f`$7>IkGO?&Yx$(lUz?~EisuHbG86Y2ZH`mIJ{0wR$XvWJPE+7wXJIzvC~uF-n# zuy9PH+nzP?ut;Q!^NEt7`Y0M32KSlMYlbhOAn_&(O$EzT8;}rA_#nNGM9D7RIC_Mi z4{5%7MdPLKx;{^{6Z2laG1Iq?Qc2c9Vnm)^E_evTz}BWJXWghuZ#q{UV}nMIYH{y? zBtwQXY&>!Ndw*s7SlRV;&+hlHg}b{yht^%o z_eb2_Vl)WiP;d*qoxjka_H(`;SjQ8mm*B`!_ZR=%)_tDl5W6l}9W!Ds{l5E5yZNwOhEywarr^%!2y9N%QjlQke`}rR?;fD;m4?zc69Xr!9H2o6vJUK?RaWigh zniFs%S0#@&C4NRi``V;7#Lsfx2dHJ2K%b5lxj2n0HnVTvD80$Ln=^RJ==VA36$xwl zJ@#Hz_qmtd8LdKtkEo2_V$MKg?Hj_k+=zRF8)y54-Ih<&T#G}p-?epbVx@Lvg)BS* zrM$-+ex7}zL;0N!y2uqV^9e&ec|YRiHaR8QPMD$X8EjE9cTg^uNW-f8rjy{(sN4iy zJg1h+NIa7;cA5LL|I)%0HC2Mk}8StVR;MvMTmd$k}Kt z2qMSftzVk3R)BrC0WHXB=^)+obQv76}8L2>eV81>0I}JI$qDd6zmY$mE9Hp z0Al*VH?gN{Wnc!W;@eRM?>gl&j~pBadLFz7%j1sENEm;(B@gv$lm8jjWOyw5enxq% z^q_@<$wm`%^(5F#-I6ncA5^&j`Jq#pI9Di}ZeDMYfmr`5*opk%CW#?+jY^=31Vm#v zR8=-pm8F&rj)q{1JP>E3$)NN<#3C;=#XP-IqWMVsx&Gn{6PEC0*t!yJJGHIkx$}#4 zB=lyC%Fj7?A3eczfe*KO-|yCvSj!=W?6NPJzB`DJN?LfH9c}v?wZED71QHh=pzaS} zx3Y+T$aRq(oVPfidWBzyc$q(YH(kM`#2cXz8Fj{Ptiw-I&*Tf4r$@BP41 zR0S1SFcI5tG!2c?yTvGa_*TxB!CI1{tbPMY`M5%_^N)9w9wt%U6(q%6zKR|32tCJS z`jb(mM{29OXKQ-H;o;+JKh_xv(Kr8;{gG+D+V{xykMw-1Tb&sTNw~a?j$7j{OV_PN zDTtZoH9~tknZ-yYxnS`!rN(2xk-(LY?s%#{R%b5EV@IsSO--lS#>qX)m~JFT`sOCH zU>0}Hlf%#I<|@mtl2=E&<0z$MeqaxpyV~gSy6Q{eh?N;Pxb0WHjpNx0x2M}Tu9mSk zVHcOb(A}J5G?I==?KW@&0;|OR8ijql5a8k^wa}3qAe^*HxV;eVO}7ZFYpR zHLwGPcIs?eRLMVavjNiCGorS!4%+5NWpo;ct;?q_b&rX8IkdEBmOzMjBY!4E>b^%( zv+*JgOLXKc+7kDiJS_2Y?zjYE#Kc8zc@gQ@yloswugXI8U$HMS9fBlqg+6I53LN_i zm7ssm(~?(>&)@}_^Tr3Ut7k^IySj>fc;P(gQ0IX)8gV$zf3Tok&JaNP(8Hgv$k!Zo zRe!`NM)$PAEJuHT;>?FcZSlU%`0b*{!%a#LZ^5#id9KUGxLxYCV%2JBl<;q{90vWD z-S3jhbFiqstGm%$s{WKz!Pg=-9D_)HKEUB z&)Q6I(8bX=MGR;>>)IFoQ>r?AtaJYCHZ?{~w5%^g?fNm*mIXh8K&n!0l_vkHkokg% zk_o@aLxAl&d((Y@%X;Nyz)j&yAYMS=@1GpnzDE=>jG8X0)w*4+hdo3|Rr{;=PZ!y- zck!lmuR2E}2F3ED@C&%^d4?iV|20$d$4n+g{;(Z%1at*zG{B`mo1)5V(9>Qe7;&RUNF z|Kv*&<|%#y<|k&3r4Lx-QTgjp1c)7NP7IPpUltncD{^*{cCLFOQ-0@uxG!v^=}JvV z-RUo^<%WC}l;czx)1_}o^Ep}aGpcy``NMntHK*zPqBy5N zJo~z}p7t(Y><+rxSwkn2y`PIJ#yK#8!+tR7A61KXbT_(Gc2ZlHaAstmS?a)U*;0(d z8fslkq6u@?bEtw1o98AMn1{(S|9FUC10S`;zZyxwrJ>S`AJ-0)rsz|O~kc&rW0s_bq z42(pgW8W|bF3zq7yFoZ3B^&DolwNU_7;%yj2YxZcbJNmPAmK8^DDcRNJT@S0e$V1W z$81BGfsSsmxKI3Ii@2w3GN9+~8~k%6uIfxGn`2pTve>Mc)!Uh{OkD-CU(*?wSVh{_ z`H`@Mx1MZOsSk4jRn0DJ(`#lZ6)Pe`pH60zyl@W(_w7hCQl!&)z+^u*AN!wW}wQ?s$zv(#tv?#g4p1(&te2BSpA z|9k16mFVzYTH{c_<|=uY>TD;NgxSOAyd|>Icg~%x!}l_P8edIZ-$i$d60zJdVYzP@9!!_=*7R(WT(pG+!o?@CWRk2deKtW zHZ_Fsea@&Aj2|b93N=z!9pqD2`X2y^Kz6@4EsjZ&K92d^^+J2t_uy0!bokw{#ILSW zLsdrRlC8bq=d6I1=S(jT8aHrJHc6zrwqztBAiB9y-tq|eVFqzPGbU9GsQb@d>Ij;u zM(7ZB_ZHSYCw4yYx(5O*^(~@BVOoq;dMbL-6S^`%bjY)}$-XJhz-WhWK~kOJ7kNdr zMK7Z5lS$oVlS*Ey#W%3AppDcI6}gC-rK+AhT(SF*%X>s)lImU8ATJ`3;yilTcvhj+ zbKZ3Cwl%M1&h3_Tl6QKWnTHFtLvGcf7&_;Hm$BX%-m`WQi5Vaj%S#^82IAv5dGVSh zLwx0L+iwH`(x-7xp4~od_<~Y$ zYk^rzCZv#Emx6YJCz&c*6AlZ8>y#64k)_-wx5BF?8syIJ1zE`6ggND1E_W>q@>%L- z6b%#PQ9+84fXy*6v=+yP^ZCEMPr%#==E-d1Vy^ho*&~z$cJoQzJEUi-l-e1|W2O*S zeM^oKTD=-GxDqB9#XN+RGN_hX=J?3)^$py1nzvOls<`B^sMI zR}GuHB#}R)J;wGKtx3sF6SUjx+Q&zt6)akPlF*vx|@BP0HAnZj~%>JGdm;cBJ%SAR-{f?dY?_Bt=(evXG2<6NDeU7 z?PSkKv6+kETV6&?_RFm95T3F)!fRi zoshcT=HE7+Wp#IKmvu8P`O|7JBgsZbO zko$s*O!>|0@8$4E8seuc@ic&F-sZbv$>hjWLkVirbRd#|Zoh*%P zb!7^tP+~ZV)7RVG+c#lN4zN10syaHqrsrRLTSs=zBKHF|njf3nOf36sl38x37dPp* z?!LBnQ-1dEzSa-|FlNLZ^|5)&XpJ>DEv#}-Qe2oY@!voU({Vv6o1c1t9ptFx#u zTL&mslCG+`?>CdCX1o@#Tb11yhFkH=aj{^GtT|S4GjhtU3a+_6Baf*I+S`z#*%Rd9 zM4}PNYlxTwJ9R|2Z`XpMOfo2MA%x!*vo@`{-MhWrz?JGE*fCWGy?Sj%PmN+H4h@1_ z5hL4}QMHx|x!W?|bllqIp89?BA4fh?lw55CfZqww9ij2O%6P|E2xWIhIXL^}(N|w_ zN+*&@83n^36~+V%a$G)M z;~Qg31iS5<*7n?|)Y^(IM*3ByTd308+Q3GkY#T%~S&-CKm?k#$_Q`p>kpwCjYOWhp z2I^)|hu*SQdf8N5FzR9tn26Ehz1{*D$!lU_@f4S7#auRCNel3>`&OzI-D8vkb@F3( zaEehY3@Xb@uIr;oEf1d%(S)B+S=q#v@pct{%=TiTw;!W?QwKeq&DgP;g%CQVeUEZc72an)nr;L4<(+=+k1Lw@%NmhX+!LE!?zue%h%}#8|_UqyE}?B z^NJ6hhuaJWcs0sXFE^|1Z;N<#eb?f9&9sM;NZP)tA>hFp<3RHgl|^PteC2*hOzmtY z!;bV?w7Ri4U!XFk5caP_xe0_N%B2WK0HR0K>Vdw?C#CdkyY+@F?s=4Bd|Y) zw5wA}P<*eP*hz9qOqyGw4Hg|%4A)N?0=DsiHPm*et=FBl9 zkp$Rbatv`Q(^;cbCv@!wi}tEJFxF6I6ybRB!4!==pdqeaVyH zNL-r=6jBVBfFOpDD9H(mb(1J51@y-ZWD&9Q3N>u{dV2eM+ii9hBy0pg(r7^pyUozH z94~bWoCWOHcTm@3z$*Re&#)QYr%+%~UN}5P`_6h@COrxHd1(4Df?%?VpnHB43xl!f zm|w6ZE7tvnrVJxgTgQjItU3`mj?*lNl<`qyS-Uay#^Vq zD+CWa2mmWHs1Tm&9+1+HExwB!psm+_v1!zhKvsdFHWk*#ex_3`@L^E}x zM}`hV%i3&$dV>hBA*sM~bP3>t%GX!E=iApk5^iA&?usU~APa$&+j4Lq?o^IzK5bjGX(S>P;Zcrf3_MD;SUrK?D0)QjYYb19k zW5?D9RSq;jJ-jyvJJ$$eq6a(!0$K{vJATULn@>4qy=1zVt;2Llj#ixN3`6b**%&Yl z1;EF-X3?dz4u^iMLf9g);HMsSO{lOwKPP~@H<`Pk>rGv|=I2mdZb*I&tRd*J``AIK8{gFcZOf@fbTh)Dff%*eLMx3qC>%v+Q2roB4vkQk{$D z1!M?WzQ0yAfF@`S^gEB;bZ~bpT)JRahFEspJKJz6DNOZkK9qPp(OcaI7>7ER7#k*m z*|*u6f~&Hc_hsUmTI~pB#R%Lq_8|zexSLk58|(Jljy*KSysF9_i#L;Z9h#c+so#d0 zz2Rru7}sHXiHKnA?$?O5-De&UyQ-jLOKIPinHKbhA^EOm||d?Kr1gMvh zABB{Sjk&WrR-`XWLh!x17YMRCv$6U6P(h6pL3Sz-yqAGRQh;Y5`!0wefIk7@cxdco zqY5a4(0Zy@kJMlm2!lKbgKY~L-53K&1#KTz8E(BLgMRL?pmcaYhr#A>P($%2$D5f; z3CYlrdO6=%>S=h4M9|a^oc9_5_15rnxNrdAkm(c&oF9Z>U$%4%Mb8T01u2?z@U-`o z$X9^StV|zB_;!uW4Xi|J^5i`0Yo~BuB9O} zB4l}R-j02v?++@pA?3FWz5*W&-6BVDFjKOiDe2VImf!`jF<#%Qs9 zXD5XrE%?%xdfwMC7aFPq4C3@?LvI5@^LS2-U8CF|4HDQED_>?%Mdx3Apz7(1q&Z>s zkDkJ#c(RXsw{Fc&Q*|Z}cU_9{M*~(>O)LkV$`#_ra2Vv}2^iL&Ve+=C+GzOZtFhVC z;;?Xysmpok!jEvFU5jtjaOM@LJ_rgOfM&~rc;{E3C?#Ol+f*`5^HzVcBR&p5+&>~n=*9$B{3?csrkgepA& zm^VdWE|aK2h- zvvuaiaJXsZc~*7QnAP^zJ{gyk^PnIOpogq6!UQ}+0f6-4c@MI=`y~b@)eMKWhT!P9 zf)aG8`$l&T12L~<@b-2KtAf3~Wq|w#T)8t;n9zp%z-jL;Fl-1QGeZ}P3?Td3(4sqs zgcRZ2_7sF6`^(|NuJAF+v%OCEOxYhk0~YhF8GwW=fq7GfTM%bN;L$5y=>S}sjJ1K? zj}Ag>#aGf&>A_^R+I3G3OEa-hI~%xoEYX`mQO8_F3TD+hJza#m$qoa4l=u)Pf}RjG zR`bjXJPw8QoXazJ zS6WkPWud|3YR1U$dIl_LVI ztZRjElgMC=0icpSIvHYMRUlQN=sv*5j0t#w#lMfHVGR;Iee~ieypABbV1n!v4X6(- z0VFSoGVXZ*%BwtgQM~|o>h?9`SL2G$x(U<{IQ)b9vKhWxLnJ_J!ayJhTQ@}crNk@fV4&IK!>Ntt}{=Sh2%`tYzUF@pz46j zp75d4*Tc^qQ>~s990NgQkc0^yD5`d!ppbUAwn*ZyU<7;tMrOK6&3t1g!~$B{WJMKw z2Udif2zx~G9!tn_z8a{uh3FrU19JzPBz6RV^V6^a@EMW`;emF<^1$Wg<#xHcCoONo1^=O@kyTK&(axkP(6jA_^#(TJE`J z)Ok#%UVnoXLX3T zH+f>~y{|s2$olQgJ}ST*2pA#sO*kWi<)ff>2=0NIbQA!>4grCmmGkIlGxo$FKvm83 zsNLgHkpqwpf)NSJ4i$bGd1hsynlM13`~}!Oz4hubsXhV&bL=M-;R8c{kKzyjS%i6I z1-wTk&g$yWn1I4LI`lr`L*DDmG+J8psb%sei1KPBfnbu*Ld-qjJ@wEi+$9c?i2;fL zoCDXeSOfAIzdgqVTowVNAi$&?E=8N+taw+G?PDfU@Bn8&DYNQSw#pRIf&fMY=oLW% z6ELUSXJuIucyV2s{XYoYTzHWnO5|2#AD4MnzSmwIDaY`ORi#{3k&YL`e|=5D_9GA|fD(7)XSO$a&7|G0HPC0A|TA3qeY$ zEuTNV-EbDOw(nenMrIFKc51992e2L!ken@0(PTbiU$-8Q4{!|b2s4)*?eBWBv&?0V z?y(;44B0mL!+Prd$4%Axp?$8{c7em0w6L)f#mDMO_uhQBii9GPpk@Yq838s@46;>K z74HunYcqE3NgSEr2#)#Lp>STyWcO^6wpAN@z2&@Y^zl3fA;rw4sK9X1nVht2DYXOj z-RmruSj@qOA1^n#Q0%TOa}7bY4f$Ov$`_W+p}BbzgVHw_+qP+b^92-$V5XTb@22XJ z$SVMg5?J%P3wf5u_@Guxkb0y=qeFzM}O}@zsI_Bhq(tA`=7Nxm5LCM-38R3rB(9yt%J$9rv)2 zsy!+o;u5uH(r_oC=VwsW(BDNKkdEE4&iV5rUtYg2BB~#6sN#y4=bkbf@WA#~NNtHX zcSqZvn;@iJefGFcXtOfF%L6=g=rPjxdBU_|Z=E5V)ZnH)>ConP0AgJZ?m0=Ld^&XM zgRfU(y2lpVsQ4j(j}Ln*kVUi#Z>EhyBRFu7kkwl9@aqDzR)&wi1LhE_kaPlSjjZ(+B7(r6rR80CRW?So?hcsKgKFva1 zM$CPp0vxYd^(wL1Yj+zWxa$UeQBDovuj}u#7-D(*%9IO_rydJWj(U_uY?VH!QVGD^ z&yUANA|MhY)J?bN>>T}Lp%-|h(7dmsuMIIHzVINN!I&@s2iNb8s9-@vqHb6a@XX9z zwYm4aB$n?zR$JygH9F?TZbPgItYEF*4con=B_6)ZS~z7;ynT|_J3G;3^)W|jC={Yd zGjJ+2P@#Ni!1-AwioC=q!%Wh<1FdIboqR8s8}sE}+u7c;;o;}K5C$wxDi2$%@_c;~ zE-7kyT%)j)_oFdI4EV8rhtR(lq6g>QCvJ8xW%!^ESOF%5fX4%X^rP$-(7+zoZym0( z0O9JF$adYd25q52mRGM1XSc%rq0klSqWZgUP)rs89t}hl?7~G?V-@TSZQ0vwS8q>Z zM7kp8izPZ0o3*hmrBQXx51vp!dXgfnP_&-f+E;Crp;@#W$vD_fK`(6L(Hr-h8h-a> zKFof1)wkB};fsBwBC3D@H&XccRcl(%0iiIe@8$`gw`*`bMo}6moCJQb<9706GrXgN{s;;(vGy zkRmaI&v-v>c3w{e0?2E}aA-w{I=b&8kP-w991 z&NlAiMc2=VZ!R^?_#guGB|soTX`X%BNNw$n?vcPLG!)cP%Vel{t(R(KX3h?voe`kxSYz z00;yk5J(_E%!Ye@n$y+0tYp^BMYv!C0Pm`fua1ko=tYhBLD#Q0c$MC_;$X}G16gqT zOItKn5X`}oGpPA7-sgQ%%nyPjKqilQS%iu<@3TT2CeMN)s6r`>7$^guyTuqn2{kAK zz%B;j;)uJofB-Ju>t$Q%h48sqS)F#>9pGdU7rTv4wIJs^Hu6oTIdUIqG826{%I#w? z43#2?7zPDp`uDzQz_jH&5Y552j^^Ud<)lr#wl_cn!YI|gda|+@Ere{Qm{!DsG%vt6 zOr>}ccJylMK=C)t7gv}6kVr`)2?-Hn0Y)+kFK51aYW0oe`Huj;;4d%24XIyGExh3dTZh9mc1)SJ^J6?V%4HX}Q>4t6pMQ(E)TF4$3H5e#G&F)IcF#Kl%I zRf_^*z+r_jtQ4_`V;IFTim8hfV!&9i!wRv5SYa5zV+b*bn8KqLD6C=x1V}YYZd8_lzKxtTaj4b$y$ zDeKvl=V)o)tPAc(3QeF=w7Vh)Gc@(~do)*9ya$NQBXimq%>sdb2pgMgl%bxHV;j}P zRD_G}E83$_QM$r>?e?FMQLJ)sFLiXJH`_Oi>~)cCN}-u?YI=Gu9CG!Qy}{G+%XM1Ub-pMPAX8Ub%dZzfldXF1n>N=*7 z@k3*^;9!MBAUrA2mvv}e*fWhWs9|*31?)aIb!?~`hsW`LpfZRX;HHJEB1DsRi!v47J*r*-qyO7Jy*>K zp1KPSm0x&BI6+>=7OguCRgIm|<7{5}xHxzY#v8eTjqO;g7?dADwD|mdbDP`&0D|=c zVEfdbo>KY_n`vqnt)|1dZ&^Mn8tK{AGVH!V-uJL^rcMJOskB6?y8~FNVQyfpy{A{% z%C_%aSc3C(d)%g!rR7oy_yL$EY>=oNNB{=}!6^c$0pRozLp0;c3TD>!b{<@qUf#L& zyTTTi-gW#E(1vCK?ultcrv?B6u}=mr;`IbGGPYUW!2kdp2&57uuK)&c!+jNFONEt# zx|Q+1Ynr1Og7_T1qOW_c@ueiFb4EFKeJLgNf(k4V+-5MSNf`^{>z+eIJ zkm&k!(FSozmN59pVgtj&U06NAj90$Vd`O&hc-`5l>&;0~9`NB!0z&K#ZF3m*i|VTr z4ZQKadR~#XGj0`B$A_0?^=t!AjpV#===XrrhzB$-#nf`wwQX%El^2lH$|_7RM%>>I z00Fw-VD{Gz69~*$6U|tB50@G?Sz0M8`)93K^Gy)z+ygiS zy_R_D;&-qvlG)qDZxvwDp2coU>*<9Ve7(J6DGR%?-~j{+uirpMpmV-J zcp_`EIvbS1O&sl~DsyEnxEpNW46du4Y!qL!02t6i+JnwML%@NyqAFYW36NahJ;(=_ z+B?I+fIxmn9N>_L!!dJ;s=N}LZEF)1%&a#g1Jovf77?P3jX-hA1R&N8#0B1$?vOnk zGn?`b>bPIUNgdIHARq-0Ph{mkZz#VM{=iBEQz8Xwf8~NIohXXxW zAUj!<=gMb433IKQz0$_*<5XsNy?u%pNPR>9u{eW-KyaG6lMR+~( z_R$m;(8%uT?OB}$z$FM zKC($YC&}g((i(|EAAQ=+-SFENr@W}nSRcOKn{1UYEa0Gd)88QHF%RB$2fue1oTz3D zf;OMU!U*sfybSxkl1j{^(2zucfmfMTcOfPimAc<5x8%H|`R?m=Q>Ux2$=w`&zM6FO zJad4+C!f#45fq4qx9_)$uJ>|p*hmSm@C9=^TYM&RuwCx*>8E#1^&L}eRUkxfdCQ=$ zb)0=~nyp0Uvc^;971Stg8>-pDW*xBkGl6eBC70F>J;+!g0eV@nl*1#a`NgUFHzmgc=72e ztx{|6L1GTQoy-pm23-WOSZg2O2Tfz6O_^e|VIkE~4Bquk-a-Z1fZ7v%STQaV3>n2N z6SgsX+tr=r=xRhb_5*vq%~f~ZCeo}EQ0Y~LzN*92d)ejjyYd9PKAEH#q@jVtnyUr7 zgCe^Is=yQts~qbpf^$O}b|W>d+m9UAh27@!l-W|LO+jS_N+wGxZ6c;4L|J=Y-Qv)fqu_k`~>sFlmziXm1d=54Ioj>h*LCU~*|I4MAeWW9 zQ&MpYD~VJ90B|GOcPm~7M~`iF>x$0Ovg^ze}@c>v` zt$Z7VKvDb9Cn8wK(jTBo*M0y&W<@C^vSiZAR+$n+S!E=YsVOB~@$28uj-lR*#-sNU zO{FvC=oW{(`+e3JL=+qlh|BTqbkld5%hq8f43L+7@iQv@@CU*gp830|19%X^jzI@y zSs2||5(tVh0ahT8L>P<_h{Kw)s(=8!cDJf?Gb~IU3`9v7DuEFZ z5fU;Zde17Z@Cl?+03t#vh4#GV=I&)L* z+V1753Hqy{4eqCF&H2(3qB6~*GAt~jg6_n-Y`1ktiDj2-Mj0`*qZ+)Km1|(#)?O-6 zWz54Ay0XkvOlpd>#JO2YFBiRY;d+(5?+-%Psq*2(<8devK*qzx5yrAO!C_=XB7!YP z8%{FBVHDcOBx%CfkO+#AhB1Oza5WMpNFz)b+(k&7N@0&1WeEX+W5lGyAxWmwEzC+p zh)tw{ayXJ;vLk)=1VJ9+48xbi9PYVR36B0Ju zBuFHfAt0nlSd1!0+YQVGyh#X?Y_bw^HXDtS*jN*7$lQ_?P?AXwG)NIhkt!siGDZwj zAtg5x5+uS+VTn8}Nd%3O!UzD81&Ej?ERYhRZAKzd<4q(}g+U2zfI%$ACPqq;B2p2Y zh>#gbAlq_C+j0{diJ+VkK!zZsOtvJ#+l`qT2t=BK0^2hbSb|}KiiQZ1NeCQjCL4&A zGD#!|A`=O?B*7B}BpZauApyCI9u`S)6aq}87AFH~<9PsbNFz7{4TD82Gr>tkC zy0c8@7m|9`rr771j}xksySp8e9iuxoU#_c05ee(C-D$&tns+kRa`s)oyLAOF(jsZqn)iB3 zG46I{*GH8+)`Qnfc36GAvtM@;7PDhsdX2kP-I*-~)z3+`UrJ0qu zxq8v1UA@k#yJT;B4pIt@R`Sm4d6T$yiPH1ks)?OvJ*aI}Zg+Id&F-$nHurX^(p=t7 zoi3JjR^+@q-ff1~cXr6SW^nAz>C#Cg&DlLcDkTclmA7`wgDacHL^-7b-c$2C+jo84 z8_b%9X1t}3F}J;z=S|J7QmM@q?eldf8x}8j4`Sh6dnE~C#_g$En<@wD(^&JI{%+it7pc|MyqNqTPf$t7(X9e5DTo}!T4O&89sD{`{lPR`7@GT_cku3a<&2WjrM zIF7p94`tFq`?R_RJ2Fn1>svkua-pj(>o*>b-m(!3MkC}Cx3|)OPm368q@!Yn1U8wj z$tfzd&jhfONn{gyJJ-gsqgg<~uC-9=ES*psv&iea@_m*~j$<;bBgXrCySux)ySuk{ zcV9^x?99y0-P$`i;&J9Krh7LwRY@`zTin~`)6A}}?UL@MYs#+Na{Ie(>~(i^zMQK& zF}61|GL7Gxk0_q)_4!6X%5wmV<>RPFc6s2z+T9;!W_4tJx%1|Bz6}MxMFPo$aPOX+ zs+|%FgB2z|gD`6)n~|LqpF!a3qXA7`@b+^am;m=n1dI;3+N^-^H;RR371x#k9-F=9 zcDpvWIdvYEXp6~Le6IPt-%L>j1X#gD7{n16#2BUmMG+b?VknBlMIwqIu^A9eZ+zct zz0wCzfT+L}40VO?H&hdh?zLLOoO4TdJ*vHW@oT&@Yk`A7t@l|2i15tnW8soen+YbQ z%^1w}eEZOJYbF3aumSKR9(?lN78k66*VF5R27Er%aru11 zayz&fAbcTPBWHB3`raMm-$or!RX%gmX>rmYE~7gzoX4qi;QMci+&Vn!DD?B|&F94h zgBwPorf(8K9s(?$V4Pej@_kuZX{op_^7#3KV`7Rh1ZLT6Yuo3~pAdjNr!1;$Y6a$G z;C=58c1{(LZrvKKg7I`;cJUd5A^1VR0tJC>3oPYZ zTYH(zUkGS*J5q&oFk5JDR_t@P-uH&NGltRLOLH4xtGmk>YIINqVrQ?s#$*IH>1em? zDfeFK@b7$e+Mye^2$L%C?>c8Y1^d1Q= z4HDmny)R@Hc?B`P!`L8K?KTTp+$o+mA7JfX+1-ffJy}F$Wo|q~f!4<9m6fa7Fmc`w zJwmGxl&rq%y0rtua`>gH>iTcJzh`aV2s!;0YB{<9e<4e>aP~~ySJ|1IRqnZWQHHA+ z8-}O3P@Jl5EF&>a;59dSty#6Wanf~)*CjUtS+*~Fn6uoT?+osy*x*{(I)-FCEIwSF zE2~CW+Cvi<7@=cR>>a(qZMJ2&BCp;h~pF zTX$6h!3qvNj)!fI)4pBrcfUw-9C^#Y02KCzEFS;`m1$LQ?99nM&{f)^7pTzp3Ca*2lQ<4}5EZv#-N&HQFf4(z z632cX&u$G>v0rMdW3WfzeA*e%lUjLCLN2|7XUo2ida-%z>}~wLYku~XFHYBzIGfve`J@bb0+=S34M zE2vZRPngpw*HIPO_VmgvF_vYT z7Il~8 z2ZstS<@t?xnH|^4-3g1{@EhyfSmq!Db*tYFZ!^m8KslosWiSR#LLI(yE=Nzg-$9d` zb;Mx3d)hXu-UN_x5sEs%JPr8HW>8yJ;2tW`oc4EXEWX(B=K+i#4tsrm9=0<8os+b9 z2()q(Ylgvj+kjduC#jL(0CY4eIXDJ2c3>1r>={SeplCYu0CaxJ17vH`Mb&iXpt_ur zx=DM-HF+}jYVZLO*;9JgH%q8d2A=o<>n?)94eolIJ ze#w*u^jq&;z%+m&xxwd}(dxHgm=NIu7SKbxmxsNgZl;a;A*e8I*NPm4f_Oksk`k_V7oAD4@Pv30`M~amE-kxOjSq z?$CP8YgUwlR}KZf#^T&c2hz6Hj}K9MzOAm@#17V1SnJMs@GTy>u+(E|p8|XV0i*K?|OimGF1I-N{zdO}} zFk{X~a*D1VBEl;7$4?GpudA-*nMHE$H2^cE{7oFdp9P?Ak+~r?2$DUA@W>PSa?|QqtNZP9RlpHI|I-7t|wO;madn^LIL5381$GK($fOu6@xEg2P z@dv@N*c_+bqq$y5LW)ETIoSZZsR_IAcwYs=_yzRz z@TtuCS(7ke?aRMx`-UD_)OUmoFaY(btpLNZZAz;t)g0OAIVs$%M;;y(7S6pAUJ$0Pn&ox`t!6K-NqKg=b1yvMc2#6@GuJ}kY5Zle}uR`~=v=$ejYp)sVLFYz8 zBgK2e);7Dm2fXuaCveu?W2%!G3B2+$Y)K|1^zLA};k(X&q^mWi?i<+E=28UM$RZ*N z5n`-ZEITu&4q1MAt)VVvyOlb4Y4Aic}8fy!$rFhz)fp<2^g##Y!GciAjy7eKe1;!Hx*H0z1G%S7T zoG*JfB-$O+vj!2&vBHikI9(Ug(W~Dlj|TmHR`kstYCGo8hZvxYB&(=-9_pdq4)3?3 zyu7EN2RnMTN4$@o5=d{!)6YDR4s$&26ln8jGeyWAUelc@s;%ezq#!~`|H?$G{pk{~ zq={GdRVq{Zq)NI-m3imCe?Na;zBQbmzWSEC-=*yE+VvXo-pQ|Hc~Fuzwga!!BK54P zdWOEo)`gAC4`df%imn^(@JfZ(Z+LfGq6T1V!;Otz?0vw)?&Hry$Om=!X|lD58ZU5P zQ>kXw6mD=km7|x2WK26zYqyS#(6kFZQv2eA4yWsbf>I8?c}c-kf(OwK_YU4P8H7+7 zr!>kt>_gSkMgSW*p_9bApsOhVyxH%%&0ltJ!`;c!x988~Fpi;>gbVR>YKSOD=>`E~ zbi5*yJ2?mIZ2oVz%{1mspbz~!;?$2zStvx!MQda|ZM(NhWBvR}Vx!`oLRG^4-fWIJ! z_cn971cO`^AGM;vGP+iNeJ^>xq@6wbVte<#7%LCdD*?-ova0XqES90V(YB8to&mG= zem_EiB!2R4*8eT>4QEKay67EoOFq$73-Vn-=^E^odMP8FR5FsZFKLtTWy6>?AZ%Pj zA0?P%i4{7ZRHMk*;pj&0VWbsO&%3_+GF5!2o2IbLIK4;b^04QdRyxP(1O)fizOeh4 z{HRctNMgn=v=>_K5?|Hi#N_K8t~Yd5BW8-e z=e8X5`p}?s)R6|PiEgtycZM`mb)+>BU?2%25K<@!1d9|A0kguZrBUf!;oT>l<`w6K zbM-S}_MxLeHGZdybymM0Ax^Yq<>YO!HB>@i{kgp>&y4G&=)JS!8XXiw62tf^vA8rl z*H@ZfJz;s~aX3y6UK@kkUVy561s`TP_D8^=Ly-Q({z; zeOqb}B*MsC&qu;^-R7lT7U;|xp}1}tb`d&X1V3HZa(sBLjx zHquBy!2!To`H|K^-vnA#9C?<~i^ci6`t98K@gmC%)K1&rg5kjVc+tm&R~|b+rAHq8781OiA5egP!@O$X;orq+YSDuQG-M6ubE zGS*uxSQE&Zk%cURCKQGk4rEyY2DHM`&(XFdj^k%A)jZ=eLk$AazkE{^vpkO zm5<(j7DU2(gN@23m&fqszq`C&=_c4%m(J@US`Pi0*X-rmUE@M4`$Mg(TbZ7cS-pP^ z_#X1A1rwmj*Ri=Sb_~sP0*Qk`P9TtMLZl9%1pynYaybkPxzKP>;RlfBu$=^*Dw;=CcI7q8YDnM2@326s}wm1V1P-O*Cf#?29N|e6(s4(C2WS;%HS;u6~qJ5fO6s| zIRtq=S%ftO#TG3JIM%$xcSkg)jzDyjDC&a%1!@3}R?LWKY`*4!M>%!r4-P@j92s(l zq2hUiBpkBk>CpBm7>3=~rw`$R1SFr~2oRET{_&kWyY%?hvuT-{xZQ7i_gXkwYp-pB zq-2ayQC0}RX3-@Wh@z%IR49@O1mGlOyms&2qA(*sP5bVu{7}b=Od0Lg<;%pi@U2%h zq$DgT1dA&sc-K~DL?9}I1W_M4dqsk8mja1oNle1+JoU|I4aqP7WD5uE`7TKfBq+A^ zuT$gNs@;DdvdUT_qR~(m0;v(NW^4D~HAZE$HTSl0-PG&PYQ0IJco*qph-eNsTvebph7K(Fqt-R;DH1jS+`AYrL@wrZFJkFu9gDZArKL; zri%!Hp}-5EwsW{>(W|cRQblaz; zN}FXeOi4Aby;NV(wdNMvQTo2|6-L5fwfR~H@9i>&sM39P_w{}N z{?5*dBN7TIqO-{)J?rC+(%%`ZDA$!=s6KOE6W+^++kOUi$%GIb3H=(yIo1fnfiVbC z7D!7ZT7(34v9_gwl?z}@Cc&Z%hHFVuRLMkv?YhOT$;iTrD5B*Cq=yNsLzvAGA}v(| z5~!qn>h<^jzKR;krPFQbMd}cl*u((L0)*|085ck*DFqn?@%ohr zq+-J}F}}9ex6hxO>#x7RSK#9AvcpmVSBPyEG9s#=hh&llcuU=BoU*UV;5EuWnN^S{ zMzMpkvXtp%D;+wk8CdFACQLll$6I#Yj_OL?DAo~+KTmRSb$MZb+J|?op|?Yh1s@ETb#L7MXQ>lYOY$*Rnpa5*4i`> zSt5!QFbO|N?4a|xE@#DDsjupEYTsvQ{!wv{VH8E|0DnU6N~^GVZ2o)A@9Ftkt*!ZA zsf`9=DW_{-{m|dDnS=PdqwlKpRaG2CRYVc!2fF=6U2OB(tDc6dS);Cha_l~JBqX1E z6-M9(@OkYXOP>W@)AnWJ+s%8kJcnyC^jn?MY^l7cLFd~rFAs?TARiO?2(e(I2n+@x zL;`!G^&U=FxAp7Kj`jNX@#FA>Ohl4kMoM@{d42nM(V0JtyxAu@^$9VASV1#YbheVM zNQ*7DSC$lrtZfC1A|bsV|9dz(EMi>}lH=vn_P;l+<>pW>uFY^ffFH~iRfz?JSS$Jv zh5PsS;=4Zmvs~ZtuiS9%ppjG;*#kdo!h^n1$zZQZb*dq?e4l-dfI})0dq_mbwviY?lSb{Sd2xexO-YcS` zY`_pb)cy)D+blP)TK$^j-2p0VL;E+}y=41a)XryoFH&pzL*-ClKowFW5*d)uWU(2P zBTHf=7|4u;`KsIJ*X3LDKHsnV`!o8#I~QA``{CNpHRkKf-J25dvYWK(8Tn@u*gER1T6w*0GCuYb>` z`F&z8B9KwKBo4}jqyt1N4q|~Y!oJ|a1C-+k@qVLSvHkqS0W5D9Z5 z$ZK^*K&({#>l6e`iT6ig)rH9U-cEJnqng&)y>FY>6A%G`&efcxtxyKi{8?ml-OlwpV>05y)$9GBZ4m_A#JXmB1T@I~V z$|t9R<<=nc9lAQ7xh=_(y6hmSi>ku$c{DJCdV5v!V{&Wr)nOezExSaCm;hdGtA))8 z>pecWi|?Di76y+o@_DBVd45ql-*^lZ<}AqY_0#EZCV_`eU=^#=#QBe(*T^YAKtN_s zS8?=PSHHq%Hmj5?*|&yJKpXxGmYaeMWj=V?4B`VqXs}@ z0x^sj!I=x=p|00UHfwcuj%A|&gSSrp^VlC(b9nk%Z0xTFN zhk*h>5d?R=nvT6{M`dEN7I++1(wl%byx^`&FOEJ}?}Y@^sUvw)uQaP3#LMw+TWL)w z^g^B6R^M*S8@kbgLS@LQoJLsg816TZj|U1P!cdZjX+Xx98(^u08JTx=c|sv})iV`^ z=C4(mn1V8(#ilF`gl#Du6d{Bh(S#C6t=*DKNEH%*nS>k$)k|rhgD8TQ4h1=2O~?WW zaagJa=CfKaGc!(&;>)q3Fblo%s;;G~Vmq^rRa#ybF;alyQnQ}-p6>U2Ha}e2P6}xb zGrrp?n{*fE6Jd!TFtt^1Z%-rFJSh2!X{NHy5noJ+ z>&S9ck2t;Z#3A8wG@y!$f&pf<%!~+Nf;3$TwJ3l)JEvr^(k%pVBC=A)-kH6=4eI|l z(hpOgeJopiK6xu!%^k8kq{cT_mqqj1Eod(F(cf|)=)-xPy5{pEu1|$-%oc~$hS%RF z849KdK2#2h+Ozh39{r}Tb2BQhKCbHD#QpZV4LO57;>Ad}9yZ>Rmy9=4msI$(mR^8q zq2aa)bdBBE2;khLCQ1mlN=68NBD_b(kKRJxH}if-95FD!mqauuAXI7kJnYkzbO182xGCb0Q>v_d3LDJ$hLFp>`l zyr|v}4`^Jbyn^obyV?b^5>ofV0S5cTQev?e;s64P83({3;t25+&_^0)8VM<}0}(-D zS%4ryxO%I(Ly{few?M0Cf*y!am`o%Ii7Hbea6u7KQDz~qb5DbHGZr@DrwO7+>oZOb z)e{4qG-H8XYc0t3WAQG8V-?-acJZGby2=N<7k~scV^U@J%w2N(-UZ5ld~F)4DXCRT zQY^BSBS4VLXEDEl+hxd*L-@t*2T(IBe`h32?|FEK$>8U`uR2+*(Pc9>nN?jj4OFvj zB%5nX0@`cy>CT+zIh0bUXW;FXcI84#AdD!B76`>D8C3;PV0-WHi@t=Ms`ambUb_^X zl%F4W&8v1P7>WLr`p$K0qCvV*%~r5b_OFT`g9|rH1h3zaThE_ zgt^MhW?bu?Pc^H}D>Ys(JNB>9BC%#{TNX;ji8VCF#4D#DZ7?D#ogzx6g*^!l`Eb8 zZB@Fh&skbVld9Hs*;~a+AZ@h%FS8>unT42HC1})J8)`A6v}%J%iwFxN5(-5P5QN`% z`~3BZWtaQ>$H%_+`}@D2#Z~!1%+8e*OIfKQ8rd00LP=(+%A`qAFws(^DOOxcPAE!* zWn^SZ!Y!H$5Q+$b{A_8J7FkM}GNbA9F7TP>SIqV0c`4rKyn4yPawaU5mQcZkj8+R3 zl(4&XEE!c1hFX%THA_n*zfY}cr#b|oCqzt$!j@(da+MQH3qw?o%hCu*iCT=dAz5WQ z#xd7f*VhV-)gP5T{p_}zC-1Jdt>TzYhs`Oh8CS;Hm7-cM zg)EhBH)s~5wdMD6c$NHfsmUb3I8&S`f(sJ2~>#7t1A%~+FN26L?%%c5wMClM4U+0@EAK7KjGv@ zZ}-8r>e62HjVnpazHJ*V4dd6oDx3>p@ug{L-dC-obke!bn@!hAvb2?|t?gxH&#!%> zx;YQK_NcWQjYTM9XxTLzZ5b?@(W;7*S~k(FjzU5ZIS=+89{*-i{re66pXt^AL;d@0 z4JeFBDrw6SFfCFlzpx2<=RNzM*`rrJuin5kPPD+-Bn`F_Ywr7!uGHxwU9796B$mVi zC>D~^S`3DZWT{OBHb&Gk8MgXAadB2ksiMDIxnw0AD79ck&NOJ(IAdayr#fB2XmXBF zhGE+8kp2GKU!ce9WB%jQ9Q@+0Rk6%2{`{S!b|(v2eR*&=H&32DODy3zPhMH?YTapi zJKBwtw++|l%=o$Bp5W3X(Xi9N~JPV(KN(1O4sVQ)RYvB-83d9Tr6E>tvgx+IaUZsctRP(;oJzyA)y?SJqe0I2^(jB)2@u&@C|o1zkp& zx5w7=Rp)OSuisVp!Ld~qHH`_iqeii8m6lYNG)%B&D$5M9jDvMY@9XpL@9Te^_4}HC z!~8kt2p{Md4G5nNN@}W6O6o`+ocGMq{|l$&{F~efU$`8+^0v?|$pg&RO)t59*GfuD z15%bM0GTuhkNpxEzZKKm@-Y*Y1)B*!%wDee;EKs~Js~cYi(WwNC6A z2WGL`Cd+H9Sss|{A+)xxxt}&$Fj$TA^XJaNcBSg?#&PRE9e7VE*Bzf+Cn=`=F7@jk zyiXT5=a0MjGYK}L(v=cymMx96n;R*rDlxQTq}FMYW;9z8W@w_fy;{EgeDM|V|9|t+ zasI{sBLAVc@A>}fNk(NHITlhh)gq!{0#DM}&-Sqp1e4|;Mx{-uF;Pa>H$DQX3xNvSJIEhM$Sb$h|fx@UU!*!E%FbhNN2v@~|>MU2{7 ztPzz@+nBxnJM24PFkJ5*`P7|gaRtbh;jE{A7ZOfMJLX|y9NAl|O773r#J3B3r>tge zCh%ch8*i>~afC=;Anai_iXQBS#DJ1skk;yNW!_Z<7{9`$Rx(m7z@%-pt9Y+axA3>- zBq@_7%z}e7nn__K)I$Z?2pK$kU#zO2Kc!r+uom2bda%{w!5RpFC0HSVfZD-WW@G~j za8_smAb_ysVmlzhD{O)eW;Cr#5&<1QUA%;cljGXk&Wz7cQQRME$>f!XN&%Nxf&oxL zoKn2N%czo;LIEQg$s?&jj}wwO11iWGm8BL!=uL(m7!oEl@)3a?XALbT0G5e}%nrms zd66~%F<^z9k(+_cZx&Gz4{hDE+Fi_9-9gR9BeBudHtpJLuIb@%3|(>1H+OdK&kMsb zWG>QLikqFz+?qMJ4`+@up@L1##91-N5cJ!)w{6_GTp`HtJB1NQ<+mO90QZNz`T-gr zzwx~0t-s&i%6BUV-lZ}8Vo(lrGPSzB9d3gS%7_6085IzYwt)l zOI|(sVmLBCP9I0R)P26Q=eNGX<%hE~GXMd@mq!RgfxuAa;oV!)&i&WD<~y$UedI5} z2G{4l(LIRQ6|X2{cnnie>>~o+H;=?pL+Uk->MA-Y=LvhSaE&WAt=VBYZ`w4Q z56$pUEwGIu3QXcl$gLu}-SMnJZ{2Yqn$XfY_tC#LpJ*_nLm{%kk#U%n*nYBJWd{Px zz!%q8Rn7TO=T8)zuUUU&+76K0GCzvPRS`)={rkE)^?rM$FPnW{K2;u)9FO0v!!|f4 zv(MdWKaogtV(woV7r7GZZ5n~to5MJk=InEHu_A6!6g8Uc4vQd>%I-Vihmd4;qB>B; zx+vpN&=%>hy4|JiB9CrRCeI^TL9~#Qkjr;n2^R1VHXvj9^ z9=qd&fgBT^jh%UX9*xo!o-K93VK5h6BABZLv9TRB&Q^?S_+}VuW|Pc=0Yy=W#Rir0 zY}=_unPyUJR4}#GM{Z%Zs%eQ$CbmjZvk7Q#!#&2KLG~_APCj$sZ{4Kji7f5q zOepS$4YDYiO(Lmyq~j2=y|((w|MaAaR@}`Ana^lFNE$H9EkG7GU^3}8GIUoA~6_| zHZp{@*=(9N27?WhQ?;rrNx5jMY_jpHVMdx7;GPz83TuOxtzh0}9Vj@C&4P%W9qS_9 z-Ky-%y0WZnx^9$?gy|ZO5AY85y(8ZJ9sT0&*$S_@VQ?2V}-;K`9o5~ z7#*h%Y>B)Erv@3Jlh|)ZRyU1{z?4_$+J`u{SPkPBMKy}PX6u;C!YZL*SlogDunD!0b z9$C|LW&pOLWC^_qwi6+g5>$G3Hw{b1WuI!g7Wach%OmePXj)BS5Wdj#={?S8fT^7* zyo99O!q1PbaZ%LF<{|phbk*1fLL+McMYz*=gd;_(BW#hUF-=8@;nNk~OmN^n>N0X{ zA9CxcG z#qU2)-~5h$tdakQ06(AVWAv^U6j-WZRB+a4XdrbG$mS4Tl~K|QgrcnG6>6XrQB}m6^mYJ+IoZ8K_RR%Djgw#jNLi&Yx5TWV(2v8z$3UU+yi&fhbAcwSd0 zeA=5=9Oowsls4vwwI#Y`>&1Sj zUcY4n_y14ve_em!gKf9-^rPt}qDm=YqN(Hp9|w6sU-AZXCgzF_KB8y)$ZY4%bF)-z zBnbmY`kkt(7`23i|6x1+Uj1!fihD0t-if5!&s$Y*0g9UWbEeh0+0w3&u94DsH_D#g zb|bnRxlev^Iapau)vh}4h&2Gw+|=6$IZbSVvKU;zXovgqhA9%v!!m4XBBkqE*1i7s zx0w1Bf9CAAt3S)gCoTVEl0XN?%3{*XVk9LLY8Y%QP$>)k5)yZxk47Gb{Jms*=McFIch(f`&z+RJQsHvPb)EipUEoZV*>bTot3lS7noUlfgoaJ} zn+Ybs4F5Bob`aP~>&gxY$TMC)Kg0h0{P%*gqUNi=W?{57gb<7*{{>KFrEyXtoauxam8|U&Rj6cGw*ioH zkce2e`@f@L-(wr&q%NU#_v`aMovXV6l{t1h^x<)WVqEjLG1pEixWz_LZ|8ef%vEBI z>dP$98V6mxy?NTZuo+X&JM)5^n5GKZ%rn;2Zv@CSzvtBl2_HWk{P_C%``N5`tbSFC>CNcp?!+6wtL)_u}8Rz7>*IwY)JmC%$w%5R>^mS{9=zMdS%( z)G7i9Cc6GH;O@mRKKnkIwA%J-n@O~_8ud0du`Gt}h1L;@x_UXZt(ZZTQ}Qn_yy-lj zi#LnszP#+@XMzFlYeq;?0p0dOXqi&F5C?A6C(S;1sC5_z1b5#kHQ4ci>E*_8%i6lP# z@${d68vXdt{xs{lQ!$^<$Mvd}X&ppN>Plx!<}>|wwHoecnyh`_nS7&Cf=+@&Nd!bh zO|z9Sf1lFR0>e<~@Bo`r8$eaamYH$ekVw>P%zdvc^myq zz8Qi)$DFV@z|um>s2u2jRZUbkv&^F!f_(xXh)Lbf{JY8L@mY8Mo8K2R?A_}{YH;6L z=Vy^Nu|=v%sEWm*DM==ju{w~IXdFZ!=Myq6DUl@-Mqy%N1zlLFnFuBXRw-jB)Ebnf zRU*<+T=r>u@0&CSUHWvA(=YJG{1b1?ZT+ulilmWhb4IpYvk1|upq*tQnJj(S&9wvw zpK`G9OqE75X4=!L{26R#oWHrNqMR(ES$UG=yt3znB#;kefh$|DxCei~v>(m7?e_CY znRnTn)H7Zw!Aek}q@k$L)l$R5N1)wre(M6?Qn!8i2kbGv026FK-{dhejRm)znwnvJWUr(QD?ahq*!1%W3TZwaXZP6R?ZPE>|q%2aGPhEg(AE)X415rKsTc8nn4 z6d2YR0%Q=CapJNw3BgPbFhW2njK{7^rwSrka*jY+jD;majYDLgVf*t9 ze?9J|u_m7~UpavX=i#s48l{k7z9jff*MT7qv3ig(_c%H;2ghAZ%ds|%;m3f}*f4KgnCPO{*1k;+y3B3UPJOw1nk8Nq zPO8Zw4^D07kG4zO8>cDT&iYwA>*rbXPO^+PXu^+Es~ul;TF9o%4PSO1$hL zatR_50KhfLO>F59r^D0oUR30ssTgAB!(Y5r~3*2saZs0c?G=GUy;R zn*+{FF)OwK+eg$O$B;pyH1eqllu#XcetzGVJ|dnY!qauqI|jV&*)fCx!?CbSn7|($ z&DP!MuJWO{L5z_B0T7IrYpsr?JjH?IO;dcTpgK`zv^5deix_LCi%nq9y-G-D1{b># zDI*86gb*2*!ilv|EGn-qs>@bL`QqKp!&_pWH=oI6^iNw zNNrh}u)CnSsVuIJq9~IIP_1g4y90)aI$rrrXxN#}tx$3V(R+gIt*vcuN}G_Y8!6TM zJ{3|eoJj(f5l65OFlQ^)VOH82CW4VDgg9^+qR_dt(*sGuFt^e?#PZjG9uy}}4c7cB z?*o!^iv*x7K;`MWw5VkbaI&O47!P<2Se66Cp9cc0bTL*g*p zsc7#!y?m>7_M5XaU0zb>+snIst{U@MSXu~3Cy;CekYJ5n^BR1QP#ys9R2vwKrNP$r z?YgWW)lwQ4VzT_-!!hsNPmEU$IX8Mj2M|eVvu3heg=VaAFj-hQG#RAw zWRr~n15GoFy!J~{#iL7CDy`c`Vr!)P+xA=OjfGBJLc9)r=Pb?5oRt{t;=b~3KM?*1*TQrbC6#7fPM}rSKs^T5!H`8Ze zy6{)t5K9+fVRh9XfC9&Dycimi`$Ln>z19F`dHcX~FR(Gegx8jkMzx;HfiMV*wu+J3 zmXOQ0!K{FdR6Bd7ZQWMYEgl{Vma#M57C`oT5@z1Y#&fS|`C-GkgaS9S%bw_g_-C02 zMryFLSDqK=DIEBhxUiz55f+7&DygbzDyXK4qLzdenm-$7yz}h&JjYO^+7^`Jn)2*mf zkmCgA8zMPD1&TkuIOp)TAI5#DSkP!L6(N~FtisKqCbs6KQH90d44FAUtlh$3GKwxs z3FIJs0Gao{m8B2wOeU!JN1v<6ZmB9tXk}_L;!-J+Y>iZ{3o!QS-QC8L3L_aYIY&ta z1(aH-WhWq&Bdti~20|?poeqVWnS~S?-_#AK4f|nf>8iSFX_`I#;7>wN&?nGZECq4` zWE|;TmoDAP?z(}EFME4jnLBMtkw|_FZl~8IJr6>JM*o@L+9D#za5)>&n`YfUoq4&| zP2sQ0v);~gs;9f@>64KK*ckeG44M)n3(xBFoY}@F)d}Sw@rI2WCD-T>**!Zxx;>w& zw2wb$hd6g#FM138{SMl~s+200kr4Y^tQp2@T<$xkbv{PuH&rIE)yeWsggpTQ2!s$n zj+Yjeg962|B}Z3Xn6a>nn~V~*fk&a%zkuosqBG?5$M9Ag05xfBkq|vQseRO;&@krL zqshJbK{eWjQAh7&y9JcZcOFMXDX9}&#yRHLFH{P4u4MTN6HY2_7VcqWj zk_X>;Uw?b{^k2LQmN_}+_siBIh$zHhtx-aXF_l!R#7_Kq<$9Z8ms^a1@(}bu4dR0l z8TqPYsc?`V=e|e>fslp?Kn!o+usG+W1ZI0PKP-@~x?hk~Xjij*JOTCHfh`)_9r=6cKCbU?H`HmbX5Hkof1iB z_VjDF_6A?@VsO+rZ#50-41Za`%}#fEGY*9Settq8j5Q~o_oaATyfg@iFwU=r<^(#7 z*+3rzn&xW%d-0Bji)-ktR3GL_P^G0Q7)e8F8Kngz7DSeb2}!10Dpav+H4BDF$|N-v zQSwdhx}VK^Myc1Cs@0zONO>a0BzO4|B0|WsPNADhQ{!WD8vf7X2gy8P#zhU>(X9O9 z4)hGTE2@U|I9Oo9TQ&M!gtjaV{>^>h6J#;y`_D54o$=sb82Wh&JFYq0E)9GD9W(E5 z-`aG3*LRd%?S9t1sr<@RVzQEyQHc*j>8IAmnyfu4Y2b|1V59lC5H@=zyY%Gu`6s=@ z-1;gNt#8xTZhJT6?i$wWk2YSAS;Lg{F&i^ip+gHU!QCF2lU{K$Veuem+cJN0-*x6! zuFm=6_xksK|IhdD<6v49bv7hfa8j<4W^sQ%KWF!k*RRg~W4I;%8o;!$su~(9;UUBN z7?1JPJ`#gFQ$r7$5k>-#sr=2vcUKK_y& zxeAkvB(_OO#!u7D*lTqHnMaRYZ*{y{u{nXfUT>;>DD>g^a0KEwe}W>>pQ9y2ErLvC zMTp{odEL-7WbyKDM~B{P%LI|*qqiS-1k^}9y~n=z?bL<sZN+{mA=6vruQ|R1$k*=}oN6F`C_?j4%sU(6zU8NB-S!TAY3o#p7 z5|<)r!<kI!JTGP@R)K*I5uK9uJ3%wdS@&VBHV_2q)Soh!Vsus2O1WbeY$$cnpUy z4WNQ1A@kdv?6!j9`foYDbZ>`wq6Cr$h)D$`B!ge&cfNUe>fSv2Pe*KX&E8U1*MA{L zC)^Xbn;8B^&&F?Wql*mSa1a^AB5;sOh{p;?8Ij1qX*5)U&(T8?`q2*l=svb6N2;ax zhR;+PF$*T2*TFs@#Th(@d|4h!{?rmfmx2|~(>q`OZy)RX~`LDZv`E2{@hU(fC z$%r%t#pJ~OiB)!Y9pvX_6~}j)XBH*fiLO1pWC>y*pHnOwjKYJ;^@5|fXJCygb++&+sNY%zRah!@W3uAT z%1D(Ur9&0(x!~ey&%AaYnjLy)hSy@8FZpY8*%uMSZb9C%v zmMbev{HQlW7w=KAWM8-{Uu;tX)3ivizJ7h|q-5P!F-tb1Sw6jgP3;sp>O*$wly6v} zSX;$`TFFc6ytdA&q=o#ewlyEIlpXiY(lwrQnBg`Gu&%P_`+Rm@FtjFuU$h(q1AXa!^ie6_PK0`wG2q3R5T?aP4o_D+PZ0R%AP~W6>V!On1w~x*3LMWe zfNm8Eixt5(UhbiK3(?hYmCYyNSeivSFeC=nev5?hoN1^63_O&`a&Nldd)jr52q(S{ zy4A<6f@p0#rI3P*uv?^Kk^5PHcW~jE;aRDrrAp08dkb#0iqxz_c+4oX8H%Ta0Mx_* z_v%_cIM@*b2j|jEnGAvmCNbY%7jv1J?ZX=ze-EWY@0YMA--8@uWFzO6{5asiM_jfn zviGW_sc?iTS!M+i2F6(vWWx=ZNedXF?3PqCGLdN5ml1Z%)m>3*1BUQy#B4ZKi!W%# zIfGVGIf)bzz^on#vT77V0ov@^Iv^%Gs;V7$E`Tr9ho9>6IsJaO_tUS z$YB(_y6*P(s;k`keFvMW$^#lrFiDNL*m6i30R+PlpmC;fl0jld@T3@!pp%Iq8i7F} z20$8665}j12rZK{V3{OCVFtAE4nG#{5n+Y3o zLL9EJ&^9DaAp`}1Rk5!Q_mH0p?@^X>%=rF8dnqb%fwgFbp7%av|0$9Pnl?5IvnHW@1s0sc`Ya!K4qcB5RkBdf6p zOa>?bDSNDa?)d>&I|YjRM8LN&ui{;4sM6a`Sst_zR({#kbhAi4|oiCf7;B*J`IJ?i7ZexV%ClI;`_cc z)pzRvcrBEOQbaH05ykuIN3Q$%a%_2V|3G5q7he)X??l($dTTmR*6pgL+_BF~zwnCu z{QpnRa=^8eiV-DcR1zy7A!cf%WF(}iO089qh@zrIR))p0tkp3=VUb2HEeuTBN+!R< ze`e$QpzB<(QdE%j@4XK}5d=U;k^*H^G5&jOI#D4KS|Dn2+GKFbB~?&02(9|j3XxUa zCsoLXVpFcIrQH(&h$?jJhKpYUlgib3dvKzOzq7xr+5NEg=;Wiea$Oa|Sz(7h0F!>s zRcmxx_rKpXe$Ow>R`K26_VB8rr3DJgs-Y@S(tQtE*BR;4-b|0a*;Yv>^07NYZt?Az zNkmy{%NePbsp8?EjNOhG*XZ&2+wpV$kjqvk&X{OQXi6nC(fGpz#T|%~dchH}_!!b0j*MtSs6>J_C6k za^D7JeQ#!!*LrF>lzYpY={$(1(gFN?`<~Rlb(eDU66uCbXqAgPq-CZeb48Ga za;-x-+M?1@LzGcPA%eA3m6W2HMYQ6=wQ14icDje`I$D|h{cdW(aqT_~zDN-B`LSRsf;P@iZQBH6-WttgFAKuw-s1WKU&e)qa4pWm>} z^xtZvx2E=YiLl-4@(aH{gahyIv)=0O-+8~;!-exN&)z-Xe!KhsQT?pbHWnPBDu`BT zYKjVKsL|Kz!!x(9y`#^Mz2F%^q1$gCRrf1b;qBKWbq-wV7Oz;6KMnA&uYP^ae+Gh~ zsuoV@<(s6rU()r|)4T3);d1G?QS6dvAQBVK^s6dN>lBpqVP~G`6X`mPpACcMv2coo z_;poTSL1?(^s09C)7w7W1@zx$#<==sm{%jT;oy7%e5g90v4B$bzV!3#!9E{ezYm0> zdG$n(Ob;z26@_$@cA6?)F4I}6^V{9eNfU23RqtO{QaO zz%0}eZKJ_xrR~Yua5zFfw2-7PorIO2?1N88y~ zKE-XXk8sCi&~@U$xyGvlz>7fTq0vpfy#$y+Rkn-IMYe||It+;fAc+q6RcDpG>&oAo zJXI}&+}mR8zO|S4y#Z9!2QHqgrykc*#kbp_@sdnjs9jLWk}isvUdqbHo`a@50(e-y zZr-ccb43jkb=`S;z-g&RI80x9hw#ufk4RLo1u>9g0hySR9qEGVIC7oDQwd|O;A8E! znX3pVeEtf1f%b+tETZ>Zzd?j}WDt801-$T+&Scje^1Sgp%d%vH0U-oHU;`jK4mamC z{Jkn5duIXp^4GrRWZXX-PKwL47NOzW`jWBjRLY}W=(ap*&7Hc7mI;H zFi2I#+oC{p3*bnDfT#ll8t|4OaIX9U{<6Q1hNtkLTs7YMd4REJgD?*A@ z6aoZr1Tb)bj-<3C54I}@aW-gp{rW?j7eLsEsWMxSex2vL2i{hq?rY_f8?aAtNDwR< zC=h+xtI}rRcCcnHce>kcWO+l3q&KY+v`t-z5G4I?I5ENRwt6L~we{1haNWQ%+ciNE zAd#mBYm#b1_sBX!R|g2ig@D`&8Bk&d^~%LfOCtDLpw`f`XjV_bZ3t8m4J^MPh(8Nv z0|tu-F4&i?>K*#A=y~i}>;;fXVYovC1mbSi0WT1V)}URmTWk<%v@(PQM6ltTAd}~h zQuAMYbMxvm0E)y|lO764WQ4(4njdLHMhqfsO2v2MSjocG(T*oVb!yoUY?7t-poN%+ z44`#9pg**8@F&T{JZTez82Wtp7D_|32qTFD42r5L_jjMK*?u_xt|+{*YMxWBvZW%$!YVp6(_|nN)PY4R3StU3y{JzTwW3)*OZN z=>Y!wo)Ws*eqY`{47{qn>v9A7`2T-m{-#E8I!S3l86@AY?EarVYNnpRbyLBRy~;X5 zPwn)LElE{d2`T~tkYrehswktg8F~GDxh(g|p!uJnJm8BC&5+O*EFtdx+lt5TH1LM)Y%k|~;pO2Z{gK{V=# zXIfTsRz#JnRYh0MS4Mi3B9F}Ebp4ez1)m}9{NAk#fk;p6HvSkt#oy$}=q40tQ4n&A zmm)cWXsQeGQ6LK=0f8A?>wSFm`W)~JDm=dM*qe4V3J5Pol0!f}?+;u2&!?2i9s0k1 zRet|?{|tUfEK*jcC@n1s-{0{+NqdDuswlB%ZtMY~6YWg*G)2A{cWb~jrcaTN4u-4eR-YlbzQT|Asf1E4@eW=?v#1XJ#Xvf?B(cgL-We# za7Q_=XY>4&QAtv%Mj=HiHBB)QMpyU!e`)-=$M^lu>+c`WqiV7GcMcDO2l^wQU*r&o44Wi)9qL{U~i zMP&DvM0@FdO`k|jjFE^b76^+FK??~;7;fjjc$3`y0Jgl>C0u}i9M(bp)X}1Wj87Vm z#FNi2lu-`)*RS-@T#IJs462Eq9@v|+U&k_ySmxq_wJ&`3W;zdWt|UH zP1!Vlqb`a(h5t*1We4XW^AP~s04AQ%s9rVk0N;@N_uWo!+}ze@E0kUz%8XP-EP|;R zj7QC;a)W96lo}rxafdyvp2|+@@5F^L=b;0ikp*C@1WgnXV8|>D`OH1|!sfqO4Ij?- zXP?~O!&{6^Q>-f?$5?c*kiW-#*j(mNR>L8(9}o=Z^D|lGEA`j6fL*+SE)8a$a2*sF ze_{%e7>Fy~uZQaHXTOfw?Dma(XSwcI?!;h}5+8Q;)>LHcFOCjBXe&T{1u=v1*`OKx zu&tDI=X?PaBr15x9o>9M3jzTE+0i#cK~<}5>2!gY4VB;w;7MR{Wu&2kM#DH0fa3$+ z-NpA86o+=lebL27oEOA;h9q4x08~_25(I-76~#+15rpPAu@_LHtfD&rrw}wM*~eoi z1tA)O0-VHfDjOu&o-%9^teEM<1Tf}z6sfpMV}K~J zqJ=O3A;7a3!!D>oFuO)UDkvdcX%(1JW*uQD6qON)X9Y%-aypfvbTeTiLZszLs&rB) zMOK#uv%Uy~>J)6F~jw}uJaI6$)Zf1~$-QOx~smM=W zgka6f7olG65Ih|KoAL#3gLx=#Jg%lb<yRu1jA2NpSG zu;MFCIG|xtvO(K5;;ffLa#7SR)A3|>>Lo}FgUh1F5P=IoMbEVd^3eOpdDJchCYI$* zK>w9`2(f6BAQtD?$SRU8Jdo9AiAS(#j;8D3F~7_sa^44 z+FWy^)Hjz!*g~%IC3aCz_KueaTN>@t(E`&V{6uJpr2RqG@b7Wj9{`yR2b$rRv z9h?R%74ZY7!LP41OU%Cz@qLB6^@tiId~WV5$vw{4oBCqW- z`KhZ|+vz;so$(up(ONd`VHvT%o>8(nc6RqXqm}Pypi!`~rSzYmUt$musuuLJq0SGQ zKbj1U<$YT7<)cFE3r=OxTd5B%UZFt!_VwSNKcC9i3oewsWmsEF)G!(#xCbdtfIx9~ zEAA92!QCBNB=`yL#l5%`cemoD#fwXjQnba21ZmIt(sRE1zR&$}f86yXd(W&{vutKd zGJCIezH;`PobN#QVr0~DaFn;(04uOe*5~>y@u$Rh=L}qT)jG+4b##gCm_lG|;a3SQ zzb6yonQ4u{HNR~DfdQQVFJ6zE|t6piV!Mw z<3{u(eco_Ed3;bs{XR6u(sk}t(3dM=4D&`Bi@GrrQS!1i=TQ|}&abEFCNahd$5(^m z_m4go8l^LfTR8%%^3Tmpl&4B*K(&Rrn(Xbqu*6pFBqCh4sF>+#&Q?q+{tjzh3|1vu z4X!VKQp*w@XR?l$N%c+KuJKM1xyy)5HqKZ)JSd2R_PyyRexfAPQ$LQ@>YhCI+Wu*M zt<>r-Ou!YAcY5Q@GihrjPu4MXU;TC$%20Bc!(7hOW)XK5^X z@^Aj3EuRc)>wCD`iI#T>k=aO;zN&$l^n14B(bhS{ia4sZ)=b53DO$jOP^Xi8wO&t9 z3NzO7=)|KHh$1yX6!Ef@ZxIm$XePy`mZV~1OR{Sw9rkgM0e{#)XTOd@jgH)s1h z*&K7~!l~b`VCHm)aRj@po7dpLg&-aO^&rVp8Y#J+G7EmlodNrxGx)c3E%A8pz^;R~ z!xRMgDbE9Dte$(?Xmujkvlq2NaU?BXP+;*p4ITc8DUOh%IkkzgC^X1xYI|d+7?eO| zEd=Vkih6U$UsZi6kNmmf6Sq+IPW`;<`iE0n)D~gxIXzvs;U#w#7Ui@PV%aTrHI{;N z{+q497!=GZ#I>9DXwHlIItY~t)i(Yj!Ebz8NskVHhs^AC>do(o=poOu)Y2hi@aDWDpmYI<9LOSnAXbAsQrhIB{jk5Cvrt zLv2Sp;dWPGnkaJudxU^3UfH{c)$a!nu>HX(NpKigIX9Il)tN2T(Sy9T<2>vo@p}nT zZToAYJ8j9O7hXluWuM-}7N0=ZXpI#AQX`&whpew5-TH2XJh05+9I$3ofXAO%t?sEy zyT9PI#JJS#-C`_}t0kq+e*ZFSF`lUh@IX!;K70xK^+NnbfWw3_?mH^? z;IXGqh)eznsEkQ!>`242H@n>?r!Edj1E~d+Ge@P_Cqg8Wu_blKDhp)5_a*#Pm=39) zr=NM_*$5>n>81spL$WeWtB~cEip|Oi<;l@3%9P1*3)I>66cj*PL2miD+IN8_1EVi| zAMZmDEYze1RO2SJm@Obo`C8_<@REG(GKDlQbc3~Ixh(D$**+J5n!TN}R+|uenUdNP zIGb&k<8rARd;|`y>^zFHLw&S_3mN1U>Dq0i}9T|^xW`KGa(xZ2DmV>-ae}J^B{CxZ^lKPEzD!wt7 zS_egLmHrUHZi}O2nuK0cN~2MTam3`>wAv{%3wK4E!G>}xudxSydY*?nG`&oope#|` zI$cFKE^bym8P7HTi#T+QrvzR0MbR&N;~G_k!-m@x*7-zvlI{Y10#l4$2q2BH?-&Y3$N~rK&vq?A2{3;H*3;i{3vFGk zO*tTjyt^BGZ73>A-*6M) z#w6cssY}plXnNj?Q`2L01gS7wJg-s>MBE8pe9sqV@UWVut)MTLH%@3^b$MOhb||)e zW^tFFb>)sUgTKR48=4EJ^1%V5pvxQ;<}^-(hgqzTX2+Jo%vktJ-aU6U=STWBU{jXm zSQ&Hco<^KT7i5{-NcL@_x1@5jKjmfz2lBKQ{=)i|;gXU7JPLFi>isn%pDL^yDV1eVX;L=Y zTg~YV%JtTe*LIRfZ4%1WK&|Zpfgl{P#~#$WKEh35w6?Imf1*j)HM?RjToFS|)2x7k zd_JeX*K_{U_`dcVT9K*1ShoDU_eN~dWSAbcH37@uFQuh8FC<`Z4RK60&WwuxtnHLUN9n8h>XD_*`E(w!keC%0BpU}9xK{~B-;P;v>0y!3`K$L6Xt zkv`{OBVbn9^h87FuvH@2R!bOhj?O-wVC|3haC9DpyVyfoKxzEWJ*n7eC3*XB{SpUe6rpS~pd;_miqJGi6 zNgOBMTiucI*E>pxV6`8||83pa|CGdX?sB<|ggHLhQ8)@CLrouvEgDrl`z};pM~^kR zUxF>~9@Nq69>kOmoE564ZD!{jjG>6+tq6;$^!YGkziL09L!cFJ#=tm@V8a)f_TFf# zn(^MojrqBWe94F{QOQ&Q4g$|EwS@*pcybhMi{%?}a4In!sP>iN4GG(!921^uCY>)u z)CfpE-|O>fCjZFltbg68{=4V4hUWlnas3dip#yq_94_v7+?Xndnr?enbck-*whE_H zWV!E&iYX=|zUAGU9!E3ph9)9fL=o4Jn&{7ocxzF-ZXqs;HnJ_HI2OXr&e-(LfezYW zE?{owun&Nk-;VX}7Pc2k91BzYW?Rq9fVt*?5EiE3{a)ipkd9>QsS)4$Dfe-@=HRBc zU!?!b%-!GY21V|9y+@A{_Pd-pdlXc9UO7 zIGyWeqK8VpB0DE&({P=~#re6IdR}(LP5ORzLG|mBEuONTHD@-%eUQ&q-pMD(syd{6 z51K})PFwpT#64=7;ODdBFbBuRFzM|XuhO6cv<6rYgy1=5>~3I~5Ah4y_1Vyqws#-K zBncv_@gP*pW5#7JSW4>5=*h`H5Kl+$dtOl|krYZKkLqgWqy`YBR`(1wkfq^)R{6#g zdjDT0=gsTxpMv^_ggiuw^7y*-RF7~8m#HY4cHS!dExk@Bq|>+SvokWDrlj;iY=^t{ zMkbdYqYMYmNM6m1$ByMXl^i<#z(4!@0`}zC^jw(nZ3lmCW-)EIpZGpUb!`35&(F^E zuJ1|YQ*H6MU#VVfsAi23l~^f|U4TmxSV)F%>)d>RpGt8*B((ar6GgnSdTiJ7aSc=Dw4E5~0A1Lw2Cg%^XkYIVe^B zB{FWJU{sLK(1@K6i>miA+(>4U{N!y)v5xcSKSZ}p0_e28#-yRIvQ z49prg?-K7kwmw?))Cij=wkRF=%yJA=)5%mOrDA4JNGM}g0nQZrByAx)&(ABdSBxEm zgN&*ysHwGAE_YrlO#C|eE4cpH_E<(F=-NC9y@?l~C37Zuz}R#NPK%3ZQKHaEy4hKl zUhQpP#69(k84ll7U`&b_)3aw9G>kFktIWCDSmokw{h4F%6v%eiltGXIdk=eH1p zusYpr+UYIhEUP6jkhjHhYuEaHa?vSwn^DBrD?n--cfB~bCA_m!lr6J9dvOO)TBpgf z>WjSy&V6>vF#FqQN1|9_vrpnK@vfJy@TBl)Pu`Y!SS9Qx7_o5_5;$X}Ms`wa%!2;H zZLSdNbn?Q>6q%!Mkku3*b?t-4(}Q1AN^SvpWN?^ho%)nzJ2dARGa=O}FZOZlSpzEh z+`y;flRnw`HWFcu)aj4V+Ol|pB=YuA09KTf#f9Vj{@gaaOS6k2XS7mDPFXGk-x!EP zO_(*DDA*2A>PX57ySq;4eA^XzKK`A!;rV1pgp?Dr3i+EBfOkfGy)6>~^g#SrPS`8g zNS$~~HRS$mjyi5kTvJ%zIT14c?hAgkas;L`t6ymj|Gaud0XMTNLUC-m+SKJP$sv*R-pj0p+*fB6ZCS}n&|bls0^jF0rM~q?24cB4@kc39 z>@&|gYrF_3gfA0tH-!2Unip}v zwvBibMI0CAnz_t!S*Dao4O3KAIMv_0Uaaz1to z(aDM!aiKwrvFk6Tlk1$t&N&F!y4hT$`RQQ})fE1x%rg@7rBV(p z8M4?^e_6zkJU>M}21%x}SnmrPGZYosln=Fd6AtEHP}dlS%AS1i`Y4qT^h{}V+Zxbh zRO&2+U2sSB-5bmbIxPgNKMs~h2!7fLukymy|A80lnb6M`*kAIeFx3d~Je2qgw)zaeK|B77we>v$CfZo)K)( zp#$|cZf;yXM~)WfT8S2@HE5@E3EvlSrmNMfz2IV!<11Q0cPP$?>J>U!EtAR)Gl$;6m5vcpT{yN(xO;j!CxP0R*(Ua$q{3Z3MVEDXx@iNc#eTuy{-m=P`5l ztUTZywU;MZ??)^zufJJ_8glkgH}~_N^bSngsv*;qEROA8$V|y^-dtzvOw&>R%@vYm z%D`(iW_O*l`)e+XM6rV>4e;%wXI$AA9Io!|K~yTJw|laW)f5g6eiY;bfs`p8U!?H@R+Y@4zzA6}#U=Ty)E@%f-J2BEY^K=>0Z}(KR zuTRjZ>#C_Hxf>el%(z)%QYM*pT(PhyV4Ed0_s^_!Ywy2f*xU~IQ3&c;q(CHG)x z^70JV$Y*D-51P9dd~d_QqU}-aV|#zAe7)8A@rT^sA!L$QyH7|c&bNCfBR`lwRA%ZU zHPHo^&ug+}K8xY$8%vts!tZ|HN^o@zpa0}m`1!eVYINlORdE2q7naRuKCng3k)3Ua zjQQu~@IwaD39(JfJ(*g@MTyG4C!7~uF=9Xo4BwYG{T2~7UX$&ejqp^WZC9uD0_W~x z;atU}VUAJTx48KaLox)(qrBr;0H4yLNaJJ3ql90c|I%^!cd+k_)ptfVpa zYzHBcNHMJ6UxT9w_BUQH?2Y&f(ekl9>ed3|)VE^Oarm|-TTXmTxw}Ia8VSoA6T+1lmF-9^s?Kn}EJ5j$A zo>HlU>RI&pI==7Tnr`9V)*W#EyssmBfBk^`KL5zXqnwN(fQM9#k*rWq1I6#-iZUS(7M$k$-&lpquj}RB@kb|tecRUgGDBM`IfuHB zm-DBIrSyDuFx3a$Uq|kpe${Qo1aeL|6liw$B{X3DE%2e6QS+JRMNar%dWsDi!~R`9 z9($^mOJ9$Q1SuTxsCQ+wNW2s++$cFQQkc}{zs3{B9&%fxFQ3(^3Y9G5*i2)x-!{$# zk17-_?;SN&d`f8u*i2%S#5rV$j5$mwwz(jc=s(#%lnpTzfJZV%MAS~GWDaAdCy-}o zSXYp!;O!SSY!Yt8ET=2mt1-I>x{&f%GvTDmH4U_*Grf{e#HC4g5O$8!vZFD4lAbuG5e7exMe-RPXp1YAbV(_m zkjqD5vNW*2f~btdc7eaRDbk5|Ya3XgJ3TS}#bW7HK>;S{C;1Itt)mF@#|s&mbwkE* z<8pG_42*)odv6m+7bhAql*FFtm~H^qk-YPvW%gl3LNyOhCWI{;{gcXv;J+do&t&Gb z<}9?XM2gkZC@}4SWJZlJ#jqG_ucL}^8%%OFP$+vMTSa?iMICDm&vzfh(HPk^6LHrb z&+ops`?VMQx>rXz@9};&Z9CscUj!948lNJIlfkt~iB#-y{I(IFAXKcWE-`}a5Pgmi zn(IEU=#RAtacMEqk<6KT0pNc0k)Ma=&*5z* zIJ$Ga2Y)www-EWTP0_~iW9Rstunxk&Hh~*TL9)>BU@n84?;24@mT}@tsNcFx=LoQ2 zeynd3so|r2_~f%9I|xSFc1O_ULe(U<`Rjq zcT*!LrL@<|g*30=IHp%I4dT^ZI3ikW)Ri>U?K3-A!(E?p(}Z{gHI&&G2(y?W{Hc^& z=m+#|M;EBr>#imhYviJe@Ae2t$-i&CS#mvYU2Cs^6IgsFpQaZ!<>27RZ!I~rFt1T_ z6KG|&CSxX{{5CDb&dWg>o;^;?FRoj*L%yF9H&&2#%lZb!Nb5!|ho#X!YGUdOi2y52 zRHUD14s<@POx)GGe*U#ZRS~w2_7Uf^F<=q2H6k~vyhdhXP=n*jzyt3u_9u9HE4m~3 z@sk}{OQF$BWaxgMNBzE+6m8^=Mf2;X!Sf&Ygh;!_HT(f||FySdD*>X+-{`tYcm?I$ zHR&k?<=7`}yC5|3CAg-`m|{%)rWq!l>TFH)sQ&?|t5Zpa2!W;+9&ww*bYSqpE~)TS z-}v*DSbSzK1;Cl4_ghnria6gxZnaNbIh3hXdLumSt-C8ZF3oR2pCrdSC`9n1@+(TI z<&`zklxd<_1sa2AP6xda-z_b#_hmnxHx$Y&0 zp1o8INa+amOFnFJcBJY+Wv1I(PZv@*gby-R-0{^NXQ$_$@2w{)d@#El(1pS!J6~IF zAG0 z&9w$1@+9%tQGMrM+%3Nxu)w}MpFDw#N+(AXhVqxP($vf?i&;9o^+fc9Ir;D%=}ABO z9>Wx5%qu2>2YTCzl4?CqaMKQdEK82&{g}MKJuUQQH(OPR+m!E_6{=rtPUD8j0=Nagy7fg5Dy>@Zd^L%m+iycFnd0@HCf(Wpx#n0 zWgCuAN`T1My7!3escuP^ZVzS02Vt)HIqS{>`B&t=;2a!ps$*!!FG>v`FcQ{aCGqNc z;wjUi54z5#Tx+h2GlW zMiDa(Yz(+(lu@A}>d##h5ZVHS$lV!C7Q9lyQ?(uiVE-mn-9~t|ZeRkocoUOx+X53w zp``^EP;uA+!alrk@b-Av`(+d*H%wRWj&>u^$wz>9-GFd1p3h!Wx~iWpnc#&K%Y)$CADt9gXSa#DuFWdV z`bWkR=TiK!;u8D}QrV<6>Aj1FjmCjH^_(HJW|b*}Yi+JgQfGx6mcQFBYTikkZg5S= zh<#CYphumVITC7D)PpAL_9RV8*fZ$*lfVOQ2 z!0U$?wg{ubK^6)0%n7?0xGE^wgT>^q8KwIm{p+rzix#?G7MQTre%Hi+_~ElB_hv7iqYR6K|i)edXg(l4lVuPJUZ4=Mm$w;>E? z>!G>`0DlloHN%cWxwcy|SP1(RJ|u#f2QNW~d&>!#xid#mDnj+u5s$-gzz6EN7p`~3 zjBP?u4i&VvVGSfw*6+>1cy%ohNgyf>(Bzh5DA%7sMX~+_(uzaul-r1 z5cjfIb`}HU8#{i7X*o_M&cpPFS{C-ujUu;8|D2#B)G8)cUObMw20!xlrb&ku)|3*| zmB_*2#^KPqlm*hp+A!KmYN45qug`1Ki)c|7XHuz_3J_i17u3oY`*JCAi(M{ZE-f|J z)!G;uNVk(^%!tE6q4cuv9`P`}?QNU{RZ2%kS0Yz3@hJ9gj_3T67eSCgoq3ly&F~bR zFU(}&?XaM)1wwLFZK+wCj{gn&N(l#BO76^oQDI6l-AOCPAfzq8$&z6<@|u{5iK~zS z*zEPU8c{7Zl95GK9d5v$}7o4~sueRSWwooV& z1_U2{460k2hqAIpszXrx-CTq#Gu+rpp2k{e;>s{olH1jj?a)KVV_rsV;|N4NC+hKj z)tdN*;5sOst;7urEhaPzuo5n*auC@k%W~b!H1Jedexgu~-opHDAbi&UDDWt%d|5e? z#PRQ4qMt*D7O^=OOU_Gdf$~ROMk@6+^agUaG!1#L*y?#H^GuKx220mYW%g4?T&fcU z#+=FtEl?nd1M+M=L~#TU zQxzA!qk()a4`5xhlxu2&8TR&{Z2755$^=OOp1dL`pC0b!rUf`fTX70i)J*pP-6PPm&jKj5q|-SW`8 zPI1{XR{!3Pz)avkwDlihI8FjPx304DQ%6H!QTE+o*E(d4Z5i0i<-pT`G|#g$FtjmA z60CRN3+PLE*>H!f5c7I-@T`-PHQv`ghC0&b&7OCOO|ju&>z*aCkdX4qsFZxzfO~EK zMd`dDcaq7C_*G~B-IK{i>F8)U6Ql@@e{5VM$(CKGzD;l#>L4UUP*Fb;ou^N>8iZ_< zk#QD(0fa?0EB!1rBLKr&s)=uZ%Q5f}7qEub^^NkH*JV;|7+N-gQH#MMfMgaj(FxNE zJQ{g%CU82l+%AN9(w^DYg&7SbWY4agsm#j9Rg->8?Nr z=V3~V;KCE)K-d5*Y8L$Mv*|oM-Jv(00bvNq^EncWaxZzhIyo34qpHorlW0Up0pjx7 ziXOYaOuhkgc_*O>19*?y(J0>exj{=f! zuiaiCY|ld#p&&fYLaL(1-^LVInlAiVU6YK)L9X5;sWL6OOgOEBB9bzfDbmr7kla3@ zOk2r)L^n^ZYR0}QvjK$f2w4Q-s8Hv}r!T6cRbsJ`s;R5nV#PCcs<>3x>1XR#2-qY? z@=%Udc8-dgI%{#esaLDm>s6M&Qb{u7P-oTFu3l(&FW1eiBrqLU&TEfSenm~=$gGl; zrrZh@i+ePa;9@#Y3> ztYNLo|I*`l>(Hboq35|`s;2+$ev!F?U(gSK7CwAO0sU81Zp5BB4bKm_z%f`ND?d9= z2*2{-&@K;tA(e85_RZhy2J+d`4D=DFR>mQO%2?_F$y-|1_1MzV0NRhn( zkXR3(3&%% zLI&!N+Nlm+3}&3;hd(>}xKib8Gq4-%i^nIiQ~kp$nzU|5$FcsYk1B{$kUB;ul;^7U zSyB*esf5SRNsPC(L>94dNLDUCP2jNN`@D9_8HCEXy%e?}hUgP&oN%<8{R>+0n7pA? zcph%x<-0M5#SjF4<>$yX_iAvG;XX89_E|NK2Z1E^!pDyr5RVsxu~WesQby-*5W7Db zJ^=i7tYvg?wP;FOn*ip=7z;-F^hR0DuLXa^xb-YV8T%OvsaQqQmJX>2D~?c!nfEu$ z=*RLZnu+?}jlO@Fw`|S9gUQ$P8gk-}q=liWdq_gvRV{3z4 z1PnTI;YLLas%vGB5$fyBMwrbq;Vvf0IVNt?=9X+G!=1dmr-p7*17xH-eP2a-pG5k2 zExo0C_<;X*Qn0zB#Sju3E?@d7Jl31nH;f)^2VEhH}EGLZkt3xBwjh zOTxVDCjl~%j&`cqId_nv0G=kVApS|P+=~)l#+Y|_(S6ZQdg>%|!nZwHZK}r*qS*U( zn#I&|GvTPW#4c8=L-)1vxkHAF5qLh(tf`E*JHO(m;VfcDVK}SA;m{&TYGk5Tq(%Qo zvMu8b@&!Lu7dfzM)J(L)L^1Q@)fa!F!0qe3eoB*EDO(tj`c)IosbzlUgeXAlb>Ug< z)vO|sw=e)BCQT|@sY*xxhd-?)uPtD~-Pkf0dd~zDjd@z03udioAi{$uvFnv!sm5{uyzyQ1u%oWJK$&R+xo3x} zTDGHd0iM!GSWh07W9bTwjw^3v0Yt9fA?N4S=$k*plT$JSKbWlCz+3`IC^ztD z7sbwy(Sm$Y3H{RORJU~JvzR&Zgv^SFo@Hm!*JL7A;*v)%sP$v=W~BSSrIa$DQ~6%a zkR(_h);k&~ppGS9DrIG2&K&T+mEkQ`>ZhpmazPjLu}{WgPC7W zlw!lNh6I&T z5_1U8@3qnzB;H0gd0s~HzaTv?DJI;WX|2KbzWUndzvFkXhW*mDT;-Nets2&pk53ud zQQ{B~Ktt9isc>D~FB5EE>Q|<_&}xNobo01ByDxNRa>sFjPOluq6#0DIyOFxD%yqb1 zj6^lmT&Vf(qzsGyF=ybkGEm+DpY8^LHDQMaVl_&5xXBIHLs7^NADwyc<~i?ML~o=Ey+Wqz*|_xkOt_YJ-GNlH7!f5=e~~A>UeQ zmR9LjC!>9=dY1LY<7R1T3ZDLD5pQ;C(y`ZE5ZBz z7UE_#aFde@h5oNTypYsq&lpXA^vfRUuoDNUtgMM*J3kLd2s}^-CvUAM20XKTJwPu9 zQ&jYx{Mb?Wg-J11O$cyJym!$EBgfLsmj-kRJ`Sw3jgNyBIP&0(>W;-`t)U9mekruAv!985HiL4fdkYHQ(tTB>Rx)K^Ak*pCNwR>M z8CsYzxRje8S>i1O5fSC?1Sk%Bqy(7sp6CW^5A&HyM_?g2&z2?1SF4JPv)_n}5mEGw z5+D?VhUC!pV~Q(f>vgbp46Een-qD-o^T?R#2NY(1=fa&{*iv!mYRB3sIy7Ej^w;QI zK*lDo;l3WUp%UXO)|%u!Db{A!wjc~H{lH+JlOk^(biq2Yo99XZOH#fFMm<2eu=m<9 z;oDK%(BtJBx_rnHtWl$uUegWTn#oVaD7vRa0w`*9w!#3wrvEuL^Hkh0X7qMvkj`oc zXiQ|uu>%D-t}0(!h2H#}x+4kOs=&dS1K<;Gyw~o_8EN-4-pUFQh80`*u8H$V(4^FB zZGDw$UY9`yytuTy`u;tknRcsoxL}gLK_B5yYa!o1XjA@r}S*3A7 zO_$%Prl+R?)ahusXt^K&0LvQiFQ9=@mHz-31y`dE2UABy#n>=usDVtZQAEIW06-0d zl@Cx;bNnAlfZBgO)BtK|Rq%hyfB2z6;DA4X1_n5){ppC7i>d+B)iuaV000mGn3o4f zAyB=6@ITby5V$%Rg{R;IfKa^A*c`I|Y^?#PZA}dm7_~iv_=(B;0Qp|K=n7V z{bNI$3J%dTl%y657f}~Oa73dKBx@} z)YQRfV3cGqFtY^oM^9i(J`fK0uN#&l%DDhXM@KX;mNgnA{f{@&Q8bwBE+zjtj2fO9Pobu4H6DU718ogSOAti{7*lWcmCx70K!ot z{YNX1<9~w@{%1)3ApWp&1W?0KI}!l!&km($6dcR?-;U}UYWi@Llsq^Z7#I!)pn<8= z0sjL)II6#TE}Di*i5i;5zi1RoApFlT|1Y3{)qwE-t)e9U=R5!~9E{Qz_5BwC0>V)> zNQ^xk0EGY13^f-}I{eWO^~G|uMiu_Q05x5Ka5V707X7OM5dI(Mf0@#_fd4fb@NfH{ z1{_rJKS22hB}5;N#`OPKh6es)0ssYSC_h>Q;eVzWYDhsK>OX3sfdT)4+8@nOe*4cD zV73VpYqmNh-NZh#k{#9Z@8m|Y{$mLM4UF2LP-sl3F-OzThySt2KAaWx8y4jalxe^y zI7(``2FiYGEE_Od6>2Jg^fOBUXiSi-tUndhC;`L&9I>bue^H(Rp}3)rMO3FhO8pO@ z1`CBFFF^wX;b=@?0E!$nDN$uG2u19O$&QISwEq792;@?cmvY@v@$cEgDmUbV-^IzI z*8uYAVaFn@XR5v-c)P@l?Rb_3-s0vZwi!oc<|Jnf*xHeE`aFP)G@#7g8-=e*ut)+( z+~)eF0dx%h?!&QI`yW?)y~RDJhHK%Om#-?|>gXOM3@P)23Qs9RyBp6+j6A<}|9Zgh z<%_=8$-PDA`pig&k$Q(k!T{g}Y+C^=QtVDkb_ofJV4aV=YPenRv^EQhC^k(L8)Jmb z`KS(EkGTv+>rTVJSK6$KJTal+$dxPaxl8zy*|+ywfx3opOExh_LX^?6uyW&Bcvv`;|KX(fon2~~$r4n+W zCM`YpS!x@b)9-1^Ee!;GB+@>^P?og=YB8BXrs1R8wjcL|Le&t#Wt+W@k7u}wx3_l%k`Vmu$I?YZ}qmcAsKX78eMxu`@o{8IQe=%KyTPM0{>^kbiDpcMFZ}JXMe-;-ZkB%T|5cHAVaEZz3#gu_qsAV^B{aoC&LK%PkYh zwyG@in9S2YD|4;_d2JRbOg_5rU9pS<(J30b-*NdmQ|IynI(1_t(P_7bR1^r`iV85f zaFmZQ63P)G3lR(h-*-a&J_g?*Q|=)eAMVmP{{hAuse_unD%Cw!Xnc4?AyCC9jVz84 zr8-}wI@CL5rzo63yb)3@D@ZNNUo9&jjq~qMpr+rb{;f)NsGE@XctceATN>vtwJZ;2 zD2m4(GxVRRcta(P550eyjZh!^c%zDV!!N8>D8493EzHmpX6V_!+YOY!bXKc>1msQF zUYTh0EMlNpc3Q#Z40N&oxnxEo0PyW^eYPkKdpH#nGNg`2Y35)Zi=vM zX7}C=>CGEP1E5l}jKU>o2AG(7P07Ii|kOvmNG}i@v2XV|m92v%p3#ZCG3N zdQPAJW;2YmQZFGs1FsU8C}b+gYJ}KuRzs5?0_dVn!UdumiOeRNqEiH-NSm1sn}noA zO{M~mmRhA+RynNUB>0zyEnif88dgD%g6*QGGdUgjqR3sSn|A6(=b~qqqG0Z(yB(nt zlqaQ+E50mHLt3Wqs~rCK-uWH?rc|jj#^F<_v8IIIaN$%z^V^f*sX`dAi<|CTI|tKq z9V2flvT)hkM+Wa_(_2)ai%PM)*{M`Q^4i;e9FY<_ze}{+-eJUS$@zC|%JDy z?wN~#@3yPJ*=3WQvzg6lc(1m0q+c-2W~l8U^`rOaFY0GjN%E~a(Y7yOK+Q%>}$x4BoDBHcqf~UTFya7B0@AjYl zpcx4K{E(X&<7g1tVb(T}mGo*fbY2(O(8f*=2qnDm!weTL6jUg7voYmqZD=ubT<>&E z@77VnHk~;;U&2xh=$r@-B#&xnCsE>z3AVQzo`(Q)@&<_b8B`ev^B2zKTx!eG$wdr; zf7sCLglnE7T#qp#(~XIe3DHCIZ-9JNquc*pA?Yv6A}Y|MWn<*!y*zc9Ar!2<&8X|^ ze~tgIYbe7}yiun*zrvT zhmxIW;0YS&st#3Z{M88N{0A?SJmCG!m`Q<0*S^P$ZKr^#XtSXxcYbmM#hc|B<96GH z&O}o@k#fU{2DarycjpyhH|K_AQsZUJgiQ+b4kONT=jw?~l};7|sGaL4;}veGvhyY_ zR4`eugCgNzrg|aKgJxs=z5fd558aiDBsW)qzv-7uH)%b});h<{>};3xOcSab5+SBM zDh+b36Dy+A)um-_w3f6Uw9wDX6dou&8dN$(I+8mV8Y&jby3FI3Y?mpL4U>~I)U*8% zK1Mu1j}|kj2HztXUG>D;Ml#!4he_rmRN2HYu72f~&_QdY1(l>I*}#LciJ+%<(xnTYb>i?8KX5VTM@0-hte8vl$)7R*w@jNbS{*; zCL4;jG^mK^c_@>rh*rP%-+aSDxu9;^QoGimYzU}sZ?j*@URywsaa&tt3g)hR<3*Dn zj`Q0l>(v`BnK_rs>p>}OH+Yn*Yq==w49oQzY`JJDR62#tRCtu_ToYP!ch8TYEe39; zbT0Q4wm3r(AysD3MAS&o4JNAv$;{0DmrswPR|7df?`dMn9 zJumh&*$RF2)`BS@x!7`DS9F&kX+$*+Kzhkr}2AYmLn=^Pt&=t3yTk;^j9`3g5(8Z}>8qxYrLKqaND8)?d zpbc_jZ6-63+K|M4;sDS4VE)5mc5kGr)YeZ2uYTwsF!(d473X4C-#zrNP&O&Knw_zLg!yOj?GyDPUnI?Y_fa4Icu zBQM1?m}E;QQ{f)(%#2N<8ChPBy++(+xD>iY55EKeUaM!z*X<7>^CPD&cz-Y+RGDAytzUz> z$T0+aYB$Tm%KmOx;wqne!|Zay@w4x?39}2~Q`46I!@DIr{P|eAPKU&1OSm2u+ zs^SGTlUT(Xt5lx`cG&9j6$UbV2(Shcm9I|$4D3eSCO91z4V3Cp z&Pq#$`{UJ1pl@(IbtyN1z&~cl;M@@hhu&yYmN5WbuCShZ{q^z^R3V zfVU$2@dZIfdl>mH>nrp@h2J(Imci-(tE3OY)GHe6k!x52(gC9@SA~9%Tmm>Y9e^z< zjhuGxvMW088E-y6XLYUoEk|47nTWbDtfxpuDjPX7jZXt)ok`<)3yXSxCdD8mzlq4m|M8i(^LG*Wo?`bcQwA}*&Z}~aw-W9%tbhri?hLuGnG|)&wtuwel^^OI zzk^28bi3z1k*_N-H50*>S+R11waNCVWNXQCe`qJnm&=3!`kXs zq8GX=6U+LowXHqEvsLbWGCxpQ_dWadNTLnh zW#Yi|euK4{-HQRSp?xM!?s_}CL`d9F=lIDyk^P{owq&72^@8<}xMsC)Qvz;fsR66?kZ3P4o4|p?BBlV1dk?vV)1aedI1K-2@DUl~pLFb@D;(L7XFhFgkMV!VdJC91 z!mfXmMHhF6#ogU0ZiSZOy0~kBWq}1=+^x75cXuyZZ1LhOQrs4YwzThe`TjS#_a^r| zc`{Ej$s{v#GIGvOC^7SbY$}zV+do{BHS$Gt)XYqPRp>uYIlAG~im;l*%N~nuf0Kaf z_?n%f`A`j0YNP(BrlPPrA1F%>tnJS0j-u<9NIEn8bkgY~9*BoV;&R9RnZWW=j8Z`= zwMFD6X$G+8!kcat<$Kyv@kK@EMQE8IVvo}qQ%YSGV?D6YaTO4-BN4-HMJhg})0ytv zv5TbLaT~l^b9^FIMJM7B+?{jYs^hHKb=`8o%HLVL((}TR_H=AVPb3Qnh|T5T)jD}n z4X;obx{RXaA;2zkf)_?IRf$zPSbs{;&}; zec#1(9f59D3W&lt$}`B#^m!1 zk5t$Xe5%}1&3Mc(r{lvGS3=2_yE~gfnKj5<-(^w%saTh`$S*@xtCRoxYw~{_3=ID# z+Q9I?Sq6rqb=?2MW?=ZX`eI1_pSKuXEu5Ifm#PCGKbA25$C&63YncO;%ruk-Nk}FE;*OkY=Y+oQX(%U+tOi{cUu+ z`tQ$QMnX`;lBE_iUecdhl#6i-LJaF^0)teuIvOmG&3VtvoIG}Ks<`B%8+l2|Yps(({^XXZ{;yYNow1Mk*v%O%-FQ(!|bTt-rhzT!!N!iEfpc*~# zCl16HY?aSuiKd1e7JYCiQWR6Ac*sUar;=edLQy^RQhfCRX9L=D4Y}}Z^_8ro5`6V! zipH8g(NUd)hc(TXDOH*y3Pn0TH!N;9UR>_Xc`AP4jm;*wuGDP8VcG|vzk zH<;KKZ8b6nyL{Q{diG4HYx3xpybbv%QQH3@Yb?F#*vv=s%dr6apJu54)A6Z%5VC>K zW#*{v62hIuf!`1m#qHKB&6n+S-q1$Yfno2LwYk`q$eLi(iT9;uTkwc6D|7{RmT||< z-`8g!I~C{T@99v&yI5YNojiPYXoyvc<1yvC!rd}=q4g=0X$V=mEHn7cmWf*`*P#t( z+KF~nmZzX{E3N*}38S21_Spiml2~8Zq2F2LJP?0AtKfWAp0M--D#O$Esl8-X4&Hyd zQM#gG(G?)ngxDMCKK9256{jM8S^no5E4n|*1TXrj@VwU8*gM;W7r1lv8IVdh9GwVY z<0a3?0H~y4JKqy27{16cd-ZxMR33p>40E*Hx&vN<+OkBYNj==m-4p7_G?&KwPbi_% zTkRiW&7M3bZ3?qiyL8Aid2olOQ_(gBWS|<|3{K`dfv!z%)w87Q{nB2`|LhERL9315 z%>BgSzgfy*IrcfO4qgH2JSghfoBCrKw3Hq5v;)xHkF${zrndK!xEhzGX-Y;e#*j%I zN&nZT_K*)hPs1}`dE?v<*mw3Cp-C(L@-cfEkGn%phLJ=1>61o?L|+y zU5P|Tn;GvpkqO-%i_(I;*hQv#9_O^St3IhUpp>FPIhhU>BL`!!e(y>&(sOznw*5Vk z{a3PUKiUf)QtS(pPd_w9)7#3^Cq25e#&O@&5E0sJrR;$HX^@bVZt%>{yrxtvBbC1IBvX!A z_xq!Zic+Z#N3#T}<{DaT0VL!H82pVBz(3YRR<2o$+mTVG_N%;~e5y1V&8fRk=b5PG z&7i@T>eEC6;btL1iGEc~0zD=tgDl3b3(d|#XkTR+G*>@9VOTKW`E^_i6687105d6lW$0X}H<8~d8HL`F|so5kg!Sf=WSQv)fa zgL*0-PaI!0=4Y7@LJaSWmnk_iOQ9mJtyS?cjAIQyjDo$w-!|?`O_d-2f zEc`SD;@jy^t$5b!W4#=I0I-!;&KW4=*1O_tScl#su30F>mb*ub0@}hRTCHg6OBK`7 zO_d{jS_`LMV6guGC;FmlN{|C%(RLNrLj|lMaq?S@9o(yq&sw#RRdd9$dfwdQTmSL+ zD*xubMLddqBvZ<&9ioAHMQ6-_(Z1e?y8d z;-1dw1yesTn6>pd={#{Ph+Ab0JuzB`Y8aW)Mspi(f|h-9_?I)$?sM7qFu%!{VnW0s+>IEN_?TjM6&Ua)SBh_-|8JlUyC0uQM3!HD#%YAl zCtUpY=<|8r)^89L$$fC1Vk+x=&qGX_1LW`aw+jAa`MNDo0iQeWByIR~YEc36zuHi_ z+_@i@eg(126s>KP=7$%p8y5)p?8%9p7^iv#IiQUxEK+}S783*_Y$}4kT6g(cnO!zQ zYkcq=UK;8hXe>?iJs^k&lWK!aYQ%N}Ps^I>j9vW|WFu=xF0W!|o&1Jn6T`!>sHxrM zS;R9DxhrQ067Bm+Cf?0bcR4$l9#@|E(ZQgw#Il=e#Nuq#Y%`VXS!-flfu`S=BuCbJ zoYdDy8B$(rJ*PsyZ<{+C7;*b*?<9U!)bSyWF;k=N!Q7O$njd~KKjNRhk~Z0q{Os_w z>sv(eVw}u()N*1~@0w9}NPr|>I9-PLTd<@ln$ONBUpvi+yu2lUkb*mgI8wJX*hm`Olq>w*5N%K(Z~Llzd&QGieuPww7>Bhj z4^Xepq-TiSJSI8Y8g%XT+4SX!WaT9y)y>m8RWyNWwOyaeztv#&{!c1#Yu$Hhw?W>$ z8H$*9DizQ6B0x@-&nqTx+Ei29krlI8o-&yeIJluN2xQ8`lT8Tf`40u{&9>Mo1>V5| z38(`C>g0W0>FZPfcDK*QJ*Jh_oVyXnL$4jqo!HdqRLcKB!;i{WB>8BRQy+9?3J8*X zY9xx_ygq%|uFz{3`pna_#@$L`TMjw@s9li`D60?L9sF?YN#(`9l6{Azk9y{-Cf!Sm z&r^rUD+rmpE;yH{+FZqasQ!XXwDB3Yboe(^{5MJE63281xt250WLe%4&NdGI4ya|%13^e_7< zF8XnxFb>>Eo6O=9DwrBFKb}wJ&}YyuFdxe&R!}u%)`@6GwHB z6x{LIn70Os$D!npd_#=QoVGjopFkWoFEnIVa}fHj3wi!sUJaEb(| zG6x5CPQR%qVRF)-Ne{rvnck%iy=i20h)>p01qZ!G_t~Xo|J92qvK5MKJ>zFVW^^K? z)ayC54j=|w`W11e>n_B`&a0Xm@E>cdc8?T`}IZ-g()OW4Z z{8dh8>|-?FwzlB3D3p~PdWCT!)7#t_+6{hB(oo8C0R2Juyr49N9_pwhwt~-JYT^LZ zRWL<}$)Gl8fFKK3K_EbZPnNWg1&D&u%j96}eGz6#D;I+=rlx*75PW6U-pmIjMHDs z@940!578e+XmBL~P27ubMO3@cu|n$4McAG5!(dColOp{gU2DBs7?czHRF~_iRPTb@ zA-2DaiBYc6%=dl8v!9C?v)k zxnc4mp9E0=ZogM}5&goz_b&~{r9W^7&**^IH?e_)RupL6z&9Z>ccC2U{r9$P7sdte>w^xjSM!VL6{ zDIbw)@s=_X(|A&*^zv%q+2*js-!j%Yk$}Xxn$b4kp$jsO2x|GxRK8SK&C|(+Ff#`^ z-^=5-rk%wiv|X~X0yMeX9fB@>_3D4N7A*~SXX&+fIrW8EC=AVQU%I*bun2j&9Lu2A z8V?!WhRg)n~wcs_{BKt&{jmz@AmA z1>IFj&+mygPq#nD7xcrRU)R0)Le6EE1;uJ>#R(j*=`bSBMJ(IFzhnUjtTBzT7W|X{ z5)Zu#c^ud;^r;wyV*^{9Qmm~N!l(SS(*kkGC)06g`2Gl@=cO>RtQTD0?ku$IFfiSs zOf+Pa1eW{V*yil+a5T9Wre6-(r-=bxazPDL{4lqoNb#viXDHgVXYci{0ltp5ZiV49 z-Zr+PgBMMr^j1WQ<;;5+mc#NE@vc#tdQ*enlR5HPRr;vuiV0mb%oG-wezPS#Hb@=p zO9A7tpg2JF(nigGxJe_1hyTTjc_EBrU?C7}VIq)Rp$Bc-C06SU_PJE2dU*^E%2DAd z_hsSAzZMUCe`N&(Ha@yQ^kKmZP0mnN+^OnZ)h6y&)4W6;~JmVW^|% zULEc~n5pO)-B5|loIRF?15h`1Mq;U^*;Z}cOv)CBv6TE67xjg&sNzXIjX3N6u&xbtb!P!r7VYbd zYq5Muh)ngM>Ta-v0pF967>Ky_#Fz?71s35>GtrzowokQgo=ID5lG09&d7{8t*DJ^`SF0g&5Yc-GiIQ&2dR}c4n z@X6JopXxo!EJno~zy6Jm;r>8mst3~jHsD&1qU*u`tQ9xEX)Xp9mU zQ~3|o#IJDbHZzddWV-KV*jwV$Z;FUT{SFVGnTsrWalUz{kyO4`CKA34bc~W@gj3b8 z@#?a4DBx!3REju%HGarQ`}#hV=}+sk#qVTX$Ev=z7cB7=dZS5Z+OA9!77RsUZXQk^QOl z{VC+qBB15xSoUBA7Puuu!NzU$yZ)CuGHYRG>UY))F@T#O*rp20EXw6gAqg$>*xq@#rWWsk5(@+}r!c97>MpR^OF#4_T|R1P#-ZiY68+UL32 zY3NHVw7pEuQ0UdSWp$}a8x;WyQueWJGJC~0>-AC%im~lWvVyxTQimeowS27tR?;X^ zC$xgT;TIpOC}2-qxer?v&-jTcAUEUGF;_Xv7co zut*GwxCyKg6kmV_Q%5G-PpmP_CBFtny=uI)F02{%%RtA?$rhNLls-KimmMPMTYBP6 zt*wh7{A_qY+bptiXgACRnF+JUrTLDNorVu&!vuWzJfF8F5&Dbx&i=I|a%&Qfj)?~! z7GeJuwHGoAI=c`6+2k0nr|;~{rW-Wop9xuRUv26B!o8&s5Zo;KoOaaxLxq7JV?*y& zG&Tkc^~&uhLko2-r@JEU6iqH)t72UT4FBYy3@eXHCHCqC+WACDPy7A-yJLDex$yOig*ImH53T-wA(`ja znm^wR3nqaCcR$?0VhES6-}0bLz1{bl5N~W1GW6s$h)dN$+057q(TTPr09hVf1Kj3|(<(JZ>o)0_}%r zteuTZu0$j)WTYO_-zSFq-RXAl=v%*DApf6*@>#@!4HSyYV_gryPNeIr;3{T_?UO`zk^m%uGLCcTy3S@S(c|Op z6L&f4+YiX9r`;YwK$JJGk#I&X36Pao)+Otv%2{1A2e#I&kx$c3*dK3ZtUf}G2@5Ot@f-zO*WM~v>qbwuH)j)}K` zpIH#~jx?|2Jszqy%fN!(+$WvEUU5`^WY#CLzR!2QD*Y8W0LJ4=FW295b#q*%wSZiq zJCzremCfswz8_tyjyX({YQ$k-3Zn$pIRALVaS$3>f+)0z3_sOx@7_r)P{Nnl_yj%d z*EE?4w6e5-g`D|BaI$5wAhwR53f*~72D7t5@pg(QV@BjSDHd72xJV1kOP3g*VmC= zq;Q8SRoBQipJ>T->9LQk-7AdOUg< z!KBS{-sEsh^nt<_flMN|;wk>REQ+1z$^n>}k%i18j0kTD9mWHaTN{G;r5)IXu&mm?Vx_ z#fHE#0G30W-@mq&OY<IQ6S9-I?;I{xH}c4^$@fWQju_z8R$s)G|Ca9 zE90y&eZd7N0&x^R>!-=+(DfC^EQI`cm@cs12S!wep@^W`1<6YpbnQ>J_xap24wU9D zqD&!wOs_#qVO-Pwy|%-*VW|Oe@irSf^f}Ai+6|$h>y0g)cF$Eyr$cvRyQeioBIr6> zn}+c`C{osI>FAxTaha7t4Zg+EJNhBpFbgV7;Wy7HZ`Y=>(l(S^#xS(y$UckiAm7cR z&L1`BA9i13tN#2e7y26gRUc@$%?OB$V1KT?(`(GJ$Kz;wN!@aafAm3K#_xgd-#YY` zrR`!rZ`izh)k$3zMB2`sYIhh+SE3h{yHQYd?0$AFs}X&+Q42O63l*sx(YtW-@*F`) z&eqdn^KtM~5Tjlq_569rZIke~ebqU*`+e+bGEn7UW|71p{T6EtbRWfWJ(3UcOpZI$Y_NQ;~nE8p^86bkSZ7R7h5wkPN zO)txpdTAXxG&^`O(7#_m@+OY-g;+35kvfXVTX7kCYdt7+h{H^FVNuG_5_~CfGekf$ z|60~gRf(<=2Smjl)fkDg7R{L}Dqg>dF^KunHg`_g=S={NM^}g~-=}#hK>kJkgTwQS zzXdGYoJpyd(b_e~M%gXVwrp4X`$|xy7$#+TYuZ1M8(?l}0$fZrQUL(!1bh_^!bCwX zH{ApR&gYAb#BsO2K6um9+@&KX35^l3OhuEi&cp%Fo@&&@`a26$@+GCu7o$-potAh6 z{^3TVT+mZ`R**d|veQt538#^@ggr24p1QMd)FUMc&D-%WTqIdnB47TSCZa#1BGPDk zMAqfRgdJB0n}SQxC4b_hE=zP$QRrI2m%l;`9wl4DLfdb@l6a0NsCKjMT z$to8bEr&9l6Q!sCD#agtL#1XbINbMmbAs3Y=G577jK^T6I}=kMKv)1^cUN(t{+l0O zxa;@c6>-5pj}i?mthtx%;iB7;8xz_!uL43sY{obMX((*Rddtzd7z_0adM5Ja&E;Mk z7#7DEJ9yIRdcNjXS~K#AnN_^}`o9VRvI$NE3;(Wk*o; zk=~U_X^8hjcG5R2UfN!?1(UuXT3_SfTeklQx6Z7n> zbNfI?!VHX%HB)OuN7sl8e_z0}60)Zw_`xPtV(!8xWqjg80g!cPd-vFrQc>KR7)T}m z{EeoBxOndP(eA{xJx$C8rvBPZcA? zN(@vW25JQ9RAAog_H2IH}yjAEK3| zuaOn4+F9~fl3*}ElZ8y~Vg5#>%FBGoU$;<_P3;qx7FhxpGm{DqvzJ6*@#SPz<)q2& z<|tMPO5}lBHZuZwC0^(#1PArUH<~FaF%QG?;{gPE>QX(o(y}i9w!%*fqsp z1z<&1iL@2kp7pM}GuqvXjod#b|H@evnKt7QG*+{gY zsgyolC&uC^s0240@=W;y^?W}TWn~446klqE7%~qmIago!p$Q8({^$OSdegh6&@7P; z0r_i}$nARgxNgPIX8r~dAx8YL@cp%d9D$fmS8$U>FjfE*3J`uCP;aJ;dvT$@3eX@7w*ZF= zXM1N_yB>Vy@_-b~(GbF#B+ZSf+{J+gwylK^7Qk=s)RjBsA~1w!STIg3T2qxB@n*h# zG+b*o#h;Wc<}r`E0#G5r!lOs5g*++L_#TM7~^-olai@5OlE5$K^v54 z>Zdn22z1bS_g6Rpk%9^nevXJxZ=2HMUe|AT$O`$(irEV+s(hxlNl8qyf7~0+5GYSq z(Uua{!IK0S3cXSm!H=F(cqnv}3YL+@TB8&F!i3ntf9)XbPhH}mMp-lj1u(i)5{@ab zD3QoK;NEC|9zgzvHLf=+QAJX*yglDXP*_l@_{t%2(CO9=MjO34aaU=|*cj0XboTFm z{>d}eI^3e|D^L)t5O(F5RqgeXBgQ^rE*6oxJ1_O)xn6GhodW0ImxiYpOgga!`winYvylpbHZCNN>PyMyS*K`DhPea4p19kJk@gInCofm zP@%$_Eg=a;<0Z0Z2*il~XZqp2wWlKc@g`~<+D2Mldc)_6d7n#Ev(tfQ%kCAcm@&=U z8CS*AoUbLOvYU7)ohOB(P6{%gza&w0$AF$uj$g~AJ}!n=IEm%rzYY-)2C3T>^s3>I zv8Yogv7aA*YCODgXl2M+E;GD+3C~n-%^DjU!$JX_J^6byRR((ejyxrM$@VhI!U|P* z5$J&&^Dy10_lDM8y%#(csbHn(U(wxJ(M zBLy9|$7yddjEEZSP*ejzGGrc=c^}iakhH;{^Q93#CDM7cD86DQB)`ujUf*`Ed~Z4o z8yntOd!uLcxL-j=lSRWSvD|0kz2;HPE%@uNPKK=*9|PF8xXvt(~azTS# zatg)%Vs*c$R9M$z)HeI@rxC!nekaf>pct#m#Dpu;#(<^XX=o?qFlTSV+oYkbP50w8lLKz5yHy zEs#4}3Rkwuc2~*yg56oU;K!TN#I|}v{e??w{bP>ZhL{lKrU4{)UC>QP(&nujXP%&< z9x?L+1hKLxy@_4%QM%JDMw=Rc>wv6a@St->>!qVK{ImbZCaChy*F4r=)8cXhX zFmI_^<@3n(A?DJ3_YbO$t>PNm<6h``&pI4`iq_wOl1tlwNlH5s2sX5t{|xABMQYY9iCk|$dl0HdiS&aQb|(k>!l?N`?}U5P#9e6ZxooC`m#;F z?m>FA%uY(Hl{D0{LOAV9!dY48vfB=~Lo@Ne%>8)%8dO1qDb8D^;;xdO?;Z^rF^;Gv ziEZ(uv1tB^e;I41*ZeWy8Z4A-EjAg1(Z2oN(`ih3WGWb#++Y?6#3?5M7#bWqAha}#`(Dk@CA-5}E z43h7wkK2%@PDCu3U{3`M%eMDKeJi1pp?g|L4)pR6Py3{P$|*w6QSvEiMNdzq#+Lo0 zk{=MMCHp;>Rc*?|RzWl~NmMaKnKii^+vbf{l_g@*HWk;0&nBqNm6tgknNp;#aui?| z#+5LsPHFVh#-eLytqfsljJJxu zrr<&6!*~=Z%t7YE`W~Z3Sq*bGi7`V-0q#N_pS_5M^I1d1U5QSpr4W6Tj#Cjx%&d}^ zhQ;i~49w1mZb=_Cvj0M-QAzcs>yS;AS;t$_4huYbi$>DzfUqa+AJ(2$q z?9W$M93ohf=9ZfoJxtrI=bMFlP|xZ4SCOwDPQwao-Hn#YH8>(!&m$}KFD@u^2K9Zj zJ-oorXV(SL?B=|Bxps2Mu|FGZvR$+w|L5QsrCmQYNwA=ItDQPNk!5L?a#(9gG953` zy7lG#HZfH(Y#5&uMd1}1~dRCBG9ep79;GUBgFSR}RHu`hBJx?|L zzw+!hz&(Um;gQo*ay*gt!;;m=y1kUgNse>c#>;3&i2- zQrn-eWMY4wyC2(Nz1eOY7aMP4%QCZhe+q40347BCPLfzZKd+PEJwCzl0+nKm37xE| z2jt{->sHLz!2BtrZ6_z7wl-5xg^yu=o9H!1Ovy-jAgrYjJ_)J%VDe~)2Q3t}Y7n1C z6eDWJHW41*pDRkWBJ-Ns749uniefz(E1@AA?y-RXl`|}{K&XmYPF-4em+sAnw3L& zVjF=-EzaDgA;uzmnC2tmT!K0=WA+WyAl%$-zOkpaJ2gKryBo5swhe{$ybwwYz@!G| zHd)smL|9VkPDEfl*>2w-xU_NjhM1op=jQT@VZuni{&8$1Jhl4MGH>k6x6{G$ zxfYgdYTUF(K8_RW4}8{F656-n-10+3~`H~cAUn3$+tTPolrLK1M3w^Udt1FFKHy)7?CIa+Iy*2GrtIJ zy@VgJU)wjx_{PF=2)(DbH}g8fVlcgT3TT|&@lF7($EkwM=*$eLp^wATjvxK%r%{Kk zgc2_zWria6BzoV}v|sfCywR45^~YpijJ%JFmD7t0OXV1i_C$L6(m>=TlJwD@F`I^i z5+GouXZMd*UR67p3_o4WDtyekX(5ivq9^+9n*VqQr-qy+W3xW`z3XPdw2X~)n+rG{ zlIRunn{k7g%!N%QnUWg?qyg{P7&mS3Mo066XAGP`^Eg}1;CGUkxQ#`siuc-FYMZnA zn-=|G!>p9mTg*yTa1Ep9qE2f`@1RV8e92$_0rfR(ls$5%l_u{cF>@j->cErc!2vZC zp^xS{y;U*RjQgy=45)w8TA6$fx?ft_&{)KNwbV&A8VN)9o^MLqt)jrN{u8u)6>?qQ zM_(v5s(jZ3o;RL*J@EC8dc6O`F0s9QmpX|1@7saHGc* z`SLS(A)Dl|unZ5H|F9>rJO5!N=yd3oBk7ZMT}dlBnof?6Fl)?UaIts4fXom~VqQ_B zzJf7MqnY%E^gM63Y3KQ!H|&D8>H)eEEFzDNB6qAcas%TB@&`BX(Ou>FdTvY?) zHy|!OBHF{mSpKZ?sEDag>jH5OF(J-$+8>RayWsb z@+{oszoD|;bSwSEPbHrQ7NzoBb;we>u$CX+z2kN&F)w29p+Kic6wmm`!94;WQBT8M?j>VxYunN-#ci zxaajTQu27qt*Z#Sf-L;mLGh?kc|i1iJ?^MDrykHnAQ574M2rb1l_I-lzJ?8}XV zehtVDkEPQ=eU8g&1)(f{#}ad5IH z1)Vp7r{y1qEQ|NUTJTWBu6`Ype9A+F-kU#3^MY94Rq$Z1F}9yEF&-2i{n`U~<7-3e zO;Q$rR<3@J4Qo6QA}%>EWW$}>8i*Xr9`Ow+hpKzN?xKfbm0jst^%4-uj^mCq@IOh# zOkfbxQ|ixwpi1@{t%}y8u#?}vAJI53$mH|1IL}Fj=`%Y@n2cu>>b!jVWwK zd?(>bKDMZFN%|$M6iYb0G#`bzSLnjP9twUA2|XMg_LQr>fhmXi`hKh%5GD2tE2D=D z%+rW?6Ov#Bx$*2d`SVv3$Bid_5GEUv-UI7g+(crK$3>{7sTsxLaLwJ{40fCO^<9#E zf;n`QwCW;$y7dY*%s=GVY(1U=MRGqyf3jq>VFBzZOLT|G(?0At@LAH)s-de z4!Oh=H2^Yx6HjU z53=3p0OYYr!9i!}1UH(m93V2;ZqNJFrZXri4~tTDtU%&GGT}Qj#}^LR?q!h?&NdrT zGjT@O8UW?{uwXd3x+5#g#Ia_hbXm1~f(+MVYN2EC73j-v9seB$=r`4fCSgpZCSfcY z|CB0Lunv)tI|ltek!HJair=$^`~aYzfE4XbA6~H8{|?z~_Q=X%1eP(05~&-a=zfj3 z-IKlL%3+$Ezk!EEXj1TyCqlmA!`@&;#(^hL{B%mGo8GCQ6Xk|PB8k(EJvlenCcrjw zJIJzdO^`9J!McQt1oIK<@7;HrL@*Lo0deA6Vc8%Y;QtdfHvp)mH{Zn_SI3)5|KM01N--3eCsWiX|K*SU?gMIM3D*E(thY9bWkH0r zRcgNQWE79cgvhc^<1kmsc79BHTb#2snC~=flr$Jwms%zKm%w*%!MW1P+phicbmUV6 zDvm0q_2}5nUh>i7%L4dd=QJe7*I{GBt<`kjk3hbsZMOe?IMHm$9QEbWnC$V;lGbl2@IRnALzB=C&&}UF;QCDk-#Fv4pJ%$;P6Fsakfiei>E>{T0Jat@eB5%n z5F{Ss7~oncQjW*EJWgB5%8;P()h=^LALrze$4XUZLXe!f?9_ z`8wU7Mmh!&d0KY7pM2PA)EEf?#b!JgN3>Ww>95Bx0!i4+IF%q$;brzVtgw)9GPvD(K zY)jOX5rPUaj+GSZs8;1L=7S23!daNh2uwDZ2pb4J5z(Q;d$`Z*w_zbqG>q*iENoa2 zr{CzVs02S@C=RA(RWxkR+{W(W>|s@NCFQE_+g`3t-0&TgM~-Z>M3NeqTu~UV{XU<7 zNIzH)<|5o6Ie12rKJ*D-8{U{a6cj~toL}pE)|=a`LDM@I&mXI9PuMv+Gc zX}n45lU2ld#6P1Pr|&QRd7zA%as5t^WO0jn9UBzW*OKqF&Sz zKBXK`Kf=5jnBKfW!@*R+a#+4~W|3qZMp3#iDXY4hM9}PEuDr-drC}_!wHDe|Sv`&V zsxzi$UktzdP>Sf?KOenUcceS(tC?k#jKF97X|e4(n)|{Nz+5y(Y@1mBqNMKfv1x&}xH;q4l?YoM*hm!bS24WHk8ggP?>l-(ctU1Z zKgw{fcgRzLYy^z)!B9(fqxH5N!9K4tlejr(;2F22&z^UqWI&kOfEdDeeazHXRW|KL zTco~t`1ZhtcHhXF?&)7B?+}MK-qTFde~6zXY#)Yxx-U&~!BGGMB9MQP04%nLVNsA9 z40H^2{D|ARG;(rrg#G9FRq2_+1r-JjtNi!*exw}euclI?ev=#Wu=qje^YudD^`Ib% zF=MFRf@Fpg^Xu?ZwNUL98;%oj?!hgV%dLq_V?B`EXH2m}{XLm@mKlm~431>GE1;-{ zQ%J?y5`6m{meTDnvx!3otZkbc?>IqlM*(qWY*9?FTihmDNIItA{m z4Hqj>f71`6?#{oI3**Q^ksYojB3B>w!dl-2l@D!s`bX>YiTAG;4kGmtRF>~7rO9Lh1{$r;+K+r|{8-aH2oz*5Uw4+L{fx>ZhjD~X%SA7 zfy*jHrOG{%2rHYZ;gqQf?c&3q_e%xc?};&WXkq~BWdmuEH&)q!=5@)nWzoFelfIJW1+QYH>}-u*f&_m(+V_jME-P^o~p_2rZhud-vl*hQ1a4|uHtmo6gT7E5bvt5 zz}E99!{$5^$-ye5u>GPH!tpNk`=@e$R_I5q%)1b$3q)yR>tVC9L&nYEQZVF8kSqrg?@zXD zj){K}e{gPQvd>>F1%;cpvPh)sZ}P>}j&)myzN+4%@U*E4@Q=MX9KLp6{sKQW#Lzxf z-o5v&@(e3UGWe#k-t%D|ftC9^!Tgj0WGnNVyDi#uiI11s=HH{gfUieL=Uq+vwXXKo zc4@|Oi;MO$)=g9YuqXwNN=Vik=9JMBFUw3$ePC~{$W0d5fp(VFO;;dTxM$KWCPL=? z4%_1+g^P&+n?T&r5Zuv5ka#V6#6a$jaCo7+IciWioB{8Zkbq$*HSFV1`^z_?pd|vY zQ#r_ytRsa{kPbfNM%p`T1Gkj->G!T|O4{{n45 zlE3cz?}x;1&2&r^E7169__N{YMR(QNyN>touKQNYq25vNJ-yPw)B+i$yTly5#X{9p zOZu>SYtPaNLPeGh>-)H6 z-`0ND_ieq-IrcpJJF>o6&{5mVx!C3MbtMrZ;fdGR*PYty>l7EW=a1|eDKk)?pYL{n zZ$H8@VDHL7`)0iM+54!A?ehd8G}3=S{6YzL&t0teDPZ7y-FNap`zrVEuJv=x*7G=h z*H!U;(TrwQ4VCntN*v$2=0AFPS_oJNE?-)RXDNV`@x4i)lEzVMgM?#}mjnhT@K%~( z%u4Z@6J(n~V2L6E2#Ny0MPi~zs}>6NuD8d&>z_H<-Cv zZ?=J-2y%wO`@Zj;O)ywc=qtc6tixh2<ZocNhFdYD|oLK+=?`)io9v{I+1S*Xe`7{Un#4}t)FJ)yTfvrc4AF~WiZ!I}^wXMmK$Q>BK5G-$&p(von6HO}zm z@^)Jv!{M3OGcaHz!SK)sV+M(yk>$)R2}w^$vwhKS&c%;ODaBCOXep@=4P(CN8tYoR z3Kbd57+4C#recsfB!WT=Cbx4k(-MM1LNHcv(W*4VLI(^wY(5$4buGL$7W9Q5(Ou3lcOG;)H%NniBE(wC$M;wgC*jV<#)itZ5)X?Uu zU>K{$#H$?vx@}EZEUh}qm|(6j5C$YBAVNqeqzncUfI3iZ->%w|@vUb8W%+%U{eFtE zU=%uq*GHJTyXu1d7TNm#*Blx;rlz>nU7XLa1K+)umBer(R&b#M`#QeWa-GjSZ*!`q z1}t2mmIpw-t#q-w(tY0C8Y$;P_0L`QbJ(k?WOJW7eV<32cE*OW-qwS-65qc1@8!=s zgxs6GEvL&g)gwXOh~-pUom#`g+tYL11HpZx?}k>9yFMd0q6z_%?*Jl7juvUdcH@~< zS1DMpd(VmHvpf+3IHB-fL~2|^2{Z8NQp@XgDU>P&m%yvNB7vrjBr#>ykEZ8#n$ZE; z2yP(GAG6!;yX+)XLnrY89)3sDp=kZk)eD%*W z!#ee!VYuvmn!1|%(6TEPj2I+Ag2oDo5E#ZHB70o$*S*()!t0qH^7(C(YwBeaCPfH5 z7ST!b+?wX6n@8*qmwohiHo7KZOpxA8w)$(Wb28PY7AWP4+aw{! z=llUx7=ofi*b_yp(v3-CF^LK&iOo;j{qsH6VZYI%H?!`JhA6ROA}FY$!}>$%(kPlt zAa~c!XP=%s@mIDM5sM2EVXkK=PWRnwUtLa_o+?Mh&Ah)O5KReinrm)^|+@p zrEl%jr0?_YW@8Y=f)G?m{1OK}@4@@{^@02Ak@LEj&66oJ5*ekLEq&J2@%f)A#HY$? z-XX8-``~wu{NK;M?{42Dgp=9tF(#G~er>k<`SGi3`8Lw1RJ_QCSxUUH~IX) z*v%q{qN*s0h|gpKeK`B&<3FCv`;+2(ARTqieBYg=Hpr}H34y~H%(08-Vm38KrbHI} z{(HVYJ#+H9&MP!)xRQ&sM*XLV4 z>2rHp!HlttGcqco42sDX2qVHt)8h{I&#$S!IzI89tEbN0Jbca~c*|6!ip3T~5=IsR zWrz%;5*ZGiCDm9fEJ~P|qYNd36quN#GGeP17D&aqS)_uJQcD(j*LAI0xyrXTqibl@ zRU0vkiq^>#9UngjbJuF;N8(MNmZ~hk#F)@qHQUf(Q4{esAUBKC{#5vIP@~>P@j= z3Ioe$2v48`ECVbmt187}VKPhsj4ByeL5xtcVwIA_i!3BDVltRivaF?*ie)m*Qqq+c zwyRz=!Ys#ys?4>ml(sdtv8t_#s*PnUV%AL}Yg#K?8ra&X*0#xMD?<%`HX8V3%b&k) za_zY}s3ik=4FPq=LEYa!R3*V(rzItSlX9{ih(NGbQ*KSO|OE;^j$pIr6!C-)4CtB-EX?1qmQ%Ws0Dw#^j zUw2i~n_5kiZA)+@Li1*$Y8>k_SffYB^Gy}6yZU|DP!QOBHG~d7UT;JW>(lsXh|+0H z5^07K_gW{WTM4Jv9?WWG-``Rs*R&)jZ$yjYOj8i>b_TU=VbTh zYgwAr(u@@afV&M8nWQ%6CQaQj$xSL^qYQDb1u9y~nXO=k1%ZOZ2MU1`1zA9li-@=m zOk_rmW33!H3ML^d!zBzt1P!PynBbZKTGOBu5EmtaXv0H5pokV}%w;ykYcQ);mk}132O+IWvbB;K%cPmJrwdI8 zNaT*X%)2E~Sw6CsVwsR8)q8j+IqJRaHlgRFNc;!_{M}!3t@ieenccA#Z`$Bp6PK<+fQApL(UaImezscr4P7 zfS%Wcf|ccXEAaE9-tO@4cvRWTbb5l+DM@E~176{$Z)v^vT_K17q)>_i$gxx*d)?^o zb#HV_2_ZJ_`5t@69ke%TzhKZm6uSsY@+Ad!LujKN>6JAo{Pj zzRACEyI*xZtFz{mPJxT*^;lZ$z^XRicIdyhOfLmy%rg$o>iMO8%ia9xG>z68O=XH4 z6iCQ214?s7HA!aZvg}$bNlNAg767bZsu5={&xN`)CjJ{U;LtqdBFY;)BFBM@yUkyU zgAbo+Oa!ReIy#LB2ML(i>BnJjx46P;uBK(B%iawT{zyU%$>oslvXBywFfGrz?c~=k zdtIlqY*__%q=KxFMkJ8n2Qd)CouW|2$kZX@L=8{}g+e~Y7@>+Z?s^Uk(6}AN1nR=A zfI+BO<_OAO-?VOm;+eZ(+(Sd@Y+#SIflh|D-*yQ0&Cc=~2pdoZK#_oboSpZ3=y>Fe zWLOA9P_`_B319_H$xCV5tdz+uh8&YzWVF}C@p$l+B*asCq#JwVnUr`b*~p4LH&BAC zoH}zeQyk13SeAiADilhtjKLA+kYa2sWB>?^3B8Lps=e5z27LEed0REAXwV@91oWXQ z5lK=qB^ankdS(v9^GBEtW(sUH#h7&E>u|$T5Kv}>-P+v2m@OXgY149cH{R;Gk4^4T zxrK3Q;LNL|4iMmJ?*}ud0OIgE34xeC8qL|PrfRH*njFmAb2*_kMzm6xcw7+_H2H02 zl{DzxX^t3S7DN=LWunyGTb?%SL&MEHEjV=QtZw+*O7U+|A1%0duvi+!nj(zDQKqfX z+@fI3s$sHCg)l@c$iYz-35}L*9>-#$(bbc&hIlaqR1n`Fq`mG4H`P^YG@3M z6wsp)oCtELceQKPcr;WGs8R;O29J(imiOVBd8@>_U+n3Nw$yrp90-9(BCU%>6nEY4 z-+3Cy_$@_hMg%^e537^=a!k#9q@xq{SO|MyFR=I9ORw(gt=IK+v-3|r`7IUP2&whL z8_&LP@3%$pn*PkHGqGu^>Z+lich_eJ3<6(p7tk{PLTAV&m828^Ule@&wtxdMeeMhr zCuur1+NOe#Ac9kk#2RF#DUB_>Y3|J2_uTf9p(uN9pLIu`@(O2HVUY=1lZarlR+DQNBKCfWmt)be29PB1f7g5$c3Ay@)XCViZDta!sBat`r(wugOwF#6lcZ zj2GlK1PKlrHKUp2?7#;RkC&}!5*qFqNdL>*zg%)%fL ztQ#PgMctC@qUst6g9f!k4HBM`fP!_Il7ej2XGxGv3kDd%V5gz%(&|KxOJk^qI5JZ> z(10DIWUwOyac+T&$6@Ee_0N7e=huZkHBm`a!&MOzq*a(@iPoly6(LT-0Tu|u{F{EW z;B)VqC)XHl;(H)^N_O4h_4QoWbGpMOSYc&YmIuUi8pfqSaT+wP2Vg|NgRq%PN?RqQ zwPdB0tgvt&Xr0v}v#Lp2YPELY<56O+X+;rpU75Xp{x82(v%+`tL8$rj&6Tx&H}U7> zdhnhr!q$|viz>C|F=$%D3r~166W=Gk)b1me`>&S?$m5wj{J`NH#Tik$`r6qxo0swY zW?0Oa)MT_~ZH5u{HZg5`0Edyeg1X)>Gr>w0oSYn zq)pN9Jz8REC{~e@(=t%aW|ijJaG3-$WA*rWcbDdiP(0Ntr$eM6hK(@r;bi(G*R(He zv*+JE=aA@phCmPmNJJ!J1BV;YtXd7Au>l(h?XZljvZR|zOD&dLY})?5uAvZGW@1+N zxNHgz7h!f?jJxZE;=eA}lc!f-e>3mJc%Cj{MsI0N)i>rN>uTLKZpJ0Oq}(=oX-!qB z(K=*>ikC~E=)f>eYRs{W&nD8@ivvjGL8*m`=Ef+`ui(tHF@#ezXtb6JqgE`MsM?`5 z7K~MinvGY*wXc49eV@mz`~H7r&E~dF(B$7!` zu|T##SZ1aLW63ZOgh3z?0VKa+)DJzi=UU4=JPkLA@vW?^u(D+gtW1nCVzM(JrRy^o z$sDTu7lvpp1xZ3wE}atiKvyxQQjz0}k&81J*?fFdx}o@^q1AQFcbDJt>+10yVP#sp zWuAUGmn=zQ4o5qOHPSSH;nT?*%|6ILmbcHS(~RMQe-D_UMpzAE_D=U2wH z`~6ig(=nNurfoB9l97{QlT9&EM%2xxT{r zqn#gR*X6#wInAOdRxL8ZLvsQ49;@E_!>2#ah8^$SdS&r29_mo~njt3VpW_zLO4{mT zNe7@$u<-mqoQW17`|m-lC5U&ng{(-(ujjn=eYhtWu$wuNW@F6z;J9EJRO0U@iqi%o zs?$g`!ICuQD|=ITrHV9K_Sze;qY}3q%ggUHPdd(*YIkC?)$_lqzmlU#p(wQ*X`oq} zrdpY#*x4-!l+la~%EKjWDfs;P`SbICZPueY`_cOS@7R1(wiz9WWpPeeC8-7}EX_-u zMFl{6z+>?C{XUSy=-1uT=Sf8Hy#3E%pyYuL00*!8L6Xd9m72>%T^opkJ7orwWQ$Qo zzWd#_yxLmQwz&N~n?r0^O=~0G(Kka${QTKA!HVZR$5~rK+Z7n3>Q`@jLv|3#EylD> zF<^CSsp>wsIWa|*E!C&K`nqu^BH`~Hwk?*wPrRXwS(IZ8$}FW~*xJdGtXj!xG|jYa z88uQ{C8;g1HES0u*W2^nGp+r7zdZcwo$LA9Zl||?e%GP%=%rC6sYX{dSg2xbkfK>{ z(mwqjOL!B|)4E1zx? zn5>55&zneD>O{)y|dH76PWfQLZdD1)WQ@ln|qPilwsa-BiW> zr_3`3F)U?`v{@~&wu?n=8qu^<5M`ESOkmk3(){)J_tyS<*{#01{Qx7@AHb%pHi2|R zEk!~h;R!!;Rz6=7;r{X4JHN^P=ecALOLOnKn+t5F4Z2lf(qk4eF)+gbm_asE_9&}4 zs)3w24vGcBPKN;+awvfaPRJ%^W9#gzkbe`-_Lj=unYLd$?4);6H#zy&TT^UH1+6kO z3owlptR%>;kn;8M-h1&+F&Iy+eAyPvStZKnyy^3W#w?FdiuLo?U8?TI22nkwdiAhx z3d&yN+j#Ev`%k=vVP-(a49JbCnKfcHh_aa(MynNLYQ0-p`}6rHNrL6elzGRmzuC6m z1FtGkG_aPDY9~4oh;=bxDU#HR&RCOq!6D)Oeuw$H)}l1f2RZ)Tia`;Gr%Pa<3KDfE zQ|FREnjxYm`$}0vOGu$g+E$j-J@69@OOC%jgysfSYwI&KEiqV+-xI#<;yE#ezIU4@ z@Qh1a`Q~v;j0_`x&n~u8W+E|3*PF~IKQcQAOZq@kWfFZe!&1+V!sE*<1_4b1iV+&nW=&)bR+6EcMuOr7oRmRsD2S+W;5cRl60Fi>r+{22xp37L zI;fzz37LU-g3FY#Su2@wal#hnEN#rpg~JFtl2%f7me96A&f&)3^C8VCaLU61q+SG& zh5P(}p5K4Xn%&grJ@;DozyPKBvs(VIPeogGTsvrIpef?3#OhR+Z3_U`AlGH7N$rxa zIBYEsLA^^vJK6$#fToU(6`u9nlrPT+@X_uR*vm|Z+ynX1xjQAx0yqMBM4pA#Uo(Ih zGcaZjrw7&WlR{!36+z0uuB<23dYs$QSgek2?n}EmzD>m9sz$9~hKj$NwUwrD`+J2- z;4ne(>(UVAWKb4VBB2&O`zU2t(3}YUyJcGC^s%-mP@`^DWk|=XnY16l+=K79XLkK+ zvehj|ew%>-+uvXq7(?LDKWD~P=Vod-SxvfV73u(Gi2*C0NsXOsKomO%?eBh{3%+EL zv*vjlA`qNAr7$P};w&Vu--q{jBkrlgT%;5rbWr2t=C=Cna8yKSP~xzHQ9_{D;nMuCiTJ+m>D4yf_l&+f zDr|(79IIq*JsMPc<6w*F~x zl75Ql{8cb~qmpf7XFrI30=Bo@G$%KRu^M>JI_l@5zV%^0niK7g9=CTWW&AJe;b=m} z{n?rE@4C8e*n9Nts!Uzj8PBNv(a(7Y+*wth$TX|l=_og>hpHo9&Xhr^Xl5^_By{yl zY7P^s#^F3)sqNV6M>P2b+ViwY7J{GGV=jve;@L)KuX|tY%jl}S-%xrz@Y5vDG}y{v zmDmjF`1n)=<%gMKbx;}0dUd?+U#%Si2RR$*yXrW4Ivpd{# zGrYFdXENxwHLPvv!31HLxJjy^kFhOI;LJ8oK@BQ_wktUM$`Rltc(nwTRQ zHAhO5y=}^;23*SB>5ITdMnDM-;=rniqDrn9Km{|)xH(~&=bFam&5If>S zz|NGpx?3|VXi*0>ZekW}Asv~q1W}0QqDo-IXK`;SaL-H*iP;RyZB@QzW@b!QD&!g7 z0B5KK8TkC2SCJ4IrZ9H@yx#VduXDqDuN zk!8|DE=wyI*Dk{;5@?H`s{VC*&;=r?!BK9_%~2-Bm-ZSk{nY3BPTg(16yf>rW-Y?q09C zo$rMBPBMLa=k1>C81;$uch`gKs}p|mg=nc;=IN{UU99`05=EQ#)>Y?>CP7+n*GPSx zS>JC|pJoYlv@7Us_FQWCUiAYa~+uN(=MUkJ0gSdi2zkU|o`i6o6I-w++|M*!53Y7yfLh&l>H zE185QlWaHZDyXnX_L-#}V^vMHbIv{-=Nj{rO*pM}Oaq+-s(lf9&c~ar;RytFB3Lwg zimoF`D4N@=(?k=dhHmNGeXv(FH3e<8Q)vAp8$Dql!pZ~}!YIK6E9PJ;?FjOqr8Zyy zy7et^THey6!xJaD0Sy{k0;2(A%Y4j_i3VTx?C%nAyta;KxS1e#3_-!#xB`i_Kp~-A(7oiWGXWX zS&+<GC)^uvZh7@G6|TIGN=|}-#i~(hho5(7dPg77>pU_Il@>Uf{w_x-f?Yl-LUWF*ehuD#jwGp)OT8{jzGu>de=wlVt$1MV8C z@S1C`x|dlnv5A;R>(^?ziA)1mp`vMurbT(``1jSsIfe_%yD!eM>FVt}v5VJy?}%}V ztg3TNXsc4ZyTv!LHo-Efy`Hw4#H>R~bSG0267ya4)x6r*n%8U0v3_g&Or@lvP>3v6 zBx0%?Bq8Vd^Y7dKIk4aPex0-X#>T~Z7cyFND-zmCiiR2*r!|y1FaUnO^L5SVg#3rq zdd<;uI?vZT-`^CkOVMKqhBNlW3fjm{t5nB$B}KC7)3ejAsb55H!kH8IkFvU(LwHjN z-ka|_J-zskF$|TrJ?%}*1(dDcowiB47D{bf@2L9Va4;(sTiqw7!Ms)ry`E#Y4p=dB zZ+Q-IoWf+9p1+%Gd9CKxzwMfh6qHIufu;i#(I8Kre?K2^{gr=cH?QpfH?GtDfJ0|} zdx<1cStM&p(=$pGQCa(pm+jUWkh%B4%+&(LSOO$VCeavdphSd}l4&3bH2?qwlV(J+ zNhOniQ@f{b!skr!S8fXCxro@Cosr$d7z0Ol0g823bGVx4bEjE4#f)|J-g_r@Fu#z| z`((R#F;gjZOO{>i4TGCBjZ8&|bk{n@)ZPlgHS77Zi*hbq zyzhjZDfGQ%pwkp(FRg!SlAAVZ6ey-ylAFLlpU|G3{hxk*(lV%2j8kejCA|NcwRx)D@WpG4szsABsZA_(e;quxxTi?%oOOq90 zT%G7NHC^LMv|_PMG_!JSTg0r9iDin0NjcGU##Z~#tzs~a+x3cV8^a^5{?pgU4;vT{ zTs#-QZ@-*!n+Z-Bn15 zcZ?!92~h`0h)oL;)XPCYL=49f7_m=|$qgle=GsF{l3`ZuH=k|^%vdgO=hk`GW!U=u zW|gJ}QHZgOOV{F_HE8#=%1uuFZPI&*kr#jPljY$?{L*zkBEgDyon|Pmw`cAb$gv z$}H+&ol-=XKoA^6%s7|~g+U;y3m}Mm`7?eTpWGAk_x8-t#Efkr`elHt=4%7M)f5fy zc?@Bsd!pnwFw6ty`?%@_26aBk3HT(2|GtQG`(ETepTD{4#TQnMWfrz7qL!6DI;UTZ zy_}!mLGsuL%B!-3u_MKo! z?Am=pnwsKDzs8H5rnGArJ@X0i`95>HK2xmu^nnl1BtMV8OAWq1$G^$V_woEJ_=K!W zQHxs^i;zhzz;!LGLG@z!IZ5X83F^d+98{g9O=RN*f{MM<% z*lbDllg1wtVJHa_d?Hh65Y?&sT%5bII_1WJ5i^79pxsQl<2-K&iD_1$ZG@g@Z|R&r zd!l|#e_J>6G)(?C0{eIj=Cjyn=D6IH=h-BLhvG>l`}fXjpPu}BK{sK#Ip-ae6tg3$ zl9-~3qKYl(_4VlCy$_yS?;hT{)*o%`-pnUReAZc-B#y^eY#8s~VdaJ7(X0DbN2YK4 zw}hKH&Hrv_;2t>$cMe9HdB^9zdgXH`=JlpF>R%|<*RAGQ{gMahLLU3&KNXF{YYKj;+khm2Hmb(;DHHZwd$xP_XPNXpzC)xy&q`@V62k@-_@W5+e@G#As^+ zi8X|T2&OO)Y#>#RHk^gvwh3tk41weNwNv)=A+r62YRoP0&FvWpN z#xq1H1yF@6G5|6$P_o^c6-Bho>IKlt1kAh8V`O)9>r+HSOvOm(H*l8SqT#zWktw{I z)}-1NXw?jkDjGq>U{cz&S%AT2X2RrhyD>EuBP!`xCBh;_g_{rTEmo^ z!C(Pw?`z!~$!6olrD5IcQ1+fT?m6#z*vh-o{1_L$1Wg_0JjB zac4B3e>Km6;iACfbKe}?e{I{Zs8`9w9vAnOTa`m?`0MyagKCea`i{0EPuMfFFh#ay zYJF*4={;k5c9y#*iM!5tDSOj-+d}Q$(+^w{?}qK(F~WuJ&| zS4VnsmtJlTtsQ3SUUpzbZX1I76f3X0IQzU_=WwOBI&6%$!uI63bFyidCxWG zT-TlNob>7Gv%td733|QRlh`U}3)tRWS%OgMWERudw)(>y`i0EvdWHfn`saxi<%6}> z=dLc2WKoLCc;VgC$8)W%n!vL5!o?h!oj6!;McF%@uxt~>Iz5Np0ALxGQxtS)qYWUN z(B#1|rYw1By|=p3W};bu`|2Shj^i|C%Z^>p>;Y4<4fx#CgM+@blBd>-GhicP@yXkq z#d(ZZ-Ft7t5-p!dt*owS%Y!_TC^fC50lMY%)rbz9G=?VLXAdu zMkTZ=sERMC(%L2*Jy${@o6~Pjb1K$w&6KoGn>T}Ck1%erg;^LcXlAhP-`FT>BOqf( z>TLY`^YoG1^$y?MJdZQaNRU6-Gw-1yy3qGlSgPZg;#gr8_dngm%MvB z(#`2w^qjS-Mbo9LpdQBNd9}XXT*uaSiSVBIS6F^uBG@3qaYV8Vz(PJs6vbKai2b}L z8^;0Sg$?{#oK(d(|#mEhiL$_eAk z#4_>h!jRX{qdpooQYF2e-{H)GREH(G}qmrW5`T*?T{ttQP>TIi;R zyI~)<0Mnx46~zGH#jJ+^M<^Q@K?M{OLp$0S(==>C<3tQ%=4VjhIuiz0L;8+;hQLO_ zMLbY80lsT`*PG^VeV|VnG@n~kh{dC5pj8auQgX#8MGm5&Y0FwzYxPZLVLRX7bQ}9; z$ux!8Q1`!dXSaGWvBB6-e)8EJR$-cDSIKy^GRCoEWg4@(>44u{oj4!Z!Z9D1Uu*nZhbgCuC&vjb!n&qxIRk^zCZ&#%8qOPa!niLtPdtt|{y zK=|LDddEI_tG*p`&#r@A3p`={on;jE&lzqQ9p+cjnqOVdy7{lms=Ag*EXcZBaNhWu zVvDnbYlsl#T=NE|($~Cp+u+Keg!m{lO-t6A~%r5nNFyDrTghNV1AmIuxRCyGczjv^o^AHFo(I_usiKs*r|vJGI=!BUuHw6aoU*=9to zB$TG7?X_?&aw!DPqeBXsX~``GJ~9U>pvvh9#Y}`zKn&uvz$vCfRgomnQ1~M&(mi0 z^@kLhK5Wo@22XhY^KT2zBqa%Km(Mjfvc^C>Ks?ljXGTuX5U_d4xEk9H>kQS_wVL`8 z2kv+1?9=t~q6q%Cq7G*7W();eLj%_P=l^ z;Qp$mWoR(0CrG5R5(0~r$qedYsZ*!lo@$V|Pkgg}T{4&;h$15i1Owu811D<(|xmo^xJ*XEjRy zKW8pKABBq%RDvJ^Afj0*GFpojq}hdJ%ov8YS!AOaP5Yaxs!F&R#38%@8pC& z{)g`m+B3(!gWI>ay#3uANL63P#hlVivsB`Uol_c}S)=RMJNOr`T=&`Y&v4GmyP6Mz zstE-ckcff^gb@QG0wC<4bf%bd2?-@4B|bxhtiYmyIFTwap&Ld>BWYz3d7#(#n14Ek z6E=IX840uK-1~S3HkfBMIC>DDH@%xR*5BGwD;u$agXN`-p)-SjC?G)pWnxIAl2Rir z6hSmn&Gpx}>+7BGH^0N<&z)BA0stU_DnD}qLu5-Jz{O&!p(Pnas9=A3&1c~GbV6x> zYt3OGBOxz7>p&lN8HS(Mgx9;C>kvHAP9YDHNLlPUMLzi`nLwcH}^TptUSVNFq#&9L0({ z$RLS=0!VPGmRBUSN0t()YZgo*97h;95F!aA%!)dImKsZ7IfdPu-7=ewDlu`8T+{`I z8NmQD&>jZnK`h6WU@hfYiX<>MTp|?^6i~1mEXKh>6^x3OFde4S?vBoG=*L_OB>_Pa z0)pYG3Sm(+PKd&a?5+d{5jk2|6|ylFt3wb#PHb#jQD#MfXGnvhaE>s{66-3Gtl@J& z?ItFN_BZ+c_^$q_6TrA?{PP={H3aBA9NtJxZ^O$xBm}!&W@theaacn# zb$}-Aib_vB-vB&32NFm^0)Zf~kO=b(=yR?2#WT*T_B}$#&8-J;l;~gM>oR=nO1&L3 zy5qo(IR9D@F|RbjBr$IIT_JYn&NJeH@g$HjEntaV^t6h$TL_;p-vMYc!#poUYL}V_$s;>pr2?xb^o$jIUqH z^XwC+-18KaK?jRSYnW#7F|_o-=03>2^J!BF<`sIuMX&I4ALZ7lTBV<|J|UpJ5It=+Ghqnr2D^v{9O zm2`Aa_|H-?+!>{+3EKy39svQ_wX}p0y0@QqIR$-wrKMx7IN`~bQ%ZcERs|Nd%~F(E zvbgQ{$WMC=Ibz4%^1JC&v{!V0HNDr|^w-Ifon{4`0_xctFSnn~PmN*uTix`rt7%e1 z*j}r$3A@)``uZTZZrr`B*t1VIvlZq1LHK9iPlzM$z8jx)OF*?$Io?~LGvKf6zSk{h z-1}-p&#;-)^du-+vsah7#y=G>m3`H=5Y1Z9I$0dDq0>mE22jQ=#N=;G)ps?l%_fFP z&_Ed@2n>S>?q6-uuIL+q1_2A#s&IF7Wp*fQV)b>|8&ddk==-$d@&gThtT@Uj@?9JT zB-e+r2P=URr5rlu+0vWo+N+LD=XEM>LsqkP?;2~#(jH zI!3s399gI#^oe45vSIH^JptcM(GAMyz2I-ob!VQ=Xgtb$WH`bMB1kd`1O$P77+@Y< z4d9p2c*{{;8=2jDW@mu|Csj8eHr!RpaB?cIVE~vQIk0X7mlvewWomeAnQ^w5LKsqz ziCo_E+V5K0fyhW}gGmfJtpvwenbN}*T`-uzR-U$IlpNTq(B5{`xDb>{Ac#R2!#W#< zJ+p8&ImL~Dgf`4D8&n!eL?cy-*#oaU*j;N4K0N21d6=5nz4JJtEnNxW5dZ?3(BVb_ z;sxzhV&mFX*K>4m;Q^j@RHnocZY&^z4a~_%BtTZSi*Nx@G?Al5>29BSuI*agZ+i}q z5MUkTgtoDh04KHmtxHAF!2}E(0T?h}hJXy{$`rzo4VbMQ8c0q{oVCXtu8b*g6;zta zH)aSBzOEQRIYv_i3=Aj<;Xv;=R=gE-6IAZ|b**abM1+WfBoo;Yq%}n`90AVTaFD?> zW8s98LPtYMB#4kDxoycHcLgbW_;V+H)@k0fZ#9k_A|#P4?WJYI1O!5K*SC3X$3S3) z!3W%}!#wERn-D}S>l+D!B+GT4czb}9ym*?9-fmU3NJlGEFpr36k24R8e?Y%*@M_#)?RSNGTh4)={?VfWSTk3`88z?Dsb7SlIb-KH_R^g^q( z*|2-rxs#Z)5yvY-{0ivS9q$SI_lK}x;tdl<$r?+@olBk0xVwa6#?sYI{7pDrG`XvF zrsJbpF>A+*5Mi_W%rt`)$q`{jDhd#kfmWjkM&+$2n+jG93ecU?M z&YL}o`oYm>PCLuZ=kj9ihkLo#JEb^bsvI)B4-OVIbx*#f_jcmnvi?%}v!7x5hij@t z9{UHPv0*~r8 zdmE%paTJgtcuYmPH#9-FS)~df0hO#g1qOqix^!opqa5+=o8If!#ko>V40gyzXr7|BUsu8yQ5XxK^esPL!z$U2Yyd zdB?u`_0P@U9{tU0oBDh{5738#AcUXRCW9CN%u`S0i7QN7^GBitc*rPL~^>SzR^oVp+t$X zM6EQGU7K>}4ibWkT<1BGaV9lJol&tP&U(G=s0N3KGx@kE{__Uk@5o;dN08`J0sYx> zWX*hpf%{qa&*ys2ygq+zSIbo`Dp_i!RaS!9*=kqPYr5{fKIhK--n3JFx=%XHNM`6x z{^|5cpQ%b(Syi?+qu5BKn8;QlNLE5?G=0x-!~5;uhEVQj$Oo85zl5+S!CfPKAet!t zr~>TX$WL{$GIsKPkPY+UtB1YKCeOi7Vb}T4Ay5;FArORN(#nK@xhZ68E-1BFkWgI+ z!AWhA+Mf5B95(27CbRnve9q*YRP~&8eDpd&5QIQvAcOX_6|@>lVIh^7ycprkGy)*G zOeQwmw9Rv4WP?;$D*kxA^XwtnlX~2mKeyqHX8`815Z8VDpSW+H`8_wiYXeUA^a%&q zJ=ZA6 z)l$-;id!pEs!I>u+PJDMOTi)1kVNem6cSVs1^_51D%(LBA@jSR-S}bi`<>U^hG(<* zUdIJ^!olvgfcU%`FX5O6-_T|B=$|IU`*-tv_wXwJ6)afN+6ill( z{jcZO=kF(``Gk_xurB19hM_IYkgl?V{WMA%VwufA!$~!gQ)#AaTo1b13mm7sIAjm9 zN%QZ|V0;71_w3});8K>`Q3Uvu3LubzQunyC`St#|PmqtRCeZj%7W$QR(rZ{|)U1@H zYE-4ArBYOul5K)bABQLvhLfXEEuF+Ti?Npirco0p2!qIp))^NKPHItdfvFc0Q*Rz) z@a;P0>EC<>RyvXrT78YNVvXwgPbhsEpjJZ5upX@TwC{odX3z8*v20$c2;Sko(c z+my;=30NG~kLY~Fb)ggS?qTP9txvg6KAXn7r?l$p?^^nb;uTlR825$GJ|3=&8tC}Eiej28h6gG(W~MFpY`1CbF!gg`A=1t=MXoN-{M8I1ud$_U1x zm{M+2;%M1p*pLq|>XiO2$Eq zH?wSVO|x{c#uIsExvQx#$w*_YXjTSpYi5=jyV;^>VT=Pz16yf~l#sl{8WtdlAmv1ZPKU}PCk zD#|%sWf2EfY=owXRIO1Gf}+Uh02>y$&APQ%P&xPG)84=fe~TmZ6^kr@4d8U zit-`)=CDZf0CW~Bt6=bX-eg~Z^fjz106lVrScJagTO_%4NnXL4{LhOXm}|dddrNmM7sw8Sbg2TCO z)H?NKtLZZ*hT(y9y#-htOVcR4>|%>UfZ#zE4eklHxVu|$*C4?OE{nUngy0@LxMgt< zo&?umizMg#n{(dxzu))V=hn_lS66jccUAY!&h*Sym3y3sjGB{r4+ZE30;?StHhST` z0^92N9lvv{Q8srO8d{j!>JQZ2>T=St-*wf<1JjP51$0-QOixmJg|7}U1)SHqZ2gpG zRO@V-e`Kq$Jo`;sp$$Eqs8Q>GVN@a6EF!B|6jXl}s2}As6xFp}a%|p!4tVO{C%_yC z*%9W$AR7{2D4A&fi_%Q}Q$$?${hLCB*U>(!{lmGbCG`uz{WYTaB9OjOIXi3WuzG*N zQEC3D7~?Fpg2#!5qHz{#?`HjO{^gNvx>pfrlj#q!o$xJju{Dc!Fh3e98GZWvPGU2s z)aX>5G;K{kKx!&Ez%ju$p_j~RlQJG38bL*5pxmm#kvS8MLAG7Slyiy@I@)9z_(pd& zy%S`w4j;@sQSvo4+8TPO4rRzVRoGQ)YqyWiO4$w`Ll9bZC5YaD+ za9N&rOi!J5Hq|8wt;1IV6JipIva*E4Ks`7WR%Hmuyto^@-B&lM?;k(%qY=4PY9TMc zQvm!Lsq{qD%dXiQm4ct3iW&A$VOz)bVvum_a+`4o;Xny67I@|$RMJckt)#(EhkPcf zNJP8k)4Is1G70yNvTeEwgJIKFyC>5VrU<*95_9lN$ta=_By$AKW#RCnM1>hbvhqCn zBvVo9+RMScxZK=~w6v+ht*OMLEJ-nyL}awYAz?BKQKqExS{8U9@IV9|&d4-gj6G3| zx$k~`mY$VfuWhW@cI(o)rRTU68D&8WJ<)v*lT392()KgBOJQ1vcK%-% z94|S{+$lpxX(8#X&ZNsk%5!HC(e(Wh&x3o!!W^3M5^}H2?LEb!tgKK57*h)2ulXg* zoNjLB78`W!!cZ8q*gz9zf%w_*MWMlKosQ$neVc{%o)`7*+2UERYnWHsvIEZA`MT~* zo=j)j?oa!S4>`Nn3Op-pLVI&OTgpGq^gZtVmMidfTA zlT%QLN-j?=53>S#6Ke1gN%ILR0zg`h+~}lH=+@5rw@yJCwlAl=_JLc0>okoDw_a86rbE>X|=O8y6#sWe-M1*c5U2Yu#7fQ3r!LP zH|?NId{Hwp&wzXLni7{%V2d8K)K|WFS-0DyMCZhS0;C)p*JC={NoKaD%JYK86Y6IZ z$TC+N@^ST%lB>H?h0W`xvyH{pcGZoDgm!KgbGSu#dJj}PhDu5s@*M5$BzR}MN49qK zrAocY5SE1=D_hI<`Uc_);4kL(wTGO@2`gJ&ZI*II;R2w_@NhjKRM017QHuT z<<4i$+!Q6EyleF$F`Z%Ud9u)$A1U;*4we~VvUT)($%bqxt$|x#m;y`6KXnlQg}*p_ zNz}NTr(Uv-dCJl;vwEVNN~x)#TuJ1l#s2NmJQqR*1gEYlrC3`ktjll+mDTP>A#|wKtos$7vMLpGD#fssR5QKvlBS(50(So1e_{!iVF6<>5 z9b{L74xK_)&{#=XNvWmt`Yx<6A@{FbGEdoAroZf$`}RQWEu)gV1&enCg@3ICPx;-A zY5nrMIz0(0yXEd|ESIWPW^2+aGrS7qdnyV<&_65d+3#l7xQ{N+L!G|skm*kekzDNm3O{RHN<6}PFn-Raj2 zA_!Z@YnitVUMNr7K|CMi5AOPISGLEl%PIJE+cQE+k72AZwlu}0LK=V3i#L5eUWhGH z52yXk)4Z@j8G0GaWP+B5;kGbM{yjNSydA-&GNV}qTvDt!VClCDiSSctEt2GZCPQuu zMDni-7rv7ZbV)je4%G` zwGQ{veqQ8Njwf0~l3_|3ZRl#_DA&`!5r*|r4R#0DpHqMBHeWf2iXn!E3jY%GYjfMEs`-|oVx`DPoTwr$WJiLcu!L!$BrRd}UoN@+wAaknm zTc%GfY_`^O#q%3k4C#!#lZ#sn@g=16RiU|TX{^bSAk2Im0%Cp4aqfNWD6Jm@mL0m% z5U@V#z>4hf%Bv4iuV2U2)?h}Y)< zEvtgECZrhUwF67lx~4L;HnFWc7vVRIyZ^#>KQ+m2*S|_5K>B)+1yLQ1kCELK5stoN zfELah?~8}~Jnbgk+tyL+!_W|8g#cf44^2eS;&;F-jwt{%we8k<^XdXm?j@Fw`}!pX zlgFi0Y?&{*!u^_lfEZKqYmZmeGg~vteNr-k`Vk|NpS?qm4SK!} zR_EtD9Ky~kv8kCYT#RW}d#9g1M4A=~NKJnHDtUa`h2Jn}qV)@BFihF+VLb zzHMS(KCr{;#6gv1grWV`fXl1BXz?EwOqCL;*LvXfzedd?PLK48wSAK&?Pctm;wVyr zzizn1xp{%#ejSXZx7k**C4nYW;5KZQ3$HxRE{jaew6hf;b?jZL!4xY6DLTDF-E`Vc zC_pS+BMy_eh1nT;@?RtW@qwr+ar`FSIihi*t6Ie4=pL9uAScNVO%oUMB`RbvCv)yv^?Sa$aJ^b+O6gWCCS+KPRI+U|_~!zSw2M*hC1 zZR4My{nQ2?&{)+#cV%|?REPb(_WB?#Ee|;vcYMLOxe+WLbeV145lisW97}i!e+M-I zU9PdPb5z7~X7F@c-GJlFO^cv-Da?TRh=C~YL_`Y zWvHz<1}RVlR9|Z2a33wmdkHFd#*1_zoit(DbCIxs`8Bf8BYZYNIi={s$?Vtd#t~_j zXg3bKA1a(eF);$VwHD}JHIQClK;Ja^3qz#Ph@^<0S!#j>>2SIeI-tT@$;om=&Iq5) z%>8zsvLOKDQLICW>NDgT@u_pF8W}mHIAi4 z4o`_2%^u86M-?Zf0>^d_#h{<1^JH`-;G>^kZ3X9~xHx>Gnxuf7f2#U~!OdyozF-`Q zx`&?r%wWBACrNLIjBe9s-V~9aQw9kKY+Jav*oPUR5jR@6U@YWh$!fYfso6r~Tz+7Z ztt#Y$M~7%@V`;;~(0>P4>*!h@buPWH5}Nh=Dfi+V_lk~%l&e#Ja=WaD4ESX?^`3-LqXT65XWBwDh^~)sPH)l^8J&0aO4b5U^ zw>=7=fh6j2wgUIySPU7%*O-(j`Vd>DuL{nym*x~yQa`4cHQ>zA-Vs|GAOaMTeFeX! zZiVksl7t~I2^m9TX=BzEFw>}>N-xltj7iJTHK8pCHKGdJ*;cZp2qI3_rGObm;V{R32oi-QM6MRnj znXBvkVauFwElaMF?gyR2roppXT8ce@NDUoby=cE7=3S@(`{q7T^8T&)P0Jom&VCfm ze2z2#1W&L+;oq}C$?S=34O4`Q=&7?OMTTIPL<=3@Q8W}_IRMqkdAB;J$h|CZAarIT zww?t`P&~KF1R{`FiBKd^>!DjtE{h;EhMtd}FoX&<2!2SpdW$yN^AUrFp3IDUtZV@o zKzjrL;hBrsC!6D8GM2}oS^)rtsD-4n_Jd(T%W*^6&q>$2^I8G%VLagk3bwZ7snBDK zOoH`Zib3KJ;3#q_YY0*1kiE%xbeToBY$+xsj`fb4YnXJrbiJbBXF0TN<5|ScF+7|9 z-lD6wJx!5JA&z47V|rV6z zlWEjK!#EHav}Bl<+lTl+@bb62zt`E?Bi~r@c){7Y{24=&*cz&dN=QgbPkfy(9iDqF ze)6HK-EF2aLx%)5ZRWN?OWjhLWr$N)Hc7Fx8NXN<+$nF{Z)jya0miS2-PjOrR z(<*zY?XL-|qVJqGUnKCWfPWi^Dqvuf$mnXmx>;!a-O$;~96(>n4TXI{Na5JVrnGEd zz#iY!=M*(V!nC!!I<)k+bE10?VzhbUPoVwEHRi(3hJy9$h1(|xeEX~l28%)ZY95xA z@hq9iQm2a*gbW881P19!=pi%SPcv%UU#@~AWM#s}4dOFmnj|4c2{H4=gd`L(15%WfvZB|$4^yt& zJX=L#D{$)#0DcL?07jRoFo7wc)AsPx6Y%CDA?QaY#&lR(4jW~`#Z2Exw9+f?K1G2t ziJ(rG-?Ai15zh+Mzlsku@ZFCPyq6)8T7+q{@{qjv+@~IQGUb1vcSSY*^o^1g9{QbU zO^isr$+A%wrY=zQ*(X%|!mNIO>I(nB4m5-7S2rLb65^RSP3iG?VT_A9dmw<)^?N@E z^5ja_cXjW-T|>uX-OnF+vE1;cchhzPQ@zm=8RrUUpOrX;?)Kxe$G+{%5rA-F{Uj>} z>!J>iw&iSxpHQN~_x8<11kNZ-CdEyE->X1d?2F?s`jrrsA zyAQgVJ_)^Z3wc2OE9lobm0!Fa{u$lp?cnZAe3ZOeQ7jqT5EHA!Mm{PkrZ;%c^rd@d z$;&I0X^39pSba%};=pGY1g8NFV@Zd6a-qZV?MklcTa~S7f*OKyR-U@7A4}x=g+l9W zVfG{hU6q`=4ruH|EX|D?&hypds4~edJR{*e1fX|K0K&$84|H04T6Y*r3(xoo_wptM z)@%89me2tJf11i>-r{gSF^@Smfp@7Sa=FDIE@g~{`~2L~l^BB?v{@k!O82U@oO)$n zo4oHrGzpyFU(|MnHt)*32VE};9~}YojlP#*pM3$LCU<%OiU=dF!S3GOegeiFn6fxpJdp#O zJZB%c9*jBjc1Nk#=YfG{H-KVaT= zTfKhGDWP)|ns1wsxE=SncUwbZW`l<J`MxD2AAK$(Spx$|J zX%hTG;B(MT#^vK*dc1Vqt>RQ(jt!~a0^Ji@W+c5=XU`(vnLjSYzia$Wg_Zhv@k(vQ zS}+nSuji`z=)ATaWZG?_E%?gxrv$+cn7|q}0-EP(d*?YtV@EUdDqyR6@>2-=aMww6 z5;l&lO|y{obfov=76Lz+Xr}riIy4}BWp3_7Cu=WW8~!ar+Uoc;wYwn=FXPONq0MKg z#skJwrH9x(w=1MdF)v5Bniu+=z+5<9`&v{jmaG)OUr*=r3yaU#MT}2Tdl-9F{B-Be z3<|DJRwS=^RsS0A*EY2$`=^$bdSuWwM+ci6IhFa*1?pwJTMB6n7(Va5O*TDSUv&*Q z5mm9B;GKJ9&#ewMC4La2CU~KoI8n;Yj`#J_m5f-OzVcTLIm>ST%<9p6qH}^JnpAk( zCs~9z?ebYpt|A5y3`9?bR@9?qmR7*Ia$Iq7{jzZ6rE&;ws^?>3k6(-AwqK$15jE$L zC5B4-@P5hZeL4G4s|?md=%{1ux3lRf?H>Nh*lMbIaR_`=h$(u_j4!y+v4G(}HC*C& z^pmt?m+BctfRQ3>kvg59sdTO?gasWOHDx(TT90Wz%gFl{VdOq$)Q8gXGHoEpN3TdDRb42N4JPL%tLONW=p&hBd%TFywb{ z7DU=Z3-U0v>G#w43QqDKT$chk+FUVmOLmmI+G%aiC9Llrw-j32pFtdpan)(nde2X1 z`C~MrweS)x(~itAM=ndW`p|$lC4oWaxc$ulCzYX7&7l&2{M?wq3-S?=FSCAP65Y;s ziVVyCZ9h2HirN}aPM7^+Y5ylzziv(=?j z1DE^Hv%ql>6H2Llg{?~jwei!Fi%m3JHD zWmnGBhFW3%X56`jPCpJH(Z;EQeW4KJnyXi@SRDu`{_YYara0%4TtNb@b}Xt z0)Ylgfq~JPWCb2fwn%Ta#U$E5Af+x;lvNJNy#uN7T+@oX$7Gk)6azsNsWMf;WY z*%TrE@X*=tzHxSfm?vaAsc5EX`u1e&GmYoQ4WgWRN0v|yy2sVnGAyAWp&7dq3ZQ-% z&|AeGSQmzM3k5^1O*U#4f)dP9``!oOu*5PUmogCN2fKX|0)2jSW#2iB^hP z^9UD6c}$96b7l&yOeKZ39#$!7Cf2f{(eK0I$|0tBE4eu$e%jPE{t(5~CQbfPDV`A5 zWk5joUUL3o*PLrF(T@7pmQk9Jn}?g5dx!S{77w~;gyvOEaxb53JFh!)gI@FnUiobK zyN6x|*IL4AXs;)OM2^l5eBbUwJ*;g$`#$&WN?BlrEb!Ivr;8zVp+gK6$RjUH)vApw zOo~>8j?#ih(K0Pal*{c+kfVU_a)Whoc``A_xyyN0oaw`os9~(YMnCsv&P=lp<3TSn zFdkK|bz?;C87AlsOirxmdFZn@QJ8njeH*DBCaK^pmUbLgI8^tVX7u+@1Af2@1g_9ygNxv4 zz`sa0)MWa{Nh+S%VzFbgY%(yE#>ea!(&6O;0F9}JNmRAyxXRsv*qT%GDAcN*)F$i6 z>|*nHYf3Hxq2)qR=9VrvnlG!SoI8ME96Zut7Nu;+4qg-^$ucDwc^j6chk44nWoljm z)*)j|O`}G7DP8ma6#C|=F_v>^h5Qv;jD zsZKA~i?=QnwIsx0Se+jfYAkIcVyD|#9IIJ!jWi*#L%e_?9@`edSuz=G4(K>1PAmu# z_`2n|gPhq>Wm`!my)nbCj6IyysUlGyuZJmKa zoCq+L<4uj2sJw4D%C64~TtsMF-${5gMb;pU0>hoc&=-KJu1s_LxW`jY1V&9fM|_Mg zW*_{v&k=#)kM9nLThvLgLL3iXW2+8wKBzt&^bZ+&Kc|@zdC<>uf3wx}^WmMLM(>RT>cZp?qLRD#W>~Z?+JeAFS7Ao{IPCMSQ3~_qp}9-F-wX zu&ZBCtF=vt_P{?5$Jk?=MEPMyC2PT z;!bMnK67F!i4b381eH$nt5Qp_;IfK81sNQ!ojeP;=sr))n`UkdlDdC-g(cx?T2JQ5 z^PBq9&kuEX7hhzU&w|eGaw%Zw+GcD!h(ofpiHRSIF=i|)eb){8J*)>Z*LQ*KKVG!@ zf3#-_<6$^>yXApqLNy$Aor$n@n8^dNwYt81$SR1D@G!zs0x5N+^gTw8w4O6OV(i73 zM{s@SS=kxoFo0?HE(+rNSruk&elv=RSaY#q%rr{P`AA=zAzKYG=vkPo+e|#p%3@jJ%Xja zY6zIcOnzZQ(-57v;Ma4!uQX9Lr8WA|In8#CzoK@*LB{EP(=Bd{e@^w;she=rN{U!B9RG;vcaV+dk9BzHgWHQMRsW42Ug1P%!odvPLN$sTIiE;>)vK zVPH>lMBR>6E^TTeo%Iq>jd^sY}8Ie{8}@)C+yzIW~4y8DaCuDM8JREO~)D8J#|L2e-hWB(E!ViGrBuWiuZ<vsH(PXQ)w^Pf8G;bFLRmA9)DdJS*7OWkJ9G2|r}aSlwh4aC&tuhZVI) zv)`xl)n#Xr4|Y1rZrH-#??D*z!||7?HX+Jl%-}7r$wVN_DAEkWIEdU zuQKT0MSH7x9DT%FK)&zEhem(+H9~EYYTKOl0$d{;+cv3k8U@-+_P`-)r3Ro;7@&(k zr|!ZmM~HkceZjCtIVBp@LGZKeUU3qYm4}FqVw8tbS2BjBRx^yd`=B8>=Q?r5wP8Cl zXi{rDE@0`MYGwJjELmyHh_uRY3FP+|!JKvXHn15Pk!9R&+i&K*I-c#LjH@R8@S>(d zNX&TYWYF)6XutE1JAhbZyj4Q{3Nju|dO(vEp(^Az-@Y|-;O{i`-q7z2>xHoe(wo}( zZ=SM6j4yde(CI;Bv@KJPEq4Kk>7NP|3TxY#nzVr|ab)ym^!>l5wLuHpona}n?@ckT z`8d#ACYu9h=q#|t|588sa!U0SaQUlIp{iUDdH&v3f8iH&;&*N(-rKeFYz{S*hk;Cz z9ObbI-MUt_*>cY5%%$i4=xL?(QbIdf;hH8(!emj5Kt@uIft-?&wY=P-sv+(gaXogi z-S_KpC4aef?8D#?zyM}7JP_RQoFr0yrM*N|(L(A(#Y zpvVSh8hbXi|&ESldrZ1-YXfOe_{eleA{UL+VqU#mmLgU%DY z+Z60;KNdPnY>5RX!eU8&Fkl;{$10`gh3w6NwliIw&Wc);)9y?w%wH=gzgYkMm4?i2 zCRo9<^6}O!KqgePw77JHENr4L=->jN@e^bH6!S$ntSOujjRd)5GTV3m!;tIzgkJ>v z{G&kKL})|KmI94S+8cuF-8eXYHGMpcM`bJF&h|p(+V5!Z(fN8Y;t|IRJVgSP2v8;| zmZ+KXrv00N3YbkhDmr9cc)2X^xUAJ53hmlLr&tmwX8Q;nHw=M>Sfdh}N8~mSzbsLh z1X-DEnRm5P84Gp2#KoL+vc{Rn=AmQYv^D2qAk1O1)fp8fdx_1*xRq_6>Kc=sh(Z}Q zMyqVFucsg!Kh+f~^lk@~ZS}!X7(mya%xPiMk5gP1!NWe{92$?I;_NLMdBlxt^_+U! zWZm_=AIr!ycbjdr!`4Afs6cl)cU!@Bw->#jvpBrn4H6ZX24RgtN8x;#JdQS?&x>M_ zDAR$G;1Lt~5;A*O7S+P9n9CkTo?=;6XOYulGG?czy3{G}N^@O0k%~?<8ODYtNym~d z!%}LmW1Y#ORftm_uR3ya-?+n^60hl#a&UA_5-X|jb z5K*hIApF*#74fs1(8BQQ?q0*PkQK|Peb0jm>)uLk*qT2oo@ei}$qgJdzsk^YIbVi}uUaNgaK(J=i?~pq2!l@Tqm*%imd!Ef(M7?#=YoSRcdsZno+%$@`+3 zi$0gH&^^^g+2`N7RBE^TKyJ0r5eC0)n^^?MH7sw zH((sFtl?l1->RqN$h1E>+L;Y^p4?x-bq)ReyFOm5_ojDqysph=Dk`6M!G>vk@OKJc zFOy`^OrWKW!Is=wprDTne4OS=vrfXeCwRK^-?)DZOzO`~!@U>vp2e6RVYM|>N>zqf z6DrWNfrdWg?!WEdx|;g+!S71)WWv9O1K}DR!c7p)*+*SPr}1+_6wd{R)y>VWR>Qnx z*)LqGKy0pq9b?Ms5i;%8n-+!$SPE})dQ!Ve68nVK@wy5;W{ME?5U0X=D|&!Wbb2mL zcH9OJ;FOVOl6vvA%QgqUG8xBs>v~{pI-o4C`+6v~VBor7Ll~PjmW&%FLP8R=7)zR` z6uV->vD7LmD?1(=4M&elc`msyueX<*)4ctvwr#`!Gpd}o zrf+*5Zo0f>W+IS6M)cS+=DzPJ9TdQuI!1JY)_DTKr7n!|!Oz-!hT;1dgr*Qqh-yBdD^ob5?)r3* z<+oPAp8QyiiCG;-H*VF7vG5a5J#WMB*xxBSl4~?6|8j-;8d0b&y88R<^;5^2)1p%P za8zPVO;`=`&(XaP`%}aBG(IwEhsCgJSTf;V^n9ntjtG;wOSo7p_Lu&Fn|t@O?Iml2 za#98q%aKZh8VXes+Nec3Yx5>DSwl39u>LH8V{Iexi@n{cLaS(uMzAlMpLZm%=EY zkoWsSeSyRG`4-=#EncL9#Z%BC@Ct8Uh8No?TBG+2S>$%6@v-AanTU&oKa1dQ7~c4a zI2rBrz0eI99p!g?rfEM%2n+ctD9DES^}6WI&x@0T+Ld0WQ|WaQ^=cJs8_Q zx%Csm*T+Vb1D9aR36GRQJbGEx(QT~%1TnYN{{Xp(>g;>+3Q~!QO^2XgG`y+r`%CQc zA}NV`;6V}a$fFxm9_lQbsLwc2jOr}8PeWuY!> zbrp-Oj4Tm*ym^z(?u;3~5Bn{q7dplOEeuAF4UxoKI1`SmM7XCAj{EhZpDn`SJS-M; zp3j~^@ElFHLmq!U(zvbN@xW>g2EYd;s=uc^eD=FgFU{3!V_@a5XQe@%yI(K>!8xo& z+??KDLaT+pJ^fe_7~?Sg;BGxEXtxBc(_q9+G4O+=m&o8^&?peXH8CQ!t=~qK>li68 z(~VJvKEek4At=W(zdCB= zlH5I4W~}!erv^mCnr)rn-Zt=@idKz^%6-2y`k*Q5X(4uE&eThG@{?a_Up4lI9T; zBsb=`mmB4wB|{^kAnYl|YD_#vs={CtZ%Aq7;IhNlXkNV9-JE!l;HbQ*$`O*P0%}}qKIaAJY?zWmF8x$OE;a-+W>kxm1oBbAxl)zM z!BShXq7nzjJ*?^wOV53k+9a<|Lw5-c9D;c@R`HTs$8Hv|w zV;0#{Eal+#L@HV`VL6cktXeLTyx2flC6!8@%H~M^uPPbkrK8%m<>e7_4%xC=_JSOS zELC&i01_!B%QUoBWm^ilT<07dxtu1=ND|EKI8B~rReNK(30ht({u-c8LZ&r~6wgOh z(#k1b3z(xeVS*C!T_-C+T|O1(RYQuA)CtAvP*qLaIno3s4m3(7iiwPHLXAa(JXUu0 z!E~)+4&M0MSWA@}ifs1u3I?gBun}GesfsKUOj8mvsg=je+G-O?YF(A7(!xjHoD-$V z&02TkGj)40`xlU$yvCgZAn|1Y^9dO<{7ZIo=f>W`TIJ0(-Zh@7`8knCixpvFw-?UV z-Qtyv(7X1{CGIj5OzTtjUhRR!FCcf#%XMHCdiS1e_Zao6wt1PdY64A<~!n6Ck zCd*W9FupI3`hF4Zbj1=<`LN67wzPGqr{z||utK%6@WcO?a54YpfMh#-tIXppVzj&< zUr1jdyfp@Dmi;bhe05QfQtRg=Am1DxWj)1y8nofygt>FuTT>wS=-4Q?lOfq-G41{_ zZQCGvHD{Yv%(LFOI00xi+jrgUcaO@~G0F7;Z)<=>#^@{iNK0Ty<0%YLSz#yG;QNHV zu~~LdHBF=3w)!$VO+K5UwK`IUMiqGaV!@&s+J`VvU-}#r@wlnQ*5kH4}hMI-; z)@rYXBn$XwS8a!>9`bcob7Ar*E|U*FGg+C=^1)9HpIZ1J1_10)qjBl(!yiwl4Gz_< z1jVb9=Q@J|r2)Hq8sb0fZ&%CCrz%41Ow&J54e*}zB$LU>C4L#6`dMcj9y;UYovFYe zOgHeIK^=ryEwIyjOxhGJ?O?9;pp>6*A)#Bhag*o9#Ub3jq7vp(Wujm**lV4zIZ2f7 zv#vg#R(x%L)0fd^tf*0<;k{z}rkt#Aq;6|rlYur}_>*=wYe|3E#*D)kg|xBi<55Ci zk5L*r`99<+klNyjB(d^Vudw`CIXw{IEv*X-6#Q$+^W-2{mS3#!K1C&a==rJY55fnI zfqZ&l#m*ctRY&xf+C(Os8~07Ka){4hU0!s&^wmmQ{A^rwFt`e*QSQ^Vw4T`p44?DQ!jWlSKnO?=b)%yvd}b! zwyPOYyxZ6Aqeu|F^SI%6y=qRq;s5q2Ln&jIT47|!`gwF)xMz#^GQyAG?funm1o+rb z@#LL?GizY7hdI@8z=W9nb~Q#&>z=c?r-Bj?p9= zh#O1)M8uJeP8t6UBp5R#;0T^Q?x2!BMfz3+hVPP_`pcdqd=OH{eG=NWf08-3%4Xau z4T|~#H|kvaDZB7#(@i8Oc+J1oE#%g)Y$RL?U9QplT>(R7r9p*NxLqWMUBP6_oc%ti z7XVKE{+i|V%GYJ+FxpoPIG5_wco!RxGcTYACX()Tlu^Q5C zeev*xdFho7t`~l9JIRt8ih=}jWi<9?$Sq8+sk!8>Km({lCwXi6uAKvgTbFo|^wzVX z(Jj>xD_KsBuDX&r@V*u(iqvY~&?XaB?c83mM~NhA=oJ9m5O73McN7w8=ZNAz>9)2o#*X$;}4Jc=ywbf0rP2KE#f%2^( zfx2C&Yu~7xx%>zlg}MC{*teF?Pew{xql zrU(`@kPleOHJS@?!o1C@?_W*Vd#8N!-^MNDv3+-T!x_ii54Pu_I4xx-`1~Pk+XYgE zO9R5+#uC57!~G01@gel(8$7x^6Az>wHvA!kCd@EbW8ABKVgpZCbegrhYj6-5C` zts3MWv@m+0KbADuKlu!H9ry$+Lw~L;8S`kjebV8p9t&8>m(48QOj`e3f0 zCLXd(S+z7jgZgoy_B5& z6h+dH-N+KYrCh4L*l8N$xDFcn?|cTIqT-iIq}J z!cQ5P)VpiXmq9w>cL9(}6JA5*V9G!hEA3Ey6}JWC5f#er@^gwvu3H*i&(rt;Bn&AD zvZ)?0e<)~i#-kDibk88)MSg<=PMM1h#*EyE_+}mM!fdTghv?m_p@%+g-7cMb_{12J zH*4?qGDjT>yj~kX-5HIX670dR#2UlK=ou6qZ}xzHX$zR+q+ARqvcT^{v>EXoOCiA1 z#tNF})tgQpYahnmYUz5p(7r+|hHRZG4^&ocfsW-_H#xmn0tPyESe!2!^;Wklw{9O! z>C8zI&0H$?El^^Q&%{!5Plt3Re^A8Q%|{+Km45erW%r@000%Q5sYgt5L5I>dGI1fi zU#z#UmCoY+ZLW1hA>$n1MKQep0{I9N|T8gTi>AqsHKZO=;M*C}7ev)D~^h!Hse@ zyQVwDKM)EIbRt)S?Z!loYe@M^S*l$>p@#{?sXL$q+JDEQfn- z$KgX*l~w+$MJk1+YNmh=P(7>+O9A9exY6}hv0{*=)p zr;QT>t4fY@&yzs@>FJ&Z>{b3}ohR@7qkOwYA#f@4P5^|JnG@T~Ji{ET#e};kV0QB+ zd*h%W&heK{uM{JOcvRPk6X+{eHCdDwfu$U;b{FRLwp*>YQS}XJ7$^uZmy@6P@nr`B z%>?;Q`aA3B>Prt+WmJAX$+p7PfjJgr+{XSAb#ZA^uKZ}qpy z<1Rcu-hIb9d(e)0hi$5{og~2{b8Qj3`)PI4f1C8ti5j|jekip0LbZLV{qG8w_PS5^ z9?)dK9{@tZ|D^Pa|0I77NCps!Od&|lKL`^4-vB{ooBM%KWCB2XJV1uX`Lh9l(0?&N z#h;W9$-|jI9+Hs)|1hyMK)hc7a1b|=224+`V1*`E{3$cU4M4WU_a7<$zqtP*NC8MT z5|WX{fGY5QFaX5I{ioSv9Aw~te^|%^7yto6|IHwEVugaZk-bFr2utH%;{SC71K>y+ zvPAM9b&!CR1^_}+p#Z>t>j0&>L8_2yUC077RRzg~B(o|4{&WPX9I`bCQnCLD$S(Zb z2_O^>07^msC+}YzX_I8+=MV7DBCP|42q1xv51akZ2Wzq)$zWAvZ^VJahq(FpARs_TJ^#%itqc7Z1N<2~Fc8W=4+S7?z>ZvP$C=^>r2fMOL;lzYsr~H@}F+}4;HdR{{m7F68X<4|LH8U(0`gl<{+%9{BR`YzcyusB1-`OIUr4rlmP}~ zY5aGjkgWeFur~ss$YJ=mRX7|D_+uTQNLMpcor6{Aey~73ZpH9zOaBDy3(eL*M&CYaL^wxx*-{qT1X>&(XQNR6 z3#{pkg$}|lG<@zyD?2C8u3d+^uMH8nvA?kJmZ!2=C zNu6x=!h}@K@&|e+pymR^oyS8e7!i(nAB47AcEo^lc-6&O&yRgNG~E+0|P7aL7i8F;SBKU^)ox9nezh*Iv#~yn}b+J!EMF`5)?`f@|B(pb^4!3+YUtyGpjZTlUbJ zB}U;JmYBIWgEMJaUG{ddUooYaRhl*d1I`J%u|P*hgwY*VRGal&*0CMU)9G5^vuttm z2avo58d&W1qVhb*`#x0Res5JQ+)1z4p9ACT@4%$|Zoh^w_;O-+9GD0LVO4Q9$+L)I zN_|P^@-tE(XPbpDQNsJC+vI8+_0qjgT}YiIEJ+0AKJ+U=XDdy~c^$D3KU+yupq&_n z2^l3^n;U&Jx%)hvn!+_7frn6=^T-xC|G0Gl9!>->EasVSTYfmXvh!ExJkX*N-+NP? z$5|s3~y z+lz?q7IW)NHP7FR!gN4;iFXMH4bGRBs-xoWDy262Y^u>A9oe8+$ycx{C1y<)vwZgqk72HRK#WC z%*~uYt!`P~Cv^^c1vy(3O-C1BeBOVnhJC(6?tRs;E?rr(>Z+Q*ko(_%c34%-<9r3{ zU^UxDHLOXOFVg7SHpUBHT4~9*e(d|V3H7{{QV0vL>hp7kKoPLok;?qKmqFA&7-`xH!HcfogwJC zv$z*dt5{A_tyBO&LsF0|nu1sqOL0saY(XjpikPK{=u*t^(h5|_C^k&!u+80(bSIC7|w9*?(XjH1b2tQA-E6jk{5R;1Shz=!vMkEeHaFJ7$6WJgyeY--&b``)!AL$ z{iApFkM6GCd#`n``>Oe4z@P`b@HAiYD?&|ZY@tQ3Mw0yX8_l9gs(*t9=8WatLeaKc zvtz}RBq~EJt{aK61AG;^;tUpdp&CeTHEr#O8FyPlp#*w)O9rdk;nodft3iKr)+&7nlem=|}5Af;_RoY9O!gYdd8 z3}79vP=E080jm!6;aUxS?H0o zt2y0K6aMez|K9=O?r9QJQ6P&&EytWk9Dt+Ckfo7k^nbbtj}mIsmjPlhYCbl>D!DX6 zAS$v0z_pC|StAPBC@b=#kHOaorBy=aUvfBg4$snMIqJv?8oA^E6#&{zE(hm5hq|#r zcI&-{#(=tB&Za`LV04{oa)ZI=wQ^;;hT3}$C+;zBVhjBq2z#SSC6$MTU5baj%C3k@ z7m#v8Wvilxo64Mhr@1bz3*<1>MMYb%7dHdXk~`psEIqt*O=Kwsp~oGo)bw^+1i=f z*-9~Ot^`q0ne*sZf=Kk++;}P~b~Zp2Tay+9rcLG_Ce#h=n;(ujTTL!iJ6))0jl@6_ z*j5s8-A;1~#s_uPl?SBUT_?yP>J^3hq@fViYMpspj-RMX7z$ z{_BsxoKfibW*HwsBr%9$%EN(G#(5+YRdZo;PP6!TPk+3Aa9H>-{6u05vqAufZ(3Kf zkx;!w`S{ikcvAD0R@^ZBLVce?Kw?JXlxl}RNgDMU{PSt~M+$g&K-AJJ;%K7Um`f%y z8aJwJ09cQxYf$;Y>N1CekJ#5bCM-z{tGgK5bntw*CJAQvh(ZBBUlSUmzGYKEby=Vr z;{N(Zk2DL$0i?I9^G-oa{%x=8$l<3FE6hvf9?>JS(z1@OwZe9bZP$BXO4xpwqzYhi*iItu-x8{IpF#{3cLet>Unu zp!PxB$nNLKK}?D3Vrfla@UqZ0pDyQN&}NGx8Rq^h*f>LWcj_eK~WCV{h>jpM|s6fl~SfgL)nTdJx$9ifai8)jLV|Je@4ZJ4HQw_Yk`$ZP_onbl@ zy#GKNE=3-l5u|7RWYp5}4z@@~^p>Dt5zUghI}n;__ZxAJmpoB;giALxWfuxhJ|_$z z>6#&S=$c|7ZA6`LElah*_H@kVJFQCQ8Tkon$KEyxT=57$EEuaYkQ23`7m{60H?3h^ z80na_BWyZg4$pK6J}>Gp#YE!ez@eratX7obh@Cg?Caih37N3+voo!>7d2N%G22ngj z^ipW#6k^Y!M>4jk*dN*}aD==kO1rTTR`{|hvxXleAndnqL{vSR8+Pwf$scGZ$yJew zi!Fzw>h{Z!fus%-Ugr|MNf$yH%8}04*t8vrxe2T=|EhH!3J*$rDw$H-*&s0QZ9;VX5PiyW6uItb+E0_Ks zxN^EAKqGBhMWZ@I8UmhRowLZDy%oOPKw^m$X%XLiZw)p2=LhJcUkhR~*K$m$flNhn zA8)!3?vP9Ev53}inQHD7!T{P5t3V;qv$#j;6 z*(pVPWEv8_m+fp3ak2}dOuG*$pmCvY7Y2(Sf89b)vjBe`+Pz|Q#M7;)^xYK)BN(d^lb-gob?7j!<4 zq%BlWCNS%Iy{Lc*uGzQQER?adTy}r%TqN}qX>Eooi~@Oihg>m*g|1~rn6W9Plcf4; zew9;=wYkskwHNx^LNa1x)v-}ibkx$0E^81&R{{kJnh>^yECjErGIK4z{-Oq;d(MEC< z2TqsW`UWi=Ru88d@{ndY@00v}vpFA@E$SX-i-6+mSRh7T-t_!+^WF(KwBo^YoFFdN-?m$y+H1mD}``H?E#Q z@1%*TdILWte&xah`MjH&fc-+ejNK*pLBF_b(XQv%a+SXEn*{X{eIlW9_B1VPDZw|`FsLW8>OYdGYS;%$8_)hQYAKwT?ivX zpaQwJ?KCaDZ`^9Jjp+ii;5;_fwtmELiV?vPz%%zQDn-ksgt zjaTMwjtuhSVoG|`oS@%cNzSD120FR8Is+mqzkJyVoxA>Syd_>zTS(kJ_oJ6bnwUgH zU`^bYcMR9w6xeX6x38ttYj-`_9#GHw!C(K+9#>V_ zb?Sfby<~@M9mRUrZoJBBk5GP6FWq=4TPeGPxQM>19vh6smPiJw2EeKssrMHr^NRfQ zJgaG&n>l_mFM_;4gicuCLCCjrioO<@1n;5cftasb%Vcghl@&^Ehrj4KO8k|mhvOzM zxY6jX2536WN?;!s&lI_PT^q!61dM}nI<3LW?w(5$%^D>HPjNebB6b$kSASd4J1fzC zsGO5n)P6H3#BHaS`qeknFflvBy0gtt1!?`RsFNjfQt@6rm_j|~p;F8x>u-=ug7XDl zRRo=upEUi%8{MGD+?UVP5KlFmsIo|Ds~A*ooDEzTI*T1muH&9n-~iWR7dn0AvX>^^ zm!9>2JEJQxd?vp42n+<92EHU|R7g(s7BFu^fq5|!^GscBR-sb!Lj~NeB06o!p=)0@ zx%4V23UfO^=%bSB!1n^a?){!umWJ6i+%(zxAu-I;3TSD$UePYxuK6>2Eqkx0 zU)aMIC`R0vX5z^UzjWi8#Sxiy9(-&zOCa?BTZCpn-5Tv6Uv13P>PMjW;U?r2V$yv3 z{95g<#^;LiS=~|g_Np_;b+|Vh$EuQq3liAmF;R0U+=<59kp0*?U|(I!m#sv{wc9XP zJttPAb!b59iD6i(j&+^IGoW zv1CbqpRDsP%`TK`#Eqs^T;Qej z*V%``dLLr8W%Y`ginUun$F6CN<1ZcJ3}-64w`=Z9xF@Mm+;SSW@>8+q`#QM5F*D6) z&R)WfHJO4WxHFA%Q?G6AX8?*NWI);sy8cCi5Vx-FGIOAQmji7xT*Ou(j)HJb-b;?5 z1`$Y>#QBEd-ws9M4t}|QvUx84l5pn1XTl_#v6@=4isQo;vRpU;f7_xx%py!{Cna0W z#^i_^JQh{|8o0)d$|z2I&_Q<23Hqe51LmoDJNh zIy0i}z}P1`8XQ{sglvHlxM2@#wv;j;0u_nfwEKs4R@*M#WrRECCcs==?FxMZ17)U% zYhYcwA`!w0thjmY&m?y0A%Qx_+s$1BtW#^^cuo2|I-165=DaUaSjun9pN3xktz6#x zGKfFcJul!iij7BS)I@p?nh)$GQJ*m>+SGJUWC=Kz2A!6O1qCsH2OB6#M1R}Pfo}#V zHr#soI_l`uJr|yA)KTNnh`D=`1%%9KdfH{ie$)^_i<8wu20aA1~U<& zZ{L>%DM-%f-JoYemM*3R@aqD#YQwyXa#QN|67PX959zn+WzUDZhhR#mwUUZ zr`CdPr=7c{vx}HG$L!<^R-WmtT+O?I7-p`z&N<)>y!4g*1$BIfQEvRTurny-yTpsG zuIyt)grkTkIJfc)x8RBmEXt7PxNyu~8t%bs#^N)Wg)1R16r=)CJHzy{b_7~%7IpXc zhQa!ac#9$+wK(Jfv=`9zj(e|w#r?WF;UyaM;<}Y)h0?5|?f8md;_*$JoN`x0^B1-kpMG0FqS3ufkwz78f=6oJ%uFi4w zhv6&7FUMWT+u9$ELordA7-~&!8t1WqhZ<~}RiU{b!Sc;p1vDm~OEm-98o!oXE zUz$Ie`AZ>8PBV;VK2G6Jf7ljfp$ldVvq=zD}o=z!!Vpf^@jC>fCeyYIMzt!+;b z4*JkYb%9c?O4h~vRWqNyxS3k+OMqejZ`+KoFo6h){$aB)+4`%nsHqSECYEyxS(Qa6 z^e`-1wnB3gA;enimr*JR48Xk~F#r9g$sMEKq=>G@X6VtgX3IWY^^a}S@eYkNv)Bfo z+8HZfL%!}*ON8lu@V}$wg-=QvUdPoa>o}iun||f&{`Wtcoi~ney$3;_>EZwQ1q9-L z=uKkKxVgxtKhA%AsnJy?+|m`ocf*6_89IeL;ZPaTyMIS`Up*LRDcWXwCwErD(KwQ2m zq1immNw&HGI+s355F#a@fk-2$0~X(O7N|D&uN;hT0%=!Uv)D~=c8&JsMK{c9-}tgb zYZwGL>Qij|{xc61PCU=mPh{K#DXa{eJ5OKy4Cd5dnPs&ma6K$A@Sh9!ayX;tKS2!*gi20?@S3Q731eJE0>VuuhfV$K*v}TLVr0%*ViduqPB@$paD=oB6s{^wRw!92^ zx0StIXAkbfpSRJAUsWh4Ln6Rn#_2(hZE#U%;MM##p@BNwNtRSxKR6Z1=&C6(_>!7G>RsX?CX%@ zu1atOZaRRCJPbs@5*&oT!O0NtJ5JnyFD1xXE+0D&JP|LoepN2us9Fpy^2n6Ty=GMr?+ z1KS_EVcT}KenhfnQm?8xHVx^c*D_+^%&-cg;LXfbB5s-8YgN1dhNLjD3v#j`-;~0j zzQ8^dFZXBGA{lWfh?P3r4)nKLd^;f5l-wU@wmOp^vA+mGPgMI!Pu!OgEMYKi>pk&e z{gtM^wK2!gUVryb$dg>rm;cdCQ4flWR=&!BYZXg3Bij-bAjtO(sqKX`D;=Vo^L0{= zs38>%?gQ?EU&X1mm`}(=I7(M!a<)ouUx)U5o8k_qq#8uj;mJ?;QXcl>x6(4>=Zqtj zzvOtAiylY-XoF;9PA-JhpF{h#QqfZZ*1_cti1BcoRvCL-UTjb*a?QtzNsK+@rX@%U z1#Mh9*w=O|;XBl+Ge#zn8RHYfa3zng?1=B-EiSn!YVp1Fy7IJ2?)eNwJ`S@HB?Y2K zJ{!9CYV;;i_^)55tySFI!@A#=O1#CV3o3kxq_am$Q}vXu-6I^50qpYW7+UIgyC z{@mg$0W#E7c0e`JwF(pgH>b$!`!m|X??UF8aR?AibV@!3*sISBDK=&#%{2A+K?Lc; zAEnmt-@#E)cAe>HZJ1O6%hJ(ETY;hK@tVS%6AQFQ+1kH@Qy&rwt@+%Hm+ier1+AGw`UwxIvh-JIf7+$7!jv@KHhss zSZTw}S{S8ab9lm3N}UHFNv5)@Y^EcYfysOgqdh-9nL@obKkxY6RInXNvoqfnYu`fE zq(*bwmDw!V>`qloCe-!b(Mf6&7|<=*tgRU-7ThgARR^3H>fW}wu)Ro!Z*8TgXxoi1 z!m#yE`}jEpqh$!|#O)@8f;Z!0>RbhGY4%3!C@zr+Qq-M6bBDm#LeVl}Zkwoae!;gJ zYkAzeB^t}gDdf?*;c;jmYcwJ?U7weWRfQU|dTRaJfs@0m4*U=O)TFc6=|5o(>Cp5Q z>G4%K2tDFUO4_g9!R36$BY&m6Ad5xpLY<-v-Cii`B1w=>J!S3{2f@3QuOFSj(Y8v0 z=QFO}W{9AapO~?oM}?BLk#NW8P-W_t>D@4}5uaxJ1K)FVF@UaHB1v7q08gf2byWX? z5_{&Ln!KCg*QB!#>}&wTLQ$eT+fL{EaPq)@4SG}xk6g9`u6w0+W&PUvJn_QRybWl-G>&(^Re>Jq`#w0c8bEwMvV2;qJXk6#CDI zam8U03l8=7mhgOdDL;{Y_RmE~1pA@43@n})!K4{}Zj_Bi|K$U3TK-OvHs40MG~T}+ zra1(YI`T^RUllg!Xu2^F>7af=+X{;`A3i%07o2(C34s)6b>xH|)!4keVk_8&Vfm{M{6Pe_T~aYu-WQvsJ7j|ke?EoaS`1pf3L_Rqt_DkQ zLBtU;|Ai=`F4_(MRPUo?+^B5ln&@5RS$3mUig{WG(Dv0Hp7=EuGM zHKbb-usJTN5IH2Ov^avF;;q><6L@A)@?GEtw=~^up&h|6XhM#G&{z`&Lm<(XqVdJ& zhR__Uz=P-T2={OAsu$0@%GQ1|%o~;yD&QsvQj^|V4mIF?^Fk5WKHVutWT(#<2)9p3 ze=k}_-sAa;wK#+~e!5PLly^Va@|?+!POOKI`{AAT7HB3DoOMIqxD~mQ#uK;+-R%z% zVw0~s=mHFR(LgDMy$q-(=a-foULBZgYZ}gf^;=!CyMocc+qZy}=f+dsW-erQA#qUZ z!zI!~sl|MF7|hDYlg^n+wZ(cRjdmFEO=)n-36~Hou&ynSiBBS~_by9>NJNh`h8+{n z9i1)vyL6oYVL02jeQ@Vq8RzosZr7!T9RJ?HU%hL-!>h!e&+MMgI(GCSLqEtl zjB7u}BBWuA(s#K{eu>9WB22hK)QuW@b4eL?i;Q=EtcAzsEud%d_L7RP0Ao!rY;`MTNW_qePuH6>+K%Fm2k9uJmAo zkn6l0qQc^8rI1umZ)g8Gm-x^gH^HV%gbl$Ze%n+W3@qhbrnrHQr;vTAh(n7?Anqb< zaUp#)l)Lp0d{~3l84ufbM2w!RX$^nywDk8rmyt&1+;2qvt3b|Apb*FZ%M(o-VZ94$ ze^T#U8*79Nc5-otBo|;65VDy&Jy=Gp6#AVNA7j5v%7J@jqBHKd7bs<~4FI>M2VsOI zw&h9NCv*we=pBxun_`=;(3g!NW8qsudR$_9*k$P@{8~dCx$5WRXbJjrFCtUe$a{l$ zdl{ZJ%N^+~yVqG?o?nJf(Vpg-8@kU6=ff70N3V(lUCq_SitBPREd?6TGNOX(2o<{xtb zGvyx{Ucf^|j#Vny6g%eu%GAiGC^TH)4XQ!$96`}smr3Vb={9P!1wM(z zF&c^=J*}E4$R+~gPLXdT6X;}Jy!xY_eih3gJdDR&aTAo%*o;#2@kQ_#?H@+Ipr0UR zQ<~(B_8y9#HmXej1r54FvUZQ;w$cR6Dr_V=p0<4Ie zJ~ud7jl$77WxWGKwQz=CN6TnYw{^RJi%+773?UIL{CXPyhGQQ&TL>Mk2tt)jkrPOb zn0Z2#x+;)rZwI^_mKIH{#w;MxTar^C+@pj)NefSjoqUTR{2hKToewDe!i0v8Wb?^C z)o)9FRGO0YLnFzpj?N3F%&&)q%2ZV{Qw-jlKOJcwC34B0K2u}= zQnb;$BujfyK&w%NYdm8$G3;8Z@|5H_RUR##CbT9fPO<7u$Bm%>cKL}XvMuOXB*Z|mJoq<(V1;E|GV7`o+@D?njBl;*v^fVGJ?#@84E?+>k#Q#o zxHib{UDmpxox&;Vv_EoRS9zMioUY_2>)iNBEqP+mU zU$4g-yR4SVDJ?Mm*|w0K!HujXSP%Ey-PLqvH*68dWGMEufgQ+6iWE}D%}%MH!EZAPmFA;!J19@T`_-h4 zGy)*oHbZ@3=F$m6<)tQRV)r8zIJRZXrr-Cukc@?~#U_!=h=1@Io2jbf95a!fN<+OW zVa--LAL>-Y5g>Vc6MLsM=g7-&Q7&8OH)_l)dB?yDlhrHN^T;>Ir(ViSL zIq~05tR3>|d#@2tX9D|jd`e#ss_Ab_0QZS7u3RvmQf7396RwM1tg30FR8lgY>_VBI zJs_CtbQr?8M4pEiO{ZVUZ#mIGQ94>Vj}}|G4XfKbv=H|Kpz=A3v`HTrpt;e%=%k%WMtPDe(P zV1S~;m_?MO6wgARR^EC#`QEq^MNG~Nn0t?Lp2wcG2FW*;M#gEBG>aY9oa0HbK^DrQ z$gZJ7z|nsr5%Sgd8)^cbdI4Z{i(keLA(qCrQWd(7IMOC3d=0xdG6WSR>{H3nAtN*P zcmX_vJ6|JSTkTzR{LMpV#GiSv&>|sM4o`e>&V9~RgR|gugHpEI!dx9>RvSyUD%g|R z-FE-$LgussZ<>VKdz+v%PYS?$IXG?Qv!R(^YpZ4aDfXy+_Kic7LJw#E+DndL0P=-H z*{t|(`lw-VPmh>vd$h&dR2d`?ao%<%rl=(cU0-gsF7C!(+-cwXG>p&I2<%EpgBd%D z?%frG4?x)QFdC=)8Yi3X*)na}5^R$0_!_r#SL?jryH9c-I?@hkCQqERv)7rs(Rnf-Wyuk<~E&YwS+cDYW?^I^T1t zydz>vARyqu?MBC>xD)$=GCpj+r2P{&cuOq`yI=)b+S?@hI%N$&d4#@zSZDHe9-*YZ zhkdn{9gSGZgyvIVsgS>yxbUZ(D?8l<3x_s&JgS(9`PJg68UW}zI_P;=DNnEJs ztsI?Om-u0sEn*cGZK9ZRwN1qB^FBGV#IUuqOALSLTa!qU(l22Y$(SpO+n%{YHC~nS8{K1H&iIi4HMexDq%%ua0 z;hJ6qB%LKxwoCDRVzFG<>a!cKyvOS`e!+7M``jazjqXCdocwF*KT3$(vam<(VSqP7 z66FFCDyuDe{E85Uw!T|=E{@Aq_V4K~&U$)?O<;U%X}8NC=Y;<8c73$!|$ zAeGDdu+Qaz#LM7~XrnCO8au;m^xW#K+R{NM=vw3n3DpTX>UBa814Aqc;oj;Xj?KaQ zn#>Lfnbm=55C3Zupe?r?e@)LRBUDF;z8i5 zTb*D}7C z|LLXF3LW5_%tWETgrxV<_aw1J9tgLX+ZQUwKmo2fC62ax-&XYvFCr1ZH8GFK zH0*QhiTL3QI5jtxO!~wH112c@H2o$z`!06Yu@E{z53Ok?qEZNt;KPV$xc#bzx`j3Y z?kNFH#^7?9I@PQdJY0K{IIe9@a~#zMZ6dh)Fx23Xvv6X_ciAhYqz%4~XL5*Gx-7HS zY%GDKbGd-j+x@eT-<3?m!qz5^X&w3Y;V2gvQQ9LGhnDN~m}h*O;EUke-bCLQHdfJo zw5LL9h^sLjs!*Gn3*daLG)4P~= z_yMsIucmI_cKmHPvi%3J=5jBF?%f-9Nz{*81os18HA90$U>AX#2#7szM@_5XO&H65sw>fe0BEZwQWi|laT5<@cTqM<(r%v6~ zt0U@qKdPbnhchZugU2hxWD4)O;kxLP0F-Y#8fxE%--kp$m>%xa##vBiay6}@1uLuG zaX#8-Txjt1J)f}CyM`7(V)o^2@$jWLIU z7)>RAb*`R7y*mc%<>cfLN!SnU z*=WvDdS(LV$VPPM@a@87ffIMmmP?yJnR`^)12M@y>&dWIAE%w8qsUZ1G>?T!N(ssv zL7B~Jp=!dAz*XQ+o9H46));Se9Qr{r?1Zog2g-UPko%vG&iQrf4mqn9Rf>{szbME)(5DC`xf z_Sk8?*_+jZfLk!NZkXMYzo;Vc+=D>5+HJJTabso~K`t2ReWK)3hG!ESj19BMk3M8e z>7tgW-o}mvwuS))@ohNqdP{#u9q65A24njvY)4cA5aGmZ*0qPq+u-KsKMOFjKJr&S zc{o#RSFo3HGEhEJbJ{);7?2+gaG_7_jx|!qS{7vZ6_e57(|K|4=5&bccT|iQ%Z|`* z`sBnlM;0GNAMM@65iX7Yly8C1wXizohif&iYEWOwwL#w+lJw2dv9 z^~7ZD406DA`z%Y1iXEBu1%}7$eV%&I8??6x2}nl<$dfb6FtPLlkQjF~`G)zK*1q*x zmjsOadn2$pV^HCR)e9?Jfa_YEM&hT~>+!5YgZldxyIcUWC@KMXHT2arQMTAl{Brae z_^OHfB}FaRYL}nY%m~Z*l+Q~{u zcfa=TQM?zuO#If%k@_njv62k*Q2^_0WU*2+2uyWFkD5cfQjtjK(WQv0xMk{uszWy* z38mczA#Eo^i1Xo7FvePAS_6p(4X=Kcwq6@KZNva%Q+?10FQj1_3Le*=TcedOe(lhc zeH}#2Tk?unwA@CdW@N8IP}MG68cu(_^Sq45Ai!7SD}--#8pRWWp5_li$}N;($*`ae zp@teWEFpmlHB;k?Vqs?oX0m&X+~&p}XlvLeg>MHRmyVD9-B#t-D>EZ;Rf&rX z;|)drVA6dZN107muuW`Eq+80}o6pe2keT*uuQv^SoXc*Nive?Ru(qNgzn!P!><~x( zmA5>j1N*N zB5bLV(^9OxiBjzDlFBb0AqqNR;fpDR`tkPg<&YDj8Jb>o{dCo9-0oRK+J(InC-pLw z5{vG7rhaZNa&OIe%MlPrvfDm?lyl;80vJCYEndX@ zw9Jwh?~tVN`*;V9xpRMBKiqvlf9O08e1ZxPoR{b&y&72Wz%N=&w1{Hn^(qoatDri= z^~zB2P)9Ek_HriGUI>WWte`STM$ln3Z6Se>f}gldP3 z{lhbwP+JZy{$uKN)QYE_T&&`;X{F6|?6NSHIn{K$7!uO!9+qK*7FKqMMT<0s_t|ly z*N>-+oJiSd@5o}l7dM$E+s0nRX=QqO_h9eMeDC9{#0Bva$57*M!TmbBo@K)Ls80BD-#xCbrDuk@-RgM)XiXTG z;CDAmG+bf=vnF-k547x6$Z|a_i=GKrYx1FE<|4v0M$mSig|j3ZGFF0vPKE9hC;0 zl{>+X3Y$g45JeJ)D;`50=mj5eLrnQGDUsD+3sw({Q~C^PZG`10&> zQKE^70>rLj$gb3Y83Y_Le17tCrFnLCET7&)C2|jy#A#AFtW^GuO!OLi`ld`9W+`3N>k#^PW#0*9?A@isp{cIZh*EFptM)f2V zEKW6ZEjcC()FW&PN(b?R*kcXEUB_x-(N* zhhZu*u`P3QwA^tbIwp@QGQK!wyvp7TKwB8!RqZHAI#CV+62wjlAwx$Zs_1wY69z{=13|?|6f=gWXijRP#>5%}xaz>v=B{ zcNwqmECGJgep#Gr8NTQgk{B-ef7LUvJt$}x24Oy8hHnScpsHOP1i9N)6l*Oo?H8wc9wqbGGWnJA1=xf^Zab0+6}X_iuYWq95gRu(9B-=xBaB>Y}uQW+BP^;qA zh7nsXtB2qF$foTe^JZQqpyj?L$hgnZVqtcbo6sP~owK(i-FP*OX4AevvX5=75qkGZ zEzweAwL4jC{-RSKHW1>G-4g)RPlgZgp9EQr+z#&r6y^N#aF3ov*!@44|7d_BOrW#RWO?B{MmZ{5Rh7e$vJ zoVFBhD*TD=-M;Lm_P)ET8&m?+y3&$d*e&+nhZ!giTm@jJ1i9fPA$2QgR4RkTmVF4O zT<4}-lU=Og^TQ{NV&qFvNM-kq+Ure*RIqvQx09=ilu4g+mR??(r9r`~f$BoO&>*`s z^Rup8joRijP$MMQh%dx`kH#u*93>su8l~{RVi~cc6IrN6?njtP3iMekDkYR6WZ5D- zNM{yOx~piqCKURx-kn$CX@s@pE3?045G`AbTQ|sJ=_{w)vco4RLy7hEAt6TFFa48eA`2qqZ>HcX1J01vk3=Ay9~+8j$ilJ(JE26A%E3 z1?cNar~*xl&M90s>mV)V$T%Xf+JS$fLp8s>yqmvuF|<25El7q8FYM{|3d^l6bnt^3 zSVE5}AU--*bS_8Z3Ap5*u)({99NsvG23S=3%WF_jATXG%#%5$1hu)i-o)kGd5Y_}K zApX{rWBKM46xb_T?-3Ip9f-ZKv=W#MZ7A6cI&IyD0h~CWqqNJb0x%;nar!Ztrdt8G zz%s^XG>zv|aE8P&&OutA$avzXus&asKYY?7FNq7k6b_rLWQpCE-i7u{FZP+{R%=l) z4&R=hzXwYRJZT{!JvLkZx!*y5O^VfPT-=9F`o(Jyhg>z`=$9WDdfSYg7#_Zl-yQ(a z80QX`w6XPj)Rr#Nj9P(3gcenIauAjSU< zMSowJ&e#CNtXB{~*7!|=W{4-2FQ{x$NQ+v89Q*zE+Bh#0yl-#m5947Moh#@rCs2|4 zP%#SqhwzOJer}9*7k*gMkPwcWkrO5G6<@a6?sY?X0LRy%6K3~gytXGQ% z(m@1wYwg&|8CU;RU}fc9luf+BsH^G00g7bC@Sh|tLiEEFA)J=|#W-F%tSBYIBJDrX z0Oy(ZymQ$l=l~bl*zcs=@=;6S-|C7zJ@J>9eSxKW$@(f6n9Y5?2(l-trNa|kbr$(m zwu&h8R`Pr`s~V07W1nd zKOl;S8nKjfT!ICn(*DC6+(0MV%3jTeF2k~)wj+y3TCADC+F3kmowLL31{0gIv;oA) zFevH}&RsEG#Or~~2DwHmxzPEctwXd@GkuCO)P+9ruZ$dcw^)zk?5Evdt_!#ekN9-R zJ!RqT#-0?!eZD^>%H%=_1yyY07#9EpB%3e+bk8cy?KYP z`vJ7{lo%f|wbwL>%jKXdH^O01H&o$?GFC3zhwv81Lj5gP(FODf>)x1MN17xqCFNXG zjAyMR3kbinK2zBdzcTL~$i%AVY+pLC`ecJaX0~$~ay*rG&R5Q#g-omP8!s4BAggP2 zObj7WC4KgKg&F^x)aT9yU8eNvMuzrN0&M56;I|ijJu%3=6Y86f>?_hu%>LNi%8=f# zMB?JF{xjHAUj=k*b~J@}NP*7~YoAfxm9G1)`ysq=%Q2zq_hk8o1 z8v2T{8{toX=Y;K4w(le_OZVC0)%Bnb9+pfNHnO^9V6LQBKw5h;!+znSKRm0?19jH#t$;f{%p$MG zOwCQta>)zL#BzvF4V0imL4udmyNQ1!PIkT{6iLK~w-q}31cmZ8#V}|^5oYFmp1PRVJgiV||x#8Lb z8}QFrexAP%Kz(0q;VNQLy3BJulLb@8UZd|M1z?v^Ww;0diZ9G?o3Qa><+6Bd&3m() zl2u~?g2@47>g3rrTLa!b*(BP&>^pKArG2;)&wWd1QSK= z-w7#=z9^E3lT8UJTQ$Dh#o8F}4m(fTPYq{1qW2FRNRJOQC7$79Z#*qg*sxej80sD6 zxI7{{tZ52|RlL?TfJhK3H*P1w^On8ZuL14t0LJPAYKEt2UCYY`rh!3-_Xe;fj@lAP zJ1f?(fj11$0LC{@cQhjkwgkYzaN!xN#cl8>F{CQ`!ODBU4XEv4%Jp*Fg6jk2e&y29 zYu>U6@jf}jWmRhxI{Ryoq1$JgkFL=H``!e2`(~R!9sr`>XOP`c4Zk~xX!o`+T`y?^ z2$<>(!A7^HUy1jFdL?31?GaiaP;T$LM}ekm+1Epj)UR?34zzE!t0tqPs;~#(KpyVK zAm!m7ce`o9wQPcI`$_TfjF3=Zp`?&TA>t0G zUnp}cTMtltKoH=#0qg7cUW35`d?b_8Ha~spJxScr=jeE^aM3Ewj94IYtjq0w0}YJu z%>iqz)j@AEvMggpRt)gAsBc)&h=dkrZo%uB<%1a*%1gVqwq)wieeVHTos@l~p6h#D zy|iH5B;Wxycp5`Sr%*ECkaZLD<%uff*Ab+_&9x~qAeJToWW9~kFuQS$o0 znP&zB_l5#}BgX)h0q(8`X*=2@pLGx~h8IQFYP^xzqe}OcO%=QnwgoE)EUoevRs#eM z(4npA;y`>QAcROhzim*h9FXV$@W3H-3FYUn1I={0*PD=)5kZPCcuer$f#SpWhrSo% z_Oc4naGcBp;oB<3(wy0DU*%cT7&_Kt_&#~d; z^wxKrbDVd*41wbSRTc+4ysHOnG*L4L+U_|Aa_^)0{V=gZe_g-?PCGf zd9zv41hSfG>0S2cc=)^-f?VM)VE3>Mcn7D{$?@@hqwlz7IfFUv(tUei)HBFP?SK>{ z5((@8WcZjpXcy{X>Hxqf(s1({nD0O=aiZJOdqYfkd)9rHOF|&g_qDss!Hib&usk?` z2abclo$=DOSb!}ND#w>5-t+3N+}%iOtFClkfbh>?D#Zkfym^M_MBfg+yq%BU@bG{> zQi5m1^6juZz6P&-rg1H3^{Evc{G1HsxJ z=o!qO=DvXux!(skTk(p0#azHLj|{@@$G7YQ!jE*yJ_r+#W*0ZUx-bmn0oYhY^gF|5 zj;+1Zo%5;9a_f*55Q+iR%;z3znENL8-rp}gm(I~bNTW@91*o8I%i7mu&K17f96FXw zP*-5^^`8Jp9?j77=&s7{+#v@N1nX*@RUrIyYv))+Rl1!+Ea0oWJ=OpmH;}+iN9_%R zP)RuC@%Wqfa-xvW%|7L3;k<$I;?wE2+0epE0p2E+=#LWq_MhE8g)0rju$B9ES6 zPVQ{?-pvRDWZh{sMEJ`+@d1y%*ysRngfkE*)I2r0&sqb+Gu9i?(23`; zBti8Kao?46LifGXFmTHEyai+df=*+=4!pQHF+J(R2B{2|tb5&Ez`5<&-X8FrvJ3~p z_Mf;M%8u?;U9Rq|%drF_rf+)jGG1%4e7_KX+yGz|0R9};z6dzbbqgkz z7{W>Z_{W0zN8_QNKfT{gZTdMrGEbt2-M*3P^5JHc#rM*#>Q2;05Ds=8K+Cox@S9;botM>o;#pENi*n-iA(psLIRx zp|rEF-*3{rh%Ea4!SK~W!29U!^_~R2`oc38cKwFTy)GM^Ovx+`UGK z3{d${4CsS4#oFAaaKVmQK0W(>GxvM)W{VJRJe-4}LiIn<{$D_TyM%qv6}k7=7%Ios z)4L|l>=~FXuX_Hhzjb^U-0QbNrP)*{fy?YfdlDox{6Mqa`iOn@rmB~N2%xW&M~Fp& zLDf3D^Y`R8Yx~}A?QnYSXYmUmevRazKeU(0&z0+4!%e@d2hs^q#`>EdTZXbk_Mq2LQy3QkMc+?z% zAs>&0g?86lqpZslH7f6vFxS8sq(n(F(Iu2+k`|WPvPF-(>bsio?F{%34j+9$l}WBu z$w*7ml*yG5JaL?0bv0I8jO1lrMeX0a{a=FF#J!rgD30nO+ZMn2mHGu6h1h8)Zu zc=idd7zi5(<5sSQf^Xgg5(y*%2=Nznx-tREyn{hqigOoAf~25@*2)#+2U*B-I0?r_ ziy9W>>h6h<8YvF~U*CC%PtZNMf>aUE6pF_Ec8aIHd(tHfN}#1n5esB(5>st{Yiny; zecjAhZFhM>505Cri7>}fpMA(22q!JEgD;5#D5O8Vs!pO##zI3GoIVYe&uB zUeEu;AbAv35M*b9TMQ~F7D5LYAos{Lgu_|{vKviTE3V*lDi$Q|$#JTcfT0to2#Q1^ zQwS2K1Zjd=kpjXpEDaU`WyBpsi4q982^7O&Qy_s@u!I7I5XwoQvXYQ)#!|}J4phQ9 z3t-sV#4JdHXzPeUPvt&?1oYFtdJuA*;Gv?iHSy5?p1!y4#m;V?9PaIA++*uhu6?~W zvvp3bzb;QEZzWfjD`w=rcMH?=-kFBc=eT%^bUQDo zcIeYLuu!z5*k2AA-2#3u+uc0QFjv*VH?&Ql z4%ivaFKvh$%iIuh!ZSUU3`f>z^8}^R<{P+}W5cvAO*>CyBq1dKNJv6ShsWhlq&@GB za)^3Oip5wUq>Mrl5Jd6=^zN|B2QGzu^h2M(N+ z&<%&o`80YY%%rWfG+k;-HC$nkFa!WI31CQMYM9EQqvNFp-iZEKF=kAt(=szA%%vey zA|M7Jq!Ea8+3l67dHXB-_w43u5f&mWSSvrI_r3F!=ELrEhG)0CKMqemdZezN^DMD$ zhtD-B`G9=+(oH)SQve8{a?QEsx4(W31UK<^s5L?Vy`wW>(vIzqP+$v8gFCT1d41;sM{#`|soXVXR^7k=grN z*7o1+y${43xdNAgXfrUfP0R!oZSjfgp3>GmliY7zj321rUDp_Qx z(V$I_@7mERU%JtSy7l--Z_}{Oo7@MPXG1Pb(Y!X9u_kWv?=>YEGiC7pkYI|zK|laf z3Pp#=Ne`ZX91n@F>+8F{uM7Ej@cH}h$|ETtk&PI|N@*iem~2Q{Fo&=w%+>ksV6x5z z@Xnvv@iEUyD0nYcO;t{bkg%9ojF84vrL$!!l(Ln!Ygg9UM9i{eF{CrbYBn{Pn?xgI zf?~;u^8Nnbd-LD#o!5^CBRkwRsj~+4_-bn*&pXl&4ilex8kfh)_2Pc&+S;$$uk6a0 z#fugaLubQ>a~qy-sjb8dnwZXIjk~6b6N6WU$6^9M{p(1nehT&2j*FZF@{qxVTVaq*YEY6 z_50tJzeyuB(vS*YAP)K8DPAX;WZEn*h5Y1eJb}M+`HkId-P+w{Z7Hc`Zr0SdO0=eGuD~c|;%i*1y4syXLIy~YK7VVl4~axym6sp!Q$L4E z1i}E_&w!vu24+v^+2;HF)qhk}TN_YfN{E7_Kw zYv!$gZTD}l=SDBW{P|5Gq$O*&r)IKEIqknA@+fkspPck?9A{?^*)k63#3F++WW>y6 zVkvb?snYF)riH5Mm`6(hz``pN6ss&HSy)Lj)1p|#9V)?5iwRDciggSs7+|W!I&>4H zz*a0VSf*AMB}}r?*45Igs~DOk4fQEqVyKykW<(i>SdtOOHYZ~kos>3Q252@Q9NSYG zHp!%osH;+Kv=L;2fI$BD`d!c8Zg1WNH~TrMI!~sKlavq4MCMPK{7=zhkp>J_F%?8$ z#bQK%q>!HgJNNI0_x4wpjJKYBYsKq-JLP+7CI&WXQ5J$UAxRcQ(QEsy_f*vqGC>$g z=hN0cOE{N7X3*QFbu{?8h54@V^_O1m>Dd`fm4-tpl45Xp(&)vFMmmgEV@*SVa7=LK zI7W>Cm`7kpwnD7CZI@fMEt<UV=pESSR!D;85F<#yY$mfddFR%td$l+>E@ zb-PHG$yAoLEnFFi=eCJAcT#5AF%hK3h?+l5Wt|YS-#yHxvRpq0v0}s#F*7L|DJ0o3 z5>qNNWVJIDjSSLQ$yFjE#Zh1?{DA=d?`OuI4j)Y$OgCy%Q8$aH9Z{iWQ5y^!j`gQB zDXr+(#aCv;TZoqhGcq{lXyhQlF|(A+qA*D=pw=*hjUu8M6G_aZxNaiHdO2{%K(8|0 zN*-4k0Ro5-TuI=NR>3D7qG2K%kPwN`k=6`tCcrK*4UWn&f>UXRuCTE~KqYe9M7UME z%$ccMn=?j)rD3fy>q43kT_-tmEl>nShp5L{ z4xNlALLkVQvd}J77l(7h5*=}agS3UqyIY#Y zhP1dg6+xphtTg2X7Q&;V(IW|B6KEn-p%Vo#uFAkFOFKw8inokuNnf2Bes}ov^(*fT z$g>Q|KDxm@-=u@*I!ieZ0CDV=w6LCTbKf&k?0uP!D1)mL)IX?I#HhMu#t_L$SbqQ8X+^yVK)v-d>4z6}=ERTvAiDh?e?5w`- zonGHxhk=~+eF0ythJK^0Zb-B9&p6fNtn2tzC&gujE)`ldbohOmB(@M*ekj;;rV=X3 zR_WgF-I%7D_AAQ1@uFS5Z%8H?HI)h@8{Dj%R8qE6NoK~F+l#i+9v}idKsw8_r*O3o zWv@)E2F{n)Aqc`vVNaj7A+&|P^+KB*_j>Ra^&Tk~9%v_OZIN3l*r^;Hg0e|2*$WV` zUk(*Ay|>6lu;*>xDzGA~JM77NkAaL=f}<4$7^5O;=J)BXywdZ{ZzJ;*e89ngWYxad z6BCo#n-vZk4GYxvwJj(*byGc5M2U^+5O19mK=)zQnYwD4(Rs>h2BNYcrpT)q6@s^H zuEi+U!f7!qr*7FO%}s7>rV=GOGh9tTix8Pbvkoe5qf=%vQR~coi-)@Rz0A*dEKJa~ z(8-J(Z&q27RKe#rlPwO08RPCtjmggz0~BOD4V?}hHU|j@d)aTZ&03aC!;&}Rr$j_D zXkxb(+wyf&GgMJTMDtjx+{igatc|N*F||Ghq2nJ9IzAY5TC6fx#odBr_7rBzEs10>fBuGOldJENNU(%jg@OdfVJhWIE-CZV## zXT2OeC~h7CP6o`#B8)gCfJP?^4I15BhQv}**a9LVl52bTM-r1ZYlE-QQ4irx(*36GLHrn(NJT6oFtG6BCGmu+Vk^!`|oXg=<6}; z?(UX!iBzjuX+G|KVL#8O3-aBU@tv7O{2eIXG!ztSqsacnNZ(rB-r6jUmK@8n>Ke1@ zZ!ZBGgB2M;-`tN_kdc{KGoAO}cqxa+z3K$^jUg~SF$!zJFnAxinpO>9yt=F4h(7p? z1P_-qh1ndEN`V_l8eR!4NMMsCW%;1^ReClWg<>S(i<=~N6v)yE^i8BOD1S@et0Y1k z%v=-)KWp<4KdP!cTrb1OQL)xC7s@5ORbqR@Fi5C`g@D||lJUU>enn9s2kcIk$m%53A!h}HYyok{SS;w}l7-%ka zS1504-)P?{67qI97N|mc-E2Voo)Tz1y2}LTJokS?5lynSwiL9JNe)D*AWADTOoW~7 zxMo0Lg9#Zt{)fk!v#H;-HlCnwES`|;ESQ{Q8T0QU!Y~nt3?cxAaCia`$ZHx4Ia64J zdpWj&1RM@WVGI!jf@pRiO_Nnhq^&Hie<|a-yO1i9p;}OUEk!LdDv<|-jDZXtyE^f+#?1+n3e_^ zQI<<4SeRKT_Oc8JpHDgA3#&$ab8A>r1cpDZA*@(W)a{FVD`BKsG?iMatzEF@7SnOn zYZ-nv8^x5^edsk}WVJdYqII`>Q)S;XEX4P+wvAiMGH5iNEhxgj!*9u>YeiV7q^gri zV`QnVOqyn-#TwB>C@O%mK}Z{b0se=4hiCisO@DV=#Y~E;H8ez&!?7^oid2SKlvZsl z(L}?SB~_r&b=`B9PL>ojyxQ?(K!AYBJrCh021SPL^(s&ICi+m_=3Dma^DovO4-+h` znHCl!Fzt_kK?b4O#1Lx+10rn7kup@8OKB@M+exb*)4eQBQDu~MXOO!B@}FGlW40IZRY@QyY%<>e*SCv{dK*5c@~mLh-Wa38%@BIpKf>I znjRa&{mWRS({(3(@!=}xKo zle|0GH%&(FeR}OX!ZN3D??7u4Bxycr4F-$MIkh&!D%D!UFv~@z78a8K3vK$7QEeF1 zX_d6fjkIlwHASKgShSH*fnhZWN&fNrc;)@C={No-g#Qd_+!8zh@Ss~BWkG@8XF4~!6;Of zA^80#0s*LufPUS~EfuCQT@&-x!)3W$6R35}uWM>n@e;sIZyeb-O-}SpOH{X|HBC8| zW*&LPPE^?qqVxFJLt!*cv*-LmD6vQgsYS6^)@-8{jZ;X*(Y7esEf(1|Gg~FERZ%C; z7*F@$&+pP7>%aDA?^vB#WeaIkwM11|w0Snz@%iG`Cr$FX9lQERkP2~U%4~6BB-$H* zLqNhK0PrY(z9C|^g_d+OBq4$occW!Ez{)>S(j8)>6uM1m2Bs;Jnl**v=Mv@_Es4xG zu{S5@(@AK(`Ripj7VY=>!Y)GHy%S7K4LR#+yAg`t=zY@CXtgC`%{0=jjjU}ZHccig z8)-C^MY2k56_T|j6h^dIsyGqbb%SH>`{(-Q%vSyW7!Mzx1|~&y2#E;`BM|2^GC;Y? z)1pC|5wMV=iz2YX&V*{Hh_;xK@?&%1=iayLhrZMM?$pwCo+?kTbjkkjmp98|v0(uE zf42FAQ5WDOE?o%AH7zm>2?$jkieT*Q18!q&Z+tf4kK()gyW+Ws$YL>!P4Rqlid?W! zl@{xncYU4U?Jm{IIxDLNBesI$=M`M4+N}aHHwoPV`SPiQL(jTwkc+k#?v)2iyDk=yxUuR1N?`j|9=_&|7rYp{s{#4wuqLn zSfr)Yt6A*W!SDEdApOTbJ2|}g(0>k$5O(qOo}Ku305?a$KZn9htx;YUWm?9z4KZaM ze#P_kt|`VTigI42h|)DKl9$<`+o4pceblGR_Ie;nWrD!o^JS+s7&Fq_>p zjWJUJzd~DW8?jN9PCs?`jKvv&7A;Yi7K7G*}In7q|f=cj3ZP_Sg5 zSy)U>eKoZ8KX3jBNFmYhD#{@kXq`1mBB1B6gp=<-#Xg?X<2mIHCbUQepINl)xpkK{ zjkOjHu}K?V)n2Bzvl|D%_&D8t5L8`QnrpqyIE9$T)if@*j~@McJSU0c&HLgxiHiMn z7eeQL+aa_y&NAV_ayZ>w7}&R0MBbIC)v3OlQrfPDzHPP@m2UcFey_aAnVDl0#L8sE zjGAPXB+`gYh}2QCk!3w?wY=(c_lNJUW(W9$Cvkrw+f+diV-l6T0EheEEB3HWRXeI5 z?MbYiOino3s;^ByS($e_$4up{2Gr{kU^V)=gSQT0VASW=LifZc3=Bfkh8{DVR})K; zKK6##sbGz~!^6HOF;)|Lrd-2mHp41&Q$?ZCtXfv9eBYd0ViE`h(XG;jeLv7xiZTlU z0g!CUDJ*0}5=blsNU-FD5BB}<(L`x=bmoY^&8%@iBREWiP}7JoK@it~EOQ=LNVhkL zGjuN1DwBAn#t!yVA*$Wo?qCK|BnpdLP#YdnGFrog1%Tpiy7JJlAnR_JpaNDU7Rr+V z5i)@U3J`%zurfHsAX6lG7$gG)ZIa1mL68w#5<`jCjj+YCzy=BeP^1K4;8lxS%exHK zvp0Zdvez}4p*OI*%nTS&24=9CjSX&&SQ^Q^O;8Lik)?rLBn%SG;f73f?|EG|hm3}s z4;UEBOtgbxwTzIPLj*#OSgBfOW@M@%m`dauB2c(<2$OQa>p@(KvCDy@oQ5sVa=2WG z5Q`iY&T+$nP~2u@!sI46hGd}Qm>Gpp3vC+1nsiafE>UYF9smOmj|Rp(U^%E-7e95p zGy8hx^`jv}`@Urr9$znzBxDdD_}2Y&&0G%7dpwZxWF6~TJ>lOuiL0g}KEs)h>lQ>k zpJk~0{KV%zLG+qsb!I8dYvFu7Yul6_PXTuHUMub2KU(+Sb>m99cODiD`|ppbJ=udW zW(Qxr1ZqY}e>!!U-yh#!#CN#()uUUbt00M89MqX?Usc}xqpOK3jZbEP(cw;_9)-hwJqaoNrtaQ zt8^;$O62+P-(69Ae3TEz#8Z4(3?a$19o6>CnJN`yoVF&xUuIR8m)VZTQu|o+?9gy5 zB8ov*Jno&lRtrQSMpVXe^~$kb%WZcmMQ-IHpI)sgy6&QS+1zT`7s}tEU#30g zJX`dq-J%>i^0%*ZzTTfz4c+;?%&t<@o(BJPfPQY35Fro>%BghFK}itR0~yVeZ6%Cl zdX$dsQkhF?$*#7SD{YmdO*3sItboGUpu{Xy1qK5Lo6)nr`Em5|<}8 zD|zC$Ajc7%gMeY(jeObhw_44u&O@|AwJY3Dj$QjL@DVIZ%~e+&Dz)e9c{J4-A+< zSi&q>nj1HeStg-^B5frBErB;MKtd#vNMEnXwuQ@t5(&&D<}{K+f)++VZ8sBTuz_Nr zW#BD-ThFtt*NXE5iEm9x#E`P8X7RTGqD^2LG0{(Q*9QdCMxmLRLoLFDb|9+?O!#Lr z3!Dw3P+`Oq!kBk!Ns??u6K9*}T)2m*A`2&1m1)p%U7O!gY^60Ya@}iJS+4}@56gpd=D_3jm{CImr>)fyP2llD-6L(V8I<|bzHKP^kxVIn?)ft zRI|4#mm?9us}d^FC@Vax=CsD40`e^l8oC;6WmU`@AzfQyZP}SAn5wF)-Bj!9Cc|MU1@L+3xN)wzYoS!+5HO1@93`xgvS9@Xq6{XMCj&+x<3b== zWym80K-(y?3neBLCBXs{8%_{lfk;9~G)V-90}dG4P9&6#EOG{G>+$>fI6e4}zX&L> zMcZia)$)H#%a858>+XMZ+krr1y6b!N`*#m;f>lZ4{?>+}j?$;@osdY`QTD463;V#OL>+yX9fX}E6?y4BJzWWw~ zodoQOO>OEY?lpp|7FskCNIiaEtyQu^s2rschRznfni*t~@6>jUbZ9am;a=N}RSQK8 zKOFoh?SO(vrVm^5a*6^I`C%b zD|A5Xrq7MEfXD{K<|Iy0-WxR+^t39>D-4AM*g=nqo_VAV1w%m|s>Gj=cVf80FL1#d zM@`U+r?fy7EI4|HAc8w_BQc*6HmoK>{f;sBm-#5G>+8aKP00(4 zf|-h?o%Ds#f()3FO_Ox%#HSW+IKkSiL9zJ zo|I_OH5dqnoeZjlW(3SZW)(H@xhB}5CA+GOp(W~5nb}Fjaf}^*7uz!`RECmmG=$q* zX(FObV=BRnW@Ow8?D9wP_51zj=Q)1A*{~Sj)$mrENVO!&C{U?GY`^~ikni8`1|Fi# zv+a^oUiq6(sAn;;w)kQUgZy7DEtHK!Cu5xHl<9{|Q{M@*2r#2_pT9oN)b5*kOr zNh)R-iZB&K(Eyz9^C9>9{y){v(|G1@z5Z-$Y~sB@@BD5<4&nGq;zYAF5~ zzULtz_ETzlxK}-K9I+UUqoV0= zL77~eO5PEbO%3H}Mu_Qt@5>q_NvR^iWkGq{X}_L)%srML@6!J!zrb~K{vZSk^LE0t zs}V|!R+Xx%x90FaiF_mDzmG$Da(MhdUv{2hrw48^PW|W1{m1r$5 zSkjtxiJ4|HSAF)R;V+KaqO`3(JI}5YlYxLf}xvD+aiG>(g+E}ubrg|Gg!T$a% z`rX3JzfZdB(boQ(@C=z0Q+@~3w3PTZ*5GF&b%B`~k+QVJ#B=XIJK{N6CQelqxMy(NfV#O-tnW^T)q_KK47L!H0Boo2Ak7;XV=~cp*wl z1W*uuiz}6|ls9WRJE}F%9o2LIQYdZN!{bvk z25rW7%Rapyg0t<#)sI29;38znx4*oNusM{4bPUA;q9ux!lu|`OqNs}S2%)$|HfEPO z5ClVn-uizCX>q2Ia?Y_YqYv zjZ2nkNhnvY{QJD~#ctETmOPt!42H*(;?qT`YA&6;TdQ?5HJDN~q9~s}R{l1ehr=+} zxK5cw-6YEVxj7+clnau>VjhwQ$Pyd*CeRxn9HwWVwHI46TXIZeEe)dOH-Ry86MNp( z+bKy@h(L(q6*kT?+>bnlhD8(nW5wOf)3kYg;x&+YRR7h9ZQj zDj23V7gP*X3#w@}tSdB_nMPA=Ht0=)pe(c~10u>L%Yx9Dag4D62mm><$Y$)7At9>o z2okB58@6s-&F@;xD`@W~0_#N$F0&-T(*V&@noF=VdLfAmxwCHa zY-ZT9Y-H9^M(XZrSsZ2;me39yxK)-dg$c+ijS&h=BC;uDB&2h)nujj4 z1d!>7mr*9Ms2Eflh$|})(O|TJQYl$PI79aLuJ-5W`=_@&dX$jt9^m&|R!HVL^To&e zzHv8cp@);ua3_ZEWUK15DLR0A!>g9XVzN&g1CifOy+=E1Y~-x!BE4WU7^=Oxp7oa4 znlu1<)`6K~D{S_(#n|mp3$b206Yv0d4(GXKSqkYIx1NCaS6uC?*Il?DaB9Ku*-{go zSNCTaI<#NGvskX`tRcTdY8rSKCLX007jejJZPS>ekMFa-Ykmx6-!rw!bHta|^ngiK zoay-JgQD81H=6rTfLVAURx>vH%oj6WrM!4hy<1 zCbdS78{y&MD8c|#4IavmGT*2U;2_@s2%RVmSQ6HbT)&oLMDQ0^0w1iOt~tk#Ab%-3AwR74X3F~ zM=(AW?0P;cv{8h|m91BR=!TVslhL%az$Gd$sJfY33?WQBFxG3d%(+j7`rI6caZjXr z#y2|mW`xk^wiTXnr;bOqo1;`@JJ`ny9gU%DYQ<9|*o2176q^v4>8Z`ztk#7!yBbvM zf|khkMYxJ-l1YVDjL^eMluUG6ni+IF1VJ|8YdsiUh>bPNZNR}1J8jj>#{kSSyvF^V zpPOgvzQIOdnVY|2XX~w@U3=GqYiwszjAicxFdJWeM)!S0{hwv$-+i`0)6%erC4ja{ z60;qfq7QKS+)rhU#qeh{krpSi`le>;xqvF8^$T4$YJo3%0Z>*{eh^--nB&Fk_s3FH zhhAd3LaP3rdcujI9*ht$2q64`=77?(dA@C!0zf0X!EE0Hh`%r-K#7=_qi~-VhlG(5 zNIZbA!dv2nK#8gTBT3j!q97VYBg0T94l=h2NqrZMu>P2Xjn7|oG!(+hT+Er~^EOLS zaa*}cB46SkYyfuD(C!p|6Bk$FID|u9DnKEHlc;;REbYx2$ef^P1r$2m2WXEg;waQd zVBpip^99s8EjW)FbigthSa1b}z(5Ux7@CDcb zLxRh&0t*$xF5O&&y}|Q#Xki(NQl2(5LsrZoz>rmA*UUlHXjmkX`V5~HG%ozlv=WR(fK#~4iJVJbjX78BmC ze;Y|p)ME!^W*Hn2Sm(i~*3&2i+>1JRskZl*xQfi|3=Z*)C?2gpboG5ql-(fygu zlz%lggi>XxQ5hAu9rM@H{{GiK``r}P-`loweeU(I0;^{!MD!1&O|y|eKYb+<(77pr zJhsvU0IY*-gAifqf!G;gZ`NiXcec65D=)*Zy-zmDb<*??pFdZ z&u0YXZCPm8#=_FrVuV35DvXH?Ld6U#LsV92Sa-dDIqodIX&h=s{6b5zot0DQT%vgcT)=OcmXCdfpLA!)c(%klNu_Ps>cM zF`*4u;ldf52VrFbAkm`WeF97=+GJ*WRhX;;?DwdpVy2vzr5F3B;rrf5dH6VLWoKG>-*W~zb*Up@}!EA zF%qh_OFD}~4n|EmNSiFqQp(W{YDB6VMCT%WKK%Ll()QmV{O6OK=Py~$FN7q}hs9`; zL13sPq)922euS+$W~@U|VF_9xYL@6S5@nP@%*YueD-oG8ixFg45d2}U;0%l``)4*- zY9Jore@Mc0i-TDWj0=RMll%IBYx+BaVGgEeS@uXshw^r&pWi<``MPM`KaQfSx@Txb zl5&NWS+W=3p2R->M-P{OE!*ind;_09XGBg?LPxO5h_E6B^XJ`tp5!p5*uTcL0Kn;& z@2%T@cItD*%T}H0Xy|-BbDt?rX#V}vGuja@j~j=*e~7VsR>sEERT`0I352z;zY9NK zeZINZsO|ad&f(}1dp+zMq0pKA+#wK>W+j_+4iXd=K?X+~jfj`|KcC)a%}Mv1`rB_l zYTtfawm5G3uS=_J#(loD_WK|Z@4c}TK&LhI)}g=4lG>IfQmtBrtsZ-Po%w%0PoFoh z4No)RP(mPiAHsB_NVix-;TeoB1VfDdhjp_F-`O(yWavQcF30i(NPe6=^Q+5)&neQD zV&3klh7(xtZR)qWavR=B4}^q0^Pu_hCxuB$F=n?nb{dPaA)`)cbfBfi=E`bnz;sel zVVPK%WhgV42qg%_IU~x1fXA(1=tnVHV6jnRXxe6Mu(x<-S}@idcQ>_{S%S-I#UY@Q zN?MXf3Lp?{E#M#)z;y>81Sk^@CIy<^SYkta(U4h*q`GKPHFE<+bC~56o7-s`tFfu@p3+ zj?E#4s_Rl|di3U}eZN}PN`HQX=eq=TLZl<&r+2&7{*ydOo5|L^v^fInyzEHco1=d! zyj9^-wzIBw=z3X=_4XSL4#YiRgW!NZgey5((UR78ZuY_T>#>4`oAL+k6sYM4<;MP= z;6@wV1`FKGU4yE7K3zzx6-<^14fOg{g8ic7g%y;PBMdNEA0Q+I37rKLZ(@Yp3x(W% zUY&~m8Swj~z<~P(RV1m~!XW#0#l5qKX)!*%zCRS&sC(*L$&pE86d6`qq-xb1K+~qQ zpJrA(NdmsZX~vIEg808ZzOlWgD;DcWwcS?lHQ}Va4|3UjvrCnr=KPwqXEfH+vtLr% zhe@xvGS{(-s}`j@yx!yW_sile?_C97RT6gr9(1_tYko^@1~b5gkff7uK1`5YrjaV9 zAi;(bjUh5sR79yD%os)-8H4~1U^qr#+*x{Z$p@b93gT6EN+HVz=pvOLkhwt;7#v0I zlbhAa?i*MO&^p`&XNJ6Z@hqHk$JQ4vu;&2logD7rEeCf)!t&T&Z=GhNyT5pK_lK_< zdexdW=y$&B-#2~TJtW+n1oSb2E76=RXOQ7p54nTYW7|{~ZX03hPNAfl zCl7tP4ZfZ4O&OCp>+ZQ9O9M%~DWvr@?A7KOkiDUbp8UQuR9Ut9IY>!{a7==7YPaO$$uFpC{ETLjVA0ledBN4JyQ4Plw2 zGg+W^ihMk(aNJu|#kC~9kj@es@?hLI@~ z0$|vw5aDt#H-W(hg)}&4$^)3ZSHer7_!oRQmow95ymdIyxpkpWgRw>O+vzR?@?UYc zC%jw&93=#l`H16-8j<2sNXbxe0m>;!KSaH8BIF{D3<9(yQYmE$s*udRk{Eg>=#M#a z=8Xw}+G@1JE|80SDX#+RvN$OgsvsOQ2#3JxZ5+j3D{@x2u1jpbnzXh(^O$AK@I-|5 z2>^b|b}4P3JC`zq4iHe`qcWcz9BXmR*q7=VgO>SEOxzNjqyFr zw%W)@mqJW%c48^ZklxComno#$qABj^-pN4L*kn!!OoW_C6h!LvB<5(OoEG3EYeguW z$s2(J{6m=<5eVgEnwcxv@5mj#caX=-rW`mQQ8WtBL`qpr<8v)8V0_RfiLDsOmIBEM zBypi4Kq(__pkp9}PACgZ%rTB>HIpVvIaJ3#jT_kM!KQ0Q0~w-5t87^^2*YzEf;=Tu znUV*KBoG={iV)hWS#Rt0avu6kgnj537b#r(<@eS)shMuEWcX8k9sSond%F^od+l41 zO1A!wTXL6h>={U4G%=o8oO;OXlPStkN1a<#7(*rM=(=~9Bn6pWW2tn@_F1jTqvdle z>)zgi7=8}=KEr*FgzLH8!%VUmhM9JJ*s5P9JMN@(EdxD6gepE$=~*Mb{ZN|NWU^3< zX}#yowS%+tk%TWVfgbSC+Y9kugshSJT1g<3+atwb{1I3;g9VUU7EJK>viqj2BjPHv zk@z+qSJ`$mRaqZmCsG9cv{uk52pm_@u;g(#BZFH!CvQ+!4>ro4&hK9sj`NHq3k-;# zm??RUpn+co-j*6nmE#!XCtZd9hk_S}!-yltE`bS@F?^u5Gf>Zvvcs=^Ufi7D*#4>* zND%Bo?P>W%Q{})hWoQ@()E;KqwhHli2g=Y;FhU#LC5PyM`_Y^=B#Iu+!J_&t@(A2Q3tP`m zMA-z2UGW7o-+l8?eemMXx7@x`pp$+=#i0!wg-+BCHJ#ui2rtV#T?;!s_2-T6@bL85 zl#3W-F#sm3OUGzG`Uv%Dee?^yf`Gowb49pL?x`d#yDbDDO8n zv>flWcQzTXkOKb!?f#eYbKimd*p(4kDp5(93Yr>szts8n*MqN#+dc1d;^^Ooz7l#f z`dMYAO0Bdr1%+uO^eSsm^b?dkE{wm7A+mpS%|lXjq~k55IrrS3BqaUm`Sa=I58uBY zUUhpOJobG&WR_SIh^k>#7?qkb+O_#SXTc381k!xfJr9;^v^`9BM~m2Pet4G3twpSg zH(C@$V1mg71qGA9xNGO_RMbC+e`LUyTju7u@Xr&;^}yDlg!n=Sn)CSkA9iatpP|t2 zMA0l-29X*Ps#r@=ZLfs>TYSsM*JIaNO&N4Y#nh?04@OLZ@H}!t6=@`?C$nfwQj}5! z20-WBC)|{ux{_;p43Pa;KR*NVwD8ZZ3_xUp?0U!IL-pW17|)=bhVR{b{ARcIc<(M- zc}aVG=JFggQ9p#PB#~U2VU$@*1dSq9DB-M1iwRPKqnNVc60K$sB$8!T)jC2zTzBiR z=cmy6@870OjTuSvs){iX_#{HenO#{1n(4Obs_CgG3$2kf<94Ca>u#1|l1j2jiLJuv z0#Oodj={fpF%ry!^8Hr%%|KwC+|Cg{EzT*8$NXULJz>!?*2@E^IHDj)A>DXOI0aB zO<5?kRVyV?C{w<9_2-4$rjz+TJe8gy;6jN6NdF?fF*s*KBe%PgSB~t#w>I2QmTG>I zl#}@;u(+qh)PQKRBRBm4Oqc}Yzvn<=0s|d)!Vu@*U+=nc=l7gc`pV{5oVkisRiyj( z^T*-NuM_2#yuVMmV>}Ip&E@nyi6ozI@RfPTcQy5Rye-X)W*CG~sEk;L@$ro&&y6E6 z{A>D#z&~>^mtL3`b{Yhe`_scd1P%N?eEID8{3rJV&d2KNpsh@zs_0z{AUX?1CrdQB zA*s_YmPoQpRLz8_5vodKP}1gM8B&o25|RXq+$bn#!h!qXh{!Syg5x#({i^O0x?q3sAeTI4Xz$r)=i^&%bY((+q+A`v82J$ZE&_lS+0Qj~)2AcM-`$gs)lY;E z+#eAXDOjUr@W_g&z*ZUkqp{RJpVyo+OrJEFfr0cXvL1hI=5aV{B{&{@k_MniNC!E6 zN=cYB%3+Vhu@VG7%m^R_U`o`~4+L2;;>Ad8#U&xofdm{_0z^cU0aI&&Wp5lIrW%A* zFgb+*iBw8)ARL00CIM>+xQ0T($P-`|kR&)P%r*cX3lu?OhyTcKNebPZ@ttaP!^F z80qfMz3%n_a18myUPtudKpqtdkZ*d}cAm=ncO>`QBt18qXEx6QS?1&t`+BhTUGu9L zMPi^2J;m9MhVQG!mZFzLqq0Xaw63UnxDjAc9k1Qx)uy*-2S{5O1LHT~BxXtv-mV7Z zv~u_p55;o9H^%cQU_scWaCWL$t?_wVR#JfeZVRf`Pr>ZUu+piQ@ERB2XE&XVS}7@4 z_Pi(RR(9-+A8hk~QC1ef0~NK?)7hL`qk2B}nZLhz+wa!SPQa<&LUfWo;|`IPowaU# zl<=9WP!_|t?d7DAcjLWXPhzFj_NR^0y!$X_?|c<$@3r6GP_wdh$^ouCmAVJohuyqW zInjOfH=i5&@|SPlZGBbSvSHCH5?A-r>$06>;d-Ogqx&Wqr9B!6Nj^a!FkmoY36;I( zub)du%_Hphcpg52r4WW7>w2>BjtfQbcNLQ~9$ItV>ck7fx^j8zr-7ZZicTgEXU+R}@n!o9eBE{R$c-Q~GiSLbH4Mzg_n^GqgLumSJ_N}__n0C*oUqbycU zp;=^box}j9t{G#290ipE*z*ENbFM{bBw7fK%(&Sc58VPoy?l5rOyF4b%ds^=NxsHSRS1Yl2fn`Jo4LR_BPQu0}K*?Y99Nv6wI_W z4f*YEi?f4IQ78=^fM{32q>CPCtqg8p2Z3SWJm)KLn$5Q1$WIRQYkDTaaPF$xHaeO( zbBc*f4MHY`8Uw&E4%U+2T_FNPDVIUP*_}reQkqI1lJ6rOELH{9)3+{`>3i{%^Vj2WFp z;=4yks}o}$1EDleK6}%;b%wSZ;?esAt*m{c>rzOyK9}8{xyv2EXil{9P90U$#%$4i zBqp-IKD)V9+w{r}3zbXmuDg@f=J;*o(R>}VcVBJMn4PB#+!gX6-7li3rDoj&pDH!V zi&{54QukNIL?EC=*7jO(=i!aup)l}Zf2+;?Zg5&jv{X1~GItaE7+{&6@DYjL-(Ks* zj-Cl$R|f-}B(QiJx}Q1S%Xq;`(`g_#jua??cKaq><4E42?6-Ue5H)Z!md1}aW@A}00J1%Y&bCap?;vRcDx1f&An?x>RWR_(S6?MR{BAaRmBp#!_EvD z#0kt%V+K@(ewTfo^eD|9c<{1)DxW5FEwpad2KZPSTTrn>Qq@~m_n)pOT{FUKrm@%Ehk@Y-LO_^E6ZC=OOj=4Qq9)v1 z95JH@3>Xr<`-c2|KXaT9#XD)Qk5`&^4^C;PuQjc%!*5=)>+F-JYvBlMvLAj!&+P0b zi}N5$c?o}WRQMfzg~W?WE~QwcrrBAdrM8B%e|$}$e$xE+f#$w?8an9P4L07-ilP}o zLy-uC2rA%<6k8E&lE0l@*KjyE$8H`#NI+7ZsW@^Pghb~KJj5s}R)B(yYEvQbd$ZkZ z9cHl9G*dCwX1O6D=^+dFph?WkVf#?$vwPR%oqMm>&%%3XHLY1?L`A5ju_92_sFH|q zu4bX36qySwER`(+$g0A{QaO!{o%4f10`iui%i2dOD@$5c-J^3q68FEDG8*QFcT6$Y4CMFem`nvzjp21?CEB6 zm|+b|-Lsfyk`jL4pMG~d_h+9OtzbVyMP(e)L{6G1l`_*e&E?$k<2`41W+}i~CIkbb zL=;t745cClq=so}C19c3RDuXJwhV}Vaj2;pVI1{u2Bd<<+ruEkxadwM;Bj>`y4>KJ zCDM@0!v&*QYIF;{4y~rYAB>c6oIB9oiQzEB*c+UMW?Xzd-?47FV~^x$3jl{8`ylnNGfe0rqB`! zeYXNuC8-gaEaXyr0*)RWG>eR6#s(NLGKK~c7uJ6wL(iw(O@6n|O=vW7N?H3@EHg>_ znwU~-K;!P@-1#I4@87Z$qXM4~aQ>!e7JqPQMl7)<64bOxtdf+lqVHZmTAn67arDt$ z1^0*a@5A5#fWznNwpMAgt4E`p4G1_TK@&_q-Z8Zrm)=|7&0DOd_WRal)?YpBo3~sw z=^-rS4cJQtNE)>A{{GC-Jx|qK5UC_n1g0@&L`4`hL`w+__wU!;=jY3m=b`w=UXc3& zc@+^5MPQ1>VyCi#3j_Mje|`OyAtr8sUKXVHqvvXy>pl%-^Lwfzs@7~~T`G0wr zd3OUZe!sb*O&T;wNPc+r)#-Sjlgi(ZOV8iS>PaO^nzsHTia_<84b!RCOj9=4)smvY zW|+w|F*k2N-oL&+x9^sQ?rHaml&;MhE6FRx1>B0=C&i7C}kn`SW9$ zgK6KJFpbR43#^%0VPZj`eGh?kyX=5>@I%c*A0fkkpq$(D^Z|kbf+8{=?eFh7^JMc^ z-JQ?Qr^8|(Aq0x3evqmvMbI@t0<0S=N~Aw|!_#d)AFiYI+%r@OzM9+3_rB%aDbAUI zh91HP;s6kz9ry-j83C~@nciilP3jtRZn9*d*_4185n=#Zv6`T^yoh3p1fs#El0!yd z&1y-M)~uMD*|O$9b!0S}WisiI#Hptot&@9gWY+c=X_;+U??sbrZt_TDhN&$mO{Ct2 zqmVcafj1n$6$Xl&0U?Qk7-(S1KycPF(jx#W>6w_|cdwksJN#_r;3!OXSBi}odO1|Gb zkjTP!P@e0)0n+6v3Sz?U8hSlVcs2y$Lub6YAvYlBHhbfmm!@N^_Jyx8-@9+S0Gqc% zbx@tAo!QLxJJ21>Cq3x~X{x#;f(beu_zphna+Kv?C6@EFU;=m!%%n2OEh1ecN#|i5 zN^@N6K|j4@{aIff`f=WNY~njlkA3p&rg~uB#L)jr#uZ1oI{vX_ z61)*4nYChp6i02*!ySeorg7PzMVud7WT(jP*;(xR{`zD!l)9?-zWQGF_0}z-i4}oW z;=ZlpU2n5@p44ivQnq^}bb|o`3b$@Ue`LiEawTs^Z?6RfuY5ip=a#YNVywl4({>B# zcG(4$=j^_sX%3FG-J~W;#)YhPWDGdoT2~ETz2R4$W%l|$M#iFS>Zt1K5qNJ*HkdpiJc2HjjYhhKenW0-lG^EEd(8cc;0fx zC)jf;@_ykT0YWJJ-@b>8TV8_;a8n#XX_8RGb+vtz%DQb^I`_5?UWUW50qN3U{nK;r zi`ac#CREc%B?Jog`;Q5R9=^@T%9$iGDz=!d!L%1u(Z|GDF}G#Zf#A8zI_R73>oZw} zoz3cV<+YRG)sqTC;K2{8?E3TVP6CH?%-N@_>D)eD-Ip=XtKxplrM&9#(m1(61EkW% z%y{mx;QfH$APhN&4gmZ`q}#nLUS8w}l&F$rV4_B2sev8_=*k>fpw{Nl?y;mO;`XPA zc8Z_AVV*^5xDU)$JopwtJceb3(n@lsz$k5u+8gQ?$X7>sNIS3!-*DMtJn-%WZQlTP z?v{k8uK<1Gc}*3F2uJU|=m(B{v%@^gGuG@#5XGI2!VtAoB_WFg(KZGxd#&Paq!+fP z98-Qh%@wtx7*HriMl2!>1dN`P?}NxVTij#3T^LSD9E;0J3QGlKkPZxkH8BO#TC#@- zAVX43vXCN`eTm5&C_)Xu7D9Z9$-I(6h=I+(*(U7Vsi`ue(m;esL{f_zmk&N-XNWw7 zIY6OxvEOMV!ckNW2ApK1kVx`L2um4)B9gkPoK{OO4FwYoNq%6-B_kmS$b=rjp)=1c zjnSY7wY25t$1#|?0Pc}({5ZDTMA4uCxR(YTe5Nv)$VmP53yyRq4()D(n#`@mS{Oqz zW0vEQ1u}8pb1}^l%v9J8Oje=pE#vYl!>@t2Lj|-z9AHa<7#sBoIzjZ{!-ra2q2fwfe@f#Ofeve5(5t) zNwAX!IAekU(Sb7HP7tu-WXTc%hB82!kpvNKvfC0z5RH=IDhCV6Bndn&B%%!zk^qL< zY_wdB5KD6*0?=c>Z%=T63!7b)gXSsyop>|``*A@p0bbs$e|@|4NmajQNG?#N-*Z`W zHuQ}9V9ne5`z~03_aVU5J)v7;tLxm};;Vk%BTr%KUGUo-B@WJa@Z}G~E|!hhA)Be1 z-@cGpue%e=-@2pD-b3qvP2Zm&&5^5c0#$E49{vrbMUo*xKtyob=^{`KO|QY`>=BTN z@##&7rA5Vh+AFC9QmifH83>GP)Lq5gG)}1$iS$oHucMr__T`PM@uXvvd7pbgo0p3} zU7q64<|o2%`_U`U(;%`BK}x_b(R@cs3RNV%Rq8={p6x@PD27!4PU7y@L{|Z;P7Bsm zd^KcwjVu|b01ra;zi+497lI&p1&*K7T+6DkDgwN6czq4daARRs3c3{V4hJPbCj*!| zBA$af`;Ur<&xU7* z(t1D@Rf@$y76_=K#Acvy^z+VtLc+6jg<=PZK{nYrI9xu$GV`aNH`9$iYd&c2)6M=7 z5fKqlQCrRN-0z&P*IIzLg7)(O`md+(NCn~%zVh=`(sOG%BRL~1q} zWYHxQn5ft)H55oiQAI@%Ram30bHBTvr)M@AKJVw(k6$mrtd^1lv^3PEktE7nC6-zZ zWtA;0B$X>Hq?HHrTEt}{7-T6*P-NJ$MUt6-O^nMHWi-%I$i$Doq@Q&{K+il+J>iZT zci>^+GywAXvps)Opfz3P}M@g&%q6IVe)J{B*L?InbMt*@9(~056fHh zJ|e{#8M6~IO%pOaPd%?U^Ss|Y`@9XJEwV{%e(qy3M4D8J0ILX}V3Sfq-Fu)TbcV<5 z+>=h7w`Q%0q~^<>et$E~b69*Z7^tL{K!gd`pFdtYSMtvl?|X@68zn1jsYKadog^V4 z88T5VvYAWTy7wN;F+O>L=x_GGydkSY4NJc)FAaj;tLpRLyxqNe-ygrX%0om25G+Wd zlG0FQnF$sZMk@grsKG(r{)Y3O3FE)DzWVF#yh}-_#L!DgC1kaOe)g%1Lng{FNQBhJ ziZUjG#<6{Ty6)F*`GuOXyZv-(=rTVWGg-h(;&WrI1327(<~t4l9^TkjDr$m?D@P%u{BJ$eL<+I5|z(bEAE}58E zh%p4G0D({*VhkV~iR3{A5Okm*mfM0Pjs=kAY~wNtQvwhSI8exQ35+iFqfut&^Bq`b z6gPs|Bc>YKKnRNfOv?kM2taiSi9>;v5N{Sr*hB#eObHyS2*_Z7U15+2!a+<8WrA*j znW=`@VYWhwMo|@st!dVhGqO;YO0A#_%w>UTGf_bn%p(kdx+O-_Hl(8t$Od^Z8`@(+2*_T{CK3RZ(hlkMEJMtB&>ZVcc`$drRYS zzH^^7qrLB4Uq-h09sn>wARq)n2rLDFD5duAGM?z)JiT`iCDD*U2R&}&3=^DD0in0= z2i@+d4c}CGvlOSdynO-D-Wup?K~7oMp7Wdw?}v7W03cZ!`A?dS4~x@` zqCVBY;6z2kdhQ!87AGiGHk*-*6l9484ykOC!%&k-@hy7k-U%ZDC`sUwK$`Oc+EW0* zAqeB0KyJ*bhI({4yv~T7usUf#p66}3I-?PW^HH}8M4B35Bt)~$Yd9f|%dFWp9*;QN zO#}IAG{)Lyvo2ynWm-TqB%2azacK%*l!Xw13M7!t4IxGm863b;wB}MxEwia?pltXa=@4A)zMqp|c62MG3J95g~RdlyD}-Ni?Yo zRoLMOZml(#w}_=QK;VEFB!P2tOu30PIiS)hnT4yM%cO0>1U0Sft~ojJcus9$$+6IM zLid_7<{BnzEx2%{05DC6LWv-VKtu@VGlg!om;{jE_g^(be>iJd^PAhTs{1eZpKb8% z&zgBzW}?@1+{b-l#gA7q4Gr=?mA|1(uAg{vN&bP3W6XDcJytu?;vH$5c)r1B?CRMG z;>B`O45urvw7NqqYOJi;dT>EOPBp(rsC)uh7ozJKIj|Cj4sqTt@cFnrqz!elK$^+z zz^oxM*#dD5YJfu%jOfBszJbV@dE%aC9ZraVnhE_QS}+Hy9;ybA*0+a=qeX!TlxwW_ zMMzdi9=W>+S!{q~B<{7l@(ykSl0f*$3}iN}@ePcF?Ie?COCce*%&;XXu4TQZ@rS7; zWGBO6+yPcd2QKmfIhGU5F84@hb(J;#xnz*W z6XFtYH@z6hUeZ7{qc?Lzme>ZFHqD#F$W#PL0IY=8sZo)pWx^ID_0k&xIh(c&@;tU4CYdHRhjV@x zz~CF<%(8gEI&c-drVJHp;qP1X6M(&dAaHTa6puxK2Yr&>d5FBh*ayyg-U2e5%(|Z$XBPb4nZg^QTS7P_)g5*Y76$KV&{QXz)Gngz{J;2XQ{jK_*7w6rzcw{`&##{>_xQfQ zd*`3KRljz>5k^dCn2RBE)pOmut$XdRIQ6S5rv7E?hV5RihWw|~bIRlU+5|zBip8z(^@{=EK6e9Yz!&h( z&}fS*{Mdp}AG010o}1ft)#;7tU&j2fpn{@GgRLKZLpk>DvT*1KAi;{OByB1|vuuD0 zT1!c6iIS5TmZg^8bi1cMno<4=L}Fv1$5T$mF5mtbyzrbC}S z!+R3*rzF6q-?vfao_m;b{oZg$Drm%{O9Z`d82RCx*zd{EfO;EHQ5A|Z0fxT#N4J=< z7pv__*q{!6*v>HxZ@uBw`W`qJ&#yP`L5h;0QnH2xA~2bfCWN+9F&KizDx#Y^=y%-% z-*C}+MV$%YkW$i8CfZV9vb0Gu%G>oVB?L2MBO+MRXvwsKmWem)_pF{aeR;h;bq$qhbn;B^dlVS^FrZoA;Un2zs>kKzq>chgtAG_r0Hw zHMj$9vVHwNs){0tF^GyPiQW6=s9T;o1Yy9M5J-U5SxA(bf{3h^Qc~96w@O5W*qKW* zNRb;E6I*^X*}s1J^7_)RJ}T6@@_F|~JT~F>Q=HVGdpdo<&SUPJE1yZEMG*yxF^Kv2 z^UuB~uR9L}iArk(l-fxoq|!??rIN#IDNt5u%~E8o`O--QWhTKi1Ywe5mdT@KH4(S# ze=?IQ94FhY{BwvOPqRZ9Q|+03z_fB<46A43RJscYUASrz8K`f0nC*48Rxr>cLfUY! zEi4u=1|V4C0$2bMIfX}rrliQmLerMxIh5mu!3?e(O1e?Z5aq@w3{oM$S`y=72}V4! z0v-w+cmp^|$gniz%m{$%C@|=SNF6F+;FfOf&D*;!95);&76w8zWW|9yk0Am?sa6Q` zgd4#{g~Z|>`YgN_@4K$zk|GNdQX-AZmp58Qj$IdYMCO4IRihA+;|+-zr9??Z#Y(^; zw;L*}!!2Uj#07{_g?#V^_Co#++4mWj&R9_Z$js@7=ijx2N2PRG&O^mA|NU^$#MCuTW_2 zc$aGcx(#`PPE!eRIh%OAM$(e+(s(7>njan#5Ka5*y+2jM^*)Nn+3$&UKxv*FIf;uq zFK=j!?{B3|{wjW8edX+^#v>oUZe~3Bwg?O%Y*A)B>3-; zgjKKbo3V;?wBLp_*woYd^EOd`Q#cc6GYd|Yq)9(c+|%o%SJgA9BS@%48cx3DRn%CU z)J8^!ud?q>2Wu`Zp$Vx&%{h9pwyLY>JYmcG>G)r5BWAzN6RY!;+x4ZylX~MjxH7{q z-HTK-t^1d51`)%Tv=J7O1goo8bZlX)nCp7FeUqehW?geNfD{PZ|rF&is`Y?1lq@?+xmF4^H*M}@v zs=9s@Wh;97JP^rKQNO6F9o1IeOs8XK(uT{64PE_j9c{`Txy#ox$P7auqUSlB+-~A^ z()5cTDk6(WR;(84>kSM9tCXeRFyRyBP-3VF6p}2A2_+`WS!p67$*iT7Rvf}WIr?gX z%lEo7=ElZ-;D3AU;ZJVL9wAMFiS-^0VnZt!lYYMMHaj)5fU0<&6Bo;0vtJqilv5Bz4PqO8JHAd zAd(5~&uLyB+IVA=UTDzK@0=kE%Qk@XsF%Qto{vgt9ig<_!J|;#=J1bfDmu4(!oefu zh?r&SPY~aQJ@U!KA22ZXA?gupF_VXs^4KUHs8 zvq3brGNjfk7ENgg)YMEw@bov%>gHx6xef{-ERi5Y(Wh0kMH~@!LCHxaC`Q4Agi z13=2ZMR*S)Tu@RboX}39_&V)v*sAVFOY6N?GVD_6UJh0FyRG0%7Z%fD&F!~_93XEL zs4`2v(l5>fGLuVVAfrPvs72vhmtquZ;P~4D7#7!?1)Q}HG5cnW& z&kJS*P23x@gaYBQE&-Kk0wQjWB$`+%a7j6KHwYp~#*IQE zu8db%z;%vS3r&&`3yUcr0pNfWd)1nrZG&TX!jp5QgKdn08(`(Wv#lyF-5BX8>)ShN zRdB^q#C~XY8xa%0(ek#wuRDD-Z@$ftChApaHIzytbl-mNZ$#cyG-0gOj}VRt5h!D_ z$1B1uV2ahQP;0`(1QIF^+Ec|DFCnx?P$i@bA|-5&ih^*++eMQ|v_~y~HChh}uAwlP z%mE_lcqA_+0gO~t8ErR2zb*Uh@)|fHqJt68p$fGyXvyumcXTr{XFKW}v=Mucs&`)J zMcK;=j@D1N>X@$wKeu)K>OOybvk6YqN#^n(=Ow{>m7&@`Io-qV!}1q{UF4d1&squ% zysqq`^oI5r8`|ktX#GOw*WVK<)DtEi?F1KsNCBF_--sx%FwZw?Bw#XF39Qlv0sxh-cYP{Y^;KeUdNE^!uJZlW^NMxR7{M0$#WS(fudt~kO!K0T7^>?eJ^9h+ohY91OU}J%wkkT0 zJl^QM^%8_5g$V zQAH64pI>hNd}Q-_%fE*{9|A~x1ds)ktd?4@-O@~nMYfY@WU-pBxwLI}&w9R|f0OF6 zYvnj2oPNRm`{&;JXwdTv{H#S06=Y2k2vHUolpr9e#z9pWto9vGugt@lLHE)=?-!X3 zem*?SecM+2*8SLQBS{ouqZN=Rhz7Ztt4~YvWYo4p=h_-Rd56@V2yf>w1IZ+wc`OK9 zH#p($89f8#&#@LND+Q5^RyudZKKX}34}IauJqQ!w>Y^$!AWwDk0Q;&N>W@}^?w58C zI^6fH=;*$A#@e4*%nJlep9!x1Jm1G&!gqU_`1M3%5=IFINkO2#eD!m) zd_ENPWa$WaBt%4!1eJbm(oCS3N=T$6k%Sg1$c&I&O}oG@xh3?8g!!rmei@i7ZUNOv z?*02Sh!{==zJtkkm0s&zFT4poJ^@fk8S~QQ`_f=wfr0ZfBR(ZH-*q%|RZI1_+}(53 zG7?Cd*+sJuD+w;jK%^0I5^F()V3G>chVv_myWP|87Mm4!Ch1Y|Dt8-z0iL0cuJvP?5(?k0+1ltpQv(FT;sOvxHxI}=u$ zO6do4Y*v$WfN`57I1Mo&O(7ygC80$H6jMbLvMp5FXps_Va8V*Q3S|>2)T2a*>CC_` zqd_wy>jkQom8fA>?WOyh$dWhk4|ayzg#y-Doj0ED29jIpib`MFmbiT|+(d&QsHQtwoo{cdH$R zm{}6*I19>pp`bEJz6uN@eT>jxfJeJBvr;^CItQez0L#;?d#|d9T*Kjm20C-02qlO= zYa}3P-rCCjLvDrTQ{|s^cgwG+H-8_XgQ9qMzEfW2@6YP*KbG1%pKd>d`zzv=DBj*j zn`3_6@2l^EIX7Zmrl=tV)hIh|0c1w^FOn3B7_XK4VU@#&rMJC{J5}H-7dv?IdFVaJHYp$wdUN)W*92+7Ui@=aI`a2 ztxmWl6hk*Axx%sBvc4aAuN>onap1LgO^B4?qdB@;c1dXHrU7W^)(#uXhGuLg7-BO< z8i6i^7|L~B+-8h%wBstqL(XZPZO0FN_$FZeO=0v!F=tyf-NQ=VvywQBum?=2lsV^W5}Jb9Xh|$=akz z)ZJ)YAfjbfg$YaA!#Y&aWCdGPd34QSwyA~0-KMyD8KXFDG$zfo63t3P!d9P{qQcG+ zGkbMFc5u!h7Q-If;diqKGK|lY6K5gLl-8Z)1DU9yeFb7^TV3;T5+-;U-oP}iGHbCi zNNqewq%$f7Xo#D@1Q7#}LKDkPsuCsav;)U%HAaC}Vld+ishh`^b4MpCY_!L=r1giN zRx1>Vn2O=JZGP)9!CVxM#CsithUA1#N`%%0?> z+%gzy&3#~<-`{f&uvjQQ{B&mzHQd0@K5`z6p9P8{hqBYOtZybv`Rjzwtp z``6s*tvmPT&U1dRz?%?4Ai#n3M2Vn@3MHB;Wc|Bc_7?r{`J-T3O@>gvGY(I-Z$4h{ zWX`5#*Gca1)~=JW`fuvMRzz4Lv*$i<1C0>H?L z8R1eg2v50YSXwW$0v7@Yd!seUE<`cAnbwla#))}iMJnl|u zKK;}+q{)Gs*V9z;`oYL%x$bADoNjBn`6?(ZL>~O(+G|gnH}v^7LPP9WqDc>zvB9uO zt2OVU>@~HVN(Go@G4M4evm6Z9ymNDh+N&1cWE-tp9W6J3z3x*Ag-kU~BBEO)1t``M z1O!k)qT{3j2`Pa{d2rTjiD()S$3pD6G%{32X|k_4#fY@?$?OxBAtTiK^n zSsQakW~N;^r!le1h>9w0$qYc+LS}B@YYfqw%p4U)t64@cOL7gM32~*!ldM#djfKNf zLW_t9VNu9Xz%G_5)VUoMOh}1_*2!WKiMl%LIwx5N@lc|V@}(tR_cBl^7{w_xl*T06 zY-rXkN>&o0)gg_sY;2WUWKuNA5va16g(+!?tRhKc7Slw?ri@99XiXA|Dr8xVnUs@i zZ7gYvN>Q{{qiqtTHdaWasBDWQG?|4o!pdq36{8lKElMb`R#`-hXtLRxMvYo3Etttd zF^o)z*=(7jwL~jPsYtDqC8eyPs!Kp9#e~&>%3-1kl1Rm7h{H=QB*RM4wvjez5t6Y? z)fkwjv}{sJmPt!xu!}OIV^W$Z+chbXSt?DjjiAaiDrRG3)J2O$vZiT~YHJdv!i_{) zD$)stXrgE%DWhbwB+!LQ6HypeA}G{}AW0}?re#Jp3sO={5)jcPVq|Fqm>HsxW@b?p z8Y?A+5?L{YmWni^G-;%h4S?8!Y%^j-OCm{0rj)ZWX)@C!WTYa>WZ9t#l+2(siz$Mn znkGv{jS+%SnI;s3W}1;kS!FU|W?06BHb7>`nPm||kW6MaNSFgjMJ7n1WD{c%N(6yv zl0;Hy2#E_OjI5%{WUyiqWZ5$j6q9U-h8Y`3%t|Q6HIyn@sHkF_6v{Mh5v0;&mZX^* zBE)Q!1e%F7RF+LjSwzOjr80#|79nXBHe|}ilueSPl(Ll=nW(WuRv@5)iX#>#w@zle z`_n$@c<1mQ6o=3#e*00;cs6>(*(rU7cnJ;AMKX+vF_TcR+E+m&|uz zfmV83?z2aR@2z`5=au@<3t7j0Mx=O%eszuV3(zsDfUYxGIM~!Igh4fs3oETy-Z!-S zr>cf~o^hEy6TQpFrnq74*HbtWNlZ(|hYSNBD@h*d>knp5=!zq&s!XOf_K~Y59m^T) zmMYNWSojVic4-x>9~E778o>6ZVAqUOi*mM^D-z1h#czbA$D{F3&sGbzXlxspo&XOE ztb;Dz*5r^!JS~l@N~}L^)D6H;)UMMV;8-$6`RFhSVip<=(ERs#S^F4!hH16 zaD$sT<`-RcG-{6gJ>j>k`?3mP`2bnzL~DG< zb4|cpO5cX?r;H0*-%vOQP{weyv%PnHrFA>qEx=h;cYV`~`b4F1Ff^z#xK}wgt ztXrn*hCYLqZoIBgX60wIbY}H~*(QwkBr1hPFhQL{-OC31WKTwDAX(paU2zLh?U;9W zb<$3S49|B{Ln#Dv2A%{2CG`Xwxyi%bmcbQ(_;?H;i1+DF!%0(i2k%C}o@%oP8Z;2O z_bqEOou(1sxR<4nw^w?-eMDH7%;$+aj zw_J&VSODS>02$2Iy#{uH6>xI&Rciye=E`AxmxPy=d>w3y;ldDy2l0pB1Pse*3*}Mz zA0i~bK*3~<24h3CT?kfO(VbJ3Mc{jSw9q_qD0+*Yqh)L6P@cvs`(JCA7u$`}#cbxC zz;e3x4(0b-gGaY@C|Dln*-axM0|qmgDINhI00eC+!3ki#4QGQHa78$ZFj8Y*ry7Lt zb;Xe{QeS$g0tSs*K@MZOg%NlSy<%EJQ(>OqC2lJiMhdzMPy(-%3tAGi`kdjRiAr(xoelWyKJdP1~~B!?_2kKH#j~QYzqpc z^6bI}2(xT<;2`xSdLZr=@~a)hE4QWhye97Ny`#H3O$r@|C!;Z4dhAf>h_z5BCj5v| zHu#^sF5ibO^NG#$dvVCM_&DmnU!;ezoYjCAHrA3nJrnf|5f5n#mlIm12xf+9_n!MD zInGTMdRFG?>AFp=81oEx%?Fm;>Q$S*58m6_6v0A*-O=pBSPm4#nTbcVDkXU@H!ofJ z@0uls$5F`gYrt>2Hfiu2)C3yTC?8pwc)G>=z$UtNjoS}&01c=sc$%voo9>yE#KZM@ zw$U%lN;rf&)9s%j8o`HmeC_uSbB4V&Av?X{Br5;~g!UvLdAdWRBo7h>Zoq~z0j*g& z`|oF2*UxxUH*ndM@d>6JIwcMbm%c>K*BBP-8}ST{1hUHmR3#Dt9aKDs7oi9U+#@km zAS1iyhduLr=J0H42iAobdOyCL`=tmbspIOn=-qG9I5Lljz0BcfJa@-I0T>? zsifw1U>&;hJ-9hR*`3uONO4~l;wa^DW;eE7*+zd4g7m?jytbNuC z_huU2;cFNbz3c?Hww-hKP+UY^Mx?zi@pvKv;P~b$=#C4>Igc9f5KtE`9nBW2Wi*Sk zAnc=}W5f$G54`k__q2?3_1;vL_; z17`Q94^}AqFnXXC{3)n5CVhb%1Kt#U!bs)qnq$Eq4|>U+UC^+N9{{)+T5LYbzcZ1G zlYB&c4|&b?tRkuC&<2nPgpEZjJ2yQr+8jCE(0=!*c)oquk9Ul)!9#2;)YieBfc8PE z;_j=w>=-R?fHY*s0>iTX*!$ehIu%uJ$aEwc>bI~Q!;43S4Kij!yUVW}q1X!WHI~no z^8s(ITkw5PM{Rb!oq75tM7Z+Jlx2j#{mKhOhR;5wr5v~R0d%fh}SoW8#Okl3p zm%3*>Uhtf=k1~#eh`4d3$y@GU{wLrUg4aqWFAqFGwD(=8M=k->oCd z=q4e7iErFMq8B70TKVUOU>VkY2^&N#O72C>^0VxG{5{hF!+>Cddc%3(@IY{9obEyB ztcu3y%vVPk8RfwT;iEx8TGNX2PcU8EMw}lu$G$_!V%6_Gmj}HBC&bNB&!#Vo3Rx@z z6TU`HFVwAD_tyGnv4S(U1aEhhtMku$jN^ybO2N6JH^pEYHm-+!WDt+DNUR#}plg45 z21&YgScM)@9qZ1kp%y&XG)SFel2^Qt+NuKe0YHXCp+Jt!%NP!3?(OZ_;Ct6QE2sc| z->IH{qk4Q`Dd)POJs;WV9K&o~nRjV_)^IX&5kQKP6>}^!Se0JXl^9=?lTTx3IyWMeJ3*hedj{_0b}h__0c;3Y)ic zS52@;i1Cl=*x~iv@3a*9o_Jc?EOyj4JS#vQrh%|ggW~kGcsB(tbFE|No2DzY&r{s@ z+2Na4d@kNa1qz%)gt8$KhYGw|oCW*-Xu#Do~W1BkIIuDip$g?E_2!1qfQEa}sP zEN-a+<&R89K=C8M>6V?`-kr8Hh0RVuprd+xZiQU#JTt0;)Fj?qgsf32s_Qg{uVJLy z95Zt4@V#PIk(XQLRn3FvbUkEM-0qe;lo%)q2S=zJJoEv8fbYC81^{U+9+aM-`AM8N zf#PnQ?{7LiZH+yAkvsylUS|&DfeM>ys6D*Pox}hr5HyYKfQ^V?EI7e}F1tVo5@aF4 z5=hQ@o1E`{_q*@iSHGF=>aL!u>gw9*VVLgn$T>Wyq;5#NyU%ygm7KUXVL>|_Y|8+g z52_i?FA2i1vOV8GtSq7bEQ3Jqpnv}!Tg(Cg76E^NOW|+!|CgZV{r^$^Z}lPo0Fp6a z5mkZpzsRVXe~`Z=98`rr_#a@!`A-hO0c8C-SXr}jG+9xVH2*gIqul=if2mmjR%AUZ z4yq<=j*$y&$Tt@;18 zFe_?a-5<{X2Y)1EG+_lK57sPJ04pm14XL0YVDZ1S1k@odi}S}kNF)5e05>0B6d=N- zu!!sws+K;ocQ{Df{59o&wOr&9 z|G{zoqdU^{$bR4&A}z0FsEOF6iAXnIL~8t} zyMNEW#zPiR6_Cjv6_6>?qR7$tD}Ryozg0pL6k){|{X+tv2_h3z1!VFc*8%KwqAG}> z2_l93l>orO!9i6(3P2M?`f3&qQa|MJmxN@C1f(Ie>X0Ht{wjeKiDZjBP?Z#r#J|9b zR3i&%gg@<(_#emr(=Rl^tUsKQ{E$BM$HV`?UysBa`-37)wg~uximr$t2lnrP{ZaS7 zy*!Ic%TUV@`7`~W!-!;##Zw_f48+%N@y&KO-|!F36?qeg&3KPp1E?7ePf$bXXlS z^zVMSqCv+_?8S$nVHx39F+T}LDuC>A4B3&B>xbzO;bouep4~*ze}!`?$#aZ3I|tLF zDUve2_aD#0PV}<*5jNR%$(b(oWiw9VlW=8eF_?(4k`kXjhA1S1)0v)g&ZcLi(MU7xq8D>*d%Zw0{Fl{(wx}t{@ts2fGIDgUD4FUGSv5mW^fxoZMw&CnWRkfV-^?XI^C z_xN00GT4BArq89~G3tubTlt6}1q(Y;3Tx-sgpgPL3g6B(Sb0tXJ*Fn7MQ{#27m25~ zKM(?McflCS+UL_~yyz4OSCk~akSpdV)MXtEswI^S8UEIroYuMd%Xp1Z<{M=kwiF{` zz9<@1>`9_F1IPQ}hDyAWYbopO?R60c+H%r9j;0BBo=t3o&FD)dY(j!kGhHWIDL(lj z^yM1LgEkVEn-V|jO6vzdIF-vx=-e(f!pFb8Kies)1WrYT9xDeZskn}G?;pQ5o`gis<)mWD+zWp7B-N8 z^LasTluDsrnczp9`jDb}K_+pnp`4IiB6``d>g%pa%b)E3^5PIm3daH`k07`1W+?m3 zB;5iyIuBX0OjSC6TE=hdn@&Lann+LJKvb)-w=MVaH1_=5(f7tC}Ev+hGlB>A9 zGLF|TWCl3YFr?ZCQQ#WLqe2~pM|;6iJAaT(XXK{{#MQ-d#zh>+^YF>a4R<6HvRwDR zp~rC}_CMkB?wRmkZyIY;q8oNlPo!A)a6<_9?Qocn%sF|E_*DNGG9*__5`*`4;? z+Ln5%>xc7&%bayg55@w9B9iv|Irk~N(dALd`pg78Z`#%x59KlH;E+ZW^GI=hfUuBg zHrg4F`}+C#ep1)7TqJV_WkG$#rQpF2=~$L8QEx!Sv2n^u-?cb{sPF?yK7^Ex?orp6 zg+6=ZeoCIGHdfO|({Dno+7Uayp&Yd3b1CpvP7@I4&{w0kw>_r}MEj- z=sUYr2f-@?n&t*f2*H5X^T%G$RK079779BujzYl?xryyh1z}VPB9qIqhx2rUFh?{3 zWt(BH%NRzU$x7>Datw1u=xD%(f;pq!TU-U2Y)L(VfEOI&dAchyG2H~9L&B>Nmjwh{r71)ompWV8||4ts+`A z%Ifmr=O{-%yiDU?wmIyslL!=aDT!eBgyCs@399{~5C|vrXF<{o2Vux{!!XTE2wW8L z7_$2QwvO%1m6q1~axU)ky!^5M{b=UmQ`6*x^rwRRAg5_kZ5Dv65=D!ZET6Nv zQYb`N`E+oFtC<`p4AKhOyVrV{zjugf){xqe>xo$82Z1PtF53Eo*uYm%gGp%##Z)JA zK$mO>s4*zKVoWko8zJ=VVeR1*)OB+JfK)_G;|G~L5_ARZ*`)@q_`-I)3lQGAA4(t% z{8w2%(+C9BjCWAPVdwbeXL)18#^R;9wV#yGmHH-V`N5L#3Z+2*HZIQK!0tuAU67U3 zmQ8!l(3SI+xM|uBdrJfI9m!MFi!Sp$2j_nD>L||!m_yFCS6BOD6*p(KM@XRkc>m@S zS(Pdu(7B^O6$*O@#zui_Jnefl%!=0dTCi@jGC|Nu&&v)6+vjFP;oWg z9(KBJI_U+ZJ)Fss!g;C61|>IE%E~5^xk`>6Kl?Ld%m3uk$iuB9BLtJ7##`9cSh|RA z=o>JyDZGgK&xHOzQbJF%X3o6(SbV1vck6{r%_UBSo`PN+zoD`bptIm6ly8}il&ANyDC>z7L734r|&VkN*Fk*`j`p;l%K!u z*^CK#vO;G)K@oy$J%d+t<=hYh1 zR5Eu8s6Ah*3dL$0xd{bSfWR8d4`k44CO+U!-s;HW0^a4Z zn&NI&_gbl1rhnA|Q^Wuvw;TQC6PoPn7ov*tnrLk^)A%16CNnc*8Lcl5yq$q?+r>rn(@(Vl zud>jp8GMDr+c;XwiMZ$M)lx_ub}RPh~ByAcnM}&DZV9~j zYT=nN>*2NL-XrvDx?VQ=;wUdg>}SR5KD%juh;9}?`mM-u=ndK~-Wf4U`-D1ShSKD4 zg+rk+Btbh$0F{&40c#+^fOaaj+13DcTxMoZ@Ui7xRJ+EN?s&r9V;eq}EEDhfi`c>?E?pweE`4jBD2+?o5f*%{7JqQYU z=-N;*0zyvr z`n$ct*2E0SgB+PI5)g#Nq2N3CcmS|)r}ApD+WYjK+eWyw9BgIiG(t3nvE~c8L$d+R zU6F*UViptFN}A>_b#mm|D`fFx5YZdY0&mG>6Nf4hHso#900b@_W&pu*#$epLFTOnl zeqT|e)eTL_0Bopy` z2roL_5`F0!k?-TRG<#j4FQ9Bfw<>e6cwax`yl3RFI?bN+olC42^!m*(7I#n2b!*BQ z1&vHVIV3LaSeh^_>G5Ug@CW_-)TpFPItj%j8U%?B7xmVbu)Df0ZNIf^_h!BKhuQ(;+<{d_d1N==uDE$zo9$r~d#D4AqDZIJbq*ScWoWx1%c zr*cE0rp$#&DuhN-)u9(Ibxs$+TO~THT8%?8F0)}`K)xZhw-Km>fm~|0{0cSV^Ku83 zN)90|te$7H!DLzAq0r|z{+T1Bsyb{jH#P&HG5V0)2?DC~T*}6qqpzT1q5iNdd{_Pn zWBmaSC*#Lhkdx_5-^EH#=-_1P{HiD&^BqF71QS2vK#8xqGyt%eg!THq?7=V+vh zkCkUn?Ae!UWejNMNIIsoAL6RyCTJXbB7-RVJ?;dBO@)lT_nL|@#0oQ8#|o&9G7f4k zfehN2)N_KfzUJ9z)?eW&^}P;1WXD#}XK&<6V`j!3r(zKZPi(SY26U{cN3gcRlCo2%7V1o&X-zm9~CtjvlLU8rPUR6QG!2j z&0PmY$hc11M1MramP`OYDU<;jNHq5z1}IIg$&*Sxb#98atF+{86@2Y?uZ_rgWHUv-=cjgM@frIN6OaM1nQ^0SltC+#+ELBX&p0YysU!6F z^f!(ujVt)%E5;I#dN z+?I~`iJbKCc-OvXC(@A94{vhWOK6((#zOg9_!>-Y6ESdfbJ@Rr>c>gOK*JOwsP`e7 z;MCyTD4H{It~)UQAmfjbCNew%+{nf~8rip{EB_MggR*D!qPs42gCS`YV?3Q<`VD^6k)6OM|R*d`-b?*Wmc!`Eox3W-Ds1jIO|01c{kHvPn;1}Z2-AQLUd zQ2|vl<`lJ4I}am?zt4aHU$Lle$JlU9vju!i zFjAn+W2TnX)J9bREb(^=sAWe)!JD;L!C$j8^->zNSQMXabogJFzb7g%tWrg`{~uJVVm#iO-7FzENK&g&%>` z<1Lnew5TsX61%~BR0%0jsmqa9AfU+}90Grw6P zQ`}0LUI{RzDs5fWcsB0qPGBJBVWAP~bujION*8B4idGAkXn*Q(=8qOA@YxgBDdWaZ zO+u|F%pd1litsm2RD~fuW_sJUmtAb>{R91MmP$|FizBx4&E&Xb6*6K-3 zUbuR?Eo(DT21s*jpg>la>hGPJ=5{x9tU*0=4 zNI4l!cXVgs_ujKZYVqV3*^}Xck6U8oCda1gm~!c5qCB%JYOsQ|z}o_eRC%d-dawT7 zO6M_6$GPvP9`L*kY$t&{M`G+B8BAs5QPB!Q8N_x4Dr+~qBd?^d9nZ}3;&Z{2b9eJ^ zeb-JBpe2##o*fbDy+61Jcl}%4a(7G^l$nHUas#`+x0F9TAdpYyc75xPdgtv$Awx26 zYu|;((7svP7V{+KcG~oB;@SuTqEShwOz6eB4OqjV&FxDUmZ~6=RC2tpFN25>AE~Ko zurQCGMxGGQWt`8aImEcfOf^IHuiUV5R;Rh|eRT5UAVIM7(y+J+3Ey>@i1Mrdx%yM+|ime|o~=_p?(o+whwYgj7YgrTXkICQRR^E5Q8 z7fvkY+E-Ou_(iO~Bh2vhBRa!Rj&6%G&w1V+2Qvu&-<_=!~X7w{OHb<~J{#?18YiI#A1 zQhQ!5s!9;CNbPasP||b0Zh1E>FajwTe1LBmN4Gv^Vz`VQu51?Q2#V^P#)Qk|c6?IH zQI9*G$?T+IOf&|bA7@_&w9|%#?79zq*4v$r>D-Q1jdjEA{!B9|dbVbAT0I}AyTvWi z8i>ac0@p11nAU7$vM@*-Tb5ldA`-a%agd{-=DOTA>(NUn^5@;bd^p$kIL_Pg{cKx_ zqq~T=O0unS>s#^I%xRIEW&d~(**%b8gyU1)0#ioNPN|GiMT8#XLWvJV+@v;N%- zx3t6`i-a3F2{>`P-8dV*4Wh>l%R9M4Ag<2ouJ<}qt>L&)_XJnN^BAUHo z0q48Bdix#`PD`!SKGI*eW(-5XvkQvE#{P$*uSvGYI;$nR54&<>I#sWjtn8*2Vrq*Y zUNX#(=@Him;L2m;+K>?<6uB#Tgfndv^@+~tz zDVEae<{{V{;_iX7`gdM2kdi>K^7rZdS1!?~kZ>SJR90wfx>rP5GpH(Q)(5Y9Brtk$ zgLX?>)3x<=U}2-N_bZ^`%cPCV4}5eN=0>bnna4ebKil3b(&*vwe|KMXccb3DJB-Sb*HgkP2NUpF_{FMRcc z@H73_J(#-uV}s2{sX>sm-{A1&YRqFx;Dfw7=8Qis9duYs&1jA_pP%BlM38Z0Z?9n$ z`Os&wUYj^D-R6fhb?#P65hoD5b!IKYbQTOB4%C;rM@U`4iLWiGQ`c~^U-gqErAX#& z=DV%%7xgOj4{o#cTPhxxx8ID~OuFaormvCln(BbR&JWY?a(NOP?({86O$YU>E(KI} ziLpItQn)%sK#Q>z0aZKIbEr?6ke8Lv#{n@|cXCMXS7r@1Pd>oi{o_zj1Ix*Nk$)50 zX(!^|v_w)D))E=<$u*i|-#r)B)n_hWaVdf+Be$4NxkD)>UCLiGA8knKv)8`6&5i=> zbvv=O_3nq1T}Ycei1bZ@@Cl`UcMRd@UZ zQ&(YwTPny=$t7J^?~*8x2A@~BElCvUKwZ4Kht_R2Ms!#`=jePJJS&>RqzCSr(A`h+ zUpK?N^!>ij2!(fSA@?U)hj>|?@;Ek8__rB>*fOPfyX)Rs`$>pMts(|H981Uz2KD-Q zTMDfmr1JY6giWDKu$s6Prov42N90`T(>g?3f13xlcVlHiTtM%^@FvAKF+2C4Uy7lr zL`cFE5qBW!;U6wHUf1zG#V^^7CgZ+iqcWSDE6P@|^uBM9GmfLMgOc+ki_8xHBV+UU zibhrxXKBD3m}Rx!(J!N-RW+^tO$5I0+V(uZPxCKA@7OsC%1ipCUDkf%w@;bcH(y4yZd+NDW_({=@C~@OaHdmK z%Y^nWaL9PUUfaS(_9O1W8!e;hn1y^FFX))lj^@P@I{CU?SeLuIx?CHATRxdNS#WfK zg(Mb9V~(9{*PwYv6hy`hyl*hNFo*mZdXi)_9GK8i*Sk|$aXDExEswYP&>wZ!W%MXHWGVH&2H0%f=ia}AnTXl@p zpj;V!tbNA-8vXh0k!f!x-2wTUajCuYLdH*BzQj8}ely(TStrixd2Kj)>Cx_6q;SM8dDd~a=f!~MLqs2x~%JJ<5wo83Jlp5Y8%w=Q6h zqsc`PvjdaI--aKrj%LE*vhUGnHOSwU+RMrA4NamOgv5XDRr;YA_>-e25NEc|1|}}P zR}M=_qb&o;)=AWDdYHh6v}?1RO0E!F>ySY(G-3%1Mg9`(kt@RWrYpD>8b_{RRy~j) zu+7!nMptuq2JlP2XMCX5cDobI1h=5W=~3>;y3biX@C)ePBbS_>s*ArNC?a58T-}fr zLM7(o?y;K4TjQ2o+sNtW%&o|^h38U?Q*@NdoO+$xZ>DI&X_3~6jYFDVP#}HH8o;c2 z$a1R5h5sa|itVCUuvz_$GZrJ*;aLZ}VJ6cw6lB!b4fRq2nWl& z9DbpXla5hI#I06K8w?AJtNNgVxAOhzmWOE-SRRAP&Sc>79*ZVkrB_#9w^>=9SJ@Ig zts-^ffjWif^1wxwqoI;LTWeV9&s6+!mvXeNnpz`h*%AZDm%y`)LT)FBkBle((pOS* zTE1Kxf0iVUY|UEqilai#EmY-OXzY7G>E}L3yi2pmsPAY7(gAn>2 zV#hz{Ir}EUYZ-MPVq)sn&xPMa?0%+sE7f|Lel$=#QE*pmv%I!NDx{>Exavk|dun~o+jK@??CW1O9YX%thw!z;X<}Pfd93q=f z+yF*htbD^cp*`j$M60#UJ)klYU5}MJQ;%wSU3mq&7mIwXY;v~8ImrBks~4^ow!0i1 z3w&dDk$2DNac00h8RB%I&J^&u2&9XZx~VpZ+?w2IN_^w#ca$R|%f)SAF*ypVQdDJ7 z{4Az)-8?`Yb9^imMfQ#ikwK&dISFa|)Rg`}B;0yMrnf?CPLHpxPQ39_&sGeu9adM~>R;LNdNlWn*?R^TKQc+`=Jp)eF~b5VMgQF`!L= zA5ZV(s%EycO%hLwL)mMpURfB6W+9JT!4hotheXishU%IfY{FVk;x%(Yxu=`)I-=XX zc7ft2!dYg>pTjMMhTnZGpk;zDTOK2Z=_<5+>Nd`d^svS%Q64fVB8&S@I1Bi%<^ zf)iZIcxmg4OsU*H)dfiph`oNhnaSiEZ>0~)0SyT{_&3Vx;xa?cws(5?^dWd=dc(`^ zSRETDxEsM@?TL_&atlrHZEL4#U*VIkaXx*PjuE|-k({_T&$&)0i3jO$(*KY{I+Hka*- zM?Egnw$COyIp!y{)9x)IoI_Ok58AmRL$>KI!1mD^=-|+$W?g-j8CN;^2reuDnyN6j zSaNC6FCJi9PQ2xk*Yufw<*IDzShf56Tx+ZpJHI?*Y)IdVa+S#`k}kT*7<$t zbNBvBopNE@g|6t!2GFN4+y#!%iv}WJa6|*nGXY>$*+?L zCopBz-^JZXgyQY3g@t&uGmTX-mFAn8OGb2{LrP7%c_>=K6+66BHRuC0bg50MXQL9~ zBoN=nz{9yy+&;8C&*m0`0}Hl}at(_xxeN0as%;rL%8@!r5Py~u_0%?r(s05vWJNkvv?rn zzPR0R99beWtnT!%<{ytz-ztbd-2QNR#XyR|_+<~|WAPU4G^|FjDrb|=%=6TL)*F<$ zXg(AXi%>eyzHSe6`A|U>QJ$(snc?^en3I8(PBO*0MGuEmem$uC_O_t=wcyfm#khSK zRfDv%Y<-+efV)uOP2y)KKg8|57MHf|hxcqElLQfd;m3B*m_YhM#xH~{0f7zZZ+jZC z*1E57X(hU~H^E++fdm^B%XLu&DA!qJL`*0J7X2wU4Db>jF6a7tUZa5ARw6}W{;o)~ z-q%4GdEYBip$9MH(E3om+<4RaAJkwxtkZSM+ma11!8TXm6DVxx?BN6$=~Gma=alF_ zIudiqZy?9(XC2f7oU0_=Vx}mnllbe$*CX$+F0K<48l6?)VGRsaM5~Jrb*12Q8Ejxz zO;n`{4b@7#N%KjVxBs14oSc_$LphTyk2n5pCk<8L&-)wN>V(z;LNjA0k4|`nkzH7O z(KjN%wb6JYhV1Q)(X{pCfn;4Cs!ixGB~`DFiVwL&jXrSm@TXVd9oRr|Nf8|aM=2`H*C4VdvLs^9y%(za){l4wbB+qUzrbAJdB*T95zBg(z--NmaUNF z#&E1TWg66p8}4p>^9tp25_OS`)#HbVbMzGPXr^j09UF>-1PWyC zi8gIy>6M(6eWN8z&VIfxOeM@dN*Nx`Zw=j4Mc9rpFZ)Ks1XK8JG&-Qhh^r8;62s}d zHf8P$9ooJlKI;W8v{IvxN6`SaSWwagOWJoDm~ocTMner} zDUcOIg*!QUYz5fr(pN3V>%+uL5%Z3iX8}xbl2&sSAlj_n9#O%=vNkQZRiYmw?l_Rp zvZc0p5*_8R)!M51lLaVI)gcxhTbA)#t^H!>@PL{%IBeF6#;-PTi(#n%6j)sT`SEBO z6Mt>1mP8rzEt|l+d%qJ6g_rH<$BXF}U-9u)T4yoLPY#B4oxnNcd`*vhO=q%{+S;4~ zw^rud%pMW`uR{>e4jM%wVsu4S;*X)oVlCQaEaFo05XaC|gE6htKj}6VnvuE?bE(Qm4nNEylYb;4N-~lJ=Za zm}3;(2&Du>JFELEW(i3Ke!{)#BrCIlBGVTFqRz`)D&4*&JZY~q#{$7tXz}@XTUvr( z)YJY1^0>Wo$}cMwZO6_|w!%>=)Br_A93lhN)R3Y2##S^`MpCE@psJVtE4K8Blodk~ zXIu`x}vitJQ#;|ztPrK;#ds{2Zg0@{I+V=!|vkz$-PTC!L9mMOG3NiYdr z6Rohe*0lxsk5rlSP1y11M>ZR_lfmjAw_GiN?KqT4<5ksY=3_5YaZ~4*BurG))*M_e z6q&NE1R~zF#qq<4oyEk(VAQ3Qxb^n-$ix)|=@vNkq`I(Ihv)Zl8`X@Gp-)e_-4Wk7 zLbau?Wk#)o&~4|*7(OxLsJVW_Hi$|$VvMpe*SCKyrnN{Vg2PCvJ+{qb4M+1&3Ws~3 zxc|_?!A>rW$uA04;SCnD777IEd~Y1rhfsTZ?DH^ugL|n3CJdphC}Kx3Vha+`i?J5T zB*M#8-x>76R@*&Y_Na^GIoK98TBiYkkbv9AlqU>~rk>#;e!4@WN(LNi5+Sxn8IW!2 z@WkL{%ho&FmnIP#Y?`cjbKNYK^-9rBos3ek6i{ohOHA01{W1z0^^6Ao(gq5dbTI?G z=F_GJjAE$m=5p1FsgU;GIFqqc$z*OyD#U=ipzJ~|v}-cESN7_3CgAz{T~p5Zo($s2 zB6yR>udSfev#9$u@}u$ck_IprEp=LOs3mJ0|0e45_*)|NqUNfJc2VLe!sy~Glqkgq z2rf6~u4dfJj~urZwlJTC_VoB)@>JyPwK=RcNm-Rqz+Rh-r^k4!Yul13HUh+_cTHr# zMXuC+dHbOw+F?OPZ}0tl+U2bwf(;l$8XCG@TRe_%6h%Z~V%YK&YdNBDS7w0!b1>u3 zbtR!8axD=>G{QZOuM=mQ7M&{(n7S}(Nm5^|NjGEeX`!8_mRFE9El`wd_%1ktf+&Rc z#1c($LJ>wzFARIzu7T3#(hZme_SWfDoxB$$tY=?!h}POgvL zwqnpz)%Sq%14bD=p6j)5%O}I1brgA7BpL6%TU3CeQnI7!qbr>$8wPt` zj?{p{*rPlAFvOx{gbFQkR`$yjX_i=x8cINjN1PBVb*xBtr|M}}0EUjUC_KpIjW3j} zyOD%54Db@ak!NmcrGN>)kx_^@#;1BK983|wjjXKaV*`&a_ctra#D-ouf*-*^ zDhUpoe?;^0jO3|kkM0p~+ph2{2k+M4mmH;@zet==&+YqvgC<-el>1N)FvBLka8>S6 zVW0z_&vY-U*!o;H$84AhH;Sp6SED1`2}v2htw{2=e(iHNZn zNASo9cK6sFR$li@nZ<)FS$pDqG#Y?lXEsSgwV^CN)F^@7GY`8G$cQ5^_`AoVB%nDE zMU*5X`pkPWDXF3yF$8Ij+DR|aBaFk|7=D}}xD`z-Mm zoNFYr?->-@g@PVnava(t0MQ8=a_dow zb9(KOAJC(dFWV%Mv8oeF4#cgy7Vfmac6Hvy&u=o0McmBkY}hpT2n%=lv$ivmj=z?2l;!IeWdH{7Gp~}y$>LvoHP>2;qzW?KSNs$eqBl^sljwW0RIQyFg}7-o~s-x&fo+gVRatw zegXu66WCOOXu`xr366$~7D8#Q)AoxNc!u>(EP`1vUdKT_p^>)zt?&mY?>GW%4Pqiw zJ7r{JV-a#5A~qS!wf`4YvP^ z`#O$DkT1-&&fN%*BMHE zML(Hh1)3ZQ#yb%H_AFetIZYyt|{u@UPJa00q4m!Nmy{SycnTVnL? zH55=ceKXKawfrhfelXT-x7i%qW8|Zq(*}yixmKDpB|nqd2;vwUOQ~6D)~Z{3&LS|( z+o@UlvHf205w#I~?VZKT8nb6#csK@p-QHdZ=e2U$efj|qu6U=a8n9(?7;*1uC^mbs zaoSf#Fso{eYy6rI=1vjO*KeZP9V++?b`gcDyI;F(%Z{I^*vdHHK#%&-H8|r~y=W%z zf1n@)+^$+Fph1TUj97KU+>PIiddeZLy_tsi;*uWHi~?VI-n*TOv93%vw`FiBzc$NAsE5&6c}e!M4$_%3fsL zzPSrhN$&t~F`0XKbtk&tof#w!-MA2hl3IU)G2;%8+=tY@ZV|FB)=?9)%}ug_t!zk5 zgWdu!pxcjBPCdZ+p%A7hxNVV}R)b&p3)Uw~bHg^khMu1nA@}`rA^*<82bZs2Qgk(2 zZq)ZLxL*jD>PKh#X+!2NZ{i6VeDa61ZMM3x1rt-!X?8HS0*9t3#BE?N&@e19Owu+* zsz78vAbV|FIpq@IKoiQmyOZ(0rue3f*y4(5H29n*hO8`BPHr;VVJ%t!j39dadHyZe zn2LAeKK(`-Q7X{6cGSq~ITAEEyo9h6|4v!J#*U%x)8KnPqCC{Tw|(d-6Ze*2UVfo> zk|}8trVM(d4GH2q!dU+EOY5NRD*CqGU75$_#qL~9WJE^&sFaqf zI5FA?7<~TlB1&z+8JA_8?I3QvO8h|W@S63R+~GWm~{0lX87`Tl_(TggZ7Ud zW2beO0aov(48LOd>!{I{NS?7SjUQ}P!RL+2Na&w+F*#{&Cq8ZV^GmufU=Kmrw`?*Ji4k9F%IX5C z5dMh-Xo7O1Zags(Zk4rBRMgv^@6{XhmdKb|uESUx!z9&6%7kr5!xG9cvNui!Zh9($ znxEV<&qtrk={lWV`qj7N5*cJ&@?I{sXET`y<|?dI7E#3Y`k7d`U0u!2_`upi`UejO z6KoA{N!{#iJag4MvMYk*-8%Z<3R#lQQ3~@^vAa7(bwy`U;x;Bu{jN@uO7@#QVWu;W zrJpYwY*hU2?{;R!*sB)QqZryg9B0hvhRYq4M1hauh*@-RWiW%=T%-yN*nI=SD11a` zg5=zGaXP0Lc2|oSmV6rC2EOQS&dN`l<;((GAC94jnrk`Z0rYg=!fPyi%US#msL&4W zTB=f4M9TG;H%JMd_jq|a-w(d_$;Zz@_8k2JV<@)p+8Wrt>)u^AN77e37Zwg z5XFF@1*qq8W%3a3qCUegoDdD71(p(GThvYY3{UT@V0;L512A)%enmdE)D=( zI=+q-*_e0fG$_Ihux8beEcl*5Isuqj4x74y(Ip?CZ4EqZ!$!RCte@&TJm0=Cu#eik zZEtKp$5oz9bi1QDnbGBSt3(l#mpMz@P(vgEP?l_$-Z?!p?UcG1+w^&l-x?AoT+i?q zK|sf$M#49HXs9@Bkjf#K_C#eW6tQ2U_*S4gXPn|BSygoOJrZ4c0FD26Lcl@P^xITEM zFI%k+_1UUl?W53Om5t$Rb+6L5yrlg@QC(RpJ$ity2-BQ z4*=?ss#`p0KGi|#&R>@EX{CL@+Tg(F@Lw=KwtQ~J#;>cpJ}Qj7E&eFiZ-l1Hmq@JG zH=MtAA7gYAx=!dzlkM}}(7Bsw#yXHEiPH_IZmacC_kAH*8cqFVM3kn)qihDhSJuMB zj`B!f@Zz_1MVky>qXVtT1s#Sb)>11^C@ZTzguz$YgWNmWi9+$aq`Ot^LLO;wC!yaK zzd~f(+@uu{U2&-J%?!Ft`2B|XNErR(`E6vd4$h{7OlPa7)1;7oM^>{yFQAaj^E zh@mrd-LT+3#q6`3O5%aAD=z^YoXSISwm62`a&?m?D4(utXH5xYjv{Cen5dhU5G!9s zNncqlM#e=T{)|`0$HlG9+O4hF>Da5Snb*BmtMc@8|M6+4heyz}kBPmyl2I_3OhH8v z1)T(&NQsL=uRQEx0dShhfbX;^vrW(;25sL$b8*@5m-W!dX4i41nk%+QE9&8)YBuaj zug@x3rRV}BV=yO8*)dMpyN0YUzm`2JY>0gUQFF$NfX>-G-2e25x`_~A_`U~-)CJ{Q zkvi+-rN?u5b$q;90K-w4le#y@Ti5_%=RwJBh*Mam0?>U&VJ}+D1X7qx954Q^?D&GB zK6MZ?cz%M@T;-l7<=&iuHOLBlHk4ACgN#wejLI|w0m&>bPPg~M%f?h2CTMW~B< zsHV+tD}wfAL4_tq*A(9wN8lM4>fG!qg2~y;jLg{V+7Th=k8fOfV-0pB-=Hdeq4;NgJW!?pCj6E7UsDR_#3e=uU((YmoJ64j;*ax(M;9D9Xa0()%Kb^NKt9MLh2 zT$JQ4W+93kJ@i~`og_|H&S|t{ydsArDodus3`Ob*@^v`bjQI_ta)$s9WSOC5;_#wg z(pQz%HGx6+lduwA+^mi!X)dP5EO9NARh%_h*f6@<7BkwhA3aBKB0U)=O%qixrUp+U zyH2pv$bwW;1JzKOQ3rEMgN`Z9fYVB)w$zn_L{qTVao`}vF?bSNl9?Z{lB1%jNKBQ@ zk|yqeUj0HaU#I{m%(yMgmLR%^U)f2QE?$zRQJTt{tU>GDPm0cN%t&>_L1foE=ZyWr zoCt*#g&kW*bD(pE7Bm6%MSgIl$pV^V%u$0Pzr4zxWX;j2HK-#^(PT;1I08+>HJOC! zNVA#eq8roLdPs8AR6LbPKsa=Ib~@9j6Z!<0#KF7x*j-a8{1mhQ4*+sNjlakg5vh>@ z0R^&?aH9z+h=K(saj^+3GXq4$491)W6C^nXMG?Tlg}g+j*$pWeFu>R*V`YGdF_6oI z#3RT|MG=95UIe2BmxRXPLNq33Iag^-2}HCoz@oshyr(kp;ehMuaY`WO-8xTZW*~E`mgu0HRnMyK`s%1;>hA9D?(XjEl1!?peZdULHD5UUCeH5e?(XjH z?(XjH=b4!%_L@sHw}p{OC2BY=?PV>l&DVE*Q>|Wfw_T8q*L7PfCtZ;%HeJ0r*=;&~ z+}?I*%`YoAxw*o%6;1a(ZM~h{ii{hAx#cOnE{<%w<(?Miah2z3``CMXZ8_K`+pOuf z?`R2+s>IjaIA!-;*1O()(5|bUeDg4zz=}QFy-9K1uGd2_W4_Mo)uE25cVX1jomizK znRj6DohI#Dsk5vqtCnHRZ;2!W=Rj3c-X7t@+&Fu> zkXl`A@hGpo_o*H2_1x+mZVJumFw?N)mA%xRVKQXA=F(EIuIX!RUfTBg`(4#eb2qi+ znyy2v=)f*enbZx|Rb2)$_WL`pwwrOXV{P>881#)&B7zqg3yOt?cWxJcXbOZ*In^bk@QNsIi zi|M`1_jh(?W@mP0W@mSIc5bcR-I&wGIdvDkyQWo*CtQbe%NjUv?gH<(Gp6kB?(Xcw zs$N!W8Lvkk-PZPvrF#30ZdK?Vn{MS`)fVq|N4WYE8%^b4?yRx9T9kXb;8bLJy}RnI zOl`LFb2_DLl_JiXX1u=S-$w5BdoBB>6gbT-?%ij9LZOi+?H8V zv#wTEK1lWYRk~pWuX^r>2pED6957(Pg9TXylzX`(`x~jAUaxPrOKjEeJnR#}ya>+D z*S#i6%swS6A1mPM2gsVo8oVsavyq zGll6b^;c!dEh|H1-plE|&aSyfcak>xwr$ENX700@;##W|@}=?Sw$epO!&_UN>ocO~ zwbQny8{X#Il@!r+gG*c_w?nG6%d`(X<-c-t?pEe!9jDSqu7tvmUSzCi7PAi$Pwz^Y5zO6&o6s zHZ}y&j8s%?Y)}e_BsSQo-Ct4n-Q;+Jf|Nr1JNd!6etnsQnYX;W6i`SAh=_zs4z3&p?;(ZO00!t=Y%I8?kt6T} zTGYXaZmZX`^a*4Qteyz zi~-fly3xjZ>40hH6Bk-t?gm&_wR{|qp4lw9dK*jILZlLQT(CR^*~$?3b!29d$S_cs z;6>Oq?|T^v5IN{$D`1mjgB53h@L+as=@hrTI?HsXEWV*Mk*Zmg5Ij}yyikVF*PH`4 zB-9(=?(S9SbUZ59z_zxExV&au%WuGmUb@+G9W-Mj2ZxfB1Pu#sFT-Bv8o-4@yPVV^+KuhrXo2Y?d!6R)G2lEq zU9R5^87r%R_Y0oZGr%+9NKofPT+GSkdwv%x!!?6K$^>SIqq_atS96w+2ZMHi()YTi z4|~Lqd(|o#j6iDa>fds=p{HOEdk7u^9j=N{TEX7FgfDnOFPCF_ovr&|O{xU5x;d)F zsXRJ_H<{t?5NBCa7@9YXxzz9x;2q{(V5a0hFf&c7FakdN=pgThny=ZJ3=+`8;L{c1 zIuX_!%JNE&ud==C6+9!{$$~#g&@wtqAVfFE6WZ{m1XACFj&?&fIV=bKW_D zXE}cBzfWM-pp3WYY5K^*8_N#&yfbs z3}6GWx9rp)8w5c5e7KEWaC27pt?(7sRK2~=PYnaX2af`LcdWQ9(#UHM1~V?~q|umx z8H3^Ml2P3p=~Eo%l32Fp01fuY5}ygSy}(>T49{9+b;;?0-jMZG)7|jgV#pMl&93(M zkdRG*PU|y(+y!YU79)-Ciyi{dAywApL^sf9IO|>6&)%tdO2>IaV|dWX=e-?!#`#Sf;qMF@%X&ri#bYOj zoz;sX_i%T+FQ(68$>CX6^896xE*+#Y4P57DFznU!!6kP<4LVc6K36X!&AOEU9`5RN zcYN_ebYAGnVg_sthuwajyScXM1}NpL@Yv{7)}?O@%!2^Kna+{u@DM$Docxz1lPj+V zfG>+Ppf9DKZ@_zBHpWI(KALg_>8xc(gLQEmIo-+C>*hio!EWA%i%z*OI(0{4rKyab z1ggkyOC3k_$@BQ?iAl(u0M1rE)hXPI~KgaC5XU?q?ADhi?w?+VYAVB(V=0@PrZ*q@n?wY#dp@Aw`-tLiD%VP}+G(4lNB-4>f z+LI0;t%M(D`dSsC8+qN?*|(H7Qb#-mrd9WZR>V$_5nrTf;T?*6T^IA z9?ovZQn(U)v&$UZ>?98+;i{-8q)zyaZcFkKRvaRQ@X@jy-s}|zpCRZ1t46%S2O{5A zv*_?(w0ypYiSJdK-9Gut7lQ0>;=be8?<>=Lqt5vnJ>h`VRJ*tYS7a|#- z7dQ>}&`@cmejeXeUX8A;Y+%dkZGf|?R!%h`=%tDPXzVcd?5+Z;mAw^cp&j%SGq4Fn?fOT3GA8GhOx1J}ZR^!Ljt&yZAlhyurAkY)kAXiz8GaZL&l z${CqZ_uZ!jUwMi)H!R`qn~V%HiQ1jqcwoh(kq8IW0h!Cq1&H+CUX_i1Awm8k)8X%%I2cmfn@&kM!?46Y|t>knEg@Kt@ z&?{Mdy8{zyVZgCa9lhJ($ng{tU{VQZkhsU zAeTF{SQSQq!ju)hhE7AoEa6ux*c4vE>pBDD?aaaU3`9V>ufuz;yG2>ueUBEMRYgb~sd@wvp`IDxf;#qE1b4Wa8$2eay7Q-Qd)wZ~7YW$sw%k}d=F|Jt z!g_t8jKS&gQH&P7+jJ?MuDRB#A-C+(QQ&X9tr&2LSJx1ts*D^Y8XD-@JUZq;tw@do zrc}uo#^`2%W&7P*!W)HZon1-}sf)um-U#?{6#OvFS?jZULL)%ZJHs8b z!>&?uK+f72xTiy!Lt=#PV^>~ps{Chk$cL)%$E^7n(7tEk2p58m(tvBN#DP-On&L%L*_x9|O&ctz(vsMzENv-httBN=Ch~(b zE4POP?q{aduAPKRW8NMoE5kf8XI5B?8VPfId8j#~Gmrrh?|6^^Ac~@(h@Q|@S9m-< z%uepNee~S{rC6ZCMTAfW^IX@5P&dO4x4FZhG!I57JoVPoAa7Yigs58F28|Kd1!r1q z>lA(7_dyC$#d^oG@>$$ksUI>Zii3Pj%>+G$!&Tg7=Wds&$o0B6s?BIvBvD}%6(Wd? z^_=Buq&e;QzF#JXlb-iwX;W8Kh%81a1&b6EM_J~)cXn%C_Vb7Qun0m)|I8$-{9z?u zaFVa>MO3Hx!b-UbD*b%EY4dl!-2F$MchTNBSP^T_>5u4-e_6^~hj-q564{*{8b#1{7aUCnMsjL&HkM6y^G-vmR0Memk+?imiCqQK4u zp&&w3ba{V@pLm*0FfzVIA0Y zY6lEI03J`M+xfb8ylf_N`GhQZrRG4=Jw+nQpny1cdRWVSLS~w(z3Y{^%bEJVsD%tU zM=f994Gc)>qUL4csZz5J>+$S3o&gT$+tafRUFhCk0MWmyR*rdn=oQ_B_;5H};>c^; zbz06xb!1hRA=t!$t6Pk>Lc>}u5)hW^UY(tB z3Z)M{`@Z$xieQ$KNPheCCFsAcM%;f*Z=~<1cX2)4-Q6eIj(b(#-*MJ3Yps7L7fPe{ z{EtQV51Its&<3kB@273gtINm3IO6!~7zy_dSVKy9iq+|cpT~)?+WB64&UIkA&RV+3 zG%pJJZ_Q+*By5qr^ewRdNho=4G6f_k(UwA5{ZPygo_fVv`)Co2pJ&yT&7kd_MLi*q znKH{t6oAP?gFv+orR#!}EAtY3-xkQ6RHN@N(thtTzTce|6UZz$a7Fo#+ro*omk(Ms z8D10B0&0BmURKA&Gk{+ z$0)`(c3;`QIk#(jujjc7-=I`Z{XlIZm#@UC{ADF}5%kVHX$-}@cv0N;kg1h24qh$M zsgrEOQjtnwl*ptQ3lUL8vbwyKrZvxYzH51)(e_&TWfK>ZAa!UF=-R%mde)PbQ+F_L z*oS?b`$N96T@GqQ5oGt-&q8Cy?&V}Vn~*amZX?l=N~_mi&0E&nnpxc3y*!&vY&DwI z!+PHKE#AmlD-nV)4Nev&cMm=Yy?BS7I>%S*%*iOv4k7iNwzy(G4#660-P(9i3o!xW zDD_ERBe0O^sV47tkszqpq1{vfEopoEtXPRZ9h4t8mxBq(lM?j0Pl0X0$Ym zNV3Zl7=XqRI2e*el4vCiBxP0v+8f^w%e@m4+D4~Gvcj|?HPzAMCE-I&PMhU5PQ`#m zPSu4U5_rRsPZp* zWi(+zGtM$*j1A^}UON&p-hEwe@dd#x1-fX!ZL-444tJ(>z4L$g09)`%U`&Z;ug<%} zgj2^eVFG|CkkAA)6K5L-Tv%Q!WNwKV4kcuQNhA{x1s2SJCM^~~+ib?AsU|8>Rvlsr zVoDMiwxD5U5P>+n6uzfS&#%zil(bqog!}n1!QK%#PI!QSFGo_=Iqwjs8?X=FJqr@uW z92H#t?aaYp*)zVo>(|n$G@j?cf{Ec&F4x=<=$z3;jpSz8bdh&g%H92TJ}2y@K~t)$ z%B9^Vxu88prPVtmAzZP9J?W)G2Vg3%U*3~dSk!R&i>xRjuCUwb!t_L8T8UEn#e>*) zS!ZBD2hx)eaG0a{J)y9)eI$T_JL_+Dp?NZ%e5XVSF2{FCx{uz$yWW~e_ANDljAJ$I1F6kW8tNg0PA7jacLkjc+)-_ZcS!_a zC)N602uU-%_!sxp?{07Dt@N#eT!N^mh_GTMG|0vV5tz=s{!{aQU1z;>R(qrcHqPAM z1|ASW0w~BLnt~buGG; zYjpw^n8_Yn=bqWlby9Z1JO5|Rve~R+lEE`ZlWI#r^8RE(eCa?}$|ZcQeUdbLpO2(e zR74bif**QrfW((OjcOV2d~T11Xp(r0%`*9NIMQaBrN+48f2uRgwd6gz2{qoYC1Hi~v) zPHJo^&c4OfLB@&ORIiMZU0iQ*&{MlpY6o7vUq3v&ReEZb_4!bmG%>R_h^VSIP=7)Y z{^{=j8Tg{TC)mJZ$f^p#5LhQg?Hj zTECLX=Xuw=`q60GG{aFT1y~Q#1SfVuICNiU+tKI+{r!3d2naDyL%AL zXI?YnO`-F*e?3y4fOmb##JRp((vj(kylUa3%>#<&H*BWWonnyMWg6+BET%?@4|xbJ;(l2u96- zPiG5a=kzt6$I0f1iITuaE>rz>rZyj|dgb_=SF{Xj?p+4q{mKF6t#q ze7+~@4_`*Wd>y}n0kS4GZOQ`zJUgl)HZ{MOrlk*vQQ7p`WW)RPE>EljBA*??j)b0X z?)hSpLt;xwi!x+TK^TfM3kDu@Oa9Bt$$&e?aZ;@m}TA zA@c6PzmW0ox(2B2G*x_lr!!YoJ$rRBV=bwezMQO_lZOWua>d3?Sg~Z*O)+C8GM1JG ztfquPX?}JVe(*Bq>_fLHik_as%UgdT&@=i2L~4@ zN27Gbrc7mOt~eZ6xG;;6f~+%EE;u;08kt#e;J7ljWtnD+GR!ieTwYQ`a$$p$o5WhI$0WT|Q_Xp2Yk*466z_a7l7K7Fl! zT*rIWskX>|LI#k8)@vczPOF`C;-;gmLrw zD7afz8`LOB+3WXl%Kl#V%97Q(BODJ@v4vS22rQktxiK8zvA zV2xOy#!9A4m0DRth6gb$nV7J~vSTtbOff2_4VyBf8f-MklQdHD(iO&{Ie^#^u~o)N z&9b&Dam$%T#I~)4R?1r|X*Pp0t&y2cqPC!B0J0PyL;4-~B>V5WFyyH!pNW}9blyHq zukBwENtrCEiCImg#VH|_+hP)n5tBxu4YsjGl-Vp(GYJs|k}MEs;F3drNOPULWXej* zN`Fm=YpPgCImFSYQefB%usBAS9U7j~z9nhDLER z4aWtcMJlpYf-rTIxvfJGG#Q|_s*;==U`LRJ6hyIGl&1^CLpWwq#ukB8kE6LxH-+zM zD|3yFz4iBTd3FpzDKX2V0A>}LMi8ScDVXV!RB4!#uuL%k=(c8HfQmo}f(bU8z`in` zM3;NP;uAa5(~b@7%vqSISlwVe1Y-nXVcT5^<9SYGY#uOr!0WrQ>*^PI=a}Ua4J3@M0f9WK zM!*RmN%whL`!DxRU>1b!a}0#XUSNUePLqGEn;+g9L~(kMvio%_?&IB~ADy;5D?A5@ zU=AZ}Qvs;ZceXu-Lwr#l2K!xQ(ZilO)jdJo86&jiUU)15wZbp^HY1J}Tw*9(I~;yLjBp7xvri>_IL2qt%;|>Gkeo(RiP=egbtPWeFfik({F2dM^OT$Dvk@4w_NXSo^NZQtyNWhg6>D-UnKq=@4E21Uv!io*L7(-Ur(Lf zd++k=_G3|FLuoTnR;1FsYZJ6hS!87irnzb|Sl3pF(o|&0z4hbI@2{_JTbkHkJn3@J z4fd{1T){X}HGZ&{sOCs~&uK?ks4hfpL7G=sM;kn=LLR~BffBZD89!Gle|5z>3T#HO?k%v=FTpuk8~ zBE)#PmQ8J3E>_K#GO4WwjKt{<=E_?pwl>R@hnvN#nQ#=LmTPSc z5D_Ga>#Cso6!B^(yvT-7K)@oGo{~@}hVOjk+=p6r6glR%xbq0hynHKts;bv>-O9C7 z^5eU{e9MfHe&UfG4|NV1CPb2Cl1U_#+fBUTYDFF!#h#n0l~hn|TI5R0moC+Ms#WuE zp&a}?^5?l%uQ~4Os`OElS66M`02)!cT(~c}zHVJ_VwpEa@RY2=f83~Q24GeH^Su{Qc$=@Xg|(hi_VA|g^G4Z+kB7?C9&t`3C~JF;iNz)oV& zdw)CHyvvsBLvSpOD?417&yX31dr2F$b*!3tWO@4L?Q^3 zsRz%VmEeif7ZsItR3nzRYi4(_M_uH@9abhLqO9puw_0kb!5Ueb9d%_Z5jLn;`Cb-^ zu8K98N>)6MtGm}u-!)9kd(Br_Jd`u_*_-#@N_q9m9}6#A+?T2Ym0hB>-SzqVLxWX5 zNmTlj)xFAS+Umcz-ng#$ebOAjvXujz7?7T}H`{P!F3xV}-+c#NQKjehTC>( zK=3R;v3Ps-2*{csBHI$K#!(P3J_GIW-yST$c?J>4&@`AEHG~5=#W1l78hlKRl9J}w zhwc<@*ojP&QfWgCBY>b?4-15pku)n~@=+C_ffl-qxIQ`8sp17Z0omkfHdx zYc#GgmIxq+h(3gpV41>tapv4Q6p@0;T|B7kyvH%I1Laxu3(-vxid>oN{t|9Ms=NNc}$x>UqA%MY&7zhGl!J|=`HD0#L$kB|nZLy4|S)%l0%Z^!w z>1|ypN@ysF1vF_7?{x|~lFc<4DNlyr;f1FISdmO!2t1|O?CwQ0IwIMUsg#RSet&)c z51`w7fD;N+Qug4vi&4tI)${A?=h-XRuSvl;#K7X6zdk%yhE`V-&8yF=#Cc4~-RH;4 z#dyMtQ7;FW_`S>5qCGO2SC!v;v39|U-2Kt_mekVAHCqhEWYadXn-el>$+Zb!HdUG# ztixKC)V2m_F_;71i)0ZjH*IHLhY?kJ)n2Evd^Eb-eSx#u9Dqi%CQ&OH^B#5`!dm|CRKG@ zE@dqTFD)Nksoqkuhh3Ue*U#smdY7qse!p?Dwp%rpO&e*Hn@NpqhAI*U!!t3hZCQ<} zvhfSQUmw5g*&LtW^4UOs3-nB7%bG-r6iTQvD}}_#Qxuv>6=x*{kknG3peij1lvNuq zL!%;0V5d_3>vX&e4Mz3v&SnesacYe)4-F2 zQq;SrS7iVs7$tvMB8o^9V$BkRMi7O4#5<7(4_(91J&6wP;c!ldbl{b`sp2ICX(pAe0*nxg>{CJ(Kv@JG@LFIjMC!muKoUw&q;c) z(Daw;ukjfySS>SAv}|fMVzgE@Vx-zlCZlUJW;UkFu&eg?{gL}p?1qD=`RH9_(CB;d+9!5cPUF6i>0oMDSzS}#L#q{$(0kqXM|g~*r24uphhAa+ zHE-2PY?h5iEKJ))Y8k9iv9x1UTNa~KOK94a zT6LF8cx{XOx5FRv{l29~fPRxQKIo;RRU70T2 z!IDhna4Ry*V_BVxtW2l!ol2iwtGSf29i!3ju)BWoJSn0wCmYfnElq zl}FpxO6t9?7c82e$;9SFhi+y8F$9v#e(FO&8UtF0kxw4ih2e}lqtCC;6Uz%j!}QOe zp9y%wO76ct9hG*gxPKSngKUF zB4Vd&*>tO`3sUOhxXQAe_+>VG#@&m$cJ!~F(cVn1_#=}nCl9{+7i^VikB<*IyC-b2 zy_H-JER{5i&pdx6`nJ_+mei3_%^OK-qhn(wSg0`?#ZjqSO<9tfT#eAM^<(2hP<+l*XtPi&RlX1t2nP0z>@s_xyf+|7_pyS=*z-*W>c{SD=U= z64Gd3q!bYld}M6qRkeAqdV9{IpDCiuNC$!#-{66d_nOKRO^H$z_YH)zy4LaHm{i7J^Xo|{Ur3s zH7AdYck$ul3oGI4+uS+z=%=bWUp*aUGM#$V`RpC#TC3sO@3nTtrPq!8U)or+XtZTB zG@2zS*<&DLsVGF+H5Q`TOw9;o2sf(RZ_WMwzI^^(zFQ4!_#rWwH9y%23C|AI6sjsD zNTMjzNl3(EDTI=D?_2(V&)9GMKV0%~lZ8i@AQR}352nb42~+)L4$h{LU#xJw93sPx zK-YneGSdCk*F&Y1snC4%Np)p{x|R0nPNNp5UKdJrjIMik_u(%YQI%aUGM+nC-dRq2 z?b=<~mXXQUe!Ek#h-prqYQ8%T%c<#YujPGOwq{ty%!+KyA+s!)w23BE8K^=B-tXX1 zU{v|^%S6o4qOi)hS4yIxN-WF?z~O{~XrZ!E5VHsjPJM#mn#cv0Mg?AACKiP`nO9|1mgQoC4kjsVfn=ftE08*12B-;y5miBAiv(Ze@KwI}ZgM*4IrhRA_O;~Q^JAS>dzjtV#pC4tb2`Lw<(P|=?;+2N25dp?Q2e}89JfrF04A6-Ee{~~I zWMOq8PqwYS!L$(=8QR5x4ui{Y;SdjjonbnS1R|d0q6)SL_$3z7H!D5%F|YfYbPznQD(%`O(uqEY0F%t zv6x^y4~cHsI49Ezn>Bib%goVvV~y8zRd?COs(w;2JBoMV^%l#S^9=ec_Z6CQxu=#~ z`<|}N$Wl-5ZsGa-BOPo$A3&^57H!aKx1=$$C8f$Mjk1i*x*Uf&>JzMy;Z_mhDGWI2 z*4iu(`@Ax%!u5Q#9)K!>ivdC-Tf5I2*mO3`t*k?VATW6_UwQhyeqQQj)Ixe#8?{S; z)p;$3Q6`1N5wq3LFa?^icd}0R-GSdN72WXd7#;{=yU-d~vDhprMPe1%aieH%CN9tx zEXx||-DQd=Sg{0@!GOVC6(O1y6sX^@Zs^s*1xi#Rg-NweJgTd$#;b*@qAR{E3oLS$w2d9pt?rAgtHg$llxW2j4GtRX z7;9q<5ECWw+UOA?laNRbFj)lhB!r*T%)Fyv0%Hi$hO+86MbKH07C|0pY8N;qOW7NN z?$cH(oCYCC@vc4_f=BYgWiu|!-C*5Qkb9~3FmiJ(D0lc z&`kD2K6eE{-zdOoBrSv%8M&tIp_hP(qQbRHDG9UybXMzMD&^G;;iOR=|AF=&PtRKP zwZ9uQq>~bsmSVE!C)ByAsYC?`r&S3{Sn;#^64nV2giLHHk+vBuCW#@(8jY}|M1KUiFddd58 z`pNqKS-&7`?PyP7RePpw7EKR;`m(pC=i881UVT|rn^b+9e;SvjCcfQw!_@=jd|jg8 zZCLh9`|DMD_1fU~m(Lp4D;{MZm(o+~8QrZs2zjG>wgqX`MLOh z@3_nz&7tnA-i=t}zyWsDnJE2`kE4a@TcPt>zYshOT|d*|zS?$P~j{C^R`ASt&*tjY1Ga zK393}TjcjQ(0E?>Uo>6UEa4tNltTJYDl*1Oz(XHWJL1o=DoT3RZaQl&Lkn;IuAw24rwp%&SeB@)QU!G20LZ>E@o+0GM4oDNI{DWv^vew5^k5HWb<|M%uou^Z%wK zjT21>X4_ja35?4$rH@wIYxnc~e;?!gp7H+s2mD4cxA6WBf8Z^x2|A=HVF4%_jZpM~ zA?_ciwO{fx;%dA14!(h)qfE*#m}q!*hrY`HZ&(zo(K=4&*WYRm#CE-2 zyH40>?xz&v6@~H8^z3$Z9`AjJYVWUHTRSepl>UCEHL_w1qQNNEWkwN5tXK?JAV_fi z)93W6{Xl;fRR10SvH$`8pNhRqO)j)%78a&K7?egIetqSSzEk%in?s~I%Q-}%TMF-_;d65AP%07dx+9SrCKB(~;8Q#~ zENhFdoyo^sXq~`oCS4S>m39#XMI zY=5Ars3x;gl|nXQ(!03k>89o5YGxZlX)6JsQptv2eZE%O^|sfm&hV?IVCnhq_2PM% zU~JIw>s=xiNPNJsmIvab4F!>@4`b4IS`ok}Z_%7oE7CLI zH>|+G)EF$;b6do+po0wzmYqqF(s&?$5*YXTA3^!Y9DNnfdi0@9Wf_r57O79}eNXS| zr*%axRY&{Sam{=~!bmDt@ANryl6tPYtF#(wP4`a-4{WT;tB0SQ1C zQWSt6hDlqQH!~;fJEIHqgb$JuWcxm~_wEQ=8#J^k+{J~=gG-fuTwdGop%xB9hu z(ZB%wfDurdRcK;0!Ph$F)Iz)JxFpaCl@dhKVSuRo^XJ|5yT-r0#7TA^jFpv>TeJ7$ z4Ro_a<^tK`0R#F#2V{`?!2RQ&b3-6$14)qVuKD^QnJiHi1mT&si7WT>3;DkKy(()- zt~};rW@^ov1Ee3c%4kuOQ9^hqy8`SZ?0*FJzo&)Yzk9;#r=jyj%rpl&{e{SDkP0gb z4^AOdOXyn{dODtT*Kg4uVLpDo6X!&#vEl}Pbu%jqYRK5$jAfKlD7(>&A{AK+y0Nz< zNK=K_nsAOKNigI9qmZm@*aeKqhZ3~X844hS$So~7s@7-=n!8*;$4DVo19mkV7-G1b zfLKtNMInYGj}QWy+*r*=En*@Y2Lh!`Dv%HcSAY<4&?Q=hYgS+@YSR@JDbaHCEKwVH z1B{iK2qrQ_k=p>O9JnAjtwDe@B`Bp6#K0J^xETn}N+b(FFxhRa@!a~0f7$4isoq?k;qx$tK+2e7{u7{3l z(PBGKYz7&zwC_JQJ-7x9@ZISg0^x=#s;aKJOgW;W8}D=3zIf)J8v|}|8NzCyIcvo( z!ggj>Crj!V)$gnAnM>;77iQScgnS;>Rr}vu&$*)>(`U$ab3KRa-&*?#?E!j^-&wr{ zeM)(9pD-M+}dF)5ltq(adu^KYV0)DFLI>)*d;(V*k{ z(WY!M@Q;^+;-F8}U4CDT_fz6hPo39w!XwN#tv4vBCvi-3^f!;4&D?j-JFA{v@nVz& z6nDXibE115bdc^>O==7W(h5uJ4L+!Z(s5CjoTQ zIgA`qH2wQcQ*|B42pK~R0DDPPPZDgFQA)sLXdVbbsM$$*0C`t?;Ir?7>$?gs((L;? zj(we;blzm8N+ABlmqKmcIn{}K-y}P8+zg9yBI9j&2z_2}-k9dy0Bp#(i}YX_@aTxLwO3tyu+cnf?2>6EuEgi1y_(>NttvHi z=~X^doIJZ+T7YqAD7`?M35W$R#myVj8Q=@0u!KQEKm`>buX3U;*q}=Wq+B&%69I9! z0tv?o1Z-@RO9eDEF+W|0xs4*Wum(7ilAy6pfTNl{&sA;fSl=glB(2>_;+Po(X`>Ha zqd*~n$R|GahkT*jH36 zo>}oKuBiDIz6zg0c!!tt8Yx(H42sF&l>|2Y`uq8h+;0C8yI-J_&5W#=VS$4upvep; z)?B7TL4gf@vf&P$mU!DxPo#i68lDu`9z>ng;c=+F#+{w*J# z!}~{u8TuWYatF{LABiO7l1bp_e?M%y)Fa@VKL0@Ry{#iuEfmRBQY8`+I$3fol}1pN zQH6+zRjO82p-52`LP;fLYK5j!RW(RI4>*&#MOVA?Up`bPa-UWr8M`9y;o=ZPC*Y9W zi&aBR%PeT6Vo_NqLnon$39T#!GO3ns?YCyLFYoW2zp@|D_!lL{C)Q*5+adk1$Y!gU zRi_P@Yc#?_&$kX>8p{NCy3~?lD`gakyCs`LC^A`%FO<_s>TPNf*4XPSK9GWzf+10(vC3R;y#P}z$KoYrQC9%Oc1g~s21M~C##z!{&|W;5=LYy$;K z1G6j+5aT2)IgsK|(Qqmi2FsLuL+dxk*|M}L-|Q&w(h_`~efzWZRVUH>|9wqVD2$V* zE(sBubV(Bz;e7n~e?Oluv+pwXz|I{#&7TQ?CQ>B?5pB?6W ztT{&mVEz8?ls<2jdUpC(DQ1^v}969e-ZR4UnIZ;u?XPuGYPmel0pzui+p> z)};OW@_76A=sz~zeS5g{`QHM``c&46X+_ati56iJMWlppp7-D3`R@Gv`RG#hub(fg z&Gc3Lz8seXQsiAMh#*S-4H%K@&(>@W{4g#Y$Vo>bQVc>({>w5(N!{UcS{;SZX;3tW zA(DW|B$K$cC80b?3L(em((Dg`9SVe~ZcKrskO8rTB;v>jIS>Gh1mb8(L~v7%;t>lL z22?mBPO#GrR$SHAkfepe1Z>8Dv4v&W9zMgzo_dbExN_l263~IKCFc35GCI@*2#`$Ye0afr}O(jp?zgmKmc|T%d}I5YXmC%chJZmXKs1$WaJ$ zdj}q@5vKFUju+F;+%K!CQnVARRIm(IohHf*i0wtNAlh;^h-WmUAtrL@z~V9>csNI=OzIl0H$ zK5px0RaH?DQ=If500tfm=FMd`GL`!6)#82S`uegt_sZsM)`BEUs`_XZd+4mi<<{@4kFRY4H0uMDF$VA4Gge&mYMEk||j%0kk8QvXaasqs1KUuv(ayBP9rs zvpG}C%ogQligt?|6E|6V)s~{F5dif(otUy!R&QbX>(ij`V0;4+^CRg^`B?z;GPa$K}x@8AHG{@Uhh^HLer)f(-D?J@&=7to1O4j*k^rgIcjw;< zz23^rUplVKfOp&3pBHFAqrKudN_Y|SyD_EuK~L)NvN8^LZm+(lHaxxF?q?gWdFUheeW+No(pV%ea&`1T22+S(Ul zh{pnSpuY=nkOuq1yDIotC%`CrvXFeQS@Yw90s#aP0oO0UWnSZCA0Yhd8OQ)ri(Nctm6%YNf-z~Ktd!CVGm?kx*ZywHcfR< z%*>FG1nP?T0x_a_s~m1H#{jVsM(UQCwaE?_rDV-pb#_sx5VJB0g#lp_eiPF0azr}^ zfIxxnuIMhxhaPikJ3Nj%W@apQ>YOm0-R54z*0rlJfl^RV!NsK+M4)AzG%1{8;E}jZ zY;QaP_(!LEOpyuh+m8q6eK_-McMa^empdKINMv|GAqYUZZt!Cw0prJrZe0}HG8wum zku`hT)zAe5(P)u}#(=z4HcayqBfZz4Od2l%AdpT(M~z4*sv+-jUFV5v)Tj~(1hA42 z5rBZ(DPRb5`Ng#hEzXK8uP)(P-gD5B*s8@85s+j_K$)XGoh!7t&W+b@--#51O}5@L z*+4PzaELKLk!2|$pUZ6}5_BO$b1FjG)v#EAs!ItD$|{votjjoPBb80^&VP5?(8coZ z?&_+l<{bFNU|wh2vp&OIMe-xI1y$9(<>`WsY$8~(z(6Q(XJ+Ec`Gg5yR^JTAh$W|% z#jmPwKcB_Pm!{zBo9_9qpbUE!{Xrxge|=eY$2LuTj`oL-uRhD{li+$hn%B0gv7Gpq zNiT*Ex7Mueyz7_E;urSazMlgU!L^g=SL+xzyTgTngDniCM}`bIT{WUKw7q>qyTBmb zZps-ftkUFx5>Ty%N!EagM$>q8$Pd?_Y#dkBPiaOGr!wIXYC|dpWwwW1ZrO45z#%mx z3IK%z7}ACY6&JncKX4X1rW&T_9amaEjK)cJm%k@o}kcHUAc`I%K>Boz@tiYlm5 zk*crV-ikMwQo^=TbGo=s89aw69VyU`~6;&#e6;x^=auqZv ze?ObV``l4?&i>xF@&0)IzE!D;^1kRZq&|WeQAPz_e`SVI5oD2^d50Y=A!%s>)mX4% z3k52wckzMx0F|cm)@Yia(35h(VO2L|yeb+9)V@MUSHth_RsVhY{roan{ zgoN2=>L>Sqrsf$9e->OLnO_qzGL!TCJ=kl1O?pW-YqC$8@7Vy?$@hKv@_!fiI&7|Y zM|}G}kJpuH22mzeaV=sNZDgFpgOp|lWmpxKfn<_(G^8XWgh8P)0yYN1e#|zjxL<{6Cf*TvO1VkOwv-cw1||d)j*)%KJS_70@4!;!p{K@ntiT%kLh~+w24%TRH;pLy#BJY(&vAuyuXRfb6dWac!)$r6o=_+ zO4NCU30%4aO2oAYrbqAh_w@ZaI3E)>WS214)Aec^IGi+n(UZ?6vKPSlV0;c9F6Y=l z?43!&e}3ZsIEh{T41WCnFsTzQAll6;!!V5NDG4PI)R9Y8mRl;2lr%Cf5U5oYNh*?= zM1Eg0=1-pf^WAAQC*EHS*3O>@kPpO`3MmYrrA4bi#6;9pLcP(^>gC=yTtW5JN?HbC7KEjV%P_L2%EYoxF9wYNp!E{NxEPjlWg$n*Esi{bfV1#L#5aH1m zp89_`%YL2w{{8)T&j(QZg~ncji=Cr?4u*cJX+)xyg-YzENocZz_Ge-C^n8OO=|z}- zLQlsHYHCB)7cb-pbO0m+eEGSI%%BYHC|Yvjrl*z0F|+~1P{oK70b>iu7+BQ#al_}H zaGmU&WqsaV>=S^LYQfCKFHkHDFfi3bqNyQOjn)$xktA`-9tz+XK*ng*=)x$TD(qDNNfb4&)b8BuVPSC$u4LfUX=j}G1lA=9KtkVS#U z46Q_?CY<5PCY=yaIS_D!#EXz{(Pa>+MXr zCD7mW%g)}N94m~#GyAV^F+=d6`M~&yWCi!#o4;oO@EBH>waFyTHx5^KmL0 zhw8_GCjQZ2RIV(YoKxyujq%$_A*n<1(^e=eQ)kKK zscRRjy@?VilXndueNBzEPV-l$*;T+HIdC?WJRB?#yn;Z2 z-FDXA)x|={@gq*e;PR@`M7*f;ft;v?x!Z(ByoHWny18~q7@1vqFTh{|x%%M<3z)L# zUU?%}Mv#FOK%l;C0_q2f!h`|$Bn4rxgG_L+JBrMqcU-DX zg?dW~8373xk&sA(I8HHoiW37Qqvyq=D5AGYbW~`=B%7MFQ{w2Qb>C;iGOIHCx@vUf zCj${xPKb0A6v+xV)l54=m}(IYl_5cAk6PrB6-bHUqD>SzOG%+70kcJBwJwILuFEhq zY8X;FwZkS2$jL)4D@Brx46abL${A8b>9d9g5b*exsZ0>TES6YQB+$qm(#r(VqalC7 zkU}y?LGe0?Avy1pNQjEm)|FZs+(W5h9Sb>;MX ztNSzS@2+QXgX&zHtrb*re5(<@pITY=Io5`p;T`m$?rX={7|rt>=J%k=)4Q!D!vXZJ zJHbDw?{}+R48-HO$YD|!Pd4j595cT5d~*1G+2ES4`Rw_^R1c4JpxXUaC&O>wa?)2mohqL7#n?hZs|JuZKp0Kuqu_sG({MqR5@OdxN48raaDh zCRPsJQrEheG_8z5w^Yl3+R?jmO-Ure6{bN2Nf<^j3)e`s0Z=P6YX$=Dik!?Y>8bsZJySN@;-3ohm-TZkEpWwVGsM8@{{m1L|r@ZCUr1Km;#1I7>WDV$={;ujsVn$~~!i#&lh_vEUL@J^VP(^O40>@!= ze+OpfjGrn>50^IxeL&!Akp7}(@Bo{c&ybMke}8cO@CmPu|Db)R=f`h;zg7EIrJ_}H zrIxSf`Sqmc{k$A?e{Q}N&diWWDYB#?q>3blj5wS% zlH@xfCujEe>ig`4pTcuV&&75%6s2magerw7i58Se3PfO}p`ky2HtYG)@v6Gp{r821 zy#gE%f&J#{l7@k(%?i_5vU!eOvgb4tg-nRVKw<(fA%TCQ_$T(24gF_4DY{_g4L)rw6CaTs!ya z^oR%_LTw0$e(p-03sg%Z^Q?jvg^LwQbySi+(7-3lE(iDBKiV||=I#?d)b8q;Js<^g zP5ghD6ZFW zQD|CsTXQ0WpwT7o*7>ka+5I4p$@v@n=FTG@E~SXFQT$x8Pe6dcm(=gDC@_KkJA^Hf67CtCgkQfz{^n+5N4f4y35)OEvt62&^Ppx8J z^{V~y{P_O){%;EY$jAXQjR0uT5<@S)udm-1KRoumHbYG?tvT}lnLd2wKL~yJsw`DS zL1H48K*9=kkKOzhW6{FjP|H8PM9oUm3G@JW@FX>_7+d?A)C0RC_z#LPRS}C3L}IJY zr^tHi`tI!K-+g-a`cI=i~lE~UeGdQZrYSWd_tddboOpBJWBtYg66((c?z%Db0wiaMzovBVX4V(5>?+pldA4jq?znC2(bFF*IaLD*ihcHdLeVCQ zEP_kA#)WE2@4GFJU<8Y)$ajdjyzvKIb1dPr!m|5wyMFHO;(NaC=Mf)l7PIiDp50Br z{)bC;B9k{`-tDtvXkCE{Jg%}>vVnw_=^^s%DTDw!cYb0$r@a@;<%u87@KCK%Z3vLT zkqd?+LjC*qsprVZlRC$TmJ!_=?Vmrau#jKDl0FB`=&|+i-Q8v1%tL7N7ig_LZ0KDC z!(^Vs_8s;FOZ)z?HC;DDFuHIAF<9*HNt9O2XNdV|~YjdBBU z4z)SL!7&0ox}w1_U?~RK47~E-J9jZpy!KK93i?J3B+`O;EQ-vMJm`>cPxK)LLTn7ZX3OHFskv3i}t42v>mRyCD zbW$lOz8H^+CPh_Md<~OI_;I_k@k_WmK1?0_A4HaDq8=b5g@XeQ>25lh_3>~ zkU^6JK;cNJ;VFiSZ@2AsU%mI;-Ng6iNz^Fk*{DSR`)Fnj#`aoQ(YZ`$y@3G!#kjC^ z+Z+vig+{Oo0ciW-$L{;*Jrx`ya zPM{Xh$qv6M4~-&mt*N*LpaCZ~F^1RcK$vp~8iHkG=K*Bo(sC4FaRMx)TSEw#ghF7T zESdBc8(P&!ZZnjyKz2JmABSm5I!=Z_w}8q9Y05OV3TY5=AtDfg5yTk}2*_|rM;8X( z{I9SL9CIfi!a)R#FEbrjR%&Zkk{)5rq{lrtEXsA$-F3vV%dd#aQC%rL^bi@SN8OpJ9v`f{L+G z5t3KF@IL%Mbh%$!@eol&6Z8~f3MmFEKfZo_FICoz58rJ0dPy~beJ-dhvf+QE@EZ9H zG?Qj?E{l@O#;BNNYprWph1LO|58BE2@Q8~Q1mE56U*FY*OXW$M&hO^hXRe&h47g3`Y(Xwr^ps|fnNHgT_ZJ3qMiH)wo$Y&Wl%6S;W`$@WD? zDG>#NeBOQG&%aHGZ)IqgT6%bA(Tov-ycGN{u6)f*KS1@v?rH}Mz|HQVX0FTDCH4h| zod}yZ0Mqc>-`~6jC*fj}zS9?wrC-noDtCcz;7iXyRKj5;-y@agZy zz|_lu`I!Tsquv4;=u0);n#|AK{Yk!G(yCniMj$L=^w(&u;YD-nMnK?zd<7Imf`MVs z_*PF`ATNjr7xpZ9j3I+pFsjaHcP1Ri*fm8I1K}A(ho%eUmeBSnF2ovgxh#*EG5m{e0CLf2tnmJ!LCs{OBcUVup z4Tk$Zv)4h0SFbB6l4vh41!ThoQq0K=w;L=;ca=^RgELfI4NWP4+?SoindBhDEwr-U zN3G|A?v<>GJSQF7!?Dk}&!TlxYWI#$Pa=068uGJ+cU|R9@|~#prVSz$B44TB@AMi;mmOc))SPAT95+J z%7kMcP~)JbapaB?La1dg9T~apk9~}EbH^cb88WubNb5Qx(1j%{frc7lvRY-QWoH37 zGooEM1*ZzhD={OIEiEd{v^EJy%Sg(i2(YH7!*j6u?U4-EAp}>_?nCAve}RG_bcT?H zkc!?JN}UCkz2U(3J*t=mYn$bhi9=@O6t2Tv^t<$S06+;V!^PwSgn)r+^qUU%J>a|8 zm&ZbHz3;R%7dT#opwnry&wOU!%lEtiTm=Mz6oH^;=DY8stggR=S809q0ns`0?7F{} z{XT8CHz071+J~aMmlqdb91G(_&u@-VioNo^Pt2pL?$|YRbWWr`+M#x)-7XZK3&0f3 zYwq3qw|W>SZyL{y{nOp^Z7U{b{llM4weIZ7C+TAyrHe0eV>CYGftUB))-7)JcC8cT zM|Y{W^DqVzfg-&weefvyDS=j3#7~p1avsm9Ks9bfW~w2*%^0d*HKTf~;D}6k1V#~p z5E&v#1sT@3xmWBTk1)}UP(NI`KHlRtX4h;G5nPD8S}I-YV1eO7kLk0rDV>u%{vdi= z!&(QrvEgQ$KJP>y9D53yH+M)ev)B9>I8MuiZ#HFwm;W@V;8r9x%R z@17jjckm!#@))tc6&1OB7-Q`Oc~ZB|%UP`vA0v4q5U1Z!DM*-K@J0*ZCxd0ADNP!XDgSvBFJu8>wDChnv{O8^An zIen1fOap3quFaNf8wQNQC`c5GCgOvQRS=`5tWY$Ilf_`}hK@xtiX0&V9v=urND>!% z0<q7T5$>!ANHYfg%k+f(azwbRa!x#TX1|IZ4h55@Obyz#BxM+iAQ& zXesY?(dgAjo!#Bs({oHCG%S?7_j~7E;&Q5@Fp1}NM{!R}CAnZ){HpqoW+yzQ5b1X9 z6J4-9yk8Ek>cREay!kixeetz@eqT^)U_JHlaVu2jg+BUr{UB}M+}G%tf3`j)dy|4M z57`DvLq1T|A?!EohBA0ej^tLDYJ|BG|IKvDIKs9=fQin%&B+OJ@OvyNR4W;-9|WVYzm2_7Zt#* z)o27_)q}8OM`%KZzH&u)IN@NPF~-~38kR|kM2jtStRi;cZ-i{#dqAQ%l2ZUbHG1rL z2icUnnnr0AEWjZC0cj$jpo>6KZ@;bj_51Z`{aLGKWwSFQp01C&zJ`tvo0|`oK!uRz zcIZ?#A3*~dOFeY!e_ zIo|#IdOoa`eQl|hG}~0oUwc|uf+$HA2#i)iW(UBzf29WcRfcNHiEUZfLgbl$O$26r z`>&m>zkNL!WQq)FF=#YVw3K8Of}=IfOZEQk?46l&feryaNfi|sAhAJKM3cMulkdJ< zDDqVO82DvM!nRiIljcA68U^!>hbbpW0_&x_}O9xL^Ge5{ljQzRfN z$RMG;YA(MP75BP-Ja9Zuu=tUK7^t#-`c(Zd?+9y9{rZ636aiTnP5!Bt24uY(OZ_4oPDUi@|AMU{bk!b$QfqM(SdL{L;d%KF9&A||Z8 z-4w$0##Aho*)n(Uo7QBwXy{4}0reGBL=aXf$DX;#wtP41%Bj!2eg)A-t=~cbeH2lI zlXOps`n4=|P|Ko^e9$R`*SZ{#_}qllsU_>@*}CP>eAdjre4~-q3R^lZ?PWL`DcKP-b)Q$3gj=22>BaEYt*;eeg*on@$_4_qTdUdF`J$!2qnH z9f#$Jg270rf`WegjeM)jzh-qGQMx`-U>FieePTplqX{AQzj}6DC8vbeTqVocUX5x6 zPIH`*7<{qgEnb;X zAfl|WN0PQ|$uh{wVc}4s@f^(#rLuVnNBMv)ad#RB(;53&pZk7C`i zh`{XdutD=)&xO;QgzqHRx+k@8g$K0=VJ9^9fRb*rIrAB!AR)^4bUg$Y%lncZIrxj^ zdsi4A-s&22i=Z7ETXgQvCMG>Rjd2fLLQvyE0N z2?tUfJ{I2_8R8_Ssq>qU?)&U^x6-+xO6~c{`==LONQ3Tk@2Atdk1yY5ExgvpJE#YR ziyvP75TFmf5=YPLCXAFHPM@6_v2>zuOUIuth#oE>NM;JN;JvVJ@rBpdW8@dX^>2de zma9I<*iV;F1>c*&lQg{ij6q;PGd{uibdLD%hW%=tW$rrj<$f%`mEKo{5k7K_y2|@| zx%5&*l#{r3aD^+bo=vCSdt}}H^07Ml?utf>NLEmyQsR@L68W!cMEXR$4`ub?0iT!C zXxGcMYUMjS>hM2qWPf42AyfO;YS?_q`1D`7u;0w0uEt1lX~ZMbv@%+Hhr}z5{cWEi zc4&6h7bs>l?^&=$XUWZ*V7kIN@7)CJ9OaHq{Jlc`*3Tt3SFG8W2B9bK*TZVqQ*ea4 z1P-^ZrRvn>yTYSY9@V_)?=-RnC73M=7={}@`|ckfU)m?*e24GfM`dl=&G9d9q}|r z2Xe-EBpE~M#C5S0UDu&UvTJ&{?j=$zIm%NVr+3Y7Ldn4F>7xwFoVk}s#OfH%?(Fu0 zic?`;b|fjSbDY!zohZ=lG|BBQIq!>~H$E!0v9z|0OEBa*=<{{;j?M78$9OR zB4w8vRbIN=h|QTZYBTGN#G|$)eKA8Yt7fF2MNts~0w73Bed;qh*0O6_vL}Lqghoyj zaoseSLV*s6LLxyKB-IUS>7@8r71g3l3p^)Gc4rl)Y+0%nFjg@nkpzRT@0iu*29ZWh zYSyYy%L-ULmyX3X3NRmFet04Z9H}Zto3%c<-s{a>HIel@B_u)Uo8Je^k2>yyaOC(w z;G23<$cgY_Xr!8~yQ;PXrpAy9znp8m@@lG)M2Fs49)y(?VbrpD)2olENkn?|r-ekn8tb*?;;~@w>Yfw(Qq2pI}5+&U0>7FOaKfkAToPPJ1theXH9= zmvwxo0ZalVv=+%EmES9$T$Fc`z3C02y>Bra6@x*{#pKWJK;N1r=wu#fl%)z_BgrDc zby_a1uZUNuHGbV0qNPa23nY-$6aOh@<0-{wPgwf@F*jFA6)AC!=f>m@Zab}#_|d3a0tGtV5<-#?FLecU%3hswuUrFR9reWA;C5y1hz4qoWk3&`d8#d~ z{Lgs$7AVC~EXu~gsS_4uMv_n#L}zQ7`J1D)-R5}1r5Q(r5=2!cC6ZS8t${R{L70&? zDkBSe?fkvUx7F8;b@z7`YQIlpG|9$kHUX6<%$8MGY&(QL)~xIKlk*i6iXg#MVr9F^ z`c>WD{~@mkZO}Ed+Hp<;{{EMf{GZ!z~Xe|~Gm!?p6Jp}r8GV2U7! z!gBkQyxc66fx^sV_@hU_s5_z^x(?sXy?sT4_DoM`!hRTp3?i6}NihO2h>JJ-Zmgs2 zjv%S?pB&9ggoo5q7)F6GHLuSeHu>`HuhqO?eHd_{66l#5^)*4!khpwEPW(HSy_g{d7jGaTn%#ucr&3!6Y zs^MV`fO>D^>fXTo3W}&AEEQE}-^Ly1FTZ)9qW69Rcu$})6;O`I)c8iP87a4a`P z8ft1XA4X;U-+c~!Abgm2hJBr4tc`1%_r0xb&QzB~J0Qk6S!JbVpRpNbGgCCvGrvQ) zA3a$F(tRwIKGoj4L6m?b8iCK9*6Z(1-u@6Ox@i06DvBZ~ssd4qWFj>w5K|#r_j_H= z^PhM!6e;kS0q}xJ^dhiwSrZ~@Q%b&d%8Om=t!Fw}HS@PO$w$HkQ3WO4O85X-T!44o zusezJY*?raRxA}A>i1{KgO%*<*VycMbdnuKBvFwF2#|-((FC@}r7cFS?Q6bU()Uc9 zetf$z1XG19(UVyz53Tx%R%-QDo#uOw29Cka?;8f~>Mtxpy%3_Lip0F~9{8|%UJDja zde0HXJ`O#gPfqJ4TgCR_Ub;kz(sitO(zt}KMNUvzL`DrQJXXzbP~<#!u;ZJscdp(G zo&%eN?>sZ!JZ$CSHN)>>$Z z(9AV5@Efv}bXH8ngBYa_($g7HfIKCJRs}4WfWbI8^UKlk46>NDl0p=Hp5$yQ5_s?CEH1$vH(@HIyeKlpVId#|`ge zUvl$7A@Tq+6*3BLp(HhxxDy8fM_8$72d8OmAaMf?FGyt%d*Q8?cf7prq(KFOcIfa{ z>PgHUdb)31sRNW#eR0#cU7F-3i$l;13`xvAUgoQsy#cweFv$RYVsAFvAvjC!ffZF% z5m6E0j5ch6-EUI~-mh>nV9sE5V%(WXAmF{ATxfz)SW2RnsH9X;RQDJeAt5uo^xQV% zD2h3j4O&W%ML0{}#`*ox{k71_rS<2*zm{{RZ{E~waltZTABXPk3#FUae?H^CT;e9y zaKp83pw+SEZ+xaI-N0wpwdev22EqF2&dS3;ntOM)tuLYMy8G{MXDr4B{X85BsLfLb zWbcNfR0nJ0?_S>hxjyB^yNVkdeMC@DklKJ4VD`-%<~*^XrJC zyT!L)`u+n?)ceQd`S#n=PHo6MK_lUZ5^0n|jI=D+QjKN>6j>t>Ydw|SYsF=E)mx35 z<#T6TRrwD57eAHzNal^txkO$iw4{{m;h@NOxFN8!GkwF_9N#>u@@Op8w-i-()bZQP z3vg|ldIe` zQ>1USsHPw+O&fj;9h>Aj1`vYqZU|>WEQm92xabSV*m}c&CBZ~uECxY}C2Xr2SxuuL zf-JrlHsIsO z6TchIjcuc3bjWu}LjV|1C}w3TyY}wOw_f1P8L*T9jxtk>9P@5ObjdnoGbb2_7?xr) zDQ+7$Nx=aVU_`-$aBIoSFk{YG)pp70lcro{Ub=2br!#osdLV6)+X#;=7=$=L!FLtI z5F;}z1z;G_C}IR=G`8(tdu*##xVK`*%_^BUV^(C7LI8mh1=Q9IdLSZg-Bq^1-=24M$Q(X$*_JS5 zOk?MRY#gWt;V}6VJSOR2gc)Elrl|uO6JX3K02_gyW1Wlng*?q4D zJoDVLal!z!+W>k)_^+$swcdAkcEPxI2~!Y;!|`4e;}{_T2d?h!O|iFc;K7XbiNz6v z>`j3KnS)Xn4d9^@bKdk@JKu++n<@w9trva9siQ*w4cEu7)y{=>{k%BIyYI8G4EMsR z>aFWKcRYA@oL^JltDi=Ad=pBb8TVTG{h8E$;QpU|a_!Zhs4tz7!Pq(J72n3ERZ+w~ z#hhJ{-(}{%Fc@Gv`O6$JQFX1bBEY(-4l*Mofr)LTj;cbrP?fqQFH)dsg`pzpcR^dA z-lz&-8I=H)RSCrJD>zZkR0wg9yP$^Bopr(2oCe)#I?&j26V_K+O_8-Ou5u5J9LCji z9MB-LUkXwix{^#`wie1{mD&jiR;n68NV-aLsD;%Sgbb^=vQA#E2eoz{E~M8gy{z%Q z#U*Z_vOulS0mj6DQX62Z4V$t|WCHa>fmuX~LiA@0kPR@CP9(&VQV`6kEJ#SJ8>s+y zM)^V7s7)j$6e;Qk|H|b+|_{;27P`O)5HuO(Nh32Em^v}a~=;n z0JM{DepD-a=KHd$fat(IbtK@)+^H;PFeRB#+E!G+;hC1&H&7;SpiNy&)dVLBsRA}o z1mHBCt?(Q+faL&Ls)qGJ4c6>}lVfSe2r@00#Sh)?%a|HJPPE zGY21zD6kKBj$jU|UU)DNrMI(}2o%B=A#U=30NYmbz&RNT<3}9~4An>$$X#o4eKvrx zV2KziiZD_}Bfk4zGWAzYX!Gx!5Z8li@NKablGd-B5Y{ZFkXQndVFR5C0?VV94c!Kg z>dz3(OJEPnC6f=eYpox3*je%)2ELqCVv$h+*>z9F?R`osDouniK#3wWl$NcNTju6X z7K+HlQD8{2efwd*wf2K|_JZiSIrl^@f_$UyxszG#9jzPGsa05e=?Tz_BvWY6Y{gQh zWYUJvnxcbLrfEn-ZKO;D6hRg&h`|ODefFrkJ55{-^SyJg*R#eRGV#Wn^3Z5 zLm4ro+iPF0?|t3x@6_Z?v8{UzvT8$;sFx~G9}l}bnPKG8P)Dh?5P~B(P+avc7WuckZ1-)gi>qGS6%oD*VG9^Ag*CB8qhnd2GDsR1tLe8(!?f*o z)9=SDhD)>W(86Fs>KR`>nIe6{ec@6bCBAphK%-=Uwk?WC$Wcb3p)71hB9i<3-fv%d zzn8ukAR?-I5)~2%ih?QvC@Q~sJ&>tYTxv1X0lipzXK#6slKJ$XB*UM1W9ctZu2N8Z zqgOr?=z=1Gu>pGPrEh}!=d|SkeJB(IGKY-mLqh*1!|)jvCv1DA3` zUmEYuHcSko_3J!3gO?%fC6>_7#Z4Ewe-{s%>Gb`@Vv3>&h$|I>F;zLu*lezR-+9TD z_;0hr^85F%LbR4kLKeW3lF2J1l#f{K()+ycJuF#WJ5Lkir`qLm_%V0?v&2^3Hf1VLgjQ0MKK zYVno$J~F7*?>Cyx0U_fNKwydxo)hlAO8KH`pSEU9xl!bX?=N2~1m2->w`bcCL+(ke z+CiZpf`r(}5E5(5SxzEm6arxrA?0n?U9WT-+ujdK0X+4)VS2fU-32w7tR>wVjkJo| z)F~h^gvo9M62TF)$Cy}I8H)vFs3JE z!3mkf<|&e$3dAV^P6iETf=txa0-3ab#B5-}uz$;d*0$eT`jMJ6&5|->64=;cQASG@ zl1y7;MT;ek8&HOlQ(6quYE2U)+DaKgwuG@{#9-DMRLe4VJGE!iQBSw~3X%<6DN^A*DBN2>E znn>8$nK2O}hMA2`G)PP~mP{0rLP3!LrG&E+U@8Q%G7@Q$S|+H<8wSCVga*qfifE+S zK(S_KWj2kA7D^UXLYr8X8n9I}MI@z?YbMH+%Pi4~N`f;eB$^4D(vxB(OA|{lP?BMW zfHDZiN(CVTB$_cuEJIWq7Fk0isVrrtflVfq#?qECC1YUJl#nEw39$w+ln~PG_^5|%WvDVES`jgw*w zrA%Nctu>8il+x2m+J;n0lVq$|Q77})-}8Swdh?%})$hW^QtRGxck$P8n}|~dlY+Z3 z*HXs*9km-nhwr-A57JTRs$JXz?Lg^@HQp2^d6SK1=N_urC?NN}_s7g8lq5F+jIeOec&;dal!m`C?6eoKI$_@B-o;j8+^y<)wVXcD7hp}w4U`-v*+FE|)vqy03!A^F#2xeknN5w@Yhy_%bkx7 z?LtpdIBfeEY3DC6s<#KrGf6lDI5Uo8551V13Q70VZsIF=2vnEm;AiJa2-!m`mG6mt zyhd_ENX#ChR0@@iBa#C?BdMb3`vV$Byod+KHnX=@dG_Y@wMf2%YxV$k>u5!`oOOPi z(`;Ffs4T=_Aqyy5L$dWXg~vm>)%XWE`S`MX3B_Ra`X34FXim~dLHXL#-p$r43bdLp z6*v=%A9|){@=4GjU{bn<#duidN_4TaW7Ua!D<`Pj-8M&hX0aRu?$Xy-_5*cYcTUC| z%oCKobzED`_AeaVDNx*syA_8(i)*1lf;&ZuYl8M*h2ri~++9lo6xTp;3qjiA5UfC3 z+UMN#dCs}-@4ok+_x*l$X6?OZX3g4bW>2=RBl|2*&!q(CZB}r&+xth8lIE9C7vG_Hh_abdgYRp11fcXNSrbe69RFH#5;!&OOpO2G{>4>c35Me)kT+JNGeXHHH} zdUNw^os&(jHj>sD>SAIiP*tZW*h$Dk{d@K`lgro5PoL%2kC{njPCAaJ>UaMjZkm1B zo|B!M{C0}f^duHN+JAG{ood70u>PTY90w&`?_cWkxls}?roCG&ZW<`FKND&JoUMOF zlSG8J#qWM<^sGO0C5C>8gCk{2;Z=#8wYs0@w;(#v&ZafyJ;!MV%OQHL_}1Rwdms`I z3ZDoSHSY(+SeTIQ{rhp7fkKTdKn9XfnY`fO!lse({y_n2m1y5& z5@~cwl54FtgMJjBi;4B#oSeB|$^%v^eesNh87rNY-B~^Psa=RK zTRDwt0;&IfI#>V4r!A+=tK%YHK5!Y+l;MNi@)}u8a1Ku$6+gAld9Jv&sjzlYsGo25 zxIB^Yo=qebb#8UtQ1;gSO6XIt9bBY1PhV0W_(OE`_tp0SobI42)u~! zkd}d@dTJRaWRJ%WKHgf^22cdv9%F-xjVUwyo3HE#t9b%{8d*cz7h|(8m9{QA3=Vhc zhY2Pf2H6qa^s(#AuZSAUUXj`{+mqJEV(tj5r+JlO*|F5WJz$zJ-(FJy9#vZ@yzz_l z{^S#OZ=04EH8ax14OI7Rdh5O%M;*D|lSZOV1vx?kU}uCRyWUlvfkx$diePX<8yQQN zsN8L+$ZyT$r!DDYMO?fp!%wxh$8=Uf9S)eOij}q>ooh_oG)I{`jYP|eVI8EgMLtfC zDblWt)KDJm`EC$hx9kQx z(L56lpLUV7Pdh;lnQE&6qY2rb!eD@9Q!@+kmOL!=NfCC@&u}&h7{I&%MSwpUB-*tb z!`2;FN@vVxQMS(8{J!^bPH_IqUh*5R2_&p>IsoZuqbE)qBOFPhl;p&F;ta`zT}sjb+W*oBKw^Zv9OuV~L9z zZ;)Fa5GHDAq0K1$nd80B^<4+@3UT~g+_A*j0et$s<#)}t9q$ORFo?eCvrH zO9E2_J(LD{5BDF0f7v}#ydWd~Sg!Z0uj(U-VL-BiJUFNS=b(F!d`kmu=Ek1QTA2!3 zFr$JYck$*a=hm+`7JY9NACGnwXLX$w4)%TI#xW>>YWKB|pd|)P_1nG*ab?SeXTD~n zRpPm6j5ZxW)q0WVnUM9DowgXa3&IOwO1@zMjxSeeC18-@#)$@~Y$N_BXrI)^zyO0= zHV>+?Q7Pz==31XFHu%LgHCBgVVsQ&t@g^oU?#f^o14~-X4Jd&DkK#L=^sE zO>swlB0+|7uT>&4J$Px-y#E_x_sHc!0@gXL*iXGuZcv$uj9sL@1*cpJOVDVEMNjj* z^|{@?d+G>R&mK7Nl#v8#uvc_U9wB!PZ0#9;Px+=Gm#z(pxakOwi@`wzx4zswvZXP4 zU@}Q@4EDGP8MU{j=dJzH@o9Xn$R5g`VQ6ZiPnIwo6bcq%vDl5~)oti?VgWVb!|9%b zM?iwLAu-KX;xmof&hk)`z=wt!tS-0M>-rWEo#9LIx|md+R$H&B@wQG-?n>#;-}dRW zDSZNLJLEovL&vlUh&kFo;t6OM&%6k%^s}!0{FzArty}}QA+;cLf6>c z;NACgXvVYaek95~PO#G4CAn=(UbAO>6Q6qPBXrFf{~>I1b@U7QZy|D`3lF})uTgaX z2yw*`EN7YWcAmy^TU^V>4(%m&4`(>1Zcl+z6`OZy%nI$F9-5^U7B|suov?~vyU!M7 z{Cetpm>*iK0#u~K6$>gSAY&MJZCitLP($4bvBynLvv`bK0iKTtV2-##r}XM+LP=Q! z%>YY`Q~B_L>wuR!TdmS{DHD;3%SCNE#mC3tRz}lE^NE(>cW{eEp++)dcATxZtjL`} z1(u+F$IX@?6$O1bQYyhYt^)Jwl$pSWVz`cd+fn z%le!C(F(Idgq`)L8V1-(nB@N}(y+5Idf_+^XCZ`I0htnFOG^JJ@kapSAJG7Spdf%4 zgaD)gxUiM}WMH(%l;gte5&&E2&w}CntuO$iGqw`8HUJ?(gyH|A5i#gbF$6IPTM2+8 zt^{Zw1pJ@)pT_uaP8!kQ;sKaOF~C;BB!8m{z(pnr0FWYvXCyEn9VA5zA`qmA5ee}Z zg8)SP6u&mV_TMJL&dSKD;=(kBBZl**C*>GAOMKJ)%$-pj@kZW(7&sQt7MUm zhyf%3*e{0lB>9y9q=SE}^B*x724=^({-+qOKjN^JmXt8|(EexlF(v_20Wcl^r#Rs6 z1VjHH{4rF9(*NEj!d3#12(?fBJxu;L_y1b?qeqqGJVtDqpdhvirWgN{k^w!pnndQzjgaFsxiPA2$QA(B>p3dO!Cj*{tq(s{<|O8N`LeK zVCxuWab;v-20NzAl8UMxhM^~!k(HrisFTgrB#0q~I#r-QcKxr6Ka}ZTm0S(KK^ZMO z=a@j5-pJtlotpOp8mWS1=+dv^( z*C#f)wd`Y+l|T{XuuzbTsglZ2H?(3xU1&} zw=Eu*Jb`wW;PhMh{ra|kSvLc#&D_hc(^h^6}w`r&nx!04b%T1D?X`y=tjXyGn=O6S-u{4rwM z2O!*hs*iPM>q<7fYRIC6|Dy)80i6)BX`vh1rzVCCL6_Ujg4RXp{}R?_-{Pd}zmE3t zW7b%IK_kGUQX5ZxWh=LK&TP+8YI7jy6c>>iiEx{rB4iL0;yz6#Sz{bbJDV5&Z1o6Q z`yy6nAV1>O?GFI?i(mNmIi6uSdKGN@^Yy)1!y@D`i3Vg5K6v5`ILn z-iq2bI*@||p%5D42K;oNN~tkh#9ry^MZSq!)iZCG_1j|K{htxias}|3y30ubLE0Y0@9nXNxPz<{r&@gAREgIVt|`or}P;s=6crd%9WX zHxhgwm8RXpPuWa+O-RdTSGxmj+EB~CUo5*@sq-&5)KsX63UpR&41d1{hNJK|>fyxN zqmS4YbfrsP^}rfDiJj$jUkG#%8^$J9P*o(?+VV+adLA6Vh5+XKeAZ7mV)n07;hXI` zsAen5UJ8cU?>cu=mO#>n=QLdHrB7Od z7JbQWXpYUQWsLBEn-kiC0{;_X1130#VC%+#46-13_C!;pD<%GCYKa{d-taHK8s%b{ zk1Pw;6)pn!?PYcNv{R!lA>Daq9~$LIw|-KDVP0>4L3vqD`HWc;i+3o0cL*^G^l=XP zC5_^kvvqy%_576(`M9(hG7b+_++~5qggKoh&m9dc*}tzD&ohOrCgLXzG5{*Y#PPA; zg^?!5XSAq*2oF+A|3%8mRHg{^f47}!f8d7mIF)CbPydRn51j&X2?_`;Y1dOOAP;vi zw7jKex>}_CS5BHB(W%Q-Dp&Dq zzvf0C&HDK!4ocoed!Rw3%0L%=OUWAg?y!4hM=*L)3m@~YXyALOXebZBhRi;-H$RCG zIQ3ewql8V+a{2ag4@rCXEiw6M?F@rrAMgy_WkH+`=JY~@lLoylH7oP7);n1s@Hn}! zn($-_Lkl^hUjHSQ(ek@o=i@LHcv9Q+iVFO1HEq*>+jHCgQp^6An?RLwr=6?e z=djMldaj0tVVwbXZkx1>7N3lkb0UF%k79T#fAh+?Eil#jv`xQqHFRp5qN%{2slb1w zWi$~9{B@bp0?KH~(>BFSmKg39SHt(1?0*$;HT+%GRxG3CowjMMw&}f2ed@hy#>;=_ zl{RMbH)gu#7DYM~iw?30@ZtRXJ0&0%KzD_96084+31dZbo1u~X-uiH@AL;?-JnwAs z_O@w(9IPoU-nlrSy{y}ILNTii**l<8fEob6hsRe1Hh#;8D*)1or`AydP-B;M=XH>^ zSC^Ios`vnWZqnEZ+?Mv@8LQIi9%tlV?0|9z6*vPo8#W<%!aQ-*i=pBh)V`D|k8^ba zlLY!S=fSs`sy-5wt;LZhvR14F0tEi^$DqBcA^^&$pLdP2mOsaDN#~W)O``PTx8+^%(d2(l)h_K33R>IG)LM z7x;|sX6{owb;l{(jo0RWCIL1HyA4m-4Bgd;IKP|Cwk5;dvOHf*IbR`LD)u?-qd$cjd0u$wDZr3lx*HcRpo>57JY!J<=+0VrkSxHZ zCYyHi+2(P11;)RuW1)2LHY4*6A2n5i&2{Kjb8+h`a$vhZSTlLKG z>~{dZ_6&lymzDhKOsq@R@IvQ|QUe`qj;NSuCXmp00vIIeq=W}3x%{WM|7Ut1ll4tt zwZ6`{K248IS_$A5OqyVz^B6!>I;g>D7td`-6oG|(Z>-1Y zCJ=#Vg!v0#b6D(MNbc-p1WRL5V* zXp*jx{*qnEC!JBy0P_TerqgV5(H*Qp#@5-OtE{Wk`Hs3f(L$hn%+a;MVKdpof?uF^ zQ+gd~(B-IZL6+zNW=z0%QA=)0bZ9iG?JST+G8wq5GgeBMuWu%~jdjKoX<-{mmVQm> z#Rer4YPT75T1;lV7J*l8CVh}jvu@*=sodZ+P}?O3nMwkCJ^c+l9oo8V_W)`pfJx<2 zehn^0N>@fOKOa_=4vmgUWSN+|n-r~(hg%RZa4y-v(P4e1TTo*q*-hAOi?N{WEF!Q^Vm%fB51btB+0&fIS1aD1uLY*N=ASf{%V^2_$B#|9to+f7>sUeSaHrf7rtE z8K4uPMMaU}-K7`sL}o?K%XMTjLpv^beJ$keQ`V7TKSs%FrByi58-wN9!xC48+1~l@ zA)op$3=Y0M#d~`Zs_1nynq!u!Huf;X(s8So}zg3e|4H4jlc;p!eriD`g=7czw0R!=D0E_4=-|K`}MoNrkPOwN{vj>kWw*QXP z9eh9>_HioVViP_+Sp&mK3Kz}q8xRlgxSwDv$$F7pvb0PL`HFGIVO(ppk5gdF6%Ra) zy19K0q6S>=UMa6k+qkqEx@=)_P7Lw^O-T+{H8bs)!oLnsvu<*-bw+c23={b-t|b|P zQh5fe`WjyJYqC2LM?uZR3^%F&9x6mnCjjWpzwcPBRMzIwAqq;%AQGUh3Ur+RVRuer zjJaOX0xpGx)<+2KZ7&<%eZQh7yu^K2?3C`;0T4|eGxSwn(o2&MVs$2MX}fU0Df+;e zF?1i7z2e_L!#A{XH^KXO%{{qNgP<*d<~fUM7wHoVNNAyFr@4Utpv*-}_iZ;HpHRaQ1cWUQ79SvCQe$@I1W(6_45w)#fyNex%4j(-bter4(XbLP!K2>g(ZX-azq|)RUU)vNi)qUMh`DNGVj$=6 zu<${zo$Bxi=c1t;3YQ8L&7qBoLhy@IvG%sZg6-=niy&pL2Y<1r!4IJ4{QfCq&sKQK z|HA(Cs{e!NXpkir>$O^WJgx_Qh>drv{j2$Ot|(>9O}~~ej5*&KU_GvoX8&T3iy#I< z>iA6s_APd$1$`s>XB(gqb+EB#{LcGlLE#}kk4z;+m9>?yh`uwge0{tNZo$uNb-cP< z`Bt=(m*GknkGLVWEz*FA@~ZD9mP?ELjc8RS4=gGRBY8OW(H1DWoV^ zGuhiyu4gOU@%k6V^<#pgsAF?nq+@^m$*1=%t!~P$%wMK?jKlhTL{^67@>`TVn%-rGWDmGG3PNpq_rX??98{OXXe}$S|)wb;5u%}!Y9BUu(8)Xs})h;wk zH2-jbSRqFS$x+@9hH|DVe!maYiypoGAqvImyX?VzKn@K@HD8D-baN>PrOsV_Qs0{x zAn3}qyJTrI)XE1&%Bs*<@*k2h5%S2eR54Q|t(h$*$^!6jjffBwd?9Y;8isG3Hu17m zL0*#G)K&$}nz_pT7ygv#efHvLWSiIQ3@2XR$)H?cAQ0#)b{gV^kFSc0HX^Jrq+1T{ zYir5!+O!!ty?RSC{Y>|$aOkEbwe(A!zySR76Fg(+a8XJlZYgguP^R5_%1>asC%cU>~)k z$IR}+YX;f8X}B?>VKT5RG=*{-8Usc(D17OAUx4xo`p+1-M|CtQTA~KGzb@pV4Hk3# zdEU9gxXBDej>#Qg9JGLlV1^lJu=r*~SJUuTs&SY;bd_S_Q;XL!1r!T45My8R<&C>E$u8M#y86NA{Cl(H(<052uao&Xaz9LqE!k zPP6*eu<=FfBfWutE{F9^XGES-91dfCu30HF>A}@}sgPNbf{rT zRFhGG9K6t5cjFL?ze4vv{#?`YNr)-QC7YOqqA2dep{D%$ft^v;$m}?+oqljp!;WQh zD(g+3;@wLRMdhK5$X?$D-n84ib17!2$4vDvKGkDRjjqACroRCkf`1JXCj9#n@UG=I zjWW$VhW^6PY|LUzY5Q*s{kLCzl;E$w{{4R9=9ldcsr;CK&D5k6doJnU*k{8(-OLaD zy8qzXb*HsfP~3EN;d&9qKNc+A3A-dyVA+TZt@RQy@#;*;fpzpWz2&(iD=_FC=&-G# z3y(}8=y5#p3Ket<`CVU~G1uSdXO&SdF(Qp}az?=|GAFARKC{p>>5>qs>O z0(H3i#)cfKAL-a~_KKNR&t^acrDq#{tuFVgf3I1RR_mQ>GY9u#93#G#3Hg@ekE|QW zhAz(R0}sysrD^{>{L78>alvjb%`;k$-Pz5u_|DTFT=dCQw}cquZVyh+22V}zQnzJ( zc)&xqM>|So%LoRAp!Wlzs^j&p^;^J=l`XWbU;0o~lKM~}CSGZ1apfKv%IpP8=&aXtXY0)NcF*tw1PoqQ`*Lf5+!V=&&_V;yh^;Yy?l`aN9mDZs zC%HhcnCwmK+X1<{0?4X80Ryx_#;CB~)N3xdr4n_pH4y%~CQwslam{JPb!{zK1a`$# z1hIN5L>+>%emyq5WFSRt))uf;ycy_qFGPLewPuqs9XOGcQrPn*UfF3PWz1mGDcPdR zl-Fx9&Aw@NhMrF7e1`hcxc;>*jdZoGUNc*>hRXmrtiq zfdvguS^Ct?T5$*Vnjeds!o4iF`VFsd{Cb*J18V+u!(3avV=iGXQ;Ku~|2X{9pw|6q5+a?a3Gt{9b>|p{w z6YZo-8IG{5)&o$~*+=_nhHyJUytpjH}K+Y`^89k~WGVgBP5G+Qo?a=aI{A9OtvE#~-^!d7bxYWXSB+7}Zm_VQg@{;Z zlnL7vO4^d!G9yLWi48coVkL zv_15qY!xcfwQvrbs=q$uRWmHpL@4#u+6JClXD4XRa8AC1g;peWzhW?qacl6=d7E0z zsl~B+T)#wRLBB#4sq`t^rhqv+_gLP8H!#hMreKDIJBiuL#z7<3rzdTW^2#8kv=3 z>OjB|qzhLwRkE`ru?&*>P1Y9b!fx{~O-?H;yA)@apqV|h;&5{4@7ZK*6q=I0mv)aLQ`roRtw zX5h+D=g81zPp^KLp*!8wm{5Na0tHW0uISVwbBe2$1n9*MZBD1*=C6}#czsMnjB~+p zoZI0jXoqgSr6A=@lk1(+3fR-hzaM5s-jokV!ZCoIwyII8iyHM6f>*}TrtZ1C7Lb;n z_YidVPi>jNL(;JtfB)b))Hx~xN`^wA(0>E9jy#r^$tqS%h4*N(PM=n3JT2cQi(_)`=zc^`l2Ny51J9k4dmJa~8XD=S*7 zpn-4sgpxv<132hopy&p zp>Ew(_nJ3Q!BAjv-@x?Y6OlR3f_n5uvBiYp32TRYvtcq3sJ1=!%OO*foIzrE|afa#CX#ALzE`d9Qzrc}iD+^oDLN`&2uI#~yp)mTy=SPPsXQJJ9{I|dbA3r4KdC)ugp7u5^mZA_mb))%a3 z-e7WhsHe!BKgNuqCFW(;*(XDZ3F>OgnFaS-WEv)^l(TJj*wke_&*~PnEYRmMiVraE zy0qlXimC}{t#sN6*!0CQG9PN?6<&d1gZ{e?RPYT9XF=rgXD+2}X z7yjNQpr9W5&$?E`E1m6zzU^9wQmt8pHui5jUlx9*Kah7ynQ`Urs-b^N_??!OC;^(uQ5Rvq(Yp3m_v%^LI5x+C*Ym!mZ0+J`h zOA*nd*nLShC$@SV_a(3c80k+QDb&i@9{=UP02MA9*AH(_O!`>apEd9|4&9kRXalKO zO~B@ciF4t=o@Vp~yfRH;bqj$gbkMv{H+ZhLXRF{)8(@9!Rh2YCN23l~22!oT_xj!> zf6`K*8Z}~N!sSKbQB6PHZE{O7VZ0WPz4^vN6PDgNzS0>zX59s)@E4@jB>R9)0)tyB zQ{R>Iov_M0ao$HDiZMf4yPFl~YX_|4^Y*?~QXmQn_0za{{VgPD(L52^`O~ufg|+oM z#=#B3JiNu(9-*bTRh6ViEjg+Xn;V#-(`*4$l~(^My+nQGFdHmfqCj&@C4c@Ykd-C7 zDFJ3vtz>v^ z9|l&zjSD+pqZFqP*&*-riz>pgO*?odFFHEjLr(Jx1e;$Je}Wa5hUR0Yn0{a`X2?84 zA9G9Z-$Mg$9nk2^R~go*tqi@hIXK))dMh0YnaMEDgnZ2gLcP0<3m&RW_R;9u`+)jp zl#ATZ*i*MNyl~>JJVKYI@Kir`rBGsd?z4gYm+@=4@HtG3*d{%4RWWKR z?QOr|wyw`j{USBi9dIsW_6(HD_hZ&XC;NLLZfrRg)&MGN`BytHNIqAc5tF^vlHj}Q zF@1Xy=hr6KwC6xf5|uSVOmt2watXTS4G*`tFZAp|A=`D3aMU(t^7EFEfN554o*~Y@ zBzBsJ)n2dWI&3vXHujUqKnfG;XT{)9zK5y-e`z##zIEzLuk&rFjDfZUq42jYc)wh{ zmD_jY{M6NWMT-ZBHrH%bGkUstC~wr&vC2~+N?}jzXKGBoD`4v;guc*%2x+*7Ls1Cd5RgAk|}ySR1_>xmV!|nz<|`o zk`aQ=KE74O3(7~Bn5Lnlc_nVNbAt}rxcnYeNlmTdDeevCq{0LS$=*!8jlr`Trb3^! z@S{!*e<`B2S0|j@=~QCN1%zfWUpzL(t#A2bF9k2bwM8XW^P|vNvNBPreL_cA?_DLy zyF*jBMdl3e%FAgDu9*f@-?1)OhY4x8dA0<63Ys&EI4vT-CJRvq#VdzY^o-kwvQ!YSAHzQl!n@CEA`z6vET? zZx0Hd;YLufz6rhn;4*AbEtp^Dg&s$Qf`a&Ro|n=OaGG;a`G=2ZqP!@X28AQ+uzd-` zo~ag(%wy5e&0bP;nhxv#UH(F8-XviwebvRb5ufg;s%f&lb(1mY;)^RsLJ<*&HJ4rxaexl zyXd3n8^wa-8F^lj!mpw+Ha2OS%peqa`bHW%;5{rI0K|9pI$QQ9$%B!zu?NPc$xVE? zkcP9+#EAihT~sR<9M>mz2e(+kDLdgK!|Xh(q7D>a8GQFrPd)zy5i&o!el|BS&btiF z_KtIDe^}$~x+;K^BES`LA>9U!s@oy$`X@E|EO!9gnv9>}QumRky;kEAXVHooY|0j~ zoL27ffu-9?a4X47)khNEZnq=zb~S6sO4&ciWqNzS1+%w<@XQ%zDKZX|dBpkb#!^-P z@P%z)(arP>6#RnA1Clb-Yq@!}*VtD#(y&p!fb2W15qxQkQZvJStu_f7)IHyX_f;}) z*ZZM!c1%2qo*nd*Bo7Tg;Ae`FhlMlNn}=&u+a_a$0pM789wi`^_(@bNFuGQR6}j1WK`7CK_s*vrTEg8a6Heyi2uZ5HEDzfDI>zsp zlMBwOn0XbK{mMHy9hwLXU&dyr!1tF3CME3IYIXKsvD9r4bn=Ye9e%Uhk9uWty*(%X z`-yepG;b?fe3sS1A6mYGIDVF&$;dD_HmWsGDVoU42Xa(jUb2~vxDm?V2X9^rDrUYl zZvsl7)-bVLCWN6{of3&BGiRJ&Lx2Ad=ZAplK@Y>}V>x~MebCmk#=tN8QO^n_;!#ag z_8C#`)N?h8C8=L?(*#A4=j&sMi?1I?mMqnH@)W>5bFTBorV~F5-^LIfxuLeFVGGWB zkDF0*jZD^NaV&W^0q4FtRgdJq8}$!H+`Rc#gSGKyVlT~!!tqXt_iZ-L3e@exP92-b zy(hmFJbJ%;M2#qz7FqhBp*4{$e{Q`n9-92x{&=SDkWl?tI!FWb`GU`Gt=(OB@J9Ba zp+N>BLBOBN%RsZw0I#Tbl{=BQEp7k)oJw9? z>>ym(qNUt7^~T}>6Pw$V(KcU%l1_AG1a4=0^8y0*JIwf=`=n~k|BNnsx4)?RqHkr+ zWdHM7VJ=Q-ppN)=$H&4qvLV|}KZmSc%$7y{x9}bmHPwmU?kg#iWV59D^ zj%mIuxATm*y8Bq{O=RB+@U@8_Oz1$AY^b5elpsh*Sf$4>Br`iGqQLgT#dnpk6edv z86}_MQYhnWfX@f0PGTL_K@k4=L|qxEa;i-K(%yO~&NMmZ5S3_W3f-^l*kLJ~ZL*dR znC?Fj6(Ab*m2pC>mxSH{&zQKL^LJYPZEYovsg`ko{B6KM)u zRU%gQ-@M%Oag@9n&8h`z$q0U#=lr1Yny(aa9TC6|u)*vK-rYeslwD>ThDd z;Uw!gOG|Xfw?ZO^j6`!g9=(_d(yvZgW3~(~H_pS46t}Mk<{oS_NF^QrDNyETS-csy zT?6Agt3$^T${a~TpQ45*_P=daJZV4;JcC4xlj0wOd@2fPzmOlnqU&+;wX@v#kHU1Ey#Wern{o%A8c*l7gUGQLQz}PF z?x#ZZ=e5EqJ}9t;xSraL)!H!%@d+FzyI(pIJhGaqz8CEvZyxmT6YNLk2aUVVySrW4 zx|Q=EZ+_4@AFF8F4GQ+W6YSp!U>(5zB^Jh#+Dg_J|LXI5iajad=&zc_8|ft>zZCB; z_kP`qZ@!6rZ$+v;+v$+RDbjTQu9v@DV}@cTU;=&?Bq&abZVgOdAj?gjWtOD;_Qckp z{ORaVtPa$4r`=-MgVOS0^h`!X|NMbLRyeZbpxhPFP10=l)$dwP{H~9{`uSI zfFHO5gNU14gda;JmIqFtfD}6N6*Z|1>y0)}1N)IFXBbDm#SOEkSn4?D7D7h@ zr*Yw#x<1W^u{Mw z>v_nWYmXIcd1K3$zX?39 zUf9Ak>%h}hJ|Sq_2S13`q^oX%nw@T> zdjkvN#C&aOL?6hHo;a~?C^{Bvg|LzhMbJs$afPeAa(oi-1-{bG=2gYZqc;&p?-bdB z@xES@i~p{faxVTWOXTS#Ar-G8LzZM3A-ghh^EB+-F-U&8l~G_evRHxGqmf@$IP~O6 z+(?8bVEFNmbe|LhQHO^Z`l-Pe2y}e((6*{gWwe@DNBH(o91JS*h<@p3%0cv_!I?tq;M=W-O6vskv z&E9U~5R58g^L78_9g?x1)h6OAt0F{;LvyMwDgNv2_ruTw8lzmOCoU;kbxkd{(6u)Y z4|o)gbGM6mOyac^Eg}A+niZ>wwE$|oh2_b9V#rJnaGEW?K@&ia(!VW1yMHc9NU$>t z66}lDvYJw14?d;lr^Xs3=Ik=TbJh9qqi0=<5#RUKmg|3-1q>XO^}pcO~0XMogDOUWtlIdazAdL#b4Pz+hV=%o3jCaik8{opT*l z4w-B6_p5W@Xaf@wv7Nv=SaWB)uL#HZt$l??>3v*>c+@@$KIB*f6v;!)v4t+|cB99g zNXG%J-d+t}NhkB1&eP;z>@Q013Z{9LaJ)%)9A_Bx;JA;l4k7o3V(5KR0(XdUNL(e{ zbFmv~ml_24Aei8Dxk`}Ey7)DaUR{0J-OP)uu)AzRtr+t<-HyfxZ+rGd4&ENgV?GV2 z_SF?9+E2c2S}nS0KTuzn>saq@(gxyVivwWX%m2hz>p#iF6JH?b5U@_*Z{9P!LebEa zi#y|LqhyZT48pVKR4z>-)Vckk9ojS<~_Lp+$K4g_>ncF0mLv@N%^8ZiqE^0D1vNT*l@B4AVf2k`j*(g=DAWaS>f$NKW>$zV%hI?~& zxNkpN4g@C(*Uxsac{41qTHtWc(+<X=VGb?dL5sdlomvR?NIRo6IG z)X9*95*FMPU7&)*xCCu+PgM8>+nB<)M9PF6P>vGhTaVCRNV^vbVE_b8>B`dQzPrNB zCvK8Zr8lX8)aMRKLq|Ek*l&C9SMn-U4uGi|fXC-c(Y8#mU=cahL4XcYK6wt<0fi8V z-}rk3cP`;4ThIz&9iI;j(5`#vcC}EY>@k2KQi+y_C1BK=_a`359Rn1rzT; zxryUBL9(Rw%5kq%nvt+@k2=1QrYf8;I*-OomMlm$5+YpSJY;Nt#nsbbmIRxw@tk6F zO;Y*+uOX%|MLOK;-gD(dM!84%OFf}C(=zf*LGd}0+Ujtw3_K&9X5MxWUR4+;9aR7H z{0Y3r4P^plq-V&hUH9I^YL#+dz;UM5cCBM$F%6qYjd}tFuzirloU%=NsUAuHd~XBy zd5P=eZcYqq&72I!_~D`jAh0z0R*w~}%Pb(I^n?chfC*V{UEO| z3=s}iM6NCP(;n^G{==AflSHdanQS-^0{sk2>7!EIYR;G#B`q;AQvSjg=$Cqc$u z40((m)q}*YZ!SnKNPy7r)2^gJo>iOfJwvRae*DqtYo%ZpHNt0$GR=Kt!9?deZWPbK z)AW&_Bc!@zGZUPD60JZ3qeq(WYx=N$$odSZzx>V^ZPKMvaIZHXh1wzi$Nm{>~Wf0ATH$|jR zD2DCGJj~w<7>dcsylf;C>@;viFIwoxc;HbtlPCIYItlC}+DQkyo5{M#6U2mBBWuKb zeC1a#L2h}LJsrjDHF5~79av->Yb@yT!|y)kKFJfro8oy{bRvNiz`6uL5z(J<`vEQk zOkJ{<_V-(Z_P<{V7_rs4(i4QQeb9?z?>BT0wA>NI!fr222Cwr`#S`7A^KjFPJvI(X z_i)Blx++o5QcY7Bl#+Ahw=|>2T4r|WyjX_Z@3{Bccn(d%R=X}mzw|*mhAQD!wxZTM zlBV83&mj9x@>CxLUNl}Oz^2k4$7L%QDBAhK12dZp0Vl3@Su?@;7}u8Tvi$jj(jaDy zme6ekgVCJ-wVLSDhKn@Te}$J5^=9&Pgwn-0r+dD$YI}Og5LH?#xb`HvyUk`@z^nc>QzG}AskLfC}--ax8%4L$-`$djasl5eRhDv@Fm5@N^JfVY3e z0pRv$lnUuksNlTYF|MM(7R(1Tt|JGDLZRz2N+GN*gzV-PMM1^8-M;{LqkNL3+8hh6 zW07O;^~Pn~V{odh9qH>Y* z&-@!-cSQ@!Z1iSZ_V>8ii4UQ)$!LXq;I5#B@EQ?ovc(6PR-X!RD4$+HqFbzbzTHQ0 zL*j__7l9@hl;_ZXRbeBKRnpxC#u#M)4#ux+i8@ZxaTSU^X=v4Ei_Yg=jFz>2>H_%QkscY^(plbtB(gUaH<}@CBC2WX*cTl&&UZlz{t%Y!b!<_{ zmBH337rZR(Gefk{-TCzo{73qsOEq>=l)^&7)mk`}sn(Owh1!zSFWzn}%b8^|=|iy? zAFim*7(HJm$U+AXd@9Y!a9-kR#(?Z5Y0S8@OaCE5Rw!|OKd0SRi_#!YxO|n~%BiU) zJUuwxtP#jClq!BNJOztx%SZX)RY?XE-^cZzPxS^fjb4JC13QZL*QC!tPk!S9IN0df zBc*k^GwP=;R&_e7nliH54b6ocb1EwvUIVmLC=4*K=~!F`D18fG{2J^c61Ry5vws2z z3dY)&hkP?_fR&t^<-0W=cE4n%Yl&Mn+wDg$eSR7t_Ka>1u~he%+Z1xFDuLrRm=UW4 zAk$_PsaWp{K~5W5i7Q2X4|>Z!s+4pxg)+OjL8jCDdWVgSHu$Jcc|E(*1v;bZ06y*fu_>Gi9|%d5c|g4eLf>=>Ux zK^u|1IwYS$c@YO4`B*vxF1xj~MW91Nr11a^iEJhjb{;m195(0HTUFvn&G;&8^{Ohu6mQ}S zy#X2`Iq}yjMKOh83fnZis}w+UIs$UVnh9J4Zb2Kx!!BKk&*AxkBK2)iUK$G%r~E@` zMTnNxI0XPpxn%Z~z%vl1EhCkwbwo!)2T?Bk%r#2ZdRs3XvXhFFAK{}*uN_PKl3f6g ze(x12;(JCf$0CtT{y2S5MuHo~}L-hE%9ts(7O8Dw)KiYuc z&?!_>&pptDlsZtMk;6R2#z}VkESj2sSTnBw)McVELB{!P$k1n(nVIi6HnFWK=I5_E z16I_;@y2c+LG8o;0){|&zt$!C2hCSPNIX$dx=DL8QzckVTQwHAyVDVsU2{0hQW7MX*3VW!VCN6hiR7F^82}lh@EYtQdCP``g`lhbtJ%UfyDb({Y2& zl@7>2p+gy&;a$Uz9PGo}#E=4YuFTD>rq*M*?oT_$2WY!l>%naRCpY9N1Yf+j-J#T8 z$*StXn0sYAYr3wy!I|~DJA%&XZubUrh!{Q)g|Si#mQ!FzqwjmtvLb7{V#g4$+-Aom zydIOIYj@iZ1;a-_d>{h=`KE*|2AMJ-#$bU7A8^UHZONlIY#;|^4#d)|swVMaIk4+{ZraG!vjCT-p%ZqTEuUOMDQUo9sT7+dGdy~D?D5=e zcila{C#xHF!hGTmw)cl6sS7t(qri9_tk62k(qp`0JBkHJz%wpx#>;8|GcLvL-#Ddu zX*)QyP)uBih=m_Loi@cPniz$=gD=c5+J}sn>4x054UI z(R^CHYdNqeYz5%zuwHmNz9Y5OLPfZ51J$hVo|)spE8?aF0oYRr8v^Z4Na7d)HSHDz zQgYf>WRy{GaT*RnB2dA)o@qk>>vA%|`@AosG7!Fwf99jH?h;gfT8hp&emE!*HA z!T$;d(D3jFt8MQKiL0xQQ$ybH5#2l8>+fFbt@P*W zGYMM9hsVINCEH2>W(axj(>UWIows1j?!Pr|66LU%M~8Kc%$Kuzqcv8u0T0@fFiUg)9N6nG5}x1NFuO>=f59iq^H z3}AFSx^3J6)vjy7nUaJ<*<$dpIqlwW%jFloK0y_(8yaS43dV~Dukf@BKBNO)!>Q|b&yuaRZ^FA-Yk})yOiQvwL6p1 zSa9$$*J{8-S0kBVcruo~pC$>&bg? zyj%!%hHRaVy1YYgk9BP;;Hc>vxU-PL*9@m>n&)+PRRtb1-53$cFbw#I+V!VZG>pIm zEjCeCXbpt3d`|;hHMz46Y3gsGa1ba6_zr`FF78%=j;_FhfUZ}3becC&MfxIE*}EU1CN*@gomaU>Qr6G%3(j4J{V z10+!bkPx(DA;204A{Idr#Th`f+>IjeA|w!`lz{{!Ew?0zg9$=JND~aeP=XR9f?~uV zZ8!rF84*%KF)$_~mOM!oh>5mYguH0R!9_G2A~_O(I1y+f;9NFvBEhNJ~+Z18|mtD+mn10ZKOv2>?SF z8-?Ko6pC$!0a8X0Q8LtOB4RM%0kWeqC?o_%gph!MLNrSTMBM_#`5Fr#H76eR2)FsR^79?p!88S$TO$Z7_ z!xCmPfGoyRFox1ikp>3hf)Ye&I1>%TW+h$w%w%y(O{XO2yT{|P}>(cpN?@8aSHCsDerf8cXw*MwcDz-80&iO z?n#qYbKQ}?aklyE=^a-$RQ4`O4ISN)&2P4p$(waS=We~nuGYymy0dm?T6);psW?#w z&q--j?mcul?cIecxl1kbI^c)4n|(I=Hu!gMbd9|3lec%fuI}%`J&pI2iF=+=(O zgBuly0k!8cyt;-Q6KE-)3Zu^BH$$yRptSHzZwEB+Kl~-tOJmB%6nb ztiih%8g-`adj#NlAbSQ~Z)Wa^B!i}sW6altOv>859lc?ty5DwZWib-WTa~&R%g~6T zo5_!)l1U>>kQ=5+ARjzzd!CoutW5QnHjr zIyoAEbtT=;w|94UyJW|7tFv!*MM%nTDywyE)NnjiaqY(Pvo&z;S5KVn-55AChm9+@ z-9TUz{a%ARiN}4G@l@>Ioy6d~v3cFx-B#{nZtk^fyVrBN_a4e`Cf=5#RhGlhGA&lS zPHm+6y0ypCce}GQGDiEeHnY>*U1kb;=4L*sw6{6;btT=KqD_4BGE2Uh8@gFLre&DO(jr0(s|(%rq? z-tO+{Gc&rkw`sc3H=b2gN)dZ9^Q}C}dfU64+uiKUv1*DtOmpr-Z{ zd^kL`w(kVW>hK4uhdtXN?INwdm9;Azs@Eu&)}C=WF87aj6Qa4A?GfF*>CNQa?C0IO z;LOooa%ADmcT-Bm?q_c9?)2_m-QC>#yQGxcm)+gh)r-5jO_E7>cXCNLvpW4^?YP@= zMcvyjdQVrUq}{nCPTkw>l_tLFRk?e+y?xCt?aj%FWrvZ~W^C@w-Hu-OW{a)4R@{#> z2Ijr(VmwmwyC-yYn(MZzx~jVN)3ml?!JQsd3g+v%T(@y2D!4Jc)$~s@o;`F+wTRie zmz_s#<=wRgu9}81T<*j!-E_k!GP<1uOzC$Iy*gEh+L(uT+S;k zS=CC|b{XqES2+!%G~KoAp6@K4zfW(wm$vCQd0Z*=Uq{zO(I!(Xt8DFqqj_#@n%ix@ z?%k4B-QMo^cXwu8-*-vO)itV1&Pn!ZF7LN$wCa`FmY~;_>b=oa-&J<*^=dsOZ3=mH zSUWSMk+Z<^n3BN5aE#3G8(cGAhG{Hw>)F`Q2CEn(7j-SWkXYa|b==r-*J+nlZ88Rs z=!HRr-DLE35N5G0H9tWDL(%y>?+!EL2&YVb*L;_`!K%g(+?Q=?52ozTz41Nquzb5d z#^=d|=#(A$PUIT~`mXrpwrllJbP1v>CAnv z#%5*{y5ztCCVjoGVes@&b0cc#{=xLS=|uOYV9C_;gY{nTXNR{^?bz<0z2Ln2Z-v+- zXSt9$i(9?|si&4Tj{)V5t?0?CN`OZs5rN<|hn<;t4`mx5K^4RAd){nX4)$$VmCyrN zUe0)9sjBzh1aL;7uC6W2UI#$UJYj@S3bJoS=={BTExfHpz0{z<2i4O%&CQGq98bGF z#|PLxt?&ccyD)fEas!lIm!}RI90Gg1Vf)%%XnH4LJfagzzeWL}DL4|u>-Fbrt32&|T?ySE8>X z-)O7T*ekns#LKFgLc(J`2(H0{IgNnTw)m@Yx>qi)CzFl%4Ou{h{YD$W+a4aG-lJK| z4#BnI?+QzJXI@Eytb5+W$pT)nzB>Wgp&c6XPjAR4*~6g`PXY&u}Px>4KsGUCoJtcuZHhf z0283#wcwC3d&5)nV|z!M3V;Cj14FcZ@ZSqoDVqsS;iNBbgNMcpy=N$N_H_)RhBM-K zSh`kV`+d-Z$9PAW8&*aJVl{nsF?+B>o9{o4Mv@5+xlw zPK+5a;Ehf_(Zn9>hiZ9Uw_+O1-Ubr;yWeS7&ma^t-meA#AAH+Aqizfy_OU5hfu)z^ zO^X1sSRb{F0%heJ)fn)}r1!(`pTpU)!P+z`He2+;gX2NKVi%CX$vNJQC#y~l&FpJp zXy#^Q=dABQ?a`Pu3zNe8fQ=Nqzys=mA6p^W7#K3OwGuEvHbLxU$+zzeo*WW));x(C zvRXdy0}+f>Y|H}_Txo|eV9g(EB}4$Hg$-`dXWcV1JAKoL8H4BDFV*H?)S*6m8F6vJ zB^bp&YWKPM;9KyZjOYVqZUw%2cn9H?M0ca+GM9njH=l+)Vyih;?b88BKx0^5=a+}0 zGc4uhU?Y$Lt782(vol2M9`bG5!qs>P24UlKrD0)c%{wdoRPlYuc9L z+XTL=hTP2XfsD5u33N|@8QtYV!s4Zc@MiQMaO^2CR4ieAvmDYeYgv9P-^+wscO-(j6kV+9AW7zG__Mq6w?l zHxBQfYSbp`wCh|YGl28=yf!*g31E8&P6a}4tDYKwWN^LAPRG8Pli}dUyqB(>YP z#==CtMh0`M8KUZ&4dPeJ+o9sCMq!~^GX1v47n$7HPY_*r=wEv_+}+@W^}fI<>#$2X zVy)%f=OIbFk-z`~@IjJw$tw3mLFU>+m)kcDxjp4>q-<<=ex=syD5~o7#ktwFfIU$A z3ppyFk8gc`^6VZX24~htAw*+WMt3i!Ry!#cYYfab(gVDyFvxD)Qw|Iny@=}8DW7;j zu&2`i0QLJlJ=_C5xTx4W(Un>`OCXRuGKUpH(!$iTmPd{Z%~m){KOE3-Mb-wn)nvi8 zmThE*5Z_swcdJ~pj{OSMGrl_sBL-|i+WICE7zm$qK+=j-4Ar88DB8Ltj3eGh4+19{Q}#N0F-lL%r^mkciR2GB5}Z5PS$DrcMK^D2frhl#fuG?j8ch zn~=G=qK;L}Gp`1_+N*N5^UQj28@+Z5J;KB>aqZn_GDdK@59Ye3Zp4XRJWmxFCPNA>E!iip0Cif>>tYh>H z3l-G{=+l5uTGtMi@}S8xRQ8I_ylPnqZouBotk7Q1Z?Dx%0M$b7rcQci-y`b4WrkpD z$L|hQGz+uY1WH4CEpl|Igw);U3L@yg+BT+Qt80Adi% zdOUJyTJOZ*JQOvox= z#Isemb=}x+guDWFI-(bc7kemAw$}x}WyusAdCIz?^DzB@5jdrTchgh7pba~{T=$N= z!I|9f@Ijtk({HRBH|@|o0~y!4J1x&(Bh1|iFIQX`J>loFAb6UYcYx)OT`B2QQ9TXl0J6x^yPOVQj0csw%WMIqL2O;V{=;aR?L(6t_)#z_Fb^C^; zO;|NrD09bo+1uOL_-z{Hn$g6vC;S$IT zmh7SBnPmyYdO>Ot#4*-519*K!0|WQH^nfw!w&%XwJnG|nt5P^Ms%zct>g`Xl%(b;d zTMpIg_iLnS2%+5LI`=xPKMW%m4+44Kmx~7{X$V%juWx%gpui0d+et3E;yY~bb#9?z z$A`VWo$THYcyOF9%7$g-I~aQr9YoD{Nj|z9mL1;Op~ENzFNWQX??dV)0c^9@0hsiB zDaoGbNceny=r=BU1I^g5Jtvh-zYrtN6DB&kg%sQ!wUyv2!9Q`}Dm`F|zX3=~J6Z1Y ze(XcWonDirJ43V#5sY^;JJa3)?zDlaeQMtVIB#Zik(%(R#nWDwRe58=gpezv#)j(L z748Q>zThLBr&XJ1N+L`klYUq|q~7$|dM=K5um$y023mICXKLG2FM+pjL6Pz83d-rn zddDwV$WX}j24<(i_mK1D^oOU|SPu5sa1-Hf`kN5uJ)PY(Y&yXrC+fl7DS|zlsPXa4 z-i&XkVFs;sx&a?E*?VU<6*bS}ffza->hY z4F^V#Lrh%u8GT;xT4+4ksfpVF(l2|}Ql77P0CxLmcHO!edq{Y?Z+(8m@fgO$kCl9uV9dx^FfwRI0mL2b|JOw+r7bRVBSy$M{dw8Dk0Fm zcxQ}RJ>l;U1K#=3fyNlY5cu!;X!_C%^^^Ce{`!3&rZ2N4TD#drQUpF(PV;kPO(q7# zhSz2fzQs({Q7h$7R=>7q$42Pan9%85mdiuHg_f84*Tc%1G_4O>h<7JYR?hinV1oI09^WhaP4WAc6xNJ#_3%0frHzlO`|rMw?ypwZ`F&Oy?e4Pk zEZtlAbYCfvZvEZ@gc*#FU&yZm-%Z$Utw%ETeA2OZ#A#dS+!o+UkcrbU{$es6Lh^H` z=Q2QdF?KLPYV$Jwv@+2wplcoGb8~lBZ3FvH9W~OQUaxP;jp7da8wl$Akk*G3E(!DUS3}?3DfMGmPNh9FU`Odm z-`X|W8EfZWT)HRm%G1TKpS{$anX1blL-O~n6M1SXy;r|g?>>@BUs*f6?Z)4B?(90W z=ibr~S5^>>wM?F9JV48&2m>t$Gi*A4V9I|C`gcqF=f(?tgDp|7zSZ}~_w(}gKR*d~ zSJG2>LupDI!8^;zxH>zo>*rw&lrpMpc9uJ=69)WvHV49D4YewcX@qLoa!F_p`M{4(1Zq%Nl zUl4<`MKGGg`-SUdJm#&&U2U!IgfM_G2t*h_?p=li6!hUveathRS_?irl)87`mfl^K z^JsV-F0N$-gHU3H;5yVUl<I0YqO72B9cQLSRU!DG~Hz zvq)mGBS_Fzuhuo=+>*MBHoWYLGN)1|3O7}hn}b)pH>|Tao7?FE>}(neC=B;|m3KxM zLK_+!A;~46eiilI-E)J0`S+nGjr4Re9&A3%0C^A(#|EeoVMt_zF(bK(B#;hTjy(kr(l|ip?WFf3!DUg$h@!XER?@ie zjR(dnZ$7+R;C_5A`M>kl)$mXPnntE6HvQ|)?L8^Q()UZbp6yyr?bvwHGD79!r+hzp z8TZR@mmbmKQ2WQ86fmz6y?An!x<0wXAwv|F`(8=4*YyrgUQR+p6_!2<^<Dzw?x)`C94C*ar&IHiC6@sqT?+>gp4G!6I z@c^yn$+x3kDcG`}pI$1$avENiD%?`%-Iq1Dy}P^Ub!hvvYVFP4 z`ArFWKtG=GuUQ2{PM4#YPAUk|~63+J3V=Qup)KDL1;>rbC2 zL8=CVRRgH`)^?+YD5vxS$qIqLooE0PY=sJ`Fe(|d5l2L%N{Rb(7yz1NX%R2#&@F^e zU0^-2QD~9sduXpjhz8!=5KRywJ>LWR3PORBM$$=RY9b%YR=)mydbYox-`nN%Nux-_ zAt|QclAgPbkWI&NJdpcZgQ>(0Qt}VDs)O%w3`{{5&>Pp^?I@4(NDAh8VdMlyL_tu{ zMNldVEwtUxbRWF?24UT6xLO`u`C3Pu%lY4Hb**%M}py?aORLM((p83jH94!%8qFVp+=ukZ7GnIk~V z%1}%qq9~xBR7>JF9=y9ae`XJ?x`V4eo`LgVYIto#AB2Q5fDnCULl7Wq&bLyFZ1ers zoPZTgigizv0iSR-Z6oa#o1nze-)e7)>mN`>Q1|(TDM*zH1c@9GU7r`@=93J>%<%bB zHANIn6;;r$Ve&kVKLKy&qxsXdO8J4F4b>P#jMD>*mjIs)C92AL@dr zC`cm|Q{nHY!|}bp8G=e_rXrGVfIglH_RE-K{dxSE_n7>?{m)?f_nQeKi20m5+oz#e zQbG;Ih((7kjEE4MLy|OP$O0jOE)c9T#Gwoz;WLGc88Rl4wIrGfOh$uAQcZZe+lhj1 zVb^q{F5D!?4K#xhxa*6YsK`m*!DIvAeX7Qc^XqAUXy|rIr0&_-d#hj7MNHIX5TjB0 zh=*N&eE!-A`}f75DT0U~qLNxbiY1?#-`d|T;`{16IHusf??T^aZK4p@?=Luk0wjut z$blRf^Ou4++-C#`Y=lrmQleW#5u(UC1WgVSH)^`-?XHz2wxzf-V9I1tl1V9Op_WA@ zaMFstRz5Wl#pI`Sh{PwZW>lig+pDsYmzJih%^j=3HkEt*yuTk zBWPZ|&zEa`YvjFq{^YGwGcXB32%`wCDYHhB#WASJL|4=S@L!)j$oo0846JQdk=v_X zUzOr$8JNU|X&VA2HU~o^DG3P*2j=wq1{9*afsuTlqIn*@M6c7>{JQM<-9 z>rT%@`e-Sbs*)+BvRaK}WULyaBSR1|3auc_w2(>_^i&_-lbt+}&(vfjqV!a(WlO+@ z6dL#5JoFXw*N$ACc%#mvu-mcRgQyUUw=PgcDA3>qV}#UhK~@21A+uSo6M&h4REhx5 ztEJ(XY{H=gupAg9xE-dTXl&zH%NPhP3LZiYnXDu?;LroV-2Z-Lrpi1u_C~X1OW38 zIIxhncP?KF(jL}u=aGsKW(#5k$^x_om`Fw%ts=5)Dd;F`4pPSe z7ruH2k=>o)?%Usg@ytY}!zf?NpTA~)E=K&vzQijaU>Vur&B%@!5io&tO8llxR7W^G z)Ysow-71ICT?((B{MXf))tg6sj!W3|(`u-()^7YCgw<4CKfc)aXytB)9ZbidFS*Ax zUiQ~-z&1Bdwvwf|zV>;)z1v1vUwxeRg`JsEYBWvGsL}PQ4*l-B>%{gy7K3_;CwQzI z%yzw9y#^+Q3ALYPcKA`-`{XkEvli#og)FR;l>5Gy<+j%DwV8Y$`Q27gshbCg z@!^^3OMbzbpJY;5hx6sv=iTAW)#dtaxpIhzsNl+qGNVxg1MLHjL{Q3%Ol3iosZ9hV zOa!uL9dz~0+Y>_s`peX88b*%7J2x(PJg_l8v56DM+0@ z`veqF@4oZq68SkzMMi6_5p9i2A?5HLH&0>b=`@xYbnEr)d!s6`dD#Cy{yI zb&r)cg8#6$zL{Cmv zgL4TE9QOmq2yMg`JUAde3A8|<`XHGEaJ9Ll%4#ZRo~(_wTGN5Fq}`Vpa^Re%VUI5J z3U{7%`a2MrR6$k!Uto9F*B;%+5bh8@$?%oq>&+CaLLKV^OS_lr`^+!oZ{mdX5ANYz z7uWYasrGel()ssuo7MM8bO@8O?QX-HQ|!I$wn+Ed^HblK9lgJ?-(I`T+`O4qXVS0X zcYC*c+mqPD`8xI)Jod4^`gD>L+tjdq_iNgJTIHNt%=t=F2i07*D!%=7NIw|7d`c)0 z2sr%78Y4J@cgxJj8$^6pIOAxtQ1V&45GS@5NfjWBqJX5+j*SJNw2nFM?+<$DK^u-j zr?!p;%RXhKRZvEWt=pS6ZJb$PD@5i>hDeDBo!6MaM@8JDz?-BO$F!wy&Wdz#-Wn=< z5^GvNZ+%@H6Cnp&#@uCUeu?8koq^fZfkc9^-avx}WMX1mMv>IkbAdqdLz;7O<0FbZ zbAh~sgSG{zMHbCm@X;^^2njdcf=XwniyFPt(VeF?uw{Vi(ko2w>o8vVLR>?fQTL=l zBIvZXG1`Sxim~A=QC!rByDoqqMz01>+szsS;=9EsZ8v~f6)OC+Q)u);`5;5eA31JIfT zB2kD)oB{-lCgPJ;lBNlhY?ef}+or2PvTFpi8>@tu@T6FniisMfnXTwSxZIp}B;i#- z6;XMI5WO-bYa**fp+zP*e|OJ@-iCAOnWjkF3AT!{QE0Yh z7A$R1qS3G+BM6!m9((*=9$+uu<>nKQB}$N#=Br5rrN+SRguvrF36LA`sCGSzGQUJT z{1SuD6z~Q9Z&x1=bQ*W(H4+r|oE8WM0Fen2LI=YU#E}df3;Q0J1OP1)ECp;8y^$LQxDW!BUF!f-0ZnN_C^7f=j3ZHs zvRXBwqSYELV`(cEq^d0@#U+&5wiK|D2@r%zL^K=#L$3M*-@tt$nEkr`Ygc)>o#+vA zGOCJ=Nh-30j3iS`(b}NJdDt{;;^2Kd}kVe3FKBfv75CSOLWs6|~ zAxNf20ODvs(gtR*Tw9?EU?4>k9MD4masZG3)|(YZ*aQS!9|W*LvpXrQud6>9ZujDJt{{%^kGzfbV^ zh=`&OlbNYSSjuHADil>w2p>^j=b_G1_Gh~{j_t8;nhp`%^&AntN6Le`%-AU5Hp|u9 zb#)~rW(!o?`_6@uN-81OfGTo92}2Q?uI|Wa$SH_JPWJg~`qKiyI|Bu9g%U)6jt{3t z1$aau*G7fY3PKoyI3Qv`NR$Qnf|x-7fTkv_5VZ?LGt2O&zT;KG(G02}{bx1X0pnM@<_yZM5!~E7Z zF_g|0Vj5~)?olETTsTuss{|lmfj|}y^pSQSbR(b)Q|7Qh#7rm_phajd#8TKH09!_c z3Sc7?N)P3T7X(rww!G7VI6zh?mxxXKp-l^+p$bS6n6JO!QnM5RLWE5K5hBXklG9`|;Cd>H>n^M6mD)A2*1EZC()p@f8)MO8+00X{Ekiq%~H zbGprI+de?VcGqw*^I{?C1L)!KTnGqEFff6HLNJa2|5Oz;;wpZ3Np{ejjV)sYM)z2~@DaL}^Mwgeg*lq!gqAwT(v6YK^NKTE#}TD^yjrjjL)W zb+)mCY=Bw-W)XD=WDN;IRVpDcWDAmuNF>Ur(yK^490db`0|JB~K?+J7zzPT<6f%XV z2*d)f`+}G)I&4D7K{Hxc0StnX281zAe1O2vx)>x=L#>oxDqy2Qm=tLFuwH@?WkY8U zlMnHJLX-g#!&)^ZGicVys%2EBqA^Krii=uHCW}R|5P-;wwL#Xr`Qh>h-P!u6KY*uz zegY}sOemnGDnl}jp@x!(%JESSKhLLmNhi9M2)D6H6WTV{C;PFS`C z6<8=6Hc#Ll!bC_wbXJ+DjAYv;sJ6*PV?=8yq^!x62~mk-1`#0<(5U+UlSgjJ{j$&C z8Bl-QZL#J*e&$PAMYRzHW|oZDW{DOnHl)nSI*~ob+wc9qpHG?F>l^3x>J8A3Ek46? zqWu{82I7WG@(|RwYN_;;gzg`tDG){epj}g$S}elNIf@tHaO7pEOr>%%q1d5}07?hn z4w-%%|=8;BS2f~w%3o!9|7u5Gh2Osz(IRBP4+V^jI%6drD2&E8gC33`}_UmCjNf; z{rCNMf3Y!ZpcEaH2oJzdf`kYJ6+hV&U!q28XuVeg+X8|UmS~!Sl1c+&Iv{{Q(kc6! z1TaGt-Y8ZAtAKz}`YM(nSOo~#1aU#Z9AKmoyV2bWIuz1Sfk6R^lnvOei*9VA01SX3 z6dFXJ8V0sOaqsj<3QA@+l&DNuF($B4BPM2mS!DHVTl4epL`a{1jy42=eT9{4tgOl} zA!b%(Ra0yb$bhA@F@c6)2n4Kw9H%HEK-f+;>i`L2R>(yZ!U|A;5tY0YphKt#49dW3 z9e~^s8s&&>3E3{}kmIYI-fuD^LfbHk0FW#IAaNImA%-~=$7>XZledzZWD?-ndi0y9(kd1sXMt#qla}m!1F?3+k7yfW_)))j%>mGrR+}*O`%ErSSg2q z#5L1kR7Ym@-mBd&H>%QcxNBwfvw&!%7gaanKDNU?G?Gak&$4)C4sg+n_t}+Qf3K0x*O`s#7!Sqb7?)(y`gM2Cwb>->`Hz~j?{W8;9qvw@5kF2XXlFkt+c7X1TkSJoq)66~*@YI``N%#$m`8H_##5gOUZ0{rj${ND zw6{|Zc%ixw-sgjUJ$~AYt7`Wcv9A8ydiJ=h@-_*gk@#i1+VYxpr1Qy(9oMqn;3MP^ zy!s61mGHB>ARv*)@eGnql$$}|Me1)qcrm(=yu7uY$yx@=Ix_yF(aa%9B&@rb-6V$* zsmT8NBkM1EOz))KVu(14w~mriyLVs^NS+`hJvu?4R)~T7QAj?^r3w98@mRlmxvJzij=JmW?`mkT# zKXmC3-U}~8BUKEguJ3&_2&(5Hh7jF#K&!V1tOlFWj8*S$oTWsg>c`}|`3}9y~ zFRWI{;4MzOi!r^Zi71k^b6D@84SKZxx;zH9D&V}mq5ud1awR63h1@mO$hM;?F5Pry z$)jbFZtTvchzSN#(vwW6LB#Z(m>M@F62MYSh#hxaI!)Jx2SVtia!Vmen&%6PL@2fZ=^q6StxKQhq8BC!VQKGbti=rvL;=VqIyWUaL`0C>7xfkoYwH~rabTfoCRMstZ%po)6jYVES3!ay;TkMU2wwafVIA%7-FfGp8^VeXpLMPCKiAY> zXsKo*AfggSI8X)qB5MkwC5mEFL?|HyN|tp+sfIj8+?RXd4m^N_7$hdr!pLYOgfO=f zNq)bov-3PEww%fG(J+1W)cS=*gnh%q=XBtT`R{A*IotPrdzV%nuWIGoH7d_9d_D_) z?fXTRhYi&;>Pu{g@qF`+bLz~PhuKlLlXTmLWGP~5^eGs41_8C*IsuNVX8rcgoHXWR z>Ck3i%vMS%E6W+Le(#umdS|xxdoMZ;J>Mp*Q0jVpL~5q{s`?Z|9_%DSJfn)Kj-(0C z#vxbVUNGMvvPQuw6gPU6J);94!zv6Ufgr@JUWzo~q(kB*qrK`b&p-k9F>}G@kf)7H zj_c_+y3w$$!K}&$1 zUG!oj?zUvNQBgsS655{Kp+p5eccx!5}G-!kYD9Ys#@00vTSaI#vu(V8i+s#MGbUM-YZ@t5)RHL3vcf2$XsLths;|Ab&qY3a zU$bB0f>1x-=o#Pepgt$3vZYEQD$LVpgmtN;X{8mBhg6}BNuU6C^?By6KgDwjnMOg^ z&Vpy&9CMrRoU8-x#1r8J0uWG48f2M7kz}N@mT!OI?lYq9%LQdol`1LZ!kc@ z0xS^@=tQwn)hfv&V75UP0+ycGCBOlKE$!aE>=R;a*cJhBL}G2fb^Z#B)TF~K(t@T# zAw)F|F{D-f*Y%cvpXx7D=KsN6t*gi9-5P_0Q@NK2;w9bKX1Svd>P^F>QWPYBh*1Vd zYAUFhDI}0$gli}Yva-1S&)wp1(1S2FVBL96qY)5Md zLZ4^?k`WDZz_thkL_LSP0Q2rG;UJkpTMt4j3$UDWKy(>TO^gKMJWIzQmd^h?3R=*j z=ZMc2ZbZ$dY!9Kz0(yhfWsV#or&5r|0N;17X|^+bJYkmlj37W!k%I zMBbcK#~;Qus$AX!VRa)=JViZK98fz5`QJP~;Aq;>XU>J>q>>dW5=6vQ!80RBNhK*o z{`CE>d6l;7cbkr*?R==&y-__pJ)%&wx!WJ!%qY1jRkVeA8?LR$Q7MBJiBt}O{qMdj zw8NBF>n*c)b!tx~hOoX`U`z{Y%+hMgt2_~X6dwP5J9=N_x%YQ;#Q|n0aj@{_ELH8_BP zuwEw0Ad>0G8OR6(nv|>oP5{mU8UY%`7Z6U{O2rN$YQV4uiC2w+a#YJf7iXN_7Ewh! z&x6gphaSg|Pg{iWw;W16ZRbdxyzc78^lv-2K6Tv)*=osScrya5+-7DK1QM`@3W*`` zal}WK-1x41_m2-3(d0l=95{_=WO%WJ(6WZHO8_|l0993(&U@kB_lF>K`{~{XnFG^? zXx6|Jf^v6gw77}eaM8wH-Kr!6(4$1@Mv6wIRI5!ANK&MXQ0$tlqQfC73L+YDB@sZ{ z!psiR5&{{}B)bKY%ZXrPW(AF~lGP=fB#EO50^{F?0)yx3#EGlE>+u$$(i6^xfXryw z%g#^O;2=s3nZ0ws2aF61gO-!5KzJ4b(1eY4VA%NiOy1%l3nysE?*gY18GvCwJDG!k zBS6kM%pU7#vUh7nCPy!|d3dnOA45fR+Kd^10gpYNT-a!us-i;2^fy`B+4}Q@-?|?+ zdZOD|_Z~HxsamwK9^<2gZOIeMvE8!iBuXZMS|;vZ>@jNX8&U|cnhx(C(fdX*uXED? zTR^10U6ptC43F3ItWT%K=QJ|?m{nJ5h-f2@Zhg~6s>^E*(!^^rkJZJ~6Q^#9&prD$ zer+$cC-%wrZVOx8CvR=uhn(fzr6y4XeK+gj_kBa`%(t^`)6I^g&zT8yVqE4n_W{_l*zzMnd$N4CKi z*7VAiMsQmj4siIdXz92``+Q{U9KIYHOhN#I22W{OWD|zJySI(>Opbge@~n=am6tbb zWQeqmP+sbN*;)bcwZ*5tlLH9q8sXNw&fKayqCR(e-d6S+SdmeL5rG5=*@7M=T1i|k z$-&Z`IaVQs5Ie_QflXb*h;XYS!WJx|4_)fgcBDxRXu!e%ATW*}B5)8!QvnPt;5Mx* z$C|q?>cHJmP^dZ*1#*d0LJv$`g^iXWnkH{m%}!*^O=#F~K+uvUhYglA9R|U| z01%iDz>mu`{2;e1A7>Dsh^L18EswDg;9=T+RrCmP+i8bN4}TQ9Um@^r_&(>|gXc1W zoqfC6IQ;&r5=gCPUtUutZfUI;qJ14gJnL{(ROcSk5WI=q&z|11?tR_&-kO{GPWx`| z&R;&*VGAr^dn=SRTi83<@pMEolX42rzUF={sx%MJE8k0}oa9}I>uLvApUxK|X@}OU zS+X}plZaXYAb1voRAu^^c*S63`=_xwLLD`zrJiQ@I{nEbJpNH+^jY!52xM3n!x9p# z`Ya2}iE9VP7N4F@@L`s2%!k3ze02GO*B@NcxN*>%L~zK|>e7r-FTi}nYPU!PG$uz@U;4sYIgdQQ@I*oB|NfCRvau;Ux&?nPz8O&)8V zRn>Exwbtu1HX#8ZY&Z!b<#}FxtNTZr3VbmvZTwp>Z(L{V3oVJX3!pwKKU81a2j4!) z=8rG}K8i76aUm4BMKK`+kz`VvC2Y~C6^$b1)R}afQDtS3hF5R%eFypV-Rr*orSsaj z$ZjVfce1hx-%1{OSp(>y_lI#zRW(wqR7mPw=o5;n5F{QR7e1e%iu(c4VI5~aDr2r) zmbVXE+SY!a3&{%l_FY7Gu(QTUOci^GAPtv|nS_CKBqn`GDp(LmvkWyVzD4<0Q ztGamd|5#_ex$o}GkejSK?T0dwR)sw@ehuPhQMXRsv_U3BwSo(b{r5{uBcuq_KIX2S z5ThI{{AS>;w52AXz9UVxI^!;q+RP8!t=kMeqKg6VB5|LK34CbYURD|{N9;VY?;UIQ?_f`ka1!W%uG;Dz58O!{| zs$xV_(!p&&f@0K=1rhz;`ftjVA=}=~29q-?$lF)0+I=u6oh92&zPG3la3a2nw2ric zvOeQs=ARV5Q$I?Cs8tI(C`$^fEu@CiPF09Tx!!n5Y8W2o@ zp)-g2sZ|oP=ptxS(#K(U5xL}bv}8q0s`Eo9r|enC6p%i0P*OvV=>ejEw=oTFB{)J) zS@gYF94|$b?L)*+`~LC!{69SY|3lG!IhN66qDiG|G6^KSmWBDhyMy>ks9~Xp2Yrt= z{{w@s^WTH8m=Q2Ou7e>Kkzs}eWS3cWNm*)A$0NU&HRCMMv|ICTlQAu%TFGptzCJs#kYeK4HjjM!5tL1$ztfsrZ_8*le%L!vw|@qVglHTb0Uyj6bZJ^-6N`QLsVmJt1* zI9ot+&i?7l%OyfhRW?RN38hgR_&;;+&xrWoi`vl7Yppng2gDu$0D>VBl>`V(L}L=T z4SxX=LKKOeKI5fsUM}ud0 z%KPf^!p*XerHE$%63k>QHKGWhl^8^1DZ?ZJ+VH>;s~Z6XNNIqm5m}VuVPiCy?96OJ z@Tpn=m@zon1m(!ELKsLPNW-`+JCJ<$a^tDbj*&yW@bkqx%2SB|g(YBQ3P1u7EL7x# z7#V8{^yx%dnam(gM?--JIGC3xXizeVK**&O>{wcoXIctDptC@bv}qNHt(`iYm8St_ z(}IAKn%11vC4_;INwFX2m(JKf!2bOC{K0&3FIF#j0zvO=2ptxm)4V`l0t&s=)a%Swfzj55aNK?1pC0YlBfh)lvrw+-HyThB z&_qyGkoUX*ssg8oCy_`JX%a%eT*7B}Y+MSPhW39Sef3qR4|ULPZI84zN8DK-B-Y`l zWcNWWSeV8Irz*2y;8tqeJSbqi+qAGmW8w%Sw367YfDvunt*L0;+`x3)i_v;a59Nzj)k5E3PQ;qhm-&B7i zsy`$)M;4dA*@gZ!5BotK!Y!qUcHW;1%?{o)LBlc}DO{XFgRrRFqNf z=-m0MGiY`FwtiMjs#Fhra~1vY%*^a-O+_w7&UY`aeH*&u{=n!GfGv#(UtaxvzY0Tl zVH+qJFs?&JH%9yqi&*__J9}4}9-W;EK#}PEJ-cRnGcbLaLaj_xfpb(b==ebUWiM?!{cca56O|WmMT#VDg5+| z4=_ag0OAG;2v`IWhy`lzuwRE6eLylbfMBlFHLlgb7As(7A%mC;)&S+sRe~M_h;~A9 z4oQ-^3DK9IxdwuSs4f=0!Bzjho+JCF3pe_a2=_Kg%oZmi_+qu(bK@gg_;{Y zC{2b15RWw_0fik45D;k4#tjYu^^az|W}9^8(n#Qiz&Ji0IjYT?sx{=&9-JWag%Rzo z>sr?VdCK92g^l%vo8@dnf`lOqNHGjae9h*ytPPOtgzS%zRWm-K$ruwT&^(xV@#kCe8fFraAk8ET=9H}s zP7p|>oigaC7f7$jg$LH~xd!sjAKvcr|Hwk?U_|e9v)%m+qaW; z{*qM>To0Cs?%im(v5OT>z9P(Z+f?g!=R5D4+)59b*RA8$d}JhXnj(O4QH2lBNsJ)nj6SzOdo`_S<9B_t4oJ@5%9z=1Fh)wXf#D2Td6nOTm(}tjfgk+Tj0Ism!`H~5umg^Et zN%Fg2x32DkYCuuMl%{<*V=OUJk+$sYeC!Y_^vkg;tyP}KExW0L)mwBr*qexMu1E79 z;C;~PL`G^97MN>9i?w!c&Jhmxx4{@6*BlSgQPQ=Ln+0*=w0r&Hv*rYzDw#Lc= zpS5ne0SFgqXi!mfX|?baK7qUl0rq^ke^%iOs+3eSO)5+&5HndDT8X3Na%c8_I|Pr~ zD}5@lp!5>F7Y}%T`-z2lK#;LaMIMJa*;Gsi-H+%V4H!MTe!klSgmX8quv7frsGH~H z`#T?B;Z}b`FNcf#77#|xrb?vNw8To5RdkF(-+#p4VjrK8=CIUz_~wI~&t#_exJA#Q zW*B6aHJB)(kn?E5J0{sgaH?u%rYC{4_yL9->o*^ixdwduq|gt1`Lu>#MMtj3exHEz z>6T+ySz3}RG*FbwWmY8y^XvTnN7Ma7_P&1p{&~9k@5(tWzVPJzKfvyq2uLL=S`Tr$ zEEBm5AJ5^j+w=QE?gj&fS62?U5$GS--|yM2@M-TlAP_eZd=-1um(H`ywUNN_>F(5eX} zV-ymy!ZZ?iV0LkZGV$;Td#ZGW`8Anz2hf4$Hhjm#0Xzez?qAQ(^UuHC^#2B%5W=Mt z=A~vrLI{+IL?Ti|&H?U?{Pup%ACEJ`7B!zM#6*^ZVAU;>-z%ltVi8m_j=z?)xQP`; zvFJprh)K(Vl>`~qeLk0WrM9KSBD+-oB>wpbdSnv2{fc zs-~Zw{tn@v*eeQ@q*)}bBqLKbISMG1-?zmIpOs@CEp2 z$@nY0_I(HE;4qHqqKcG8S1RDCQnH0+*=rA zbLzW3AGmmeAAX$cyglR2Y}f7R{QjZ~^hQ|bS%i}{1j4JVniZnk_Xp02ue81%muBaa z+WTXB+fd9rDz4+cK8y$$LMDL(PvCS&Qnpp0Ya(V>K@z$!!N`Zg597BN>{e+`tolc& z!W~3@po*bWKJ3FJB&xOI%*LY+KPHJCW?&XpFc`{HAR!9C&MFNoU@{t&lqQ7`QnVtm0-J-YyCu>zWhSgEBN}4IfdI&j z92Em&%X1|$fs~;_0!z;i3|<0}?zf(41oIYkt;4O(Q@eA!4)O>(*gW?0l05N+-lMBE zV|u46MWb1XVo^+zijk!if+Qx&z>}rcfI^AQS`kEbrvy%%$r#OoRiiBANfc2+)0PFT zWzk5BJDhatS8KYdY9m>?Q5hkGRu)Q#Rv8#a&c82tFY(`Z6-vANDZZ}(>K6go@SJUCmId0F6_fO%#4MtC*UuP${{FbuOi>3}ym zBso-Hln)G&kvjsTeM+4x!+oeNy*pqFL*ARaRg{%gvE2-%v=i7L@xQH-bwiBxqLJ#4 z=hcH(6gX;g@sO!^Zom2&W`qm0xX|~KIa#Fcho&W zcW$(5yEBfO`R};>yYu5<*V|k7J%&Sk^F`63>i+fS?;8*Up4#~5x{}*r_uci|zEo>( z+qGSr7ulaYbgHj~*U0i&C&zwL@`p$C`l{wJ_A2;j(TOcx={LJ5a3_1f&Q#$gA-v_EFf`+Mej!`|m- zd#(1YbIH@gU_f9&V1xz?UGBrzK|TPs`V04^?IV&xx-jfqY5NYP(VC3Y`UuE6_7@bBfb`cj|hq) z4lqUnNuVfAxE~u(GDVcpLDW*OYDZ()ZxztT-ydmS9DG&)`4T`WgtQm*fu#%~qIt5E z%*GtaJeWnz6lfs{nUU})!dO9JB!fu}aPH|8_+dOAaQX>y`GeD+Yf10CN+g&m5nhnU zV*|nF0ETxH0A!X*s{2he-hsY*@vG~;7kANmu^Z-l!bW^In;r-vaN?0@c0Bs{*O^q_ ziH}j6=Igp7UE;YELnyOMA;^6J%peiKfP@NynOS_jhl!b8Ys0cUKxz+r|>c&&odgs=JnA zzQwDseVU=`shvH0-&_+aGp)`JBM_X6~f5kWb)s3@XH(3r3*n__?{^yBSPCSW1zgltG? z#K9v8%f3)mbDlTYpNb?IdN>Kf+YtG>BiB5Ny4K7AQWgO{84-N;Xd9wy4-2|g_j@~gTLk|&Ox1b#(F8*MjLrTjtT3=QauVTGDIAC?QEZe3zSclu{UBB!Lc-xb?!$tC`TO5p_#1hzfkhufGcn4H zim{AoRm`eYBCRbn#Ge0~`TBU1_f@}dFAsA5VchNLo_R@6PTqEm4@(F`=s^fV6GbW_ zLTn&J83*`;EF?6^XoO&z8+ru8GsqDaI$m@f@zRmW84(gmbj20n;TknF#=lqJp21B) zQ$72mbkgWp62X-|S=AGNPY(m~`u{$8-SGWBpFhvGm4!yg%P`baB_Mg(+2qeSHW1tSaIYts1CcONbpg4F@!ziDMCHl~n+?(wq9)S(beX zn2>?WdMJ0vpAX-)`|(hwN?Am-Nh~6x6Egkp6Z`zUKdfqR=B+IGyVUgGGHOH9p$HUx zswgE?D5*_DsdDU)q+NZ(@|vnZhws!Elx6-duBjpAWwdxIJo~_Y@=xAwKfVN#nGkA8 zrdcH8@cRS3{J#sm``+7r-S+V0XDcMt6E$A2HXhWB3L!-VAb^O`0wP2}f@nek5y;^a zBv>We8VMT<`~-<$`Vr#g;pd^DOStY9ni0}<0~y_}@tQK0EJ05j#}^N#2{M`h_?7HW zv4v39&>x>{4R3c{=U?AHA|q)DhDehXgp7#^6Q3dM?}wFpH{ZF8uXb}Qdk>8gWHOYm zG?i}p{B?FJVxw3IN%gazz5%BRocfo;#RI2E^F-;^>6j4(YQAA91e^2X?UyLqi?=C#%e?ENS)_epzVn~!Cf*=AR zU+r>DjIw6@YZHz}x>pg|GeihSE|HB8?%!x6PqT+<)rai7Oe7-wjVaI*=bT&axPB48 zKN*@TD42pGuO9F3IyL=2pEsjf@Ykcl7=%moO)ykb7Vr|7gh7>_*Ux?LH@^7`Aa*4< z2HI%-%L`$lAw%Ga^-xhggW^`rSbAz%GE;(8-PB7i%WNP8A`yX-&>2Y~!5cY-A(TMg zV6atS!YsxxI5Ntp8Bit(Fi@Ji9TCDgB`)lfn~Rzfhc#xT(}%ndanGJj*!A<<9#iZI z0$WVuvyVK05|?A&Ez9WioE=-l@nYT4yr3i^?mXRN(KWAb^zScM!)WW&_Iso~cJ(m( zW5df~4?N(_BpBj(Qp1A7Sce273B*yr%&`*3o<=*py*)WxXWc+L$Y>d5U>VXboKApq zOQc0vr9w%) z2Je7zH}^>caD+RXQ&O)Hnb&8X^QoRngH95TWeg4XO$bLhYmYPO(?lSeGtfuKLOm7H zp7CG=2fvKm`n+5F6*9$MU5mK{8E(3}Mqbw!t2t_FDEZfA&3Ek8e`=S5?=Q4hifGPO?WN0ez8oTA0a(#ab_u`nNQ8N7X8XO zj9QA%;(>Iy|xx%6n5~Q+?vH_B(hy*W4s}u+3$WQMPtcz--Uh08f-SEV5 zbo=1OV#R#^uT3bOf`zLfoEvxbWiODsJqC_8e!TwaucCLO+Dku1?T~xZ#UG^lcP@#; z`u@rEdRQnpJTjlRr-Vsc_s-P&w>MI=M+a_!LG3aLu%c8j;kyYIahF|i)U*OH5Dox9 z2jT+yeBabOvi$=g+3$@XQM4df_1W6s`^#s8D%8;WzjQeSLg^@oG+AK*cW#_V%d}3% zd4OWVYL$r9h6fkm3S><-QFqDDa$D$0i4s8umKU^%VOh%XQwRaPek%60!ani@U%WlY zBZ8nnIG31yZdKPWF6#CXZ(R-3v~PBx9YDP{ELfZ_JolY%o$q-JjDaE&NCfA#notj6 zL4KCt>0rz;uvbmNw%r|5!GP=PK++L)$m=XM zZA1-luoDOdAPV$nb;+fCAAL<;$$ zz#R~y*#WIoNWc^+36Rkv24zSK@ACQXr@PKq(z>n#TnualECIeh&#&LFetrkn&ivaR zf+~4gQYwokR%KO0R*4Zeot`-Em;B?r?(Y{vf;iJSS}C{#fj=D~9Q(tr)%WH;cb}C{ zDhKJ6_5Gg$UMhW~4(1uzd|9;mPrl2r)UEAz^$>U+UsT+XW5vHqN|nN_E6)1_zFBmy zno(ffTQ~2nXMLTPx9kCL*zASQ=nUZ3O{%NN>wR0_ZN@nF!GqcI-L1c%;c_W{RcGwG zlVB$ytj1~ec?+L!Re{%kBya6~-(-#FU%jWp2&7X5H(&-$Z*EG$s)nkRF7Cx%8JJ*! zcXq3*vctN}F;<`k=%i4{AjrrFXI$PYy449#833fuY|N^H1!W>|F((Xs?>Uj&4r*Ph z8Fi6gDh-F)c04F5FdXR()NQ)3dvv+p?#{xrT&?9x5>+VGN<}45u57%Ra;Q>W0K|$8 z?u29x)e0|KP4wU=7tY|@=6&J;5Xj*6%TbkDg;fA@@tJ}$TXK|0>g9+XklP&WS(6H2 z`;O_@Bo<6fK$VPQeQ*;v#_o(x#N5UMnbp9oYVOels0nqpIW~^5RtC0D zod*)Sxgwv1@b>TrRw4;mg&s*0TL`xR02$;eimKIJ$ZqdGcRlz~>47@&!8BAgzoHW0 z%Zm!Zf)}i8$`29>@2%dAZ+cchT{9afPTO{_5(QMcKn9#(<_jwTCjLxbS_T2U6q;TO zTrdo^h$dzNKm@e)Hk=q6Or;pX9pRZgt+#~y)xm<@V}vn_%>iJghV2MJpT5`lO7IVP zh74E$o^edaAo3mS6b*&cYE&rDUCs;|lulMt<}EQ2^Rpr4S55Q0v=^LCneCMU^FU@C zA+!d4;aI_vuZRjl0!Y{ZY^fVCp^dV}Hp>Cx$Tj|xQG~yqdFKYE*a@f&-%qa&_q%_B zqUG9(O&Fr0jfhNGsv1I+rl=`LQ|FoApDgw5;H&ydX{f*@zHa%e*I$ghclWOssS^t` z&EcrtlFRV0;p?;IP!DSLDG$G-iexDoim37PhGx3+Ihme*HQAgr0pS7irm7$*hfo*4 zw+>t5r1_z(eP{~%RY9#~E~#y(3#s?A{XR5Iw8S+K^bLEgw&BzVYMyOrsb{-8vp(wfcbSRuY!790?$d}*6y|>4HTOy;fs)EXWHFQ^ zAjm`7`@PohS@+WSqW#~#9?2k(NM&CzW-}3zM5dNeW3c-3-58d9@~YuLZq(Jo(zWh4 z_kU-|56=zgIiIy9F+|Z2O&s@qog4k;YUf>=zTuCl5=28EQzmGJDZGOMqWg*TB|44k zQ3e_i;_9{YZfJDu^v=&7f`S?dYLclcVk#;knvH9t@4jc=Ih?}qKt2I7M3OQ974ukU z3YFe)(9L0O_jNvK)67a?uy9>hyDCyT%kvLL`3%`XbRR|%sG_K-6v!e44$g_GFhJzRv!fIYL|Bw^ zK+1+yLX1pEXFC<>3++DI|iXN4g&z~-mZMfGX58eY*1~E&2My}+j|$<#@@lZe^0jp zvKI1Aq)2r;l#-0|cXUr&B?AK(OAf0l#*Mr6OEpigJL|=7?`3r*?@95R)%oAl+1Hz` zkM7Oiw;u-TTUDO!SDgC~EHiUiChL#R>)vkdU58YqQ0a0oZjSwUd!J;!`Fw0A*CMj6 zkm|!8RnRxv73^BFZd-Z1E^_J>sjC|&TzQ$8k1hKwv6(}M4)gb!-S2X1-OhQ_b$#b1 zRaC(POBG;2Mp77&DLb8cuJ^!?Jk_l9oU(hufjV*IygQq_#>pL+Z3khaUOnvSa;avz z?3Z}isa7{fFH{8HgQ9>_b&yfp!L`I|C!Zxzfor<_=V>fv?PMU0;`7pzfob+VrRQVH zKAn>m_Qsb8NY+c;_m*{RVj_qcE<8Hea?xeyrt?nX3wr%ogEmv6kEpI31wP?DMssE% zGb(qxuQlCr%dTn7UR@`E#AJaO3>akEYgdk)#wsdlqP+U*QjP)B9qE-$Fo5*Ck?8_R{oegucHlmdOhLD#P!d!n_fkNNOaxM0L0}63 z1P+c`0AwpH$rcU6)#|*d;?3RB$v+t!3tUkS0RF17z9&|#C-;(O9dEXqTlJ6kavpyLmeYv=_Os&fl z>N)pzUQ_mO4egg649vuK;m*Sa#+tQERxEX%KJJ$^?@-!aL3Corh5^JK#c?RiI0Lmr zY0wpfEEm`d{oOYWjOUafcunT{4IvSl1VF6w42F(2EkHp`n=JwWO(R}hKAJ{);@2*|_322mf;vv6mX~vSiY>DCoaRl5VG|*7T zpD_VsluW{y?U2bNhY=+qNMR9F4iHoZDFVbu3=s^CvP!~!P7so~G@sVz6o8n&F}x9p z4OPLWj7u&?Ry4N31Qc>+=+m_;48jp2mJg1zQY0+>+Slz zK7Fwm6lD`c#Wci~G~M^n^wx8{-nYvHPJ*davcF7B$&3ibw16NHhV?8yeM(>wz1rY| zSQUm#3qW*NvredN4SEN9A7C}t(lKNiB9e%rzW)8!hkMuT@7>{qKGhOP+8Rwo8HNOd zL4yDQ1t2gA3kC{F12B_q1RB4SF<^$45mO+Di~>Z$D2yZ~vRB_H+vV5VK9(~Qgd_x3 ztLEJxh{;8g(@a{wB}fVNXgS&gxCNG8>D#}qzUVr;qN`WR@o&lb>)l=B_9B$XBATjd zGmq!D@y;K%K7Ki)qhxw)Sb_udjF41BOGGkH?+?zOPuRb76yz=`ep6RmGhrvnA+u!M-6*ft+VzFq{n9RmV#)>r&5S!m#8S~dOnR?%R6h6SEF%&{X zj3h{*badT(Ay7T@+rzYQqOgtA+wTRHLIckjnk_*d8z|w>K9t0fRK-&hPtUqH=Wm*< zeVxPZ{%eOpg_mb}h(A)Oh=_#wy(Xg^0-vXp9M`#yb$z&`cq;Mi@q5nuyl)@RSOA$Q z6q!vZslGk@{k-hm+3neM2hobED5#PkZ#@Q+njL*zuiPR&>@2vX3)-kyUY_2&+adB$ zVHgKHuZnNc&!mJUR8U1UPnclG^k2+T991Yq)zpg|KbDTTohEx^Fc28bguq#LOe#sGqjNWx11B^Kaq z%uO|gg+ak(Moi3#u*d`{CIKTEjgT1z+g(Q?0Asb*p}|f7Y=+Pbl9-4N6cq?sp_tro zhgMmLGT^Cn4Mr`hE*9b zScFD1h}AIR1dIfhCIgmW6z@yZ&O06JyD8T^_m3T8%#)*|iY3YG=R=3a)D#k}nzb~I zr!2;FES5xY=VW4b*$tY9C5E*MGQkSa=5Y)nC7H=E(&8)(LgFp3$}DUovJD~oqmS2_ zz^#{0K0Y1xJ>zDpO4Yp1PD66TZmxqas>S)OQO77_cxSj=qvO~LJ_F5;j?VZXj%I;J z3cIqx>$qLf=8kJBr!*%M!(jQGRYyQK2McQx5~Q_c5>#MH4c^^ebZ*wm{TcReyJdyj z8>?BDA35zkMQNq=6)^V;5@Eq=tZ?1Me^M#R6>DIh16FI`1ppcF7(g6xTD$60PUU2E zy!c&L*E?07%>us53wgM%(c8Vx2s7CF>}~7|UH00yC)Kx^#{EOq*BttXZ5`T~DtsEN`|T&1(A7_Ts?Dmt zpICZk{h4>t{%5|c7K{jvBFHE1Kv2#dbWXBprS(|Ml*LoU?CXAb{_XBQ@5(S?kM&YZ zW>;cP`}OVJ?xI`z@LS5ZZszaP)mvW?-Lh}o$;}#OIeO9hw_d){#EV`B>!b8<2-Lc- zx%C-$zyT18XJl(a|)9#I4-sf)a$WCS>@?SUci=NjPoj`rrnVS&bmVJAVkjbp=vg}gUwZZPcAP*D?2ApmECII zUWzt4WwUO~JKjNap0RhEH9oKFpKS~-(t$IQhh6zsbCrX!WP~7)2ohfJwOnVLs?}UW z<)_h>j(zu0J}eth$;b%xkF{^IydrrSK1Rsu9`<9(mz|e4wB);omi=}2mErd7W?3ph zscD-?jH((!mbY&oobMN#M#X4tvW|Tp!{ft4sA%|%Uk31fGvdd=7cN72docbjzH-;U zChwlFsWjU_j?#6I0R)pY6woj?0ZoH$XL)N!&5^*m2fkL5gcwH%i$)wp=PQP)syUo8 z%S)9cCx$M_hloRb_`gTYdWAOh$HYSSED(^CvG0RM9iiK)uE7@gINSpW4Pbs|*pB+n zS0qB7?aLBKl1U}%ZFjzRT=hv_uN!XenYq_7w12HTa>c0Ui_*NWsLRRXDO0H z#2dcdrX!mn>{qt_ZdFTIH+6lVTOFHsuCA=*N?hB&vPV=t?st%JIY+PQQ!QTK+1uN) z6KOx1nepqdp!sulWi^6_&Sv&7!vm`_H?icazpzj^8 z9U;iVWkLZsjxTrM_Xl)wB1vgA9wd8d8#XO0nh-_9Z`vK!l51QolB-xrBCCug@Q5=D z;LuI-T{44=3HCV<)HY_5;t|xYCdDn>G;ry7A8Eu zEqgEq85W>OOEohi50Gth4exzGL{dx|{i+mMZ4?de>v@7HdJ3)T&gNUz zJV_y(koSBx69p`u>(I%ONhCr+YW?20!PHksv2sUNK0PeYE$4| z!So>ZI-Xn)pHw1U^6)(kn0359R8ma=FhG?i6_}$$8^@~iU(56NU&iNIvsiX0A7mnm zD1fL*1lA;~G?4jq5+;IEd3@Kx?kj7^DsFYpdp!s^cbwKLL5D!WB`_Ev_Pj;h%YVXEb@%;}AWl0wN&*`o&aGNYE8X2Q$rJehGD~VEAKIPuN%; z#SyADD6DHmlCwzy413c113bGASQ+Fz_f@#%;4-}#O+y4xM9CLjYu``Y=Z5~_?H6A? zw*9Gm(F}-GqkYuA*85&tc&E}wUG?zqPG~K79YRqNRFs*agC(YhiYGq4eE0Qy`n`4U zx1Dc(att+{_5%E*XeMZ>n24*mN@^^Llpj2CY)8~MRh7VKZ@ae8h-(Gt85r~wCh?9Ex>h)bVVVG7!uysrurIjZ@p zBQ)uvWh+@xzz>Vm^Uzz;PLkEoEE(~DLhX*&nfUll}1-{x$j?J6VB*)yV48O zlY_-N#G<*n=c&B+(|hgHdhN#NXz|{+YiCRct>u^jApn*D*io<{a8?7k8Z{M8I6_tC z6#}71iN;@TySdY%792*PYIR zuQ#JpCKJ30)TV$pKzY#%^9}jgT+YcPL%Q$~W>u1Bn&qr19z3OCr%=;RL!=Uq-w(cmciKL1Cflp-`*h=oa@(qd=W!K} zs>!X&pFQySSBG8pZ_2Y5bxQS&V$lxUl$*p=eXEF__X`(Yzh((|8ZW2VM{&}X&Z$NH z^LN-u>*?Qp+a2RNG8)Xsn%~>onz!9~YgbE;v1Z(vhPt>Xg*Q&NgRbl8PhREOGSawV zx(#sA?#d-0S0UXsue0J$3{Q72Pf_i<&7W+N54zLD^1!@(%LaV=m3m{UBYLv#==J7;*?1w_d82PY z#&{vrm#uk`W1$bt0(Yp2Wzknf=6fS`?$0~Xs4_XJb7?7~dS&EN$os&sz)$8qfQ0J| zB=f^%gMHe@ijkT$?Sd*oVV2g8T^b{Xhmq#<)p<`)&c{Oz@_@YR+V&dluv^Zia_DQhYKF^-JSC;|^$gmaf0rBLK0<9WEbR#TM z#Vqo-5-^ELM3cHKgXXZ9EVLcaNKCMBGLcz>#1x6B6PSqu+kT#{$yd7W-_*GU-WSDp zq6qqZUQBK&a;`s1_s;zD%JJRNbh>vp&Tg_Ys-&8g^tYnNYxDZa+;-VHtsMsZO9LBz zO}u20g?y}y<5Qx;Z8TMT>E^d@W*XigaO&`__s$m zK&WNZs**)fxB}p=kY7 zv5t`Sc`dU?*_v;mh!$62Af5Z~S~Wg_H`QBPC*-{wg|taJl4pBb4`#O8Z>9hM4WVnP zOhDw2yw){Zw;^{(tyNrCGKE5ANGQ(z^BtY<4oNj$dw${|uhrlXUnJWriGFs)1P@15X9RD07U z5YpJ$2(+3+gn`%LC)6Z`I1@pDa56%gU6vG20g;_yk_=eLrzs4rL6BnHj1urelL!iw z7K9NyWZmfIx1DJ2^3*}+XV!{fil~aBL@9|Y-{s}^-(P+^&FbxbkZ4d;R8jH6590j^ z8Zjb4`}olMTbp}1_j_|jy#kViv~^+k4K@Lh8J29dJ)B?;m}_{&Zx7NJL3ANr=%=wka)&h&GE!8nH%XVv^CQ zgeXc9mXexiX=yXRpKgrK_`i3*uTRZuZ<D6v0GMCy!ryuD#yPC%*g-A6~uJ>T4{%K}dvQ zM9*~L+Q`LEk{Fr-oPbqUNMUWTp3{OhZ8KKjhrrNid>lYKVZV92C%(n1 zOS3S%xVr=o9^Bmy?(Ux8x;QMF2X}Yf;Ig>ua&ULI-2?~_bkUH6Bi|$)Xa2;I6r@>4jlWCM2FIAyW6|mkG*F2u6hAK|Hnt`({9B2TW{}T znMEwg;>T~q#F`QA$)#6`%nXe$C;Psw3n|LXy8MBJUt9;qHkZ(l=avY>r@GM}o7yVq)nB+-BJ!yp&Zf}{ zP6`Hb<(w7Qk`)uxu;XB1zsvp^(wZTQ__!Pdz-Gb3AT?MXeu8_PLYG4xL<^9IK06W; zY*WLoEyLX04#yh%BEynn#XtVz? zW)B&4qJ7!|86~+GgA(yyr~-J96eS2H8xMM_`b34YNT%Cl9Oj;Kew-dPZrcoNw7eo? zxe%KGa%xh`3PxwaYtQmcjdf_VGO_-k4g7xB2N@z&7Ydr9$E zO#8N850j7@c&H2}8WlDm#yB3`IyXfJ$Bc|vnG&CgqR>!X1%F=NE`hP*FwnAvZln%; zH{FT39|rQ%mFh?iyKX-oWS+~cC^tmOde^dv?M+FRdCI7e&X^$$m3j;dCM5t;qWUIj zDB>5dQW+5t?~<|9C$F&EP|l&CHV||d%^A3|M*DWU>9FgYYjBQq=?YTGcU3D;+o$%t z`m?f}vEr{ueU;D)MYf70{Uq!f*11~qS_gxCBj=_PyN0d`_T>5+b}gqoyDCp(XQ4?A zx2z8PMf?1GBcWK=v}7@ng_T)%rYuzjF*_60d?oS`&rS#P9zo@`)h_#X$|-w|_Ie#Q zLG?985@$ytE9F$3rm@WOMHY<)a&^N6C)N@I0U9cxu(F5~lc8lEw-JS-gQJdxU^%5@ z_NrifW`h!&p@wG>j-9)pCDlSx?PPU@Q2mNq?!v;V`Hryant64x2cs2h9HnP@S`nov z$6}QsijX3&{YG}VdAqu)6Z%?_BCW_G`%a|mlsid|U4HCnSM6>?7oM|`vFRLsvPJ_? zRELYWFuSm}NHxcbqG`>kDTRcXgp!raIE!61)j*?zv&$s2n9@>%Np)jGOkJl)NsK^f zLZlHhM|q8%!qJGPey@fVTdpdGY2i$|n5Jp2QKgDatIB3k*@NfWV4kRxx=@R&B}&QT2FWcqOiOitC(`bi z?OrU9D7#`x~_Ax zZwQS0%ghB&Kk(G~kl08+4blXA(~A}(A!E#kh9I)emDb{>r@=ip{-}N0_ZGLbqq6W7 z*LbP^%v-aHWm5xEc~lmZM|7W<1>gQ53C+#QI5HEN9mWtDc0#({z_9MlB}kh@;`q5< zQ7u=Bcvn9oGACs>#bv5XBb{ghp_h%73Ya@CGSNU6--x?Ru2Ly_R!VD@@gGPVi4wKC zt)|7XSR;7O0}Uc1iMAKKR0$Zu<-A{o_?&r9`rZ6k;P33^9uzNpbtYX^O7U4OvLa-C za1V#kVsHJdPW^KenR+2ZCBG?7Ok;TLKv5x&pjkfSO-$`==nkltF0`PxYUpwOPI1}G zWi;=0gLBG93GYDKViiB7&+m-eT#{C%W)OOENCJeOxZeh~=jBU$*=fm)iTg@0?Mec6 z=@|_$A&W32Tn?i(aKAeEIw3s9X0~VW?aO@t+1_S@g|cx#2lpN_kB@j8rUE9Z=vOlu zzT%*dI1;zC?vS<14lyX;h%xg@Jr%6At&mTZX^DlFq6L?~C|jTDx(0_iPmj9s#dB+E zo}*44-KZG~gJcQ6C+gP=1@T9Iq}w{NKe;1ymJRs8=P8YQLdb4=e?pJjd3?NnoO0qC zNqa7J`|d5z><2EvPOv`|eyecdQ>Sm;| zYO`|Ua8QjB|KM6>ug#y~aBDgD~kky1o~T@W^9zLVQx$LqmODE%s*O7}y+ zN5@!!_j7UxR2+q3*=2$sMLDjXDh#jaxm%(ht=4kqGQ!foviW;JZb%%ag=g%{rE*FY zuS*kI%Jmm*S``-s@tVRrh3BbnpT3KA9Sudnz0wc+2OVs-NgBCo?aD#I^Y!vjo4FEpOp>~zX^#=O{zMwP>;r(?u@2Jm3G*4bIX16lGaLmK_qeS z7XAJk`17@d_P<=&x@Apj!X=0PtvXninURaZ@3Yrf2*nKka zpx0D#y;n}jduCs9NEx)^u&S>Ul0-|Z&HlsUenSk0;#p6cXdq)~85XUB@(l!8IL8$K z7$!^q&F=_3;L5t-O$ox(EcNTY7={kvM-YMk8}Sm!6hN#xV_5oY?gz<;-i4EoL1B@M z-UIyRb;{>Udqz-elxB7POqT)^K8mB-48pS#txn&;h8Ulth$_fSyqjmBVD7mMIB?2N z3RG94%aWQrvWA(pGl1IhBTg(Wq!kS;!(Sh=Yi7N5la_Ybg9)FiLY35%frOe;5-6}6 z(!@KV$yDR)xh8`Z9Q~Q1SX>Bt;~!?1z8{8nE*A0Tagt7=3zK}K#X zc~}CO@W=8>Uo91h8Ttss+RSmBp9|WU&Ski5ygaYAy#G?8^Odb+|1ilq+H_!_c&jxi zprjv+Mtdr*ToGfPgsOm7HUKYZxAa46fog zd&|1Ffg;zq-=v3h=!TfSpePy_{D%%EU^myYgY8soP(`GB5)Fb81ugB*?~1VFuC}=f^w?O3L;ylcanjRmOMYnW_egGterD4$ z(~IF)j(9Ft+O0eez@whP6Q7c`BYukH_7<^D-?=?9&r$E!l#F4*pTE{SE0McKh~kEa z#XhID9hr0`)HUJwL zH_?H%T*EMh@K4A4_Bb4STC9I(j~X~GC9w%uX!8-6YJp|| z5vW&quS8e;pnXFE<|HVd*E#l2AW$5dxxUIf2mkb^fW1wc&t>VvJNEmIp60iN1NekW zQbR**;eQ(1VGz?sMxcU+u+}dlx}}~QoeY#ebGzDCxI{eXGW>3>gaEfxmOi!89Nxet z4`qeSEu$AMI>ZYk58t5mpwq?i4xYEy;14g-$c%ML4wf`x>2Q=$iFwnBH zZ#zWJ%;Ijd54&P#ROlki9BspCyBx9X?d^%7VL2PFEEwX0%6t#f#jfWM{te)wp3qkj z*r#qzk;y%{a~Crrc>QeMpURZb!96gf02spLE{wO6}G49%^UFQSo=3ZQ?Kq~5vdqBH;&FF z$!!=I1=Kh5StMZDZ!6GVvBo_4K0WxO>04~B_)ILnA?b0{hw)L?fTz^EPpbAhqlOno za}6a+6UKC6LMOVBGLD+<<%GHCq(E1A&> z8G3HtE{~qsQyhgaK{sw~S}yz|$;tjE82oT5TSE-nQlWBJ9)q4 zrIlQS!%tydKF3bG{JxgfW~r53q6MRny2cPj7%Kfmn-8MBy>e^I=we&Ob~k5-LN|o# zCA^Mzw)o-;9n{I@Ge$ASkG_?03k#E^7|SHhFCprwTfIYAz6Uz1>jazzG-!PF?lR#E zZD+j;9uJ$=eI! z=j1K-<#-$PR-T07?_Cpgv%jt&5J)}XCoKE~0019}N6-X>fAP?S1pvbT?EWkm`6=)d zSP69G0bIt&9i+mDFi)q@{4Xg~`AnRj(_du*e&S!Be-x1TrvR!vQsF1y{Ifw-R8-U+ z0RTAV|Dk_jd?e!+umV{BEr%rk-HLw~{j3-X>qn+m9G*^Lp!>_#?hw z$Y{#sl>cQGS%Ru4&kFd@kA)S0^FM;|KLh{M6+e59s==x8Qvl~@ED7V!3Zn@l`@pF^ z@?UO74jobyz>4%2jxaI`{x|$I^lv~$#IJb%semf~6aD-t{-1!1ad`kh<8OI%m496z zS7U!cJTzSYO?LOzMa;PGU#TJQOkcjUtx(1fgdrs5vo#!XUAEREyM8pmwZ%kX=V*m{ ztEJzF{5TcrKIBy(03K9v1wI%0?g+x7#t z8i5gfEeNlyD&%zYVRnAljHORFur~*E+HovXUKbM0?Nyqz|GUI@ddd*h>&^y?8@RNo z#$fJDObkV!Nq?9P)$ygQ6TZWi&`L&3V#;VfQDCq)Ud&4eZ?mtOo0< zk}Nd!q+}@ajZuWngx(U*w}q)W(n5evV}SCALv&^cma)hit&XC#kNztfrGpG;mn<{; z4;o$aY@&rb{Megc{<0BvO;1+VBILg8Qo_8>Amu+0T^yc~HCj-9X25Z)m+9k}Qn zh}WPI;fT5HIVJFKl%=1G9>?3l05m;>9uP;lPb}Gqu*^oVSg1CZLa766i&gWrChq4G z)NL$`-vBp;0?1diDZ{@jiiNV~Tz48i0wrl4)yQg`7lT4>GM@-kA<@!bMc!`WE-9A2 zc4rXIb$l(z0=pHC2j8~JNZCpS28^A^4*1D#uv-@792Y24=| zV2G3*U&w8M2;{~huklK}MPpIgnHJdBo?a^LF&D8068%!?EAK{&s5UU3+jPvbXOhr9 z-F>eH$hr{g@r{fT1!7!L_49Lf-l&);y_jQ0JoYz^E_Nx$kr+~bIdE?^u#F0f_(bm& zVqg4LD#bkszc%pueWlyih~p~H?*O4caq?gW?6!gGQt`B%hQ)S1k76{I*wnqBA4wHB zJ|vTW@19>O5euSsr?2KPl!%g2qJ4O$m7=zTF7Jz-b{hH4ZaHkpmgkIFSe0ZRMXbp* z7ZkB(L#T`12RoPBW16cHQJL`$pCR{o&!I|<5-(q^KSwPXkJz|yQZAKjPcW<>*7HrZtuk=Z<2SOivmz>PT>Rp5QE#B?VHZQh**PQ6IC675qgH4&vNJ&-!nQ7y=1%TU4;yx z#Ck*d{l7ArU(<&fa!7HiIm-vzPT^Eolf@b|J^C4w-5xd~vG=~u@HqWvVRF_beEy_^cmHN3h zPxJ+jym`IwYWVmQ7~vEWmJZz8yH7EhEhS)p!a@)>zE$ewgWfK06X==7n)RWLH_cV% zd{ok&PGREh6cQVx?k7~{L8N7*N*~hb zj|j9&Usrbs2`zVlK@3Qe$j=FAX~GBqlml=9v{XnAo2Jgr^kQBIVM`a#{maumg!c#On=*vl3j#PGx?b~9g8t?@;^r*p zB%lWKdpWIl*)42;C1M9_dPHV@w{92>dT&LzJh*ahMkU14tK>WU5bmltQU$&SYrM27|RuUq;o4y~8}HxF5JgAR=Fuu~uFOGd%Q`Gl2FbJ@#Eg!WIor4#v9k-rDt;0SLT= zhhz~66)OZI2<{IN0O-T|w&z&0*v*-m4O@?CPYWz)KQfdqZ18vp0l+%I8~Td2#89NU z3+WLtP*MDZN%_qtJc0)E(_5uZ1%#L6$Y5Chv}dxkbbBO~Ufkg5BgUxgiuLUkFvi5j zp_7vmASj0y9R5PPWAHo@@x1Tp`5h(rZqrH{k7h`gB3_jb>uBT7 zk;srJ*jxPwni$$|MgUJw)(hwld{YPg!MOm;T0m5dqCF=o89D%sK#xp8Qxj-3i+nmt z9$6=6Y+|{3-fxpK4L?ulXU6o5tBVyy)SpBiktPAe)y#~lRqV`}jto^gXgc+*8wxn( znNB3enDPK2?+?9?uU|jOQlMb`YlsW-`j`V7=Z2B7^_iI14BZ3+{Rc;4eQYu+ByNOWK zXd2_{S5wAW>f@?L(pb8wRC5?N0acnz(%i+kdaBH~+95dxz{>6visx=iid^eliVD=c z@@hbZ8s!Es4JF2)$~_Gt3dEoc*?trH;4#`W*>0lJ=m~Uf#7s`3futoiSyrZ~b{pIG z?BrqQlIFQlM%AEJDsU*cL6Y>ViOXqBT#a$Xl6N2}<~?E%-gc8N4=Tu1T9*Pa&7C*R z*mS~uYM;Wuowt#u%Fw;a(}Y5$%fo?+8DOXO`wVr;A6_4r?zmF52>vG7-2!V=zWw$R za!G5sTQNV1J?vbT7m0$fy1k7%>BB6)C82BnQFDE2=2|Wz`^n_!s^psC7JSRlJ~JBC z=-LsnozwBw9R`Eb3%&)}&Mj1#=`Blu%%p6(zB_+(A2yXvz@v;~1l$~tf=r033SZn2 z`HdWOb)ddS1IrjDCJK;ER-aIwbtV4?f(p!>P|w{kCVE|mEYYQkqL5b_?=#`4$JA zFj^V<>cUFqD{5mkux`S%6lj%S$=%bkhP?RY2zOWSiMOX&p)dhPb$NZ0{${%oi5z;0e}WoG!2+0v z6c5D=5wa`;w&9V2V~bTj0zWf&(&zF-Vn5RybI9C&5^R*C2!H#V-iJi_Y(?VCC^i)p zV-*uW@oa&Lw0z_hiO(I>!>27^YBtfe27AEsI+z>eWTeHcgKGh~8Wo$v<&tm{#6 zw+h-4M4O*^v$YcBYhS`38srU!YANspcC3`i_`U3-o#EiLUg1o?|^ z2E-EuGo(8)yk8tEVrs_@W zdSVbYw|{u;9%!IZ-z;KN<$R&B&1;EgtNvuj{gii7cfb*Ti|_oMA(i8|+ z0v)N*P+P^vkl|N2&IKl(hb_yJSb7o2JWUpGJkUCN6MPIXeTNxU7Mt#duIDZ3YEieU znE6=?q)AF>V*m$X^C!gBqSWI{2V-0#B45d1nz~*D``c0!T_~H&fA%pKwSTSdFZeaT z%@}ukXqDB-jwvAwK728wIMEY7Jm(^kH|9*R>M_uYuVX{lSQPvqb-!dd%ZIv!%heSC z6KM@T+8++N#@YIMF}X$f7PzryLZas{K6SNO+Qn6JLDpNbpBQwaXDQmw?0Qs7JX%3T zR9F=*J<1d~wME+NDG&M}m{MKf*RHD)c#5|kQKuiHOleiMx7)-WT|#LX7j)X&m=>P6^1Be!`5K&jO?@XOb5*LxO!Yz*Qh}Y_OVS15Vo@yuw)gi4 zblJ}y!X&hCuL5nw1@stYgFM1CI|XPLJUGyYl+iI7M@1-2*e%y0w}1P0slM98q{4?Z zK`t}Wxgf_99Ma&`Dxo*cuIc^h>8@L8I2*@>Ej#N17Ol=A>k5YD)BJb|xZ4 zaU{N(IAomgQewQtCZ=f+EsAonQSF*vo6nO~p(?ia!_SaxTWc*Vj8sk*tsy5`wpB9B@_xJMnX9v$frL5cXbIElFv(hy z)B3v>&)MUpQ)`ixoh)mN>4TnjeX4%$<&YN~JD2A)p^4Gug(JB5!?hb#{t6RT(dEfey z_gC|TuXHWm&aLN8p$2;6pN30y9Ault{&@T}YR#g0IF(^;$Kkyy?OK5h+m=o6_;Eoe zZ!f?72X+V6ECNf|HfYV;e!s-Z0p{Z8W|5vO&!EJ?Z3{_g=p5yMXTHr!x zWmF&_;BKC^yXT^~OCw%MzZC4PNeC@3lj#=7eKMpe?Ts<>{f)^w7ISWA0kNO-wE1Zk z_5h8Aq(VWgyAEnn_3lKC)AiS95C~+EK>Lm&MVNmO2^ls6+eU*n{Vvsk>nkl0C4*2H zOc=x6^Dxa%W@GED(eT7?cjeKr#?tu;ws`Xo99AYc;`cZi1QJ(X5)Y8}K`cxcwW#~U z^pE_2!|jwyHVLH5cow(|B!LbN5#Hxy*e#he?J%zD&yA&27zTtN8x`e~u4|x+x z+QtCSKh9g3>wZXvPKrKJl%PXC5ki0x7OMKrmU9E!CD8UJtRD~f& zppqItdayI~pvH;qw}7K8JnE?CsAZp(aShC87FDdA>*i_jw*@%at z5~ZxD!noY$2zKMonVBW#5!ZvYNhdPPjgwijRPnbvRn`0`r83G^yTt)d7gz@)A&m2w z9Wq&1O}C{7gbzD@@8qW1S-^s)jx()qnIA`-zb10GCES<<72jU1On6K$#PX{q-o^DU z3mq+iU8)U-t|NxQ-;H0__r-Z(k0gv|6g|^Qsd!O1U@`(-+a9E>Q)CaC(tNr^4{y9n zX*#YNwGHLIemRkL^)xIU&52oZMqQ8iN^aeLE_86sO=FxGS(6@-Lx*)gTLl{M!fW$@; z!CM=RJ)RXXM2vess7ZHTGKNx)h-~g2tDVXAGtUpG!}{2$0zwlnE{*+~Zibt^XoKC1 z5k9Zl6_nCBo03hx!2Eea?7OoHq}A{Ee7*3?*_&FyXmi{-uAYZ=6*E6N{w;dq>oB*V z(3nw(r_w9U1tuW!rB~ailrYRo2y7A~%E9n*54u}FjGXCho2g51_u^q=Mv;rIc4&V8 zW|8)auGecmFxRap8{rqp2Mp^=^aC0>QYd8G${% z(b#WN3FuWz>G4zG;!dkW4Qrh3=osw&G^x}0BeNpBqjdcJS$m>)EMMetO8nlLcA=mc6ZxX`Y z#J*4dE(Df#H@(~Ddf7FbQHoC^lKE@L&k_2+ncKP7y6Ao;%zJg1#0?Lzr;>lcZM&D z4jGV#8Xa(^HZ}$Ncau*l#cNG;w)PvCZgYif_%S&x?Nqs1CHM~t*YCgDdhNpLWI7JH zWV;J0^zmy6EGVG2($-P3*_@8U8mu(9=^lN__4k0)`_6FtZLzg2lJzyKf4b1UQq~7E z{UGgJIu!dpTAQ`w!p=luMKdm=$V)g%z5uuA=#v+PeOuDQ45Gg{qZ%;5UHd*$2qINs z+GRis*R5a;A@~{yx0bF*a+T?dHh7c}^=Z61B)=GE&+OnSG0y>d3#QB7CN?_((jD)nVo%|FpuT@AaB~^l!m8w7ujJC4n znm#6I_e+>qkU#EyPm=RAeQ+>W51)4UTb&$sd@)bp7VJ$NJeglr>%gPenNUK!qX+(Q z``j#dziZa-nU_aVCd&hRHuoxTdu`VsYO`>>Lt*h1cx$(}0O`&Ry3(YPf0eCYP=Ato z{%+v1{0sOx+cZ&1ZjTC9EVT>WU-TI4^EKj1cU~2(?bU*QG3s?hXy}PFE8I?dJvSrQ zt8E#38d4Cmi9a~rTZIgZmZ2DBF6a$b!KZYngFAH!?7yF$lx-tZDC{2y>d2R!U#vku zi<06PJfSfReakmcCBxQ^Zz~p@sq}o% zL4I#Ogo~yO*-mqjfBn;Mrj!!kIq~qL;tMkGSn+BX{N3&)!7v}*4DWdi+M1UsChOyzH3FH8+2Y-A>0$iH)OKy(r{nX#c_06>f8C2zRKh&u7M6o}HW1PG8e|C0%D+)=%q; zdkggXyJ2=(4c&bgpD8imQm;;KuKM}IREzE6YxnlwHyo%U>hMM+jOi%7OmrJbY%yky z+}ouVWT>v6g5A#>Ix$=WV=e4$^!Ekuo9Hhp<}+E}qN`h9bh4`V#543fcaddwg-uKr zMqaSSPHF}$>q!)#!A`S{HpHp0S!fu-GO|DraZw7HwfmNh-g&1Q)5cP_b za(_l4c`_4FPgr_3Z%&BFe@8`-tNYQriZy*sz1#V_P=H0{5l#_RX52^O69>{RY1D^y z#U3~GcCRm~O7k;N`?}PyNWhN28!b&NI%VfP%KHtKCneGpG8%qKU;A;XKF7rMTGn@2 zV)?hblQxbk$w{|qPJQmle&2elJ@N?nbi!}CD_>2ur;C00c?I1t*J)xZ#MmaPO29kv zu<8K!k#HxN-zdE-i+5BV-&dJecB>e+E2tj^8ZbXdS1A znyE^964#!Tj(%b&%#^;C0NbK*cI;i?N`>MIW+D1f-~7JLYj$OxQk~%#?)_sTlp1_f z#A~*$(v!*2>K@ zx`e+!`bTp8M8Mu#YX75zS1EzVoHCTwTcWlBbtmff4(iv`Ay(Eh_&k;zdfhRzxN zprxAkX=sTALGxM@WGPz)a{H0k;e7k@ZJ8taF4CO93rw&n32a}ROcgN-2!)1$hpEE< z9GBS&<&cg+IY5W`SlRs`W4urhXY|wm96XqJ`B!j4qA0sLuKC~de=Cik;GqFhLNFnY zcZFM*|N4&jTNm^swW10s;%o&LB>?mm+d1WN+u1icUsYr{~(dH!< zDVH@65fR&U`&py- zXxq{J4$2}hQ#kjMh>Hyt6rz`4B{|EG1FMl4s28TZs09AztJF46O%ZLM$_E&s5(SvOA9 zqA$Hww7i*fC$C&`*RX8E!skBFT2@f6Q&D$TGCGx)I;xfCRh_0|BytC66CzMA#;A^;dudcIGXnQ72s%)$xuMCjg; z*?6)SF=>}>jNMb(eg(nUdge?AtT)iiy6d?&Em$#9UqN(&S^Y-m8LWD&m<<-b}I7NXvSOgq}iq_Z<#`5QDLmSsdy;UbG zX_$EenhE^uJ?c5B@z`TovceZ84N^0=^uRaOIh^v} zji;4E?4Bs`2NcTmpQ@Rsad3B*!}6vUMz-~E_Vefk!pdE@*G#MQV?$i!l?9dY{L2W$ zT6~!CtZXuAd4xDC_pX)m&-Lw|TscbbBYl_%x_CYMPmOK%#+lFJgZdLvKfF`Aj`fJZ zZ&<{p6Poo>eHXv9h5J3E-{&m!u~-8i;ukI*W|NGEYvtDcr#a~mh2zKK}FfG;Y(HbX{o-2mS- z>Q@xvNx|Zh{6yC(<5-yCJYbfyB)|`ugR0Xm6ygbJV~NKz$)*Qp%Ji3O!S_pE1)MBi zg7oSVdL}x7lU^dp7b*4{QP7gOq0N_0re*lfCIY9fJc5OnrtX-?fWv3~UK`y9sxIvY<;!CTpG z|4oDu{L1E1wV!tuIpbjYZ62PsW2`)-^h(2ytO^Lq-9*mMO(SgBQ6l5|EF2P=A7iG3~)t1C_1m@9_CdIOIurcDdIgy6t zQ0mhdscit13~`-l^P?51d)Lz+e3_^8=(*@!pze6iBpLZ(Mnuy`*X3uaXcaqrUgBeR zO%sj$T2}1%mgkXi@z<5s0o(zjIc5?#h2GX%{j!L_@auo_8vobv9*7k?CjYy@`oSs% zDw8Aj0tYK2+Cug1D5a?2=DCHqE?B4n+d-u)E1Aavtt`i9HPOJk?QAky;G?kzA~Of-MPlwJe{Yj$Ew=Tv&EY4;MP5p2#} zewx8HqFpAYH}x6<*@kWpjz!@HeADAw=XwP94bE*-MS%vGlY<0sEZ?PPOuC5u49ueMe~z#!ER7{yZ-y zo|494WLu%5q*5S4{J2#P{Ab8hI(XiZl0MLOH=iMM8-fFuxl4Oq9PbI!lj90_9COPb zxqFko3+ryqTt5}wgSo%VcMWH1$_0G2VQ2E1%9j6X_v!XCRaJ(2?Rj3l+cM5Yd&!>u)HE(eJEN|C8Xo4SGs;|s{( zxbRkYvr|cPvxiJXZK~f1ZILykgxyBZ+liNM|E3|o6wWx6#dzvtmIEESWmhOXGr&%= zSy(XbE#!SG^=D6_1dHW7q{IsTfz@--uW`!jA>z`u;>P&~(N93P7d3_!Ca7F3Vu*tS z0~MC}hGf2KDWu_1R+^M?o#sx$sGQbR|4lF7*I+b1YfgAzzE|V0@2WGf%sNe5wUQr?S1_*3Z@{@`>gVf3kbXK`1` z#@b43LGZUPuf(!#W{N7MTh;I4k>^)BJw|Jy24L-7jqtx&t*zGMG$w zKCl*qO~22=_Dbm&8s63D)%;ZI;S#=Ehx}m0J{kNxVnf@K0*(=yMtS`H98B_5$Mz+v z+L$sO|8VFftHqLgWA|=JQ4#F^sl~Rt;k`7UuM=P3IE4$D`aG@e5W@!Lk3x)1)pf>M zluAFbi^f-);GLTfH7Pt!WQMR7MwD&c3O&~gA{4LacZooJr!2IyM4wY;* z$DppMKabDj={m;`0dLKe$0g31KM7rLUC5YuduvFZCfZ$6jeI0hNsbM6Tk{3K2q_Rq z_H0ER<`LTtR@Txo#rA76v1ibJ6ua0Fs+_v-{!EE7wfeT6BW5fh7tgDPgc?!DHn3z8xB+!9kRgqlr(t#~yxcn%4{`sj z{0gUcVswAaDblW@%U(!mUWH>kQ>aW4-`60upk+pwBefZCjS^2YkR30cG<8?Mep;(F zqQ{R?;n6dR+Z%mE0I_P-6pIFdo(Yexba|Ng)<@X%w0=-tu zCoVSO{nr0JSM5#KJaUe|IFr4J>tfnBnXFN@>NP^wqX5{plqpy_E&5F4F;IHjLDGMM zueN_Epki7VuqZ&UqPz`H~|Vt2ifES8rA`t z41y|=%s`6uj^e}#k_Ik-=wRUJM>6ck7^*3&oE+hn`zk>;R(8GZ?H@|(l0U$IUChLO zfFB>pR_jfW5S)et5*3#g-AV5cvg|bxXHU44?Z101lvv_~M=z!75ugAO)L54j3)IXR zJ9JP<=A#S3hq=Bj~|AR;v$()F7+&- zIWc}Ca{0{R45>>=0*g^^N-#rvNhJHKx_}<4m9%~#(MG&BbBNxXEoyoxj zfwA}tag(I-c5GWOEP3=zLFc3bp=O;A&XF3nVx&}R9zlp20>6#as>-{RVh18XYKwVE zoSvsr=GPEr>%VG}Rc+`a($p|>Vfu}B{3PHTG05rJCXll^=99&={Ybvd6ibZTiZ!QG zI}AgX-B5v5XiXG*x*(|rwNjlLX9t|8OsLoGakA3DC5GR$O4y}K+ zpFILoEEJ8=xxqp>ue2ICQv@pY)=7_7Dr}g}F$}kbGpLZa{+_n)nUFDb+pIM4_1gGw zaHxfSb&V`=Oh{qsPe0`<7B4v#-}cS~j;tETqjV?Bcmx-%Pp10j;&P-bk;9X6&r2G3 z<I+B`cm5%GsiubJqCW)0fL^q0-Hi zF?{)Mb~(%>N%UxDh4n%&um=tNhtz2Eol#WDZiWCQPAij^8Ksy3YtAU6{;h*JR5mDN z^>jG-A;DT0mx&%NFKt2U+qxsMJivF1T(*rwDPk;MYeX!8#H{~7=oS&iHIfO(d)9YP z+;O)_&{xneyN>=BRwQND!5upjDqdhuJUOOgrLJ}^CA)G|zE47Mec)-^*t#O~IaM2e zj3Se6Cq7`E0b_vj8HUUe%r%|Yk8!+BK4e-yk$q!haLzxFz^NhAcK7+wWlyqxFWGt^ zQK{U}TpLUkomP}bFX-E0L_8gm!awqU_YZZkfYd*hDhM-5rC61Xue11A{<(zvj1hb2yUCdCjds*3oWg zixYY>uc?jsp|1nXtHX>IA7tNdNY1X;*?ip&%0&o#dZ_|IRg4tF+G)5Hg(OKNlZh+ig7RvTQ!vTcQe)m8we_-VZ<4wW@KC=~o$CWA`_kay>KlsqQ^mMe}47RlB~Hpd_YixUGeaMqE&DNEa!W^hOs zg5-@Cx;=Ln1jIto=L&tqsZk^Sdy#rn4 zrOzx94v*YPl}!Nx8u1`9@54N(-h0n;g>ofs69v#PU?2hrjJp)4y94ysJa+ht?nY2v z9ioO_ih8xf*}}lXL;x=LWsA^8ga}UZ{KYUcJ=^Ug)-YwMbVgJ0vh@jFLL0tg_o1fN-NB_=JJ)%=nC|*VMPwi4z6nqavb_kU}CgBgP*k$bB^K z=t%*bo0FAAXFNJN2v7_GSP3NvPI%9QyTM)zluE#;Ry}QRsje@(B*v9e@q5ujZ z+S_KBQHU7f8wBC!bo-nL4u&JDq7^hG8Gwo)rOGVGL5xNr20#WOfDrr?D^HMI9$f05 zelb^W&Sri2@k_XpAn~iqyh0osloE2Gb#Y3^M9W0D%B7F{L$3=xC?8)_B#GSItaiGoz{m z1~ED(W=SN6k)enuc)-$F6=P+WYYizVDnQ8NZ4eX}*{%)1q9KSH7#-zk*rT$E957WJ z0oj?#ACz&8l^8LwW2!VXQzD@OJJ5Ap-lj6+&GNX-^TzmidF!B(bP&?D;d&^%4I=`9 zR6Izb`UAp!-{6wAy!0-TUB_Ci zmGnjJ^yJeulB+v7d``iGDajcF5JZkBb4AGO!3Z^Z-nG4Jk_HZdposR8x zo2_`fUEy0)OT6!$b>AMV7PMCx*Bob;lr~Ax2!cRl=yz9= zODQEKyH}j<*1VNe4AKM;glCS8z@iKgs#q--*V(lpjzc^lc3OX+t)k!Y`~7cU?^KUX z#Md4;=N%9XhQR`kNknOV78pFt>2Iw0#kK(N%_YE@^o z(JO&U6j6rlX)4B2HiTFpj}VH6YN#H}%+QFntm}Fc9q&pVosT)^p18r_*l;1hosXeH z%ms!#4Fy`F5rGJBh8fH7_g$_~`e`(Dey_mapJ#2(XtWgB5G+bPJuY%ufWsLW#yS|m zNCq*HLYgxRduu=h5U;FT69f}OYw`(Id1-3k0Kf{WRjO60hyd7{Fjv7K8>SViRqNt8 zWM=OeWM$dCVP*!;8P?}=`N@e@m3ldvT?)X(kr2b6C;6AZiJbkr6RCmc1>x_V+4q^Qz-p-w!&XUu$8=kf94ZwX-VFf)ElA zA(Ui3kG96*7sj}om&0!Tb5YIbH50aC~VFtz+f+5^WBtQsdN+J$TM5?hO zA`u|0LMl}Y5Q`F^f$mZ5)o4&$AX~b?Lk^4t!Vr3j1WX|VViHkE;>Ca%R%^#T3}>Cp zah#MZIHe7&V{sl#DhNeVfQU9CFmbX}>a9m!D;r3XM2OOLjB6l}Hsi8NDMd1hsbgt2 z<5stdQ6(xRaVE!9q?HlKl^Cl+mPsw7Zr1FuRmlljrKH7C1s$@rREb+?rilfjfo#!D zx8+WnqAl)5i^2PyyO`N7S4k@_-qmg?uP$FXs!MI<^pZ)#6;i57qOR?QE8X4P?(XjH z?(XjH?(VFz@TBWAGrPOHrt+1H?(Xipx~}46s-dHF4II0!@4LIZySuxI?(XjH z?rpMrq?5b5x=haI^D{e%?vcLfGbHZJQk7qB38FA4Q=P=;cXh^RY}qD^-tO+e_q&)p zs_(dR*O$)4=5fBn?|ZU#jhBx3(;AaOQ10BUv`W_G+O6Kq%_b3d&V^Y*Y0+LmR)ECe zPR&ga%RO^NVbeorI4`3%!)%K8ZNj@?%o1i3;#MbI*<5LIi1Sp@B?4Ci-BR7^ru&R7hT-< zH(@I0?kf;6%C`3V2q4_L?3^%YnZvctx5C(k4L9aVe5obH%q3TF4~mL;v{$)IHnn!-)>VeaO0eD5Dt4Pp_$jtD?Q_e3$j6G z0@)_l49D){wB%bQcmm69fGb5_p_a>Gb*i`Stkt`ZbXL$(WXh7qP~5wfaMxws8pbvb zUB+;(=JjL4lZb5av%R&z4v1Y$oMGWtM{1DEW@}eeDGv4RZ+Smz!gkKHt#@_pa-1+} z_GuUb?T9+1OwJJ+&Zk>~=S?QwVS36H-J0QA5zFo};U&q+)rl8fGIUzn++({JyHLBD zLr6o6ZVkKEvg6*EdQQQKjMM5M3%Fa{&Bu>-QVeHK(X=bbu4Ij%PW2jVts(2p8!gh; z#|J*%xuYLmDRcygJL*AjP*r2BfeZJu1Q&>0w~wbns&K5QN@8NCZf+JbO%>0**WEiu zld$f>(L*mal%>U^t%fXV-)H4TO0zJY_VQpV*2QBT4d76!q%*@-ZozAOx_j{FDRP9!#p#b+ze zsfgpf;eODqiqo3J?dN2+C@*@AL^j9*^xJs-S2MBZBW`8~oxP%RycIjb^=}D?W39IO zP8>%zhA3d`eyj8DVe6U9G;x~hajA2cQPnd>WdoNDIvrZ51CKE5YXViTc3jO@boXmp ztG!xkuBv941t%_*ZPK0`US0#6d)TFCfKLY5$5%siSO}UoqfxxB?9Q>FIE_l2-dBXd z7AzZ4bK^)!ZQ@wo=V-$R26Am2g7t1PD@P6v{RbI}xxK^eGFzbe_HN*|p?R8Kq?lDm z%)_9z3<}~&XHNlL22~4F4?RP7PV$eijozEDffDT}?bIb{uv+K2mXNwDFzFX_Zq%KS zDGBWDp=$d(4rWc!E2ZkKcZWL_FMG6MS~m*xmd|XyciuYeE7D^VIXe{81O;+7>Z`jc z^WmJPW7FVHW*S!j4)x^*XjMF(xv@M_u?ozf@YRf@Q3pq6W%cbClHw-z=W9EgJ(Z8w zkUD0n)!%dl3d{F^BH5h*V_baJ415jUAA1n3c}nW|KDKu9Rb%JM^D-f4UVCh$(Ms`m zg+2q02V%k#SGLS_W@1>mW}Re}+g%g$L}949tJzU&-s0W9>(_qn*vlKW=|Z!IJ{}au zUxtHrM0hnR(#0^t8R{TiE8MAxumj2|Rh~UpmH=?%?HRS+@SB#ER+_su&z1Suc(m1I zxg(_Jz-eXN7h={?m(^H%TAOO>w$g3SO}|y>m&W9bVz6cOTBY%KyIopWP8F%U1Z5Mp zH1)O^g82?>EZYkwNH==Zyh8G5$Cqf@NF`;u61W_iGP!L~SxNSUEK(TG(7waDIP}A{ zo(a{{GadP02b(y6vPfZF@B!x@u1YZAa>K}ZcPE*E#cks4YkBGH>|1h8p-QRjjr2o> zG8%$n_n#_PIKgFCa5i;e0kCTz-U()B4zk|Sp1K)9Wf4@nCD_XAF05zrpdhdQ)C3j( zdVqqy$^uGC2xOomf~o-j_ykcD{>lOpOOOZ>O`Z6svmM>{Jo;QUWx2}L*0spl70&aA zYRu-Hfv07s<}h39_sl7$me7C&0;sS%GOTrq#kH@k_&+-q&==~d?=LXNh{Lr@bCNrT zZuJsIy);D48N|5si`K@jpeKM0yc@o@x1Ll?GLr%F zo!o!#gkG0eR3x@^)~{u{Ui+}{YSXqDdynT=2-*vNUvR7#H_LZ#Y}vN{m1JR5Y}Za( zFx{WJgTU`0$>!YVE>D4xYWlA$bJPenx(Sqa;V;xSXd72&Gd7-web1wlI{I0=CUv8s z14S~}L|v0H9qPvQHa5dDXwc&`9sSZ@u~0PCRo#ae%pw1QC7gV&(Ps zH0{Y<+JM)1$%XYrL<&ikTC-zpwDUnp>bR=4nX7ulr)?1FsDLa^(!Mg7_v;wL@7=af zH@fS2$<0yMiYg+s*=B3YaO$Lm4gv920on7Xh%g90)Fjz1SDARJ9S(-6(De=SchN|!9k2o>3`F}4A^W8h*!pZ?j7$O{GVz$PM03ibD z=@EIz-fJ~1x>Ev3!*-QHjhM0lMCT>pS3f>xVnRfn)2LOK<`&^RkmM#x?Xw3dDoqEb&h~?jtvzE6u}JZI+cY)n#b&O9VBnx;jYeqXCE)(W}TuNlG*BR%-W zTu*+k(NZTAX}5%xK2T7~Nkbnr6dK=mH+7Wgzcv?%LX+EGy-{E6=qM#9oF&l*$~O7B5DY>(Vr? zto0{HndB-#B~w_jIWFzZRyN{WI!3N8ihf1ya#!`1sk8s;2rzDGae* zAU6=e{g=u3QeYt;EMhtGdhSz|kQO1zzj`#{PcB%8rl1VKlXTfS=QjX>wa-5_^_~m! z^G~|uvVnkZ2Z}bA2J9PPBUZNOsfjkxsR<+8 z&r;xu4C$w!f`vXp8NeWyq4B`Xl5})REXuqhl&Y&#QdLs%!CVfE(v~u0 zypBr*kVgd$fQn&8GcgB&n2a=*HsG@ZP*QBbG-wQZc@?7wICvlz1Q`TSgrNZTZpY88 zjZqAnC^`^M6X{T^=t2qZc3`SLI{KDqR6LNu2(PcLb=7b<`W6ucECeZ&6f{wdFBV!= zAyQ7(Ccz;zFfW;A!$fpq1W0UQ3?P27NQS3dt$8c*mBk5Oua}+9d32J72w;L3L)6o& z`w8q*U6^KkYgyuo@g zje3M52fV2oZtj*;4lI}oMPwtzBDSsCK{D-INjhqr7Ktd++8eyvO~NE8R&2v$B0&it zO~rJRKwU|014I&&DjdaSnKeP`lTF>)gLTcO#|o9k_0(-iN>n9-B(5Z`wn6T=_M3NR zY7L?qE-^QCJec=)aiuVtZF#SAN@YdHkhPTBsk=4g*haHzsyeJ0tn&gwLqEa+0!hxg z=E=#A3yjxR7x)!`Pl@m#lcPh;zs%LafJ>JAB3Pn~!kHwOm1G`C==xX?j#|hFPT)1k zrn8kZRq;GY}MB8K#8QW*9}4(d3oU5+lar&ygVKgBHgmGPtd-|a#?s%)IAqHPm! z;<9liA~Odysxx<537m@9J#@i`EDk#2RP<9yWh4 zgb;{?6f-4UEbZ`$T0pNnTtQ^Hovya<*BF9i5-5u)$7c&7niy)*b@2Nye}5#gndFaq zg@`xRS;rw1z*Gu^(3&F2fSD$2ZyB)5Fz+{Vk~*$@`LomKiWZ*_wDg__4%=Qua_>3L zOwT#aVj?0U9o=rXkpxAImIrE#A>Qj*^JkxQahirp>#M;5W_Z7NA(jUSQ3EG)raIY; zmK&}aKoX~?+P54CC{r3g;O`g_^6Krnr~F{T$o<-?Uuyg!qQl_!~ZHN~N~#2HQZ$pb{UvwuthLX!gR$?sx#Lrcf>b^ zE*W;UU6ALg27Kj5GC19R6az=sHQDO9LT7u8BUdMIeO(#vkF6CjJjH7yrdc(f_iC=r z$dgj^qfjG^P`Wj(XeUOuy)S7tQ9;(Zw<>I^a%7y<>x+`w_8)pNS<;PnDvy$)(W7in zc);`7T$%EFt{_C`V9O`AmW}IfnVFZ-@N~^tlX!^MwazT;%cy;%>UTWmr=ZVV!byWO z3J7BlvEXokI_Qo;yp{9*fAZ`6pYlFFf71U<`ultP{2mGKbKZ$&X6~_!jbIWtGWy`u z8L?spMyIZO};mb&=fx!kP5nXGDhsYb_iem5W*@iu?Py_7zlVxL>i(}3}GZBwgDudubcJbcjNcC1~~H%f6u=! z$qjrVqLR6}NW}*%0~$)Np&LbA60>MP|@*~G`9*|rGV3B4D3GUh6_ zI>#c$vjB^aRXHG#OIA|zM+sN0nxxh&pm1=-P&w5RnUQjpSw$rj3+UU2$Ep<1ZZlma zgC+*g&-MB<&z_C5v-iKwoLFZs3F-BI)#Oo%yVh?vRoa`rHVrD3S59QAnpIo^C52T~ zM9(%C7;Ipf!2$>^7962D-p4cs_67*B7D1ZlEEqH1+Af~#7LU;q!1(X)_1rR0b<_guV|k4Q+G(S>tY%WN483}AH}ad}H* zT4OpRe(7_X6`DLI3zwX=XLUNenK^B?@=C^Fh(U!V!C(X+ieU=?ks~K1AHood*hQVc zkI!GJ$!WjBb#V#URHrmfSAS&L?=>kQHSd?G+UM!Ja<-b;34f>gJP`3zJ)`M&ixgk( zJOCfu54!j91@K4S*eOF*aAtwxAAVkZv%mr2+(+xd|A;O>zBdt!@BEn=^yXE;l>d<2 z1;8XY%xtV{eb*iyx#yO=cjKNsXR1RZJcKMlL}3pkk75k4BRFv6T2(Yc#E!xPTP=ub z2m@pY!X}Q)0ZN%b^9&7-gu&QA|{CuyzfY$?m>1+fyV0i6F+r!2- z6tpQs<`qz(Pou!2KcEn3WR!CUikY@Z)y*5;ZGwT-kpmUODlOFlh*^S2Ll58k{$ul#=X6?B`~H43 zdwA4biDcVYyz|c_j_#G` zmw6cz67Jz@tVZs_;HoifxQOMdroXQJEBr{?jWsr3lsdM2zpvtcd-KMUZ7fKuR5U5_ z5G7h!$)+#IyL?_SW2PbqB=GPbv0~Q|@~w|}52anVd_BT`D_?!8(TBxj0Ad}+oc=yd zn2F2ZU>c&4;acz}@s1`#%3iG~IPgM@I51T+9)2t+tQ zVF4Hr#?1~I1~g!pCK+8xOG!y2y6beZNiLNxx>S}*Tc*}tzSO?@t#j)bO8%Lin;(qc z6@i+=F%pI$fQWd)h?X?KG5n8wTZB2_bx$X64hSzX08ieYU~%|r#EuU4P#XyEJd)DHYAkDR}>l$tQ49F>Da{QH!h-X*{s;fNI_oUwct@D{_BiMO_Ae`e~pkdMMkH*kNIL0y2l47Aw!4W7hpr}tr zl*q&kvE&o-iE%{$^w^*=fOHZ8{Ruy%P)Nob`Tk6sxBeZ#2)wE|mZZ!3Q#?N0nt=QO z0pagbMR0_LeLQ>!C*An-QRsE9lnv!+ts~)~wF2m%-rU%gs!nMQ;%K^5q)PY)#%wTW zZ0G}Ur+O&mz-DTW{C0-T_h%D5Q9x7F`@v0lCn_lsi3k%z0Bztl@#jCU=6+ukZ~AU2 z@nKf@+5UcWj!0}iB8R8}8Az933VYM|Ro1saXdWN8NDltKe*y)G+|_XRyUc;@;-?vs z5x}3>{XVdmKR(>x&Ncaf#x+|PTFqO%RFXvQ4J_rZQ z8Bf>Cq{cCL*9YkzygW1S=U&jO{73FzS2Xt2?3G^u25{DZT+wmJ6p)A{op7h~AIA-S z{nh*5<;%vkTieGMhYtzK3K&TtM2BAwP>|2$_sFJt96#-Uvw9G78z#Ji{&YF~&=v&? zy#?g+r20!PdQnnfGeA?@kfO60=&~qZck6x374>pvFcC>eNQQt@B^Ng_nRdSy$@=~9 z%whce&*z-O;rby6JpC{aYvbFDAB>qYBvn-fib^*m1Y{D;d*}6B0ppU2h?KQTKn?~QLbO?SpTU1z@e?-@=& zPb3H&6i`Ve2?;?)3N$465`p(2C$0>B66k+*N9!>9^|B#gkI#b)ZV&6X(!s>Di~^z_ z5P-1-$65|ayxE%d{1E`O#qWj?O;F{OY&Yucn9QBm87Q+}byXOnSDM{d6067O=ge)= zeB}o5igEe#=CcsM{nY`(57_;H7sG?Sf5-- z7xK5)F>`gf8|76fmXjD?7tXYomO#`J>9o61EQ{EE`W(V%Iwsi&krq7Y%H$$>1ZK6n zTyqfC@E$Cw%iD+Xp%-kfxt?K_l=Z{Kr2Tw%n69Oo%PiE=j}-YO7FEuBL|o5($8*)m zj7Kpt`LwGrtzw+z&VuJiC{PMj%dK0@Smt1MEFIet15ujsiu08$=80q2YnLdJ&4fuz zZHt^inR1tyE-P^r9JVaSY>lv}bY=;=3zk4z-b^$5ZG?8DMgNIwt&Ril^e2d1``qtmshTPumT@C&B+O-6Bke~Q>wTfiHtD= zLjg!&00CLx3=wH2YOc2X*F@rMS1*GzV7bO_b~T`!;%51)?Oa55wD*y;GX{i-xd`l% zM%_zgrDypixm>IF$cTKHTUQxy|i~*i&S$D$_wLD`O zB646@ykG-7wX(@GHb)x+7{E;|&R1REGfwc8PKbt*JE8>C5OAEQS#vWuNu2LF=C8MW?d6}f zJ8Nr7#t!s=fe`=@un2&X7y$_4PZ*%bV^%7w5r~K=!10c3*Yebf&+dO~?^^!aSaY`5 zV>@hn&a*J!Q;ET<=~SWdWkL)Ed50t@N0MeY0~jQeHU5>?zQMg-Vk@J&k@r~O2aQ1r z=bZ&ry1KQ20z4QG^zy&oe?BzF#t|g#nZ0=|cu<>i^}FZE&N{7QF15Y9V;9g$G)|8C zjW9-C&Ydzv*HLSmw{XtwI_ahb-45HFmBMCSF>Y6PH+4AEw{qm}H#@qO*tx@(7fzjb zJCRY`B|m4nzdzIT_4<|j@GTUXSJVfs+n3_XNeeUi`#dz^9{NKNrGld`ip@p@kiksi zM6AF)&+|&M)r^*6I?z)!=QzE*ajk2Q9L&$Kgph=kb^Sekf%3QXJ>b8vKfUJGCjgM~t=x_zU-^UgToN&C;);1X6k#<*n~C*}ed90R$jE z>l_XJPwliT*Q&M3sX*ncO6BEeo=a7iM3}CaT5B^{s?BuXk#|CM2-1h9Sb-)G(yX|E zM6|_>SOo;83J^p(&pNDV)o%I5oXVL64H}5OmshMncrHG%lCRxQaWUAUeb61Y@s9Gd zl;?GjMT!J(o}YO>woF<@G~(`}rZ&i}Yuk2URVCExr@-o6l@@8%OXF0RLLY+5$brkY zuCrOIImpUEYk=b=rwp6y@Riq;C<0G_;5-rV2I)Exj>XhA!_f8HJVY2RRVI>7j`h;* z3Up(ruVCL3p1yR}-9$CeFNbJ-gL>kC(X>u;G&mz!Oi;KFh#B4^KAzhmIRULm7z9UqmqR03n*%R)0E+T)UKnxr1wb; z(%y`u$g&@*dAnN|L*3i2ySe6TJimJVEqvdwoeQVGK-^ufV>?Y>WYzk9ZQ8s1XD6_MnfjMLPib6TdTys9dIh&Q1`3$!H`?y_Wp*@mJikddL98w+S8x1Nr+tJJE> z6;R+pDgmR^zz;$yp=y)jRniT4E(+;eqAMy}W+6)|%Tko2r73IThHv|)Tu*+p@m6EY zy1FANRF#2+iJP`~bWYKxq+s&qHnBN8k>tBgOF;P2}2%KhhWoA12qA6ml-Fz8tz zA%+59*PC};@4a(b$1eDWX7#>z)pc900#sx~kr)`>`rZ|ruS$=S$uQ9)5~<+yY4Z}Q zZmYDtXXQ*f@P=n;RW1`$OTVUVI^^Tp23>HZ&Q;gT%jKh}9ezyb$<&%bcb_{BL8*~BFj zj}%fkOu6IN1lhuBhwSTlHO&ofOE!%TESM9dWlAuO(MaYtJHeQPk^%K*XtIwQ>v9Js zxp=^7ljeK}19?Vf=o(;yMhTw?*2^7Zpp5h0!02-hx}W66R$z!?UvI8bY8HXL{q$;L zA_9^v>l8ei#gfxJS4$DBnl`T(p#_T+g2X^r3I!iCzW)J@NYZGS?71uFCHV7j(Vef*8FkFE((JnfHE-rXW3aX|0?tTKk?Jya{K>= zc%2*0_~!>a(_B3^=CjZVpq2$s(d=&d5D%vVfy_QQNV4vX7evfO5B7#o)u5(z^NGpt zlb{ny(sXj|lxEBl83bfA2uNy9e%v_i0rkIrZ8&WQuS8UOKmg>yI8+o)_82-7Go%Z_ zgILQX@JxpjPWgy=Q-=qeITh*p3Q7tJXepFplqk_g#j6@NM5Nf%RLc}>N^F{qMWn?R zELzD%lV7jv`TpO7SUIn$fAjue%6sbU_8$aB0VNc_^RL?{@0-Q&HLTl?1YgxrOoGse z)95XdNWp;tks;C1{Gv+gudMFJjF)#+Tk)zmw8tTs9bYo~>lJ)#q9hO!G6F_KhxWhc z=Wb~KN}j*pZyGOqFP-m)nw#W>K?ztPP#y{T4|6_%kI&QNvFsrdWAuU7gB8I|8#*ng zA}3ycMLv5D)3aic7hKj%hXDA5Bry*hLnj+1!~Pg5Y&Aady_yhp!g({Dm*n9S~X?Bz#rn>e({(7VKM&%EAMx$HtkE;Lt*%Gcie$8 zd+ej5aq`6}4IiBH1?fJxu-P~SX5auEA}2g=Z_Ww88{_N09yS|>iLh7et>ZzWXor$W zndc#yF_Dra&s?25Hcf`mmRu+;jot!#a5x%7=G`uo*WeF=5+Mm#v8byvCe~9@lxrod z(^WL8O|)AYqSj4C8cHoiu~@1o+eW}B3Qy0-|9kJ|{@bd~tIQz}o;W%E9UkocOga3h zg04W4NgO-?`%6iXRqg^Oe_v>hk||-vF**>hFN|XtPvZZ<#^e3x@!fIygFPk_8JK*& zbgo)~qNW-c$L!#&05QC6eM1j|02T=RH{ueTD7z(=T@+J8Nf4kAYD-FN znkz*`7_A#jN^?$ zNKc3Oy<7kR>p8weM+A}QcUs;no5A}1?}M)wh5@`>IzwC6OaMB6o$vdP^9T86Zr$s9 z#>gL@7vusa3rPMD#P{#ldkw?k#D`kRnVg~#x^|`k>_2e^rG4y~|W^RUovjW=I}GzImX#8klQu-&>E8k z9ao4N921GL9^mk{en-TVGZQflC{aeTZ6+wT6riZmY$hm5G*KEfSlUV{Vo-@%1|^|C zKga9!`a1ou;(GPZaF7oB`t}@E)$-!2>+47Q4?ZfZU;ubE`*d;DS=L&r&EN5^^?7*a z5&~+~>l$E5_r-s|tKt1>-fvsxZ(UsJP&-8Y`SwFo0Vzb2Kwv~Ji~U;otHCoOGZ-dj zcc9eX@Mqbfxo(+*0Q*>Jnj1Mnna(fU;d{WtnTDQPT=y{C>d!O{!0aGQIYs@O@X9iq zDU%tpmRT}vYBr+Aq}q!`CeUnYDBDq_vNJ|ylF4Ez8Wxp^VipKP@%TRu&tz${?Fwv^Q{bTeS#9I;NzdqBN~%hgsRA9$3_ASB^PF!x>&B;HT^&dXAaa7j za+FSvFByOVvpe8J?w4QZQhPL`Z^a-;dVc5JplR zF+mY?0|=p*lb)Sfurx$x_hp+s(K8a!){Nl9$2-9d$opCfHN01NA(#nzyY*`NeU$-oP7CMA>)dAdZX1aGm7_j zkKBPV+o~vQGDr`6Z@bSWo!pvy`ufo%*#k6f8lWgRz*%VVMIxD$@n&F{#PBHd#z53C z93_(EO4=K;&=)c?JF5>(IfY?P3qNJKl*e&uKYa7{;>^%w#-n2wYIVe%{Eb|6RQ-JB85sV+CtfX zS0<;;a^mGKKvZKR6B#1MiEg_`n%PB7Q*IDgXpA|c*3pzE)+4+*sx@$x;1E1otk`J~ zH0iktvTb@$)Ja4l6$z^|5;3$gD-&o~l1n1pu^U)qNP@fO~_*=W*RFVU}gwXFqrA9Tr@NjTCOWwEX}0?%7t?&k~XF+ zN+v8ssOGqF&2L$y9qBL=`H=8X&=Ce^0tP}pIOYm|p)!d7>d?$?XSMHVbzRPL%Btr( zy#F(tcM~w{tq%|bWP98$bDK3qIJr!*84;1^dj)87G9)2m4OIa|FXBwLKF{A#C7wKr z5E>o=LYbI4N1D#Jz5CwxyWIQAX{oPmG@k77*SoutfI%ct5r{?tA}ENk{<;3&?fhcz z`@h25CpGQwVN4Addwi#aj#$_O`Xu|rll^?JS03&QEy0_wVjlJYZ~OKG`MT6nj%IuV z9s`A5XI)v5UCY7Z0@k9{l4ruhj+(j(LR>7CD`8B!ERmBFQA~`PF-HZ92-_qO))N{; z*lJBqLykJYoVAmzG!$VanrAH)Xo=QPW;kmcDV-UkNunXBLn2Z|j}%E@KuI?N3K2k# zG04HPH6$3KGGk3e97v6rePDkd(fRoW!(CJ-p;yvM5jhODMhO{r; zoq9|~bVjNSu9_^=IbfD%J2}-`sdJzXWcBx5o$K??YR7#lBp@9Up%Bm{KxQ+owDZKB z`1q-MkhnYK5{jZnJ2WC1n__~McTiTUbMfxzv#J7hYcX2tf>lXiltyL|l-MMokxo|7 zS1@43xOOi!DQ`HW&QA8*d(E|Y_UXVH!xF^UwLaC_=Ay=_wX(#ymDSePRB1NGlT%We zV$BMyS|Y)M3IZSwH>~cnX0H@oP?EAc9S2F>azRT5tt`Zl#BFf3DxKwx&tzFy&%?zv(s?8cSkuL>M)Jaq&haWUFixbmhw?KgR)jj$+9 zW7ZJ8seNL%9#X?6R13C8rABc81(!Oxs1x8eXG4mGO#XV#zkjyV$RIvhk;;bX;+o(~d9)%4cRC0HA(sdc4{HBy-AszBR1-T>b*Jh!2>)#O0(ywepY4GE5+Fu;Qo zH>!4MHr@}X14e@YfwfShP+1gFXrU~Hrjn-Cs}BjSSeTk!;exybBy6WXis4#HZh&W(F*|PwMFfhPyLkt`OJ%u6#I?BLEgxMHst!$C1 zRZ!6jCaH99WzEv|aNuEqget2Lkpy}X7+`24q7f8`R2Cor0Ej?A!W9f4L|%4xom5Q6 zjLaOX4})>7Y-}2%`S~+GZHX($Z{AEzyknxlUtmO0SM%OCGg&4`DBM=9NyJhAQLLF;HG7C^`pQ8Eky~YHqveo z2F4f=zy=6I2tx@569~f$A{90sh9B2=M|X4b*%*vtV@x4N(t;#Y8~4d3!g#5%$Fs+4 zqZ#@@`1x_2?~XOgr$4P9Qvu&+4ukkFuU~uS@Mc%@ez^mQ$cBS@2~r_9=VqqIJ#|p73Y>LEfbGR_#W4e2 zYzJuUdVv>_vDkj(>0ekrf5A_yQ4uZn!!r{zFpE2?+hn`0lO~keB1s}D!4wq%5ufk- z=O^F4VGa1#SU*|eI{x54STUM2p3QQ75)jp2^S`~ke=0rHoLfXIxVu61~H6dE?~>-qy7FF|ADa3&eH0T^4J3y7{3a({m+NzsBJ7X zQ7Db9PkrzPqFQjus<7P}{~;|sw?DjAiLf_1`jDFqfr@Srqv^2P=oABgA<@ESa5JqJ ztH@-P=Z&!Eh;hL<7)b&_pU9{w(aC<_Q=_DTE`;Ktq0=ac6Ty8jQ+W)CA#!<#`XVBz zf}u#GVKs(S*{L>f;vW6pEyvgOo14JE7;)sfq4o3hVL_WHIQbGWfVR1}1LG(8Bq6|d zyDF)3AO!9>sn2v7uDPw_t*CZO)-qQW0!RtjQbI}Ln}4_ed}8Y#mjBw!&a;i;^{ktx z*g*UrM`Wmo(n%l{R7?Z$*QbGdAP|s9IDQ`R(S2|ZEGWvn(V^5JK$=Z;u-O2Teqawn z$HTx!aDYg!d70pzK6m2x#GH|w@Mi&tk_;v<1g=bmSV?wlqP%|G1CS#M_H&@f_09ps zg&9|zcYFS1q>3hFiHf30n=)lAXxWCwG;K^oO+~^gLcPf@?a^5KcCa;K{Qnq z%zs7^j!;CO%H=_ha3swZBpixGN-zH7)F1ng``O}16XklZ*YEfK*MGh2&2K;Sm94zB z^;Py$Io!B5izRnm#UzOSF2?=&29$v{|0|fO577N3_tIOt#6EccU-bX9dVkD+-;N1d z#K#P__kw|)?>XOGbJ3qf z|4M!m7BB?~?~)i0BNjCMK6E=_LKOKN6Brgy@vj>V!2~$flEEMdLsUu-21E4d-}-X{ z_mIXWjbnowL)sLE+1vttf4}M2an8Q~-|GLqFfoh=;`CO22|jk=js8Yhuwaa`BRI-^ z89hikZ0jeP83?4*iTsdXdLNxH@AROH2x!R$=NT5hWWROZ`@Z^uk%<+JUv7DL5mA4@ zRY#I80>Z)|0{*cO0dN$|6vR*^K*L>i(euY~@vvjXjFvJgP(U#NAjD(m=>A&_GFmxD zkobHfY%V!j|3{e|!u%cW!_XAgA325}&-j0zBP~ zX90hP00sc@gM$aQkexaz7=R)Qh7Lt~7Xb&RXNR7y8R|W=fN;&oZh4`mX_r1bp{1gW z-Z=3M1sF4DCZvS@{r&y)8UAa=_1uyY`SV@a6#M?yc%IpvUh&@*_Cg0;LxC2MYNahy zMihz_RC?6$Tyx{~de?h3yzh6eJG^@*&!yq+uWo$*N!5y5y5Jrdj4>Dk7%E^u#3Kv} z_Al+M%q-0JOlknr2vDqu$S585c{*=e1IhP5k&3n4LG zM+kO#_U(7iZfrZ}l<^F~B>^DFLg_ZuEhO7AwJg@8rl3f~NhgEN?qRQ&Ab9{LJa^mU z8t5^M`0&686c8e#1_+N75VhRaXOpN!*)*#ZB*anEu1Lg&hs&;rXZU~h|0C!qVr5r| zNdRLF@#?C?w2B~uB(=dDC)NPE)2|qcl)TtXnqCwf5HWyEMjSl9&A{8#ooK<) z0nH```@{|~da9qVw?~|P-~G=&2?&2mGV$79v8%=AVY0>+TU3sf<3RM?jM=%0xV1H^ zrfhRr3w5%frQN2i4SF_0I;I=A_2aK-d}*Q%Dm8y=nWzh?w_%q%)-7pMEM%yVV&#f8 zgI5%FCk8bLWG#C@Pia_!>?CXpWHeFlA3C)9_`7ZV%|V}=L!`T zi7sh#E>do+G}K*{jABGm<#g|w#(r;VPQDI}lGjec_kjOoNB`HWn03l5$j2-8E`uYBMUuUb3~y?jK~x!4oac2apB2~s^vkk z!K|cfTF&>o_r31-)fbt*SS?qI*umfcFbsePB#7QtS}#czN<mP^O~-UK%;a}sg>69S2J=s z+^02*aw`WCa_;K8w>8qK%I59VxnTML`^V9@cF4{_!22J@m^X;P0b$ZsAwqnJw^7bm z4>#G8@p?=SZg7vkuKk4m5&VBc{8=a0>yiF4sR|VMGWp_J=QghnBl+#(Vq8&l?YRu3hXJ z#^PJWc;2(mo@aJ1fr%BAg@c%7X7p-2nB@knX#B4>ds!o1x8-|O4MXE^jcd#sR`)P< z)@ExMc0L&|s_`S%-XyKHl@CCI?dyE6ac$iWYQU-2g97WBTI27ndU~b8jUrB7}>QT*??h08K1C>cjL#){%^mxQvKhaJ>C^garn65c{o_uY-BEj zAq%Mqew9)~L{YCG2U;7_J1&!U-Ir=2NfGX_+^!`@wv%HWDDNq({2#S~lI#smk+a&C-KnL)2CTR&5klO^qhuR2?q6CaCo>>ygUM*chwS zY%b9)l_IMk(pzZisDg8K<^?6RX^|@xcB~$1xsEji-G-sHcTGgml`XoJv5E;LZt`}F zNZHf!oXnkT!5{t$Y(bbKGkSvi%x#>*5Zx&`6z^tjDpGg?38fyjRy39I^oZ5-Ge21> zR5qbV#>oo#s%D$tUS9msH^y2@@)!bGz=!F}Um;M6Bu1tnl!>ItiudOF+oc@u5k3%? zKO3A8DKpHpJ_HdIl+4VEag1PpJi-(xrAnfzg(?(Fdg-I1`hB12{uvkB-~>J$!0^d~ zA5==8%>lDHHL4VIk}xi0t3(Ea695$ z7`&lGzB3$?CQ+%gN6TTSrelbe!NmpXfLve!kXRTUA&dq4ukiSM!8g3#Gx&g|v7bQr zPZ3Z`Pt7d3-Hy4&vt(Qz%z%zND_))>GxCo-=^2#{CfKiO#Y8xQ)<1t&c_k1 z(W4LR{#W(Lq5`}-LCsNs2jNH~KLCV45R6htU_0+eKx8}jgN|ST4>vQD@(h1IBZl_u z^53GhfA6XxmKc5L;7zmlV>PSw%Kc9Ybdp|w<*1J9d0rYkdkk-$aWd7+(D>|cE z;_DaVUtuJN0n{5>P@#iVEexu!ApxfvX|ouu#Q;w8OHP-UbFfe!qiy2<*QB=wn>zx`itm zMGUM#ehh#kGhTR{rE0haejF>Va)&|-2F#i|`>y}b>@2!7bZ0uh=QmXHK!)f(x>=9l zaswYI=^(N2Soyp30NH@*2g3*;4U^=r4jWUBMCZn#kfhQi6FSJyT`gBWGYjgW<-}-% z3Vq`k0BigG`vXC?h&Bo~3?}>0B!)z5YlnVQ;EO=mq}5<`>2NS0f|f714 z9={iL_xI8L`&qN{0^hre_5lUqy)LM_P=lmP^YtkYjd#<`#YtOyCe0%qM zL`9|^y5blxiaOPniYTOJc;6gL{c&9VXBR04y#HIF1TU-(^5mvwGZ&mR+`l1!`X7IP zzrGwx5WfPt6JNY5Wj#4zn?E1W1!GwRW*v({sevwrev~n>0}RCEqhc8UKL1q0svuJR zJrYkJkDx3OSg=4M^Mm1d{M8>T%d<3l4>RhreQILP4V~QU6J2f+IhT$@EQO{ebE_vZ z7G}t1OcR33k{$p*5)vU^5cBl`}Or(3D*jG9@h^_wj#z+wd8hlDpW$g2o2RfTA)2$PB;lMlyQ$l6D_| zF^Fh$*C#x?fiw_Fd&)H!HX}SH2uRwb)`m5Wz8%P53_vIE`ThSfuLisR_&#{S>+6r2 z=s7X=PNeA+RmR3chtWDFh|aRQXorLp6EI3h0u)d4=kWnAInH(>LI?0bLxJrD>LwLP zMJz@DhzvmN{s;C4zggcg~F>oXX~>jLW)`j=fI%$ul%&vc56} z<1Tfaj{X!&l~Rt0A>0G{hbim%pXR50aXo|JyT5s>a*9u0D`)fTU_>Rik`*Q7g*!0O z8)i5`6z5bWX!G=+T3_t_?|kchch37&KHkHO6v|0O4HT6HBFKA|c^TjLySzEGFtz|= z)*)omAq^&fL6F|EP=FR)0SjbUW9J$$1ImOByTA^&*GO%7btsgJ-;O82i8R0=ra~X* zi6I}ndi9h0_x;abUqQfys*5r#*ddTugdr5ym~OJvu9q?rOvN^B8dwe~w+4bVo?xVU zG-Q}Eka_YbRdLOnrfA2UgIcV2gCY&u_1swY3I^{MnX4pvuu5q&Fv+AEV$u<2BqR|9 zoCn1#E5@S0)u};ql*1w|Yh2^vzz44`Hudw2%;u+;lBs!Y%oyOIk0#rMLo3FHU3+jP zdXh0GRVhO0k|h>8M;gp%7NO!EnHOo8I-ih~awq`NJayV>2S9EM_%yTdu3R?b&s8T(UYk z?&CYLvC-YS>2$igjOo`o(_HJi<}w#uT<1>bZm#ZKr#U6fblm0L(bHYfyNvJLKR|zf zwfp{T)-IumSjMmGI)Doyc(X^X<1PRMj_Re1VWq*Uj3|4SM%bKTr0LzE_88_uTKR(Xp%?{}XfB0g3LB}h>j z9?^)jkq9qc&%FXZ7Dp#)xTD;gMEriQFBNya@^~>aCUwy~aJ2+tvOg2Yd*sN@&r~u5 z2<0xdT#9v3BnW7Vr3j~=JE+>T@q}^Ouc?+oJYND8m8)k?dfyxy-&I^~!<(ya=+rh0 z83stk1?#?ovdgMtIeg7L&T6Y#VC+axZ04?^*KjpsyEOJwgy!C3%gK#FOb{{V?rtvE z%cWfggV#fr<7&t>w=n$y-!tO4_J$yH*NMEGr9l)wSwd zRd_vP-s@p|*m|ki0=W(nQx$uSavNKEbFdp;S0BCaaY*A6$#Kj(ow=#o7ol@-8WrtG zBuYdMk2erLpvXR$XI6>rxJ`Fd#>QysB3nY&xNsi8Bqmr%NI-?pIiu%3_M`6~Xa6){ zQE|^`TPjj7$8|jK-JWh&PWHoyXkgacyVF-_)3e^2Gu`i&ZO;khdoDi)h@DN zV>L*LU3cHPp7Q<*)q$tnq3(bdi7S>t?h73y6dpI^{sS;YjxCY(dyN7kf|u-g>egQ*^EWB z9M>dhcn<7jaMY1Bb;DwWSnJ&!F0IRVW7d1T zGIdOrPt9Ld=fQF^m9<@jmGH{Qdubzvbf|=y^PFNRWVk z$=>$E9{>Uezl8DrNO7;GtMw*J;~5Gp4axrS8PfiaOFTmXu{JiwTLK+EyN~am5Bc}} z<>xs$&U}%74W@jO-5?0G0Yn*@iWv8injm7CsrkltW_R$95sm~PIDsv-tzM*HP6zY2 znJI%rM1jAaY`P3@d$govIF?~thRvdiQC=~ZeDD@?&!+0@gQ%W-V=n~oZ(#JvLwk^h z3~$HRocizg{QgVp#f~%lnKhi>&nrbz(1?u`EmcyjR*Cz;;Ps4Ry%nEd@cssS`a-qO zc|{0lgCV12_z)b?mkv?;orLH3)P4y-;X}T)y3YiM*oUzeASgjd9?54uM?r?H40Mb$ z9wGz;?^=$B;Vgr44%dco?g*Sujbu=?CQl?NFRX$+G{O7g)6KPizWX)|C?4sW{gkc(GgID z^VS2iqrQvXWGvm+n=nf;e@Z1w`mWGJ4=Fd~IgsK*(VwZ26!`!bzdfF)smVjvw?~U; zukHHv@%HCPdVFWt1A(%(E#+018~-o{69dJ9*TWc(f_V%Qwfv6k`-nSsM+9|c09DNHIYYM;~A z`>c52-mkjw@y9lEyd0rc@2Y>FcXf5yCjdXSYCV=BBtn29eEl|D=;TpF6ey!XMRN->KIlsLva2xt?~k%Wr{0ZBc7IX=B-2kRL5is#T?0wJ~xg{q7> z1=qqvI;})Hfh(L041NE96Y#xRv6MWi-WpO^vg#e&X$GL$Hc@|t$QsDYy6owDvK`~M$LLwyg_QF07;s7#4EpahP_ z7K;WP!-57zOwRbiqNbel@9T3jlnoF#pII}K8hLOSshgdFFDOGP*iC9&!UhOW+a#ao z=jIG|>IaX7?~jB~uV5GEFaTTlGb1x7lS;uJO%1ZSR@8jgJa?mYtG^#){{Kd;Ef>iS z#z0T)c^D?60#Krsni>y5)EiE~`>whWepslFe8!@qEO+P6qIn`PmGSXTt+qsQ zs1iTBuetjOsE+3F03SdW0eOsm5++C%fpPK~6cOVL`&e7XJ~5#-J^0*ozdQ9ph+g-! zvl!5rV9+4PG8i=Z@B`Wz0N^;QDKwbF%b3=+_50?tPpS*^;==90m?CK^nJ5@wpe&2eI5;&s zb*{W|!NIO5u6Q}o=H+ZLfdUW=3}sYHb;hGpA_x<+W!yS4iq5FEAGdMjyoh|tH>b|H zDkP|yL_tI2=QHuBqe%fhKDT!=Q*Mu9Fw#N=tQ8ZfD6PcI%9x_a?o7y=gS4vdt&>Og z&xCgnvhgF47ajs)RmwRSj2cct$pEXm(N$Wq;Nygpg)%j6QzewRC6-)@j0D9LVj30_ zmfC|jjF_}_upHh~7_$*}0PRx^O34-zWW?LtgMl+p@PJg&#?nA2^BdQ^dJbA_&@pBi zl34bdXo#UQNfSrP7=!R|Ngxn4;Jl$K#?j3U=O$>CV?(?VZVFW#X##Fsc}DdaQ58;E zR%MS4((#sKI;J8#yo3QhjF~pUqjc0lt#Ps@S%IQpiz6VJZd@n<+Vcdkd)dFfKyUZg z_x5K~UteDthu?Vb&PW@r%*^&?Z+q7_y@AW#@#BI-Fcf16<4*M%I%Gi@;LQ8fW)i(z zEj}RDuew<<;Sy6*THg75_q~4Y)#h_TYo=oyq%1?T`TD=}>?-c?%P4RC|23h`uT`yM zF#nX8D7Fyyy)A#6Sz!}a?(h4I7HZ;ds{*^NNeX(A^zpDmXm14CV-TAfYqqv^bzRZY z>g6zY)VSR1y6)}F+UD-34xH1gbn#Dpy+K+|f!f6^-OIoFUfv6RruUZD z&!nWR?|}CnuK)l7`b+9r35QGTs+)A{2Zna;=+GwI_g%-4j2nPuyiJStd&B|{iKFf{ zW38U(4~lp(tXb0I@dJt82Bfp7B7p;sNmS_m6?_6lpO^vK?KO z9szVOGgF4Iubs5}7I@7$j%oKRYT6@9hIAax4h(4MiOi&~#fbBG=Dx(;8sU8Iu+tae zBk06_xnADa*m`A)zV6<}i@v0~;?CJc@XlFxE$=L4OoGV5Kq2jO9`67xF{Qnz<=u3x z!_@0K^66e*E}@|S^g5N&^1H6`K?GIRA)T4FJ2)I5_^%X;Bo(-1J-`=*@xxt=9_aS3 zxb1sGenI2+hIx>ZNm4=;l=0SmueaR%>3aA49{cq7HbFXDP0dDmo%KWUb_}_&b2~x$ zK$YM6!qOfSXTs#!Yez)`dDMjMyo2YLo)22t6Z54}vta8HS=4Wu*E`=ey)Sy%O}g5d zIh!|7mFQS46<$ov7n|Ahf{J%TzQ+Q176uxO=C9i4uYTqF_&e=mE#S^&S9-GH(k_C} zXQ3NoZRGW9y11@;oZA@*mP&1-C|rra&@4L76IxWV9R>@VV~GnH0TKv=MA(!jbhIUuQRjQA zsgodk0tEs`tWMYY-zYxJuvS)XT@AluMSc&y`n)1up&cAe`Po~S19uY>xiw|FT^zSZ zu>oFc8*dPy9gVFN&AT3&I$1ISEqSs#cEffT8+z%jH5nV0?v^HMYXu|KN+i}hE4ywv z6fMY=L1A2y#YQcNjV6;4T1|2)C$T9eM5c_?+tIl6({aspOodX)>?)d*-FF8gw)1yc zoZejLs98XGQw>;yM!<@2V}t{dmJXLP-zBW%-2>4@5M*p>we8a>-o2|YbAKF=ajsS> zva?fL3(YQ%yzyRf*Ir0u1f^u4Jc1TcVM0Vn3!n3vJ^-qUD3DMVK=JD*Q!ht6t?TNh zbDJi0oab5ql5#*0f_hPMlxD8R-)pU>~_?2a4X&Ik}I7{08`W`#GZ>u`T6*tfS8pPk3$0r8U7;o%)SAVNC-uvA0v+R z{|0>f;Q7h#)fxKwurqvKF}n)X#lX3~?j4!#$jK+^Sfq#d`~Bw)XTCiLy<(y2y!vSV zxg}6$*cp)-k*H$WJZCGPCJ!NFF_($P5VUx&x7mLGKc(Tj&T3h(@A%a|pb=oOJ($Nv zF>~j8?c0yM5G-Q_jUT`@P!wSmp@tYTN`=ChJYgBe>UaP@Odx)Lf2WK!p9TGV>)D?E zI-bv>g9b)KYcgLMrOiDtnuk>4(2~+%F=Bq}e`ELXZ+kRzmjnVogR;rqF)kJoe&ZGg;s7=G_v1H? zj`PtZ`Rm>@jO#1)roEJ+G}gA7g82AtQEH@|i4096F+~^iUtfLuQ#EGL0DZ}ro<$hN z6eLRy4)PrV{U*aWA#nPtljURSXd;~Jo0$5$0>nBx;=;-<1fRd}_VNAWujV1VDrzX}Uti9D2k+r{#kj2Z{Z)K`9;^;R z&W{);ucy~O>6tp=pf5#y#Jl^NyN5abT0_w?pU zez*0lac2kVRUJ^~zH1b@aYc~0C&yDP)M8in@j3Vmf-3#F5YWajapFq`domspS?|vA zDEFI(!*mpJTKGbPIci3}Vqn4@$t3#z|96a0%fb}(?vA|O<@0mkD*NzsBgNHx)?~)@ z)NbB%RRz}D>t~Hq{$;;)&$UB^XovYC6^slHCj#RVFfaoQ03wPghjs;)iYVZ@=6R`k zGL3%S zA3;C{hOVycIx+#Czggns@{&XO_v`Z?nf6Hlko`%+-M=v@`H0)I4Ysz4a|gQ8v>CTx z=#tjtnIzJTMkEB=W&DT669d*8&XYriyXIY2Gq|`8h_48@T-xA0VOo+$nxH|X2wA0gTw-wpk27nl2d@c&yHbV;L}105jO5-s zt%2Uy6%R&{l&+JLFx7z8tTFC0CB|)fSS36(5F(Kvv0gFzf7is;xz1*z(=#)%Ti*5S z-o~}9Yr7YX@3Pjt4p_z{yVEK&t?>z5c)_W=@f2F+dB+!>&jRnkG* zfGdB!>sI4A&Vp~uc_PH5rD>?qMRyl-u8K{~F6wTb&bu9VO}m|L;=7sGWxDR&on4a+ zPUm#ao12<0ySHTPuDD6vJA=EjTr;km?wxbHblo;uss^fsq)#Au@_z3(`uh6DF^qso zylX|YxJQ>qAix=_nkd1vKcDaOf25ybTrWQh^gEvdBqc$wXCMoSIWlK}3%%4h(V`qX z<#=~^5x23rp_^Q+qj-h|$#JEW7p>ram22C|oj@{e=Nx^0O1DKnZq;&Ii`;$Vs-ZH* z^zO~BS4rbmH@WYtFGf~-uKLeDG{7P;0HneSP^13PbZ)f&UqE2gL%bhVk#pglHdUO_ zZG?S}voJQXK#Ba-Zm5a_R-2j=uuUJ61@Bd1i+VxX5y|n*o2_e=Tb%C=-(n=#_7X&b zL4d%{l--XRa^S{_<3_389(Y%$*;GWZk=;9VI_p(7gVdw2`Extl;NVp4k)a3}Acum> z6rT0y&e1}#Y)VSOe$ksfY)MG6} zF!x*D8>Qd3$cS&G&39vEKPwxKu$utUV1|Y2n((?t?{2YeisZUQV%Qx)S@(=Ul!OQg z766h%U3d5U@chS~d!UXOtYq*%u|%J_!ceY63Qp-AvW2aqn71%r)S4XREDh4Zu0acA z=Fg*tyS;a=Jhz$3Ek@&3(@>=~t=Foxt@`gd=Fi>eYwaYroRpI(l9nDh-mWKEUR2IY zP);PUUO|J=nZDzE&hyWD{mSdvDTE=W)3+0xf)y(~B!%toQ%!F*$MEL&mtCK0P$r@; zL}pt?O>;Gzbj&wFgMbBs3N}DaBZdQrxORIRVjKt!W{k~X;Ft)ANC-?b_WJS17+nyB zjQ@Zts%UUX@<)S*l~aNcC}@NL*#aY>ghg~frU9VA6m~!%rC>xPdPG4GgdLDE1Z=>F zFoy_v@V{Q^%%-r-eRaL%RSFdDALsavryJZWUcpm zG09Y@j;7n&th&;AYMNAS64f;}*tJyQ+~a+0%kd9;Pec76Q5XtE1yWDZu5o! zV-O;#3O}V7P?RuLM^<)zkJ0%z#9qL_^?NrGArNB-fD88F$fDL66j+D=y#4ykP$~UL z4iK}x3#p~yK=gNI~xDvaj8e-rgk)ko+b%@JT|@U#lX z$S2BjC)5D*`2bLY3-19mO^t=awxe}85r`wk2C&DB!aOoC0)X0sra+KB$KTfn-`=&1 z3G4;$LL#S73&8LoMS{Bcq({zO!Br!n=9r8umVTq@KYu?1DU++a5C||oHVCmqei`#2 zE;+IMM{xaX^y_4J%D5Unudl8+3*p?>^9vz#4D!5X-NF|QL(|sq>fyOj+d@PNLmywC zpTD}W>K6mFKYo4_;LvBzi6K#K%G6or-jbcgS{1NAcME9&ZbuIz6fA^W?t@AW^= zwx`|Gb#5_>DErW}eSu~}pSkWOC-B~bMsgXN6C8N|N^b617 z(htnFAP^4g2VnQX|2B;d^U3~w5dLccKKK%K&v5?F;WSZ!j=Y6w6P07}J?RYev` z)AgpC<9GGTu4_5tt#MVX>iIhUb^QK+YYs0rnfMeRa!n%^CQ0-o_5~D*DD~b5caK~f zFIbq*%jD;s2@U6Z3wfJzhVSdo+~#o1Jz3{zJR+Iy9LIt!{=Y}z{`Eg(#P9bcR$&U+ zSbqF1W8@JQ3F01VTnW6jdd+9*XR3+@b$xzu{XeJSZQWLLj;Hiz9)x{E1Z2Pmk^z0t z;=#vzzk9z!&l8SJvf*J+C+Cw9flVqf;{gLg;Ic}AM0|b^zvcb1a&Q3E-<2>}U<;;z z#s*NW!znzDxl7VWs6?5iudlD*{rm6ZnJOE*xs+gQ?-l}aD1Cl(4=@yMTrm3P7`w?T zbW5}J%bS|6@)eojIOD*KzAF+80)OZ4=>5pZ{p|jhIoDqNI zAII5$KM;`#@IRR3@i00Y1ier`+6e{>;V|%cOc3c~7-ul)_4V{Vr{`Ju`cP+jWi_nG ze@Hie|3D9kAeztIJ9I{Crtlh9#&P}rxZZzyyk2vcRrVSrJD;&mgxNliWfGz&>WW12 zd&Z`?D>BgcVZp{|sslJDgXf8buMbD?_v1_E^NXC!XABCvL7&i!KYkg1Kb#-N-e4HV zOQpqR21@z~i!2m_Tk!=)Y^F8Q$Larnf9LkT>hBoVu=nO;g9?N|Gztg{T=?U&_^>g=2F&g6yj5rtY+nt zY>uNLuxUdYM2?2d!yO*E0AnuOc4UiK<{nOSi;J5|K_Y0{s;nCx8lna)C9ym!PL&`@ z2{ecVixf5x5;w<6v9v8&)DwlBR6%3Halv3pJRV{cOnIAOQnEBdVXab+Wpe^=1^H4=CHs(aog@CLHfvGcLFbs#2xTA@0mwj@pRq;|e z>J`!4=RMYEbyZX=yzaC#HC0d}z1m3MbeG}K0+N>cohoM_M6Yk;jK&zU`Xtdf(E`vd zBeK$RXL;Ve-(S7&dao|T_;SbB`}Bw41`Ldm5eUeEkpE#iB-1gFPyDG!u)xapkvn6{ zyIQifyL6H6y{A3#B*9|F@CGJ<-0j^5ZtS?O?(Xj9>x-8=cSdaEE1S1Xxx>4;vgwm? z%4b_{t=zk=;co8k>xWUf*KDJAbS7OlZs-Gj!1Pxznc<$Y`9zm50!Q6Vre87wg(1!jVQz@$maLmVzID>Yn&o2tDGD3TlsY`W~X zUhRcuzN|TYRq5j@-B$GkimbSt+C|>?q3q10`z14JX5V*#-K)QHjn)TaHsxoM!9#40 z@B<+2&?o`N!@~&jidXv7rYGC;wVFEp@jG{yr8&P-$_o&ahg8@|`&~!BQ!3}*T0`U~ zO#8n1+yHungdv4VASeLjX8Dfmc53111a|;GJ=Z8_u=*dd8H+cMN|rdxy_Y&%9433f zall*dcU%`d zvXu+(a{~fXXb9F`_#!~}fHu&+>RlU|V9sf7x=yqPA4iYBP=1Bz1sNpTyH#w9>F`&C7KycgpD3y`f{BL+&@b8=F9-#ToaI1@XQ=aGDu3tIp_Itf^yKUK$ zha)L@1t!!fF~5Xc0&WNCc8JH#Mo}ci(&6*;(&=9Pz%|x5(K!@291@-Y@8?l44F816lRBY%n5< zDEOk0MID>QPlkJU>$O<37-no1Gz7t^v@%Xwu3k1ka8D|~AV3j&Rz6Ao1 zRLfuS<$3Cr}ljBr@YTm6X6xg&}5ELG<7gGCe4e%_0?CI`}`s{GuW# z*!U$L(M1$dK{MKOlU8We`0GtNHfFNMcSPM&r$NT&H(f9T`F3;ISvLz((Du?(WM0IVl z|6;>@Hp8mQ_YoGoYD0C`{(sniflz;f{DxHyPVjEn6hDMp!Ja4WK_U%r1DFP&FN_!v zX6j>j;}vvb=zntO^!)qBkF)N+`|Q5G5bnKiTlW3U)cuSUQH+XF$=5s_W2?q>&E&zY z=Hb@)-(Rg)_xtyy&1+e8je-4DJqJXneta3FE(CbR`+n0h(U`wyj<<(Alc|XacjNEx z?|)&dORekq-?nrHQS>lG8wNuXvRJ?lMiPw_5M-wolCcU2-zo#C1aOA4l>UAF{ppC` zTGyZ9@67?T=@e1NoI&?T_S4bm#4jC4KUIi`ViiSH`mz%}m(^lxD_@1*=U<xbea-{N zqUM9=_4amVZWlzROw#e^5*Q0AU&r!@pAD`TE#(TO@Bm-u@i7;JTvh;GbtqQcf!~OT zFkn`XG#lB$g$a;R26_7ZKjy(0MPc=(9|wIrHVYgHrNH{e8o=^`Aou_)!YrX_FqB-d z-@>K~{{KAqf1kem5|hF1>h9`c#ww+?DarVxN)U18Y}(C>L8Of>OKS@@rJ6M+W~#Nz zZYcI)sgb7h1-o~1M{PA_K(#beU`VPa3lfho5=$BlZ6F>g9-{`ZHMSuB`Byhgs&Ry+ za>5Y7BV$^u7&Zglm{?X!5QyfInB;I9d7N{bxrY!(N4GM&9_+(KN}LvE?Qn}43Y==Q zA!%+AMDa$G4pEbgnnGmawdtU)?p&(O*s5(I840qWN)9ClX0moM*?msjTZv&AmtMA|#Gg3|GZ`V|P_i5xxF< zTGpqo*uxVHk(Vup9lGlNoNgnzK){Lcgcu?!dpXy4?ccrcdyu|n6j=KHeg6L8Q4vrs z2*>qIl~GV5>`e|MHzl6b-F0rwtEsN; zj$G$wcXw&Yl8DzTZo72Re0-m;*X3WdHq;M}2<8|yy2`IL)PqZ`&`k05~_^z;HU2#~QBp4a{ zk*n(7euUj2-+bfDYP9{@`|QEj!(Na@EWT@%SVYo94z8+)%Um=omC*^SlT}u_nKk`J zo*T%Zwx#zDL-!6>JUKW}b8Cd|5Axkh=k%<936Fr>49$IklG?(Gi&OK>_ zf*T!Rin0fy)oZI7%ZXQ%te;l#&Pv{Poa5p&IvTt>HbETl^Tvsoa9s>T8H+nD9<|Z$ zc3Rul5;X4?*-PDvw(>~nUvA~}b~}ex8@6k$^Rd<+jxQnQ^L)Pb>^2vOnTRk#%;J7} zOeQSJjreY=#3+HZfWnGbdM>*LknUY8JpF;HJ_2nnQJw2FH@I1oxw-(FY5SnQvt4(2 z9{~F{g`IeJTZ)3`!dU9Rcs~*npwl+9Wwwp1s}xF$0DMI`NT`AhNsRvwAL9Hj5RLuT zh%oMU66C`-RYyy8eeStwrTor_S|SkhT`{5hQ=HGDjkf`)^qk4Apt1=2lj3l?Ds|+x zNzkci3!iH`-s?NN@431(&j@XIy9ix$&$B^bGKiH`u$dvb+b2EVjF-8iEMbZDu6E;> ztKYrm@1S`IsK=c6N^Cu?d86L(PI%=p6`G#=uP3hDWw)JgF`O}0RD0DP;dhSO&Y_h> zY~J<>02}p5nj(NJ1q4^Kvd&JCNe?1qNK8T+1CF{{(z_Sj$es}4X;{&Kd0mz}Hf+#l zA(e?3iGh%T;6TkO(}o%v0${;mD3}X5_?^{Kap!@+lx!zT%2*P3dm00EZC6C0fRMW( z1_C4EZ=Y#GfCiW$0B{(H254+N9311tHNm(dl30QyAd~?@5j1GQIWkU70EmSV445zw zutdjw4HPh#5=@>ikZVsnYlozBrgO!MGy4IywvCmGbV#+S6*tS}=JB1-;>v>B z)-wN|AfFOXi6`3qTYV}ARrW#==QR(6S4EnY+oDEu?`8As_u|Cl#bsQ4Sumz{*^#5~ zJI;p|lZ3*m?fRky0HN>!mIz=NJfw4Jorw--oPkzt-eoZ)VBkEXBN>UU_nx@%X9<1r zbFd`zQ9=Sll76J0?G%bA`=Y;aC@4h8NW0|u*S~-7_8;f@{(J1}%zG$2u*CFNxM2H( zzntFm;}?wPn28PqGtXGs%)WW#Jl_@Pb7xnR^rLQpzk-eIKa0!a^wrUtMs06_2eK1|PW$a_Y6RgQcI>tXtIukI@8x z#ftkq7M;b$+x-J_f}CJF(XaUbNPlDZ`V=9VDzpD%956Py=^3YnG5eY4`oiyjieFFk z^(W+#BxN(VM8?q4s4IgrS|8J0;{R7+!vQ({SZkHW3cfF`Nx$dc_xtG#TGl^o1pvG` z*hb`hup$)#oTTQ7s2+_O)d$tq583?t;d}h%#~RLR^=3bb&g;}wJZ8?{CCrB6dY1zI zb8~D&^~Kpk3h8>3NWnG&Lvu_K6FDziDx@4W%)^=H(wJpE1AT@XxvHTm}6bO0LaWPH1kryB&nBt$y?1sTbqqAe5Cr|Ew+_6-db{&*O` zIwD$>&t6-x^JR=%LmlEdpzl6$&pHledbq!z-^yRR?{w;UBwPSKK<%lOw1tqaz>Pyn zonX`R^YVVhDv#NnYU|gVC`^~<1|eh94Fm&&Ep0~wS^neq?K2#6{ z5AKKWyX=E!!(YB4cN*G3o*Thw(w>OaTE$I6)+s{Gve$C-sEU@2_7xXXE93luW(vcX+yY>NPe8i#2ep%C_UUvxsO&&9Nz!30`fd5Z2RW z?{JYET)VhX-;cI%T=4C~S8^|(Z@{o9#JzP?TuZY!I=H(-Ah-q#E+M!>u)!_3O9mMH z;K75t2ZFn6Ah<)20freYNEl!U1PjT@o1E|a?tORN-&$|I_5OIZW_NW}S6BD0-h0oM z?kaob;I+9Ap$cE$Czj8nolyX{ao)zn5j(2%=qT0D=Xhd(1UhabF3i%B777=>k3&9y z&hs3v;lO+!mq4n6xiF1kQ&tX>Itd@j@5!n@ff|wG7cHVuXtML1fPKw#p8mY4U^xm5 zvkH5EQb;K^0c(V_VPj^4Btei1*Tfu4wv*(uZ-j6cQHS1Sytzy)6$Ox1S=_R+)R3(- z*chr%Hg?JQj{ph>v&icop{b@E*xP-m8r3RoI9$EWPMC?txc5 zYF0}WU8j@jKS|1)y?vNl14%I!zunzezxmcY_gXkg2~!I%_l-~2t;B~?H>amk!#N7@ zIOj#NhU?Iq$8IF>R(6AoS}N5@SL2U=*}RM!*oM%-4&QzMd)HNNuGe1b^Syvn5{S-TJ>|N(NnLWz}O|xmJN>c{DIovuanqP6m!q!xb%UnQcE^I9zz8m;HN$BkqRO3I; zOnr@g;#iO9RCif#oEY`g2j{MG_m=qYd!>Rk0{t?P!E%pMgwnJ*=$NnF3oQIYy4Fl@ zFGZc^9K6;UW)~1iQcDH3&4hQ=`OGWP^%@;A+|*&kb;&)9Yc)SbNicRpvzB>D4L&Ps zrlDr^A#blA|L$Qr{Ip0SGIY*%C9-{bI8k|hAIfj`*e@Si-sYmxT2K+>;q=>7jxkwm0o~?ImUrcLl^-UTMQD)L!daLz4yus82dPe%iT?@!As` zDa{Nt+*u;QNE?vdG>HYL(1HI@t`zK}OkwI>WLL0g8J(eZqeuvJ$NBv`s-2hk{3_TO zv^Y`2Jz8kod92kT~P@!y=?M{{>XfdTlZPQ-Izb1T5%#vU6C2D%0BWDZI z`1uOP?=u`Hj5|ddJ(DRMk1-nbSGUZ~&Bxm6p`l}k_Hpl9fzn!buiYO%+%@`{k&)baz4BdOe-AA;fR_rI%9w5R1gz0aWPVpVxF^V zkX)#em!W%6-8M+U@Lp5{*ofE^?YHiVfA8x`k-o~EAn+M`ebrC<6{W#@)s7qv(F7gS z`BZinY6JQ@gI4-8jb#zroWXYYL=V=_!X8E!nP6q%XZJ+}?#4iuzVeF0aQk0>J?(v2 zO3~0Jf>&FY5K2lricaezj|Nq~#2-#t^7=ZeE1aYp5iU=rLK#NwG_!2(C)Rk(iJCC& zmiRE69H+!xk;p0ikg2vJf34<$BncTi&%=1O@GYOP@(@5P_Uia}@9*$?89{jls`(1u zJQ3EbYbx~75mAL7^wBZ{xii0_L~vNumZ(L0%%7U-nT`)fshf(s5HHcyQVkR+(9%8T9f9GC*H`LyN92n z;6wl}6MFdDQfjr0zwn>`l0zu>goSB(8gA?Mv{HypE)I{OurHf326{4+9_jl$z`hg_;g)e$X+|KK$ zmZhnXyVuD$;d&)30?>Rn#RY$ZY&!+oq@TxvBC*dS`5t~ zLcC+e($aC5pL6n7P+}7~fN-6^{rc-A*WI)=@j~8Tf29he0#koYd=?cYJpWtr;PLDz z#dq2GFX!Xy#mz6S(?yWWw|cspux~)Ud*)K^`qfnL;}Rkq!YtyI$7J#^igki@;jO&1 znZ)(v87KRPev-44^*_XlYRpI)!ovS{Tc>y#L~!ItFJiw{L*Tk3hl}py%tIVcXIq@` zb)mc>y#2OpUe1LmXNf6No?09*5Pmn1X3r-fyC3}JxDgvv5!aBT7p+WBQ zrBl@|6}Mcd=jT9Vcaf3kc%Ay& z=C7TL_B}{wsHmQqUq!TE2Xpg#^#bJ(?0nNg!FJi3ZS)m65euAY2N8?lxwdB4c zOiZtqtHRgORmVQb>y#pe)hr(3MKz{+*)%`lA-2aLUMONu-d~%u*{Yw|lcKurrU9#} za5Y{xwQ!oyEPGGHxAC1nyO2mxbvG_H(?XxDF{Uzwd&DH}y=A0DYPBYdRX>$Plz<*U zRotqvN!8j?E5HBwxJnWWgT6M1O@~Ox&_M%zOEo@{UP!(&&Ng|@c9s_BGFxU_ZSd*I zukY8LhJB64vQ1Y?cex^)ND$1{f)Px+iEhvTSXTudU1XX*>`bsgEOs0`7*h}1dAoWHl3;}ON&AAeDy$^@inog) z4iFP5tEofu6j;DPukTc!wA1N+;>8T87~iT-d!BKb6QkP8p%^y4YS?Eb;+LQj825_l zm%VFnK?aXlv!S^T*Py%k92jsqH;j}Tw37DcQ(3s|IL3_9eNyy0f;%z(uf&L`o+w-r z?|oNVTA>Oz9dWbltb`A(>6}^a&pxwyQopBgav2eteV$m6tYK7DQ}0-ioRy5P9j758 zl)gWokq9Jn48nOvyMkv!GNtJUq|Vl-%_J5Z7xLbxO-nF|8w@9ie&nI|xYwzIFO75(JsI#s~ck`ZPPY669cN^#r2y{F`ve z>^YuIfQj+-tTb(IPZN`vsrnaQy|?An@9>8{x6a*g1pAxFB3j$t1b;W!I%VfL7AkPxdd>LHs+k?o4Q?R4 z>^adHwh2olk^n0Umy3axuf1E%X>*F|x~}6?Yce0G#~X$F%J61`#j65W%`xlZt3&G^ z*3ihnI@(^kDK-o5cvYc$*K}PA`T)yQpS!mmlt0Gl4R!>bSwxq_FEDM4M@-vmIFy(m zKEv;Oqx>IT(tC_=;>6#)Qe+ejaGQv_quS0s0=riRgjDv55D#%{PP3bXRG2KeVdrw? z#iP{Fdd6oexxs8Ens*`=(;`nLYsA~L@c=Rz{)@&yCClZeax>Hn$~IBF#Lm~S#%PeZ zZXkQ1;vH{4=)+kZpWs{m z*tH^^8!5JF!!)JD5wBinzC&v>&#Nb+VHQSZDIZYF?S>~OUr)Q=@^HY4! zJj)#8-b^^!QzA8F3K$Fd*-Fk?SGliQJIddRV~m^5)mJEu=NgPw63jKKX7d%KdQ$Si z0!6~?&IzH2CQBbo^@@?bEHx3YsRiBb@7}yJp|4OOCmM315mv^h%dxFWlGFW6dVwk; z^+bu;IkaZmVP4*;tleboO+lgoZOs7)Q{xFCP-DRa>f$Jye3T%hGfD7EM`QtXxgw88 zPfl36w_2>H1BQ$VOtHq$e)B zfGFg=@4>WD%f`8Rn|iP?Q1oe9%qC?OSEK=N*}HR^tM^(oqj)tfaEne`W|+Y0JYDgb z-qS#$$FtE(Es|N4N5>UnUn!Hq#KLx_+{=#!0j-lSHb&yF)C8(+`4wU@v-1_3(}Fo< zsh5W;zME@_--h9a?dUdi!l;ETs8WFawcjDEvdzIY0fyep#l+vBb$3p*-tMXc8FoTE z-e`@C+`y96g$+6Gya)xT;g-Mw_3%6v;hr%o7+Ok+;j`;8}4{a#Q)|N7871ZEI-`p*o(Q%0$SfE_y1wFl(By+kCk) zyiUKEeTLyy7Y`qgZwsp|OmVJNzQ!1V$o_J=rStXzk`JCb6zeAu-Bvzc*W9~h<#8D* z8M-aLMcx@j%Rzj4yu)#yiJih$;I&N2P_L(c4eW9BYC6F)6SbO3jW;D_4lF5~#7|G($VzVi>vUB^X z4L0k>*t$n1k;j7~9qH4M8&v#}b(>HTPT=aCg^k9N8~wO#!Y6HoXl~U7IkTfAG!j}Y z&V-ba#DfFeCoO&GZwZRt;epKjPqo>d{i;NC2zu?0-p zv3^I*kr+o8!_EBw9rMOf>H2oDf2}oab)zRu7|U?F65W>dKB8c7 z6%RAxRZ^3gIe!4b@@Rftof>W9_&L^OZm`r1(e8qOV7IU11*ZNb6*%Hs+Cg_^AN=ge zTc5hZ$OaeV_(w^(!>!=`HwM#dElU2u*`7S7Jo|FE+!x<<^G_+a494c67bC?`y*D(r zTItDGPGjOi;tuDDhv>A^Y=BpRLb8*5mgB%3`zJD(gD^p< z!XZpX=ukf#ccIN4>+_j|=hnqti!46e+r;z5lL-22fpHJHuKa~|)rXb&C)ScH07={O z8F?tNfltI68g{0`3-s9FbbK1zr}V=VzDIH>Pg^;vy1tZY?7==O23h09mQ;BbG|^RZ zQ*#D$zJL15hfMnwGN}Q-U4G1&m!^+2L=W~SCw;f2zQzAHx zlwR#S=A?FTiJ3&I0@nId)>}h@ z@e4hy_nzgX-rUuCd7Y=%-J2~qF7)p5>WSr%HLYwKHhGmp%UsLV?E{zgI?^(o=({8Z zqK#H7xV90wI-EIL-0L&;g&05#QJaBRvdgc$whZ6GM}^bbsvb}RO>5zA?|P45&ODoJkyF5m)R*XURKd@d_@C@hFqN5flmvW%!& zqu+nB>G=#9ku5naXwY-JR#0l+kWm%q^qiCY5%r?C*uTuUh;;-D)^&wlynL)du!RJT{wEiv#5k5-ifwd&Q=}+*)Qj4FK&P0+TPlVxj`13;oz)a zH9scnvNu7W)~<`zK=PQh=p^(ei`IZ-LfdjNtx?c^AwLb!3zmZn_GI^f*eU&`RBH9> z!`m=pwC&;3cF^AOg}Fvk<3eNWU^w|0yH91GlUIrnqnFj~=h?P)RpR-lVVTJG{h`2y zl7gr6Xy@O@e9QuP92=qV0>1i^*4-C}Pchb-1$%(bE?I+Cig${$s<48h*dms>ap1R) zEeYS$eYmDfAh%+TZF03KI`A9{`hNfMGIS2!Javq%9e)f3J=U%rujFADLoA;s?KS>% zVcad=+_8UoL%u&gW0F5kM%LRIy4}C#H7_dj=WLM<9!tp#);zc?RKoi4fu_W{bPbQ{qgDBc~;@^#jPG4_} zcb&mzFgAm-4>JjxePqV#pYznbw!R8b)$73z-#d zkid!3+lezw5pMT>a?dY>Gukeg%%$|yyuDhYN{pkemzM^=4Bew418qtiKlXpUtDCTW z7Mmn8DU0Ru9_Bs_ERP~g?|v(Nz}1x22KrRbWa2yvzr4ISf0S`?V=hNrZgCr`v+ltr zOkQVIjlhi1c8Xqn^5TEvHdh?tK1?848V0@l_A>;zw#>Ot=fyY{l2zdU3gyO z(nsUfs@Z{>s7<==XyDnb<=Gb?KJ~AvstQ(Yn3%n0OIQHN-LXCFl|aK6kc6P$Q-4qA zz)pK;b0sj%$+nNKp+!3b^&$32H0nJyy!1KkNYL}x=`!Cr2$86jp#$^&yP`k?;4pqY zjbz9NA8$c#R)*8Pu&qz4sh#3y`@_py+h(Zs^n<5EwGobMKTfVXftm;JgGH1L48V)y zb+Ym;2n+YT`tN0iAr?O? zL8{52d&?*F82)<9<;x-c2h(4!k94KqhhdRLp~sj>&6^1&s6}kCxw4lDSKYBghJO9s z4G)a(Kcu`mIV}st9h1># zh`D$!H>^G{V=}TEA0Fpp2yzR@2iuz|hikafckMS*C0BzFvbENs)w~5Y46P_Kzmp z5|ZIsRuFdak#3MbNbjb#48|xsSzovjEp(+ilfgz$Wmb+n7dZGFsR(RV5!8Iw{lXy0Dbxec*GxvOouK;|zvIagG7 z4z8*mSJh?27@C2-#kE1_as{9X$?R z5*pHI9ATzFD8lRkd{FuX z5ph%Ch%^;Z-PN*8xbfwmD3>ZJ0l#WG$9V0ZvkvMGo6U*NGhnpe4Nf)OwADaUNw&3j zOtyE7mChDJ&w8iFrB~rn>|_OlUVo+NH~1|gBYJVs1=nOKX@2`cR_#(B>tG*W)%h3? zJE&w-Lsm@Y84LtVuZ>?-_O@avLfu>Ez_ewy4e3^A>P18ZIbM^4SuJm`W*msqmLXCp z*F*63^uqQ2)eBb{EO^(NSiwatCa3gi&?0DNw!in&F?T*tx>Bt_u3)`;@D8}(Zob}} z4FpaA#X$z4YsQbx+t)AZ!|#ebU$U|F)g&REz`Z3vqpvzCbZv;b#>0>W38_KXwu_p# zjT7MBCeK?aIKas%oXowbu5J!g1izaOa60y1UD$BQjs)=fkdUnyfo( z!)5qv+Y1HgKWvhjNFgN_K*jz4f-XWmwTa#@x8f#){%Or1 z=Vp8G>!Gg2%DfHj?t|;M&N$f0J*ekFxnAdS)2&)J-M2KfhA%gu< zJwDk<{f%mjd^`px|IPR5L31|C+n~IyMkliGkqe9YJNnA5DaQS;1b)=60l{(3jqc{N z5*Fs`fsZ=0hcgn-dx7HGeI@W2bE$5aA-~jsLJF(G+-@^hNYJi!wD3X&8F_zxUZb~g z{jp8g3JxY}_NlQ}$jXrnoqbCI?ws$Zx z9BlMrp2LV2FhqlRR8xwJ&W!T&!&$mU%g>I@w* zDN1+dCN5r+>hL8B>LC%UM26^xSzUB&@(Y@D_SY57G+B{76)Zu7?1cR3X~5|~c7BpG zG6deU=aCemBnEsASf#7hrx<|WGRqnRNy#{z`v&v3K)K*XcdNs=qnoO7ILx*qNFZl6 zPe~Pyve`-?!Ou&{Qr3}c)umDDL9VUThsEkAccKm`u6g6(j zyVHki65zm2{p-+c)5Alf7qG6L1NQ{nLT%e+J?T7FOa(IZ*Om^&i9(iYS?k>lYgL?j z@!csEG}s%gc0#*Q`j4uQ$c&J0{ku<$q#4TXb*K#Ee%coqyiRm|E}@ff{;^3f*r zFLRD3VPhIzA|z0bX<=jg*aI8II)p?DnOjKRZP>>U*qsbg7}N63 zyh0hNT)>rIA6!4vuKnDbH=5KVbHnE4Q;q^SRBBKl(lfq2O&uFOezSE1Lz$0s5C1r0 z`L)Y3t@7(ldP#C_AAZuL3ffV$@E0ZRAK;zVnC8?^e12t`@-uqc_fnL%?ckUWkDdm) z1GVcqm`$^o2JV`zlMf`4R|{n*L~d$KSyudd0B?0mR63}v*RnFJm@iL|GM}m#yW@B| z`c(Kqrok^cG^R+xKW+V-g;5zJgb(9i(ASvh=zaViqwl)q@|0wO^H7L}E1_3GCPfnL zdL^z+4sus`xd(_uxd?#Bp~00_-xPbz}KGoLq{T*Fo}LPzrZ;}_6%elx=z?p z0PhxogW>0hq2NoKCu&WT1ipf!JuBB15M3r|wfQ{k^sm;cFLW**JOt6~E0ygra4XoX zbdXRO#JRC}xtM(93QV7ZjGe~N#U0))V9CH%HKhgc)|JWL6n``C~+#wgOP)=d zdbUt&yOU^DOzW|kvF!mAT027`{Urdvn9(q;7#4Cc_!!I-42jn0kXKe7++q3!JC;S- zP+=*go7)blu@}!;2f~65Qmpyc{cV*(Ow;sLS)<}z*jwC$@&^VlE`qGtFe_;@)Du`; z`DXY07ja|NRn^JJRT5Z3?(g5DB0sJ*t4CyD0fG0Ttmz+RmXjLnTGQ3>xhsO7t$Xl zuSd2P*1eAPT-0k@GoEZtD_2W(u3T@@0f?e#v9iskU0pmoK_1VhMn_pm>*B3Wymh)$ zkdmz!7;42mU>Sgnq=Gy#ls<&|Eb?Ifb635JRX0J=^?j^}DDYB+~2MNmsm+eL|`h5M+(9eKx z%)47w<|GIS`C?!lII+2cO~GpVl)vk8#*vbegYtP?WL90Rye6^Oh@Sw&j2PsVS^fYlo?U6Cf{r)djv@xgLFt7kmWJOAGDtzB=Ka?q zL>aK52M5ri`|dh6j$;~N0AmzhM!GUlJsRV&3d7nEIWginPb3jY+^q4WJoFoR%%}*m z81ke%Ki0>~<(Y_-sEco&o-I12@cB6rthWaee4w)U5|n$}L3Web>xszeEuq|$g1q*5 z+)DFS`k98N2uVNjmK}FJtT}bny!FT&u zvck`UEQ)wP@dJndveRjl%CaOmuD`dFyV(svmbN}>-bGE}L|oIH!IZlELy<>cKeM|^ zRAdYvAwHKhhj#Cvic=@c6|xQPV zFTrdK@cynhR~Q`#61AW=cR`hRJu+K24cEd=Y`yMI;q$q{KL!JwgYNpFgI~}J&5HRAdN4Df!&;GI~82sw+oj+AzJwxyOEBb4h#r}~b zYFupK;x|L90I}BH(u?Z z=)1!OWsd_ydZwC5?M_|VwlfL~2Pe7Y?!tm$yEAuL0(F@$;5nOTEqYoN9i>WHI^GuW z-bFCH<<)D;tF4Q38DGKB^<}Pl*@O$|Vs<;ptF?nPF$ORs0GB9Po!M4?BpMBiYjEPW zd&lcpQj*G)ge7%X7BtMc@XcWX#>a3!Djjn}cH*xFG2)HHo^B(Uw0cXTydB<)sfl&n zQudrD`s^*JxM0|0lt)DwQqBN7Qs;O*?lAxHuMPIJ)0pwhxKYgSo{9~$TST_x#b<#U zv)qlRP2HYE0hcW%8q zrkoU0k)5=KG=}+83~3S`x-tf7IVlfmqA~$#>)?&Msk=o2I<0;@X}l3Dm6mx{J%_ue zh9^fShaIi;wU?<|8cPgrq-i8}wz-x;RlNm|TlQD0gR2+(g$wQ}3v;5%=wld0^`vN8 zX8aE8mFr_|j&7`5tX&yUm&7{5u#I|~l^+0fl;cTK)E)Q6d{}<<<6kP)k#hOEH z{|oTg*{j&o*zx{X!T)0LX#8P`;Nbz#m4q_n0RTL7MO2Eyf11Y-5&`^iVv8dG=}Sh| zKNKqYga4x*T^_)Wt|$-qH~g!@A3_AB<39@iQ~H0#=<@&Or~OfiE{{t7zXJOl09}5o zQ18F>{M(%WVW3*7`gfj4^j~}QpCS~_&|v>R{}ko_BbBz<@+V6q`Y-%n?EjVd599xa z|Jz9a2j-vd`~xVdw7I!I*?-ypU)&XW)S%-5=KgK}KjrMG!T3k+UlOQl=>H7Wzjygx zlIZgP-D(llsI;Onp@{Yo$>?{4^3^C@_3*6w8F|c5}sa zj_b=0qBDtxGeP8M0&GZMMYAtgXQqH?qoP$3v3AlDMZ7oG!ELAd3~=@$wgx6HXED1R zB3|KP5eG#ryi6hZvQQG^nw6m~YGLhNH(0{VA-U>nl{Ozs2GT~>S7)A9xg`AX;vtsUURF(@2eKXH#zEu`VOL_jrn+P7I>v>A|8eDFPzgG~e zJ(;Cuy{5gcvk?5f)h`#kmO6HPW`z@lC8E3nJ^74_}Z%v-X8J-vsX@)vvyy(^sLvghavHUz{iQB8S!!+gMrY7j2x(WoyLq>=UiAdB5fb z`DF5aND=?~yboGIAoPfPla9OpjMqMXhyY75PckQV-*3;J)VRqa#_WpE_zhuX1~&HT zH%8(V0{m3=f*|*D2Xw0g8ImQ`gcY5nMaVcZCT=7R)aY^%8r{hVjb?$_k)})6%qHknP$-_UL zA_8d67@J!ipASx(g>?XiJMrf%#D6VuK#_)Q&W<_!$0?HuUBs&Jd zlV;G1TbPAH2RXccs42q!G_z-&$?R*^QZ(8T72f_JyH|`hQC8C6!iNTnp(rvf=h};i zXZPq{jnklHg?qw1#VOqFYbn5isPmxs56e#i-hQ3ubo!cmA^BKn!Tn*cXqZl6F($P| z+ZX3%Rstpc<@pN&f+9MX=P)rd&04)`g!T7M{bf6Aae<>*n61kP6~hw&p8_}~si(9+ zCpzI4Y&M3A5If?tjyR0`cA>7}R%gQpl0Vx>T~|Ea!Kozi?CibK`hx#K_f)`=+r`Kv z%XDwF-#>u3Cx_PU}1>A++rt4*No18LBiDS-!MP zzCO7Al9I(wC?P5w!}mP+n%E~OgQKyHe+sO1Qwb8pje|3{mF z(VS3^hnzrMdjNYh?F4B{jBqq>Bk6IT^Vr8aaClcQUhGx)OvK>t;b9>Wk>BkA1)Fbr zq$Ze{RJ$aWV0m*k#F)AwNP1nyR#!NlOhqy)As@%BhvdQ_i)KI(`t;X-cb7{5 zTU+O?#YKvMCV-ja%|#mAYR6g0R7ap?(cQsfczEc;_2S^e z>93zPUNKZgKo#q{KmnhPh}54iNvsaxrQwGa@oYO{ixNZ>h9Y{CkgtvB&kHnp>qvjx zO*UHtaD~Xe{|LFixx|kMeVe7nTy%VFbr=5g;Q@p)&W zK8>B8dvS(696gL&YH%gkzQl&JOpIK2?AP*DbLxPGx)?!?!epXrxZkgK#HnUC zh&lo_x>s1|_s$mv@DUEJ(a5aDrSS!ACbN7Y$=*F)|8~rHCvYvcS!#SoM)o9?MCNdt zw=tm;kwsV=v!kEsd%}eiK3S393HW|i5FN&`gP|?w9=wh$dbmDrdht+qKQbdkY^Lrz z{yNWrd#^0*26Q#N+XC~q1*Q(kx4diz49_hRqGM)!$^UWZlz$U6QD?WTe0PcW;$89a z*MmtpIq!9GsaOt5oPpH^KJJm2u}Be!m8YcNv=zbn&C0c{UuMyftGK)Ym#>K%qyHcn zPH#OEGppy4HLV)Q8b-U8|2i9}h)L+xA|!PmkVZ!aAfRgWeV?=gde=i%_Z>HW`@%V7 zkrND5?1z5~LM*5$lb75NBBPXn<_&|)vm0;ePnpg#B=Cxnp($QBD0eh4(>pa5Tr@Te z43!8p=f&BQE+<--r`(2FtvJRG`fhXZ!VWDFc8LN1r@u%^O*%;4(bDaZG?JYQQKh4t zCdR>^JNg^EBAjl{abk@tD$}c*xBlCNF0v-|6k7r~uDc}s&dXPHNE_BccXoRQxmr z6I7&;60^UuFsVKd5Lm36i^t>g-6>;Ijh>V-H!D763h#3{GSh!N0+~Z>n2sT(X3LAI zoe0EWs$4(8aD880U0s&!QcLBxgXm;;B^3pXmEyC07`>@5ZSZyB%oFB>gka5I4}+d> zOxqv<*i+g+8KTEBgo1Aa&??Y(op2OhzlFwiX1J5t#T+zwF|0r9VtNNp@@VD?y&Lf9 z1lq3w2i?WU$k3m{*V_w@zK!dF1|3>{+3_Rv*Nds~@f?WAtcl=UeQ8o^&7ilGW!%(RT!DMcdRZyNouf`&sn3@vtN7$at6XZuc)Hx?I|>aohs}nhI*4W! z`B~(bvIvJo@%3T} z1|9qa@|5N51IH8dC0+jB>JBW5L;$@?#YgpETwJ~@X6EJ}C{v!G@Ez)6c!{zm40UAO zqqaZBzCqzT)b=SN>f_~^yn-bvkGf#~ZG=g+fnt3|4G)U^jVf+Kk=ybL)~HH0Fcs1~^2Lb?qXCXi+k*FnQ82>+<|6tu))G}MoVgQ3D zJw&HHE4rDaAAnW{0I1pmqyfGgw*SbTpwd4~0NOt!01*0!q4YWIHp%v%w+Ye!>R|u? zJDSnH?8N;|OJ@zx2XX$7Bwm>icPl+J0E=0U3sTJ`U+K-XZEX+sLH&^~AY|=#!$OjW&%WWjnK6^`a#YyS3XK z$|EWw_%y04(IVlmePu)Y;{`ohd374aoG2#qQz{cE=$H*0QO0+|xU3EU;1&P?GZ7M7 zWmchkuw8ZiTOnNl08@oI0;`OtlDY#Gr80Vqv^bP#03T<|7DAtbFFvuHDC*+jhW6bM zVFV^F9KeC1yJJMZp$7yA(PP;bEWRtwCI%CLBfk?0b_rs3LG@ar6-*=ij8ejukZ2cS zqp{twxr;avsQtom88HF?R9Z|&p(x?x1sL%`UN z|1tu`5DJ(5lgF6?ECK#J$8)1hPl*M%o*ca78A4kExaAzxs2kJ(0QB?#y^5N!wufRy z%YUl;&t!n|-*gXCTm(uJ=TZ)UJ|7!U%c|36P)-L}n!>J*!H-YZkj-3u!O5l&MgO`w zF{2z%QxK%28Uesi;HooVb+aqc5RF6C2T&MfVCIX)7b>x0tcudRej#U$#MHnmFp5aV z9hO7(JvN2yN9M0z*Sx-Rjw5K`!Q*}uOQbP_iS z+{F1@Jhe+QBuI;)EF$ligQYt4#WP&t3H1s|mZz6%O^ynpyb;cm#21;P{305PPL@$BIZa z3e@qrOW&1;s54wF+yd&3oCAz+h>sO7Bn+#J@;+Fan&-4DOH~|FgyLAQD$w*pGqjHX zmbm&mw5vO>&nZ;QM)WnPTqcspdf3FHHhS34d9biB+ih=-yEW_K>ex?O5a{Ja6o#Ye zUovlHb##AucGdX#gVJfoJ^yN(_+YaYca!;sdmSR+mTa+|`kOToPT;U+r6YvhJH<46 zO&U(j{@txJtWQ;x@pkEa6@iBZGlobuV*H_Kwg?6+3qoY-+EtGQ-u%+$!hfw!%i zOV1*mmtt^n)1+Qkrc{e$^T(ZRGH5+Ds7`wGfJMo3Tf1F#Z2d`uXJMwFoa(Iv)n*~! zs!dhqLi1#8ExN(3sc&F4q<7c2Cb{oGusObo&cniZf+*y`QbyqO0C`TsUMbETCr4`6 zJ3$Q>x|6Qsd4{*gy4zv{iggxRfhV=bLG=^j&xm6m`_?{Jnp#S`C%=vMI-_hlZFMwr z*B!L8;f%GZv#xv}&(ftuz*I-$R&^sKV1+aKA}ht|!Rk#NJes#;$movzL#ck#aUf|Y zDw&Cpm*b5O1_brle}E6vH#4LNLvX!N^-M~t_n7J4imzYWrCatdp7j23 zbCELDI9r}H>cM0wos!~KB|lXzOzLVAe33lw&3_?KM_k1%gXgCzVH8ZUd`_gP_Cd~V zO!eD-pB4H0wjW5sFu~X-u6#bdn@EM_`;caq{d4X5C!8iviha(3M>-=7&)8ITkBo=U zF^Z?~HQ?pNYt$CIxA9-qBIQEe1MZxP0=^)6*a!NSC%7MtpXZW6q#e)KlVC3QhdPKC z!^G9A{61UIJb9*o?n2FzC$RIiNrISkMKj3@T--%>e5KFLc~sBHfao0EV@1FCK?|RptqDr22#2)>(TkeP|k` zk`e1NhPY125`Dd#YuK8r$CpDqDJ8h`;x%W^Un&C?0}a^UFHjZyutW^PBT5=tw>Z9; z{#eO%^?GULw(P_RHM$e?Z?rIg>oiuxZBt2kMBI3;wigB!4W7dyK$`KbqE3t?!KrhG zF@y@Azq$+!O;em)3(BlW1iY42ILmF`1Ol^*Y9V}Q6LFIQbRUeq%{f%QIk$?l;nSVJa2sPsi=DjKWMQNY4p7ztU*b27zl3dXRa z7Dr99<{Y9)31N@-?*qNf&&8a@vyIO?2~q` zY?m0)jz?&=!p-J2(s)q0u5{esNqd{0!C|S>b!o}V3oWtw7f^B1gA0Tyo9=c7_d*EvUk-n zg%&)R1Z}N|Cs`SEuB(_?`;IrHcAAK;i<{duxg61mnKb0`6DPZk9hrzuzcb5FC5o6- z$7bPgF&N>g6t}7$cl+jc)Nlb2zHFunD!Axdqi-_rRjm@MZyU;iPHcT^w1yT=TM1k= zt~vJBiEXB~d01s<9Xd)?%^Lq-0Czx$ztr5~b2ZzP=QYG~wNDkQ=&-Jsa~Yd1WTzFE zjJcUi?Uv^wy;n;|71L3*R<+*L<&{e{No!uN)pnAtHL|>467gzY*V6d&x6i#_D#k38 zSBnj%-xYF}>e=UOTvVlZYh2ZHIaw{I80MwpFARCf-$i@UyLVIx?W=;z6mk41fWbsqg3;i;@4IuH9cM~T}GU&dRmfdrM4>3jqaM< zwrN+zO>N05-(9QEtF`3DE%CF`uN!%MKD@Q=n76sF6?D@!lCK+;NlMz9_p+{6$5pN^ zdCKLhZuq`Y2!FVQKS+c>v_c<%gg*#`JE9Q$L?NOO${`QbLP>v!5)wj7)8h}um+RpV z@IHO~iJ}69QBTBJ5e$f9jCeBA1c*rs{Ywg1y+Ms503a*u^WeRLn7?^EZ4MjI+M2PB zL`q?RPmi1ODGVLyjh}h>@XD&KsoLLmPhzp8QSuZhj=@0DjF24Wcy$~w2kF3q1Vel} zX%&o6=vN$LvR`HbcJx@J$5|GTh7gEqvuOx3uid^Y9WO22+C930@;*2ZfhhPM0cB4H z?FAnehGzj6tZ=>B@fQ1=uRwb@pJ>FT z4_PHq37}1f>;?&;@X_hbU`$w`Hcd98H&KX#ZuJF>XmzMa5Ju-$I(O+ zMV@F1OU*wI4*)h;1It?PXF~ePysHi@GPAFAoj0=i&e1urxTVbmYW0ipKDIT&&CEXG zBnBUN_+8rr!@v$YT=K(2Vs<&NL8r5%;npk$JrF7v??NnG6%7G^Y8faY*?2Hz>Cv`1 zGAFA;gV|I@k_Qg>KY>f7$OY&fN*hr}2)BFq4#+B7i9;XPI$PmifUitxKphi&IES`-n_1$)A! zarK-dQ>z1|(IJ!RrcnfprFBJY=m!a&0}qA{nNun5iU4~ft~*LqXS8B43jy^8dH9tH zZ3a$yE`@gP(E>3#hAJxkc7!JgKG$o<%y=l+NNTY-+w#owVP>GcyUMANo}OFp5yL_d z&qq5jBi0{#xUA=7h5;?YE~4f%#^Eu8-m3Wek-3nRVUcBJ);qJ!|RX1B56?N(j zF<07K_YT}83Jq>i&%5wqstDLTg?xWyCW3a34gDT14J*4Mu=_whEOyPpHb){J9+?e{D zol`NIS8BItH);E9)b4WH?8NY6bSo+4_Ev)gJaYLlG)&oCL$}1`dMv;aiCrm{diSP^ zySVR@_0h+AChveMcL%9osNvgrccJS_uQxh%`Q6^;yzH6fM##oiCBT>=ZLP@1@z?oexTC`t;c57G>3~@{7GHS!;XU zYG%c<kM7G4fagV2DJ!arByr1cJDl9 z+0!c|U1zI>o!l9xu2X?ad&wtK-&RmSvDLQAF84CC*_J4FKyQw0cuo5)Rp67lh4ww# zou>1n=*0$-%bE@!K!osoEN<|%wG-|{pi1y~&KIkxistUOvE53>{WiL-%D_)e#ZvhY zc=3xBl9|ySR|xAAyuBj<;n*gc-CBBH9jgPT$-#^lJ&J|)a91-YkUQ19hT9gIHIH2G zzLU33yW*|)apQnp@O4t_r&YMb!rl6z%(@I-D|^Bmp+YRdqZAkh_6Ez|V($6wTM?7C zG+$;6p(M=ZN|O&&4GLBQPpRiBo<(T4C1-HZ>WLa<;sZE!HiE@uJM@x-h4zX<0w^$sixx%m+@;4mD9l-%!$nYe z#9ih=EUjTrTz#_Ir?RM3XuFytb=wDDbiuQ#RV$-@ewN91>c<8jRWpmN=>~O%NJ7R9 z(QZYJ@~zst8L}()s%2#>%$~7Ky2>4uazkdt=BP8)4f0sA8p>Ha)-z7!-EUgDq03lx zS1*?EHCwL4=iz{OcfIYMqP1}ux>2M65(V6wmMI;k5IuG|U}FMTC{1tx*N6uFXL6ce zvyfcJdzoa`h2qG+CwMTs>ha2^6k|c@(s^bB(wbf#dOQu|${m%$sSg|h&8!qNk5{$v z1R4b(hl?cyJS?DcgNfih&$~d_taX6V@LS-RBisq?L4pePFh$nT3jNf45DaySYI{ww z&(m+g)T79e2z>g*6sQ?ueFmOe53msWjJs#IJ9-GOY$wYOUb-C8kSSe9j zg7uG4dj^3Azja^a=c1w3mgh34ti*qtlJbTJx6N-_Ts4PRk@elnx9nTY6+`kidIs0twQ@B zySlKoLaFgib%8?As;j$#KVca6l&yCWr5L6a-#YQ@)5c@1t~X_FxW)%b4r^%%o<6Y8 zORZ2}U3ackpl7OjwN)${kl4^LWT>6I++#-ihV@y~;mvrFL{^CNr@fG9;p5dQxa5ms z6-pRc7=1ET&|??3sCN}rp3F0WO7?nM*1RCa%I+#QePa3XY-7z4pn26nPMNh}Wb74n z$9>m{LNVsB86-{InN=&Jw+<#qF;<2*R~}v5)>p1j>;Yy4aw0oCG4FPoOJrf z2skdggz}`=lBH|23h4BKm8@ZHo!Zp#sa;*Y&FY!e(naBUeupxp1!F)s*Fd~GaoLcb z#niW_0-SUaG$MCW>YQ4%s)qIZj+T1Cij?qcq=XAA%_~i!^cEwJkC6f;;5OSNnn+(% zm3=X)7Y{RLwAi7n4HJm2D83K~1_6z#6&$B-YbDYh4V}xuI;Ihc+^3W-j^5}p4CJpZ z;>Bf&9D@~Ji+0yulN2K}B2v^RVxxl~l57_(-+ON916;hhP7D6 z{sMp?6!u+z8Zo<%M$9+sr^dY|8dlc!z#MRPd_MM{%QyY3sVp7*b6P zL^-0*bI7ndG{uV??1DQyNkOVC(-b_9v9DlFA1>jm)r4pr;#J?c`6itRu4Y(_d)~Kb zY1&zDL4w$Nwc-Q}1Zt%8pLpGdixHuy2!dr=o=GV`__199jK5>IQGn8LC78;Azm0qyn#3{>qZu` zxLgv7zGRyR1ML>^8zFCOJPA^8BF2mj?_fwfJ$u8SC3KW6iA;$=qJquZg{{i8YF!bg zuNg2K1)K3rgGNe2AomXjyLk%~3juZp#2w_?bF9E32nrVq813T=W9Q_~Qp69uy=);= z;q|_1uh<7uqSs|w#u>y|BXiU>5r(d^thgw_)+X8@;vA49*O!QGG#8+DI5>_Fa!|R- znZOva=kHTxULRW1;t&=vH9Itr2R#cYd7ks#lS7`AgaHVxO-W%;b5D3`aWO{0@bMyG z&Fbood&(N}@z-K=lQTdTmyU}>NSh)de7^ZupZO>nVaZ=W}d<;X!Frf(OT(ALOkh=xv2aDbAM)?thx znOVTum%;C~IDY%*o?7!Tc+v5o+X-vQgAEYRjc%iRUYDQKxmUxLi*s#WFQr$ev@X~S zZ2^`8WQ_rBAj=OJzBGevc-POzzgL`3oIWzUVYL^GR`=lRoR2v5tF2Diwf5a(tiABr zd}Mg^r*_scYWiDW!q>vDYWZt#^O8-88EE4G(`-iC4X{e}?0u=2mk|*S#J4i!JE#n` zO(fbwm=}-MfHcbXt`_C3?Yy5CcKK@Ix1HyfuSUbCZ6?czNnx0%M6?bd4!wjMVz!Pj zM@(HaZ42wRl0`L!0N6Hz&Y%*@LZ%6H$Y@=r@uda`5JLKk9D`Qut*7x09sw;TWw=P(gLn#yxk?q8^i(wG} zzUlx{(Ar5?K1vSRFXIKiu0#eH23WqaW2g^%fh7`dhKoJC=ZqgqdzzFwHBaA@an2)S%M;|@J zudPD>h8kqC0f#If*9i@Rd4YL+_NBJk6PP}; z0y$jgJHU@x4~z{|31^zs8=QBJxt!-Y$ISfJ1~!mI7HFErQcl#2vJb zng!E9X`$u;=KIeuBe$IAInNFCu_cBL%Rt`Z5StQmsw#@2x8LvG-L1TBSM9EC_`^-p zRIJWr;e4nnbFs~~%(>0;o7wD)%*=@P+|1QLC8j0DVSqLzpI{I~I8wwH!rY>~YOj{@ z8(Z-CTHcYXduRuk1lW|59e8H)kuMDf(V!;iAfD>gaGSZ_Unm{9eA^>w%n0dHumJ(%x29X8!u3d%p;9; z+%7#a+yYS2O^xcHy#0N=t6nj_mB^3NZEjZjoi!#f!de?b$54<<5llipoxoE-W3HrE zY^|znE6!Inb4un4TwI{}D_-|i&T!H^0M`|^M5w+-v_wSprYn}U($E?< zx2VZgRaI408Uv&?tpXsV0V?r5my?mLS!fMI474Yx1F@kXmO}^G2`(@c&wYCpVE_Po zykxvjOvp3#dR-=}A-af+II66%Q#X@!cXd@&RhM^nS$B7LcXw4)RaG+FH@f-F=hpn{ zUTMR*nVa*?RaQ*2j6T`~sv#t0q>PM98mNlJg;iA~8Da%& zLZ*Ns=6YHy$+jJLAxWCW{RdXQ!mrUU$mX8##6oWCwQ^Q=?XYOG9VF0!TZD> z1OU|HQ-B8HNsnMvw?}48R5eQ&K-2;WbM{#X@fa_nFB$J?0U4TWoT?S*H^c@wa%dDV zfm>HteRxk+i>+&A8bY%1-sK%jdr%_iVW|hSFnly>@jydPFbNl|7!W|fDf`?Pv=K5_ z3-hH31n`1&abDUOF4`T!iwOH0Z7{qv4TMk_Ko?ISsq48c7w31Nm!~E%pz#?!y&d6; z+BY^1?=ZW^CmIAAUhJdd58GGZOxtVq`9#*(+9la7wMfIrZcLzb5GY{CE3{_jo8bJf zC@i2XR3630+2xx!^}8(czbBndr2%}sw4lLtxlt)7d4&BEL_h#<;wuRm>;m8lgz&o5n;;>IB(<`X1;A4fSio~n zWV=(^lXo!?ESjSs;3#KSBik&1HS37G)TNSz;iaM#}%z*kHJQrBJIws9xfq4TW6^>B1 zcSX&vd!|NJrtAlNgK)A|F#e}#Dd+p4&M3#7aT{?nRT;M^? zv=Lf(bx}IqwRSDEhEF^?MH7%--ql^k_xb zVKc-gC@)xxAT&HW3Jh;hs`NG~YE8D!B4JIW$|mZTi$_({V{lr>Ru1^*60A}vk)qZR zI)*2r%F|;kY}UM}o0u~)vAo_B$Eb>&fai=d+9;Dm5>Y;zV<8cX02~pJ?0a80{Uv9G zMS;=;OpnA1BPg@e2;O_AXq{vVlhBba`uq;#1lKl-EfHYAM+#^*$l=vvec(I>QqIjq zI=7FFyx4$j*F3(Gnynp&Dm!=>qvk^jk+Z^}Locc!x0z+RCz$z0`J($!? z&_qsHncmqg?^(>ryun$QHP#i zSH0YVCIXR??WufT7FibU{O zSCn|{lq}^3BHijSzbf@0BtRS&c}!5?8Wo#!%f#>^g?54-4-{J|GMG(w#Gf z;DbTorh7Qxm(+pODz3Sqp&v(K2^#i!UdfM#s9?cU(=^aHaz@2QBpBvkeVdK8SuD27 zegzVJpnzXPZWqV6hj*Ut;DJMO5Io2}wIB=~tJZgJdD!gGQ_}=5G|}`p<*5^GGEg20 z(&piTok*@~CY&6A;oDM(212YZ({+f^V3Bc;Ws!HWPb*{FCmXojb`ImQjuv|CZr7)J zG~2t2&gqtCXeYHy9 zJXKY;Hrt#5?4VxAowB-}S;4)p9`;gh4&KkaFIe^i2cHXjdIv4&ss+j@dry(@g1AN| zh+44FAX1OC?+*#ym8cVKL7JAta3h2;3IwBWpoQvoY-19ji3UVpKHD91dRdS+&jHeB)#30M|oA_2Ep$GTV3Guk1b4?RDfcI&@e69irj@(s3AoZ z+@annsobI4UeK;_+hV}fF^Zv#xchqWChu6L(^(N}!mu!_r3C1aFhIEi7_05(;d^X( zrI!gJ>@k5$3BA1am$Be%dv@2I;$FT(d~JES|$RBT3wHnU$z3*YG2nedsJ-gX` zhs&2}J-vIuR_-A7z2Hsj6w6fQaj;65pk3Q)RfdLeV^6BP9tU&p3hm$$nzfD>fiwg6 z-uveFzWbl7tQJg622?f?PJq*}6)UGquh`DKi$OA^9?}NbF}#bnnVTWn(4)pM)H0ic zHB=Zkw{<%$t=;Ty#Vc%MW-Mgh-M2J}ml(nUx3^`%ovW<7II#QB&dkL?9^UKT%Wj}e z?ZAlBXOcpOE9$a$eNS%VnYuP?oCTh2T+HV|0^ z-N>Q=?4gWDfopdQ-HHm%He5E{)4Ep8P3^nh zJrj1#cF3CcKEC(YzP|f7#0rNMEjblVsu}E04Ov4Suwqnx-enTrec-J?<-wfc?NYPd z*#>E(#yOUBh_7`!Cufbfu=(M_iNS;KefN_0wf0r|X6Xf`s&KcOcdt*`^~*f?yu3ZZ7U7iNKzVCtf)vg|HY9*|{T)go<`rIZfj18`}~4vwW&L>#E1h?%OU zceiSNs&+N!lapiEj2mwlXAQe-fm&1`T$>2s!qb^H_N*JgcdBMK*fH(u!spf#cH34G z1VM-t+OeX`s|?h@7RiH*PBvPpQBg(8i&U*{+n5>3?`6C+k|zo@gCGQt7#v>my=^b0 zml+O-5y2>QPf zhNznXhYE0M1hGyL!c$Qoo7;QWvsH*;Vh5HBAvuC%U`EKu!Ale0BS_fQ;~53Ib#?_IkMoQY>1@- zLDy8ttitd@C8o690F|aMB}W15Jl1M9ATkR~&g|w(EoYcu%k6W$|TzmnbUX%K5O&1zBSv3c}5WY(1+E&Pqj$;i;RSLqU~nYVsX|tD0^M1LQl? zgwKL1YYMW+)EL2y?<$5jyseoP-MgSAmZ`&sD28WK)!x~CA+r8|j?UM%W zYtJigg;RFk;|A`*gKehDdw|~A#@;-MyK&v#Xsc|uWNz-)uW7y8w(R@ZZQGhg?(MkT ziP3VVt#y z2Ph+iZWpFR)7qSgt1^x-j|1D60O5B!*)&B~-NA!y(8$)z4(;&q9(|lL!WUPSwJ)ok zZ!0f!I3H$ZZP~|Mz^N_A-U^3Fj~(gP!+CE*tDyHsq1t&M9g26Z!W`^V=;l5sDw|_; zR@uif-u6*+2^@QIS7z@AY+440p|ZrScsw?u(03MVa;}CG&id*aPpn30WhpJGx7iEE z54k~A+;v@{TUWgU(`%kLeVe_Sz&3(OU5R0`(sJnQ$~JD!dUi6mF>Kj3C!Gwjv#wB(%ri~ zVeHJ^rpS0z-kibP$^!}otP6;zwmUkXY3sQ{?ly&oT~;Us#fr-E?yD1cT=w!dbX^MD zyy@IYSyf}8U@q#jpecE+_lCt#`BJ*AwsTJ7zL{$FyJbi&`Hfokj_RfsDVJ5+=t+lP zaH0e0qpK?)1(?qSY;5OuoH6Gq*)OE3NY`?mY+TMxfqDiC(P9hLhhQ<9uXl~x930b! zLoN{^qAfhlARO8^5zz;Dx4fO-p>0VN+y~Db$uviwGI62pZtrCQw zF1Oomg{W3D-AcWcThZ%6M+W96K|O$A0O+r2bSHaZLZ)_Hp#9S)62v4QS-hRCaz=T? zI<-Bz?SnfSxk+vHglK>g_mTw@bo)cnNV)O4Q+1SZhNDx_28lo%Do8nbf9aqZd`46bC-Vf%f#WW&rYnhu=Z(qs~8w6 z-cT#IGZ3>@lUtjUGU@}cR(S6b+}y3|9dpYd?Mz}?PVV)BGZvOKW^Q|>V&RlIOO@>e za?Qh2HpYsqrI_sZh+4?%gB*6p6J$NzqdLpUGitDbs8U?*XmMbnGX|2*$zr>E!ujZ+ z)l|LhbSU>s;uzC>`*_N%Mdo6T{bQ?#)<#`{~x zc;96^&rz9yRn}BjU;$hOOf~5rOw>Ds81Qd*V#bv*L!I*$GoV3?YlOE7Sn{gGu|?wF z5UH!myVuZ)6P+iVNZs`*M3A$$YM__ocehZ~VaP5E$2Q@tP8p(%+Y+v=WUAmdTbmkZ+%SQMABY^>IT;Yw4v z#87!sg-gyPQ&`8ebY~o<52@hsLJ|d5wj6@0=6h*z9@m=pXN|hZI+@9aR)%Q+kl+us zo0U~z+N_~nosVr(z$Hu6w3D}JFf6%H>F3X$`FuhX`|)E3}ob zRfpFGW<9sZZshLg+`Alocd_?n3=e3br;h20VOLTWThgzf-Pb8)%dNik_Z>Ht4AoUi zwuRcm+sl*JK!}a)*cJsvVE3;yuC4XyTA<0&UOJZHt(;y1AnZ^ab$&ty@&LQDo_%|I z-CXOQdhh1FyLNu~gg>l8AIgYB^eQM{oI)OiA@lFOgNfPe_l1^*#!S2frR^RwvUDie zV&_o#;%^@du#d9{?758hIwEZmj;qc~#9AgNP1q$7Jr#B2S$8?TOynmmLw+2knWL;j zQys?o#@n*93_NV=z{Y0Hty$SsSDISxHYcX=jb!gZnd+!^%kIn0HYvs;7;d@_I+fkG zxg6k?ZsvBkW8PQLL87<9QidLUt9KrqZ?vqiYiM_}ZDsM>*J)L&RpCp{s?$SER+jgG zzjg*KW_j;=vt*%`6Y(bM^gnl91xdTZ3TN(y$K?5JA1TD&_gqj?QDv_3y%QrTd{dBae2lx$jD~#o2<+{PU8zH zC@2KbhSDDm(J&3muDcW}(d0_p)5EOl6W+ydDjnL}$Zx`%Tzba?n@#krz%vm^baL|Q zuR4v})7@yyL&QXa!V*mY(33#M(nAI&&&EMcU3u%v z*0A*L8%c`cGA1||kj4dGTxAyk8Oc#G1WN|Q#>SohUG8;e8+jBnO|>m3?45(7qqa?( zD2&-HV=I*zfbDPz&Je(2vu!EH;L*np7Y-aNxfH<|W28<_Gi(^zO+-}r{eN7;uIE25 zt^C8sTK5JM2SE^_U!A_)>3*Giau?Ti_FRunKr*<;@OSP;3HN zhf>Kre?PtVhhBZWY=_1;2CQ=mNGM;szCQSI$@J}hTie5fqX4?gtQP{9#=wZNtZVqA z9S^4xY-m$falo%o^l>T8YeORQJ!5R+GqL~&?Cj&WfwZIKM36U5XPff5?n5;J0|jO73fTGD8zK#7qTu%IJ3RlwzSDA<~?rerm8D~!52!7eX8@*5sS zEX9@nn1sL{G_X}zeLgp=;aL~P?D_5Dl47fl!eGz3R~KaXAve^2IrE zb)=ZO-g%nz`i!Kb1-&yY0_}lkgOZ31ACK<-?s3NZ=OJcC zLjV`d3W?` zTwo3HjNyYCczWCUdom9mwSdMbZ|>grl-biUj1DPW@r-c2`11+jM-$dK;Qqz~ZwW$R z^3EUZj2OlO7wfwVtfBl_*y+!OTCG*xgd)&!-`k$?;Ika|H%5*3of{?%-o&>4gx)u? ztgvea(3VXfUNpW#KuQ>TRx&cWKr}=&I`OL}R7A^=--n;PJ)q}2r(_|=N9=p{5c>Mo zR|k%@kTHOqhw>&k5#I6Ef2Y`t@Nk*-IXf7*jR2Y;0O9cKKE)U?h@9mw)x2W{0P(U1 zuhC=3f0J-4jAVXrU#H#^Y-7hdts24nUN^mjy7)wmQ9~6Timl@sMN91kk($N4q{wD_Uj}D_wa%?$3>|p0SAyTu?932}Zqm;zx zG0=w?$0B5HXqZDA0gW!_E=~$|l)_;OprFiyNsVVIsw^CFjPcaoH)aM(Fo;)qb>bwR zU3KSl5qflxvIJ5f%%A}CdEOG3OhdY@)s3cMsCF_FOc)Gp%sG-sh+a9RDH`#}n9m)_ z;<@9z9s3d3F?zrXl)F;@o_pTStfPX%V_(&fkAB|n@$C1U&PmP#Gtn<5)s$SA$Q3|z z&lSoECqR@01{iJmHE&rlzejI-!Z_A?GItZz5MpWI z6HR5TtBpAb$)P$q0RX|QHpdH8J!5!(uHk>G6k=PxE zx^T*e3te?oWy5WeiSnTM;IWO`ZHzXA>F1LtHLaOffhQqxwU>Ypz{CXL?HV*-PuBf@ zzW%?D*W||^udv%WmN`T4vUiQkm=4RSOya<8{h78vF@wCOILng!wmiZJsJu$7p?0%8 zi6DYOIFw*EjfB6qqryI64yZ9cUGEgJVA>I>C5|N=X|#z|1Q5pG91MA6W-h$z((=7^ zqA4t!Mkpn9({Z>ZZnC?*adZ+}d{@AvOoo$YLa7bllF(XgC`|-3i}HC}tKHkCl+tY` zug%rg^N#K_jo-K5px@`dj0xT+L7M9}%;wRKNz=#?)NTC!ogffEQ zf}&(@Vo7-Qj=zC*@2`Gw-gdR|sjpEQYtOcaIM5JbVKF6&xGKI8DawjBIoDWv<}Lr*~}ZZZOL~>AzB;lsuI@HA#_M^EYyr_# zoT^Bo*-sd&Zj_ze@1M`d=D!DHeebTmSADG6H@ZCU8un6_#;PcSP)e$);VP1i$Pp5R za)hdli5L|q_?jX4`Ig%>j41^@DN+tsr2wTTQiwu{rbw!2DioavORAAc3J9{GWI(D2 zg!EM+RDo4Ws8^z<;B_5EUEDa5WOHyiqQYWqmsJb+NeLk(Hf8+$7=GW#zEvE~x4Y7> zs6&T|H}1h-2OeyZSAIuDPM{`LZlLsR;M(~$-h=nAajaX`R*zyTe458o-+xI87la)hzj~xK(oSQZjD^<0K*Op&4QKu@8}M zT=CL$saLY&A{`l5YE#6Xn!j_L;qiG+SnxH!EOukO@b{&*ONzL48m%EQ-X!|azDooF%fxP%4ra+zwLnN{W8=J?HzzN(_NN~}b%;ly3q zb?}3u_c+uo9aeX}w>bAHz+`@j=M&l9-n8}11@1>)n9sd?-uJ%bXDP&%gU&F7M5?A) zn*yrS5g6aDlic1j`Q~4{cR-k8pvJ1Ed9Po#%hnw=s14o`JP~?Gn&F;`vkRBQx<_mf zo1g)KK&KM=FttBJ80rc z<9$(t-LqUBg(~8j$~Bf9HdR8eD)!s-v`d`ODjR0Q=WA`bCuf#CTfE#s^Nup5dU)rV z=&4KJyT2meZyvEq(08P0R5=ZOx?4OYr+Oly@~YicQ@!x|l2U~7Q&1OU4$hKX@VcOD zFNU6MF0*^xOzU_(UOXR)vX9vshn)riOlgfy#&J=>~t37j<%VgW~+B-XGAw74Dv{aGKt$S-5ZO(XvcKfx#Sophd zbzh2QKIVDXd!nd{L#@5>`1@|D%bBZj5lWnQmXDW%kB4;`ZGKrOe&Op_RzeK(dqrwG zu&+d6lN7oy+&U@T@KQe+0(09XZVywSLf*=|u$Ey6yTyhjB-LtomI_k`{lDL=M$5wB>J+H63?E6jWNhGD`V1nTjbGYljC%5lPtmxOL-KS`f zZG9(c29tgnaM07;@!*g}VB;dr{7%f0K%d(!n_4i7S6Jd&)b*Sx~>^_(u+oE z59?2NmC$=^M%~WKWjA^vYr6lI*o4c9LZ}|tDEgrRaI40QO&#_`>>u# z>3Y*##nQ~|_tNgxa(MF*(5A_KZ+e%Ln^0wo4P7E1XJivUst~F`ITAF6c!;EzMgX@quK9KjnR~EV2+94u06?7mY-12F z2?l*a7j;eb>^)S)$De7$*tz$5hb4U5;df`xi`S@CVdeEp$F`=sJ;J9amEq&_?>SO} zVsse9%5vK3-;BES_oRaHerRo&F@V(**h zG-#aS1PClxv0$MQ6TZ8KZsh8m`vqm^1}${W^-`h6F#qE75&xci>#_()G8{e(5KJ*9Tt1gySFi^w8BgN?PY}|T;Ma+2Bw8<+uLC?y0bV7t zcK7yHW`?L7QHm;!UIk);pS7>7L_5>gOzLu~t1jq7JG;BMd&$hIs+fp}w;2#K9p40GL`G!hs;Z_T?U|a} z9qt5N%<5{VDypXBsH!Q-%ew-oRaDT+xr~T*RxHeS$c&s7 zmuGjFFIRVUs;a7-nTW}ps-Z)bRaY_Sh=}Y%-Q47fndC-H&Qc7jp;#>d7j;!x>$|F| zO3S;h)m94vs+Ov&FS9e1RZCG9GY;=cWg#yX=z{@ao#xZQByLLgD%Eq zYX)X!XRgJ}&Q(=cA;x6LnYOCKoT{NSGcR*hRa7ddOun#DL%u|0D`7jcH9OQm$jFWi zqXO1o4;X{5N^*C&6q$t%by6VoZMFf(%=3FQ*lJGKInEiM8ka4@kq38ocXzp}s;a80 zs;Z)xhmqq-# z$x-b@5icM50KbZ^TI%w-R!nlvJ980SM>US7^BmEnAS10m_}ZTP9csUF6H#4FUSm1N zNW8g`y)}!A*a8%R#Du!R{id=0aF#ikODJF8^*B2FAZ!{D#=T)*KRf|ly<392?_0NR z$`_qYWKUiBc;_TtvQ^%&Ja+2y*-GzeTM>0+J9z8w@$JtA4%Vc-dGo6^wNrrz4YZJv zy=M%p1ThdGKu4QyB?$zWm)*=pFpwi)&><{6dcVM8V@6A2voS2ll9ndh3JoeV`MZzq zZ5zKRtzFFl`bbD&=Kj!AgFoF)78XkH&8Zpq00X#oZq9Gx?VjZ1@i$}XCbzyRQ~()1 z+idP9^%8Cu8gm9P=IR+(acp@Ikc}Wka`c3f{6ng>q^sApxk+~Mzh{2HuNsRjQe3p7 zx5qiob&{8B0(jfEZr4<^=d@Wx#t<$HKv>9B5}dMXBUTknlT@sh-Uo86TE*SsdS9ju zG}y*5%370YWwc_O@BHtJ?EUv&Z?|~%rv4;^3myJv4t;x)d5EjM6$Mj+n?k;01(@Gk&SN}zf$=1k_m=w9G{RX&Kg z_&xIv=iIGxKWoyo?j`KW@Xb&`WagrAH&d5K*tD=&a8(8%%~I@DknLhOgLSgZ%J_Z_ zHpUI40tPW`QAwClDXZ`2$ImBx_mAgR%5~z*9?d;>Be?wA&b01vtm{}Yut@8VH-{|h zdUP2OO)ieNIgFcTfJ7e|hN>ej7PEo4yElUmTz8=KyQA9?)#e*ID3`5jI7^XKdI{O!tn zd}=kR>Tx&cY1?sW(HWZkLj1n{IKCeTMkRgykHPo%5AV)bCEwoqd943Hfn`AXz%~th zbe;$ge+z&&1#bU6g6tEWim5Le4NyI_puY^mRaM@%W+KcGb3uLR~p8VYR z=U;1`zyP!fB=5gH?|Nl(+>r%QIpRp~cu|??-hz#oo?PncPH_auj*d(kz>pY@u@dLJ z^5)YGp{|4PX3+09Ta7&?cKYyEJe=CMN0oBdm&Agc&vhHgfqeVV$?Cij0^t+zAH9Od6 z(HmN~^ws(r{+pKRnOmI6Mlw@P%CW9h)09z0)=hIp=GNyoBAwW-oi?#!YZ{v^bC%_` z*-3M9Ha3U|1~7(!ATV3ZNC-(_00yX19OrT9d?n?0TwGqUtIX4`a7ZdK-%n9bQMkS~ z`s-xNT_AgPt@W&k5XdsdoHX?=#ilgXs?yUYs}`#*X_ZrHQl++~mQ=E`rc}05RJ5|o zEh<#mWRnoUNC9X_SK>YazkvBeH;EB6K={B+{{GXLPw2bd%Wc14@`idKPW~xs_@8WU z^|5nKWy>L~+BP<3+LZ3Dsg{gwv14t^n(49HYNJgzIcvJQu5Ht82r-tlM2J9-P?AyK z&gZ2)dCZZ7C`&g~h1~8Q_mGWe+LHrF>@ zbk5F9x!JT_t;}~^Eo$bq&SrCLl|HwP-=d1XKm+(~`^|V&XA5VD~@V0^7P`b5T9^EiYl9-yNDoW0D(Y$zcZwg zNT6*EXkNAU;-(z`pU#UvyLZ=qxA~o6KI|X4FZ%Yx@*z>6&O@~l(p;yR^n`A294WJ; zuzZD=ZaVH!d3}g2n-GUW9w}|_v-kJ-KR-VrA|fzDunelJOw#io(OKDivoZ^@1HC+RGK*@B{H#g69tD zchSq~r;W}gVmO+qtITf|zE03s(1UQ>pcN3T{a5)&o(y7-pL+ zQ!;ExSv1ON-+Sx3^=-EA4?4N^bo0X~zmm%H?DPAZ=Y777@%Pi}^t^k`;lgE2J5dVM zDUwF6)Ux7{O;yLw##>|Y@6Q`^7^2@R&pKS)CtYUt@@=-TGvvT)a;G-1w98bcF$7Lv z&IJn5^qAj|z}l<6#=L#^k9mne$J=OFL>d%hR6&2Olx}6lCa@6 zp^3Dz(V%m}7O2LZOt#q&J*WjwDo{T;;Ma~g1QeAa3A%9#2K_9Lg;}>}!ZyV50G}v% z60m}OxnUZB)xRU}Vem8nd|cfRV!&#g1<*~jG1XODR^BE?m`jPMw{|sbtRoX>(G*w? zp)~*iNehOJrZki=A6zE`c(R+thfbL;+8%+%+~&5S)MQG@X2S(sbwr7Nlf{DqX^0RM z4N~(3lAH3Si=|Hj^Zas7#(DVnPosyV@4vECq|f86rursTbgy5}_V&`Y}Ap zZFYIs->W~Thi$>e3T-36wQfbzu%#bxw%Br%m zwQAK>bgrsas;DYfS(jO5s@1iXs_Isir!J*xs;bqxtwl9T!As3ltyNV@ncj zcU0*cQ`u^zmbFY&xJ(5Tf|aR+oUTxoa_Xq8g;y(86v4KaR7GbKNP;z0T>z5St5sC2 zsbmRzD3Yr(CoQVgYMiw(XDUm=jU?4%38b{evsGzYuCA%fQ6(uUV09}>t5CyA*HWs* z(^9o<2D(_08dmLY$)rY>TG9)(Qi57))l}kDq?=V$R;!~GRZ_LHmNhz+teSSJr7>b@ zC8>?7R;E~;RI=4lS*oj&YOJXVqRW9=TQC}BZl!8nRn1AJs+L-{B-E5mQnaYyUUQA7 zR;;qs5UvJZDVB{&)gqZxrnssgRf+{uK+?5HWJOk1sb!#e6*TG*tb*;FoXu4$Nrk5v z1(>N+l^H-4T9VB!YNRo0*rjzXmVVX(@D_ zfCGslKmb6bKoEcgBv1h|f08H5H%0Rjso zfsB#>#sC2bh=C9wL_|P{hnKAp`u`?B$cTuDh={4m$=0A`JH92Yuxob@caaegs=0X) z0vukdW@aPjefR0-pFQ{7c-n2W*bVgCNyCC0XbYa(lwM;^NNfAiDabf=hXfr^5osR>v~)5=Zna+np}3}>$o-zOS;=~bG{$s?%VKb zb&vGRFLGoHezuUf!ejlv>;E_Ny|eFreC!+!_H92qt&h(Y`Vwfi?Ik^9<#pyuK1-i& zdu5%#oth4cI~fN<26N+b6d!A^RpLH$>n`baInmN{lOzz`+~rly7bC_K8wX$!S8})m zloO1YUIf9EUg2EsFu67yi-lF$0~;fi${4ur6QjCP>^nPjb;upek;hJAM0>it@ z<1Y6<<(uxU1GGK0;OYrq25e^M6NtSytxW37K5do`U>pIk7{RP0Ukyb{V#SMZo2JB5 ztz$_M188YP3=$(-#p@WuGm{#fWX)ycRy}XBz%usnXvK+iF~d|+_0nzyHV z$s1KXhi9IyB%uQB-n=(Cs;6dDHWumU&;o*4RZ6fZMsTsv8#24Ipci%0-340R)%zA; zBW>0vIy&1e>=?bqsNQL#3>t0(h!~pyZb_}YRCRV&UuCSCXO5vltJw#;p_y-IRxWL3 z+cUIf;+C~x?cy%iC&x{YUtVB$Lz=!;nlD0Q5m_D897`wgs{MD8%GSfn#6qV#S@8=A(Td5D>ICa9Wo*a z1~d$45RC~5_cF*`U+5CzJ1@>C*r#>BocG@NUr8(P#79C`t8aVfM5FU^{(ED?_Z9b+ zt$sL&es^MbERkvDI$nj^TID8ZF!#$;>A1)jbVuP2X>Qb=S)8v#M?(wj?m3 zU~ow%P}~s>_0mgqFVwD*rKOd(=DyXn{cWY0QoVJ`N?*rUOES|z|8yb#;D+P;B3~jR zA{%G4eT)7+=UV;m_xtbR_$sQZW@cyRUEPbjyQ-?0V8NQ*(!oS8Pg`7Ncsw!&h9)K1 z^hKllH6YleV~7YC*x2EXzzi!tabQ~>KWReW;QYw4e{5_upkoaO=Y8nND>7tbAUA5l zt)R2HPplXU#$pkZS^a|McD8G2qkPs3AF+%Wtzl)O@ku@JNHP>;8(eu0^(0{}nN*fY zv1(05#xh$n(voIt8*Esj(UPRnRHln2l%l@={~uqUSXT8CL+p~cfIAvUN&q3rgZk&^ z@yvFJ&TZov?0uo?^(*s4+|{`wK=l=p~4CbU~B{2Q_<$v z+tmAgqfxIuZ|7DuNmQ1KqimWjC22HTHIl_8ixODUV=^|4B^tENq^w#>EWLk!cgML& zX)RbBp|P{!AFsfd+xg^OM)Qx$(;=Ar#Acw`e&PT-8UZ1I(1an0h&x%#b;<4_=x1@9 zt$=Joj5B)gzFE^Tuv_IUaMpn=BTdwK?QQa!L$?%@j)lQKE?|s}@;<80s^}lO-85d*3u`@N8mP zOMirG0cH8p$KnBv4KcJ0F*TVYGHEt6nl?5mEi)!YTGEW8MvH9IBN}ZCV(Kl$#Na|o z5PR>-nfL3K>+PqDfO8n^e>R!=QMHxGOE|S>Wr?+n zo5C1o!nUAAm8XHJ#0ga7l$+S^Ynxk1Z zDk{dtlUX%m7K~eFP-!_S0F(rDs^A7gV3xtW%dN`WHub@3mnpFefJ>%3=w*U#TS*t*uQCL82$vCWQ>RPm8(Yd(c? znjY@_40wKk1N@bJlTyL7jsFG$L?3$IEfxZ3%ni1T;`m@clc999gWUPeES+Q<155n` z*d{bK4WKkqSuG|s$hI{m#YUkjiX&8NO&U!aHI1USG|girqiRZ^(8dEyV-UQo$0W)~ zO9AIR?qBfhJg5SeAqiqJe7}d+hB9_%2oO1#sAWQ(aXdNX>p3~X9`3{tZ*iIXC8I%TW1xdyGJCkj(UDg*+f(p> z0zR0!7`+`L)V@GL{YK;-B%^PDDqhnH1YLh0aDg8YAK5vTBPQ&kE+cH~+;E0ctB00ig(~Oh$TSyYF zPaI|LHKIp{na+flHcO50(~@d;kpQbv5def*5M!CDcZV_9?;jScxXuSq`r<{!-7c$|*Ll7cB7BT1t z&<{kdFGL#LeFK}VqY&_j>S!quP7s^K-K~>mA&`^Y2AQUG#iVE>2EE-(shIiH@Y#4~ zTPqmCyf=vt4gtWd81c!y1(eyi`LEqcX_X~qGcstj%}l0kCS@kcsHn9SQf)?!qf$|$ zX_}IZD%Nc+rqpdsV%ocV`sdLjx$XRqu`)u>a8j80F+XIM#@N{ByPaLMfDB%uGt_c( zRW0Qti$N_2Hoy^<2?ex-762|@df(D@lBOLG6HgAaS)dnGYMQFas9N-u=i5APbK~t_ zO6?tN>+|#P;V<`hx^ds?)K}|n^-AmU$+kpZ`1<$l z-$tstNeCoMy8dr9KMH*Nhgl|j!CH~vK#g}71Y8$)d(z}aVqHTJ4;xwKX7G@aV8J0$ zK%$R{eJ8;mOd;)+5Qfi@I@{TW@s9)~j7~le3h>q#LvH=~gt1~YV{bajA7P%yw%Dsj zH=~#k*kBs;h|>j}C@{fQ#A_HA0N`gUOnQXy;BB=L=kHtLS(=%lO|~p$H8yH#OiBuj zRLWvT#)dH_3>Xw;0u(Bq_CFg6~ z?~iY8UFq=Zz3uFZ@TkRAILf0uAZeBe@{iG#1awGX;JFE9HBoX~ih(lfLW?A)NP)Y$ zq(f!Zv0b*Vp(`wwM3SliZ8BmrXghoaZS?$D=;EKZwqL#UeX*Bg)8u`yVEfn}&zq-j zgL^(bhv#2>=Du-<+`uN^F0qaFe!gzAQ$@{G5HbfX1eXvnD$6W$Wujf7B7}tk@Cr(v z6nyD>(YZ{T@InwN_Ko8=oo9ROSd98|bsv50$G6>fyxw;`-|YOnS$t+W1GzuT^mK4; z^Zb8Gr%*xs!Hn~mv{-)!fCz#J5+S;6!GEZq!T7V^oZtEWlJEMsaR1uqU%76hOTO)G z9&HL`*N1gJ?&@`2_fs4A0LBYHMBhtq zu9=hqb4JSMI|l~QjxA>!2?lsGX3;v}EH;4)9b=uxEOW7uHb@S3b%E2PlQxwznd~{r zJ1N-&&l+>CS)Ay_&ge0q3~ACg2TlVBV{QR5WW-BYCb9$B&;fGmqm<@s-2G^4{tyFQ z1OPJ7G5{9)^0W0{U!ULk{QhO#im8Z>xz2N&&U5fjUuGI5iIXxZxI|4kM6pc5+4vw3 z^}AmWRF+p~++Q0VMNOD*I)+1f9{6obxmYVL?cEK{{{);5h(iwLT=oha9|eO2Rc~Dr z0B)?CcVdl-dg`Y^Zy_eMYZu+ctSx7CLJ*!F_N;TOZ+j?5P7u4w0pS+$mp0d2yy=-X z#a8tV-jwR^jmQCGZuczOdM91kvMweeQ3Nt8@DXlR^4}Me*H>?71Kt^ykg!{xDm1ga z#c8|ItTccHAkdJ2O^6aI^Ww-^EXsO~T|=4)D}icCht zu*+0gN`!XXu@0`r!L*o~O*RcFcHXHxn~lixcsGm2-x}N660B(oYTg*I4&!iRG4FAT zpx`ZbFkcSdHCcIexEZbt@XYh7TdzfEH{OD+X{avYGr3l864MOJ%*(tybssY`Z??v< z*k)fz?AdL*#-6JrA$4R~C&G=1BK4CtR%jKJ$BFSH$Fp>Mvv9jsz@b5i-W`D3G7U4f z>fYT6*l)YI=2nrsMd0d`h7hm}Pj20E_JuOsN4QlE!N3~^Mb4d*;bXy?W_#F+DUm5G zhU)4}*K3if4P};0K@yd9)eh#O(L*t&V^>^YB+7?a4XCy=ZkP;cZE?gz-XAX86JXvT zyRuSNSmF`NQ>Q59&JFk9Yqy~Q?0gRH>BHmK$H%?!niqU++air6Ce+$yQbwqlDG@D< ziYUf1LSZ9Dgp}13nUt9!R4LbVn@pG*5{hAD3X;{R(+p|?4GK(1X2zJ?Y+x8JiXIda zMKRljF*jE&Lj56;Q;Hg4M^Xsc@MThADyYQt9zKs+^j~Y^fim&OpC5OS@3*AzPgGt| z%50=Wj8l>~Q7R!Iq7lCkZ@zw?ci#8F8n?v=^=T5KzByrGSz#gAj%#rpY=mFHg`_pWO%TXEQr1LQX#kM(|pK%x{8 z6(mlWe4@YZR5C&&$}~LdxvxGRf1ls^{{H_2iFbeOL%u{nyQ-?Gk(E_W?jGGy--o;4 zefP}m@2`*J-oI+rpSRBu$t;wXYDtZUAn&i$IW}*Dx!F`Dx1j( zHKCei^PKBl$aHWv7SiGFG0~952bPgtU@J<J^VPJvhmZ>dJGF80lu(ELFZI$OIAb4Qupd$OzFc4!4NyD5S z-V-lvHYUbLZ+wh?aD3N+!^6vx+J=S+ubS)6d&0{@Xg@khwA{>C#F0prEJ>m&`Pc#p zSUL9G^%d1GpJ(PolwPbJwQAL2RCI(0#(1)D#$J|7(Uj6ijcZwn!LrDA830Jx2?*4` zeuD5v%p=%AucGFa1zUr1dngGyoTjoE&RYuf4`Tx=-XaFUPOAnzFTl@-aB=N}7~Xzu zK{#ngbhAx>HkMoKRuf5SkioLdb%pTk3>}7{8EE<6&bV4jNczBRO}5%>V9++xZH*?| zLvLN3AQGZI?BtlAZ|ngJ0e;{1WPi=K$8%`1`Pa=CTYov{w$iVaV}s1v9xg%%sZnj!p15B%Ry}ppHy%!gIE|l)54ln5M_p|rrPRJkj`3W zZMTaGEjb@qv+3BoTF(CLA?Tp9A4b?V4Y*QTQcDp8WY#<1+Sw&5+J1ZWmA^}Zem}Z- z%aU`9l@*NSiRw;j$Tw2;k}n2j#-YU^6T_PDN7SNs*L{D!^}o;h*l1Dzd4kve`?N6w zVHhW-CyKkx-Pu=(b*ywWBTbEuFxI}cr!afq;e_|aukZK!|6*h6UES8TpEZuZ-}DPR z+<$Yo{vB2m9K1^_^dCzktzeR~RHmxw>X+%@y@=W~PT4q)y2FZ8GKJfYMBO-+ZY734T6*g*n_X$`caodW6dUjNGcm$(EL8Xn5 zR#(&MSG9B7p+NkK2B<2v1y@|6k;tTJRF0PwNi9M2-YJIB7I10=HBwy5MASCt=XqrM=Gkd zlJ8p~AX?Tf_>Tm5We_+r@g3)~dfJTBh8;At!fGYMDhr!va}tSM30xY;)i{LPxg=qM zwxN{e8}0yuBGlDRnd&;qfeqUCTa@Y*^XUZ+qPg3s~>#ae(OgrKL79c z;)4IU10b+F$(4_tjG9pJ`R_dE-+O!GlfDS{wu_Cv$24mDJMVq1y%>4>A8V|AzO9ri zZX&AX7Vg~DqT5p=2phYJVM=4M#t&B49{WFi_iwk#7rcYzPnv3&I)v@nAW3r;qLX)I z63T`Wq^spDn~TSfbd|n0#^!M5#@{cz+yj)8fm?MkA{z>_s$!FOHtjcaU?mFxI$kCh zRQ)1QkfaKTs-sd9CGqOuwZ8SEz7vCa+v3OL=RrS$32|1cnr$+o8f0Sei^59=Kn{e& zKw!WCmu6@D{u=!L{wF_t_5P(j#mfD+^$_}=PLAbf`6Z1s`|k+e+tPf%)b|+0vT1z>d%gd_iOZm5{K9^RtUDLR^8QnE*=UsH}W(O`qCUdg8IOi@h(H?#r(2$#-b} zYhT-W+U0Tuw}_9g&%yov|6(R}l`#))tAFv5m(!qhPrU$S21Echl`xkx1L8je5kFt! z?#Zd6S8V>pR#^SBK+0}^JkmJ#of?w5cn3i8AU<3#Z!ee=j0>iAI2f$u9KB^`1xGVw zzS_;-4xDE5;jeSpP~tJVd)jd!a{CXtH69(v`tT~8#IT-Ua&Hr`^GA>*)!E-W$xvHM z*X-CCK6kn>`D}7jt37vX4lWYK?xtpC*ZTH@NQ! zFzh^#D4ooCJhe=w@|mZu5=YdPT;6dEfDVvmx}KeV9!y! zVwLp^n^!TD1l*f$^!3N=-Ni2Wo1q7L-f8Xa zvT*{$=yjVr#FHwghpZ1Gv}mzeD!s5|=Wc+k+@jpB&6jp`3Bu}*+XnjUtE1s))|{+- z#ks+5?oL;N`<$V{VSZX1lWpEi$b_U63Qi5QQl8h%YmC_f_tY$;9= z6qV|9YJ>6>C*u6IYm{^c#3 zSgCxg%P|2rzvvzJ6+wfs*jEX+WYGc*wAvCupPs2px7E&ZoMRbzrt~2!6w1f_3~2rK zAKBNn{{3IS&q#QXYQDQ2uaDmURhda$?(J(j=FtsE^@}k#)#{?BviG*i+iX$_f-9dz zo=Ak{COJY@7K_E%eqRv|x)5xt;iizYk5;`+QA|gG;Ls8n76vi{mL$JPCV$c(g&oN% zV1hmpOx%M#gAJeb0t?(5+Ud{?yDsh`|CfV>L1cL`FnL zPR;ISh_E=~;x3z3;B|cFb=*AVQ>LT(;%zdj4i6gkls+D`*A3IuR(+JH%!eNR30cI#=9K@fRyBy3K}t zOL@d}=I5H5tA)mI-nT`M9fO3By2Zak`#xw*Wp|l7Vul~{-KwCrc+mWz7OGgAPJzWE zzc90F0Gi`aeuMVkbt9KLp{{DVFM9lpPugU(zJE~f(3HS3)T%UtI!mCeNePE5-&YhafrFb`k`75yV}Jnhd?-Yt?vg(1 zzZ`MTT^hph#&dwmo$7S)L>5M^R!)R;iKXL*4A&d9AqIH5=S^khYa~Wa%zh7qNZ`Y2g$Rt?HPwzK8XVA zI@sEtvTJ8Ejb!UO=#AnE!8ztGClT1m7A-c*FWFLdJ;e6ir-bS1>atCEmJ;Z+M=y z*y50p0bYmG=0LzfrK8>b^Mw_NstQzNFS62#yv8EDJ}lK4ZCKe#WO=mb<1CxFgvKwN zu$xboqmWp9G4MykWIlJj1$O#-&N*B`8`f6g~)X`!m~ug>sha{=W{hRip7RdEqhu6099H3{r+;&sN>u+=b0_>rMCY5 z@9JpPSNl%Xczo&dpJ7tvmvz9|NF$HCo%$8eciU0FJp9j<@^vYCHZTOs6CnP0FVcf0 zD_|o3fcG==;Q9Ripg^afLKe#3$22ABl%tS;(zt0ah5f%Ohh(B%J3%Yj4bBirs z>L81Vp0%xhwXuHz@Scrv;$>5TybbQwAt1;&JU&Z7EVh5?h%G1Evct2s4Wh1A%DZ z!D)fU2?vCEpeRXoP=wk@GLl4SP`m50#`;A2aYPkFhM|5GixNb=;EYC?bPW_3s%X)G zRUZ1iwpAmzJ_C)B*BfhAyM1q@aH47yw4&;!%TfqHQiY_R(HSzBbzCL~Md#APa2W|Cv`|DlZW{2-@ zeJl2Nz&+A$yIhZX?)&dYp2yB{*g3t2-+kEM310TmvF}J8``3JH?)%rgcFaC~W6nPF zi)8zD`!TfKG;M9}Hv8Uud{>LtyNlSnYXm$$Z>#UN!EJA=&yC}UJA2i&--WDA6fX0C zrHh8n<2b)?lCBTZ0RtEe5E?TD-*a(KpXl>9KL4-Z?|a7Z^u&CnE(AhU-udG?-<{*W zaNfGtS@O&QLja-$0tPTiZIZN>*O%`vUEJ*j93|U1+pg-DPO@COb=2&*x;>S537#>^ z8N-Jil|fAM=VM`ZS33rF40k-`bJ)n7nOAIQ9AI6XiVK_@3XTp;^RvT%af6(xfHLP~ z6jQWjWrJTutqu^;mVp+Jl{xwM{QF#g+Nvb1hGvKUPIHDpXCVY8hY%tfNw7_tCwbu$ z^W{~4KgdD1x1#`NZjBCXsUP%cd#P~lU0t=&=@WyzqnD#LlNoccWC-aGj#sL-oTcox zGT7GU8|SFY6C0+hmGo@3UeEm|%Dmtp_@zL7+o0y+e!q(BZ$U&^s?jeio+*;Ja`w=f za=KvQ(*gg+MKW)ti~Cf?Y&h6zw8H zt%7Cfm5%uE&Jr3zUO{mRzcwE?A9h8eceI7M)l=IZWmxO!5Xqwg1!E7G+S;L4R}>Y# z#Wh<5cmwZyUU3EH5hDynq--lSDp|JLQIZfg$E?PP3lJJWb5mG>)D&EFizI<$Q3FjJ zA|D2EDTtg0h%|s4NVP;~cV!P|abVU>tY{uV7JcM6A!KPDWsoR~GQ{+a^hyQjaWMC6~EYo5VNnF$zVps&JzI0 zz-g9qF;A+*^IXyW`hR8z=8b;}BfH%F)Y?^dtLLWwuF-g%?sl@7Ra4jMPH|^*&evX} z*9xBZxy0)#)z50Hw9|sUHyoeV+uq6S`cV0My61U*e{#9=#+2_p_=vA+s-G@8-QG>D zc1yg^RB%rVan9}It5$i{>O0G|q&D)US>kOCV&!I|*nVcFX>;J3W0;pNHNN*gFGeLq z_R?zokok!iqqNgLl}DNkxmm)<=UQ#!h!^BzUqPdK-nvL@-vVkWI~+ck`O?x><)Gc@ zaQ<_sIo`iU_I{N+*s3Vno7NL7Th;SrUHCcV?)L%ZaH7xS^!{|`n=oK|n*_S)KP>A4 zAC0k~aWAqcuw6fWnBBhn)u;o1Cu!D~itL?MMtDayej&9Y#k)rJ`d`yThfhV;Ir$uS z-u*S{&P@~W=bkFbKYDkYUyI_7(4O(Rz8-g+eq40zd|Ax%j}nOPcjQ~=lYYh6O}cSd zZgQaUDOwhatgF6ikd~QFx@mf1`(vC3-vSk&)&A$G2(iyUq=C*1(f2)Z@NRE3`h|2PC*`W!v>}?&E;1`p*%(lBDj+w=)?sBCOSu zrFIXJhwM%rQ`YsS@ZPpSIgVGZr(WYT-0+s>cQ%p zV@Q_uQ4T1AplC34P0(NggbZUDxCX%~OV-q3Y|Bnp0S;{SNRHTm;CINV+_i{tyX zjqx+!UjYrp^oE!mp7E~u({U#=Hj(se8}B$wbeOf|Y|l;>&3W3o?t3S6Ys<1Y5#~6J z z=0|-y2A6-+OU zY!*uV(r+eA2+K2P>GI&nW{21e4QLpQorWvJ&7+2m3`g^L!B}Y&cS=Q;UOmni_3^(z z*I|e|eGKdFqaGaw5N7s;@gRr~#-Ho-1+hbQ`Qv!cgC0q@SjklVLW3m{Sr&OW8 z$Vo%BLHx%#_kXs{ZGIv($NY?#fl(JTGczLSTtmCKc58dNnUO!L6?b=24&XB?tu7}w@z+Nw$?o>wD?nhUg&?fWrRAVfR6D#F^TY#QGq*^v?4nQh&&rPU=W ziF|x|+(blRx~9pKnU`#~)|<_qmyU1cAD^4xx%fCC@Vr86=j>{Az5FXIB3-E+m%Yz_ zK-SoXx??H&olzOCUUi$EOinS;d8pBIlmd(XQt(QW&*vy5Qw|`S2>^m1kXi_W&_sCq zcks&2s=98#02O+QoK=i3UUMH>W|ksKvRp{TS>^w5?C)Tdr+v zjMoXBZ2%QK1tRa)YuSrmtEH>`{-@>4TPvN!OaA@#frsXH{eHvsfM+E>mqv4?spiA9?qATlt9`l0)aWpu#UFw_OXRv)eRpJsgV6vgJpDmr)O(5&}%-uqy@{ z(Fy=i8J)nubpVV5Juj`IIOeq7_dFTw`*oZ}>PCG)6|NiJIwr@nG)5mKi~&TL)?*$5 z-|o3o|Ig3uQYXCWNQmFxe~Cz`+5M5@l|*fd`PG5W-C1?28b&Xs@bP_9;DT%s0{{X9 z0CEMe2j~I>#t*;X&@P{I;LmymPy7A*{F@HU%+39LhZ7MF%-BIlpFe<0@DY4aeje9$ zgJy-#=p_mGx3qU3vHRqL0zDdbU?mWZL3hdZJmUpUjp%K6dGcF9h2VH*wGJb_Yeqzb zFE$WnbZ;l>_`iOMvoF~r{l#?!v!jFUUn_JXK65*NA_!Q*D|7oWArqjZ#J{7^Fdg`O zkG$XBE6<+g4&Weg5Pb1)i=H0m5dw{c)Yujo_^hg#c*L7CoQpk9snQwQ@a#uu)&swu z9{bw&C!9zF`s`4?;JtEL!*2y);rwxo)LX&#{YwR7?s2YSuMl#&HMmmN8Fg7YCelLA zeP4mk&w-PvUxyGzE4d~}O#=}S(+Gpy%?Po8d?tcX3lLih zh!nu!_l5X$0ni)D5SN+C^15eCGyoe0b*9fTiX_qUJ~5S_s9WlkzwaF$A|@tg z;VPq$$%H0R<1QgMvI@q~XJNHZ)}GyPp3<(o&;anj2j~I>K(=7d{JLR{b{GBp`-q7B z#6(1Yf3*>lGcz#}cS5qOLaQO~TW_-R{p&-|Uf?~B8J~AxPv{ruSiWIQGg-S*6DIax zzmhk3OZhqkx)R~Pb=MZwKi8cI1HSdng3H6}Qf0|s&&CIb_$J@->k-jXO}e7#x9o=wRg{j_VAA>2qZwm&cz5BB2;w!N z_Rlx4y<|Wf&caU6k^u**u_PdH)7*to4WUWnDxz-XqMH~+#Z(}H#gL(@sU#_s#SR>n zG8B;3Lb##T!Ymt!bxMZj5jM#sP}nh0#Q-oA&A{%ET6GTT zQAiluX`!c9<{1?Vk#ZnGGE4yoYT}}b6$H&9l`=~vL7~Yc5(AitcM&3J6*Qp^YN{-; zN<)h(LWMP6-tNimZ1yqX4mV?Z`vtuwH#y<#a}N95?#Fi7x7EBmI6EH3cH_Xl^!2+u z8x8AkcE`QU%(5DZ|lK>`LQA&J&Xy#1EMWB0qc&DUMltxLH%E?08pcU;FATyE>4 z=H}$NbCkI5ax^89)4AEJmUKDSW!mM*w=TH3bgntYInM6aB|Ec|obH59x_4dI7^IqA z+xqK&4R7q*-_`rMzt892`wwsaT*LlEL|!|)s_VcN5r7DQ0GRZlq}Q;NCYwAjr}A>& zRPH8wiu)oA4>&)twkm;HIkOgj0iCyf&z^G`=%a}m>NRK?HOMhj0C?YJ8Vc`;HGPpx z?it1k04ILjM!f93p}O^G_q}j%H&_L|8d8$g`l@xDBbS4~4;#^U&tXE0m=Z#qFKIPx zk&6ymxv2MDOb1*#@_NSD;nKzr02VE~c&jI2wHFP# z#y51l>NV%RM!^zG;L@t1_SR98t7>_4%;q?6YU0B+tnlHxq+h+h_n7d(;3Ae2<<8^Q z-?rGb+V{YzkG)p5l&9gzJM11En5#3pn_HTY6c=!I4$RrQ@x1lt#l3WP8jVIZRx4Fn z4|ji`%fI6!Klq2YrtxpB%%^cTiQVgwQ_Y&EJGWllcKUfw6uVJ|m0@bBau}r0#E|EX zbJsb|y!P$RcIvs?wS<9uG+|}XZlnMPOn!u+N{^dW4HqgP>N8LmJeZ+XO_*7uBBK;8 z6%A04gj@=sZYN16N~p$N2%KUe8YYaWqAA5vQerO@AatLJZi1evNGf$l$ zyQ6CW9`@f4?_EW_KfAx@*TR&zL;J6$bp0$wD{L~F_top~dRJwOn8uah?@Mvw?|aC_ zG?k5=WL@4ztD-HD%GDs&Z1USJqFJApJm@fi0RkEVK+z2*Bro0oU%)CpDjPq^{fu9y zd_MkF{QUjzpTG0DnYo|#zb@|Xs;eke%*15KnaIh=hlbe<(gf0J3-BcG>;EoL z(ArmBs?)Xep>(5W+tD~xyDLu{$%^Mxt9xhe@FN|9>{`lghTeNf$#-yI5F4H9^@8>g zV>jHmjhpNc>=43B{4V?y_!7n4>)*FR&%RiCRAdXNT!+p_Ep=_ck~!J_72W{APlNaF z`WeK0m@&pnme!632&VAx^D8q9v&=7#f=gVeDcb>sp~*=E|#tDJK{7LBci7k5p?KgE-iJO z+VJQOgFSi8X;hd(6>d+A2S)^gB6?L9w{^b+PXr|A8)$@PL=ZC(l1U*Cf{dZBqEP7eY7`aKt3uTJt$Xg2|Xl?fJ~2 z#Bu@>QH!q)i)$zkJmyM4<1mm1L+=|K$+UsY?>5kTJ@waF;GXgbK7O?i01Tnsx} zG3t6Vwd(i675tSdXLzp3+IyZldm`F@cNueN0SqV-BOT}Y^> z>UW0Qn4+4rt57HkKnLi30kC060p9_<3qL&#{(p?kF7E&D`tMB1Rs45zivNB91D=8C z2q9ilBq^@glcjWD;4ejyA2a>_X3%kk+n|)Ggb;{Lj_9omO8~Cd>GqH^x1tu>GzeVb z9Ub@K9DPTR%<}Vy?z3(u6rJYfA-Z8;%aPv1LNNqh8NziG2S8dH0YWWn{W<6e^w1&8 z68nfjlXn!TM@!khyY?%wcD88r*K?DYWpfs&d-VVHk6stZ;2`hS`b{&{s4jaHoRs#e<7&1PxL4%T(rm4qvy*ML?);;-}^3uSN zqab2<61FdgN31URz0f=d3HJ8R<)kNK&q5G5!8&n?inz9LvJimIcf%eZEx$m}d*Slq z-6*xbb!Fdis##WiBS=nPEvn{!b|RF%zIu}S)0zY6S`>h{flp^V{1oDD(xCm`W;MAV)iCDIXe^E z%t=#y<|Os-?r@QoF6Io_MFIpggQAH(0{Si(rrHnR^{f4Fy#BZQ{r{i7y8gR6?^823 zR4VLU-R0fTs;ZfpoT=)kh<8}Fc6l?8+{s;Z=a6Tr!F@}> z^`40?Cc43cgaC)=e#6qYkAnyq$jE#TeeVU~WOMA-LD9OPgCXrwbvA z-6DWuc!Wb}WXvf;3aF^LNLJYC-H;Te$#kX6jue9{x=%aJcvmGaOR9WrnzyemG(#^F z6+tOt>DdgmU^c`JIGU=KpxE|@Yh!$E@13`|2i^;;9f#B4no5#va#NB<3`nRdLJ&+% zlPZ8QPuH$4J$SLUU$MH}dUm%L-nyFxrr?zB+o>o_lHn2!0zf>BgzxERl(zHpuU*}ArPH*H%c4t@CEZT$kvpby zT|18D*LH|HF6)uQc4^G%*LFFprd@G4#sL7YKv2I#><1y70HUfR#xip{cR81I+}S#A z<;HhW3!UB0&h6SY*KoMI`?vPWDivrJh#vQ#d|3T_{ZRY=KQ;OM&1$A$nVD5?2YdSF zfwT>wv<-v%nMzs)Oe}r4)t&hEn)?-ZS3>YwKuXPZmGA9dUvE02dwW&qo5Oe>JSyty zKEc_SqI130bh@cv~pkFCN%XGwjC|kn;o9NW-JR`Oj`Q98wWR?rUqj(RL-V-Yl=5Ct$DlJ9q33| zmWrY#!h)Kgs@PXu#GduF+6>#Q!F{>eypimJ`K#v%zFc9hLc~+mch?o7&7r2RvSH%9 z1`m7B7GS(kV{!uS0=Koa?Cd8p_XTLoV|&zUiPkrqCsKuk zkij%0#F&u4U?zkPagW7h)E7`k>N$%l?r3o>!5C$`dGp@zj|pJOg_5QG(Fr8d5(F*- zTGh*L1XSwo<%Gq_5d(Dyl}I{(5Y&|jj8!s2r2%4cQ%#JC$8eUT--Vv9@Be?lH|$eFRwW` z?Gbh2rF?~sPJ3m3vBcOTQLcbs5AX~KMcqH*^}8we_x=3;j{m5Nnf}#O$j5hl#k*xy zQFnJO**(J+*d7)CHKQ9JXY=U!9yCqs{2#NXHa_|1H_euk1d>?Ms4kKOl2K{`3a-1| z`|{^%3a(B+k6wLxx}uTmMI)}9ijmj7a#W7{v)=Ze%oo-J#ocoXUv~S!itzKUw00s< zcnWzpxrms*;^OWkkjHgz9bfYjK=MZFRYSa9GJ3uq0!!zjO8uXHR+P~_nE8Vce6J=f z8JtB?&>aRf@68!C4BHXSJYdAuFjRMhN6cBKQ<&Ln*bl%^6czedy4N+r;mQDlFPLJO zcbQa#UJ8U5p9puHW>mySCY}onYb6b_Mqn*!Uy{gL7)m2qR$+u=7M)%-+ zE{|{n^cts4YG5blt7QRrkDfX8;IPXSvNsUX@~RPZ1hTG?*mhkth=d({%F@LwUw!2o z!Kec2YdVzkGd3;(z?;T()o3}xzH|)ub6D@nVh`B|?LUBS(=-tA_oiM?(mNh%yy!LZ zZ+jkL&UdT5?<9#;FHIlw`S#ffd5Wn~_WAR~+rN3hpTR4}-N%cyEWPVH(XCcu`qsFL z@vKn*YxFhy8T5WFgRh@g|35y}e^dTDyZy$8ABc)+Jau5x+Aj1!kNTJrF(p&cVVZ<)>D zIsCwm1b6!Q{@3HRD&vK%VB@Ceft8~bWa3JUS9ONXlCBiku@NfwOs)cm{XnN5XNRn38dVJcHTHVywd= zo@+A_Ldl6|RnfYyMY{vA)V%t&&qJ4(2=oS<*D_YQdq-DTv?)LJKRQ%#dD^Dbux ztNi}wKJs^u@BHdxx()dn0{?1mBNbO;vvKtvowBWY4;s7H?qp4sdENaHlp~!WNL%U5 z_h7v@>^^!)eV2#FXl?l6`NoRL29~g?9LtG!0RYwkV_N-dUSja@*S00Q(O-k_^Y8QS zqBJ5db^DPcLS`;zA~JHSvZ|{ts;V`TIy&FUF(84_dVB{x-qN5SYCWlgO`p3L@E^h7 zHv@bzs=cV0tX$k&;|mwbU(j$41_U8`d7SF`*%<4BXQxUd^}Q~+?kxSaTeH%}lK!bO z?al73>16G(gC_-G;Z#B!Z$6!fJ3*}GAFrN=z`nezw6TWYdC|k-pS7)cT0n$h<=f{s zY#~-uH?_o+Jq`eTW_1aM%rIEh>O%>~P$X3AAO;W$`D60z@>=(K@wSd{TUVV@&uxD{ zUD#d?*$LL2$KNmB*!cI4ZN9H5dv3F{*v#u}eeuJt!R=ie?|a9ysqe1Hr+f8zy;>Kx zy3(5~dDmubsGBFgyFFg+-cngRtG0JgO1Ew#AaQjnl4V%o5`r6r05f*S20Zzkd&yrvGj4}Gzn3Rhc(`u86Bz8|r($Gi_%0bD>d$3zH)RIcLEw8*s;P=+y_4ijW? z#k@M~8ws|1iPkNE9IAyNF(Rts%ZFgl!b^loY#lbH?&j1Y9Mn+NU6hJLZ99uDSByBy8N%fZ4ijUZ&NIo4lPiHTCmA_Ifd#<3Ie7sx zn;QwTioEBJOq^#q-HUM>x^>q}qDzwP*MB$lXxIWEGzf-=H%hMJxu>%mED#*b=W851)NLClzO}A2X`AYx@OPEt$(rHdhTjEl^mrW$|}P zm|2iKpoLSwLz=dsDZ|B4dDk>Qjv$cc)<5qp+%P>Qp^4BW_ z@aeSrvdGFOfs2NMGlLzvuq}XyY>eBI{acPC75fuWUFGVu;Js1PS6q6Gp-wvRt`ZHd zz!H~)uJtRgJ{>%GOuCD;R)(uZX^`|STJ}+zxIqRR>d?<(?#dI18I~If)~p#ukF9kr z+u>8MJm~G_)2iwToXGm~XtM9v>g2G7*CCbVyS9W=yr8Ii0>ZoxQY`Gc8XbE z*c%nV^tB~YiW;oAv`U`$gz%LTQ(j!T6?)F zgeVX+gv1RAGynh`A}DfCCkHZoMfY_c1oB@jgMCYQbG0uc!5 z!BtYBLW*(&JxNHt6Jmj<=4rQ8R8xvZYthqG3wia`SgJCjpzFp7bxe6jRPw(K{AnmSbJ6Bu~BGYz&e5p(+w?PukC;!j=Q@O}M9Ls_gx#rMipk3o9oF201t zZJE7oc&*lC9g{>tyro;XoX=2&cz*hu#go^LSmT~wZZUlumJvpQ1*XK}`FMML0~<8V zgaK%PkYH$jv;-h8*x2b8K6YST>-_uwL%yBeMRhLvKW!=?Qs;aX6 zO?v#X_pgI~q7Z?M`!)N*tQQv!FtVo=U#`Da6n_Vu9X8gxGPBEFkoh)h>#pvxjKuE6 z*e=DLcJ&j1OtFrF&|-d1N~8%87)p{E(|DpkYRsy{pvP`>kx*xfb8EVA-fzb+g`U}; z&riYc&o8-lp2!q>?_POBtSnQP(X01yKQ1=e06^n{Xy zp&nhtbL{=OQ|1k<{bNlkeRZU{j{&A`@1Q#7RNtM8wcm(%c6h1C+on=rRT)Tll9L=ncbBbCj}BjW*0|`966Acv+ ziLSwRDaMDa)Gim*wprhe&PdYdIc4&!1?M@D|I_U!JSA8YtyZ#3q-jQc~ zPMNLuiTwY6p22?nJp5+y6tYvv6J2)Z2@dZ4H2@9h#=m;!?_+%*Js&T%_xCC1_viD_ zkcf@>`9t}yeMX#pk&b{mdXqZ$M*J{-fEXIq_Zt^7W-mI%VRQBSvT>ZrOMq}MtFu3> ziz^vAe0_SWtCiaKyyJ1RQ;XIq=QtkHP-!CERxRI)usaU8*5j-W7PwGg@4VpXGn|?p zAdu(|gL%&3U{jI8WO79(P@`f?X)F_$ZoUA)Cjk}1++SOBE^6|}2V z+EW#hfaEFL+`4tAAL8r|!UB6(%}nQZTD=B{&bq;!knA2MDI#EzXcmQCJI-9}$g;PL zMtU{W?lVbexvrsaSc<&WMVojionrS>oyHEsut#D!DQ`W=)SGgz-mkv!20IbjG3Gj1 z;9SZ)dMwq_Cb}{qrBc@Aj%c2>Xm@nU5}e4~;v89aNS%e}Y#Q7{3L+K(V#* zCzW%Evb(c1>aAk&w)rq{qqjV(%Jdc*q9?&?z8Gf`SSk2`}_M}U zccD@KNRc|3y7SKu-@gv|lR3;|_8+zS`_8{sTr{Rp_}B0+($1bOEc0K*A>;VhSi&l< zsIG)`j<{Oxd0lnaybc{}xYIY$T~OuTDtS{E*0f^^6pdzoEOl>qD;Dn6>CDMc=Y(#7^WQ@r`h6V5qVSKAo+1EB7(YdA69lNfZ<8yip0 z2&YXpsWlw8DN9UjyLCi5V``#VBBu>gS56hoTU6nqTr`V>Lu_dfI2c^2vX!;l==l+3!-2L^RbGubYNEIZ_)RHC&$3;O%RZT)uG~kg`HV~Z*fKz0W7VL0LHm2s? z3a+lzt06$xFi~+0vS5`|QZAv%3B!$Tk8i&7?#OoEA8)=`yJck*>DEkPU;mU z1UCt^3>sACuFz1NNbXfAf)ltHK?50ZK*Z4Q+}%Jh5G)ep$Ls9Tcs-w!d&Hy(0VhHd z{r|@Qy!rai&p*liPgC#ki{B%%b(8EJ2WZ~t?<;(albl+PWhglFzn>07*TE!@Y#U!& zZU}+H2yp^%;w-xDT~0~IIL_{KrQ5j|88~(vD7+|+Gs*+A*$05#b8@NL>xq(sFrtF2b z3=o=BhUZd*ZVs#AL&Gw~gI6yY#V}?{T~BV#q1={V9<8ckp82AUyfVR)30QXeiR#zy zHkIP3q(JO=5zg~=r ztI-?LqXNcg`UMXiHgF}^H*or?-b#I9oimecPaE;9a_4T}Pg}oDbE&UJZI^XAq_esxnwe2~M&!~Bq>;9k%u!_pZU#B5 zrz;O^!y)WxQ#AJw+Az$qw$N#+WHnlZDr;;|&9GL)X{EMeAT5Z7uU9q?69~>GO$}+o zKt00oBi=-CFlJn#k#d0YtX>n z7;F2P{(rlDapxSz`8m{U?}t8%_V>tJT*vO@~eVIx}Vl$ma`1*2Yj&w(c zH_G^gI)0>1GiOkEfsqjxz)U_yC#>2}){kpD1VwzC1c&1GY^L5)N#&MJ@xA1rPF?tn zL{i0^^!)PSra!{p$;#m#d`0OHE{N`2@@dC^W{m5~uYT#xM(mI>G=SL9JXNYPWLa9K za^&MxX{#+-T(nyG@6FD6yVr4R9a>Vu44%l?9t^>gJR39g!k4=WE}T^mOTfu*XHE@2 zW7+l`eVZQp-*z$f_~i@luY1|g90A`t4?g?t2i`6yuL=-212U^6K6PvP%GP^+pOTCp||P9>y=K#`AqEZ5)-RM(Dr})F*>z>>{!;6Yq_*3(cuI{VZPQE%?ca7gBUv2Mf zoR+k&jlD;=o7f7>yzh6`-VA$%w{5dz@5bI$yUsZs(3(?OWaPLsP^!KJq4%{;tJA-f zxNx-f$vj8Fkaiq9_lH=l`*cV77|f4V?m_lDRbM^br+rEALc@5zCKMNF>9TT;myej_ z)?2R=6uG8kGPN=&^1*r*-f`5SYDyuTb2*N?hg9RFc1%kIVQG*{mn(Z^?t5mN^Ld+z zp0$!U>Ep3B``wt!XWZQfxqeq^b2%HoQG0Ei$qdJgaEUd)1&>EV%};u=M*YbiuP%1G zkgaN?-8Nj`#`2%9YrXC-oEvKvW2`#4K(+{ZMpL`jf+J7IB;vPtv3xGX$mh4^>7o4Z zkQ3peo!$~tXLE7XEsmX--us)GZZ|FIJI)@s-J9pV&tF%3INo(QS?tvJkG`p=sX4|A z+v8X|uV-m0t&iD0fx>A%>`@lU_bO-9qw(*ZZr1(e;`@hp1f4<#++ozk6&wka+i+oD6?>e@~62@$b8#I{oix5R^*qt zJ;Fgo*d{--DV|(d@3SpAZhW4kQuT)Bi?;W0SH63-l6Ygj@gq}br!UA?bME&iXEAb+ zeB;h@iQu>EtC&rTcA96LH{(Jq9F`!pm+2()jfq~O;`uF6UtzYk&0Fry)#|y{-3eqg ztV4ucD7)IcDxV9L-b)d}Wbiz8Z#I?g4^N}B#bZ7?ye~J-WI~<0a#g(Mkfm~`N>%Ss zo^Os{Efbj5IldnX2&S9XPv3*&{Pa`e&60TcvoX$Z##L#{soRR*Mc0QW*r7M@{p=hg zbd9ECbGG}wgxYe)m3_(dUHbU<&LhJwM)uRb(RIiIe%$Q#$JLDP`)fYFio;^2>mGNk z>$ep(d&_m!?6flTxnDLT~xQ7!2gp$YEB$ZPmnIwLii6SH{;ptBU zh3L!!4i68d{BO|r)m!U#i&)nGPK@?%=K1Fj`o~1Rc%-RYzKy-2%jCju3GprHUdgLt zEGv%eikLeC?8|Catu67@l6Kf;_1rEd_c^~eb2@w2x+~`|ILH`qAkfhL=x7il=kTT% z>96B|zn^37Vj?agBH}MoGdERLUzeGgRaG-GAqS&ma7JeQZ@Kqf`5zDLIf0J>B8C2P zs0lAs`Z*uIwK~&3@3%nbbiC3E8Wo`%Q6=H7BJ1@P`~BEb0m*+JKxn_$@!xolo%8kT zyu3dkQg@4lk;;kwIm@S@WDL*4#GM`YM(3NJKRxbQOqsVDp|RqkA|iy&Q;UWQp;I$5 z1VG8Us=K?psmYjkcE`xnWXQ_PyBBv;Gcz+Yl~ZDcOw4K`A|fHB-QDgT>{u67LaM5& zrXnI8++fU%nVFoKoT{padv|}JxNywPRS~G7n7NTNGcy{IH8)v*sE2UlS0x}a9 z31YTRNXfN`)-!@58{VJ%9Zi2B{GNjJUEPbkEVFLfu-w93vnAJ?u)5qzCpRb~NCE4uw96hZo$r15-7d`^Th%v!^gac$k>y~MhDs{HIl>bwT^Y`Pu$U4raPY;0_M z-!+p4GXycj5XY@|)=`5De(dtpSgmz6)+$Nsg_mN!1m^lmmJSPwOq6QHYdXfa-T5a~ z%|v%|yuphsCbth4Th<<{cP`$c?+!PB#=BjKc9)fVeq{2ix=S3xnVFsk3-eJIhWeQ4 z(PSHxYz>8%AoTS5H1E^)mwZ^T3%sX4a9`@xCR@E|g3<42zEds`JO^6*=GXoEPmn6- z^WEz)CP&AV{E&>bT#}et4NF*vi(AB;lENSc0k6=}>-e*}U#m~|{aR*d{6tUl(=+!@ zKQAzfzk@-@g%>{e&1=P;VEqg9s4rKMO6JeZ*(|wEjH*V&Z5Ovk>dV&OJL`Nq#xQ=Q zuNIk5%ek%Q&DJM4tT((Ci^d#FjO#uD*t=6$v0(kXf^>HU_lYNh;;=^x8x7%3UY#O?F_SvY>MIkD*I>IAP2$3K;XQ6-j^s9PCOfq`4DNdG0@Y3;lctO?CGZXe zfj2^>K0H4dEoZMDCM&!~dtaneoN{Azqi=Q#-G|0tzICTrQ`-PRnSJCw_nhv>mWIFM z-+TV;-M;&Ly*u#Nyngj-@>#j|Jy)||%jy+)x*WPxx9%gKRQ8XR=ZNyI+^_EJjNYsm9@V6u!T3BsJU=@=Zc4AWN0T|lnT*M^ zYf8( zy8_y)a+0GZ2te_YKq2v@oDz6@kA;XpRv43FCLy#Y(57HO=NNNkU9k!r5$l|683=b| zCw7H*cl*7af3e>khGrou%tWFRh6G6Ixd<3m903<3o#|h#V~yj!O2?lcdzv$N?svef zO^vvcil$iHLIJCok|L}{1hqyxs*{6*2iw)yJ6quSqr7(SvY73C?f2dG!H*2P?OHw@ z02`S0`|rE6Xu0fl>%)&;t=jjQ#J$?oploiK5X-XSsRb*a%eiP{Ez2dQ)sYyuM6z5r zS7lJZw*vxVozV>|B$S-PZUmHCcMgKfn=a8O>FD-NnrQTmyRn23jFtcbXa zcXt@>?^O8_5fPf3nTULccNY-vPW2G)@W>I6`8(Mc1{fH0+~e<-cQ}{4(a*O>-~diH zaaYfu%*=mZukZZmy+mP9OPpzoGB^I+~hmEA(hDObs zJEV%ct|xTrP0V%?*#|BRWn7qc##CJ6VO*Svo>#U}3Siq?Qq*0cc@iCml9jm{*vd2uTV27xglp)>$Tf$$zfce1Y-z8sZP z7Ud4SjFC#Ii&Q3tGM03EQnl|&G3L2w$GtO?>Q~hlXy|7?$}YAC)msS%uA@Xz?&;nw zQV*<~Lu9TMh&1l)db}&572Ka`D<)4tXH()da>%`dzz8RSZZPK7=8PfaqGOlS=6*pGg(|{@@IE@Gk z^c2XRg-8`d6bOo;MI1A)KYM%{sYJdX3T_ARA9gUGhtZ^94Q{Q8XDvdzL`M_*??^{L0EyGztL zvBKs>ZmbDV8(3VgntM}&-MR-fruL$ zes>?6`;Ya1f4}vAz4!k-{_EvcRaDH*PE}P^R$blQ*t)5h?3*n8jPGpdcT$NeWAqy` zPH*xwsY3hqf@->+lC`kjcSl0$V)qI^Z=CCgTmymLuMaYBmqzJjokUhmw-x=;c<)*j zuphgn=P^2@ME)L=b?11g%Py)pa$&aZczs zS$*;5HxEef@Xy;SHX(Uoa1kC=1<7vvn(

    `2mIEQ0pboox2qf0iDYztlidBtQbvWT9DarBuqu#2_x0EAwlYW4kZ91t zSq&k+uKE(Ll43WE;ZSta$g;1zsC>xI=Z|-Isw2X5v`E}ybVS82;nK_2qFi2Uunz=QydaRw>?y&d|h3v@H4_-#{4_z+8hOsGsCOrUi|y@q`qSkuP&K`@pg1R zp*U^kY@91srtQVGmy)U(RZt+P*Wmv%?0?AqcuVu2pFA1QS)Xz9^4{&T-1kB5lzFh4 ze1}&{)g4FRd1}Zd*@%x%Nl=?{lKFk2!e-=q?z7v+Zc8vhLNWS8hsPm^G4q}0`~JUw z+UGg@4&tIC@&Jf|6*ATM?)ecBnUz@im4D3+fN$qs#f1U#3`jPI`;+t^O0$GOLuRx( z$W?+H|U5mA#C7QJe!#gA)1+tmNh$hFO8bxIc6*!0l#+z&z-V}#%rqRFdc z&gvY7Gw(Ro_7AUP+@uHuGM92Eq%K{lP=+pXF4oNt5bI(&FvK|Z;( z4b|MuvfbPkl7YyWB!ZcA?nO<_QAYTFP=s z93pYf?~=ZK^Y53AHH`LOjikf7_wUb(#6G?^M+dgZ&F26BJ-Yu{uk-o8uJPw_`G1lk zd46&pH5cXMtot6*=B7OF8jow(67XPgqQ; zq>3^{8@F_vlI70L&C2eVUESJI)4Epj8l!!jZx zBLrl6Ab$pc9^6X*KV$djMEd=GOMe~R>YLB+`c>aT@4uZ=NU!sVLy-$@>wd75*ue=* zlt{>01SXhZ(XeR7NwG1BNg~4wNdYF3iG~bFX$ht^8VwneKtL?Y2qlsxKuZYBf+H~q z$k8G!Aq52{00cnUB4{X0i%CTmlNqHNQVbZ=F-SoHqd<_wNl?I&Xk-FRX);DBEftKB ztcFZz$rPB>Q4=x+V=*zKXp+=p1V)QvRDhV&C{$8NU~L(uNDPo-3X>F2OtT0hD2*i~ zVMA*GngrO)P#DD(D-eq?P?jJ}vW&|R8Z20fD6~-;F=!|>krj(9+Gx=k2qs0b5&*GE zA%PncK$H|PW>_IJG*%6aOk#?LlNlI_mQ5_OicLisF_A2#Cd^=jwFVd^B^d}9(pV5g zK@_$uFoOs*pr+de3Q!Rgu_PKOX=Vu$#A-}MB-%`yQe=#z8UPT)8%)^3M1X2aH3b?h z%96=Rqb4@Sf{PJ~G;ByEDP~2nY(z$&q`+w;sFf`mF=8~U<9cEm1rdPMQzS4A5(5Ypgn$DXK}8vjAqX-gv0{;w zmIA?4Q3VE#rUt@FCdSy>BL<5kgj$NmqiYGUlv$KXjGDxSHfoB9*o~t`))OQcHb|2N z2xcr4QDu}tqY@|*QjCgk@RjEKn-8IUH0HqA&7hK!R&D9I_XWU>h@rnZKPhBXyw z2_!%^(@nP12Gd*X^RwqXKDxV|P7TgYOSm1qV=scwO};2sJiETCtR#!Im$nOov?02l zVSchX0v!Wr&Ai#%U50~Jl?_1&wg};VrM}Ti*b^KA$?TJ_?h+_RX@iO#U*!E3lo z9l4&nnWn13K*=|>rt;=PUTdz_;EmX!SdnQ=^^Rs+H(i&ruhcGjuQaTJ!xLw(xdqE0 zHsn59qTPT2P`X`lCKlE0dXYzvBEWr>I#|Fi_p4=*YlUiidlZ#*gM*wghNXD}Trq6p z+g5N74*)1YHxud+B!NTsjDXiV~2evY4uXVlSD{VTh-p#r@ zb}(fw8Zm7tmBa-)=$&A8Eoeh@SUt}1c4t*%l}^f6yM5QTYrDId-*zFQxfMrsL6v&K zot0fXkgK^;#O~XHj5m8S>3WkZi&`_Uw^usq8qF&5()a^L$TXUkaNQ&}cJa-3oGZI} zi}EzJa+!*g$=fS|9lW}4Pd1pXoX!@yosQQ=5iF;`UH7SWjAJafDbl_zx9n6^c9mCD z;1CBuLA{Lf5>T6qyB;un3hC_SMfQrpNQ@&mTzcN+*kdNs8J(o0w&kEJoxtjHnz1>|| zRZ8AkxzHT4oO>K~-tIR@;p4l~bfs@eML$3<+^yP2cDO_|WkIio0A+*^hF0pUs&=Vc z)7FL3QR7pSR$^xuL2L%Z*acNeDWNRXDQuAHNJ|d8aA?h~dF@Mhb2FV_$F0;-RUkK< z?_>jsCFh~^gpRSt}^;-H;}7LQRr;*Yh}K@A?P%HGV)YX~TF z3Ju!cnUriny|+DMuUHe-Ut@IKgD5S2va?KH)VlLMLh$)|g`Ff$&a9zeNO^$YgJNp8 z6V+qewCgM^wyuo}(YiNpNxl>>i42!{Z#`o=*c}GVrt3xMIODkZPPX+{?&c+?YwpJ{ zZ^YNCpPLS#so5RZX}b@B!0Tz|TS_V_g=OpV1}sLMY6V@H)a7w`$X3^FRN0{faEi*h>e1PEJ0ZlnUtM6)vEK5!s`nyn=52%y@v?A^oR@3(N#fjHBS+lTdd(_OFFJ;ans^w@63f|1|rGRpU z_TVnqxcd|rvQZV{axyGS2KOJW()k@C7?>3fVD|9}+O5TZGGsD0D5%;}dRo53u zUXI|^ok(2MlI%p(d!|W2wqmh%oqE;S4Bjj8SJb#*5SHwn-42FeyYL$qmge7V)!nnM zJZT)pk2M``FJEoEn1xjmL&syB2370IyxA;Qh6;J%1=q8$oHAFfM^(L6FTmx+RquFF zeh_%hlh4Dz$dgGqBr&Gyf}uj3f=I(@kl1W6i)j>4ZMv-#vpCtoz1TrYg6CO$;@hn` z-m$qD_lmXyJ_9KTL$(1qXEWTc>>57MHD_$_S&0f==@uLmRJWV&9cq^g9lhwZ_>SRm zgnI;oIAX(W5Gy3Tz{3`r*VRte*9HnKTmZEOx2P$jJ+&$N*y`k9gaBa@Mox7I?3>E~IDcL-CrauEo z3+;n>D42`7k(sdQS-?!{e?t8o9@wTTes%l)*9c-;2 zCsK7#N@1;Dy?yxn>py-z;|`%#bmN`1);lE|t;-LCxgMr0A1mtuVD;7bd3qt}OLds% zTTgD7&_upAt5+MI3mY}S-E-nM7W%9N(YmUGq}6s^b%}Qhxll3V$|tP~)xswBtFtuM5jQX`PbC4|GnB0s{i^Rs-2+L%4lBV| z$DK&8du(qo-kG$87Rr<;T`0lo^J@2S;F9pjYVKs7w|%>dgT1Td`ms@@OebuSIP@w_ zd=GhR9b-Yfa#q??!~x`61m7yLig3%@S{{0y3*nR!jZk=-B{SDd0Y(u8TN+$`@s@-k zv0;$b6F?hc%GJo{SjOH8o8N}(0B@OE@n#yFFLi7@1=+R&P5N@jyt{_c)mwF`Ou0uc zl^tEMwZar`Wo1`;-c>V#9B>(Rn#D*8BNbk(m%Id3VSutJwYfp+W?c?rgx&DjA3>d% zDy3kmjLJAX9ao64+gSAl;n%dhI^!(Opieel!b$7X=4#=rWNsD5VZvXvLVEkC41FS3 zCt7sfQ7|i$W8`yjC#tl`Ko4JA1lx5TuXPJ~oXT$QIIlfWBqFjy+q)2(T3^jJOb zX>Q`_Hm@bjCpQtw(0$hTo}?zw*=r?j4DQI07rd`Dg)?N_%(1fEFsH#TejRWtUA_T( z-hLwzo(Q<%k+bHK2o=;@RD!6S-uJwo@z=dA5ZeL3uW;RpPVj5<0qL3h2ynp`w#wEbqyYGbyA zWXIyr!7E_}R)FOQ88@`0)EKii-7+0=xrk{aoi5B;DRQ?*ZT+g&13Vg6fVTPj3Uqxk+$FsiPd&IG(Bm14YxswYgX!8_Al7QKA*zGC`=lC*VD?bxHdn5oP5 zUQoIf#}_Yk+7+DcmWx~|*5CzskzqCBN4QSr>5afm(9*eRdFLVS8P{&`8|;UUDg#_s za5`6LOCY&>tN~pJ-OxC0KS3O!vujR9!(q_Omi!ck&^qpj9bo6Ldd5xboaj7I(-$yw zz@ESa@;MnHyOJdmXtuLC(&QWOcHZ-s(&kr5K0DDUnm3V>P0Ft><`y3BaI4BYk8hFF zeQ;IxL$!dCV;;g=+2KLNRP!bW4M645uU=usvo~Jxnkr>hEjhQVYtonl@bK}?Mz89dbLR;sM{&ak_&*4|6^xY759B$Gywt-hr}AZnVYYjdb- zI|q1Sbv5O#r^xM$KCJ4#E5OiaZnYtc+m44l zbcXm@-F)Dx4G#?nmN>$pE4a^it5!h_gqm*k?|7k`-sHd@GvSQ_WSZIvbM1<|cSGz(P0#PD-qx3NnJc3dQ2r(iG5;x`dvmQb9 zPU3l2+msJ`&qmwAKCT>9ev~Y2K zUdvVLmE}(CjX_i$RVLapZ$7fA?|t{X<@%~gs#bp8=63K4p-HaGEauB~YM`>R$_^$9 zps#JW#z_4QNkAqMDTx`01f&DfMG|NqYE4ZD*@??lRI8S)PeiTM6;h!|HOs5=JKlcn z=iaUN9`~afmgTGE_n4JI%~HfOdmS6u^zDgU&n<51uXR_iVOMhdOjfFbt#zESlVFyr z>X!BHJovH1-uJv7spYB%Es~>FNlk_?ZR+(~EZZ7uS1YD2S?txxpxDD&m3hu{oaN4Q zopsqO#g%LU=T#-+D5vA9NnSLGdUtS78*Qzv3?P6BKuDVr=W;^;h)9B90KtR?2+0B= zK@qmwZGey;9-X%vzt%qE7{+U>t$wx7RQkDJqgeWOf+K4>O#AuseEM7I6d<3fl~GtghWI|^LrcDyP0(e%@0ocX7{|>V$lHIPkK4M z?fOzZ8~LyLX#I{x(^#iY;bu9Z-bIyJ?=lPu5aYkW!>G~-QH$q zW@ct)W@ct)W!>G~Q*h!rj>%+I8zfrLEd$oI)Rzu73X`s7K51CY3K<^MUfonMqeGOjRpT zKG-_mJo=-%BRg)PY6_`Z)Z#Kh$zqjfGP35gB;^8WL4c`FDseThW%sH{Nu;@Qj@%+O z2C4;R*{b!QDdwoi-tcX|v;>r@2IP>57^tN;N-}~?wv}vClab22guR1yktrtAoTSZ* zJW~>rRlTb91xo6=ieTIos;b9IIyNfZQ;_yL^O_JsjQRb^5K0otgo)mpLISdP*Y)475BaG9$xLCR;kNYjEz>odv~ZeE!}I)v>vW? z=hZ&rR7aHaC`t+Dl~rFXwWVd2HX@x#hu6L09qV}G-nzTM=iW)GR*)ycPp7wVuoX}^ z4y)LG>DDI2d%Isxoww85F4x}R(YEvJ#_b*5W7Tg3Q~?o0(-8~;st`6Pl~Sf*B8Ds* zwY`@0<6E#tJ;$rFU3Y4)0t8i5p-jxA3R0K?CMaU5fGQwFZnJM%jE&WLf>k`HTPn>s zSfNn4rChzHC3zfjyu?I~WX)6(e_X7Mxjy&L@67q}kvNk`lQ-LUc3zb)%ZKNm&bK)gy^kpp%s+4~ zK6UR~;pHzCi?&KAyWHh(J^Rf0-^$;ZGtV1l&cwq-0RVaoVPen#N3Yvic=26~v4)hK z^F=H7eRHqhh>5gEb>}i~;v`Sc zeL~JUP^Pe^p0$-F8P3rY+ViuW$mLJA{O@nk$C9_=ocX!E+E*z3mffDNDRq5ugy|!p z2DCMx_r&wOy}teHLh+_;nyUO|4LjvI)yE}SI-aDou3h%d2oC@d#3SgyB7XWfl^WNb zUAou5Jk93;KotcQ?}_03UvJj*(A8@Xd>=X}{k-TtcWBCawc&X!_V+K)R-NC3_^%e@ zp1h7P+V9}2DfOYrU*@%=7EzilNi5!}bS<>$BL;lE{R_rB5H?3OlHy7=-8SGVhJOnqK&&Pf|{d{txeGPrDgw?TdO&cQ}z;NUoHryw_-+?iw6(U{#-c zg`n{jl~uTwrcZL?)lDl|S6yf-k)n(5v%BA4oUIyBZ)e0b_awKsoEt~nfGYa@?`89v zE<1Ce{kmkZiV%~&MvL?X?p7qXJx^!R7uO<_zZ_dg8#^j-vnrfUc=ygLEb*S^VxBw2 z?)h}R1ymeM&?vmPYk=VH1a}SY7GQA*?rsY#5Fog_dywD`K?4cS;ubu(?*<5LfaKnP zbM5=y`QNLvQ{7!%-CbQhb7oIZbromCZD{=EYn9A?89I-j@4Y9`z?+H3X3&MvgM^PS zT{E9W>9^--}h&9m3jmkT$u4?Au+ zW{}Xna?a_=wDs^L$Af6325vX;&*AuCMx2_gH!mwE2YBkIs<#EkHs9;PZ(d^+9&HPOv0)Z8cLeyxh29L59b*%T$Hktc&z0 zSvqKX5)WGowhV-Y{oFv z1NR!E`-ow^S-U;C31t%U7tMqFdZlng4$FR#LnWN&AF>jY7JojxFn)hxetg1v_$^%& zPv@pzTMr1A;9oR+FMmwed#1V47I4cj)ha}5hFG9hvz zBo`72kLf@k41u-0&gUX%Fx!1ryie5DM!PxSXK@=B7e6FJ{xVz1;x*Xo_7VawToU?@ z(aAl_t#H&TELoAQ)$-kqcBwEG;dxwNrpY9J3vywXun@vU*7s5x+_Yw~!Dp9q8A<8= z4jsV9j!d~40g#i$#dKAWD|ifTVjEM{Za?OcD8=Ldq0I7nP}yXUICx%u%X7tN6zqqI zM9v|=&G8J&He6$#SSAS-4u96@LCc>+-kQFC`^?Q~w%+jdgz30zb7pRS@O1r$iGdMC zak&cPy%$V(V3}LA!wv`dz~su2qvZ4;vxj%!Ld%d-2&#|}hJ{fn&DXXcIk;C3mA6M~ z(MOItjh)@EpGU2{ez*O--Qsd7tkwx1Q*0hZ1?Q$5d^;DzvQxnW)vpigKOow++R1?? z8483c$l=|lD6N^z<&$k=b!k3`t#1NuIZ8qnFGIud6%GU1u?SL@I!Xig)U-qgH7v<) z2Bee^KG_C69J;o%4;cw2T;V}K49P~NxRLcEq2j(E4CX@~!?Z}jJqUy!|D3tEJ+XWs z-oEyszQ8|6VinbGnoHIS@>!9BT$oinwddbLXuBqf`S>xVA3hFvE7TbI-p;v(ZZFFG z+C=`r_;h|kb#M>%qBvF8KJkrFvi z@{O$F><**kZ%oE>9!6?J5uwrvqF8@0Gq3F$B-LIqDy$^p7SZiAQ_X{cTnTJsQTEpo z7IPZ)k9&Lupyru>>|ti(+@5?2+U=V)U$HnLqDX00A!FZ7 z+k>;Ee$YSs?n?a1aq=PbOjG`bTWhadGpkXP^_P^LCp{kkSq^}N3;@WMYq_v?0`Gc! zxSc6iOzCCA=@oc0%G}^1)cY(-g{&xsW)~;Uw=6V`7Ud<+-tg84kBZg4KN#U*13w#g zmDf89hHE&@;r`IO z@#kwe0DwERBn$XI09lq90QiT9#r&cLfCXUAPy=MhBFh3Gzd5n6un;r^pz!_1X=w-~ z2>6Zv2aweO0A>!^zgZCce*w;mzcc?75wzbOrTsM^B7>|s^f%vcj4UhoZ{hErk!63E zk>#@x7$G2HTmV8QM2b7~Hv=Mz#f*%g{BDRKA%4I45G7<;`u|uE6vR-Fzb5iK4_I$u zPDAwZR~{EKgrfDk;a`x3kP}%JA^hL-{9VY9{~xh_^Q0jfB5JXaWfA@SCNSe6jywMa zf64ee$NW!+$g+UH^oO1OoBHn{f75upo0%6mc;Fu(O#n6!-uL_;--s zc>uEPZzTWwHuxzm0z@5&?+h_j)n|Ajq-+#19McKrv^? z0{(`-2LCIIEc;jTPj^^|AyD|3u{bm#L%(nHzv_OYzeYutMV9?{mHrU}Ama9)vi=kI z|7eM5{J(%1fGjJtq$M)b?zZ{2nvrD@)s|O{on1de{uG_tojZA)*SNl!dQo`okST1R z6cJayc206CQkioX2V$oG0j-)I-c!(R4)lPfpy6Z@GFv9*rrj>(9*KK7?;{Z=D7N?a z;*)v?VI_7=(9!}djdL)p*o}unlHCLYU?$ejHoL)=*!KxTxArh&FX(;Ccz|Xz{!Hh( z3T=+%w``Hz7j3+t%zp;`A!9C~>kmrSPGSy#RR zJbA(6k?pRfjl4uAYkM_ASzP(YN|a2Z{R<%?ljE9RJnB##o;gF5E%s*d^8uv9>oW1o z)5c304}UKyI~(Vk!C_5Hysh`|sp`bHi%J8Mi6gB&)B3lAQuAQAFm;eD)JS0^V#&aq z+}j1aKJxyGixt*qWUSCCNY-|XlAE6kl3uvR&yks&H$YD|7}ubn`tZUc$|=s1!(rE! zEV_}L&eHH+lv%KOC3F^tydm+5EI8?+xCx$yg)8iFOlf-IOAC#d_n5O-+U{|=bl=`H z^+;gCS<}Auow6n98y{VAmYHf5PU|@BO-PA4O~yL9dnokMPxP3r$$+nIq9+~HV0*cv zzUV|P-e?weiTOb)`$PR?(=UQ7PJxdng1>(11R%m0abx|gOZ?$6Zl=!3I1}fwM?~?FamkwdGceU>CRQIt+nvgu%#hgfFp?hDWB4{eH*`lqFT;(7%#ZX zBcrc%NHV&cEB(7DgzEWeyJh)#XD3xZ`RFl2CW=r^8`V$EuCcP=wD^n7$aNbg;$v*HzamX# z>o7RPMk)Lpz`C2H(47d}`YzQ74Ke{oHW(((U+_DLI8tk+%VC|U#Tvi&$7NozTz&Wy z?H@r#4qD7%?EoUvfI-qWIj`f3kuI*LQyVm?qdo2;pL@ntkfLg&8tTtN>!#DQ*r6vp z=q9K9OBARd9q7mIN>vsjgX>JYmaaC}g0t0zL9{1Ra;uvHQdYfp9>8HU;Aic zFmhK+bUz!5&bdivK=Cj%@2?M5PT8I!XT9s7v*@gN43a$rt=cuxaeNxZ-bqf z{4BITr-HSdN#`x}<|C!rKDfM}UD*Ryz*#JZ`+!D%PFMFJW+5Qk7>`9PCp?_^9@=U} zMW4e&+>y&rpWNjIuXb}Hv1!0{1`vPjtAQJm+ z6@fWf9azxCw|Pp6oo_&3NT-5$`#khmnsbT5I#F_!`P!}|v{-bV5owstHKggNm8_Rd*M&B@ruQvS_@zD;_? z+cqaWbb8^cJzNL7Al>HFJm@kk1$y_}u{zL1UocZbYs9Y%^4-=v=XK%E4+pzoYC-&W z5w3^3V@?mkK%o9hF1g)9MP&>SWU4kl(ZK=F0~SP)FJGt7*VoyXEIqnyH>+P44FQ3? zK?rsMRtE=P}yLGjOg$ILjiipr%hX#sbrod`-Q)dq|)+-iA zR1v+Vocz^|I*aY|y`21PhgF~raVwgYD+GnE6S|_wW;hsfsfYb0{B77*!+n1k|AAj{83UjX{7y8I{GN|X|N`w`s!E4tm_G=V2a57J#pkTIwUurD; za&)>sHsHtLKuAbP;MM)(&(PeiL4lgD3lT;5+qQKE`>|_RZz&4BgB2sIBbeK5tg{oYwBfimJ^}g=;{tkk zPI%uh0>BGlc(3QG5ipY2<@!KG$Anlh2PH+!xWq}sy2MGN|DeBd2!1PvsVhSYY7*}T z-FG&+dG(Aw1aynG#8;z zxb6|2^RLxgclZK_743Db8Ag|7YKA|H%gcmFyP=*5MXncdQmFHNQnn_v9|lns@yqptV5Q;2-dl&=A<~3HlrG zoYy%xa@N(wSnME9l;)P1J9~44-hGN!s;uAqbKWc?`MTl{yg} zxG;rnJ3vF-pV#N|RmTGg(=!Hw6(Q8L$EKiHdP(k=7dDKhxC`n9(2StXRIE6<=1nrj%;Wc4whdeENl(Ztl1_MDG1Hl<# zOx*7_3z)%i3M2A#4GaWOo5(iJ>h|00u731yDjxw8@5>1O{2GQ#j{0W2Cu_L%kC5id zRK%b0-|##j0DwY|<@MF??=n&~Y%mxu3&5Diz5#pm0;HX!`5p6H;SuBdTLV@Y0nAt; zL+Fsr4>X9~BW5SG&)t#rwSXV5d8Gkm%w<^ekMMzYk3^6;wLdU2{IneB6kR?-NiQnh zARGW#1(3g>bv|0(o>?(nu^c=efOEdfs)!i52p~}I?8g`y+;kR!b;+2*$vqv-R?p|} zi%$Y?9eWB!FKC|-UMs$F(SoeWV8s%5<-+&NlAx0F`ngaT@Tz@#({X$Vit_0W$D?uU zdQPe->3&MS(WTU~ZyX)zo20TEZ<@@B*E_>iXvt=&2gchCDy!%jo$6weTbd7)!!vqH zn_H)+0J32yXg361Y7xHWy~=e;S$S7{^ELD}%2(QNBMb&RPac4v*%Y*cA?Y*R2o2|2 z1-&1(8{Yxgmb8#(E{4_9>%%mEwi>U|bU{XMGlV9YpigzZS=T4hP&SKQni_}Arov(;+b?R&|b91RD zwRMRjic=zvGAK8UVmFLZSHg}*567l_{Rx?VB9}eU-9}im(E#YwS+Q)&-Ib`kvCvBD zR0kx>2uCXiRuWZ`up_5&0G!!@F43r%X$Bn508?jmG)hGdN)pteI9B>+03`VC_^-L6 zKhyZb+777imoB{Mt%*LN*`;-6O6R%;6E}HJ#U>V{yvX z7E=q5x(s!f+$WhW*B$V7-rv;Fm$>GP+k8Q3w1g()OffMDxZ?P4*Kzucz@$dPH>~a@ z`%x;!?R6N3s07!M8*S8BUVoC`XJ4iK^~8+VAZ5n07t+ z&stu0hq$sA4RUmO202{K!0>!~1v6!91+ZMKZYCQn7BBcSvN1x23(M|Y21e>mUNoK+ zPODLjfFh=z<&kdpl^nWCG&IzU+ES8Hr#;?!0!}dY0A~ z+w^zUq^7|sR3%MUW{Nypm%&HU#UdU76I%r$KJUGRqq;5f9;?5*fh>1y{28EU<0&`k z`7iEG>v9WIP9y_u+ws&Ss&gz(p07&CZ%~-n-MsaR40ypV27GTjj zFrT-nYRa!l)iJfGy}G}h@gD;hjosJiJF3>NPhJ6o5xM2f0bDp##ti}6=W>UA7>4Wz}FUNYVOJ;p8`W|Y~Lc+WGxbUyPe(9h3lJPz=D5jYCRSo@-OjvmuE1DOPM zDDJFDO^%BfT9^~bPH#K8Ew~qLm^YMEuI}g-&kwuYx#)4xiqM>BT;wL48xr{kdN=hA z8{B8i2!M_JnXygz-X*J#vFZ-Fl7XJDnRc!B=|eX9XE15An7iOn%R3(VgY}Xb?I^>E zH9c6A-%fb6U5T!y*h;f4gJho7_xm4CcbM5uJ|6*2#dpPea9bETi54b#SeMjgH2S}5 zykc2t@)_GJX2>4^2G6+K_=>5T=-rg+_jxomEidHy`K-B3O-*B`9V5I;2G1H7Z}c|~ zd{_-=W>thL#*_9jyjs3sHlzWW26}gUfYf@|bX=}X`Uf3c`-C>@sJI<1&)PG$dEney zGGI{?aT7=P3j(lcy6(qT0 z{$`ZguLTEuGX$<0W$h}Ri3#>&f(o9oGIh+2z-D=kU+tiT8AWd#4RbNo_w*QGG zRU5n#m`maSaya4g6y@`BXgE%;Fu~w+#6A7wp-^ujSu8YL@Z1_Grt)23~Mfq;!w7apOAsm;Gc?4Be8HvF<-&mefjX7r@ofKzgO>ElTuE&VG zXVxjwlf3i5zq`0w->t+VpyFsIAO$_^mSiC*nx~1vxH01#Tmv2oPu{ z`8~00eqkhrf!uQ$~06u+eBP!v$G zkVC+(O*x!;?aFtXJ|bh3il2o=l3CU5795*K{fQhv=J^6y<=cIX9>B>;T&GNtS6RW^ z_0^EY1nYjknv4q$dACm-OpMliNzSV3n#_|K(cv+SfURCVJqkv`D~&chR!i~l&ukz8 z!bEh|A$2R~7;81fX=Y89*}McB#{4QQ)hW54`jZtFi|Wl9xBB*^RaWx}d+#X7eV7B&++Q4}U^(YQSc6bGFm!k)FG#|MZ4?PioAX2&XVDzmbp`nTQ~N zEh9IXhUH8M=Z%~DWfM?|O3mSwd86OJ#xBmBYd2me6(zf{qRk7dt{>1&Gwl!_3B3KfB9OJSc@vQa^sQW~S`9ic9!Ejhx{Tg0`Gxc)%A z-+%qS4vDb(5#=e&s5Zn8@xDKeWO&&T$M|e2=vPVN`A>^`SFniY+*oU1^8h@`s(FQA zJw~Y+aN?@Uv??9#|EKeJ*Z69d2QwIba^ zF{Vrfk(5_c!isiHl1ym=o^145j%Yw10or-0^@U{>R%ScYCTq)YVlyj-PGySQnj0j_ z$Clgc;>8mYiUEqYMxC|(uOd_w!h-=b^;i9@Io8GKCvEjvv%6RWHb+QnEwaTXqJ_ou z!=g&0$k0!a%&D#*3GJJ=olY;9QJIn347~I57ST}eV+mQp-wL3RwqaqUwXp#RpOX{I z@maMxy_Tw5&2JzkQj^I`(_w))!~BrO3w`cl!djH zEgQXfWykd{dX}EYp>v_g3$>s|zPh!%Q^m!ZGH+tR*E9_)ypOjcIz?$`6x(Y!-7nS? zrLJjJBp}lw$QH@vg&hM!8=vztT~<5g+M;+g<)WGGboK@VQSOYHq=FhIQE!>izDO_f zJZ}waHDHI@NQ+y~u`148jUCaa*ZUWlV3liKj>02XfDYD7QM2C0vm zx#r;P;hBg0PP(f9OuR^pQlfeAWpt|Ye)}@#jl4B_*IP&~xok_~u!o-hXa7~>83MB6 zZsPN-LYrcB5u5$RYNx$+`zgqW#;L_trp{LWEYYkh{E^!dtD9xMW}J3#LAcaf;k_1q*XRsRgt&<3C$N%lQty0C>?vwvz>T)fAg zvb}8uh;FDu`b7e{=uk@o*^P#DVp0KrH|!xr5f?)!Of0=*INUkcg)lNB9hew zNtW0tmn2o@V&dIG)_d4%o4lFz!@7F%?Gj>FqTHp`s3~!vlWi3UV!kA374M)-%;lh? z>|jK-n6$F}Oj^=GX;JJJj}eBq3NbCJFRbn~HB0_#*6HYwbf+|- zkj2c_k}ou}$~J4hI3dcsvQ(?=OA+L5x?UVQrr*%}zWW{Cu1k-jQ>L#du3&&ECKXm9 z2lQg4P+7K^pM`%a95R|M9dNf;)IxJp(%GSG*?X4H=_Lht>NV_IcoZs~L#o#iv##Z`_usRnZR>*|Stt?GF2>vI#VOLils4 zY&C{ll3&=z3`m)#zOMZ^T79X;T%U5Jt^H3;`7X&z8 z^h9C4F^i89t$u?dw5YRp;4(&-NEpQ-lXg%%;;l+Ht46q&eHE+z;&VE{&_NML={=tv z{Q~XtvRAtb?YJV<&+md^E3hIlZ2G}3I^BH7_v3*pTQAEu6j24mR5R74;P+E@ z@oW0vEln)s;N3*&x1Ko!yL{KP>x7V)%1RmI<}di%m7>wVsEa3yV!iXuG4wF>XZak0 zl1?xmXm!#szI@5ddm1CzEt1KI9r*f0*R;2c)6`P4|3>anDrtLot0%Yq>hW3JDGVdC zo80p7mqboGl<l_Isp7sJaN zzlQIR*y9#}QQ+sbzOdD$IH|XXO-naoCBCT#aw101#>)1+)Xnqhq>zq9JfeK(d-g`?$?+>m2K=h9MT!Qs zo6NcgGu;Q#$&#mKf79AJm4oB<49mT9snYyUwd+NW#jTlyKiiQmf5n!5c}6)0?UK9K z5L39@N@13Mf~veyXkL||Uk(i)$xqG9&`WtCPo5?|hIggVIa6%SFKUdOOZJCV-_vUE z0S4$y@EGt?rzI@YMtn>%$+YXsXMZ>cY`bgzmW9qvEcwI!u1er&Sd>)emmuk(^IeEd z8CTvgm^ULVCS~xz2NxC&<+yOuBgyilQ5m?(s?&1C00%B)xm$)D97*<@NZ0eM$K2f- z-<~{s|8R?5CbQZSD>0PJ#z$UkrZN#)#)ztxxJ(}=dPFz)X!vvclA(afC~bxf;& z;H`}x8BivX3LzrfFBfgBa`@ij+xN80=spax6^b3KR$B(oT#CTop3eqM%aR60iewt6eNRFjZW>wSyrTJ?+mBfKWI9z0oZ zq|r+{?y?c`%-VapprL({HArH<7#yb);Ubr6%4P#1^EvJp$CH~xs)?5z_-zm&B;t&H z9*)#e;eyfgtBBK|<~l)`j;Hbl@t}-Qut=5Ak6bgXiD3}Fw8tIt=G84_xWO#YwmLS- z)3Pp6c^l7~IZnNoc{*1R^-aY%Un&#|wHhUM(Nd=W#Y^Z;$NV6^Dw#P+si!BvxK{QZ zn=NF=$fKP#^c?Z=qZH4?)q?4JjaM|%QwYzuQrmksl2WT1l=m35NYLdN2I+`F~P_G5s19XpM;H0l`(BO)=;9O+w>ftdGcV0Z9vn0UBD&q zbMMUNoC!l9SNC&V|0SuN(HkyKmv5pi`=>PCH?^UW4764|kO#ge=yyT@fDu(e)+quT z$PQ#A(Z!648B`ATO}PnUrWfxk7sOZE!XPrX%Hm0(#QasZqpcN=iU{5g0K85h=W9!l)`Wb&;hC zH#W_EyE?E&ben0YwTr2|3W$_YqUZYvBd8={P3>zG^RcKXv&)CVI*sevXrfjo0Vn`0 ze$){Fj%UTOSHGuSN7~`;Ab-!U(ys8N)0Lj~wx}cwIEVKBxDmJNa>Q9RrxClHvs^f5 zUv+v=lOT7y?zlhbXmhlK?0Zw*Seuz9=8w8pizzzn#g88PD!U)Wc77H7?GI5|xrhI7@52H78j4&H~hcz$FL51^#= zfu$vPMsADk5^Lwrbp zjvD@jqL8t~0+WnYb{JU!n-R@+!f3s9JUm8Li1qFnrh%dC=M5CR0cncNm&U{Wu5ye*4DzV5@kdtFfGZ?FrEI2LO{T_{qg|=au>%83QCO3r*U8}e zXZMuO@@>u=VddDe~= zeHGXZKJof>{JcN5|v0+bkZbS!a4(7FmeE(4NA9lDqD(B8M07u|nn>;oa zeGT?OGud`~{z5sO3w*ut_DaPPRY!x;z9vXlOXe$(z3ZN}*E7{~V9Zw(vTkk_NbO2R z)xH)wgf>@~9AOVDY7V$>RC~rlReM>v5j0QdNaM6?m=#d7X~=rEQg}n-<=vh*anS2s z;u3Wy(Q^Xb#(G!}b8nr*9Gg{gAt(&qu-%y@dgqHx)A|rArZ;W2U-2#2);&{!t}4t@ z+n^je_T%Pf?jYQ0(>SRd2j&?>vrgmdv3)OU_HJ+>uB13;jZ+*=Sn4oPM0%!S;OF&@ z^zp`~TR<|WQox8!A{R?nMrA`z#-gEmc=&1(A-Zg;9ava}Q$XmThAc=&#TVm@-h>HyOTx!0F zBmul%FS5@4v7dIcF7R#EHz_MOSENnw)FeV$mNtW&j5bsCN%s>(goX3%af99q8?^Fw z-)5WZ``Q(Ir&vyErMP?@F}`Rt(<*F11)X)i96zM{(|qRK6aUx^dl3vGKi@fKrY;Q& z@t%_o-nD?;?m&MrA?)Jq#_U^0S%4XBdWMx9*(_~(#+Vav$bfM4=QP&n)w!X!=|P3u z;@%q4YA+74lCv7l`Zatf?jD}3#fIFLuxdrCo6WS1<8xH7MZA8Lx$pfF%oCR+JTyzg zaZmgxd!@ZUtdZqd(b+X6!nEe}*ynqA`Qa6z#ZJlqU!6z&Q6L8cs~mw-XT4agdZ}53 zCkLL37@Jp--&#?>)E}7rAHku#&)~ysBj0{D`v;4CiM6l_oMzd&P(I*d$q4?M*RTGa zy*j?vZ&Que65o%3|aZ9t=1VFYtJ`zH(}1*2a;x8~d^C_tge2dLUCL#IWwLHgIf_SOIsqHWEEGfjD@n)^cQI`_Tkw zti6*Lt)4hjGXQd?135G5$V@d5ubYfY#EdpznRACwI}Ouk4ZD2#Bm}Yxol&#k54i(X zWry32Qn0}XgNS~^c%DB<8{9?-Ldg%TX`jHJDG9T+;5;!4 zfXM`%1byAYSoHL6&1uwFy5eCxD_<)zt@BwIfX`pJcQGAK5tW<53&K7>G=dX{T0ILR zx7fwl>IS~v>NxULO+GNqHWq)OVLE6xr#5@{DCXjJanenEP^&s^HMjNL2$(P&T$VmJ zs{7$2?3)vB5N}A5u(kA|;w0G4L}#hf@TI45)IR#!23rtVvTnaw1`k!2k_1_c<7M<=A1M^aZ~!{ zt{c*jf+8kB7V(u)Hyu|#9aT{lUsY3SukY*fzq~^8SEq+8D%2X84CD~o-?CoMh;P~){`l2> z`{7NX(d#&+0SH?NSAHwZx!rm1+<*LpuEpc~BO;Y1WF&)bK=Ug_8>Y8+o{QX<2ofLOTeT=o?^Cd&XE{~Rb*E+LCGAFa+`Sr5{U|sWiUgpP=lxtE@ z;JW}9lMb2yxSB#Up>*Jp;f%ef*7Vg?Q@^tDVB)GL&z_jwR zn4dKBoz82Ep$<0#Z#*+}#vl(}0*NXm<ai+3s>G1hs5oJ+Tf*ynIgq5)3(#G6c8A)mkbS0fs)Ade} zO2-nwjI1@)*c3ktC6k{P8I3$|~*%*wq^jYe7aX>sVGJLVA9zp5H zbZrIc_)V$a_+NBAZ=Z1x7zXt_l}ux$T(vDN`FV}9fY(7i!l=E8XA2J zNdJ2DM7hVM z15Y14hK4^7=!L%B{C>^U+40iu7n6sNl>Rn>A=P#KfPE=vaE(y$I;~qlb5LsT3-8dy z;N}wF-3FBai38fZSfZI5jQ8gwg`by8Z70Ab_R<4yzsEE-eYBD>AD?)my%Y})htQSz zyPR`N)XL}|dD<4Z^4GByvUa8&w>_JX3Hv%)MuUIGAcb9!(L*6fKjRYPrPB$=WQ4V7_*Fk;Z!d<9Pn(~`p zNFybmJ6<~8$?3FQy^7OR^<91b9um75bS#J1#6StsKa7c!W!DvnI;KmbOy2vYzf7g# zQ#9TwInMw1l8~b0qZP{cLG_;>iVth@g0pYf19GpCykjrXP#y(s%-2W=M3|14y&WFX zc9X%oLE~Zmx3eMd70>$y13yblsND=_t;E))^p5-Ah9E7Y&%5(92YzyAqqf#ukIfHA zm1*yT&KUb1lzd-xeI@1Z!B~q2N_Iu;{t;{PQf-DS7_2r<3Yok-e9xTUwc%jp(#V|7 z)3*MMB;kFX`~_JiiTW55>1fV~py}+36XbKfY(c$hn{4bd(?kQM#x+0SlHs2Fs$n#7 z9zCCIhc0^0Exa670=vIR+}u7vAFly<4>-*3+;7e@zvi-g)|KnOh)%M?fB0PBINJyr z5ZUwd=a+~3ifoMBLMsA!q)$#|Q%aR%HtMx{@84(9V}%>h^gEK+iW}T|@)tQGL+FtZ z{$P zB^_%|O@uu?XPr)6`8M>}m7;F7t%b3UGs@jCKH1j8Gx^>VwEDE&QBj9=UoKv+N4#n0 zY-*f$A>)ol=W{fYp*=DO7WfmBvVsxeP#a}g_uaBCtLXih0DCAs$p$;w$+v-ie23z# z0wO|bWJX55IA+XvHx|YagS02TAosPVmiVTwcP3*OqQut7tdaCcxI!Nz0fh9J<)zi4 z$3J^cYIv}$k2`&9Q5f;>KC<@^eulIhbrS0&3TJ1yy%%4lWESlu@+q}v`lI5;9ap&)oJ`ue~KBjW8RME)p3g7)02AYF?7={}^U^~c(MdMppsLrR@DXv{$H&38xPEkY) zA|u@pYL%0`ap!ryj^v9Su~oZVp^}icA5kwouVGEwKm@&J^hbmw>KKqerY(m8cTfb7 zjw>G&65bZzJEhh$`s&%s#jzV^YsrSDiALyTT(e_rps%X#PvXesFw+>E$9&J^OPzeZ z)^*!~P34HJe~5jJ%udD7=xW+ViDF7=~DR>ua?qozkn~6A)H(9)b zivIaxBuQvLu95W7E^C`ZJ!xP%^AyVwh#68duEw>L@8T0<DNt42? zG5*U2@)llFCvIq>-W3#riFz5gWT8O(eOxhpeAfdJId_G6l+WIp5SM|0St0oR6Hf^R|0@gv{qJ8mfMh{=@!9TqTO zj=?FhhWP;d%4*^@rJ93WdbEU)e7V!1MTsa0|Mroygrtg;HUodR>iT!9`FIyJOsk+B zh%}Jb~hdU(Sy;pd)Tn3GiO&Vr(_<|XzwQ}COaby7(bP%c3TJVsK z$I3@)N+n-%<}>KgG0$hxFHmCSDd?ReC1D_~QTt4-y;j?)OTtEwIKfj~gRPV8bMKU7 zy65EWa7`T=;MRs(p|no#?fdg$U3A+Ohj$=Xd(g15u9L8RZ{-#)^o*xO-whi zXDvWuy|yifl=jdsF}W?JtZ(AumKA$Qz;GoFs0NHl+S@NMmt8n1yn^goAfG}F(q=krHIUf7luH{EkG zNNgVoWUm+dIFTB2fA2DC(;YKeS&a7EGvRQ5OufDM{`1AP8wU?Fwa|@Q^!YEgqs#uA zj_VH8<1GSl(pG(iX5EnU@9!LFkzP=b_;(KSaUNKjeiUFyty5teBp#M{jbY>zB3-tw z%gn=b&|1)~*RReBr%s^%*we-el9wswkve?XNl>W<^KoXKq0?P=<6k9 z&nxr|4tGCF=M^Nh#5!R3@zj}CSc7GD1=jCkQVT*al~(Qg`!*_T%CBsFzi&*WQm+<6 zTI5JX=$!W3Dl#l*MosUIuH%$NYHKlR!O}G~B1Bz&mAQe$uY zqbSy?DbVrzwZ2}`rr^eMD` zNXn#+&&q9j_cS?csT#bU^jKn~!r7mdGA4d%&z>#G+7u@$s+K<5BYkAfdFktnHrpGS zD?QBZ2%Qkv=Sjt}vrLn{sdP)gZH~0(j#d20^UU8btJaU5vXe8jTFTDJkE@+lSIL(J z&B$YJbvj1LB(b`sEIt+N%$I1Z-=BWn=*&ivGhPW(<<)qU__C2D8YG3gHRpWu&kkz3 z>g%jRa#^p6=Wb@bY*A(^c6l~d9Qfw^B;%WKEfuD5H-?wotBlH^mAOKZQ`P3nMmMx* ztx}&MB~N6-V8SSO8Z-n6@9H2;vLv_|S@Sa!z)gXJd%xtgOqXinTk?qX39+geq=jaOf@jZ80xsfBCJ z3({`4)d72|&=bDEQO;(u`$Dpwsj_peW4CwQ)q!@Z(MTb&%``)ImfYf~?$%T)^A;C-o(Yw>yA(N9RPB!SP%j40d)S=hj%~8id3&&kjN98S zQ@ygwHTNg6-aErHao!<0dkQwx@b|ZNnA=FVdE(zE5MLLZUb9^QncdhHeQTrwPoNkr zM?@u_&|ydi76kVODB3~yx!ZboYn5A6?rsBeW1Q>gW4yLQD8xz|l+F#=Tp;^|~l;U~h8~tM7YaGb6pY5IJ|t$bkT7d)>ONH($G|8XW@fo7Uc@ z^$8bx6CGNL7SWTqqv`K(8LM+S9TUcsnCk(yW*2Jd#aDXnIDBT{mwvR&Z(whG-uJFF zJGVnqadv}ySW8LWbF@27>$JHUZ(XN%4jY->?|p}N$hD?sYToaar)A_0BrI=yNl-Y` z%IZ?8^lxvA+k1x{-Eu0NKBi{cESdyX_A4G0XRO%Gwv6jo+xD?YF9?XVT2eaL-Z+|0|mNz~0ctG88EPR+ThtF(c;t1eTQRTWIO?%djwcOjWhW`adh zbuQR+6T1TH!?#s*s@%6WoVmEDk#jDo%(R8KZ3~-#=v1WUsxGM|RO!KMTgu6qp=q;I zI2)O(3QHGLGg9s*Wh9Vv8J8(cx~i2{?$WBWRdp)v>Zv7Es;SLPx^k^4q=c%Qrs|xT znyS01tK9Fe-*)F*)T(ZLo40M;-OSX?)vCL7PVLnScH4H_MX)aFqL`G_nsY6IRZg6S zWn8&InQbR^GVR)PL93QaZmBtznTx4r-OWIj;%;V+KkNNU9g`}(_@V|XubG(7hxspja-xCQecSBMEU{U^sWz;}{z=-0%_XGQn za*2R63tDkm^ZoYlYecHAY~@zJpO<~RyZu%b-QE6XW@cq)k1ncaW_dH}UsYw@-s)yo zJ$H9??q9PrA2TyE-uJ!ld*1ck-QTk_Gc!5wd*1iG?|a_&z3+S8_r33X-uJ!ld*1iG z?99x}ySucz_GV^gd)4oF^D^%0s(BvJ8X6k1(ACTu06bbBA?3HpvI!>=r^SzDfs{$= zhV&8M%q8wQWdZ|3w2g*Q+F%SR|!YVkmPtR7yWqP5m>R+d<|B?Drqc`hAJn!CP ztCe$GV|glANm3_C&i9GK`zs3f<2C!LM-{eX);iP>+Um2fxX8M-kGtsI-U#YVnuo;T~u$F^E#Tx2lkyyGtq#o0ZCXN?v)nq{4_ z1ZZ(FtpEXWP8nEgG@!JB02&}bYeWbT8WuIAHjnJVpH-E=iHUnhzVtvnimJL)vVSzO zy{xrj`ZlPslsY0S3%SmC_A`9`El4c|6;qeYC**tb_-=Wk#$4VZEu~fM@Q8~Li$w&elYvjSG{ zU=0qjzs=7rWNmrYlymL@cs#tf5FyE$)*wR^*u5jL;21)fMPmf*n{fhga zhq~$BSfR3fb$vc*VAVJX5B(NCGL`=`R~T{?$O)mV@Av%vUVp#bqmh#HuKDY}UL<`>1}Z9& zQ9ZP_BF08r28vLHko zNRl8#C7FwnjF%~vOE>fL`u`sPkK?D^kHksq_W7TYVATXi=!*DX;4J)P-J(!)=CREg zkOU7RHvO8}v5NjPo0)}c6fsd&k-9wW2BfJTA0`-sEJ*RL_L#H$A!1_pGr{@h$hn48 z%bAH2EM+ZZfUYnJi4Pl;WDP zmL^jfNQV;Q7Mwz2>ssGDeCPV;Kcw#jypf1|0!j98o$Cf4chjYchK=`35eAhcNfwZj zDuPR9LSJ^@`txUaA!UfAfS6?080s)Krw|mBE+P2=sL+%_Ky}wnK;i-Cj9BB3Kd!aM z9(T6eMNZOSfuW*Wort+lH6|?Dj~sI}Lu=bpf$w}G=HK@j`R~8qzn**!L*yZI zfiW=$$*e=RFri3OT7&1IxMbQWT3SjHlLX>krw~wu4}ZXS!N%V|KfUYEzJDLSdr==u z2=8(t<|5=x#743PLNvok7Y zW@ctJ897rk&C=hqGdW{gs+1bg8V}+@N4P_TfIn;Y{PWMfbSS+_0367R)IR#*b=O8u zo@nEJfpzl;9?Bm`0*nFdjv!8$g9@Z2gn$p}zc?5HTtC7c#!f?19YtJxQ?#5KYV1ZTsIE&!5MYdQok! z&Esl_$)clN*6BFi_pUbm`{#ar{l_u$v+i8UNYh$?<{ZI5Q}FKCBKZPr5w*`O@Yjp5NO%=4BH@Y*HcUun1(%DHjLC z%`hJ{gx8y0y12WWb7b9`=T}^Ib@H<1$7$IzlhHXzPf9&F zJGmz!P4&Kf_LZ?cWQMRb@?P|r%G||sIF>6xPe%0@&edJ^&dBP`kvp<$jU{*7?Se-s zdC4A`6!}Wr7Ov3lXJlfdO`THY+?vbHoZ2qBO>a&rEX({T(_5R=2%=J^x=j+%W+k@Xc?n(Y_(sQ3bcIch$Y+J-j zp*4iEv`pT7-6KuyhVnCh_~c15lF)|_3T8unw*DrBP0nE54MOvciWSo7Ov&bfbe_SX zf8q#kcQKq*Rh5<+`!yp;tWBvjy4ForEX^_yh_nnL5fC5?l~!>;6^GzhH5VPuimBhynzLQb+xx zPGdO6TqA=5!z@I^kpxQB4#0EgX22%CA-wTrL(|TA{*Htm1mOq2bD>!sE4i-r1>4A> z;U}(pa6@>Tp|>u$;Dd)$?#BW9#;Pp2 zQF9Ec%w;nyw7-rrXj?c$CP=4H+4dNo|Va8|`{{-3I;h zftkk*(0bX#9B4;IQP#90r8JJ*XctQ8U1S$5G?SLw18L1B;lH-%H{K24>%E0^rqi;! z8*jLd$Zu0l=>4i3+=?;X)YxdQmoe4bt2q(jVvA(~AW-}8y7P`JUTb`N#~H@g%;9i{ zI==0)9va19lLX@w#5B`I6-^Bu4?TCV8a@W>wS$078B;uQ=8-t#2uIxI3fH|Ebsc-b zv7t5JIw(NEVYkb$Si%4#XO0*Z5E*0WBta9`O5NOO+nZd7<#em7m(K)9Bm!JO0096X z1@k{Xdf%D%ZJL@_@n25q&AdP-6|@Fq`E?KkcnB5%&_E;5DxkF%s*0%KYwv4gUeUc{ z?ha|=9q*6mA$LAi7aqOc|^PH}|Y2LsUb3@vRPOrEYX!xafIa{7RX z(SbnHBO9%82*4Nzheun2VmtO&`J0w@cGo!R)EegLcP$lBM&J$yj(hVLc-MNz-Fv>f z=R!Hw*%Q6%3gZMt48;{)iJS*r{oGyC<7*6OK5u<=fzzm**IjIBHnFqAW|1BdPJHo! z9e`Ym@n~XbOWXp+SO)WXShj-fHLOc-g2^BCgeINshhYUiE#*7rYn$fj2q9|SC6P|zMMBWPc*y5sea*XuaeINuxb$p#^~ZdHU{`~`J_@ie#3cEW zY(+!04pdx7p0Rcb08lKzzly-SkRgwL9>LZI7)eHc;1U4uicAwSoJkpQVsThM-L>!g zYj5%X+vGSVUr6;%+yiP!hnetYj%>-GFxb_|FXu}~T!`GODxh|0l@ zS&?<343>zG?7P2aUVwrXT-{}Q>Z4ITL)ITW7@0wl>!>qx#{T~H>#}K45Y1a6H*Pxm z`}SYeq0ZVG8A0gLe=X`t(MCchsuU8HD{r%%-6j+m5hR0UsRm3~s4FU@MuH;*MM*Z= zMWECg0gxe?lQ*2rxfIJvRyH!_#Zk7)l(|U4QnHDXCK*`|azG@8D1odYWj28j_gykF z(hC?(HqtQ=gjA^w4HZm=cM(oC=#KW^zSh+g>g`wHv+LG%MBAJ+GZ!n`%f78eYZk4f z8glcq6q&v0%k0{$Ni8@pbY+TnM(}jnt)oYRvwT&Bb;81QhgmJvZjqUmcdBP<-CCD4 z2{wq?cVlMul}^dUmAJY09iF?oT;1i2k$E}R_V@l*=F?OuF4xuycKZ~Oer&$F-rynt zfzSbfAP^ixW#DLqN^#!{r1 zB$e{I11U(F8xgT@I_$=!o$b9wyPK|1PMvC5uxqX;|=GsDhqT%q52m_jh`h;K2&z4`wK>DQrA$H9WF4{4G%!I{EqKX95 z4vg>Dn{WGh#U@)$@?t26f(d{k3=m^+5{wN~qT^}EeD-~Oa+H^Ac8jZ;w%ZYzj4Y|) z2kV=tK>K~{KO7f+gs6|XnfE>CB$hRYsEB#H^2`zuq2H9Pk(Ah#S)CP(jWrzedh2}p zG2@c)8;;C}RUl}HSe3Zb-!XQ^7mkB{=XY@C}~Ct zXA0z;=lIAel2B$u=>KbigifA7=3I`OwV zyXbx|d`kD(orip7T$B_(Vrhu;AE_B{9P?%#58Z@vx< zZ0A=N+~aIDjK2j1^MsI z9=-R!esRn)^Qw;Ot?urc@g!mi1b|5-MHECH2)6z6!MVIxbGg1=jxpXn`6xeX$89z+ z1Vj=$AG;2qj|fH%C?-Bu+1dwJ*$V8X2zI^XXmFS$e;`|K}41Qh636GHx zi&O`nU(Y?rHnLJ4vv1?#Gnc6(f&@Z7h=J$L9=hKJd5n8kPOMg-IqJU;lXyWeK1}O$ zd7*y#L_et(*xY< z_v^p}G60@zpT=j_e!pMO_v?PI9BtPfb&0a8`>XI{F>IvZj1*WqGUkY*(Gvd0^13w^ z9MR|Ee%QLFLaK=Vfc;Fc_GzhMs1N!sa#x!6pN~6jw%MK@JJ)=1tKaD7D2OeI1b;My z%OoU>%#cZ!7d?JGKcDCM{{B2_yjyKVh3F{O7n&riZeN#{ym@1 zvnX@t9?Th;cT~lGVXhcXnUNCcsJXwlu5aP$Z|+?yq2vepG9q>>D`+iPxR<=oZR zaoe49xyN*J>+K}ihb_7>h%h&GuJ-GX9WxptG=$PoOtC{16}#8m*zCCd*5-KUzVACa zUUInL2B4;iqtM*S?h3lk6*;9XOlrN#eA9Flb@x!h_V%-n1iO){j50EX+{ww3nI-fw zbCV#=3NI3^$5m6JPfg75L{Dtc+m=@G3s-imH66!D!?!%|WtC3^$zr7p2E%Hpkh`~9 zbm8#lCajZlXc!PSAOJKAskFcx1V-wpo9hHF1A%xzrc2wCp^H{;LDeZ4go2dB#a+2H z&D4V1a6(o}t%bOdCAdmA7}iT`T#ABL;Vs7DKrO3#X34WbxoeEBON}Uqxk}?jOHxuP z3JFBF|Zg{@oP;#hyrd;R}_T`z+F%!V|G+iN%$8#^{OtFlA8 zOjL?SLYXz`MyXRWV8lQ^{nhH1xZXBiJQ@W75XB-)5FnJiv~5!u-@nghJM6_25q7s7 zjfttEq9Z>e_{F=Ev$N^R42{gujN_Rx^;P(Xd|{Jvv)*!j?6Qo%Z*FFPB0)DFrs#;< z*{0}m2!T)0e>}#0zixZhiR?6Ya&nI5WMqvP^x(W0!?$?8f-jQbAOSL@$w*}r3TGgS zfDA;LE^}kEj_m>5o3kcm%#uwTm%Zni6a{2~#NjcLzWMnt2CAR|p#Pcgu0JQN-;ozT z&i(P7xa+;U>i4(ZdT;M^MG!=#R8ebJtqp3wXn&3O>VIFKpRCVvfe^B*w!6E#yQ%dcOCi z@AmIzFcV&-Gx7ug3Xu%OmRL zMj}cnsN;V(v6F7KmkF@q@yDn$%!XGfJg{9fKr}%%e{{O%8_#c`6eBxJ)w(ns36TF2K)htv+OYsHz z|3}@8jkrIfZGS%}xKM8zwtuS3&)B-G-{i0u0s!(DcN?B}&Yn2Q#&*Wj+7~d5sLLR$3$`T6nZ^k-jr9=T&7s?j37J!9F$WxP zttS(`S&V;eWYn5&YJIe1VnDu_i_?C-cguQcNO2lLXIR0ubanHs-cER&=0n-hD1lO= zT}Vc$3L>gx1Yz#)@Av!t{>MQ0enI(YW{9>(NPz+q1q_Fe_{`2pfm3V0bKl3`Ywy1H zV|`Wiik%Nc0{XSX9VIOgQe=63`y0LLAAXDL@NbFnp8aC}_qaI{5X&ZGG4?h50wN*= zQ9+UlO)(8oiKJSTm}w>$U~44?N(xPuR!Rh=+v@V^7j(OIxn*~D?r+jYA`>!=f}%nK z5U~a^kVF#%5$CGlXV4y&(r6;ZQLkG+ji_$)*Il-r?k9Fl&_=IL+e}QDs}AWzkx(K2<^>LAw>{Ku0l*ia5`cjG97l~Aw2EQ5hmp2WsJrwg@8$93^}{IaYUBl zRw$8WZ0@wskxYo@HnkSQR#dgNmcl}bNh~Hx)|h5mt+9kcFj1nB#w|id1Yn|bce}aB za6%l5C34lywbE*Wu=D325W_uI{<~3!?sMP2-|y6)A0IsLZrr>5_O{zTG`CV-u=kqY zC^;ep2|<)SPcm=qK+HuVK?I18Kz7SwjMA^{R6r8yQl0STr-_IFd;5G) z&BEUK+X5b^z_yF>{y4+g)!lceqCG)SnKL&!FV@A5@@?fTyyTp(He`|+y3EO>l0zaP z$`XnuT5`;yC}|!by6oS;wzXBQ|Aw>%fY5~i4OXnbKH7WY{6BQe0>d80O;LwHO-UT= zq_7f!Iu$FSoEEjQ`p_C0`;tYQzkZ|jx%`{@sEC18O;uG@Rdi?#00-}0&>8>&(STYo zTGN(+e}4C$-uJy9>-SVxCCBUhH~4&p5R8EPdL(HO$u#CbuzxS}L-JT869AA6<$4>< zQrYvIYQw%7)OBO3-@f*F9!@0ZtjoQbtCBUee53C^{{LU2_0NlcKc2qa*A{*&eZ_nH zh=mc+0DgD)NL~5xN++HBmHd6vXGA%vD)$e$;AW@LT)G^omy27;(x&zR)AS0e$HOyRMXh~OZ24(|Q?@tGaBx#NvvZ5g=V zK7B;s4UYOi#3=YCML-pCLdy(rLoqD@KD2ZTPZ~WE8o3$~a7po9j0FmBZQX?LBxqok zbEyi&x|KdKGUpY!+l}|re`yjUzBSo5c<;uu#DVN@Bo)_}V(>os@0lcNZ`YQxN2Bw1 zLJRLs)n)DF<%KowA|emJObfjC(9eRTMG=&uhy%Cm@rVF-hNlP(C??~#0yeohQV?}A4gNp@}E1Z zt`b3>pduoqv+5w2)CnbB!J$IKBlg)By+uuq?6W{<05lmnI}SU4m-Nrq?cetPHTt{r z&pq+uZyk8oj3$aIkyJqtJpdvF{{Mfk<_rFxpFe3y{hD*tWdBy^Ris(YGiLR^*XxYq zd)xH3scltJ$K#3pKVPrk`EdjY5e-N1v7e3k@qTPN0(Ie=@Qr!K9Q$S@*BQ>jIAu3K zu^-T?V1QO3Rfq@>;sgNw`uF{N(Vy3pPrd5+t^Xa`!l?*;zgRdn;G2tr#vFWLLQKiU#Z#ug9J6A1+4-gMYNX98ErW6 zZLV_eYn|6X#fb$J2_@VqXlQ95g#1?a(Xt~CI;kIkRbGd8_}l_+vhMa=9ydBLmJ)05~EJqvb zo5>cgiPH10FiiJncI&>*r_>0#!t%O|f_h|SbCHvzV*p?X3Ny8RVgyWBl}>7RCFI1W za_9;%cu34DykH=bauP;Ha~Db$fhA^;!eO;bHZAHde0O}|-N_0U|NW^7l)f3Mf$CkZb-xJNYY-pXcyYpA)a$QmM%|dLn><6g&_-07NnTh~MD%-YVnj zbJt|zs--~U5xe}%ndykly_sI10zt2t>3W|l)f%|JHO$Y2Jctq7fC!5p03M(~f$Sg< z^Phr3_feABMTu?@Vo3=BFe8#xR|KH7y$umnPT^21r8;!wR2Ubn_7!)B-N{XWQ&bh~Jq?NgGQf{S4`6)7Y|h1eRKc%x z5Ft|tD*S~qo{~Y@sn!g6+%}8Mq3Pz?WD*g8E6;*JW*txy5bnMD+W-p%{;EA@Ws%3zPSpn050tdR~ zi_D$(b+<|QAb31>K%DvNY#plk>uk?U&7KJjIz_qBB49*db@K$iC(U=GTpdjt^S@Sz zM<>j__qLQ?O^HfCAq+?>cCFrmV68fojZ_f3;0K~AB0hJ(y;#o|vutaAmHW=~DsFf< z*a8d+qTTcsfS?@;9fMM?sG&qM^t5u+fkL7qPNr-C1VJF5f@Tc&oaU62eF%ZZJlXa0 zv6W0*^3Ws*gBlENP=TfZ5cmDR-~0am&)YX`=3v3>K>eV-57m49Pwm(0?0Ub@%{B{L zU_b#>Yh}LwWC!Pe-}`Ut``Ebge^H+$yY2s_J^Q>gC)vM9GS)oM!lS>u1|md1LPYd; ziTHe!Nk+V{+!|xndN(&}RD%7;kdKapgXjntLx>O{0g;vX_VE$JKR%n(K@p2B0AviX5Hey`JpwH#A*CUp zo&d~=0_|1(nc*7!d)~RhU~cm6>bVnyWDOAg-u9z2uvjKNd)~k=qC;^}NU_MO{m8;h2?H=D1p2z$HWh5uTTAeuUEEmk=={j2 zZSHhp$u)V=&5c#Im?U0Hs=Df)yE|sq-Q13?tXel^gdT0q+9z=hlzCaK4km{MIemHC zTSE)I4=t;{c-h1bCCi-~?&Fm1cE?t$VvMT0+Ez0tye!pY<}P=#&@;AVmASaEWbM|m zcBba%yS3)-WnKc6j#a=80z?8HbxcvdwT-dKhbX$j+(5Yq*4o(xDH$9qLR$ccR$5~%X(B=dC6TrTNn75=Sa6t}j1oI? zj8IHsnPUPgYhu8Z1!!QHG7cpO69yF(k;*t&TF?^+iBy1y5F*eaBshQVHTz>tr4Q@- z*CuRWw~C$rZ`;iM+j3~A_F}qlF9^D~UXYSI8BAUGj@Llg#!3@2FaaVUffFfL;r?0} zdp8`@(}0apAM_9WOIiR84FRLl#}Lra)2V-^{VV&D|Ev83N#ie1dE@imd#9#}nU(pR z{r;}rYLiv9dAnPI6iG5}Zu!goSG#O?#ePpBrl)pLG(fu}D{Q8$&hMf#Pzb_oxopwA z!SmuH5IxT)d}oA*mOoHPzke(7-+?PVPBz@-?%q&YCQ+3D2=z2qxq%T0z!MRl%X5pg)}r4FN_B_JI8GcP~3W_G?+w*BrMCRhvho9$TAI|yY&-2&vKLGpw2mF3_e0|^P z$UFIzz1$dR^G)(e`9(2~4T<2HLtv7kZ>XBp_fvf!#n9LLMlrLKP_W9uR#E zXKTarmS>e-=xH5OHWWaJk?=r(7SIa4aJ48&(^0Y_8YPkkDvWAc(4l6;0ze1huVS!@ zFhcT>tyW}k&b$Sl^7Kui;2?LXWNr$y{&jn=cD$J@D)W#Tmt)|LXnEoumz1U0+76ZN z5#Z03Y{nTQG5m#8jfHA;{RVY}a~3SRELt+A|xeG(NNdwcV-ow^q;XFRFr{@?HY z{x9;Hme_&*1`voKfdqW|YC$9Hpb5Xy+OS|eeP6^xLr>P72!b+g6o62a@A+{V-&)pg zBNhF$94C^{|2O-8zwh_l?}b!){Ldrclz#<#_`c)rc=HqBIPm=l9J734$o1&?dqj=! zQ7UL1n~&3I0d=0TzgeK|4VBq8C%fg-Cop9)XIkPMoRBNjNfrlQWtve8iKQTjAQBo3 zx&_Qxo9_KE@F)octu5+oQ<<7gREB9F)f2n;yz}w?zu)&`-=eS}K`{BBJB--fw;*n6 zS7Eq>EOxx{A_d2IX}Hni3BZDzu+tqVx*4s?b9vWI_1>m)ynQ}5~oZv#KjV+ z!}f~-)Kx|TDz?oGS#~5E8Sre)s~1bMl&zD9 zP88lz$vbsttCDy(dqzCma=2)!rFE%Yybkr%gPGRG-OSrlCY}wYb!T~&*#mGp8nA=5 zr#a_Ss|R}M)@B-=8H%fqCC3Kj+|m_x(pi&LImY778C;aQ5IO)1zzN9KVnKi+XSS)< z8UjXzWL~y6Czm04r!2*7V%-vxY>}i&Fj7oLl`z^iNl@5=BPkk25NZRonI`c73KvtJ)q!&2uo>Fyf#GWme>-J~umAdMch3qZ6$1Lfmw zHik}!l=BDz1VID}Dt&JIeYLwxZswFR$tfOH?-kh@oYj#G)Ax-E^Y&8xmK7!Ao8;7` zSs9tR{k8TG7seYkLU-bGh8_4ue@rGeW3zzYN~Kp&uJ>N{N=XDiC}jP9%+)(K#lVs& zFhZh<3b;TF?HSfEWW$|fKAI#iDTrj5CnTAd8zxCLmzBj!$H>g`Bc{))i{5jOqz|>f zpD!GE6mRAMx>~S!Ro52s;a6e05z|` z2DMxv`V4n>d;Y(#>;3)u1N-)S(xVgzf&Sm?{1OFM_P*924VeTslJ{QF{#z19A-T z5G@LPyDjYD2!fzuX+9H?%EL9kbSb5Ofxw6p*(258AeT)0nHq-Bq$Za(C1crGLt|bN zg(0*PUL1JfBrh+!!;0&NwWc`KeQS-q`*9ohhOS*-u2M`s6I@5|3?~ONeNcp`aqVkB z1iN$yx-;ju#~RSnDj-ck>jxIOTd+C^MwAe~??>Y_W+N^~pcb?ZF2=UPj9!R&`)U-R z+L;Xw-mj+nP1u+2#KBPM097O#dRpk_%$(5nV>!DgJ*pDBadn}f{Q&ibL_dMqddh!G|rK>J|B zllDG}A2R27T$1o{R$#37P2Q2=r*ynzz@xRpn;w`4=dr2%pv6SGs`_kOfCU(V1N;8{ z|9{`>{O{}Zd7jIy&G)V}FXH$Y@$P>p5`JMV-oNKS00nezw)Dt0f29igf5H6o`4u1U z`~JUwzVoC9KUe&F^huw=pfBMFq)X7e{)jOO|6qS#N1Z=C9r;{9m;Fb{-2D zi2ZNS`7vRNlcRRCXvGeq5B*2Sx=p`1US?o(=c1(`LS^S-mb=REJu{O$m}K%!U_?nQ?0{)$ zr_xO9M{V=Y+wN@S49UkhQ>|fhAoacni!n6xa(J6J8B`;tFoxPg8tJwsJy~VzI<=ib zaE4i}j<7_;lty%K7a_hZvX|8ePt=o>X#oMjs*}4=V zs9lWG;ilcv(br21)}dl<<mscIoWDwX#td0f-6A#-nB=OPv68*pJ+6B#jgZvz_ z9gW)m9(yylJF0!{%?oz#b2~q<;@9Y_sDbN~YwJYxi^eb5Hg(EARd|c7JYwTqO~-h~ z39hDJ@0Z_YjjzqUpWSKm{Fh%7c)UIDl{vVP$?ioH@X=9JxNRHpj1V5aIU+(T;_wjc znK2?f8m9*oZT;-)*#lmx;WGQlv}xf>k}k469e0VFTZBh~gr6Upy^IsSFD(<{8=QF1 z@;ao;Q$iJ*7D#rCFP#xl)N?1|W@<*ihd6=x-0yd9-OCNKApk~cqy-`u6|C8|-rT*T zh+}MB)?(C}Qm1WZ{mN6~CM(ve^$))by9KiC?B`!tp#(;K0FX!`2s@<5lR6Td03aj? zg2{?>y);XqmSgkhtfPFF3r;(Gj_iZzSX6e&QelD>S3gDt8K&w0!59d~HYHEc7(}0o z%=4<&1Z<5No1E_V*U}CFu!4XL40s?20s%pVf*c40L6fn9MO}y6f;R;m`CLc1leqNN z6eG_1CYq(WUHBH2$PJn38U%4l+wl`3wb!sUJ99NuhvY!Y2-;v=HiyjH8W9VU48pdwH4)gE^{&JVu;y*IKBv9&|EQvOFWpvb4 zWl*fy2=Ucf^hg8e&+@#Vzm16e^?f?f6EicpnVDb!8UTL)0iXx?V8|4N)g4tmSNr|` z{u&?03-x}{5lF=ojpEqZ0!?d8kmbPIG1+1Xw(>hMhW}zlgy?^4Vz>9~2$xV_W{aQU z>C0U$ewSj#v|88S)qV{hscx*>_$Gch&9Y0jmmBs81c=I?=ksip;j%ya}?ZQJb9=fEE0Yz-`V_q9L`00()C7dN72rSL6bWZ3PJ1-$+?uV9o)u0(ZQ*IW!N)ZId%j(t?o|hL^j)s3RLZ z4B8{=AQJpo zGHtU=@uvNL{tsPq-<>^qJXBxwW5||e#u}vgv z3gIiVZwXn(zBdfn_eqvXgYWP0{eFMH|9|H*@4kD_J@?#m&O47gZ|*xs#u#e#KwGhh zdYsqAp`9kKkWc258ZyVBxB1VA3;dN2;##;z1B+gI4t$7fOqPO_htHY-7jF*0eSKZ3 zc%J24%tGBq_SxGVLP|JJqW1U3;UNIQtNR$PJ#L{n7*yvdU@u)RnDa^-D!faj9u-veP(SIVp=A4R{ZZ0_whtY zIe8IgH}j@l2Xm92YdxPA_i0di+$+WX-XEjy2#SA^fL=2`N3yhZksB+mrp>z#Ljmcp z<9#;&w(;L3w2URwXs|ah?6P=|7h5qp*X!qS<(5TMb=rqtkcsCL$!n-{u^2+gs;YC3 zCv^~3@>kxI`-j&z?Gmybt6X5ElEQNvq9bARvIR~7*u2~Y<~3tFX#nYPfu2i`T?(M0tnQtH)z`I z@GEbHPS)9pAtAl2x9>Wc*gWt=bk?1@eA@=bB~4!BYDaqp1!pEec-RzM?o5dU&XDqn zLA+3k(|5kn=ujt+k}8Tq=7>WOg9%ZZARV{zWWL$epluoZva76i*y6~<;W z(A6?zz-A#BfOUT2U7c68FK%OxnP-1SfBya6-h7&Vsq(tpVLu;J$W_`d(4bQGk}~9A z|Bs?e9+8pl?uLZB7nwF}JiL)TlI>X0rtsOj3Iy75OrMkRLHjoyh{k6p?1jA=MOQ>c zacNrJoS{sIqFcmX?AtY_JJiFls&`UTupzmA_lM?ot~YDO*Gndo_*r;^Ad1guDhM?} z8BEmi3Ogu<`4S{i(D5P8jpFhOugltVar2qyn_MdKocUCOQk)8U@7XVX@j7gyt6sp% zsw-!TARXo86}m%RvJ@97(P+7E)%n^3X|tB7m0PRG`uQ)WoH9c_SF9N>X}Qf2t=8f` zc#g7~GLYM^KiOXg!Iziu>ojg`%T&8lq z)pcPQbdSGPz6^11-Yx#7#cphycuNHqWK%K#cU=;ZJWA43dq^B+;_T~QPDG|i){@mh{of`w zvxk2UyRaoS_^^BsWbDx*Y@)n?_@)P^X!E5M#C3a8DL-82I+vsX^Zhs1)3RT)MRBQU zJ`-o~1inZf9El+o`z0C2H&Rw}ISW3`@7jI*8_ZYQDDQUbuuaV3CExD^oi-hnYZooK zX=KKKO;JT{(!H02zvaF13=G{q*IYouTqm(lL0oW>OOm{g;n*!5`{Den-`#brwIk8V za(g#U%d3gq6yNr1N^o65ORG8;@x1=h&U~=r_OVjPMA7Q5P+`_ME4+<6pdQ12L)tC$ z0#`}Lf=uibHReM-to+*`MOvmtl^3mN2JXOdhaY7%>_mY^OK>3&v(m2I9NR(Y>+(HG z3XNrF7n2oD$py598F|UjW_cV7nCs=3#B|~`3~3tIjqm_l{f*L>@7+Z z4^NBtpjD52MT2O8zssawUVF0ER}rFL{n@Shq_23GiH%D6M1TH%3jGJINa_;3N?oL# z9S8Dt5r&sbrz66|(uJF^BEhr=btf@bD-9_e|1K>}7hV8kWKTjSNp`@y)sd;rPKm0* zF_I4939f}PsiUQWL)BODrl#l^(_Sasr1U2spl#mdcW1YY92Lbe>~@yycfNPz#l+-& z7gcvEE;Qo!j&zQ4mj0O1p^+yBJiat4&Kt_N5Q%zNVCTYKg3z&4uX4-l92d)XV-eMf zQdYT!de?RiJdBPUa$|Ed?$fR~$94W(WR#ioU+KZK$EGJ;8jC zdY)pn^%_af+FY1JQUh3c3F=heyau_(d4Fd<{tK9j-qt%Oj5C8FL+v=Y;JIWACL}dt zK5mKAtMBNmw0z4d)1ww5;pFBLOMPrXdKYbqRgLh@wQ{dJS}^ z_i5=tSY>HLuu!?+pReuZG&lQa?(4N14czslR4rn-jlJg?j$`6&&sC{@EE+ApAuT61 z(Xeaz?XpZ@KgK?wvDwpn8i(!b8r8t$TK0LF312Chmb{C-7@Zx!TjSTa{;^!9LUG1i zl!}Q!yA^k%?0cakDR6mMx{vUvVabeCpVz|6PIUs|B)xgLX%d{EgA7%rE?m`GhEX|j zKysjb5FuOh>nomSLXP>8h)@uX3y3SsdxX7Rb-r+JT4QpRzB9vq*_3jeSIvE`sK04? z)!kumOI0o=l{mY2lhT%gF0-N7OpdA#dI1KLajm$63O(mF`OP2B(9J{z zaxi7!HDZ0HOvR`rlHMj-qaQ6It$J_U`{U28j19_mwjBWxBb4zwi=oPdP^q%YN8X}U z1Jv$)rs|q91_Ay#BAF|MkufHR=AOFuyJ|5{*EPjLdC#LO2PG$eg+eGa7ks01nQ+Yz z7;>&HeDnZQ8$%S|6!hrKB#me#k|r*06}(4W!;Xc9rRE*xPAiIPE`D7Oyzl@q(zK5Pq}R8`0k9kdJAh_^L-Xx^q+5nEEgfm}?#%|A>bsH(Z50z3kFB$9P|U#yfx? zN64RT>Robrh_NPV>JI$-#5{yuzv4Mw-=xZ#`GdY zjm0$TrhBT-Jd9e)5OXaD#&^G`uL1(`~wbkZOX;{C17`TbJc2o!BX_=CNrSE|>Op9G3T+NBFl@)e%!iY6zB=wfRi)f9L z)7A(cFY}kkLiHSj$fDk04iXh4JE6LX=}4)s*$6ts%Q5MBWcjwIwWdCcc>ONt3N|Zp zuprHCQ!lfj(Mu1@eK9a?I_9t4t{#Hn049H`;-V|X*Dm3^X$>U1Cb8z*YlUNh!et0a zt2#H1pF7f6OW#4Az1NXKV;5*GIj$K+Mmv4qxi{p#{T*?O62Z+c&Vcxn%xyvaqw!?2 zE^R@~v1r}Vuklids{tZ)gJUA6;L{)s$n{1k#>EI_WCR-z8yXMkd+Y?RWYr$$kQxKW zACyd2cTeK(IN#*7wd_3DK1bx|{A{vv7dm&qap=q1?-~4dLy4k)H{}-Kh5`d}0|-;% zEduFT(?bM;#}ylujn?$r)+YrIApL{*$9{CjIiS(bj)JsHmU}cd!g>kgpJ4kjnk5I1NV9_MXhAb1^(f z4dtYzx45jdt8UL1lSt4`8GC9YrJ%6D)%9iNsn5rWsi8v|H|s#y!yK>n~$eJ3RdVqxtKdj8}wQc zB~(#l($IBDC!ivX`BU5~W!KFFX1MR0T78FYRAAWlxn(ukWa%(6-(n-n4%p+yut9v# zi({Jjm!HV=est4CBg}>`CvU!%3zrCrpAMCe4~&R^ngp%vglw}q>1{DVh9Q|8z@vS> z+)p(3;B02PziW@*X5i8W08w!bpV$rt2O4G`(I57j+X)zD#BSCR+)qHCG#nFo(6_HV ze=s&qXCLpq!%%_Ngus^Y+!eC(nW-vJPaq{{6I5KHLY%T>j1 zQ)Hp8U==^QQEz6WO`fl#N{+SL0rw9K5-+PRW`3FW6`C^NQxbZrbWgih>^z@?xf3@{cCs^rGkUjMDAGx{aoma(u>=Oi+YL(~|jW`H>in zO9(BVb;8_QMFxtek;_0pT&xPfuwwd+KU9OLa6c@^H z&iXcS^&4KsM#awH2IPXqNO;BHVdPx)bMcstC|~&}5*kq&NTYDtQ2btiiXL%N`U(wK zyeuuBQ03;qA?FO^-;V<~mOsxb`7Z?fA9f9z+*Z|AG2XV2q_P+fk0pH_SdUt+-ikpq zVM|xUzR&r|vi4SoApCqvbdMDu`6bJxTq#{9YRH&0?KW&xPZe`AWxkKSjc-&lkn3K4 z%ybi};2tz@x6qyn8{!BZkCZn=CMk}^ilyiI{oYVqU*RT99=4<(FT@_-+#sbB$(q?R z?5k$HAVGFPFbkDg0+$2$z7v?2TELjjgidyaJomkmSz&klw5n*aJ5w~XOd=T;u*C1r;!>^21nVcgY) zSROoF>WbZI^vcS2%fbgt)tt8t+boxpFY`@$Oip$r!W`1yp}ck1@i7ha2-t^*Go{Iz zIwtFt3cKSc`oaF*ySp`?{Sp~)B?s$W(|vsg0r;5eK1Pn_mcVz2wX%w&+})Ss9^V2; z1f=#4OJUPukz{Lxb<-7@4wn$ms&b9i!Uo8K-F7ONgN ztG}lTtTH2`p*^`S7d>~gq%SE~DGYs1=#Xn%U`v;FdOR#45@}3INxZFNY?^4MEfUzD zI8uoBN_oTdX6t*YEi!BEs>8}G(}?t9^N$Ax6OU?Ko=n#mTRB{ReQV!!JA=iE`zXd8 zN|%r})QyYtT7%wOpyYb#I{abd(q{XC?Kh`av|V#~JKa!pw*8$~)33%IbOy$KOzksH{x=E8y$=Td$7aph3CK z+LVuZ#c>Q01$O9%krk@^wry;55b>BJ>%+d;xbo(wq+lDXKvIVh*Ealq-CK*#^S`oQ z{ON{S6?oLkTJ2}A`)sb8XC8qi$4@2oWn6$ z=@}zf+3aSx8E@H9#HQl;Hoi;;4*xb4ij1+D)riy#z8F5XfaOl&`;O0UI}QCxmJhU| zD9xZ3WSrqhqtE)?s4HU5|it@zTeCJ>=V0%?_T4& zmiP=t>zukvy)y94dVgT%<}vyAO8*}+kH;({|H_QiZrX@DrD$ztv$5GPrXBm<&z-7B zgj&DFOF@LA*OLd#`C?r0uHnIGnPP>c&a7V=S=rVfg04{6e5SivFrp&5MsHCVZX!S# zmvJY~U)E48V8VPp`{|N|NEz){YavYohdecm_mnLE=Lw1@CxMaK4zb#O0zQeiKR1+= zRYymMO7r-6za)4e(s|8*rG|_@18IHf@MI#d^heAqeIO&ivXwGY$X6E0=E`_M+@oo> zSMJRl?=m!64DbslC(u=PFgKN&ss_V_=~q^r^%-JaWfvchCR_<#ew2kFrPr?S)->8W z#Xulb5K6UHRr_RZZCP|%UDRU@21-ygHgqVgQlX?${?Fw%&4IHs<2JEuFzx|^q#oVk zSaSEmw((mJ$WQ{EkCqnOXquOCTutAJk`nduw!3xL9R?xMe#zAoTpv~ZUH{tSvT*}E zu0XRhG8S8cF6dyMNRP*Re4vzje52?ClpFtSK0&7$X2RvV9#*maql~ zD>gJA{cXVGV+nu0{3otf%MCRg>OYRPx|LQ|wfKvg2AJ35@IH}PRUvQm#h=&&71=S_YJ{Lyt(k{t-Ts24@VT+h6k>)6P% z*b*=`fhI8;-7ey#O=;n@?K2fj#a7u{n6zX!HAfxAKTluqZH#T78#WPv@uf|(z=V^a znVL)Oo_EbV zj)sUxxrTMJf<5X0^Wqm5m&gs}XROu4rX_M`u#bNOUV(RtQ^YzzNI)u5O(i0X5e(|w zU438Fv)Lt=20$ub5qxcDZwN~&a*v^pbh-U*NIk}(&PYex;#%vw$amb?J~itfQe}d7 z16O>zp6gRl=A%Nn$K%5wmrb?nD-5+o!V1PdN5;@&iy3OrX-3?4E~GqQXUY2_fnmuN zHrBX@>q%C*ZD}(RoD&ZMQHq291#qdz;D1%rKNYa{KW8`sI0MAEf13Y~G9Ef6{;`5eV@_6%;@V(4UP1fe;{iLpl(G zjuO)f);>jpf&PEzh=+q!0Ldx!z`X$7zd-j-ZxW^zg!|NbMjj6+bgEJ!ssMxl_St|& zRK>x-K(LM>2qcUGOfxzvCPr@vg5%%-VLZ@-0*#=63K)e0lsE+dIRXp;X2to>Ou<*2ULLalndw#d0P3;&S#>7QKtw%no}{) z3;;+>cghox3IqmFfH}|RIHLii0ww@~QS`8T`&Qv%>o$?17r$|7`v%WLzY4N`v2h5j<0(kuk z|LeA=Tuw#!hw+&o#h>B+^Qbf7&xp=0z-dibxAoLJ0EVZg1mLWQ2LsK20DOAw{}0ZL z0yOCWR{+6Jy9)l(@03UwkP88dKlKx!1xO4(wPw&kiA7D#+QH#&i#7qp7XBIq{0t1T znwZyEau+>rg)+-xpursB_6gN?b7plV9M2?0SDZQ8 z{tYQm%p%0W!yeB;uz%}qnRC~rOrN@Hzl7Iq{k`FhY#Cqs%u#B&p&pIy)IKCNs;4Za zNCM%^mGYX;Nu{AfL{!WCfsec0LsNWft4BIWO-p8>?DzCa#wCxZ#6=)w)9({4&HV~! zT~RiX{I|TQkQMh(JZuQEz~p%}en>0-%Ln}W_QH>Gcb}P=!s4lhhKH}~dL0w`51Brt zK2#g<$2UuSW4jCAJ-oGhK@EO+=23v>t;@ZBeX~anOX`Nd^@DsC0@t{&Z9BEnFcbU+33552|}X@ zc;}%ig)WBs0oXnX!8J2`B_!}Sd7nfg67donseL>yW%b@9(kx;2o*Sv&QEELUW$d;q zu!V0BEf7F#I&A4z)Ym3j^Guyc{rs~TO+GMsJe|2aMw+C?I5xLb z3M#TH8Se8H7k*)Ge)0HA@7;`z4gEbelYq-hvqO|)W|&I)hQr_?C#Vw?3S@l~cBmd$ zf5xYfgVjY%WclroY9``ZY=TU$RXLPB3YeWHRQwb}J9&8dPq~CU!Bdzf3y(bL0^=6}R8d)uIh8U~SIeHPm+sVe`D78jvSbRdvg?Xdi=kzEnd zFZXmwW7Y>|Ru~FWS#e&ZpAFm0@qv3@ev?$3td;Q8xX;$^`!>YeyDr1`<5iI2;Sk8g z-~1>T>&1srPnIW+0gv-aE_wG164IIjV_u?wJSpA?QS#e8JPFBOA@8qb`pM^@;6j=K zN1pk6mmNe8q(rw$UK*IyoFdwk+)!M0n9)(wbLtkrkBCV%Y+?-_2if`i z4kUdi6*>|WPmYh9DzPf3q+1qTu5g5*b7ZLubr02 zWDlhy1Gmsg7mW1)xbNqIV;ndZ8T`(4a!x2FJib};7pk|>BUsr~t1Bg?W04o828!%{F8It)ARR};C Vl6@iplt)(GY(G>~bkbkF{vXHUSjYeX literal 0 HcmV?d00001 diff --git a/tests/static/data/peeringdb_net_3333_10745.json b/tests/static/data/peeringdb_net_3333_10745.json new file mode 100644 index 00000000..1e937b8a --- /dev/null +++ b/tests/static/data/peeringdb_net_3333_10745.json @@ -0,0 +1 @@ +{"data": [{"id": 5104, "org_id": 8829, "name": "RIPE NCC", "aka": "R\u00e9seaux IP Europ\u00e9ens Network Coordination Centre", "name_long": "", "website": "http://www.ripe.net", "asn": 3333, "looking_glass": "", "route_server": "", "irr_as_set": "AS-RIPENCC", "info_type": "Non-Profit", "info_prefixes4": 30, "info_prefixes6": 20, "info_traffic": "1-5Gbps", "info_ratio": "Balanced", "info_scope": "Global", "info_unicast": true, "info_multicast": false, "info_ipv6": true, "info_never_via_route_servers": false, "ix_count": 1, "fac_count": 0, "notes": "", "netixlan_updated": "2022-05-27T09:56:39.774266Z", "netfac_updated": null, "poc_updated": "2016-03-14T21:46:47Z", "policy_url": "", "policy_general": "Selective", "policy_locations": "Not Required", "policy_ratio": false, "policy_contracts": "Not Required", "allow_ixp_update": false, "status_dashboard": null, "rir_status": "ok", "rir_status_updated": "2022-07-27T05:29:57.260109Z", "created": "2012-11-09T06:06:08Z", "updated": "2022-07-27T05:33:20Z", "status": "ok"}, {"id": 2171, "org_id": 1989, "name": "ARIN", "aka": "American Registry for Internet Numbers", "name_long": "", "website": "https://www.arin.net", "asn": 10745, "looking_glass": "", "route_server": "", "irr_as_set": "", "info_type": "Non-Profit", "info_prefixes4": 5, "info_prefixes6": 0, "info_traffic": "20-100Mbps", "info_ratio": "Heavy Outbound", "info_scope": "Global", "info_unicast": true, "info_multicast": false, "info_ipv6": true, "info_never_via_route_servers": false, "ix_count": 1, "fac_count": 0, "notes": "4 Byte ASN supported (and peers sought!) at Equinix San Jose / Ashburn and the SIX in Seattle.", "netixlan_updated": "2021-09-22T00:07:15.642546Z", "netfac_updated": null, "poc_updated": "2020-06-18T19:16:19Z", "policy_url": "", "policy_general": "Open", "policy_locations": "Not Required", "policy_ratio": false, "policy_contracts": "Not Required", "allow_ixp_update": false, "status_dashboard": null, "rir_status": "ok", "rir_status_updated": "2022-07-27T05:29:57.260109Z", "created": "2009-02-10T18:20:28Z", "updated": "2022-07-27T05:33:33Z", "status": "ok"}], "meta": {}} \ No newline at end of file diff --git a/tests/static/test_enricher_irrdb.py b/tests/static/test_enricher_irrdb.py index 2d9ae57b..03dac4ed 100644 --- a/tests/static/test_enricher_irrdb.py +++ b/tests/static/test_enricher_irrdb.py @@ -20,9 +20,11 @@ import unittest import yaml +from pierky.arouteserver.tests.base import setup_requests_mock from pierky.arouteserver.builder import TemplateContextDumper from pierky.arouteserver.tests.mocked_env import MockedEnv + class TestIRRDBEnricher_Base(unittest.TestCase): GENERAL_SIMPLE = { @@ -64,9 +66,12 @@ def setup_builder(self, general, clients, ip_ver=4): def setUp(self, *patches): MockedEnv(base_dir=os.path.dirname(__file__), default=False, irr=True) self.temp_dir = tempfile.mkdtemp(suffix="arouteserver_unittest") + # Prevent actual calls to external APIs. + self.requests_mock = setup_requests_mock() def tearDown(self): MockedEnv.stopall() + self.requests_mock.stop() shutil.rmtree(self.temp_dir, ignore_errors=True) def write_file(self, name, dic): From 56a8070e37378bbc133b5a1085d61b912462b7df Mon Sep 17 00:00:00 2001 From: Pier Carlo Chiodi Date: Sun, 9 Oct 2022 14:40:04 +0200 Subject: [PATCH 4/5] OpenBGPD 7.7 --- .github/workflows/cicd.yml | 2 +- docs/FEATURES.rst | 2 +- pierky/arouteserver/builder.py | 2 +- pierky/arouteserver/tests/live_tests/openbgpd.py | 14 ++++++++++++-- 4 files changed, 15 insertions(+), 5 deletions(-) diff --git a/.github/workflows/cicd.yml b/.github/workflows/cicd.yml index 541a736c..679c907a 100644 --- a/.github/workflows/cicd.yml +++ b/.github/workflows/cicd.yml @@ -69,8 +69,8 @@ jobs: echo "$DOCKER_PASSWORD" | docker login --username "$DOCKER_USERNAME" --password-stdin docker pull pierky/bird:1.6.8 docker pull pierky/bird:2.0.10 - docker pull pierky/openbgpd:7.5 docker pull pierky/openbgpd:7.6 + docker pull pierky/openbgpd:7.7 docker pull pierky/exabgp:4.2.7 docker pull nlnetlabs/routinator:v0.8.3 env: diff --git a/docs/FEATURES.rst b/docs/FEATURES.rst index fdcd4357..19619ed5 100644 --- a/docs/FEATURES.rst +++ b/docs/FEATURES.rst @@ -33,7 +33,7 @@ How it works #. `Jinja2`_ built-in templates are used to render the final route server's configuration file. - Currently, **BIRD** (>= 1.6.3 up to 1.6.8), **BIRD v2** (starting from 2.0.7) and **OpenBGPD** (OpenBSD 6.1 up to 7.6 and also OpenBGPD Portable 6.5p1 up to 7.6) are supported, with almost `feature parity `__ between them. + Currently, **BIRD** (>= 1.6.3 up to 1.6.8), **BIRD v2** (starting from 2.0.7) and **OpenBGPD** (OpenBSD 6.1 up to 7.7 and also OpenBGPD Portable 6.5p1 up to 7.7) are supported, with almost `feature parity `__ between them. **Validation** and testing of the configurations generated with this tool are performed using the built-in **live tests** framework: `Docker`_ instances are used to simulate several scenarios and to validate the behaviour of the route server after configuring it with ARouteServer. More details on the `Live tests `__ section. diff --git a/pierky/arouteserver/builder.py b/pierky/arouteserver/builder.py index 7ec45cda..74d41af1 100644 --- a/pierky/arouteserver/builder.py +++ b/pierky/arouteserver/builder.py @@ -954,7 +954,7 @@ class OpenBGPDConfigBuilder(ConfigBuilder): AVAILABLE_VERSION = ["6.0", "6.1", "6.2", "6.3", "6.4", "6.5", "6.6", "6.7", "6.8", "6.9", "7.0", "7.1", "7.2", "7.3", "7.4", "7.5", - "7.6"] + "7.6", "7.7"] DEFAULT_VERSION = AVAILABLE_VERSION[-1] IGNORABLE_ISSUES = ConfigBuilder.IGNORABLE_ISSUES + \ diff --git a/pierky/arouteserver/tests/live_tests/openbgpd.py b/pierky/arouteserver/tests/live_tests/openbgpd.py index 6dec01e1..7b5e6d06 100644 --- a/pierky/arouteserver/tests/live_tests/openbgpd.py +++ b/pierky/arouteserver/tests/live_tests/openbgpd.py @@ -617,5 +617,15 @@ class OpenBGPD76PortableInstance(OpenBGPDPortableInstance): TARGET_VERSION = "7.6" -OpenBGPDPortablePreviousInstance = OpenBGPD75PortableInstance -OpenBGPDPortableLatestInstance = OpenBGPD76PortableInstance +class OpenBGPD77PortableInstance(OpenBGPDPortableInstance): + + DOCKER_IMAGE = "pierky/openbgpd:7.7" + + TAG = "openbgpd77p" + + BGP_SPEAKER_VERSION = "7.7" + TARGET_VERSION = "7.7" + + +OpenBGPDPortablePreviousInstance = OpenBGPD76PortableInstance +OpenBGPDPortableLatestInstance = OpenBGPD77PortableInstance From 5f874a6d547674c03701f6ca76e60a66c25c2db4 Mon Sep 17 00:00:00 2001 From: Pier Carlo Chiodi Date: Thu, 13 Oct 2022 08:01:49 +0200 Subject: [PATCH 5/5] Update docs, examples and tests --- README.rst | 2 +- docs/SUPPORTED_SPEAKERS_CI.txt | 68 +- examples/auto-config/bird4.conf | 8 +- examples/auto-config/openbgpd.conf | 2 +- examples/bird_hooks/bird4.conf | 4 +- examples/bird_hooks/bird6.conf | 2 +- examples/default/bird4.conf | 4 +- examples/default/bird6.conf | 2 +- examples/default/bird_v2.conf | 6 +- examples/default/openbgpd.conf | 2 +- examples/default/template-context | 93 +- examples/default/template-context4 | 93 +- examples/default/template-context6 | 93 +- examples/rich/bird4.conf | 8 +- examples/rich/bird6.conf | 4 +- examples/rich/bird_v2.conf | 10 +- examples/rich/openbgpd.conf | 20 +- examples/rich/template-context | 111 +- examples/rich/template-context4 | 97 +- examples/rich/template-context6 | 93 +- examples/rpki_rtr/bird_v2.conf | 12 +- tests/last | 1584 +-- tests/last.json | 2 +- tests/last_results/extres.last | 2 +- .../live_bird_hooks_example_bird1.last | 2 +- .../last_results/live_communities_bird1.last | 2 +- .../last_results/live_communities_bird2.last | 2 +- .../live_communities_openbgpd_portable.last | 70 +- tests/last_results/live_default_bird1.last | 2 +- tests/last_results/live_default_bird2.last | 2 +- .../live_default_openbgpd_portable.last | 26 +- tests/last_results/live_global_bird1.last | 2 +- tests/last_results/live_global_bird2.last | 2 +- .../live_global_openbgpd_portable.last | 724 +- tests/last_results/live_gshut_bird1.last | 2 +- tests/last_results/live_gshut_bird2.last | 2 +- .../live_gshut_openbgpd_portable.last | 38 +- tests/last_results/live_max_prefix_bird1.last | 2 +- tests/last_results/live_max_prefix_bird2.last | 2 +- .../live_max_prefix_openbgpd_portable.last | 38 +- .../last_results/live_path_hiding_bird1.last | 2 +- .../last_results/live_path_hiding_bird2.last | 2 +- .../live_path_hiding_openbgpd_portable.last | 110 +- .../last_results/live_rich_example_bird1.last | 2 +- .../last_results/live_rich_example_bird2.last | 2 +- .../live_rich_example_openbgpd_portable.last | 26 +- tests/last_results/live_rpki_bird1.last | 2 +- tests/last_results/live_rpki_bird2.last | 2 +- .../live_rpki_bov_comms_bird1.last | 2 +- .../live_rpki_bov_comms_bird2.last | 2 +- .../live_rpki_rtr_example_bird2.last | 2 +- ...ve_rpki_rtr_example_openbgpd_portable.last | 26 +- tests/last_results/live_tag_as_set_bird1.last | 2 +- tests/last_results/live_tag_as_set_bird2.last | 2 +- .../live_tag_as_set_openbgpd_portable.last | 366 +- .../live_tag_reject_policy_bird1.last | 2 +- .../live_tag_reject_policy_bird2.last | 2 +- ...e_tag_reject_policy_openbgpd_portable.last | 106 +- tests/last_results/static.last | 2 +- .../openbgpd76p.conf | 1887 +++ .../openbgpd77p.conf | 1887 +++ .../openbgpd76p.conf | 1887 +++ .../openbgpd77p.conf | 1887 +++ .../openbgpd77p/AS1.txt | 28 + .../openbgpd77p/AS131073.txt | 28 + .../openbgpd77p/AS2.txt | 7 + .../openbgpd77p/rs.txt | 49 + .../openbgpd77p/AS1.txt | 28 + .../openbgpd77p/AS131073.txt | 28 + .../openbgpd77p/AS2.txt | 7 + .../openbgpd77p/rs.txt | 49 + .../openbgpd76p.conf | 1273 ++ .../openbgpd77p.conf | 1273 ++ .../openbgpd76p.conf | 1273 ++ .../openbgpd77p.conf | 1273 ++ .../openbgpd77p/rs.txt | 0 .../openbgpd77p/rs.txt | 0 .../openbgpd76p.conf | 10254 ++++++++++++++++ .../openbgpd77p.conf | 10254 ++++++++++++++++ .../openbgpd76p.conf | 10254 ++++++++++++++++ .../openbgpd77p.conf | 10254 ++++++++++++++++ .../openbgpd76p/AS101.txt | 588 + .../openbgpd76p/AS1_1.txt | 350 + .../openbgpd76p/AS1_2.txt | 322 + .../openbgpd76p/AS2.txt | 406 + .../openbgpd76p/AS222.txt | 0 .../openbgpd76p/AS3.txt | 322 + .../openbgpd76p/AS4.txt | 266 + .../openbgpd76p/rs.txt | 847 ++ .../openbgpd77p/AS101.txt | 588 + .../openbgpd77p/AS1_1.txt | 350 + .../openbgpd77p/AS1_2.txt | 322 + .../openbgpd77p/AS2.txt | 406 + .../openbgpd77p/AS222.txt | 0 .../openbgpd77p/AS3.txt | 322 + .../openbgpd77p/AS4.txt | 266 + .../openbgpd77p/rs.txt | 847 ++ .../openbgpd76p/AS101.txt | 588 + .../openbgpd76p/AS1_1.txt | 357 + .../openbgpd76p/AS1_2.txt | 329 + .../openbgpd76p/AS2.txt | 413 + .../openbgpd76p/AS222.txt | 0 .../openbgpd76p/AS3.txt | 322 + .../openbgpd76p/AS4.txt | 266 + .../openbgpd76p/rs.txt | 868 ++ .../openbgpd77p/AS101.txt | 588 + .../openbgpd77p/AS1_1.txt | 357 + .../openbgpd77p/AS1_2.txt | 329 + .../openbgpd77p/AS2.txt | 413 + .../openbgpd77p/AS222.txt | 0 .../openbgpd77p/AS3.txt | 322 + .../openbgpd77p/AS4.txt | 266 + .../openbgpd77p/rs.txt | 868 ++ .../openbgpd76p.conf | 665 + .../openbgpd77p.conf | 665 + .../openbgpd77p/AS1.txt | 14 + .../openbgpd77p/AS2.txt | 14 + .../openbgpd77p/rs.txt | 28 + .../openbgpd76p.conf | 2263 ++++ .../openbgpd77p.conf | 2263 ++++ .../openbgpd76p.conf | 2263 ++++ .../openbgpd77p.conf | 2263 ++++ .../MaxPrefixScenario_BIRD2IPv4/bird2/AS2.txt | 14 - .../MaxPrefixScenario_BIRD2IPv6/bird2/AS1.txt | 14 - .../MaxPrefixScenario_BIRDIPv4/bird16/AS2.txt | 14 - .../openbgpd77p/AS1.txt | 0 .../openbgpd77p/AS2.txt | 0 .../openbgpd77p/AS3.txt | 0 .../openbgpd77p/AS4.txt | 0 .../openbgpd77p/rs.txt | 0 .../openbgpd77p/AS1.txt | 0 .../openbgpd77p/AS2.txt | 0 .../openbgpd77p/AS3.txt | 0 .../openbgpd77p/AS4.txt | 0 .../openbgpd77p/rs.txt | 0 .../openbgpd76p.conf | 2281 ++++ .../openbgpd77p.conf | 2281 ++++ .../openbgpd76p.conf | 2281 ++++ .../openbgpd77p.conf | 2281 ++++ .../openbgpd76p.conf | 2290 ++++ .../openbgpd77p.conf | 2290 ++++ .../openbgpd76p.conf | 2290 ++++ .../openbgpd77p.conf | 2290 ++++ .../openbgpd76p/AS1.txt | 7 + .../openbgpd76p/AS101.txt | 0 .../openbgpd76p/AS2.txt | 7 + .../openbgpd76p/AS3.txt | 0 .../openbgpd76p/AS4.txt | 7 + .../openbgpd76p/rs.txt | 14 + .../openbgpd77p/AS1.txt | 7 + .../openbgpd77p/AS101.txt | 0 .../openbgpd77p/AS2.txt | 7 + .../openbgpd77p/AS3.txt | 0 .../openbgpd77p/AS4.txt | 7 + .../openbgpd77p/rs.txt | 14 + .../openbgpd77p/AS1.txt | 7 + .../openbgpd77p/AS101.txt | 0 .../openbgpd77p/AS2.txt | 7 + .../openbgpd77p/AS3.txt | 0 .../openbgpd77p/AS4.txt | 7 + .../openbgpd77p/rs.txt | 14 + .../openbgpd76p/AS1.txt | 7 + .../openbgpd76p/AS101.txt | 0 .../openbgpd76p/AS2.txt | 0 .../openbgpd76p/AS3.txt | 0 .../openbgpd76p/AS4.txt | 7 + .../openbgpd76p/rs.txt | 7 + .../openbgpd77p/AS1.txt | 7 + .../openbgpd77p/AS101.txt | 0 .../openbgpd77p/AS2.txt | 0 .../openbgpd77p/AS3.txt | 0 .../openbgpd77p/AS4.txt | 7 + .../openbgpd77p/rs.txt | 7 + .../openbgpd77p/AS1.txt | 7 + .../openbgpd77p/AS101.txt | 0 .../openbgpd77p/AS2.txt | 0 .../openbgpd77p/AS3.txt | 0 .../openbgpd77p/AS4.txt | 7 + .../openbgpd77p/rs.txt | 7 + .../openbgpd68.conf | 2 +- .../openbgpd70.conf | 2 +- .../openbgpd76p.conf | 4015 ++++++ .../openbgpd77p.conf | 4015 ++++++ .../openbgpd68.conf | 2 +- .../openbgpd70.conf | 2 +- .../bird2.conf | 10 +- .../bird2.conf | 10 +- .../bird16.conf | 6 +- .../bird16.conf | 4 +- .../openbgpd77p/rs.txt | 0 .../openbgpd76p.conf | 1186 ++ .../openbgpd77p.conf | 1186 ++ .../openbgpd76p.conf | 1186 ++ .../openbgpd77p.conf | 1186 ++ .../openbgpd76p.conf | 802 ++ .../openbgpd77p.conf | 802 ++ .../openbgpd77p/AS1_1.txt | 0 .../openbgpd77p/rs.txt | 0 .../openbgpd76p.conf | 3557 ++++++ .../openbgpd77p.conf | 3557 ++++++ .../openbgpd76p.conf | 3557 ++++++ .../openbgpd77p.conf | 3557 ++++++ .../bird2.conf | 6 +- .../bird16.conf | 4 +- .../bird16.conf | 4 +- .../bird2.conf | 6 +- .../openbgpd76p.conf | 3741 ++++++ .../openbgpd77p.conf | 3741 ++++++ .../openbgpd76p.conf | 3741 ++++++ .../openbgpd77p.conf | 3741 ++++++ .../openbgpd77p/AS1.txt | 168 + .../openbgpd77p/AS2.txt | 70 + .../openbgpd77p/AS4.txt | 126 + .../openbgpd77p/AS5.txt | 147 + .../openbgpd77p/AS6.txt | 161 + .../openbgpd77p/rs.txt | 294 + .../openbgpd77p/AS1.txt | 168 + .../openbgpd77p/AS2.txt | 70 + .../openbgpd77p/AS4.txt | 126 + .../openbgpd77p/AS5.txt | 147 + .../openbgpd77p/AS6.txt | 161 + .../openbgpd77p/rs.txt | 294 + .../openbgpd77p/AS1.txt | 231 + .../openbgpd77p/AS2.txt | 133 + .../openbgpd77p/AS4.txt | 168 + .../openbgpd77p/AS5.txt | 189 + .../openbgpd77p/AS6.txt | 203 + .../openbgpd77p/rs.txt | 294 + .../openbgpd77p/AS1.txt | 231 + .../openbgpd77p/AS2.txt | 133 + .../openbgpd77p/AS4.txt | 168 + .../openbgpd77p/AS5.txt | 189 + .../openbgpd77p/AS6.txt | 203 + .../openbgpd77p/rs.txt | 294 + .../openbgpd76p.conf | 7608 ++++++++++++ .../openbgpd77p.conf | 7608 ++++++++++++ .../openbgpd77p/AS101.txt | 406 + .../openbgpd77p/AS1_1.txt | 280 + .../openbgpd77p/AS1_2.txt | 259 + .../openbgpd77p/AS2.txt | 350 + .../openbgpd77p/AS3.txt | 238 + .../openbgpd77p/rc.txt | 259 + .../openbgpd77p/rs.txt | 777 ++ 243 files changed, 162976 insertions(+), 2007 deletions(-) create mode 100644 tests/live_tests/scenarios/communities/configs/BGPCommunitiesScenario_OpenBGPDIPv4/openbgpd76p.conf create mode 100644 tests/live_tests/scenarios/communities/configs/BGPCommunitiesScenario_OpenBGPDIPv4/openbgpd77p.conf create mode 100644 tests/live_tests/scenarios/communities/configs/BGPCommunitiesScenario_OpenBGPDIPv6/openbgpd76p.conf create mode 100644 tests/live_tests/scenarios/communities/configs/BGPCommunitiesScenario_OpenBGPDIPv6/openbgpd77p.conf create mode 100644 tests/live_tests/scenarios/communities/routes/BGPCommunitiesScenario_OpenBGPDIPv4/openbgpd77p/AS1.txt create mode 100644 tests/live_tests/scenarios/communities/routes/BGPCommunitiesScenario_OpenBGPDIPv4/openbgpd77p/AS131073.txt create mode 100644 tests/live_tests/scenarios/communities/routes/BGPCommunitiesScenario_OpenBGPDIPv4/openbgpd77p/AS2.txt create mode 100644 tests/live_tests/scenarios/communities/routes/BGPCommunitiesScenario_OpenBGPDIPv4/openbgpd77p/rs.txt create mode 100644 tests/live_tests/scenarios/communities/routes/BGPCommunitiesScenario_OpenBGPDIPv6/openbgpd77p/AS1.txt create mode 100644 tests/live_tests/scenarios/communities/routes/BGPCommunitiesScenario_OpenBGPDIPv6/openbgpd77p/AS131073.txt create mode 100644 tests/live_tests/scenarios/communities/routes/BGPCommunitiesScenario_OpenBGPDIPv6/openbgpd77p/AS2.txt create mode 100644 tests/live_tests/scenarios/communities/routes/BGPCommunitiesScenario_OpenBGPDIPv6/openbgpd77p/rs.txt create mode 100644 tests/live_tests/scenarios/default/configs/DefaultConfigScenarioOpenBGPD_IPv4/openbgpd76p.conf create mode 100644 tests/live_tests/scenarios/default/configs/DefaultConfigScenarioOpenBGPD_IPv4/openbgpd77p.conf create mode 100644 tests/live_tests/scenarios/default/configs/DefaultConfigScenarioOpenBGPD_IPv6/openbgpd76p.conf create mode 100644 tests/live_tests/scenarios/default/configs/DefaultConfigScenarioOpenBGPD_IPv6/openbgpd77p.conf create mode 100644 tests/live_tests/scenarios/default/routes/DefaultConfigScenarioOpenBGPD_IPv4/openbgpd77p/rs.txt create mode 100644 tests/live_tests/scenarios/default/routes/DefaultConfigScenarioOpenBGPD_IPv6/openbgpd77p/rs.txt create mode 100644 tests/live_tests/scenarios/global/configs/BasicScenario_OpenBGPDIPv4/openbgpd76p.conf create mode 100644 tests/live_tests/scenarios/global/configs/BasicScenario_OpenBGPDIPv4/openbgpd77p.conf create mode 100644 tests/live_tests/scenarios/global/configs/BasicScenario_OpenBGPDIPv6/openbgpd76p.conf create mode 100644 tests/live_tests/scenarios/global/configs/BasicScenario_OpenBGPDIPv6/openbgpd77p.conf create mode 100644 tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd76p/AS101.txt create mode 100644 tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd76p/AS1_1.txt create mode 100644 tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd76p/AS1_2.txt create mode 100644 tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd76p/AS2.txt create mode 100644 tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd76p/AS222.txt create mode 100644 tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd76p/AS3.txt create mode 100644 tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd76p/AS4.txt create mode 100644 tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd76p/rs.txt create mode 100644 tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd77p/AS101.txt create mode 100644 tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd77p/AS1_1.txt create mode 100644 tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd77p/AS1_2.txt create mode 100644 tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd77p/AS2.txt create mode 100644 tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd77p/AS222.txt create mode 100644 tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd77p/AS3.txt create mode 100644 tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd77p/AS4.txt create mode 100644 tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd77p/rs.txt create mode 100644 tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd76p/AS101.txt create mode 100644 tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd76p/AS1_1.txt create mode 100644 tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd76p/AS1_2.txt create mode 100644 tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd76p/AS2.txt create mode 100644 tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd76p/AS222.txt create mode 100644 tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd76p/AS3.txt create mode 100644 tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd76p/AS4.txt create mode 100644 tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd76p/rs.txt create mode 100644 tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd77p/AS101.txt create mode 100644 tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd77p/AS1_1.txt create mode 100644 tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd77p/AS1_2.txt create mode 100644 tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd77p/AS2.txt create mode 100644 tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd77p/AS222.txt create mode 100644 tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd77p/AS3.txt create mode 100644 tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd77p/AS4.txt create mode 100644 tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd77p/rs.txt create mode 100644 tests/live_tests/scenarios/gshut/configs/GShutScenario_OpenBGPDIPv4/openbgpd76p.conf create mode 100644 tests/live_tests/scenarios/gshut/configs/GShutScenario_OpenBGPDIPv4/openbgpd77p.conf create mode 100644 tests/live_tests/scenarios/gshut/routes/GShutScenario_OpenBGPDIPv4/openbgpd77p/AS1.txt create mode 100644 tests/live_tests/scenarios/gshut/routes/GShutScenario_OpenBGPDIPv4/openbgpd77p/AS2.txt create mode 100644 tests/live_tests/scenarios/gshut/routes/GShutScenario_OpenBGPDIPv4/openbgpd77p/rs.txt create mode 100644 tests/live_tests/scenarios/max_prefix/configs/MaxPrefixScenario_OpenBGPDIPv4/openbgpd76p.conf create mode 100644 tests/live_tests/scenarios/max_prefix/configs/MaxPrefixScenario_OpenBGPDIPv4/openbgpd77p.conf create mode 100644 tests/live_tests/scenarios/max_prefix/configs/MaxPrefixScenario_OpenBGPDIPv6/openbgpd76p.conf create mode 100644 tests/live_tests/scenarios/max_prefix/configs/MaxPrefixScenario_OpenBGPDIPv6/openbgpd77p.conf create mode 100644 tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_OpenBGPDIPv4/openbgpd77p/AS1.txt create mode 100644 tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_OpenBGPDIPv4/openbgpd77p/AS2.txt create mode 100644 tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_OpenBGPDIPv4/openbgpd77p/AS3.txt create mode 100644 tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_OpenBGPDIPv4/openbgpd77p/AS4.txt create mode 100644 tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_OpenBGPDIPv4/openbgpd77p/rs.txt create mode 100644 tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_OpenBGPDIPv6/openbgpd77p/AS1.txt create mode 100644 tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_OpenBGPDIPv6/openbgpd77p/AS2.txt create mode 100644 tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_OpenBGPDIPv6/openbgpd77p/AS3.txt create mode 100644 tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_OpenBGPDIPv6/openbgpd77p/AS4.txt create mode 100644 tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_OpenBGPDIPv6/openbgpd77p/rs.txt create mode 100644 tests/live_tests/scenarios/path_hiding/configs/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd76p.conf create mode 100644 tests/live_tests/scenarios/path_hiding/configs/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd77p.conf create mode 100644 tests/live_tests/scenarios/path_hiding/configs/PathHidingScenario_MitigationOff_OpenBGPDIPv6/openbgpd76p.conf create mode 100644 tests/live_tests/scenarios/path_hiding/configs/PathHidingScenario_MitigationOff_OpenBGPDIPv6/openbgpd77p.conf create mode 100644 tests/live_tests/scenarios/path_hiding/configs/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd76p.conf create mode 100644 tests/live_tests/scenarios/path_hiding/configs/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd77p.conf create mode 100644 tests/live_tests/scenarios/path_hiding/configs/PathHidingScenario_MitigationOn_OpenBGPDIPv6/openbgpd76p.conf create mode 100644 tests/live_tests/scenarios/path_hiding/configs/PathHidingScenario_MitigationOn_OpenBGPDIPv6/openbgpd77p.conf create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd76p/AS1.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd76p/AS101.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd76p/AS2.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd76p/AS3.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd76p/AS4.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd76p/rs.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd77p/AS1.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd77p/AS101.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd77p/AS2.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd77p/AS3.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd77p/AS4.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd77p/rs.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv6/openbgpd77p/AS1.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv6/openbgpd77p/AS101.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv6/openbgpd77p/AS2.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv6/openbgpd77p/AS3.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv6/openbgpd77p/AS4.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv6/openbgpd77p/rs.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd76p/AS1.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd76p/AS101.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd76p/AS2.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd76p/AS3.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd76p/AS4.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd76p/rs.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd77p/AS1.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd77p/AS101.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd77p/AS2.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd77p/AS3.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd77p/AS4.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd77p/rs.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv6/openbgpd77p/AS1.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv6/openbgpd77p/AS101.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv6/openbgpd77p/AS2.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv6/openbgpd77p/AS3.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv6/openbgpd77p/AS4.txt create mode 100644 tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv6/openbgpd77p/rs.txt create mode 100644 tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenarioOpenBGPD_IPv4/openbgpd76p.conf create mode 100644 tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenarioOpenBGPD_IPv4/openbgpd77p.conf create mode 100644 tests/live_tests/scenarios/rich_example/routes/RichConfigExampleScenarioOpenBGPD_IPv4/openbgpd77p/rs.txt create mode 100644 tests/live_tests/scenarios/rpki_bov_comms/configs/RPKICustomBOVCommunitiesScenario_OpenBGPDPortableLatest_IPv4/openbgpd76p.conf create mode 100644 tests/live_tests/scenarios/rpki_bov_comms/configs/RPKICustomBOVCommunitiesScenario_OpenBGPDPortableLatest_IPv4/openbgpd77p.conf create mode 100644 tests/live_tests/scenarios/rpki_bov_comms/configs/RPKICustomBOVCommunitiesScenario_OpenBGPDPortableLatest_IPv6/openbgpd76p.conf create mode 100644 tests/live_tests/scenarios/rpki_bov_comms/configs/RPKICustomBOVCommunitiesScenario_OpenBGPDPortableLatest_IPv6/openbgpd77p.conf create mode 100644 tests/live_tests/scenarios/rpki_rtr_example/configs/RPKIRTRScenario_OpenBGPDIPv4/openbgpd76p.conf create mode 100644 tests/live_tests/scenarios/rpki_rtr_example/configs/RPKIRTRScenario_OpenBGPDIPv4/openbgpd77p.conf create mode 100644 tests/live_tests/scenarios/rpki_rtr_example/routes/RPKIRTRScenario_OpenBGPDIPv4/openbgpd77p/AS1_1.txt create mode 100644 tests/live_tests/scenarios/rpki_rtr_example/routes/RPKIRTRScenario_OpenBGPDIPv4/openbgpd77p/rs.txt create mode 100644 tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv4/openbgpd76p.conf create mode 100644 tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv4/openbgpd77p.conf create mode 100644 tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv6/openbgpd76p.conf create mode 100644 tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv6/openbgpd77p.conf create mode 100644 tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_WithAS_SETs_OpenBGPDIPv4/openbgpd76p.conf create mode 100644 tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_WithAS_SETs_OpenBGPDIPv4/openbgpd77p.conf create mode 100644 tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_WithAS_SETs_OpenBGPDIPv6/openbgpd76p.conf create mode 100644 tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_WithAS_SETs_OpenBGPDIPv6/openbgpd77p.conf create mode 100644 tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv4/openbgpd77p/AS1.txt create mode 100644 tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv4/openbgpd77p/AS2.txt create mode 100644 tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv4/openbgpd77p/AS4.txt create mode 100644 tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv4/openbgpd77p/AS5.txt create mode 100644 tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv4/openbgpd77p/AS6.txt create mode 100644 tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv4/openbgpd77p/rs.txt create mode 100644 tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv6/openbgpd77p/AS1.txt create mode 100644 tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv6/openbgpd77p/AS2.txt create mode 100644 tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv6/openbgpd77p/AS4.txt create mode 100644 tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv6/openbgpd77p/AS5.txt create mode 100644 tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv6/openbgpd77p/AS6.txt create mode 100644 tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv6/openbgpd77p/rs.txt create mode 100644 tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv4/openbgpd77p/AS1.txt create mode 100644 tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv4/openbgpd77p/AS2.txt create mode 100644 tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv4/openbgpd77p/AS4.txt create mode 100644 tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv4/openbgpd77p/AS5.txt create mode 100644 tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv4/openbgpd77p/AS6.txt create mode 100644 tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv4/openbgpd77p/rs.txt create mode 100644 tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv6/openbgpd77p/AS1.txt create mode 100644 tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv6/openbgpd77p/AS2.txt create mode 100644 tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv6/openbgpd77p/AS4.txt create mode 100644 tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv6/openbgpd77p/AS5.txt create mode 100644 tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv6/openbgpd77p/AS6.txt create mode 100644 tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv6/openbgpd77p/rs.txt create mode 100644 tests/live_tests/scenarios/tag_reject_policy/configs/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd76p.conf create mode 100644 tests/live_tests/scenarios/tag_reject_policy/configs/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd77p.conf create mode 100644 tests/live_tests/scenarios/tag_reject_policy/routes/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd77p/AS101.txt create mode 100644 tests/live_tests/scenarios/tag_reject_policy/routes/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd77p/AS1_1.txt create mode 100644 tests/live_tests/scenarios/tag_reject_policy/routes/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd77p/AS1_2.txt create mode 100644 tests/live_tests/scenarios/tag_reject_policy/routes/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd77p/AS2.txt create mode 100644 tests/live_tests/scenarios/tag_reject_policy/routes/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd77p/AS3.txt create mode 100644 tests/live_tests/scenarios/tag_reject_policy/routes/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd77p/rc.txt create mode 100644 tests/live_tests/scenarios/tag_reject_policy/routes/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd77p/rs.txt diff --git a/README.rst b/README.rst index be0b5de3..9603b5c1 100644 --- a/README.rst +++ b/README.rst @@ -43,7 +43,7 @@ How it works #. `Jinja2`_ built-in templates are used to render the final route server's configuration file. - Currently, **BIRD** (>= 1.6.3 up to 1.6.8), **BIRD v2** (starting from 2.0.7) and **OpenBGPD** (OpenBSD 6.1 up to 7.5 and also OpenBGPD Portable 6.5p1 up to 7.5) are supported, with almost `feature parity `__ between them. + Currently, **BIRD** (>= 1.6.3 up to 1.6.8), **BIRD v2** (starting from 2.0.7) and **OpenBGPD** (OpenBSD 6.1 up to 7.7 and also OpenBGPD Portable 6.5p1 up to 7.7) are supported, with almost `feature parity `__ between them. **Validation** and testing of the configurations generated with this tool are performed using the built-in **live tests** framework: `Docker`_ instances are used to simulate several scenarios and to validate the behaviour of the route server after configuring it with ARouteServer. More details on the `Live tests `__ section. diff --git a/docs/SUPPORTED_SPEAKERS_CI.txt b/docs/SUPPORTED_SPEAKERS_CI.txt index 5ba9a7db..b4b30886 100644 --- a/docs/SUPPORTED_SPEAKERS_CI.txt +++ b/docs/SUPPORTED_SPEAKERS_CI.txt @@ -7,7 +7,7 @@ Total test cases per BGP speaker **BGP speaker** **Total** **Passed ✔** **Failed ✖** **Skipped** BIRD 816 807 0 9 BIRD v2 820 811 0 9 -OpenBGPD 7.5 442 439 0 3 +OpenBGPD 7.7 442 439 0 3 =============== ========= ============ ============ =========== Scenarios @@ -17,7 +17,7 @@ Scenarios ++++++++++++++++++++++++++++++++++ ========================================== ======== =========== ================ -**Test** **BIRD** **BIRD v2** **OpenBGPD 7.5** +**Test** **BIRD** **BIRD v2** **OpenBGPD 7.7** AS_PATH too long ✔ ✔ ✔ RPKI INVALID route ✔ ✔ ✔ bogon prefix ✔ ✔ ✔ @@ -44,7 +44,7 @@ transit-free ASN in AS_PATH ✔ ✔ ✔ ++++++++++++++++++++++++++++++++++ ========================================== ======== =========== ================ -**Test** **BIRD** **BIRD v2** **OpenBGPD 7.5** +**Test** **BIRD** **BIRD v2** **OpenBGPD 7.7** AS_PATH too long ✔ ✔ ✔ RPKI INVALID route ✔ ✔ ✔ bogon prefix ✔ ✔ ✔ @@ -71,7 +71,7 @@ BGP communities, IPv4 +++++++++++++++++++++ =============================== ======== =========== ================ -**Test** **BIRD** **BIRD v2** **OpenBGPD 7.5** +**Test** **BIRD** **BIRD v2** **OpenBGPD 7.7** announce to AS1 only (ext) ✔ ✔ ✔ announce to AS1 only (lrg) ✔ ✔ ✔ announce to AS1 only (std) ✔ ✔ ✔ @@ -89,7 +89,7 @@ BGP communities, IPv6 +++++++++++++++++++++ =============================== ======== =========== ================ -**Test** **BIRD** **BIRD v2** **OpenBGPD 7.5** +**Test** **BIRD** **BIRD v2** **OpenBGPD 7.7** announce to AS1 only (ext) ✔ ✔ ✔ announce to AS1 only (lrg) ✔ ✔ ✔ announce to AS1 only (std) ✔ ✔ ✔ @@ -107,7 +107,7 @@ BOV custom comms, IPv4 ++++++++++++++++++++++ =================================== ======== =========== ================ -**Test** **BIRD** **BIRD v2** **OpenBGPD 7.5** +**Test** **BIRD** **BIRD v2** **OpenBGPD 7.7** RPKI, AS2 invalid prefix, bad ASN ✔ ✔ RPKI, AS2 valid prefix, exact match ✔ ✔ log contains errors ✔ ✔ @@ -118,7 +118,7 @@ BOV custom comms, IPv6 ++++++++++++++++++++++ =================================== ======== =========== ================ -**Test** **BIRD** **BIRD v2** **OpenBGPD 7.5** +**Test** **BIRD** **BIRD v2** **OpenBGPD 7.7** RPKI, AS2 invalid prefix, bad ASN ✔ ✔ RPKI, AS2 valid prefix, exact match ✔ ✔ log contains errors ✔ ✔ @@ -129,7 +129,7 @@ RPKI INVALID tagging, IPv4 ++++++++++++++++++++++++++ ==================================== ======== =========== ================ -**Test** **BIRD** **BIRD v2** **OpenBGPD 7.5** +**Test** **BIRD** **BIRD v2** **OpenBGPD 7.7** RPKI, AS2 invalid prefix, bad ASN ✔ ✔ RPKI, AS2 invalid prefix, bad length ✔ ✔ RPKI, AS2 unknown prefix ✔ ✔ @@ -148,7 +148,7 @@ RPKI INVALID tagging, IPv6 ++++++++++++++++++++++++++ ==================================== ======== =========== ================ -**Test** **BIRD** **BIRD v2** **OpenBGPD 7.5** +**Test** **BIRD** **BIRD v2** **OpenBGPD 7.7** RPKI, AS2 invalid prefix, bad ASN ✔ ✔ RPKI, AS2 invalid prefix, bad length ✔ ✔ RPKI, AS2 unknown prefix ✔ ✔ @@ -167,7 +167,7 @@ RTR protocol ++++++++++++ ================================================================== ======== =========== ================ -**Test** **BIRD** **BIRD v2** **OpenBGPD 7.5** +**Test** **BIRD** **BIRD v2** **OpenBGPD 7.7** check the RTR session is up ✔ ✔ log contains errors ✔ ✔ restart OpenBGPD to speed up RTR session establishment ✔ @@ -181,7 +181,7 @@ default config, IPv4 ++++++++++++++++++++ =================== ======== =========== ================ -**Test** **BIRD** **BIRD v2** **OpenBGPD 7.5** +**Test** **BIRD** **BIRD v2** **OpenBGPD 7.7** log contains errors ✔ ✔ ✔ =================== ======== =========== ================ @@ -189,7 +189,7 @@ default config, IPv6 ++++++++++++++++++++ =================== ======== =========== ================ -**Test** **BIRD** **BIRD v2** **OpenBGPD 7.5** +**Test** **BIRD** **BIRD v2** **OpenBGPD 7.7** log contains errors ✔ ✔ ✔ =================== ======== =========== ================ @@ -197,7 +197,7 @@ examples, rich config, IPv4 +++++++++++++++++++++++++++ =================== ======== =========== ================ -**Test** **BIRD** **BIRD v2** **OpenBGPD 7.5** +**Test** **BIRD** **BIRD v2** **OpenBGPD 7.7** log contains errors ✔ ✔ ✔ =================== ======== =========== ================ @@ -205,7 +205,7 @@ examples, rich config, IPv6 +++++++++++++++++++++++++++ =================== ======== =========== ================ -**Test** **BIRD** **BIRD v2** **OpenBGPD 7.5** +**Test** **BIRD** **BIRD v2** **OpenBGPD 7.7** log contains errors ✔ ✔ ✔ =================== ======== =========== ================ @@ -213,7 +213,7 @@ global scenario, IPv4 +++++++++++++++++++++ =============================================================================== ======== =========== ================ -**Test** **BIRD** **BIRD v2** **OpenBGPD 7.5** +**Test** **BIRD** **BIRD v2** **OpenBGPD 7.7** RPKI, blackhole request for a covered prefix ✔ ✔ ✔ RPKI, invalid prefix (bad ASN) not propagated to clients ✔ ✔ ✔ RPKI, invalid prefix (bad ASN) received by rs ✔ ✔ ✔ @@ -304,7 +304,7 @@ global scenario, IPv4, tag ++++++++++++++++++++++++++ =============================================================================== ======== =========== ================ -**Test** **BIRD** **BIRD v2** **OpenBGPD 7.5** +**Test** **BIRD** **BIRD v2** **OpenBGPD 7.7** RPKI, blackhole request for a covered prefix ✔ ✔ RPKI, invalid prefix (bad ASN) not propagated to clients ✔ ✔ RPKI, invalid prefix (bad ASN) received by rs ✔ ✔ @@ -395,7 +395,7 @@ global scenario, IPv4, tag&reject +++++++++++++++++++++++++++++++++ =============================================================================== ======== =========== ================ -**Test** **BIRD** **BIRD v2** **OpenBGPD 7.5** +**Test** **BIRD** **BIRD v2** **OpenBGPD 7.7** RPKI, blackhole request for a covered prefix ✔ ✔ RPKI, invalid prefix (bad ASN) not propagated to clients ✔ ✔ RPKI, invalid prefix (bad ASN) received by rs ✔ ✔ @@ -486,7 +486,7 @@ global scenario, IPv6 +++++++++++++++++++++ =============================================================================== ======== =========== ================ -**Test** **BIRD** **BIRD v2** **OpenBGPD 7.5** +**Test** **BIRD** **BIRD v2** **OpenBGPD 7.7** RPKI, blackhole request for a covered prefix ✔ ✔ ✔ RPKI, invalid prefix (bad ASN) not propagated to clients ✔ ✔ ✔ RPKI, invalid prefix (bad ASN) received by rs ✔ ✔ ✔ @@ -577,7 +577,7 @@ global scenario, IPv6, tag ++++++++++++++++++++++++++ =============================================================================== ======== =========== ================ -**Test** **BIRD** **BIRD v2** **OpenBGPD 7.5** +**Test** **BIRD** **BIRD v2** **OpenBGPD 7.7** RPKI, blackhole request for a covered prefix ✔ ✔ RPKI, invalid prefix (bad ASN) not propagated to clients ✔ ✔ RPKI, invalid prefix (bad ASN) received by rs ✔ ✔ @@ -668,7 +668,7 @@ global scenario, IPv6, tag&reject +++++++++++++++++++++++++++++++++ =============================================================================== ======== =========== ================ -**Test** **BIRD** **BIRD v2** **OpenBGPD 7.5** +**Test** **BIRD** **BIRD v2** **OpenBGPD 7.7** RPKI, blackhole request for a covered prefix ✔ ✔ RPKI, invalid prefix (bad ASN) not propagated to clients ✔ ✔ RPKI, invalid prefix (bad ASN) received by rs ✔ ✔ @@ -759,7 +759,7 @@ gshut, IPv4 +++++++++++ ==================================================== ======== =========== ================ -**Test** **BIRD** **BIRD v2** **OpenBGPD 7.5** +**Test** **BIRD** **BIRD v2** **OpenBGPD 7.7** clients receive routes tagged with GRACEFUL_SHUTDOWN ✔ ✔ ✔ log contains errors ✔ ✔ ✔ reconfigure ✔ ✔ ✔ @@ -769,7 +769,7 @@ gshut, IPv6 +++++++++++ ==================================================== ======== =========== ================ -**Test** **BIRD** **BIRD v2** **OpenBGPD 7.5** +**Test** **BIRD** **BIRD v2** **OpenBGPD 7.7** clients receive routes tagged with GRACEFUL_SHUTDOWN ✔ ✔ ✔ log contains errors ✔ ✔ ✔ reconfigure ✔ ✔ ✔ @@ -779,7 +779,7 @@ hooks example, IPv4 +++++++++++++++++++ =================== ======== =========== ================ -**Test** **BIRD** **BIRD v2** **OpenBGPD 7.5** +**Test** **BIRD** **BIRD v2** **OpenBGPD 7.7** log contains errors ✔ =================== ======== =========== ================ @@ -787,7 +787,7 @@ hooks example, IPv6 +++++++++++++++++++ =================== ======== =========== ================ -**Test** **BIRD** **BIRD v2** **OpenBGPD 7.5** +**Test** **BIRD** **BIRD v2** **OpenBGPD 7.7** log contains errors ✔ =================== ======== =========== ================ @@ -795,7 +795,7 @@ max-prefix, IPv4 ++++++++++++++++ ================================================================ ======== =========== ================ -**Test** **BIRD** **BIRD v2** **OpenBGPD 7.5** +**Test** **BIRD** **BIRD v2** **OpenBGPD 7.7** AS5 session is down (max-prefix hit, action == shutdown) ✔ ✔ clients log max-prefix notification ✔ log contains errors ✔ ✔ ✔ @@ -815,7 +815,7 @@ max-prefix, IPv6 ++++++++++++++++ ================================================================ ======== =========== ================ -**Test** **BIRD** **BIRD v2** **OpenBGPD 7.5** +**Test** **BIRD** **BIRD v2** **OpenBGPD 7.7** AS5 session is down (max-prefix hit, action == shutdown) ✔ ✔ clients log max-prefix notification ✔ log contains errors ✔ ✔ ✔ @@ -835,7 +835,7 @@ path hiding, mitigation off, IPv4 +++++++++++++++++++++++++++++++++ =================================================== ======== =========== ================ -**Test** **BIRD** **BIRD v2** **OpenBGPD 7.5** +**Test** **BIRD** **BIRD v2** **OpenBGPD 7.7** AS1 wants rs to not announce to AS3 and AS4 ✔ ✔ ✔ AS3 does not receive prefix at all ✔ ✔ ✔ AS4 receives the prefix via AS2 because of ADD-PATH ✔ ✔ ✔ @@ -849,7 +849,7 @@ path hiding, mitigation off, IPv6 +++++++++++++++++++++++++++++++++ =================================================== ======== =========== ================ -**Test** **BIRD** **BIRD v2** **OpenBGPD 7.5** +**Test** **BIRD** **BIRD v2** **OpenBGPD 7.7** AS1 wants rs to not announce to AS3 and AS4 ✔ ✔ ✔ AS3 does not receive prefix at all ✔ ✔ ✔ AS4 receives the prefix via AS2 because of ADD-PATH ✔ ✔ ✔ @@ -863,7 +863,7 @@ path hiding, mitigation on, IPv4 ++++++++++++++++++++++++++++++++ ======================================================== ======== =========== ================ -**Test** **BIRD** **BIRD v2** **OpenBGPD 7.5** +**Test** **BIRD** **BIRD v2** **OpenBGPD 7.7** 2nd best is withdrawn and AS3 should not see it anymore skip skip ✔ AS1 wants rs to not announce to AS3 and AS4 ✔ ✔ ✔ AS3 and AS4 don't receive prefix via AS1 ✔ ✔ ✔ @@ -878,7 +878,7 @@ path hiding, mitigation on, IPv6 ++++++++++++++++++++++++++++++++ ======================================================== ======== =========== ================ -**Test** **BIRD** **BIRD v2** **OpenBGPD 7.5** +**Test** **BIRD** **BIRD v2** **OpenBGPD 7.7** 2nd best is withdrawn and AS3 should not see it anymore skip skip ✔ AS1 wants rs to not announce to AS3 and AS4 ✔ ✔ ✔ AS3 and AS4 don't receive prefix via AS1 ✔ ✔ ✔ @@ -893,7 +893,7 @@ tag prefix/origin empty AS-SET, IPv4 ++++++++++++++++++++++++++++++++++++ ====================================================================================== ======== =========== ================ -**Test** **BIRD** **BIRD v2** **OpenBGPD 7.5** +**Test** **BIRD** **BIRD v2** **OpenBGPD 7.7** AS2 ARIN Whois DB: tag only (w/o prefix_validated_via_arin_whois_db_dump) ✔ ✔ ✔ AS2 ROA + ARIN Whois DB: tag only (w/o comms [arin_whois_db_dump, rpki_roas]) ✔ ✔ ✔ AS2 RPKI ROAs as route objects: tag only (w/o prefix_validated_via_rpki_roas) ✔ ✔ ✔ @@ -935,7 +935,7 @@ tag prefix/origin empty AS-SET, IPv6 ++++++++++++++++++++++++++++++++++++ ====================================================================================== ======== =========== ================ -**Test** **BIRD** **BIRD v2** **OpenBGPD 7.5** +**Test** **BIRD** **BIRD v2** **OpenBGPD 7.7** AS2 ARIN Whois DB: tag only (w/o prefix_validated_via_arin_whois_db_dump) ✔ ✔ ✔ AS2 ROA + ARIN Whois DB: tag only (w/o comms [arin_whois_db_dump, rpki_roas]) ✔ ✔ ✔ AS2 RPKI ROAs as route objects: tag only (w/o prefix_validated_via_rpki_roas) ✔ ✔ ✔ @@ -977,7 +977,7 @@ tag prefix/origin in AS-SET, IPv4 +++++++++++++++++++++++++++++++++ ======================================================================================== ======== =========== ================ -**Test** **BIRD** **BIRD v2** **OpenBGPD 7.5** +**Test** **BIRD** **BIRD v2** **OpenBGPD 7.7** AS2 ARIN Whois DB: tag only (w/ prefix_validated_via_arin_whois_db_dump) ✔ ✔ ✔ AS2 ROA + ARIN Whois DB: tag only (w/ comms [arin_whois_db_dump, rpki_roas]) ✔ ✔ ✔ AS2 RPKI ROAs as route objects: tag only (w/ prefix_validated_via_rpki_roas) ✔ ✔ ✔ @@ -1028,7 +1028,7 @@ tag prefix/origin in AS-SET, IPv6 +++++++++++++++++++++++++++++++++ ======================================================================================== ======== =========== ================ -**Test** **BIRD** **BIRD v2** **OpenBGPD 7.5** +**Test** **BIRD** **BIRD v2** **OpenBGPD 7.7** AS2 ARIN Whois DB: tag only (w/ prefix_validated_via_arin_whois_db_dump) ✔ ✔ ✔ AS2 ROA + ARIN Whois DB: tag only (w/ comms [arin_whois_db_dump, rpki_roas]) ✔ ✔ ✔ AS2 RPKI ROAs as route objects: tag only (w/ prefix_validated_via_rpki_roas) ✔ ✔ ✔ diff --git a/examples/auto-config/bird4.conf b/examples/auto-config/bird4.conf index 8ba00d76..fe894bc7 100644 --- a/examples/auto-config/bird4.conf +++ b/examples/auto-config/bird4.conf @@ -74,10 +74,10 @@ define AS_SET_AS_RIPENCC_prefixes_4 = [ # ARIN Whois database records define ARIN_Whois_db_AS10745_4 = [ - 192.136.136.0/24{24,32}, 199.43.0.0/24{24,32}, 192.149.252.0/24{24,32} + 192.149.252.0/24{24,32}, 199.43.0.0/24{24,32}, 192.136.136.0/24{24,32} ]; define ARIN_Whois_db_AS12654_4 = [ - 23.128.25.0/24{24,32}, 23.128.124.0/24{24,32}, 23.128.125.0/24{24,32}, 23.128.24.0/24{24,32} + 23.128.24.0/24{24,32}, 23.128.125.0/24{24,32}, 23.128.124.0/24{24,32}, 23.128.25.0/24{24,32} ]; @@ -813,7 +813,7 @@ filter receive_from_AS10745_1 { { tag_and_reject(8, 10745); reject "AS_PATH [", bgp_path ,"] contains transit-free ASN - REJECTING ", net; } # AS_PATH: never via route-servers ASNs - if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338] then + if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 12926, 13030, 13032, 13941, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 26068, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 47584, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 52990, 53859, 54295, 54574, 55244, 57433, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149391, 149663, 149826, 201978, 202561, 202793, 203133, 203283, 206275, 207353, 207484, 208425, 209310, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 398395, 399338] then { tag_and_reject(15, 10745); reject "AS_PATH [", bgp_path ,"] contains never via route-servers ASN - REJECTING ", net; } @@ -1035,7 +1035,7 @@ filter receive_from_AS3333_1 { { tag_and_reject(8, 3333); reject "AS_PATH [", bgp_path ,"] contains transit-free ASN - REJECTING ", net; } # AS_PATH: never via route-servers ASNs - if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338] then + if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 12926, 13030, 13032, 13941, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 26068, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 47584, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 52990, 53859, 54295, 54574, 55244, 57433, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149391, 149663, 149826, 201978, 202561, 202793, 203133, 203283, 206275, 207353, 207484, 208425, 209310, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 398395, 399338] then { tag_and_reject(15, 3333); reject "AS_PATH [", bgp_path ,"] contains never via route-servers ASN - REJECTING ", net; } diff --git a/examples/auto-config/openbgpd.conf b/examples/auto-config/openbgpd.conf index 8f59a10a..88cfa301 100644 --- a/examples/auto-config/openbgpd.conf +++ b/examples/auto-config/openbgpd.conf @@ -237,7 +237,7 @@ prefix-set "bogons" { # never via route-servers ASNs as-set "neverviarouteserver" { - 92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338 + 92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 12926, 13030, 13032, 13941, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 26068, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 47584, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 52990, 53859, 54295, 54574, 55244, 57433, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149391, 149663, 149826, 201978, 202561, 202793, 203133, 203283, 206275, 207353, 207484, 208425, 209310, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 398395, 399338 } # ===================================================================================== diff --git a/examples/bird_hooks/bird4.conf b/examples/bird_hooks/bird4.conf index ed2b876f..0a308341 100644 --- a/examples/bird_hooks/bird4.conf +++ b/examples/bird_hooks/bird4.conf @@ -567,7 +567,7 @@ filter receive_from_AS10745_1 { # AS_PATH: never via route-servers ASNs - if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338] then + if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 12926, 13030, 13032, 13941, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 26068, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 47584, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 52990, 53859, 54295, 54574, 55244, 57433, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149391, 149663, 149826, 201978, 202561, 202793, 203133, 203283, 206275, 207353, 207484, 208425, 209310, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 398395, 399338] then reject "AS_PATH [", bgp_path ,"] contains never via route-servers ASN - REJECTING ", net; @@ -769,7 +769,7 @@ filter receive_from_AS3333_1 { # AS_PATH: never via route-servers ASNs - if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338] then + if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 12926, 13030, 13032, 13941, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 26068, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 47584, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 52990, 53859, 54295, 54574, 55244, 57433, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149391, 149663, 149826, 201978, 202561, 202793, 203133, 203283, 206275, 207353, 207484, 208425, 209310, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 398395, 399338] then reject "AS_PATH [", bgp_path ,"] contains never via route-servers ASN - REJECTING ", net; diff --git a/examples/bird_hooks/bird6.conf b/examples/bird_hooks/bird6.conf index 148466bb..d15e23c8 100644 --- a/examples/bird_hooks/bird6.conf +++ b/examples/bird_hooks/bird6.conf @@ -605,7 +605,7 @@ filter receive_from_AS10745_2 { # AS_PATH: never via route-servers ASNs - if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338] then + if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 12926, 13030, 13032, 13941, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 26068, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 47584, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 52990, 53859, 54295, 54574, 55244, 57433, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149391, 149663, 149826, 201978, 202561, 202793, 203133, 203283, 206275, 207353, 207484, 208425, 209310, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 398395, 399338] then reject "AS_PATH [", bgp_path ,"] contains never via route-servers ASN - REJECTING ", net; diff --git a/examples/default/bird4.conf b/examples/default/bird4.conf index eae2f694..e556287a 100644 --- a/examples/default/bird4.conf +++ b/examples/default/bird4.conf @@ -301,7 +301,7 @@ filter receive_from_AS10745_1 { # AS_PATH: never via route-servers ASNs - if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338] then + if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 12926, 13030, 13032, 13941, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 26068, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 47584, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 52990, 53859, 54295, 54574, 55244, 57433, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149391, 149663, 149826, 201978, 202561, 202793, 203133, 203283, 206275, 207353, 207484, 208425, 209310, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 398395, 399338] then reject "AS_PATH [", bgp_path ,"] contains never via route-servers ASN - REJECTING ", net; @@ -465,7 +465,7 @@ filter receive_from_AS3333_1 { # AS_PATH: never via route-servers ASNs - if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338] then + if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 12926, 13030, 13032, 13941, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 26068, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 47584, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 52990, 53859, 54295, 54574, 55244, 57433, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149391, 149663, 149826, 201978, 202561, 202793, 203133, 203283, 206275, 207353, 207484, 208425, 209310, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 398395, 399338] then reject "AS_PATH [", bgp_path ,"] contains never via route-servers ASN - REJECTING ", net; diff --git a/examples/default/bird6.conf b/examples/default/bird6.conf index 38dbc473..684a6e8b 100644 --- a/examples/default/bird6.conf +++ b/examples/default/bird6.conf @@ -339,7 +339,7 @@ filter receive_from_AS10745_2 { # AS_PATH: never via route-servers ASNs - if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338] then + if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 12926, 13030, 13032, 13941, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 26068, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 47584, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 52990, 53859, 54295, 54574, 55244, 57433, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149391, 149663, 149826, 201978, 202561, 202793, 203133, 203283, 206275, 207353, 207484, 208425, 209310, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 398395, 399338] then reject "AS_PATH [", bgp_path ,"] contains never via route-servers ASN - REJECTING ", net; diff --git a/examples/default/bird_v2.conf b/examples/default/bird_v2.conf index 0a70c86f..bc0c67c5 100644 --- a/examples/default/bird_v2.conf +++ b/examples/default/bird_v2.conf @@ -419,7 +419,7 @@ filter receive_from_AS10745_1 { # AS_PATH: never via route-servers ASNs - if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338] then + if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 12926, 13030, 13032, 13941, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 26068, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 47584, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 52990, 53859, 54295, 54574, 55244, 57433, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149391, 149663, 149826, 201978, 202561, 202793, 203133, 203283, 206275, 207353, 207484, 208425, 209310, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 398395, 399338] then reject "AS_PATH [", bgp_path ,"] contains never via route-servers ASN - REJECTING ", net; @@ -594,7 +594,7 @@ filter receive_from_AS10745_2 { # AS_PATH: never via route-servers ASNs - if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338] then + if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 12926, 13030, 13032, 13941, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 26068, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 47584, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 52990, 53859, 54295, 54574, 55244, 57433, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149391, 149663, 149826, 201978, 202561, 202793, 203133, 203283, 206275, 207353, 207484, 208425, 209310, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 398395, 399338] then reject "AS_PATH [", bgp_path ,"] contains never via route-servers ASN - REJECTING ", net; @@ -773,7 +773,7 @@ filter receive_from_AS3333_1 { # AS_PATH: never via route-servers ASNs - if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338] then + if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 12926, 13030, 13032, 13941, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 26068, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 47584, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 52990, 53859, 54295, 54574, 55244, 57433, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149391, 149663, 149826, 201978, 202561, 202793, 203133, 203283, 206275, 207353, 207484, 208425, 209310, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 398395, 399338] then reject "AS_PATH [", bgp_path ,"] contains never via route-servers ASN - REJECTING ", net; diff --git a/examples/default/openbgpd.conf b/examples/default/openbgpd.conf index 14dc1d43..f39646b0 100644 --- a/examples/default/openbgpd.conf +++ b/examples/default/openbgpd.conf @@ -185,7 +185,7 @@ prefix-set "bogons" { # never via route-servers ASNs as-set "neverviarouteserver" { - 92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338 + 92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 12926, 13030, 13032, 13941, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 26068, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 47584, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 52990, 53859, 54295, 54574, 55244, 57433, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149391, 149663, 149826, 201978, 202561, 202793, 203133, 203283, 206275, 207353, 207484, 208425, 209310, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 398395, 399338 } # ===================================================================================== diff --git a/examples/default/template-context b/examples/default/template-context index b96372e0..27a5d5be 100644 --- a/examples/default/template-context +++ b/examples/default/template-context @@ -1050,22 +1050,31 @@ registrobr_whois_db_records never_via_route_servers_asns ---------------------------- -- 34209 - 6079 +- 7843 +- 1299 +- 3257 - 3265 -- 11670 - 8607 +- 6805 - 12322 - 6730 - 13030 - 3320 +- 1273 - 174 - 680 -- 8455 - 2152 +- 6830 - 3292 -- 35836 +- 5511 +- 8365 - 21396 +- 8075 +- 39326 +- 6908 +- 11164 +- 5432 - 2914 - 29169 - 16509 @@ -1073,69 +1082,56 @@ never_via_route_servers_asns - 20161 - 11260 - 34108 -- 7843 - 20115 - 39651 +- 48237 - 9908 - 15692 +- 47377 - 10013 - 8943 - 5391 -- 48237 - 37271 +- 714 - 12353 -- 6908 +- 8455 +- 12926 - 40029 -- 6830 -- 36459 -- 51530 -- 1273 - 57433 -- 39326 -- 27947 -- 714 -- 62567 -- 8075 -- 3257 -- 11164 -- 12822 -- 35900 -- 5511 -- 7155 -- 6805 -- 47377 - 57866 +- 36459 +- 7155 +- 12822 - 46450 -- 263801 - 17012 +- 263801 - 63290 -- 8365 -- 5432 - 278 +- 62567 - 202793 - 33983 +- 26068 - 134022 -- 43470 - 3754 -- 3630 - 135706 - 264424 - 132563 +- 11670 +- 3630 - 7862 - 48408 -- 137207 - 24282 - 265630 - 37529 - 131996 - 132829 -- 19237 -- 23961 +- 27947 +- 34209 - 263856 - 135848 -- 147059 +- 19237 - 24800 -- 62623 +- 54574 - 137610 - 34587 - 138023 @@ -1143,46 +1139,48 @@ never_via_route_servers_asns - 132996 - 30983 - 263258 +- 13941 - 396477 - 262191 - 54295 -- 18520 -- 14295 - 138953 - 58768 - 1955 - 328572 - 49127 - 393573 +- 18520 +- 14295 - 393684 - 269156 - 207353 - 209699 - 270544 - 328582 -- 267442 - 48265 - 328445 +- 398395 - 60412 - 207484 - 268091 - 270781 - 138769 -- 57468 -- 212953 - 270407 -- 133317 +- 209310 - 271053 - 270828 - 271172 +- 62623 - 140287 - 212706 - 212623 +- 43470 - 269367 - 36165 - 202561 - 213202 - 141120 +- 35836 - 141411 - 262888 - 131398 @@ -1191,7 +1189,6 @@ never_via_route_servers_asns - 53859 - 269654 - 141892 -- 1299 - 267214 - 62164 - 263686 @@ -1202,16 +1199,17 @@ never_via_route_servers_asns - 141140 - 271200 - 13032 +- 51530 - 31764 - 142369 +- 137207 - 142348 - 23888 -- 398203 - 141856 - 146846 - 146958 +- 398203 - 139667 -- 49922 - 47583 - 60757 - 269512 @@ -1221,6 +1219,7 @@ never_via_route_servers_asns - 55244 - 49910 - 92 +- 147059 - 136874 - 40063 - 149296 @@ -1230,15 +1229,23 @@ never_via_route_servers_asns - 272018 - 396304 - 269190 +- 35900 - 265337 - 201978 - 208425 - 212512 - 142164 - 149663 +- 23961 - 149826 - 210715 - 206275 - 272124 - 61756 +- 49922 - 267561 +- 47584 +- 52990 +- 203283 +- 203133 +- 149391 diff --git a/examples/default/template-context4 b/examples/default/template-context4 index 05cfde4a..55177790 100644 --- a/examples/default/template-context4 +++ b/examples/default/template-context4 @@ -1020,22 +1020,31 @@ registrobr_whois_db_records never_via_route_servers_asns ---------------------------- -- 34209 - 6079 +- 7843 +- 1299 +- 3257 - 3265 -- 11670 - 8607 +- 6805 - 12322 - 6730 - 13030 - 3320 +- 1273 - 174 - 680 -- 8455 - 2152 +- 6830 - 3292 -- 35836 +- 5511 +- 8365 - 21396 +- 8075 +- 39326 +- 6908 +- 11164 +- 5432 - 2914 - 29169 - 16509 @@ -1043,69 +1052,56 @@ never_via_route_servers_asns - 20161 - 11260 - 34108 -- 7843 - 20115 - 39651 +- 48237 - 9908 - 15692 +- 47377 - 10013 - 8943 - 5391 -- 48237 - 37271 +- 714 - 12353 -- 6908 +- 8455 +- 12926 - 40029 -- 6830 -- 36459 -- 51530 -- 1273 - 57433 -- 39326 -- 27947 -- 714 -- 62567 -- 8075 -- 3257 -- 11164 -- 12822 -- 35900 -- 5511 -- 7155 -- 6805 -- 47377 - 57866 +- 36459 +- 7155 +- 12822 - 46450 -- 263801 - 17012 +- 263801 - 63290 -- 8365 -- 5432 - 278 +- 62567 - 202793 - 33983 +- 26068 - 134022 -- 43470 - 3754 -- 3630 - 135706 - 264424 - 132563 +- 11670 +- 3630 - 7862 - 48408 -- 137207 - 24282 - 265630 - 37529 - 131996 - 132829 -- 19237 -- 23961 +- 27947 +- 34209 - 263856 - 135848 -- 147059 +- 19237 - 24800 -- 62623 +- 54574 - 137610 - 34587 - 138023 @@ -1113,46 +1109,48 @@ never_via_route_servers_asns - 132996 - 30983 - 263258 +- 13941 - 396477 - 262191 - 54295 -- 18520 -- 14295 - 138953 - 58768 - 1955 - 328572 - 49127 - 393573 +- 18520 +- 14295 - 393684 - 269156 - 207353 - 209699 - 270544 - 328582 -- 267442 - 48265 - 328445 +- 398395 - 60412 - 207484 - 268091 - 270781 - 138769 -- 57468 -- 212953 - 270407 -- 133317 +- 209310 - 271053 - 270828 - 271172 +- 62623 - 140287 - 212706 - 212623 +- 43470 - 269367 - 36165 - 202561 - 213202 - 141120 +- 35836 - 141411 - 262888 - 131398 @@ -1161,7 +1159,6 @@ never_via_route_servers_asns - 53859 - 269654 - 141892 -- 1299 - 267214 - 62164 - 263686 @@ -1172,16 +1169,17 @@ never_via_route_servers_asns - 141140 - 271200 - 13032 +- 51530 - 31764 - 142369 +- 137207 - 142348 - 23888 -- 398203 - 141856 - 146846 - 146958 +- 398203 - 139667 -- 49922 - 47583 - 60757 - 269512 @@ -1191,6 +1189,7 @@ never_via_route_servers_asns - 55244 - 49910 - 92 +- 147059 - 136874 - 40063 - 149296 @@ -1200,15 +1199,23 @@ never_via_route_servers_asns - 272018 - 396304 - 269190 +- 35900 - 265337 - 201978 - 208425 - 212512 - 142164 - 149663 +- 23961 - 149826 - 210715 - 206275 - 272124 - 61756 +- 49922 - 267561 +- 47584 +- 52990 +- 203283 +- 203133 +- 149391 diff --git a/examples/default/template-context6 b/examples/default/template-context6 index afcd5dc4..8a4f04f4 100644 --- a/examples/default/template-context6 +++ b/examples/default/template-context6 @@ -969,22 +969,31 @@ registrobr_whois_db_records never_via_route_servers_asns ---------------------------- -- 34209 - 6079 +- 7843 +- 1299 +- 3257 - 3265 -- 11670 - 8607 +- 6805 - 12322 - 6730 - 13030 - 3320 +- 1273 - 174 - 680 -- 8455 - 2152 +- 6830 - 3292 -- 35836 +- 5511 +- 8365 - 21396 +- 8075 +- 39326 +- 6908 +- 11164 +- 5432 - 2914 - 29169 - 16509 @@ -992,69 +1001,56 @@ never_via_route_servers_asns - 20161 - 11260 - 34108 -- 7843 - 20115 - 39651 +- 48237 - 9908 - 15692 +- 47377 - 10013 - 8943 - 5391 -- 48237 - 37271 +- 714 - 12353 -- 6908 +- 8455 +- 12926 - 40029 -- 6830 -- 36459 -- 51530 -- 1273 - 57433 -- 39326 -- 27947 -- 714 -- 62567 -- 8075 -- 3257 -- 11164 -- 12822 -- 35900 -- 5511 -- 7155 -- 6805 -- 47377 - 57866 +- 36459 +- 7155 +- 12822 - 46450 -- 263801 - 17012 +- 263801 - 63290 -- 8365 -- 5432 - 278 +- 62567 - 202793 - 33983 +- 26068 - 134022 -- 43470 - 3754 -- 3630 - 135706 - 264424 - 132563 +- 11670 +- 3630 - 7862 - 48408 -- 137207 - 24282 - 265630 - 37529 - 131996 - 132829 -- 19237 -- 23961 +- 27947 +- 34209 - 263856 - 135848 -- 147059 +- 19237 - 24800 -- 62623 +- 54574 - 137610 - 34587 - 138023 @@ -1062,46 +1058,48 @@ never_via_route_servers_asns - 132996 - 30983 - 263258 +- 13941 - 396477 - 262191 - 54295 -- 18520 -- 14295 - 138953 - 58768 - 1955 - 328572 - 49127 - 393573 +- 18520 +- 14295 - 393684 - 269156 - 207353 - 209699 - 270544 - 328582 -- 267442 - 48265 - 328445 +- 398395 - 60412 - 207484 - 268091 - 270781 - 138769 -- 57468 -- 212953 - 270407 -- 133317 +- 209310 - 271053 - 270828 - 271172 +- 62623 - 140287 - 212706 - 212623 +- 43470 - 269367 - 36165 - 202561 - 213202 - 141120 +- 35836 - 141411 - 262888 - 131398 @@ -1110,7 +1108,6 @@ never_via_route_servers_asns - 53859 - 269654 - 141892 -- 1299 - 267214 - 62164 - 263686 @@ -1121,16 +1118,17 @@ never_via_route_servers_asns - 141140 - 271200 - 13032 +- 51530 - 31764 - 142369 +- 137207 - 142348 - 23888 -- 398203 - 141856 - 146846 - 146958 +- 398203 - 139667 -- 49922 - 47583 - 60757 - 269512 @@ -1140,6 +1138,7 @@ never_via_route_servers_asns - 55244 - 49910 - 92 +- 147059 - 136874 - 40063 - 149296 @@ -1149,15 +1148,23 @@ never_via_route_servers_asns - 272018 - 396304 - 269190 +- 35900 - 265337 - 201978 - 208425 - 212512 - 142164 - 149663 +- 23961 - 149826 - 210715 - 206275 - 272124 - 61756 +- 49922 - 267561 +- 47584 +- 52990 +- 203283 +- 203133 +- 149391 diff --git a/examples/rich/bird4.conf b/examples/rich/bird4.conf index dfe478e3..87e04cf6 100644 --- a/examples/rich/bird4.conf +++ b/examples/rich/bird4.conf @@ -74,10 +74,10 @@ define AS_SET_AS_RIPENCC_prefixes_4 = [ # ARIN Whois database records define ARIN_Whois_db_AS10745_4 = [ - 192.136.136.0/24{24,32}, 192.149.252.0/24{24,32}, 199.43.0.0/24{24,32} + 192.149.252.0/24{24,32}, 192.136.136.0/24{24,32}, 199.43.0.0/24{24,32} ]; define ARIN_Whois_db_AS12654_4 = [ - 23.128.125.0/24{24,32}, 23.128.25.0/24{24,32}, 23.128.24.0/24{24,32}, 23.128.124.0/24{24,32} + 23.128.24.0/24{24,32}, 23.128.124.0/24{24,32}, 23.128.125.0/24{24,32}, 23.128.25.0/24{24,32} ]; @@ -1758,7 +1758,7 @@ filter receive_from_AS10745_1 { # AS_PATH: never via route-servers ASNs - if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338] then + if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 12926, 13030, 13032, 13941, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 26068, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 47584, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 52990, 53859, 54295, 54574, 55244, 57433, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149391, 149663, 149826, 201978, 202561, 202793, 203133, 203283, 206275, 207353, 207484, 208425, 209310, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 398395, 399338] then reject "AS_PATH [", bgp_path ,"] contains never via route-servers ASN - REJECTING ", net; @@ -1978,7 +1978,7 @@ filter receive_from_AS3333_1 { # AS_PATH: never via route-servers ASNs - if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338] then + if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 12926, 13030, 13032, 13941, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 26068, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 47584, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 52990, 53859, 54295, 54574, 55244, 57433, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149391, 149663, 149826, 201978, 202561, 202793, 203133, 203283, 206275, 207353, 207484, 208425, 209310, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 398395, 399338] then reject "AS_PATH [", bgp_path ,"] contains never via route-servers ASN - REJECTING ", net; diff --git a/examples/rich/bird6.conf b/examples/rich/bird6.conf index cbeb32fb..008c90b0 100644 --- a/examples/rich/bird6.conf +++ b/examples/rich/bird6.conf @@ -45,7 +45,7 @@ define AS_SET_AS10745_prefixes_6 = [ # ARIN Whois database records define ARIN_Whois_db_AS10745_6 = [ - 2001:500:110::/48{48,128}, 2001:500:4::/48{48,128} + 2001:500:4::/48{48,128}, 2001:500:110::/48{48,128} ]; @@ -1772,7 +1772,7 @@ filter receive_from_AS10745_2 { # AS_PATH: never via route-servers ASNs - if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338] then + if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 12926, 13030, 13032, 13941, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 26068, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 47584, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 52990, 53859, 54295, 54574, 55244, 57433, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149391, 149663, 149826, 201978, 202561, 202793, 203133, 203283, 206275, 207353, 207484, 208425, 209310, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 398395, 399338] then reject "AS_PATH [", bgp_path ,"] contains never via route-servers ASN - REJECTING ", net; diff --git a/examples/rich/bird_v2.conf b/examples/rich/bird_v2.conf index 6cb4a0b9..28ca6012 100644 --- a/examples/rich/bird_v2.conf +++ b/examples/rich/bird_v2.conf @@ -98,13 +98,13 @@ define AS_SET_AS_RIPENCC_prefixes_6 = [ # ARIN Whois database records define ARIN_Whois_db_AS10745_4 = [ - 192.136.136.0/24{24,32}, 199.43.0.0/24{24,32}, 192.149.252.0/24{24,32} + 192.136.136.0/24{24,32}, 192.149.252.0/24{24,32}, 199.43.0.0/24{24,32} ]; define ARIN_Whois_db_AS10745_6 = [ 2001:500:4::/48{48,128}, 2001:500:110::/48{48,128} ]; define ARIN_Whois_db_AS12654_4 = [ - 23.128.125.0/24{24,32}, 23.128.124.0/24{24,32}, 23.128.24.0/24{24,32}, 23.128.25.0/24{24,32} + 23.128.124.0/24{24,32}, 23.128.24.0/24{24,32}, 23.128.125.0/24{24,32}, 23.128.25.0/24{24,32} ]; # no IPv6 prefixes found in the ARIN Whois database for ASAS12654 @@ -1940,7 +1940,7 @@ filter receive_from_AS10745_1 { # AS_PATH: never via route-servers ASNs - if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338] then + if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 12926, 13030, 13032, 13941, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 26068, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 47584, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 52990, 53859, 54295, 54574, 55244, 57433, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149391, 149663, 149826, 201978, 202561, 202793, 203133, 203283, 206275, 207353, 207484, 208425, 209310, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 398395, 399338] then reject "AS_PATH [", bgp_path ,"] contains never via route-servers ASN - REJECTING ", net; @@ -2165,7 +2165,7 @@ filter receive_from_AS10745_2 { # AS_PATH: never via route-servers ASNs - if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338] then + if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 12926, 13030, 13032, 13941, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 26068, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 47584, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 52990, 53859, 54295, 54574, 55244, 57433, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149391, 149663, 149826, 201978, 202561, 202793, 203133, 203283, 206275, 207353, 207484, 208425, 209310, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 398395, 399338] then reject "AS_PATH [", bgp_path ,"] contains never via route-servers ASN - REJECTING ", net; @@ -2399,7 +2399,7 @@ filter receive_from_AS3333_1 { # AS_PATH: never via route-servers ASNs - if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338] then + if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 12926, 13030, 13032, 13941, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 26068, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 47584, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 52990, 53859, 54295, 54574, 55244, 57433, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149391, 149663, 149826, 201978, 202561, 202793, 203133, 203283, 206275, 207353, 207484, 208425, 209310, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 398395, 399338] then reject "AS_PATH [", bgp_path ,"] contains never via route-servers ASN - REJECTING ", net; diff --git a/examples/rich/openbgpd.conf b/examples/rich/openbgpd.conf index 4394b08c..baaed97c 100644 --- a/examples/rich/openbgpd.conf +++ b/examples/rich/openbgpd.conf @@ -115,11 +115,7 @@ group "clients" { neighbor 192.0.2.22 { remote-as 10745 - # This is needed to avoid the bgpd error - # "neighbors with add-path send cannot use 'rde evaluate all'" - # It overrides the global 'rde evaluate all' setting for - # the neighbors for which ADD-PATH is configured. - rde evaluate default + rde evaluate all passive ttl-security yes @@ -139,11 +135,7 @@ group "clients" { neighbor 2001:db8:1:1::22 { remote-as 10745 - # This is needed to avoid the bgpd error - # "neighbors with add-path send cannot use 'rde evaluate all'" - # It overrides the global 'rde evaluate all' setting for - # the neighbors for which ADD-PATH is configured. - rde evaluate default + rde evaluate all passive ttl-security yes @@ -163,11 +155,7 @@ group "clients" { neighbor 192.0.2.11 { remote-as 3333 - # This is needed to avoid the bgpd error - # "neighbors with add-path send cannot use 'rde evaluate all'" - # It overrides the global 'rde evaluate all' setting for - # the neighbors for which ADD-PATH is configured. - rde evaluate default + rde evaluate all passive ttl-security yes @@ -255,7 +243,7 @@ prefix-set "bogons" { # never via route-servers ASNs as-set "neverviarouteserver" { - 92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338 + 92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 12926, 13030, 13032, 13941, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 26068, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 47584, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 52990, 53859, 54295, 54574, 55244, 57433, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149391, 149663, 149826, 201978, 202561, 202793, 203133, 203283, 206275, 207353, 207484, 208425, 209310, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 398395, 399338 } # ===================================================================================== diff --git a/examples/rich/template-context b/examples/rich/template-context index 0621733c..dc4edbd7 100644 --- a/examples/rich/template-context +++ b/examples/rich/template-context @@ -1404,6 +1404,12 @@ AS10745: length: 24 max_length: 32 prefix: 192.136.136.0 +- exact: false + ge: 48 + le: 128 + length: 48 + max_length: 128 + prefix: '2001:500:110::' - exact: false ge: 48 le: 128 @@ -1416,25 +1422,19 @@ AS10745: length: 24 max_length: 32 prefix: 192.149.252.0 -- exact: false - ge: 48 - le: 128 - length: 48 - max_length: 128 - prefix: '2001:500:110::' AS12654: - exact: false ge: 24 le: 32 length: 24 max_length: 32 - prefix: 23.128.124.0 + prefix: 23.128.25.0 - exact: false ge: 24 le: 32 length: 24 max_length: 32 - prefix: 23.128.125.0 + prefix: 23.128.124.0 - exact: false ge: 24 le: 32 @@ -1446,7 +1446,7 @@ AS12654: le: 32 length: 24 max_length: 32 - prefix: 23.128.25.0 + prefix: 23.128.125.0 registrobr_whois_db_records @@ -1458,90 +1458,86 @@ never_via_route_servers_asns ---------------------------- - 2914 - 3491 -- 34209 - 6079 +- 7843 +- 1299 +- 3257 - 3265 -- 11670 - 8607 +- 6805 - 12322 - 6730 - 13030 - 3320 +- 1273 - 174 - 680 -- 8455 - 2152 +- 6830 - 3292 -- 35836 +- 5511 +- 8365 - 21396 +- 8075 +- 39326 +- 6908 +- 11164 +- 5432 - 29169 - 16509 - 20161 - 11260 - 34108 -- 7843 - 20115 - 39651 +- 48237 - 9908 - 15692 +- 47377 - 10013 - 8943 - 5391 -- 48237 - 37271 +- 714 - 12353 -- 6908 +- 8455 +- 12926 - 40029 -- 6830 -- 36459 -- 51530 -- 1273 - 57433 -- 39326 -- 27947 -- 714 -- 62567 -- 8075 -- 3257 -- 11164 -- 12822 -- 35900 -- 5511 -- 7155 -- 6805 -- 47377 - 57866 +- 36459 +- 7155 +- 12822 - 46450 -- 263801 - 17012 +- 263801 - 63290 -- 8365 -- 5432 - 278 +- 62567 - 202793 - 33983 +- 26068 - 134022 -- 43470 - 3754 -- 3630 - 135706 - 264424 - 132563 +- 11670 +- 3630 - 7862 - 48408 -- 137207 - 24282 - 265630 - 37529 - 131996 - 132829 -- 19237 -- 23961 +- 27947 +- 34209 - 263856 - 135848 -- 147059 +- 19237 - 24800 -- 62623 +- 54574 - 137610 - 34587 - 138023 @@ -1549,46 +1545,48 @@ never_via_route_servers_asns - 132996 - 30983 - 263258 +- 13941 - 396477 - 262191 - 54295 -- 18520 -- 14295 - 138953 - 58768 - 1955 - 328572 - 49127 - 393573 +- 18520 +- 14295 - 393684 - 269156 - 207353 - 209699 - 270544 - 328582 -- 267442 - 48265 - 328445 +- 398395 - 60412 - 207484 - 268091 - 270781 - 138769 -- 57468 -- 212953 - 270407 -- 133317 +- 209310 - 271053 - 270828 - 271172 +- 62623 - 140287 - 212706 - 212623 +- 43470 - 269367 - 36165 - 202561 - 213202 - 141120 +- 35836 - 141411 - 262888 - 131398 @@ -1597,7 +1595,6 @@ never_via_route_servers_asns - 53859 - 269654 - 141892 -- 1299 - 267214 - 62164 - 263686 @@ -1608,16 +1605,17 @@ never_via_route_servers_asns - 141140 - 271200 - 13032 +- 51530 - 31764 - 142369 +- 137207 - 142348 - 23888 -- 398203 - 141856 - 146846 - 146958 +- 398203 - 139667 -- 49922 - 47583 - 60757 - 269512 @@ -1627,6 +1625,7 @@ never_via_route_servers_asns - 55244 - 49910 - 92 +- 147059 - 136874 - 40063 - 149296 @@ -1636,15 +1635,23 @@ never_via_route_servers_asns - 272018 - 396304 - 269190 +- 35900 - 265337 - 201978 - 208425 - 212512 - 142164 - 149663 +- 23961 - 149826 - 210715 - 206275 - 272124 - 61756 +- 49922 - 267561 +- 47584 +- 52990 +- 203283 +- 203133 +- 149391 diff --git a/examples/rich/template-context4 b/examples/rich/template-context4 index b2491f70..e0d41f87 100644 --- a/examples/rich/template-context4 +++ b/examples/rich/template-context4 @@ -1225,13 +1225,13 @@ AS10745: le: 32 length: 24 max_length: 32 - prefix: 192.149.252.0 + prefix: 192.136.136.0 - exact: false ge: 24 le: 32 length: 24 max_length: 32 - prefix: 192.136.136.0 + prefix: 192.149.252.0 - exact: false ge: 24 le: 32 @@ -1274,90 +1274,86 @@ never_via_route_servers_asns ---------------------------- - 2914 - 3491 -- 34209 - 6079 +- 7843 +- 1299 +- 3257 - 3265 -- 11670 - 8607 +- 6805 - 12322 - 6730 - 13030 - 3320 +- 1273 - 174 - 680 -- 8455 - 2152 +- 6830 - 3292 -- 35836 +- 5511 +- 8365 - 21396 +- 8075 +- 39326 +- 6908 +- 11164 +- 5432 - 29169 - 16509 - 20161 - 11260 - 34108 -- 7843 - 20115 - 39651 +- 48237 - 9908 - 15692 +- 47377 - 10013 - 8943 - 5391 -- 48237 - 37271 +- 714 - 12353 -- 6908 +- 8455 +- 12926 - 40029 -- 6830 -- 36459 -- 51530 -- 1273 - 57433 -- 39326 -- 27947 -- 714 -- 62567 -- 8075 -- 3257 -- 11164 -- 12822 -- 35900 -- 5511 -- 7155 -- 6805 -- 47377 - 57866 +- 36459 +- 7155 +- 12822 - 46450 -- 263801 - 17012 +- 263801 - 63290 -- 8365 -- 5432 - 278 +- 62567 - 202793 - 33983 +- 26068 - 134022 -- 43470 - 3754 -- 3630 - 135706 - 264424 - 132563 +- 11670 +- 3630 - 7862 - 48408 -- 137207 - 24282 - 265630 - 37529 - 131996 - 132829 -- 19237 -- 23961 +- 27947 +- 34209 - 263856 - 135848 -- 147059 +- 19237 - 24800 -- 62623 +- 54574 - 137610 - 34587 - 138023 @@ -1365,46 +1361,48 @@ never_via_route_servers_asns - 132996 - 30983 - 263258 +- 13941 - 396477 - 262191 - 54295 -- 18520 -- 14295 - 138953 - 58768 - 1955 - 328572 - 49127 - 393573 +- 18520 +- 14295 - 393684 - 269156 - 207353 - 209699 - 270544 - 328582 -- 267442 - 48265 - 328445 +- 398395 - 60412 - 207484 - 268091 - 270781 - 138769 -- 57468 -- 212953 - 270407 -- 133317 +- 209310 - 271053 - 270828 - 271172 +- 62623 - 140287 - 212706 - 212623 +- 43470 - 269367 - 36165 - 202561 - 213202 - 141120 +- 35836 - 141411 - 262888 - 131398 @@ -1413,7 +1411,6 @@ never_via_route_servers_asns - 53859 - 269654 - 141892 -- 1299 - 267214 - 62164 - 263686 @@ -1424,16 +1421,17 @@ never_via_route_servers_asns - 141140 - 271200 - 13032 +- 51530 - 31764 - 142369 +- 137207 - 142348 - 23888 -- 398203 - 141856 - 146846 - 146958 +- 398203 - 139667 -- 49922 - 47583 - 60757 - 269512 @@ -1443,6 +1441,7 @@ never_via_route_servers_asns - 55244 - 49910 - 92 +- 147059 - 136874 - 40063 - 149296 @@ -1452,15 +1451,23 @@ never_via_route_servers_asns - 272018 - 396304 - 269190 +- 35900 - 265337 - 201978 - 208425 - 212512 - 142164 - 149663 +- 23961 - 149826 - 210715 - 206275 - 272124 - 61756 +- 49922 - 267561 +- 47584 +- 52990 +- 203283 +- 203133 +- 149391 diff --git a/examples/rich/template-context6 b/examples/rich/template-context6 index 0e1d3075..0401ad5d 100644 --- a/examples/rich/template-context6 +++ b/examples/rich/template-context6 @@ -1024,90 +1024,86 @@ never_via_route_servers_asns ---------------------------- - 2914 - 3491 -- 34209 - 6079 +- 7843 +- 1299 +- 3257 - 3265 -- 11670 - 8607 +- 6805 - 12322 - 6730 - 13030 - 3320 +- 1273 - 174 - 680 -- 8455 - 2152 +- 6830 - 3292 -- 35836 +- 5511 +- 8365 - 21396 +- 8075 +- 39326 +- 6908 +- 11164 +- 5432 - 29169 - 16509 - 20161 - 11260 - 34108 -- 7843 - 20115 - 39651 +- 48237 - 9908 - 15692 +- 47377 - 10013 - 8943 - 5391 -- 48237 - 37271 +- 714 - 12353 -- 6908 +- 8455 +- 12926 - 40029 -- 6830 -- 36459 -- 51530 -- 1273 - 57433 -- 39326 -- 27947 -- 714 -- 62567 -- 8075 -- 3257 -- 11164 -- 12822 -- 35900 -- 5511 -- 7155 -- 6805 -- 47377 - 57866 +- 36459 +- 7155 +- 12822 - 46450 -- 263801 - 17012 +- 263801 - 63290 -- 8365 -- 5432 - 278 +- 62567 - 202793 - 33983 +- 26068 - 134022 -- 43470 - 3754 -- 3630 - 135706 - 264424 - 132563 +- 11670 +- 3630 - 7862 - 48408 -- 137207 - 24282 - 265630 - 37529 - 131996 - 132829 -- 19237 -- 23961 +- 27947 +- 34209 - 263856 - 135848 -- 147059 +- 19237 - 24800 -- 62623 +- 54574 - 137610 - 34587 - 138023 @@ -1115,46 +1111,48 @@ never_via_route_servers_asns - 132996 - 30983 - 263258 +- 13941 - 396477 - 262191 - 54295 -- 18520 -- 14295 - 138953 - 58768 - 1955 - 328572 - 49127 - 393573 +- 18520 +- 14295 - 393684 - 269156 - 207353 - 209699 - 270544 - 328582 -- 267442 - 48265 - 328445 +- 398395 - 60412 - 207484 - 268091 - 270781 - 138769 -- 57468 -- 212953 - 270407 -- 133317 +- 209310 - 271053 - 270828 - 271172 +- 62623 - 140287 - 212706 - 212623 +- 43470 - 269367 - 36165 - 202561 - 213202 - 141120 +- 35836 - 141411 - 262888 - 131398 @@ -1163,7 +1161,6 @@ never_via_route_servers_asns - 53859 - 269654 - 141892 -- 1299 - 267214 - 62164 - 263686 @@ -1174,16 +1171,17 @@ never_via_route_servers_asns - 141140 - 271200 - 13032 +- 51530 - 31764 - 142369 +- 137207 - 142348 - 23888 -- 398203 - 141856 - 146846 - 146958 +- 398203 - 139667 -- 49922 - 47583 - 60757 - 269512 @@ -1193,6 +1191,7 @@ never_via_route_servers_asns - 55244 - 49910 - 92 +- 147059 - 136874 - 40063 - 149296 @@ -1202,15 +1201,23 @@ never_via_route_servers_asns - 272018 - 396304 - 269190 +- 35900 - 265337 - 201978 - 208425 - 212512 - 142164 - 149663 +- 23961 - 149826 - 210715 - 206275 - 272124 - 61756 +- 49922 - 267561 +- 47584 +- 52990 +- 203283 +- 203133 +- 149391 diff --git a/examples/rpki_rtr/bird_v2.conf b/examples/rpki_rtr/bird_v2.conf index 65de2f92..a3301eba 100644 --- a/examples/rpki_rtr/bird_v2.conf +++ b/examples/rpki_rtr/bird_v2.conf @@ -63,8 +63,8 @@ define AS_SET_AS1_asns = [ ]; define AS_SET_AS1_prefixes_4 = [ - 4.36.110.0/24, 88.218.16.0/24, 178.208.184.0/24, 178.253.38.0/24, - 178.253.55.0/24, 185.255.126.0/24, 199.48.180.0/24 + 4.36.110.0/24, 178.208.184.0/24, 178.253.38.0/24, 178.253.55.0/24, + 192.109.109.0/24, 199.48.180.0/24 ]; # no IPv6 prefixes found for AS1 @@ -470,7 +470,7 @@ filter receive_from_AS10745_1 { # AS_PATH: never via route-servers ASNs - if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338] then + if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 12926, 13030, 13032, 13941, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 26068, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 47584, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 52990, 53859, 54295, 54574, 55244, 57433, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149391, 149663, 149826, 201978, 202561, 202793, 203133, 203283, 206275, 207353, 207484, 208425, 209310, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 398395, 399338] then reject "AS_PATH [", bgp_path ,"] contains never via route-servers ASN - REJECTING ", net; @@ -648,7 +648,7 @@ filter receive_from_AS10745_2 { # AS_PATH: never via route-servers ASNs - if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338] then + if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 12926, 13030, 13032, 13941, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 26068, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 47584, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 52990, 53859, 54295, 54574, 55244, 57433, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149391, 149663, 149826, 201978, 202561, 202793, 203133, 203283, 206275, 207353, 207484, 208425, 209310, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 398395, 399338] then reject "AS_PATH [", bgp_path ,"] contains never via route-servers ASN - REJECTING ", net; @@ -830,7 +830,7 @@ filter receive_from_AS1_1 { # AS_PATH: never via route-servers ASNs - if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338] then + if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 12926, 13030, 13032, 13941, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 26068, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 47584, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 52990, 53859, 54295, 54574, 55244, 57433, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149391, 149663, 149826, 201978, 202561, 202793, 203133, 203283, 206275, 207353, 207484, 208425, 209310, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 398395, 399338] then reject "AS_PATH [", bgp_path ,"] contains never via route-servers ASN - REJECTING ", net; @@ -1008,7 +1008,7 @@ filter receive_from_AS3333_1 { # AS_PATH: never via route-servers ASNs - if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338] then + if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 12926, 13030, 13032, 13941, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 26068, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 47584, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 52990, 53859, 54295, 54574, 55244, 57433, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149391, 149663, 149826, 201978, 202561, 202793, 203133, 203283, 206275, 207353, 207484, 208425, 209310, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 398395, 399338] then reject "AS_PATH [", bgp_path ,"] contains never via route-servers ASN - REJECTING ", net; diff --git a/tests/last b/tests/last index a0264ca2..77e7ceae 100644 --- a/tests/last +++ b/tests/last @@ -247,7 +247,7 @@ RTT getter parser: new line only ... ok RTT getter parser: none ... ok ---------------------------------------------------------------------- -Ran 247 tests in 68.563s +Ran 247 tests in 63.405s OK External resources: ARIN Whois database dump ... ok @@ -267,7 +267,7 @@ External resources: prefixes from AS-SET via bgpq3 ... ok External resources: prefixes from AS-SET via bgpq4 ... ok ---------------------------------------------------------------------- -Ran 15 tests in 48.245s +Ran 15 tests in 62.975s OK Live test, BIRD, hooks example, IPv4: setting instances up... @@ -284,7 +284,7 @@ Live test, BIRD, hooks example, IPv6: dumping routes... Live test, BIRD, hooks example, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 4 tests in 14.255s +Ran 4 tests in 15.078s OK Live test, BIRD, BGP communities, IPv4: setting instances up... @@ -323,7 +323,7 @@ Live test, BIRD, BGP communities, IPv6: dumping routes... Live test, BIRD, BGP communities, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 26 tests in 64.025s +Ran 26 tests in 69.024s OK Live test, BIRD, default config, IPv4: setting instances up... @@ -340,7 +340,7 @@ Live test, BIRD, default config, IPv6: dumping routes... Live test, BIRD, default config, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 4 tests in 15.047s +Ran 4 tests in 16.964s OK Live test, BIRD, global scenario, IPv4: setting instances up... @@ -881,7 +881,7 @@ Live test, BIRD, global scenario, IPv6, tag&reject: dumping routes... Live test, BIRD, global scenario, IPv6, tag&reject: stopping instances... ---------------------------------------------------------------------- -Ran 512 tests in 509.215s +Ran 512 tests in 540.852s OK (SKIP=6) Live test, BIRD, gshut, IPv4: setting instances up... @@ -904,7 +904,7 @@ Live test, BIRD, gshut, IPv6: dumping routes... Live test, BIRD, gshut, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 10 tests in 44.425s +Ran 10 tests in 49.582s OK Live test, BIRD, max-prefix, IPv4: setting instances up... @@ -943,7 +943,7 @@ Live test, BIRD, max-prefix, IPv6: dumping routes... Live test, BIRD, max-prefix, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 26 tests in 165.497s +Ran 26 tests in 172.653s OK Live test, BIRD, path hiding, mitigation off, IPv4: setting instances up... @@ -1002,7 +1002,7 @@ Live test, BIRD, path hiding, mitigation on, IPv6: dumping routes... Live test, BIRD, path hiding, mitigation on, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 38 tests in 174.239s +Ran 38 tests in 176.240s OK (SKIP=2) Live test, BIRD, examples, rich config, IPv4: setting instances up... @@ -1019,7 +1019,7 @@ Live test, BIRD, examples, rich config, IPv6: dumping routes... Live test, BIRD, examples, rich config, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 4 tests in 26.304s +Ran 4 tests in 20.184s OK Live test, BIRD, RPKI INVALID tagging, IPv4: setting instances up... @@ -1060,7 +1060,7 @@ Live test, BIRD, RPKI INVALID tagging, IPv6: dumping routes... Live test, BIRD, RPKI INVALID tagging, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 28 tests in 83.631s +Ran 28 tests in 79.876s OK Live test, BIRD, BOV custom comms, IPv4: setting instances up... @@ -1085,7 +1085,7 @@ Live test, BIRD, BOV custom comms, IPv6: dumping routes... Live test, BIRD, BOV custom comms, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 12 tests in 46.496s +Ran 12 tests in 45.674s OK Live test, BIRD, tag prefix/origin in AS-SET, IPv4: setting instances up... @@ -1272,7 +1272,7 @@ Live test, BIRD, tag prefix/origin empty AS-SET, IPv6: dumping routes... Live test, BIRD, tag prefix/origin empty AS-SET, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 166 tests in 168.950s +Ran 166 tests in 172.100s OK Live test, BIRD, 'tag' reject policy scenario, IPv4: setting instances up... @@ -1329,7 +1329,7 @@ Live test, BIRD, 'tag' reject policy scenario, IPv6: dumping routes... Live test, BIRD, 'tag' reject policy scenario, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 44 tests in 114.618s +Ran 44 tests in 121.872s OK (SKIP=1) Live test, BIRD v2, BGP communities, IPv4: setting instances up... @@ -1368,7 +1368,7 @@ Live test, BIRD v2, BGP communities, IPv6: dumping routes... Live test, BIRD v2, BGP communities, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 26 tests in 63.218s +Ran 26 tests in 67.131s OK Live test, BIRD v2, default config, IPv4: setting instances up... @@ -1385,7 +1385,7 @@ Live test, BIRD v2, default config, IPv6: dumping routes... Live test, BIRD v2, default config, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 4 tests in 14.591s +Ran 4 tests in 15.314s OK Live test, BIRD v2, global scenario, IPv4: setting instances up... @@ -1926,7 +1926,7 @@ Live test, BIRD v2, global scenario, IPv6, tag&reject: dumping routes... Live test, BIRD v2, global scenario, IPv6, tag&reject: stopping instances... ---------------------------------------------------------------------- -Ran 512 tests in 499.002s +Ran 512 tests in 513.873s OK (SKIP=6) Live test, BIRD v2, gshut, IPv4: setting instances up... @@ -1949,7 +1949,7 @@ Live test, BIRD v2, gshut, IPv6: dumping routes... Live test, BIRD v2, gshut, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 10 tests in 44.138s +Ran 10 tests in 50.348s OK Live test, BIRD v2, max-prefix, IPv4: setting instances up... @@ -1988,7 +1988,7 @@ Live test, BIRD v2, max-prefix, IPv6: dumping routes... Live test, BIRD v2, max-prefix, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 26 tests in 165.985s +Ran 26 tests in 183.754s OK Live test, BIRD v2, path hiding, mitigation off, IPv4: setting instances up... @@ -2047,7 +2047,7 @@ Live test, BIRD v2, path hiding, mitigation on, IPv6: dumping routes... Live test, BIRD v2, path hiding, mitigation on, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 38 tests in 171.075s +Ran 38 tests in 179.261s OK (SKIP=2) Live test, BIRD v2, examples, rich config, IPv4: setting instances up... @@ -2064,7 +2064,7 @@ Live test, BIRD v2, examples, rich config, IPv6: dumping routes... Live test, BIRD v2, examples, rich config, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 4 tests in 24.751s +Ran 4 tests in 19.984s OK Live test, BIRD v2, RPKI INVALID tagging, IPv4: setting instances up... @@ -2105,7 +2105,7 @@ Live test, BIRD v2, RPKI INVALID tagging, IPv6: dumping routes... Live test, BIRD v2, RPKI INVALID tagging, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 28 tests in 77.980s +Ran 28 tests in 79.172s OK Live test, BIRD v2, BOV custom comms, IPv4: setting instances up... @@ -2130,7 +2130,7 @@ Live test, BIRD v2, BOV custom comms, IPv6: dumping routes... Live test, BIRD v2, BOV custom comms, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 12 tests in 44.362s +Ran 12 tests in 45.535s OK Live test, BIRD v2, RTR protocol: setting instances up... @@ -2147,7 +2147,7 @@ Live test, BIRD v2, RTR protocol: dumping routes... Live test, BIRD v2, RTR protocol: stopping instances... ---------------------------------------------------------------------- -Ran 8 tests in 40.609s +Ran 8 tests in 41.031s OK Live test, BIRD v2, tag prefix/origin in AS-SET, IPv4: setting instances up... @@ -2334,7 +2334,7 @@ Live test, BIRD v2, tag prefix/origin empty AS-SET, IPv6: dumping routes... Live test, BIRD v2, tag prefix/origin empty AS-SET, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 166 tests in 163.047s +Ran 166 tests in 181.076s OK Live test, BIRD v2, 'tag' reject policy scenario, IPv4: setting instances up... @@ -2391,810 +2391,810 @@ Live test, BIRD v2, 'tag' reject policy scenario, IPv6: dumping routes... Live test, BIRD v2, 'tag' reject policy scenario, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 44 tests in 114.054s +Ran 44 tests in 118.667s OK (SKIP=1) -Live test, OpenBGPD 7.5, BGP communities, IPv4: setting instances up... -Live test, OpenBGPD 7.5, BGP communities, IPv4: instances setup ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv4: sessions are up ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv4: announce to AS1 only (ext) ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv4: announce to AS1 only (lrg) ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv4: announce to AS1 only (std) ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv4: announce to AS131073 only (ext) ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv4: announce to AS131073 only (lrg) ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv4: custom BGP community (ext) ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv4: custom BGP community (lrg) ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv4: custom BGP community (std) ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv4: custom BGP community scrubbed ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv4: reconfigure ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv4: log contains errors ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv4: dumping rs config... -Live test, OpenBGPD 7.5, BGP communities, IPv4: dumping routes... -Live test, OpenBGPD 7.5, BGP communities, IPv4: stopping instances... -Live test, OpenBGPD 7.5, BGP communities, IPv6: setting instances up... -Live test, OpenBGPD 7.5, BGP communities, IPv6: instances setup ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv6: sessions are up ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv6: announce to AS1 only (ext) ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv6: announce to AS1 only (lrg) ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv6: announce to AS1 only (std) ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv6: announce to AS131073 only (ext) ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv6: announce to AS131073 only (lrg) ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv6: custom BGP community (ext) ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv6: custom BGP community (lrg) ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv6: custom BGP community (std) ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv6: custom BGP community scrubbed ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv6: reconfigure ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv6: log contains errors ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv6: dumping rs config... -Live test, OpenBGPD 7.5, BGP communities, IPv6: dumping routes... -Live test, OpenBGPD 7.5, BGP communities, IPv6: stopping instances... +Live test, OpenBGPD 7.7, BGP communities, IPv4: setting instances up... +Live test, OpenBGPD 7.7, BGP communities, IPv4: instances setup ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv4: sessions are up ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv4: announce to AS1 only (ext) ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv4: announce to AS1 only (lrg) ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv4: announce to AS1 only (std) ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv4: announce to AS131073 only (ext) ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv4: announce to AS131073 only (lrg) ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv4: custom BGP community (ext) ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv4: custom BGP community (lrg) ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv4: custom BGP community (std) ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv4: custom BGP community scrubbed ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv4: reconfigure ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv4: log contains errors ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv4: dumping rs config... +Live test, OpenBGPD 7.7, BGP communities, IPv4: dumping routes... +Live test, OpenBGPD 7.7, BGP communities, IPv4: stopping instances... +Live test, OpenBGPD 7.7, BGP communities, IPv6: setting instances up... +Live test, OpenBGPD 7.7, BGP communities, IPv6: instances setup ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv6: sessions are up ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv6: announce to AS1 only (ext) ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv6: announce to AS1 only (lrg) ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv6: announce to AS1 only (std) ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv6: announce to AS131073 only (ext) ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv6: announce to AS131073 only (lrg) ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv6: custom BGP community (ext) ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv6: custom BGP community (lrg) ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv6: custom BGP community (std) ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv6: custom BGP community scrubbed ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv6: reconfigure ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv6: log contains errors ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv6: dumping rs config... +Live test, OpenBGPD 7.7, BGP communities, IPv6: dumping routes... +Live test, OpenBGPD 7.7, BGP communities, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 26 tests in 66.482s +Ran 26 tests in 68.085s OK -Live test, OpenBGPD 7.5, default config, IPv4: setting instances up... -Live test, OpenBGPD 7.5, default config, IPv4: instances setup ... ok -Live test, OpenBGPD 7.5, default config, IPv4: log contains errors ... ok -Live test, OpenBGPD 7.5, default config, IPv4: dumping rs config... -Live test, OpenBGPD 7.5, default config, IPv4: dumping routes... -Live test, OpenBGPD 7.5, default config, IPv4: stopping instances... -Live test, OpenBGPD 7.5, default config, IPv6: setting instances up... -Live test, OpenBGPD 7.5, default config, IPv6: instances setup ... ok -Live test, OpenBGPD 7.5, default config, IPv6: log contains errors ... ok -Live test, OpenBGPD 7.5, default config, IPv6: dumping rs config... -Live test, OpenBGPD 7.5, default config, IPv6: dumping routes... -Live test, OpenBGPD 7.5, default config, IPv6: stopping instances... +Live test, OpenBGPD 7.7, default config, IPv4: setting instances up... +Live test, OpenBGPD 7.7, default config, IPv4: instances setup ... ok +Live test, OpenBGPD 7.7, default config, IPv4: log contains errors ... ok +Live test, OpenBGPD 7.7, default config, IPv4: dumping rs config... +Live test, OpenBGPD 7.7, default config, IPv4: dumping routes... +Live test, OpenBGPD 7.7, default config, IPv4: stopping instances... +Live test, OpenBGPD 7.7, default config, IPv6: setting instances up... +Live test, OpenBGPD 7.7, default config, IPv6: instances setup ... ok +Live test, OpenBGPD 7.7, default config, IPv6: log contains errors ... ok +Live test, OpenBGPD 7.7, default config, IPv6: dumping rs config... +Live test, OpenBGPD 7.7, default config, IPv6: dumping routes... +Live test, OpenBGPD 7.7, default config, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 4 tests in 11.577s +Ran 4 tests in 12.137s OK -Live test, OpenBGPD 7.5, global scenario, IPv4: setting instances up... -Live test, OpenBGPD 7.5, global scenario, IPv4: instances setup ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: sessions are up ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: session configured via local include files ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: good prefixes because of use_arin_bulk_whois_data ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: good prefixes received by rs: IRRdb white-list ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: good prefixes because of use_registrobr_bulk_whois_data ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: good prefixes because of use_rpki_roas_as_route_objects: exact ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: good prefixes because of use_rpki_roas_as_route_objects: covering ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: good prefixes received by rs ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: good prefixes received by rs: non-client NEXT_HOP ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: not IPv6 global unicast space ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: IRRdb white-list ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: AS_SET origin, RFC6907 7.1.9 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: IRR check for AS_SET origin, BIRD ... SKIP: BIRD specific -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: IRR check for AS_SET origin, OpenBGPD ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: AS_PATH len ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: bogon ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: client blacklist ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: global blacklist ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: invalid ASN in AS-PATH ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: invalid NEXT_HOP ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: left-most ASN ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: never via route servers ASN in AS-PATH (asns list) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: never via route servers ASN in AS-PATH (PeeringDB) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: origin not in AS-SET ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: prefix not in AS-SET ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: invalid prefix-len ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: transit-free ASN in AS-PATH ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: transit-free ASN in AS-PATH from a transit peer ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: unknown NEXT_HOP ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: RPKI ROAs as route objects failed ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: default route ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes not received by clients ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: bogon (wrong tag) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: global blacklist (wrong tag) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: RPKI, blackhole request for a covered prefix ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: RPKI, invalid prefix (bad ASN) received by rs ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: RPKI, invalid prefix (bad length) received by rs ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: RPKI, invalid prefix (bad ASN) not propagated to clients ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: RPKI, valid prefix received by rs ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: RPKI, valid prefix propagated to clients ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: prefixes from AS101 received by its upstreams ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: prefixes from AS101 received by rs ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad communities as seen by AS101 upstreams ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad communities scrubbed by rs (lrg) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad communities scrubbed by rs (std) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: other communities not scrubbed by rs (lrg) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: other communities not scrubbed by rs (std) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: blackhole filtering requests as seen by rs (BLACKHOLE) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: blackhole filtering requests as seen by rs (lrg cust) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: blackhole filtering requests as seen by rs (std cust) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: blackholed prefixes as seen by enabled clients (BLACKHOLE) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: blackholed prefixes as seen by enabled clients (lrg_cust) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: blackholed prefixes as seen by enabled clients (std_cust) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: blackholed prefixes not seen by not enabled clients ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: gshut by an enabled client ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: gshut by a not enabled client ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, announce to AS1 only ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, don't announce to any ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, announce to all except AS1 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, prepend once to any ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, prepend twice to any ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, prepend thrice to any ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, prepend once to AS1 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, prepend twice to AS2 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, prepend thrice to AS1, once to others ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, NO_EXPORT to AS1 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, NO_EXPORT to any ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, RFC1997 NO_EXPORT ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, RTT, blackhole, not peers > 20 ms ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, RTT, not peers > 15 ms ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, RTT, not peers > 5 ms ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, RTT, not peers > 5 ms + AS3 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, RTT, not peers <= 5 and > 100 ms ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, RTT, only peers <= 15 ms ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, RTT, only peers <= 5 ms ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, RTT, ext comms, prepend 1x > 10 ms, 2x > 20 ms ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, RTT, prepend 3x > 100 ms, 2x > 10 ms ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, RTT, prepend 3x <= 5 ms, 2x <= 20 ms, 1x any ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: prefixes received by clients: AS1_1 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: prefixes received by clients: AS1_2 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: prefixes received by clients: AS2 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: prefixes received by clients: AS3 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: prefixes received by clients: AS3 (with ADD-PATH) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: reconfigure ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: log contains errors ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: dumping rs config... -Live test, OpenBGPD 7.5, global scenario, IPv4: dumping routes... -Live test, OpenBGPD 7.5, global scenario, IPv4: stopping instances... -Live test, OpenBGPD 7.5, global scenario, IPv6: setting instances up... -Live test, OpenBGPD 7.5, global scenario, IPv6: instances setup ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: sessions are up ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: session configured via local include files ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: good prefixes because of use_arin_bulk_whois_data ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: good prefixes received by rs: IRRdb white-list ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: good prefixes because of use_registrobr_bulk_whois_data ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: good prefixes because of use_rpki_roas_as_route_objects: exact ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: good prefixes because of use_rpki_roas_as_route_objects: covering ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: good prefixes received by rs ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: good prefixes received by rs: non-client NEXT_HOP ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: not IPv6 global unicast space ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: IRRdb white-list ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: AS_SET origin, RFC6907 7.1.9 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: IRR check for AS_SET origin, BIRD ... SKIP: BIRD specific -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: IRR check for AS_SET origin, OpenBGPD ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: AS_PATH len ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: bogon ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: client blacklist ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: global blacklist ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: invalid ASN in AS-PATH ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: invalid NEXT_HOP ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: left-most ASN ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: never via route servers ASN in AS-PATH (asns list) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: never via route servers ASN in AS-PATH (PeeringDB) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: origin not in AS-SET ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: prefix not in AS-SET ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: invalid prefix-len ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: transit-free ASN in AS-PATH ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: transit-free ASN in AS-PATH from a transit peer ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: unknown NEXT_HOP ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: RPKI ROAs as route objects failed ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: default route ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes not received by clients ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: bogon (wrong tag) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: global blacklist (wrong tag) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: RPKI, blackhole request for a covered prefix ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: RPKI, invalid prefix (bad ASN) received by rs ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: RPKI, invalid prefix (bad length) received by rs ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: RPKI, invalid prefix (bad ASN) not propagated to clients ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: RPKI, valid prefix received by rs ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: RPKI, valid prefix propagated to clients ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: prefixes from AS101 received by its upstreams ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: prefixes from AS101 received by rs ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad communities as seen by AS101 upstreams ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad communities scrubbed by rs (lrg) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad communities scrubbed by rs (std) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: other communities not scrubbed by rs (lrg) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: other communities not scrubbed by rs (std) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: blackhole filtering requests as seen by rs (BLACKHOLE) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: blackhole filtering requests as seen by rs (lrg cust) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: blackhole filtering requests as seen by rs (std cust) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: blackholed prefixes as seen by enabled clients (BLACKHOLE) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: blackholed prefixes as seen by enabled clients (lrg_cust) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: blackholed prefixes as seen by enabled clients (std_cust) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: blackholed prefixes not seen by not enabled clients ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: gshut by an enabled client ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: gshut by a not enabled client ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, announce to AS1 only ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, don't announce to any ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, announce to all except AS1 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, prepend once to any ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, prepend twice to any ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, prepend thrice to any ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, prepend once to AS1 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, prepend twice to AS2 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, prepend thrice to AS1, once to others ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, NO_EXPORT to AS1 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, NO_EXPORT to any ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, RFC1997 NO_EXPORT ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, RTT, blackhole, not peers > 20 ms ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, RTT, not peers > 15 ms ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, RTT, not peers > 5 ms ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, RTT, not peers > 5 ms + AS3 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, RTT, not peers <= 5 and > 100 ms ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, RTT, only peers <= 15 ms ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, RTT, only peers <= 5 ms ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, RTT, ext comms, prepend 1x > 10 ms, 2x > 20 ms ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, RTT, prepend 3x > 100 ms, 2x > 10 ms ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, RTT, prepend 3x <= 5 ms, 2x <= 20 ms, 1x any ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: prefixes received by clients: AS1_1 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: prefixes received by clients: AS1_2 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: prefixes received by clients: AS2 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: prefixes received by clients: AS3 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: prefixes received by clients: AS3 (with ADD-PATH) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: reconfigure ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: log contains errors ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: dumping rs config... -Live test, OpenBGPD 7.5, global scenario, IPv6: dumping routes... -Live test, OpenBGPD 7.5, global scenario, IPv6: stopping instances... -Live test, OpenBGPD 7.4, global scenario, IPv4: setting instances up... -Live test, OpenBGPD 7.4, global scenario, IPv4: instances setup ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: sessions are up ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: session configured via local include files ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: good prefixes because of use_arin_bulk_whois_data ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: good prefixes received by rs: IRRdb white-list ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: good prefixes because of use_registrobr_bulk_whois_data ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: good prefixes because of use_rpki_roas_as_route_objects: exact ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: good prefixes because of use_rpki_roas_as_route_objects: covering ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: good prefixes received by rs ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: good prefixes received by rs: non-client NEXT_HOP ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: not IPv6 global unicast space ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: IRRdb white-list ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: AS_SET origin, RFC6907 7.1.9 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: IRR check for AS_SET origin, BIRD ... SKIP: BIRD specific -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: IRR check for AS_SET origin, OpenBGPD ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: AS_PATH len ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: bogon ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: client blacklist ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: global blacklist ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: invalid ASN in AS-PATH ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: invalid NEXT_HOP ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: left-most ASN ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: never via route servers ASN in AS-PATH (asns list) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: never via route servers ASN in AS-PATH (PeeringDB) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: origin not in AS-SET ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: prefix not in AS-SET ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: invalid prefix-len ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: transit-free ASN in AS-PATH ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: transit-free ASN in AS-PATH from a transit peer ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: unknown NEXT_HOP ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: RPKI ROAs as route objects failed ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: default route ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes not received by clients ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: bogon (wrong tag) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: global blacklist (wrong tag) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: RPKI, blackhole request for a covered prefix ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: RPKI, invalid prefix (bad ASN) received by rs ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: RPKI, invalid prefix (bad length) received by rs ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: RPKI, invalid prefix (bad ASN) not propagated to clients ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: RPKI, valid prefix received by rs ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: RPKI, valid prefix propagated to clients ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: prefixes from AS101 received by its upstreams ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: prefixes from AS101 received by rs ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad communities as seen by AS101 upstreams ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad communities scrubbed by rs (lrg) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad communities scrubbed by rs (std) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: other communities not scrubbed by rs (lrg) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: other communities not scrubbed by rs (std) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: blackhole filtering requests as seen by rs (BLACKHOLE) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: blackhole filtering requests as seen by rs (lrg cust) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: blackhole filtering requests as seen by rs (std cust) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: blackholed prefixes as seen by enabled clients (BLACKHOLE) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: blackholed prefixes as seen by enabled clients (lrg_cust) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: blackholed prefixes as seen by enabled clients (std_cust) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: blackholed prefixes not seen by not enabled clients ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: gshut by an enabled client ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: gshut by a not enabled client ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, announce to AS1 only ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, don't announce to any ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, announce to all except AS1 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, prepend once to any ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, prepend twice to any ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, prepend thrice to any ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, prepend once to AS1 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, prepend twice to AS2 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, prepend thrice to AS1, once to others ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, NO_EXPORT to AS1 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, NO_EXPORT to any ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, RFC1997 NO_EXPORT ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, RTT, blackhole, not peers > 20 ms ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, RTT, not peers > 15 ms ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, RTT, not peers > 5 ms ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, RTT, not peers > 5 ms + AS3 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, RTT, not peers <= 5 and > 100 ms ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, RTT, only peers <= 15 ms ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, RTT, only peers <= 5 ms ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, RTT, ext comms, prepend 1x > 10 ms, 2x > 20 ms ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, RTT, prepend 3x > 100 ms, 2x > 10 ms ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, RTT, prepend 3x <= 5 ms, 2x <= 20 ms, 1x any ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: prefixes received by clients: AS1_1 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: prefixes received by clients: AS1_2 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: prefixes received by clients: AS2 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: prefixes received by clients: AS3 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: prefixes received by clients: AS3 (with ADD-PATH) ... SKIP: ADD-PATH not supported by OpenBGPD < 7.5 -Live test, OpenBGPD 7.4, global scenario, IPv4: reconfigure ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: log contains errors ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: dumping rs config... -Live test, OpenBGPD 7.4, global scenario, IPv4: dumping routes... -Live test, OpenBGPD 7.4, global scenario, IPv4: stopping instances... -Live test, OpenBGPD 7.4, global scenario, IPv6: setting instances up... -Live test, OpenBGPD 7.4, global scenario, IPv6: instances setup ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: sessions are up ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: session configured via local include files ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: good prefixes because of use_arin_bulk_whois_data ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: good prefixes received by rs: IRRdb white-list ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: good prefixes because of use_registrobr_bulk_whois_data ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: good prefixes because of use_rpki_roas_as_route_objects: exact ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: good prefixes because of use_rpki_roas_as_route_objects: covering ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: good prefixes received by rs ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: good prefixes received by rs: non-client NEXT_HOP ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: not IPv6 global unicast space ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: IRRdb white-list ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: AS_SET origin, RFC6907 7.1.9 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: IRR check for AS_SET origin, BIRD ... SKIP: BIRD specific -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: IRR check for AS_SET origin, OpenBGPD ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: AS_PATH len ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: bogon ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: client blacklist ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: global blacklist ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: invalid ASN in AS-PATH ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: invalid NEXT_HOP ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: left-most ASN ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: never via route servers ASN in AS-PATH (asns list) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: never via route servers ASN in AS-PATH (PeeringDB) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: origin not in AS-SET ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: prefix not in AS-SET ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: invalid prefix-len ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: transit-free ASN in AS-PATH ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: transit-free ASN in AS-PATH from a transit peer ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: unknown NEXT_HOP ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: RPKI ROAs as route objects failed ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: default route ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes not received by clients ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: bogon (wrong tag) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: global blacklist (wrong tag) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: RPKI, blackhole request for a covered prefix ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: RPKI, invalid prefix (bad ASN) received by rs ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: RPKI, invalid prefix (bad length) received by rs ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: RPKI, invalid prefix (bad ASN) not propagated to clients ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: RPKI, valid prefix received by rs ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: RPKI, valid prefix propagated to clients ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: prefixes from AS101 received by its upstreams ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: prefixes from AS101 received by rs ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad communities as seen by AS101 upstreams ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad communities scrubbed by rs (lrg) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad communities scrubbed by rs (std) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: other communities not scrubbed by rs (lrg) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: other communities not scrubbed by rs (std) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: blackhole filtering requests as seen by rs (BLACKHOLE) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: blackhole filtering requests as seen by rs (lrg cust) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: blackhole filtering requests as seen by rs (std cust) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: blackholed prefixes as seen by enabled clients (BLACKHOLE) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: blackholed prefixes as seen by enabled clients (lrg_cust) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: blackholed prefixes as seen by enabled clients (std_cust) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: blackholed prefixes not seen by not enabled clients ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: gshut by an enabled client ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: gshut by a not enabled client ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, announce to AS1 only ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, don't announce to any ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, announce to all except AS1 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, prepend once to any ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, prepend twice to any ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, prepend thrice to any ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, prepend once to AS1 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, prepend twice to AS2 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, prepend thrice to AS1, once to others ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, NO_EXPORT to AS1 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, NO_EXPORT to any ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, RFC1997 NO_EXPORT ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, RTT, blackhole, not peers > 20 ms ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, RTT, not peers > 15 ms ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, RTT, not peers > 5 ms ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, RTT, not peers > 5 ms + AS3 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, RTT, not peers <= 5 and > 100 ms ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, RTT, only peers <= 15 ms ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, RTT, only peers <= 5 ms ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, RTT, ext comms, prepend 1x > 10 ms, 2x > 20 ms ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, RTT, prepend 3x > 100 ms, 2x > 10 ms ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, RTT, prepend 3x <= 5 ms, 2x <= 20 ms, 1x any ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: prefixes received by clients: AS1_1 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: prefixes received by clients: AS1_2 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: prefixes received by clients: AS2 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: prefixes received by clients: AS3 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: prefixes received by clients: AS3 (with ADD-PATH) ... SKIP: ADD-PATH not supported by OpenBGPD < 7.5 -Live test, OpenBGPD 7.4, global scenario, IPv6: reconfigure ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: log contains errors ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: dumping rs config... -Live test, OpenBGPD 7.4, global scenario, IPv6: dumping routes... -Live test, OpenBGPD 7.4, global scenario, IPv6: stopping instances... +Live test, OpenBGPD 7.7, global scenario, IPv4: setting instances up... +Live test, OpenBGPD 7.7, global scenario, IPv4: instances setup ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: sessions are up ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: session configured via local include files ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: good prefixes because of use_arin_bulk_whois_data ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: good prefixes received by rs: IRRdb white-list ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: good prefixes because of use_registrobr_bulk_whois_data ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: good prefixes because of use_rpki_roas_as_route_objects: exact ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: good prefixes because of use_rpki_roas_as_route_objects: covering ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: good prefixes received by rs ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: good prefixes received by rs: non-client NEXT_HOP ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: not IPv6 global unicast space ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: IRRdb white-list ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: AS_SET origin, RFC6907 7.1.9 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: IRR check for AS_SET origin, BIRD ... SKIP: BIRD specific +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: IRR check for AS_SET origin, OpenBGPD ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: AS_PATH len ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: bogon ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: client blacklist ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: global blacklist ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: invalid ASN in AS-PATH ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: invalid NEXT_HOP ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: left-most ASN ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: never via route servers ASN in AS-PATH (asns list) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: never via route servers ASN in AS-PATH (PeeringDB) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: origin not in AS-SET ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: prefix not in AS-SET ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: invalid prefix-len ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: transit-free ASN in AS-PATH ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: transit-free ASN in AS-PATH from a transit peer ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: unknown NEXT_HOP ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: RPKI ROAs as route objects failed ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: default route ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes not received by clients ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: bogon (wrong tag) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: global blacklist (wrong tag) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: RPKI, blackhole request for a covered prefix ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: RPKI, invalid prefix (bad ASN) received by rs ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: RPKI, invalid prefix (bad length) received by rs ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: RPKI, invalid prefix (bad ASN) not propagated to clients ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: RPKI, valid prefix received by rs ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: RPKI, valid prefix propagated to clients ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: prefixes from AS101 received by its upstreams ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: prefixes from AS101 received by rs ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad communities as seen by AS101 upstreams ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad communities scrubbed by rs (lrg) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad communities scrubbed by rs (std) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: other communities not scrubbed by rs (lrg) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: other communities not scrubbed by rs (std) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: blackhole filtering requests as seen by rs (BLACKHOLE) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: blackhole filtering requests as seen by rs (lrg cust) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: blackhole filtering requests as seen by rs (std cust) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: blackholed prefixes as seen by enabled clients (BLACKHOLE) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: blackholed prefixes as seen by enabled clients (lrg_cust) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: blackholed prefixes as seen by enabled clients (std_cust) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: blackholed prefixes not seen by not enabled clients ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: gshut by an enabled client ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: gshut by a not enabled client ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, announce to AS1 only ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, don't announce to any ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, announce to all except AS1 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, prepend once to any ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, prepend twice to any ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, prepend thrice to any ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, prepend once to AS1 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, prepend twice to AS2 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, prepend thrice to AS1, once to others ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, NO_EXPORT to AS1 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, NO_EXPORT to any ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, RFC1997 NO_EXPORT ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, RTT, blackhole, not peers > 20 ms ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, RTT, not peers > 15 ms ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, RTT, not peers > 5 ms ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, RTT, not peers > 5 ms + AS3 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, RTT, not peers <= 5 and > 100 ms ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, RTT, only peers <= 15 ms ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, RTT, only peers <= 5 ms ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, RTT, ext comms, prepend 1x > 10 ms, 2x > 20 ms ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, RTT, prepend 3x > 100 ms, 2x > 10 ms ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, RTT, prepend 3x <= 5 ms, 2x <= 20 ms, 1x any ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: prefixes received by clients: AS1_1 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: prefixes received by clients: AS1_2 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: prefixes received by clients: AS2 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: prefixes received by clients: AS3 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: prefixes received by clients: AS3 (with ADD-PATH) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: reconfigure ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: log contains errors ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: dumping rs config... +Live test, OpenBGPD 7.7, global scenario, IPv4: dumping routes... +Live test, OpenBGPD 7.7, global scenario, IPv4: stopping instances... +Live test, OpenBGPD 7.7, global scenario, IPv6: setting instances up... +Live test, OpenBGPD 7.7, global scenario, IPv6: instances setup ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: sessions are up ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: session configured via local include files ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: good prefixes because of use_arin_bulk_whois_data ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: good prefixes received by rs: IRRdb white-list ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: good prefixes because of use_registrobr_bulk_whois_data ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: good prefixes because of use_rpki_roas_as_route_objects: exact ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: good prefixes because of use_rpki_roas_as_route_objects: covering ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: good prefixes received by rs ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: good prefixes received by rs: non-client NEXT_HOP ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: not IPv6 global unicast space ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: IRRdb white-list ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: AS_SET origin, RFC6907 7.1.9 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: IRR check for AS_SET origin, BIRD ... SKIP: BIRD specific +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: IRR check for AS_SET origin, OpenBGPD ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: AS_PATH len ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: bogon ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: client blacklist ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: global blacklist ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: invalid ASN in AS-PATH ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: invalid NEXT_HOP ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: left-most ASN ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: never via route servers ASN in AS-PATH (asns list) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: never via route servers ASN in AS-PATH (PeeringDB) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: origin not in AS-SET ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: prefix not in AS-SET ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: invalid prefix-len ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: transit-free ASN in AS-PATH ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: transit-free ASN in AS-PATH from a transit peer ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: unknown NEXT_HOP ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: RPKI ROAs as route objects failed ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: default route ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes not received by clients ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: bogon (wrong tag) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: global blacklist (wrong tag) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: RPKI, blackhole request for a covered prefix ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: RPKI, invalid prefix (bad ASN) received by rs ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: RPKI, invalid prefix (bad length) received by rs ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: RPKI, invalid prefix (bad ASN) not propagated to clients ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: RPKI, valid prefix received by rs ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: RPKI, valid prefix propagated to clients ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: prefixes from AS101 received by its upstreams ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: prefixes from AS101 received by rs ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad communities as seen by AS101 upstreams ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad communities scrubbed by rs (lrg) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad communities scrubbed by rs (std) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: other communities not scrubbed by rs (lrg) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: other communities not scrubbed by rs (std) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: blackhole filtering requests as seen by rs (BLACKHOLE) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: blackhole filtering requests as seen by rs (lrg cust) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: blackhole filtering requests as seen by rs (std cust) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: blackholed prefixes as seen by enabled clients (BLACKHOLE) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: blackholed prefixes as seen by enabled clients (lrg_cust) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: blackholed prefixes as seen by enabled clients (std_cust) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: blackholed prefixes not seen by not enabled clients ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: gshut by an enabled client ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: gshut by a not enabled client ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, announce to AS1 only ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, don't announce to any ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, announce to all except AS1 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, prepend once to any ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, prepend twice to any ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, prepend thrice to any ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, prepend once to AS1 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, prepend twice to AS2 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, prepend thrice to AS1, once to others ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, NO_EXPORT to AS1 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, NO_EXPORT to any ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, RFC1997 NO_EXPORT ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, RTT, blackhole, not peers > 20 ms ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, RTT, not peers > 15 ms ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, RTT, not peers > 5 ms ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, RTT, not peers > 5 ms + AS3 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, RTT, not peers <= 5 and > 100 ms ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, RTT, only peers <= 15 ms ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, RTT, only peers <= 5 ms ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, RTT, ext comms, prepend 1x > 10 ms, 2x > 20 ms ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, RTT, prepend 3x > 100 ms, 2x > 10 ms ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, RTT, prepend 3x <= 5 ms, 2x <= 20 ms, 1x any ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: prefixes received by clients: AS1_1 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: prefixes received by clients: AS1_2 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: prefixes received by clients: AS2 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: prefixes received by clients: AS3 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: prefixes received by clients: AS3 (with ADD-PATH) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: reconfigure ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: log contains errors ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: dumping rs config... +Live test, OpenBGPD 7.7, global scenario, IPv6: dumping routes... +Live test, OpenBGPD 7.7, global scenario, IPv6: stopping instances... +Live test, OpenBGPD 7.6, global scenario, IPv4: setting instances up... +Live test, OpenBGPD 7.6, global scenario, IPv4: instances setup ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: sessions are up ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: session configured via local include files ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: good prefixes because of use_arin_bulk_whois_data ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: good prefixes received by rs: IRRdb white-list ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: good prefixes because of use_registrobr_bulk_whois_data ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: good prefixes because of use_rpki_roas_as_route_objects: exact ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: good prefixes because of use_rpki_roas_as_route_objects: covering ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: good prefixes received by rs ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: good prefixes received by rs: non-client NEXT_HOP ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: not IPv6 global unicast space ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: IRRdb white-list ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: AS_SET origin, RFC6907 7.1.9 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: IRR check for AS_SET origin, BIRD ... SKIP: BIRD specific +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: IRR check for AS_SET origin, OpenBGPD ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: AS_PATH len ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: bogon ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: client blacklist ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: global blacklist ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: invalid ASN in AS-PATH ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: invalid NEXT_HOP ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: left-most ASN ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: never via route servers ASN in AS-PATH (asns list) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: never via route servers ASN in AS-PATH (PeeringDB) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: origin not in AS-SET ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: prefix not in AS-SET ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: invalid prefix-len ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: transit-free ASN in AS-PATH ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: transit-free ASN in AS-PATH from a transit peer ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: unknown NEXT_HOP ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: RPKI ROAs as route objects failed ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: default route ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes not received by clients ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: bogon (wrong tag) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: global blacklist (wrong tag) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: RPKI, blackhole request for a covered prefix ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: RPKI, invalid prefix (bad ASN) received by rs ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: RPKI, invalid prefix (bad length) received by rs ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: RPKI, invalid prefix (bad ASN) not propagated to clients ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: RPKI, valid prefix received by rs ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: RPKI, valid prefix propagated to clients ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: prefixes from AS101 received by its upstreams ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: prefixes from AS101 received by rs ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad communities as seen by AS101 upstreams ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad communities scrubbed by rs (lrg) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad communities scrubbed by rs (std) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: other communities not scrubbed by rs (lrg) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: other communities not scrubbed by rs (std) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: blackhole filtering requests as seen by rs (BLACKHOLE) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: blackhole filtering requests as seen by rs (lrg cust) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: blackhole filtering requests as seen by rs (std cust) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: blackholed prefixes as seen by enabled clients (BLACKHOLE) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: blackholed prefixes as seen by enabled clients (lrg_cust) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: blackholed prefixes as seen by enabled clients (std_cust) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: blackholed prefixes not seen by not enabled clients ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: gshut by an enabled client ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: gshut by a not enabled client ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, announce to AS1 only ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, don't announce to any ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, announce to all except AS1 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, prepend once to any ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, prepend twice to any ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, prepend thrice to any ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, prepend once to AS1 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, prepend twice to AS2 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, prepend thrice to AS1, once to others ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, NO_EXPORT to AS1 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, NO_EXPORT to any ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, RFC1997 NO_EXPORT ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, RTT, blackhole, not peers > 20 ms ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, RTT, not peers > 15 ms ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, RTT, not peers > 5 ms ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, RTT, not peers > 5 ms + AS3 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, RTT, not peers <= 5 and > 100 ms ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, RTT, only peers <= 15 ms ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, RTT, only peers <= 5 ms ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, RTT, ext comms, prepend 1x > 10 ms, 2x > 20 ms ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, RTT, prepend 3x > 100 ms, 2x > 10 ms ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, RTT, prepend 3x <= 5 ms, 2x <= 20 ms, 1x any ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: prefixes received by clients: AS1_1 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: prefixes received by clients: AS1_2 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: prefixes received by clients: AS2 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: prefixes received by clients: AS3 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: prefixes received by clients: AS3 (with ADD-PATH) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: reconfigure ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: log contains errors ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: dumping rs config... +Live test, OpenBGPD 7.6, global scenario, IPv4: dumping routes... +Live test, OpenBGPD 7.6, global scenario, IPv4: stopping instances... +Live test, OpenBGPD 7.6, global scenario, IPv6: setting instances up... +Live test, OpenBGPD 7.6, global scenario, IPv6: instances setup ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: sessions are up ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: session configured via local include files ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: good prefixes because of use_arin_bulk_whois_data ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: good prefixes received by rs: IRRdb white-list ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: good prefixes because of use_registrobr_bulk_whois_data ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: good prefixes because of use_rpki_roas_as_route_objects: exact ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: good prefixes because of use_rpki_roas_as_route_objects: covering ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: good prefixes received by rs ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: good prefixes received by rs: non-client NEXT_HOP ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: not IPv6 global unicast space ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: IRRdb white-list ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: AS_SET origin, RFC6907 7.1.9 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: IRR check for AS_SET origin, BIRD ... SKIP: BIRD specific +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: IRR check for AS_SET origin, OpenBGPD ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: AS_PATH len ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: bogon ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: client blacklist ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: global blacklist ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: invalid ASN in AS-PATH ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: invalid NEXT_HOP ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: left-most ASN ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: never via route servers ASN in AS-PATH (asns list) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: never via route servers ASN in AS-PATH (PeeringDB) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: origin not in AS-SET ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: prefix not in AS-SET ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: invalid prefix-len ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: transit-free ASN in AS-PATH ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: transit-free ASN in AS-PATH from a transit peer ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: unknown NEXT_HOP ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: RPKI ROAs as route objects failed ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: default route ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes not received by clients ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: bogon (wrong tag) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: global blacklist (wrong tag) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: RPKI, blackhole request for a covered prefix ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: RPKI, invalid prefix (bad ASN) received by rs ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: RPKI, invalid prefix (bad length) received by rs ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: RPKI, invalid prefix (bad ASN) not propagated to clients ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: RPKI, valid prefix received by rs ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: RPKI, valid prefix propagated to clients ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: prefixes from AS101 received by its upstreams ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: prefixes from AS101 received by rs ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad communities as seen by AS101 upstreams ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad communities scrubbed by rs (lrg) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad communities scrubbed by rs (std) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: other communities not scrubbed by rs (lrg) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: other communities not scrubbed by rs (std) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: blackhole filtering requests as seen by rs (BLACKHOLE) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: blackhole filtering requests as seen by rs (lrg cust) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: blackhole filtering requests as seen by rs (std cust) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: blackholed prefixes as seen by enabled clients (BLACKHOLE) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: blackholed prefixes as seen by enabled clients (lrg_cust) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: blackholed prefixes as seen by enabled clients (std_cust) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: blackholed prefixes not seen by not enabled clients ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: gshut by an enabled client ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: gshut by a not enabled client ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, announce to AS1 only ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, don't announce to any ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, announce to all except AS1 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, prepend once to any ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, prepend twice to any ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, prepend thrice to any ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, prepend once to AS1 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, prepend twice to AS2 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, prepend thrice to AS1, once to others ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, NO_EXPORT to AS1 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, NO_EXPORT to any ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, RFC1997 NO_EXPORT ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, RTT, blackhole, not peers > 20 ms ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, RTT, not peers > 15 ms ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, RTT, not peers > 5 ms ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, RTT, not peers > 5 ms + AS3 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, RTT, not peers <= 5 and > 100 ms ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, RTT, only peers <= 15 ms ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, RTT, only peers <= 5 ms ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, RTT, ext comms, prepend 1x > 10 ms, 2x > 20 ms ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, RTT, prepend 3x > 100 ms, 2x > 10 ms ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, RTT, prepend 3x <= 5 ms, 2x <= 20 ms, 1x any ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: prefixes received by clients: AS1_1 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: prefixes received by clients: AS1_2 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: prefixes received by clients: AS2 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: prefixes received by clients: AS3 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: prefixes received by clients: AS3 (with ADD-PATH) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: reconfigure ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: log contains errors ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: dumping rs config... +Live test, OpenBGPD 7.6, global scenario, IPv6: dumping routes... +Live test, OpenBGPD 7.6, global scenario, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 344 tests in 329.423s - -OK (SKIP=6) -Live test, OpenBGPD 7.5, gshut, IPv4: setting instances up... -Live test, OpenBGPD 7.5, gshut, IPv4: instances setup ... ok -Live test, OpenBGPD 7.5, gshut, IPv4: sessions are up ... ok -Live test, OpenBGPD 7.5, gshut, IPv4: clients receive routes tagged with GRACEFUL_SHUTDOWN ... ok -Live test, OpenBGPD 7.5, gshut, IPv4: reconfigure ... ok -Live test, OpenBGPD 7.5, gshut, IPv4: log contains errors ... ok -Live test, OpenBGPD 7.5, gshut, IPv4: dumping rs config... -Live test, OpenBGPD 7.5, gshut, IPv4: dumping routes... -Live test, OpenBGPD 7.5, gshut, IPv4: stopping instances... -Live test, OpenBGPD 7.5, gshut, IPv6: setting instances up... -Live test, OpenBGPD 7.5, gshut, IPv6: instances setup ... ok -Live test, OpenBGPD 7.5, gshut, IPv6: sessions are up ... ok -Live test, OpenBGPD 7.5, gshut, IPv6: clients receive routes tagged with GRACEFUL_SHUTDOWN ... ok -Live test, OpenBGPD 7.5, gshut, IPv6: reconfigure ... ok -Live test, OpenBGPD 7.5, gshut, IPv6: log contains errors ... ok -Live test, OpenBGPD 7.5, gshut, IPv6: dumping rs config... -Live test, OpenBGPD 7.5, gshut, IPv6: dumping routes... -Live test, OpenBGPD 7.5, gshut, IPv6: stopping instances... +Ran 344 tests in 372.628s + +OK (SKIP=4) +Live test, OpenBGPD 7.7, gshut, IPv4: setting instances up... +Live test, OpenBGPD 7.7, gshut, IPv4: instances setup ... ok +Live test, OpenBGPD 7.7, gshut, IPv4: sessions are up ... ok +Live test, OpenBGPD 7.7, gshut, IPv4: clients receive routes tagged with GRACEFUL_SHUTDOWN ... ok +Live test, OpenBGPD 7.7, gshut, IPv4: reconfigure ... ok +Live test, OpenBGPD 7.7, gshut, IPv4: log contains errors ... ok +Live test, OpenBGPD 7.7, gshut, IPv4: dumping rs config... +Live test, OpenBGPD 7.7, gshut, IPv4: dumping routes... +Live test, OpenBGPD 7.7, gshut, IPv4: stopping instances... +Live test, OpenBGPD 7.7, gshut, IPv6: setting instances up... +Live test, OpenBGPD 7.7, gshut, IPv6: instances setup ... ok +Live test, OpenBGPD 7.7, gshut, IPv6: sessions are up ... ok +Live test, OpenBGPD 7.7, gshut, IPv6: clients receive routes tagged with GRACEFUL_SHUTDOWN ... ok +Live test, OpenBGPD 7.7, gshut, IPv6: reconfigure ... ok +Live test, OpenBGPD 7.7, gshut, IPv6: log contains errors ... ok +Live test, OpenBGPD 7.7, gshut, IPv6: dumping rs config... +Live test, OpenBGPD 7.7, gshut, IPv6: dumping routes... +Live test, OpenBGPD 7.7, gshut, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 10 tests in 49.272s +Ran 10 tests in 53.914s OK -Live test, OpenBGPD 7.5, max-prefix, IPv4: setting instances up... -Live test, OpenBGPD 7.5, max-prefix, IPv4: instances setup ... ok -Live test, OpenBGPD 7.5, max-prefix, IPv4: sessions are down ... ok -Live test, OpenBGPD 7.5, max-prefix, IPv4: clients log max-prefix notification ... ok -Live test, OpenBGPD 7.5, max-prefix, IPv4: reconfigure ... ok -Live test, OpenBGPD 7.5, max-prefix, IPv4: log contains errors ... ok -Live test, OpenBGPD 7.5, max-prefix, IPv4: dumping rs config... -Live test, OpenBGPD 7.5, max-prefix, IPv4: dumping routes... -Live test, OpenBGPD 7.5, max-prefix, IPv4: stopping instances... -Live test, OpenBGPD 7.5, max-prefix, IPv6: setting instances up... -Live test, OpenBGPD 7.5, max-prefix, IPv6: instances setup ... ok -Live test, OpenBGPD 7.5, max-prefix, IPv6: sessions are down ... ok -Live test, OpenBGPD 7.5, max-prefix, IPv6: clients log max-prefix notification ... ok -Live test, OpenBGPD 7.5, max-prefix, IPv6: reconfigure ... ok -Live test, OpenBGPD 7.5, max-prefix, IPv6: log contains errors ... ok -Live test, OpenBGPD 7.5, max-prefix, IPv6: dumping rs config... -Live test, OpenBGPD 7.5, max-prefix, IPv6: dumping routes... -Live test, OpenBGPD 7.5, max-prefix, IPv6: stopping instances... +Live test, OpenBGPD 7.7, max-prefix, IPv4: setting instances up... +Live test, OpenBGPD 7.7, max-prefix, IPv4: instances setup ... ok +Live test, OpenBGPD 7.7, max-prefix, IPv4: sessions are down ... ok +Live test, OpenBGPD 7.7, max-prefix, IPv4: clients log max-prefix notification ... ok +Live test, OpenBGPD 7.7, max-prefix, IPv4: reconfigure ... ok +Live test, OpenBGPD 7.7, max-prefix, IPv4: log contains errors ... ok +Live test, OpenBGPD 7.7, max-prefix, IPv4: dumping rs config... +Live test, OpenBGPD 7.7, max-prefix, IPv4: dumping routes... +Live test, OpenBGPD 7.7, max-prefix, IPv4: stopping instances... +Live test, OpenBGPD 7.7, max-prefix, IPv6: setting instances up... +Live test, OpenBGPD 7.7, max-prefix, IPv6: instances setup ... ok +Live test, OpenBGPD 7.7, max-prefix, IPv6: sessions are down ... ok +Live test, OpenBGPD 7.7, max-prefix, IPv6: clients log max-prefix notification ... ok +Live test, OpenBGPD 7.7, max-prefix, IPv6: reconfigure ... ok +Live test, OpenBGPD 7.7, max-prefix, IPv6: log contains errors ... ok +Live test, OpenBGPD 7.7, max-prefix, IPv6: dumping rs config... +Live test, OpenBGPD 7.7, max-prefix, IPv6: dumping routes... +Live test, OpenBGPD 7.7, max-prefix, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 10 tests in 358.497s +Ran 10 tests in 393.754s OK -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv4: setting instances up... -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv4: instances setup ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv4: sessions are up ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv4: rs should receive prefix from both AS1 and AS2 ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv4: rs should have best toward AS1 ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv4: AS1 wants rs to not announce to AS3 and AS4 ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv4: AS3 does not receive prefix at all ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv4: AS4 receives the prefix via AS2 because of ADD-PATH ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv4: reconfigure ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv4: log contains errors ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv4: dumping rs config... -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv4: dumping routes... -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv4: stopping instances... -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv4: setting instances up... -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv4: instances setup ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv4: sessions are up ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv4: rs should receive prefix from both AS1 and AS2 ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv4: rs should have best toward AS1 ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv4: AS1 wants rs to not announce to AS3 and AS4 ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv4: AS3 and AS4 receive prefix with sub-optimal path via AS2 ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv4: AS3 and AS4 don't receive prefix via AS1 ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv4: 2nd best is withdrawn and AS3 should not see it anymore ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv4: reconfigure ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv4: log contains errors ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv4: dumping rs config... -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv4: dumping routes... -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv4: stopping instances... -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv6: setting instances up... -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv6: instances setup ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv6: sessions are up ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv6: rs should receive prefix from both AS1 and AS2 ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv6: rs should have best toward AS1 ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv6: AS1 wants rs to not announce to AS3 and AS4 ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv6: AS3 does not receive prefix at all ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv6: AS4 receives the prefix via AS2 because of ADD-PATH ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv6: reconfigure ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv6: log contains errors ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv6: dumping rs config... -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv6: dumping routes... -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv6: stopping instances... -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv6: setting instances up... -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv6: instances setup ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv6: sessions are up ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv6: rs should receive prefix from both AS1 and AS2 ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv6: rs should have best toward AS1 ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv6: AS1 wants rs to not announce to AS3 and AS4 ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv6: AS3 and AS4 receive prefix with sub-optimal path via AS2 ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv6: AS3 and AS4 don't receive prefix via AS1 ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv6: 2nd best is withdrawn and AS3 should not see it anymore ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv6: reconfigure ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv6: log contains errors ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv6: dumping rs config... -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv6: dumping routes... -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv6: stopping instances... +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv4: setting instances up... +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv4: instances setup ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv4: sessions are up ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv4: rs should receive prefix from both AS1 and AS2 ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv4: rs should have best toward AS1 ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv4: AS1 wants rs to not announce to AS3 and AS4 ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv4: AS3 does not receive prefix at all ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv4: AS4 receives the prefix via AS2 because of ADD-PATH ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv4: reconfigure ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv4: log contains errors ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv4: dumping rs config... +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv4: dumping routes... +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv4: stopping instances... +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv4: setting instances up... +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv4: instances setup ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv4: sessions are up ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv4: rs should receive prefix from both AS1 and AS2 ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv4: rs should have best toward AS1 ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv4: AS1 wants rs to not announce to AS3 and AS4 ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv4: AS3 and AS4 receive prefix with sub-optimal path via AS2 ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv4: AS3 and AS4 don't receive prefix via AS1 ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv4: 2nd best is withdrawn and AS3 should not see it anymore ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv4: reconfigure ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv4: log contains errors ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv4: dumping rs config... +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv4: dumping routes... +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv4: stopping instances... +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv6: setting instances up... +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv6: instances setup ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv6: sessions are up ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv6: rs should receive prefix from both AS1 and AS2 ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv6: rs should have best toward AS1 ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv6: AS1 wants rs to not announce to AS3 and AS4 ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv6: AS3 does not receive prefix at all ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv6: AS4 receives the prefix via AS2 because of ADD-PATH ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv6: reconfigure ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv6: log contains errors ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv6: dumping rs config... +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv6: dumping routes... +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv6: stopping instances... +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv6: setting instances up... +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv6: instances setup ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv6: sessions are up ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv6: rs should receive prefix from both AS1 and AS2 ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv6: rs should have best toward AS1 ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv6: AS1 wants rs to not announce to AS3 and AS4 ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv6: AS3 and AS4 receive prefix with sub-optimal path via AS2 ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv6: AS3 and AS4 don't receive prefix via AS1 ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv6: 2nd best is withdrawn and AS3 should not see it anymore ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv6: reconfigure ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv6: log contains errors ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv6: dumping rs config... +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv6: dumping routes... +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 38 tests in 192.492s +Ran 38 tests in 197.166s OK -Live test, OpenBGPD 7.5, examples, rich config, IPv4: setting instances up... -Live test, OpenBGPD 7.5, examples, rich config, IPv4: instances setup ... ok -Live test, OpenBGPD 7.5, examples, rich config, IPv4: log contains errors ... ok -Live test, OpenBGPD 7.5, examples, rich config, IPv4: dumping rs config... -Live test, OpenBGPD 7.5, examples, rich config, IPv4: dumping routes... -Live test, OpenBGPD 7.5, examples, rich config, IPv4: stopping instances... -Live test, OpenBGPD 7.5, examples, rich config, IPv6: setting instances up... -Live test, OpenBGPD 7.5, examples, rich config, IPv6: instances setup ... ok -Live test, OpenBGPD 7.5, examples, rich config, IPv6: log contains errors ... ok -Live test, OpenBGPD 7.5, examples, rich config, IPv6: dumping rs config... -Live test, OpenBGPD 7.5, examples, rich config, IPv6: dumping routes... -Live test, OpenBGPD 7.5, examples, rich config, IPv6: stopping instances... +Live test, OpenBGPD 7.7, examples, rich config, IPv4: setting instances up... +Live test, OpenBGPD 7.7, examples, rich config, IPv4: instances setup ... ok +Live test, OpenBGPD 7.7, examples, rich config, IPv4: log contains errors ... ok +Live test, OpenBGPD 7.7, examples, rich config, IPv4: dumping rs config... +Live test, OpenBGPD 7.7, examples, rich config, IPv4: dumping routes... +Live test, OpenBGPD 7.7, examples, rich config, IPv4: stopping instances... +Live test, OpenBGPD 7.7, examples, rich config, IPv6: setting instances up... +Live test, OpenBGPD 7.7, examples, rich config, IPv6: instances setup ... ok +Live test, OpenBGPD 7.7, examples, rich config, IPv6: log contains errors ... ok +Live test, OpenBGPD 7.7, examples, rich config, IPv6: dumping rs config... +Live test, OpenBGPD 7.7, examples, rich config, IPv6: dumping routes... +Live test, OpenBGPD 7.7, examples, rich config, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 4 tests in 22.056s +Ran 4 tests in 17.642s OK -Live test, OpenBGPD 7.5, RTR protocol: setting instances up... -Live test, OpenBGPD 7.5, RTR protocol: instances setup ... ok -Live test, OpenBGPD 7.5, RTR protocol: sessions are up ... ok -Live test, OpenBGPD 7.5, RTR protocol: route accepted because validator not running ... ok -Live test, OpenBGPD 7.5, RTR protocol: spin up the validator ... ok -Live test, OpenBGPD 7.5, RTR protocol: restart OpenBGPD to speed up RTR session establishment ... ok -Live test, OpenBGPD 7.5, RTR protocol: check the RTR session is up ... ok -Live test, OpenBGPD 7.5, RTR protocol: route dropped after spinning the validator up ... ok -Live test, OpenBGPD 7.5, RTR protocol: log contains errors ... ok -Live test, OpenBGPD 7.5, RTR protocol: dumping rs config... -Live test, OpenBGPD 7.5, RTR protocol: dumping routes... -Live test, OpenBGPD 7.5, RTR protocol: stopping instances... +Live test, OpenBGPD 7.7, RTR protocol: setting instances up... +Live test, OpenBGPD 7.7, RTR protocol: instances setup ... ok +Live test, OpenBGPD 7.7, RTR protocol: sessions are up ... ok +Live test, OpenBGPD 7.7, RTR protocol: route accepted because validator not running ... ok +Live test, OpenBGPD 7.7, RTR protocol: spin up the validator ... ok +Live test, OpenBGPD 7.7, RTR protocol: restart OpenBGPD to speed up RTR session establishment ... ok +Live test, OpenBGPD 7.7, RTR protocol: check the RTR session is up ... ok +Live test, OpenBGPD 7.7, RTR protocol: route dropped after spinning the validator up ... ok +Live test, OpenBGPD 7.7, RTR protocol: log contains errors ... ok +Live test, OpenBGPD 7.7, RTR protocol: dumping rs config... +Live test, OpenBGPD 7.7, RTR protocol: dumping routes... +Live test, OpenBGPD 7.7, RTR protocol: stopping instances... ---------------------------------------------------------------------- -Ran 8 tests in 43.032s +Ran 8 tests in 44.083s OK -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: setting instances up... -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: instances setup ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: sessions are up ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS2 prefix ko origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS2 prefix ko origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS2 prefix ok origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS2 prefix ok origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS4 route filtered (origin ko) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS4 prefix ko origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS4 prefix ok origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS4 route filtered (prefix ko, origin ko) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS5 route filtered (prefix ko, origin ko) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS5 route filtered (prefix ko) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS5 prefix ok origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS5 prefix ok origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS2 white list, prefix ko, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS2 white list, prefix ok, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS2 white list, prefix WL, origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS2 white list, prefix WL, origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS2 white list, prefix WL, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS4 route white list, ok (exact) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS4 route white list, reject (more spec) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS4 route white list, ok (more spec) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS4 route white list, reject (origin KO) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS4 route white list, ok (origin any) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS4 white list, prefix ko, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS4 white list, prefix ok, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS4 white list, prefix WL, origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS4 white list, prefix WL, origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS4 white list, prefix WL, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS5 white list, prefix ko, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS5 white list, prefix ok, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS5 white list, prefix WL, origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS5 white list, prefix WL, origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS5 white list, prefix WL, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS2 RPKI ROAs as route objects: tag only (w/ prefix_validated_via_rpki_roas) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS6 RPKI ROAs as route objects: invalid origin ASN ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS6 RPKI ROAs as route objects: ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS2 ARIN Whois DB: tag only (w/ prefix_validated_via_arin_whois_db_dump) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS6 ARIN Whois DB: ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS2 prefix ok, origin ok, ARIN: tag only (w/ prefix_validated_via_arin_whois_db_dump) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS2 prefix ok, origin ok, ROA: tag only (w/ prefix_validated_via_rpki_roas) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS2 ROA + ARIN Whois DB: tag only (w/ comms [arin_whois_db_dump, rpki_roas]) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS6 prefix ok, origin ok, ROA + ARIN: enforce (w/ comms [arin_whois_db_dump, rpki_roas]) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS6 ROA + ARIN Whois DB: enforce (w/ comms [arin_whois_db_dump, rpki_roas]) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: reconfigure ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: log contains errors ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: dumping rs config... -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: dumping routes... -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: stopping instances... -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: setting instances up... -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: instances setup ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: sessions are up ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS2 no enforcement, prefix and origin not in AS-SET ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS4 origin enforcement ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS4 prefix enforcement ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS2 white list, prefix ko, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS2 white list, prefix ok, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS2 white list, prefix WL, origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS2 white list, prefix WL, origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS2 white list, prefix WL, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS4 route white list, ok (exact) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS4 route white list, reject (more spec) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS4 route white list, ok (more spec) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS4 route white list, reject (origin KO) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS4 route white list, ok (origin any) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS4 white list, prefix ko, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS4 white list, prefix ok, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS4 white list, prefix WL, origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS4 white list, prefix WL, origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS4 white list, prefix WL, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS5 white list, prefix ko, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS5 white list, prefix ok, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS5 white list, prefix WL, origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS5 white list, prefix WL, origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS5 white list, prefix WL, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS2 RPKI ROAs as route objects: tag only (w/o prefix_validated_via_rpki_roas) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS6 RPKI ROAs as route objects: invalid origin ASN ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS6 RPKI ROAs as route objects: ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS2 ARIN Whois DB: tag only (w/o prefix_validated_via_arin_whois_db_dump) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS6 ARIN Whois DB: ok (solely because of route white list) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS2 prefix ok, origin ok, ARIN: tag only (w/o prefix_validated_via_arin_whois_db_dump) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS2 prefix ok, origin ok, ROA: tag only (w/o prefix_validated_via_rpki_roas) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS2 ROA + ARIN Whois DB: tag only (w/o comms [arin_whois_db_dump, rpki_roas]) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS6 prefix ok, origin ok, ROA + ARIN: rejected ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS6 ROA + ARIN Whois DB: enforced (rejected) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: reconfigure ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: log contains errors ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: dumping rs config... -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: dumping routes... -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: stopping instances... -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: setting instances up... -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: instances setup ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: sessions are up ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS2 prefix ko origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS2 prefix ko origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS2 prefix ok origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS2 prefix ok origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS4 route filtered (origin ko) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS4 prefix ko origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS4 prefix ok origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS4 route filtered (prefix ko, origin ko) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS5 route filtered (prefix ko, origin ko) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS5 route filtered (prefix ko) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS5 prefix ok origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS5 prefix ok origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS2 white list, prefix ko, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS2 white list, prefix ok, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS2 white list, prefix WL, origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS2 white list, prefix WL, origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS2 white list, prefix WL, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS4 route white list, ok (exact) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS4 route white list, reject (more spec) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS4 route white list, ok (more spec) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS4 route white list, reject (origin KO) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS4 route white list, ok (origin any) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS4 white list, prefix ko, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS4 white list, prefix ok, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS4 white list, prefix WL, origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS4 white list, prefix WL, origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS4 white list, prefix WL, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS5 white list, prefix ko, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS5 white list, prefix ok, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS5 white list, prefix WL, origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS5 white list, prefix WL, origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS5 white list, prefix WL, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS2 RPKI ROAs as route objects: tag only (w/ prefix_validated_via_rpki_roas) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS6 RPKI ROAs as route objects: invalid origin ASN ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS6 RPKI ROAs as route objects: ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS2 ARIN Whois DB: tag only (w/ prefix_validated_via_arin_whois_db_dump) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS6 ARIN Whois DB: ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS2 prefix ok, origin ok, ARIN: tag only (w/ prefix_validated_via_arin_whois_db_dump) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS2 prefix ok, origin ok, ROA: tag only (w/ prefix_validated_via_rpki_roas) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS2 ROA + ARIN Whois DB: tag only (w/ comms [arin_whois_db_dump, rpki_roas]) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS6 prefix ok, origin ok, ROA + ARIN: enforce (w/ comms [arin_whois_db_dump, rpki_roas]) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS6 ROA + ARIN Whois DB: enforce (w/ comms [arin_whois_db_dump, rpki_roas]) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: reconfigure ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: log contains errors ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: dumping rs config... -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: dumping routes... -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: stopping instances... -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: setting instances up... -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: instances setup ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: sessions are up ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS2 no enforcement, prefix and origin not in AS-SET ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS4 origin enforcement ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS4 prefix enforcement ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS2 white list, prefix ko, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS2 white list, prefix ok, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS2 white list, prefix WL, origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS2 white list, prefix WL, origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS2 white list, prefix WL, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS4 route white list, ok (exact) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS4 route white list, reject (more spec) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS4 route white list, ok (more spec) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS4 route white list, reject (origin KO) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS4 route white list, ok (origin any) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS4 white list, prefix ko, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS4 white list, prefix ok, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS4 white list, prefix WL, origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS4 white list, prefix WL, origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS4 white list, prefix WL, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS5 white list, prefix ko, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS5 white list, prefix ok, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS5 white list, prefix WL, origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS5 white list, prefix WL, origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS5 white list, prefix WL, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS2 RPKI ROAs as route objects: tag only (w/o prefix_validated_via_rpki_roas) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS6 RPKI ROAs as route objects: invalid origin ASN ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS6 RPKI ROAs as route objects: ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS2 ARIN Whois DB: tag only (w/o prefix_validated_via_arin_whois_db_dump) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS6 ARIN Whois DB: ok (solely because of route white list) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS2 prefix ok, origin ok, ARIN: tag only (w/o prefix_validated_via_arin_whois_db_dump) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS2 prefix ok, origin ok, ROA: tag only (w/o prefix_validated_via_rpki_roas) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS2 ROA + ARIN Whois DB: tag only (w/o comms [arin_whois_db_dump, rpki_roas]) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS6 prefix ok, origin ok, ROA + ARIN: rejected ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS6 ROA + ARIN Whois DB: enforced (rejected) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: reconfigure ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: log contains errors ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: dumping rs config... -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: dumping routes... -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: stopping instances... +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: setting instances up... +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: instances setup ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: sessions are up ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS2 prefix ko origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS2 prefix ko origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS2 prefix ok origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS2 prefix ok origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS4 route filtered (origin ko) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS4 prefix ko origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS4 prefix ok origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS4 route filtered (prefix ko, origin ko) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS5 route filtered (prefix ko, origin ko) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS5 route filtered (prefix ko) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS5 prefix ok origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS5 prefix ok origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS2 white list, prefix ko, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS2 white list, prefix ok, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS2 white list, prefix WL, origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS2 white list, prefix WL, origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS2 white list, prefix WL, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS4 route white list, ok (exact) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS4 route white list, reject (more spec) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS4 route white list, ok (more spec) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS4 route white list, reject (origin KO) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS4 route white list, ok (origin any) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS4 white list, prefix ko, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS4 white list, prefix ok, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS4 white list, prefix WL, origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS4 white list, prefix WL, origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS4 white list, prefix WL, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS5 white list, prefix ko, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS5 white list, prefix ok, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS5 white list, prefix WL, origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS5 white list, prefix WL, origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS5 white list, prefix WL, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS2 RPKI ROAs as route objects: tag only (w/ prefix_validated_via_rpki_roas) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS6 RPKI ROAs as route objects: invalid origin ASN ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS6 RPKI ROAs as route objects: ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS2 ARIN Whois DB: tag only (w/ prefix_validated_via_arin_whois_db_dump) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS6 ARIN Whois DB: ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS2 prefix ok, origin ok, ARIN: tag only (w/ prefix_validated_via_arin_whois_db_dump) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS2 prefix ok, origin ok, ROA: tag only (w/ prefix_validated_via_rpki_roas) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS2 ROA + ARIN Whois DB: tag only (w/ comms [arin_whois_db_dump, rpki_roas]) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS6 prefix ok, origin ok, ROA + ARIN: enforce (w/ comms [arin_whois_db_dump, rpki_roas]) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS6 ROA + ARIN Whois DB: enforce (w/ comms [arin_whois_db_dump, rpki_roas]) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: reconfigure ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: log contains errors ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: dumping rs config... +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: dumping routes... +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: stopping instances... +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: setting instances up... +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: instances setup ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: sessions are up ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS2 no enforcement, prefix and origin not in AS-SET ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS4 origin enforcement ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS4 prefix enforcement ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS2 white list, prefix ko, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS2 white list, prefix ok, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS2 white list, prefix WL, origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS2 white list, prefix WL, origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS2 white list, prefix WL, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS4 route white list, ok (exact) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS4 route white list, reject (more spec) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS4 route white list, ok (more spec) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS4 route white list, reject (origin KO) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS4 route white list, ok (origin any) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS4 white list, prefix ko, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS4 white list, prefix ok, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS4 white list, prefix WL, origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS4 white list, prefix WL, origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS4 white list, prefix WL, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS5 white list, prefix ko, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS5 white list, prefix ok, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS5 white list, prefix WL, origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS5 white list, prefix WL, origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS5 white list, prefix WL, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS2 RPKI ROAs as route objects: tag only (w/o prefix_validated_via_rpki_roas) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS6 RPKI ROAs as route objects: invalid origin ASN ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS6 RPKI ROAs as route objects: ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS2 ARIN Whois DB: tag only (w/o prefix_validated_via_arin_whois_db_dump) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS6 ARIN Whois DB: ok (solely because of route white list) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS2 prefix ok, origin ok, ARIN: tag only (w/o prefix_validated_via_arin_whois_db_dump) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS2 prefix ok, origin ok, ROA: tag only (w/o prefix_validated_via_rpki_roas) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS2 ROA + ARIN Whois DB: tag only (w/o comms [arin_whois_db_dump, rpki_roas]) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS6 prefix ok, origin ok, ROA + ARIN: rejected ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS6 ROA + ARIN Whois DB: enforced (rejected) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: reconfigure ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: log contains errors ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: dumping rs config... +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: dumping routes... +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: stopping instances... +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: setting instances up... +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: instances setup ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: sessions are up ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS2 prefix ko origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS2 prefix ko origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS2 prefix ok origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS2 prefix ok origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS4 route filtered (origin ko) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS4 prefix ko origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS4 prefix ok origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS4 route filtered (prefix ko, origin ko) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS5 route filtered (prefix ko, origin ko) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS5 route filtered (prefix ko) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS5 prefix ok origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS5 prefix ok origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS2 white list, prefix ko, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS2 white list, prefix ok, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS2 white list, prefix WL, origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS2 white list, prefix WL, origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS2 white list, prefix WL, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS4 route white list, ok (exact) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS4 route white list, reject (more spec) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS4 route white list, ok (more spec) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS4 route white list, reject (origin KO) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS4 route white list, ok (origin any) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS4 white list, prefix ko, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS4 white list, prefix ok, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS4 white list, prefix WL, origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS4 white list, prefix WL, origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS4 white list, prefix WL, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS5 white list, prefix ko, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS5 white list, prefix ok, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS5 white list, prefix WL, origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS5 white list, prefix WL, origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS5 white list, prefix WL, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS2 RPKI ROAs as route objects: tag only (w/ prefix_validated_via_rpki_roas) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS6 RPKI ROAs as route objects: invalid origin ASN ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS6 RPKI ROAs as route objects: ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS2 ARIN Whois DB: tag only (w/ prefix_validated_via_arin_whois_db_dump) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS6 ARIN Whois DB: ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS2 prefix ok, origin ok, ARIN: tag only (w/ prefix_validated_via_arin_whois_db_dump) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS2 prefix ok, origin ok, ROA: tag only (w/ prefix_validated_via_rpki_roas) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS2 ROA + ARIN Whois DB: tag only (w/ comms [arin_whois_db_dump, rpki_roas]) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS6 prefix ok, origin ok, ROA + ARIN: enforce (w/ comms [arin_whois_db_dump, rpki_roas]) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS6 ROA + ARIN Whois DB: enforce (w/ comms [arin_whois_db_dump, rpki_roas]) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: reconfigure ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: log contains errors ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: dumping rs config... +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: dumping routes... +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: stopping instances... +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: setting instances up... +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: instances setup ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: sessions are up ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS2 no enforcement, prefix and origin not in AS-SET ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS4 origin enforcement ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS4 prefix enforcement ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS2 white list, prefix ko, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS2 white list, prefix ok, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS2 white list, prefix WL, origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS2 white list, prefix WL, origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS2 white list, prefix WL, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS4 route white list, ok (exact) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS4 route white list, reject (more spec) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS4 route white list, ok (more spec) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS4 route white list, reject (origin KO) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS4 route white list, ok (origin any) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS4 white list, prefix ko, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS4 white list, prefix ok, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS4 white list, prefix WL, origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS4 white list, prefix WL, origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS4 white list, prefix WL, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS5 white list, prefix ko, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS5 white list, prefix ok, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS5 white list, prefix WL, origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS5 white list, prefix WL, origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS5 white list, prefix WL, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS2 RPKI ROAs as route objects: tag only (w/o prefix_validated_via_rpki_roas) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS6 RPKI ROAs as route objects: invalid origin ASN ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS6 RPKI ROAs as route objects: ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS2 ARIN Whois DB: tag only (w/o prefix_validated_via_arin_whois_db_dump) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS6 ARIN Whois DB: ok (solely because of route white list) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS2 prefix ok, origin ok, ARIN: tag only (w/o prefix_validated_via_arin_whois_db_dump) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS2 prefix ok, origin ok, ROA: tag only (w/o prefix_validated_via_rpki_roas) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS2 ROA + ARIN Whois DB: tag only (w/o comms [arin_whois_db_dump, rpki_roas]) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS6 prefix ok, origin ok, ROA + ARIN: rejected ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS6 ROA + ARIN Whois DB: enforced (rejected) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: reconfigure ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: log contains errors ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: dumping rs config... +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: dumping routes... +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 166 tests in 173.555s +Ran 166 tests in 181.276s OK -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: setting instances up... -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: instances setup ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: sessions are up ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: AS_PATH too long ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: bogon prefix ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: bogon prefix, wrong announcing ASN ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: prefix in client's blacklist ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: invalid ASN in AS_PATH ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: invalid NEXT_HOP ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: local black list ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: prefix is not in IPv6 global unicast space ... SKIP: IPv6 only test -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: origin not in as-macro ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: invalid left-most ASN ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: prefix length ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: prefix not in as-macro ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: RPKI INVALID route ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: transit-free ASN in AS_PATH ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: good routes not received ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: prefixes received by clients: AS1_1 ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: prefixes received by clients: AS1_2 ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: prefixes received by clients: AS2 ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: reconfigure ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: log contains errors ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: dumping rs config... -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: dumping routes... -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: stopping instances... -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: setting instances up... -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: instances setup ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: sessions are up ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: AS_PATH too long ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: bogon prefix ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: bogon prefix, wrong announcing ASN ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: prefix in client's blacklist ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: invalid ASN in AS_PATH ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: invalid NEXT_HOP ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: local black list ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: prefix is not in IPv6 global unicast space ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: origin not in as-macro ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: invalid left-most ASN ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: prefix length ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: prefix not in as-macro ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: RPKI INVALID route ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: transit-free ASN in AS_PATH ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: good routes not received ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: prefixes received by clients: AS1_1 ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: prefixes received by clients: AS1_2 ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: prefixes received by clients: AS2 ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: reconfigure ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: log contains errors ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: dumping rs config... -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: dumping routes... -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: stopping instances... +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: setting instances up... +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: instances setup ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: sessions are up ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: AS_PATH too long ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: bogon prefix ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: bogon prefix, wrong announcing ASN ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: prefix in client's blacklist ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: invalid ASN in AS_PATH ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: invalid NEXT_HOP ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: local black list ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: prefix is not in IPv6 global unicast space ... SKIP: IPv6 only test +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: origin not in as-macro ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: invalid left-most ASN ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: prefix length ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: prefix not in as-macro ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: RPKI INVALID route ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: transit-free ASN in AS_PATH ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: good routes not received ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: prefixes received by clients: AS1_1 ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: prefixes received by clients: AS1_2 ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: prefixes received by clients: AS2 ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: reconfigure ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: log contains errors ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: dumping rs config... +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: dumping routes... +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: stopping instances... +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: setting instances up... +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: instances setup ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: sessions are up ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: AS_PATH too long ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: bogon prefix ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: bogon prefix, wrong announcing ASN ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: prefix in client's blacklist ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: invalid ASN in AS_PATH ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: invalid NEXT_HOP ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: local black list ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: prefix is not in IPv6 global unicast space ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: origin not in as-macro ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: invalid left-most ASN ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: prefix length ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: prefix not in as-macro ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: RPKI INVALID route ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: transit-free ASN in AS_PATH ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: good routes not received ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: prefixes received by clients: AS1_1 ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: prefixes received by clients: AS1_2 ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: prefixes received by clients: AS2 ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: reconfigure ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: log contains errors ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: dumping rs config... +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: dumping routes... +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 44 tests in 124.940s +Ran 44 tests in 124.558s OK (SKIP=1) diff --git a/tests/last.json b/tests/last.json index 5fe29e1e..0be3ea09 100644 --- a/tests/last.json +++ b/tests/last.json @@ -1 +1 @@ -{"unique_test_cases": 2643} +{"unique_test_cases": 2645} diff --git a/tests/last_results/extres.last b/tests/last_results/extres.last index a8f55924..30bd3fc5 100644 --- a/tests/last_results/extres.last +++ b/tests/last_results/extres.last @@ -15,6 +15,6 @@ External resources: prefixes from AS-SET via bgpq3 ... ok External resources: prefixes from AS-SET via bgpq4 ... ok ---------------------------------------------------------------------- -Ran 15 tests in 48.245s +Ran 15 tests in 62.975s OK diff --git a/tests/last_results/live_bird_hooks_example_bird1.last b/tests/last_results/live_bird_hooks_example_bird1.last index 92337cca..5f01cabd 100644 --- a/tests/last_results/live_bird_hooks_example_bird1.last +++ b/tests/last_results/live_bird_hooks_example_bird1.last @@ -12,6 +12,6 @@ Live test, BIRD, hooks example, IPv6: dumping routes... Live test, BIRD, hooks example, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 4 tests in 14.255s +Ran 4 tests in 15.078s OK diff --git a/tests/last_results/live_communities_bird1.last b/tests/last_results/live_communities_bird1.last index d3fafc0d..3dec994d 100644 --- a/tests/last_results/live_communities_bird1.last +++ b/tests/last_results/live_communities_bird1.last @@ -34,6 +34,6 @@ Live test, BIRD, BGP communities, IPv6: dumping routes... Live test, BIRD, BGP communities, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 26 tests in 64.025s +Ran 26 tests in 69.024s OK diff --git a/tests/last_results/live_communities_bird2.last b/tests/last_results/live_communities_bird2.last index 16fe8ed2..4a390dc7 100644 --- a/tests/last_results/live_communities_bird2.last +++ b/tests/last_results/live_communities_bird2.last @@ -34,6 +34,6 @@ Live test, BIRD v2, BGP communities, IPv6: dumping routes... Live test, BIRD v2, BGP communities, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 26 tests in 63.218s +Ran 26 tests in 67.131s OK diff --git a/tests/last_results/live_communities_openbgpd_portable.last b/tests/last_results/live_communities_openbgpd_portable.last index 4713e203..dfac1cf5 100644 --- a/tests/last_results/live_communities_openbgpd_portable.last +++ b/tests/last_results/live_communities_openbgpd_portable.last @@ -1,39 +1,39 @@ -Live test, OpenBGPD 7.5, BGP communities, IPv4: setting instances up... -Live test, OpenBGPD 7.5, BGP communities, IPv4: instances setup ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv4: sessions are up ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv4: announce to AS1 only (ext) ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv4: announce to AS1 only (lrg) ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv4: announce to AS1 only (std) ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv4: announce to AS131073 only (ext) ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv4: announce to AS131073 only (lrg) ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv4: custom BGP community (ext) ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv4: custom BGP community (lrg) ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv4: custom BGP community (std) ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv4: custom BGP community scrubbed ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv4: reconfigure ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv4: log contains errors ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv4: dumping rs config... -Live test, OpenBGPD 7.5, BGP communities, IPv4: dumping routes... -Live test, OpenBGPD 7.5, BGP communities, IPv4: stopping instances... -Live test, OpenBGPD 7.5, BGP communities, IPv6: setting instances up... -Live test, OpenBGPD 7.5, BGP communities, IPv6: instances setup ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv6: sessions are up ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv6: announce to AS1 only (ext) ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv6: announce to AS1 only (lrg) ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv6: announce to AS1 only (std) ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv6: announce to AS131073 only (ext) ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv6: announce to AS131073 only (lrg) ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv6: custom BGP community (ext) ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv6: custom BGP community (lrg) ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv6: custom BGP community (std) ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv6: custom BGP community scrubbed ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv6: reconfigure ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv6: log contains errors ... ok -Live test, OpenBGPD 7.5, BGP communities, IPv6: dumping rs config... -Live test, OpenBGPD 7.5, BGP communities, IPv6: dumping routes... -Live test, OpenBGPD 7.5, BGP communities, IPv6: stopping instances... +Live test, OpenBGPD 7.7, BGP communities, IPv4: setting instances up... +Live test, OpenBGPD 7.7, BGP communities, IPv4: instances setup ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv4: sessions are up ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv4: announce to AS1 only (ext) ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv4: announce to AS1 only (lrg) ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv4: announce to AS1 only (std) ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv4: announce to AS131073 only (ext) ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv4: announce to AS131073 only (lrg) ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv4: custom BGP community (ext) ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv4: custom BGP community (lrg) ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv4: custom BGP community (std) ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv4: custom BGP community scrubbed ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv4: reconfigure ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv4: log contains errors ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv4: dumping rs config... +Live test, OpenBGPD 7.7, BGP communities, IPv4: dumping routes... +Live test, OpenBGPD 7.7, BGP communities, IPv4: stopping instances... +Live test, OpenBGPD 7.7, BGP communities, IPv6: setting instances up... +Live test, OpenBGPD 7.7, BGP communities, IPv6: instances setup ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv6: sessions are up ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv6: announce to AS1 only (ext) ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv6: announce to AS1 only (lrg) ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv6: announce to AS1 only (std) ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv6: announce to AS131073 only (ext) ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv6: announce to AS131073 only (lrg) ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv6: custom BGP community (ext) ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv6: custom BGP community (lrg) ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv6: custom BGP community (std) ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv6: custom BGP community scrubbed ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv6: reconfigure ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv6: log contains errors ... ok +Live test, OpenBGPD 7.7, BGP communities, IPv6: dumping rs config... +Live test, OpenBGPD 7.7, BGP communities, IPv6: dumping routes... +Live test, OpenBGPD 7.7, BGP communities, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 26 tests in 66.482s +Ran 26 tests in 68.085s OK diff --git a/tests/last_results/live_default_bird1.last b/tests/last_results/live_default_bird1.last index cfb8af3c..9af09ea8 100644 --- a/tests/last_results/live_default_bird1.last +++ b/tests/last_results/live_default_bird1.last @@ -12,6 +12,6 @@ Live test, BIRD, default config, IPv6: dumping routes... Live test, BIRD, default config, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 4 tests in 15.047s +Ran 4 tests in 16.964s OK diff --git a/tests/last_results/live_default_bird2.last b/tests/last_results/live_default_bird2.last index f14f1280..34c5fa5b 100644 --- a/tests/last_results/live_default_bird2.last +++ b/tests/last_results/live_default_bird2.last @@ -12,6 +12,6 @@ Live test, BIRD v2, default config, IPv6: dumping routes... Live test, BIRD v2, default config, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 4 tests in 14.591s +Ran 4 tests in 15.314s OK diff --git a/tests/last_results/live_default_openbgpd_portable.last b/tests/last_results/live_default_openbgpd_portable.last index 4c72ec3a..c1ce05b5 100644 --- a/tests/last_results/live_default_openbgpd_portable.last +++ b/tests/last_results/live_default_openbgpd_portable.last @@ -1,17 +1,17 @@ -Live test, OpenBGPD 7.5, default config, IPv4: setting instances up... -Live test, OpenBGPD 7.5, default config, IPv4: instances setup ... ok -Live test, OpenBGPD 7.5, default config, IPv4: log contains errors ... ok -Live test, OpenBGPD 7.5, default config, IPv4: dumping rs config... -Live test, OpenBGPD 7.5, default config, IPv4: dumping routes... -Live test, OpenBGPD 7.5, default config, IPv4: stopping instances... -Live test, OpenBGPD 7.5, default config, IPv6: setting instances up... -Live test, OpenBGPD 7.5, default config, IPv6: instances setup ... ok -Live test, OpenBGPD 7.5, default config, IPv6: log contains errors ... ok -Live test, OpenBGPD 7.5, default config, IPv6: dumping rs config... -Live test, OpenBGPD 7.5, default config, IPv6: dumping routes... -Live test, OpenBGPD 7.5, default config, IPv6: stopping instances... +Live test, OpenBGPD 7.7, default config, IPv4: setting instances up... +Live test, OpenBGPD 7.7, default config, IPv4: instances setup ... ok +Live test, OpenBGPD 7.7, default config, IPv4: log contains errors ... ok +Live test, OpenBGPD 7.7, default config, IPv4: dumping rs config... +Live test, OpenBGPD 7.7, default config, IPv4: dumping routes... +Live test, OpenBGPD 7.7, default config, IPv4: stopping instances... +Live test, OpenBGPD 7.7, default config, IPv6: setting instances up... +Live test, OpenBGPD 7.7, default config, IPv6: instances setup ... ok +Live test, OpenBGPD 7.7, default config, IPv6: log contains errors ... ok +Live test, OpenBGPD 7.7, default config, IPv6: dumping rs config... +Live test, OpenBGPD 7.7, default config, IPv6: dumping routes... +Live test, OpenBGPD 7.7, default config, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 4 tests in 11.577s +Ran 4 tests in 12.137s OK diff --git a/tests/last_results/live_global_bird1.last b/tests/last_results/live_global_bird1.last index 8421e0d6..a0d83ffe 100644 --- a/tests/last_results/live_global_bird1.last +++ b/tests/last_results/live_global_bird1.last @@ -536,6 +536,6 @@ Live test, BIRD, global scenario, IPv6, tag&reject: dumping routes... Live test, BIRD, global scenario, IPv6, tag&reject: stopping instances... ---------------------------------------------------------------------- -Ran 512 tests in 509.215s +Ran 512 tests in 540.852s OK (SKIP=6) diff --git a/tests/last_results/live_global_bird2.last b/tests/last_results/live_global_bird2.last index 1f968b87..5c0aa4d7 100644 --- a/tests/last_results/live_global_bird2.last +++ b/tests/last_results/live_global_bird2.last @@ -536,6 +536,6 @@ Live test, BIRD v2, global scenario, IPv6, tag&reject: dumping routes... Live test, BIRD v2, global scenario, IPv6, tag&reject: stopping instances... ---------------------------------------------------------------------- -Ran 512 tests in 499.002s +Ran 512 tests in 513.873s OK (SKIP=6) diff --git a/tests/last_results/live_global_openbgpd_portable.last b/tests/last_results/live_global_openbgpd_portable.last index 62efed92..8f6ac85c 100644 --- a/tests/last_results/live_global_openbgpd_portable.last +++ b/tests/last_results/live_global_openbgpd_portable.last @@ -1,365 +1,365 @@ -Live test, OpenBGPD 7.5, global scenario, IPv4: setting instances up... -Live test, OpenBGPD 7.5, global scenario, IPv4: instances setup ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: sessions are up ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: session configured via local include files ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: good prefixes because of use_arin_bulk_whois_data ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: good prefixes received by rs: IRRdb white-list ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: good prefixes because of use_registrobr_bulk_whois_data ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: good prefixes because of use_rpki_roas_as_route_objects: exact ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: good prefixes because of use_rpki_roas_as_route_objects: covering ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: good prefixes received by rs ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: good prefixes received by rs: non-client NEXT_HOP ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: not IPv6 global unicast space ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: IRRdb white-list ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: AS_SET origin, RFC6907 7.1.9 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: IRR check for AS_SET origin, BIRD ... SKIP: BIRD specific -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: IRR check for AS_SET origin, OpenBGPD ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: AS_PATH len ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: bogon ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: client blacklist ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: global blacklist ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: invalid ASN in AS-PATH ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: invalid NEXT_HOP ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: left-most ASN ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: never via route servers ASN in AS-PATH (asns list) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: never via route servers ASN in AS-PATH (PeeringDB) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: origin not in AS-SET ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: prefix not in AS-SET ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: invalid prefix-len ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: transit-free ASN in AS-PATH ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: transit-free ASN in AS-PATH from a transit peer ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: unknown NEXT_HOP ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: RPKI ROAs as route objects failed ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: default route ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes not received by clients ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: bogon (wrong tag) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad prefixes received by rs: global blacklist (wrong tag) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: RPKI, blackhole request for a covered prefix ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: RPKI, invalid prefix (bad ASN) received by rs ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: RPKI, invalid prefix (bad length) received by rs ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: RPKI, invalid prefix (bad ASN) not propagated to clients ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: RPKI, valid prefix received by rs ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: RPKI, valid prefix propagated to clients ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: prefixes from AS101 received by its upstreams ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: prefixes from AS101 received by rs ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad communities as seen by AS101 upstreams ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad communities scrubbed by rs (lrg) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: bad communities scrubbed by rs (std) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: other communities not scrubbed by rs (lrg) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: other communities not scrubbed by rs (std) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: blackhole filtering requests as seen by rs (BLACKHOLE) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: blackhole filtering requests as seen by rs (lrg cust) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: blackhole filtering requests as seen by rs (std cust) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: blackholed prefixes as seen by enabled clients (BLACKHOLE) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: blackholed prefixes as seen by enabled clients (lrg_cust) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: blackholed prefixes as seen by enabled clients (std_cust) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: blackholed prefixes not seen by not enabled clients ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: gshut by an enabled client ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: gshut by a not enabled client ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, announce to AS1 only ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, don't announce to any ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, announce to all except AS1 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, prepend once to any ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, prepend twice to any ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, prepend thrice to any ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, prepend once to AS1 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, prepend twice to AS2 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, prepend thrice to AS1, once to others ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, NO_EXPORT to AS1 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, NO_EXPORT to any ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, RFC1997 NO_EXPORT ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, RTT, blackhole, not peers > 20 ms ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, RTT, not peers > 15 ms ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, RTT, not peers > 5 ms ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, RTT, not peers > 5 ms + AS3 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, RTT, not peers <= 5 and > 100 ms ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, RTT, only peers <= 15 ms ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, RTT, only peers <= 5 ms ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, RTT, ext comms, prepend 1x > 10 ms, 2x > 20 ms ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, RTT, prepend 3x > 100 ms, 2x > 10 ms ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: control communities, RTT, prepend 3x <= 5 ms, 2x <= 20 ms, 1x any ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: prefixes received by clients: AS1_1 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: prefixes received by clients: AS1_2 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: prefixes received by clients: AS2 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: prefixes received by clients: AS3 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: prefixes received by clients: AS3 (with ADD-PATH) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: reconfigure ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: log contains errors ... ok -Live test, OpenBGPD 7.5, global scenario, IPv4: dumping rs config... -Live test, OpenBGPD 7.5, global scenario, IPv4: dumping routes... -Live test, OpenBGPD 7.5, global scenario, IPv4: stopping instances... -Live test, OpenBGPD 7.5, global scenario, IPv6: setting instances up... -Live test, OpenBGPD 7.5, global scenario, IPv6: instances setup ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: sessions are up ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: session configured via local include files ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: good prefixes because of use_arin_bulk_whois_data ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: good prefixes received by rs: IRRdb white-list ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: good prefixes because of use_registrobr_bulk_whois_data ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: good prefixes because of use_rpki_roas_as_route_objects: exact ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: good prefixes because of use_rpki_roas_as_route_objects: covering ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: good prefixes received by rs ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: good prefixes received by rs: non-client NEXT_HOP ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: not IPv6 global unicast space ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: IRRdb white-list ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: AS_SET origin, RFC6907 7.1.9 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: IRR check for AS_SET origin, BIRD ... SKIP: BIRD specific -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: IRR check for AS_SET origin, OpenBGPD ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: AS_PATH len ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: bogon ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: client blacklist ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: global blacklist ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: invalid ASN in AS-PATH ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: invalid NEXT_HOP ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: left-most ASN ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: never via route servers ASN in AS-PATH (asns list) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: never via route servers ASN in AS-PATH (PeeringDB) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: origin not in AS-SET ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: prefix not in AS-SET ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: invalid prefix-len ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: transit-free ASN in AS-PATH ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: transit-free ASN in AS-PATH from a transit peer ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: unknown NEXT_HOP ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: RPKI ROAs as route objects failed ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: default route ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes not received by clients ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: bogon (wrong tag) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad prefixes received by rs: global blacklist (wrong tag) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: RPKI, blackhole request for a covered prefix ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: RPKI, invalid prefix (bad ASN) received by rs ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: RPKI, invalid prefix (bad length) received by rs ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: RPKI, invalid prefix (bad ASN) not propagated to clients ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: RPKI, valid prefix received by rs ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: RPKI, valid prefix propagated to clients ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: prefixes from AS101 received by its upstreams ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: prefixes from AS101 received by rs ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad communities as seen by AS101 upstreams ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad communities scrubbed by rs (lrg) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: bad communities scrubbed by rs (std) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: other communities not scrubbed by rs (lrg) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: other communities not scrubbed by rs (std) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: blackhole filtering requests as seen by rs (BLACKHOLE) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: blackhole filtering requests as seen by rs (lrg cust) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: blackhole filtering requests as seen by rs (std cust) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: blackholed prefixes as seen by enabled clients (BLACKHOLE) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: blackholed prefixes as seen by enabled clients (lrg_cust) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: blackholed prefixes as seen by enabled clients (std_cust) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: blackholed prefixes not seen by not enabled clients ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: gshut by an enabled client ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: gshut by a not enabled client ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, announce to AS1 only ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, don't announce to any ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, announce to all except AS1 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, prepend once to any ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, prepend twice to any ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, prepend thrice to any ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, prepend once to AS1 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, prepend twice to AS2 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, prepend thrice to AS1, once to others ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, NO_EXPORT to AS1 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, NO_EXPORT to any ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, RFC1997 NO_EXPORT ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, RTT, blackhole, not peers > 20 ms ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, RTT, not peers > 15 ms ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, RTT, not peers > 5 ms ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, RTT, not peers > 5 ms + AS3 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, RTT, not peers <= 5 and > 100 ms ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, RTT, only peers <= 15 ms ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, RTT, only peers <= 5 ms ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, RTT, ext comms, prepend 1x > 10 ms, 2x > 20 ms ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, RTT, prepend 3x > 100 ms, 2x > 10 ms ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: control communities, RTT, prepend 3x <= 5 ms, 2x <= 20 ms, 1x any ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: prefixes received by clients: AS1_1 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: prefixes received by clients: AS1_2 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: prefixes received by clients: AS2 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: prefixes received by clients: AS3 ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: prefixes received by clients: AS3 (with ADD-PATH) ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: reconfigure ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: log contains errors ... ok -Live test, OpenBGPD 7.5, global scenario, IPv6: dumping rs config... -Live test, OpenBGPD 7.5, global scenario, IPv6: dumping routes... -Live test, OpenBGPD 7.5, global scenario, IPv6: stopping instances... -Live test, OpenBGPD 7.4, global scenario, IPv4: setting instances up... -Live test, OpenBGPD 7.4, global scenario, IPv4: instances setup ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: sessions are up ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: session configured via local include files ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: good prefixes because of use_arin_bulk_whois_data ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: good prefixes received by rs: IRRdb white-list ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: good prefixes because of use_registrobr_bulk_whois_data ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: good prefixes because of use_rpki_roas_as_route_objects: exact ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: good prefixes because of use_rpki_roas_as_route_objects: covering ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: good prefixes received by rs ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: good prefixes received by rs: non-client NEXT_HOP ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: not IPv6 global unicast space ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: IRRdb white-list ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: AS_SET origin, RFC6907 7.1.9 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: IRR check for AS_SET origin, BIRD ... SKIP: BIRD specific -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: IRR check for AS_SET origin, OpenBGPD ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: AS_PATH len ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: bogon ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: client blacklist ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: global blacklist ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: invalid ASN in AS-PATH ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: invalid NEXT_HOP ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: left-most ASN ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: never via route servers ASN in AS-PATH (asns list) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: never via route servers ASN in AS-PATH (PeeringDB) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: origin not in AS-SET ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: prefix not in AS-SET ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: invalid prefix-len ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: transit-free ASN in AS-PATH ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: transit-free ASN in AS-PATH from a transit peer ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: unknown NEXT_HOP ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: RPKI ROAs as route objects failed ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: default route ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes not received by clients ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: bogon (wrong tag) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad prefixes received by rs: global blacklist (wrong tag) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: RPKI, blackhole request for a covered prefix ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: RPKI, invalid prefix (bad ASN) received by rs ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: RPKI, invalid prefix (bad length) received by rs ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: RPKI, invalid prefix (bad ASN) not propagated to clients ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: RPKI, valid prefix received by rs ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: RPKI, valid prefix propagated to clients ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: prefixes from AS101 received by its upstreams ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: prefixes from AS101 received by rs ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad communities as seen by AS101 upstreams ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad communities scrubbed by rs (lrg) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: bad communities scrubbed by rs (std) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: other communities not scrubbed by rs (lrg) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: other communities not scrubbed by rs (std) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: blackhole filtering requests as seen by rs (BLACKHOLE) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: blackhole filtering requests as seen by rs (lrg cust) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: blackhole filtering requests as seen by rs (std cust) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: blackholed prefixes as seen by enabled clients (BLACKHOLE) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: blackholed prefixes as seen by enabled clients (lrg_cust) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: blackholed prefixes as seen by enabled clients (std_cust) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: blackholed prefixes not seen by not enabled clients ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: gshut by an enabled client ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: gshut by a not enabled client ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, announce to AS1 only ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, don't announce to any ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, announce to all except AS1 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, prepend once to any ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, prepend twice to any ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, prepend thrice to any ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, prepend once to AS1 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, prepend twice to AS2 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, prepend thrice to AS1, once to others ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, NO_EXPORT to AS1 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, NO_EXPORT to any ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, RFC1997 NO_EXPORT ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, RTT, blackhole, not peers > 20 ms ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, RTT, not peers > 15 ms ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, RTT, not peers > 5 ms ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, RTT, not peers > 5 ms + AS3 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, RTT, not peers <= 5 and > 100 ms ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, RTT, only peers <= 15 ms ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, RTT, only peers <= 5 ms ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, RTT, ext comms, prepend 1x > 10 ms, 2x > 20 ms ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, RTT, prepend 3x > 100 ms, 2x > 10 ms ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: control communities, RTT, prepend 3x <= 5 ms, 2x <= 20 ms, 1x any ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: prefixes received by clients: AS1_1 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: prefixes received by clients: AS1_2 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: prefixes received by clients: AS2 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: prefixes received by clients: AS3 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: prefixes received by clients: AS3 (with ADD-PATH) ... SKIP: ADD-PATH not supported by OpenBGPD < 7.5 -Live test, OpenBGPD 7.4, global scenario, IPv4: reconfigure ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: log contains errors ... ok -Live test, OpenBGPD 7.4, global scenario, IPv4: dumping rs config... -Live test, OpenBGPD 7.4, global scenario, IPv4: dumping routes... -Live test, OpenBGPD 7.4, global scenario, IPv4: stopping instances... -Live test, OpenBGPD 7.4, global scenario, IPv6: setting instances up... -Live test, OpenBGPD 7.4, global scenario, IPv6: instances setup ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: sessions are up ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: session configured via local include files ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: good prefixes because of use_arin_bulk_whois_data ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: good prefixes received by rs: IRRdb white-list ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: good prefixes because of use_registrobr_bulk_whois_data ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: good prefixes because of use_rpki_roas_as_route_objects: exact ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: good prefixes because of use_rpki_roas_as_route_objects: covering ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: good prefixes received by rs ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: good prefixes received by rs: non-client NEXT_HOP ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: not IPv6 global unicast space ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: IRRdb white-list ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: AS_SET origin, RFC6907 7.1.9 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: IRR check for AS_SET origin, BIRD ... SKIP: BIRD specific -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: IRR check for AS_SET origin, OpenBGPD ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: AS_PATH len ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: bogon ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: client blacklist ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: global blacklist ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: invalid ASN in AS-PATH ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: invalid NEXT_HOP ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: left-most ASN ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: never via route servers ASN in AS-PATH (asns list) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: never via route servers ASN in AS-PATH (PeeringDB) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: origin not in AS-SET ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: prefix not in AS-SET ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: invalid prefix-len ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: transit-free ASN in AS-PATH ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: transit-free ASN in AS-PATH from a transit peer ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: unknown NEXT_HOP ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: RPKI ROAs as route objects failed ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: default route ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes not received by clients ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: bogon (wrong tag) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad prefixes received by rs: global blacklist (wrong tag) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: RPKI, blackhole request for a covered prefix ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: RPKI, invalid prefix (bad ASN) received by rs ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: RPKI, invalid prefix (bad length) received by rs ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: RPKI, invalid prefix (bad ASN) not propagated to clients ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: RPKI, valid prefix received by rs ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: RPKI, valid prefix propagated to clients ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: prefixes from AS101 received by its upstreams ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: prefixes from AS101 received by rs ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad communities as seen by AS101 upstreams ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad communities scrubbed by rs (lrg) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: bad communities scrubbed by rs (std) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: other communities not scrubbed by rs (lrg) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: other communities not scrubbed by rs (std) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: blackhole filtering requests as seen by rs (BLACKHOLE) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: blackhole filtering requests as seen by rs (lrg cust) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: blackhole filtering requests as seen by rs (std cust) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: blackholed prefixes as seen by enabled clients (BLACKHOLE) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: blackholed prefixes as seen by enabled clients (lrg_cust) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: blackholed prefixes as seen by enabled clients (std_cust) ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: blackholed prefixes not seen by not enabled clients ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: gshut by an enabled client ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: gshut by a not enabled client ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, announce to AS1 only ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, don't announce to any ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, announce to all except AS1 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, prepend once to any ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, prepend twice to any ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, prepend thrice to any ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, prepend once to AS1 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, prepend twice to AS2 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, prepend thrice to AS1, once to others ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, NO_EXPORT to AS1 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, NO_EXPORT to any ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, RFC1997 NO_EXPORT ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, RTT, blackhole, not peers > 20 ms ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, RTT, not peers > 15 ms ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, RTT, not peers > 5 ms ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, RTT, not peers > 5 ms + AS3 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, RTT, not peers <= 5 and > 100 ms ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, RTT, only peers <= 15 ms ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, RTT, only peers <= 5 ms ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, RTT, ext comms, prepend 1x > 10 ms, 2x > 20 ms ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, RTT, prepend 3x > 100 ms, 2x > 10 ms ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: control communities, RTT, prepend 3x <= 5 ms, 2x <= 20 ms, 1x any ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: prefixes received by clients: AS1_1 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: prefixes received by clients: AS1_2 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: prefixes received by clients: AS2 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: prefixes received by clients: AS3 ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: prefixes received by clients: AS3 (with ADD-PATH) ... SKIP: ADD-PATH not supported by OpenBGPD < 7.5 -Live test, OpenBGPD 7.4, global scenario, IPv6: reconfigure ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: log contains errors ... ok -Live test, OpenBGPD 7.4, global scenario, IPv6: dumping rs config... -Live test, OpenBGPD 7.4, global scenario, IPv6: dumping routes... -Live test, OpenBGPD 7.4, global scenario, IPv6: stopping instances... +Live test, OpenBGPD 7.7, global scenario, IPv4: setting instances up... +Live test, OpenBGPD 7.7, global scenario, IPv4: instances setup ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: sessions are up ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: session configured via local include files ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: good prefixes because of use_arin_bulk_whois_data ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: good prefixes received by rs: IRRdb white-list ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: good prefixes because of use_registrobr_bulk_whois_data ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: good prefixes because of use_rpki_roas_as_route_objects: exact ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: good prefixes because of use_rpki_roas_as_route_objects: covering ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: good prefixes received by rs ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: good prefixes received by rs: non-client NEXT_HOP ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: not IPv6 global unicast space ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: IRRdb white-list ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: AS_SET origin, RFC6907 7.1.9 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: IRR check for AS_SET origin, BIRD ... SKIP: BIRD specific +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: IRR check for AS_SET origin, OpenBGPD ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: AS_PATH len ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: bogon ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: client blacklist ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: global blacklist ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: invalid ASN in AS-PATH ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: invalid NEXT_HOP ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: left-most ASN ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: never via route servers ASN in AS-PATH (asns list) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: never via route servers ASN in AS-PATH (PeeringDB) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: origin not in AS-SET ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: prefix not in AS-SET ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: invalid prefix-len ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: transit-free ASN in AS-PATH ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: transit-free ASN in AS-PATH from a transit peer ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: unknown NEXT_HOP ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: RPKI ROAs as route objects failed ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: default route ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes not received by clients ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: bogon (wrong tag) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad prefixes received by rs: global blacklist (wrong tag) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: RPKI, blackhole request for a covered prefix ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: RPKI, invalid prefix (bad ASN) received by rs ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: RPKI, invalid prefix (bad length) received by rs ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: RPKI, invalid prefix (bad ASN) not propagated to clients ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: RPKI, valid prefix received by rs ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: RPKI, valid prefix propagated to clients ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: prefixes from AS101 received by its upstreams ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: prefixes from AS101 received by rs ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad communities as seen by AS101 upstreams ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad communities scrubbed by rs (lrg) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: bad communities scrubbed by rs (std) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: other communities not scrubbed by rs (lrg) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: other communities not scrubbed by rs (std) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: blackhole filtering requests as seen by rs (BLACKHOLE) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: blackhole filtering requests as seen by rs (lrg cust) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: blackhole filtering requests as seen by rs (std cust) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: blackholed prefixes as seen by enabled clients (BLACKHOLE) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: blackholed prefixes as seen by enabled clients (lrg_cust) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: blackholed prefixes as seen by enabled clients (std_cust) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: blackholed prefixes not seen by not enabled clients ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: gshut by an enabled client ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: gshut by a not enabled client ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, announce to AS1 only ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, don't announce to any ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, announce to all except AS1 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, prepend once to any ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, prepend twice to any ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, prepend thrice to any ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, prepend once to AS1 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, prepend twice to AS2 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, prepend thrice to AS1, once to others ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, NO_EXPORT to AS1 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, NO_EXPORT to any ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, RFC1997 NO_EXPORT ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, RTT, blackhole, not peers > 20 ms ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, RTT, not peers > 15 ms ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, RTT, not peers > 5 ms ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, RTT, not peers > 5 ms + AS3 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, RTT, not peers <= 5 and > 100 ms ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, RTT, only peers <= 15 ms ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, RTT, only peers <= 5 ms ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, RTT, ext comms, prepend 1x > 10 ms, 2x > 20 ms ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, RTT, prepend 3x > 100 ms, 2x > 10 ms ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: control communities, RTT, prepend 3x <= 5 ms, 2x <= 20 ms, 1x any ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: prefixes received by clients: AS1_1 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: prefixes received by clients: AS1_2 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: prefixes received by clients: AS2 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: prefixes received by clients: AS3 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: prefixes received by clients: AS3 (with ADD-PATH) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: reconfigure ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: log contains errors ... ok +Live test, OpenBGPD 7.7, global scenario, IPv4: dumping rs config... +Live test, OpenBGPD 7.7, global scenario, IPv4: dumping routes... +Live test, OpenBGPD 7.7, global scenario, IPv4: stopping instances... +Live test, OpenBGPD 7.7, global scenario, IPv6: setting instances up... +Live test, OpenBGPD 7.7, global scenario, IPv6: instances setup ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: sessions are up ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: session configured via local include files ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: good prefixes because of use_arin_bulk_whois_data ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: good prefixes received by rs: IRRdb white-list ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: good prefixes because of use_registrobr_bulk_whois_data ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: good prefixes because of use_rpki_roas_as_route_objects: exact ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: good prefixes because of use_rpki_roas_as_route_objects: covering ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: good prefixes received by rs ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: good prefixes received by rs: non-client NEXT_HOP ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: not IPv6 global unicast space ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: IRRdb white-list ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: AS_SET origin, RFC6907 7.1.9 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: IRR check for AS_SET origin, BIRD ... SKIP: BIRD specific +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: IRR check for AS_SET origin, OpenBGPD ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: AS_PATH len ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: bogon ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: client blacklist ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: global blacklist ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: invalid ASN in AS-PATH ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: invalid NEXT_HOP ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: left-most ASN ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: never via route servers ASN in AS-PATH (asns list) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: never via route servers ASN in AS-PATH (PeeringDB) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: origin not in AS-SET ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: prefix not in AS-SET ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: invalid prefix-len ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: transit-free ASN in AS-PATH ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: transit-free ASN in AS-PATH from a transit peer ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: unknown NEXT_HOP ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: RPKI ROAs as route objects failed ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: default route ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes not received by clients ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: bogon (wrong tag) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad prefixes received by rs: global blacklist (wrong tag) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: RPKI, blackhole request for a covered prefix ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: RPKI, invalid prefix (bad ASN) received by rs ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: RPKI, invalid prefix (bad length) received by rs ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: RPKI, invalid prefix (bad ASN) not propagated to clients ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: RPKI, valid prefix received by rs ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: RPKI, valid prefix propagated to clients ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: prefixes from AS101 received by its upstreams ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: prefixes from AS101 received by rs ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad communities as seen by AS101 upstreams ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad communities scrubbed by rs (lrg) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: bad communities scrubbed by rs (std) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: other communities not scrubbed by rs (lrg) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: other communities not scrubbed by rs (std) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: blackhole filtering requests as seen by rs (BLACKHOLE) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: blackhole filtering requests as seen by rs (lrg cust) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: blackhole filtering requests as seen by rs (std cust) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: blackholed prefixes as seen by enabled clients (BLACKHOLE) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: blackholed prefixes as seen by enabled clients (lrg_cust) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: blackholed prefixes as seen by enabled clients (std_cust) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: blackholed prefixes not seen by not enabled clients ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: gshut by an enabled client ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: gshut by a not enabled client ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, announce to AS1 only ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, don't announce to any ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, announce to all except AS1 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, prepend once to any ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, prepend twice to any ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, prepend thrice to any ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, prepend once to AS1 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, prepend twice to AS2 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, prepend thrice to AS1, once to others ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, NO_EXPORT to AS1 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, NO_EXPORT to any ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, RFC1997 NO_EXPORT ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, RTT, blackhole, not peers > 20 ms ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, RTT, not peers > 15 ms ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, RTT, not peers > 5 ms ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, RTT, not peers > 5 ms + AS3 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, RTT, not peers <= 5 and > 100 ms ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, RTT, only peers <= 15 ms ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, RTT, only peers <= 5 ms ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, RTT, ext comms, prepend 1x > 10 ms, 2x > 20 ms ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, RTT, prepend 3x > 100 ms, 2x > 10 ms ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: control communities, RTT, prepend 3x <= 5 ms, 2x <= 20 ms, 1x any ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: prefixes received by clients: AS1_1 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: prefixes received by clients: AS1_2 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: prefixes received by clients: AS2 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: prefixes received by clients: AS3 ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: prefixes received by clients: AS3 (with ADD-PATH) ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: reconfigure ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: log contains errors ... ok +Live test, OpenBGPD 7.7, global scenario, IPv6: dumping rs config... +Live test, OpenBGPD 7.7, global scenario, IPv6: dumping routes... +Live test, OpenBGPD 7.7, global scenario, IPv6: stopping instances... +Live test, OpenBGPD 7.6, global scenario, IPv4: setting instances up... +Live test, OpenBGPD 7.6, global scenario, IPv4: instances setup ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: sessions are up ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: session configured via local include files ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: good prefixes because of use_arin_bulk_whois_data ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: good prefixes received by rs: IRRdb white-list ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: good prefixes because of use_registrobr_bulk_whois_data ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: good prefixes because of use_rpki_roas_as_route_objects: exact ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: good prefixes because of use_rpki_roas_as_route_objects: covering ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: good prefixes received by rs ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: good prefixes received by rs: non-client NEXT_HOP ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: not IPv6 global unicast space ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: IRRdb white-list ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: AS_SET origin, RFC6907 7.1.9 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: IRR check for AS_SET origin, BIRD ... SKIP: BIRD specific +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: IRR check for AS_SET origin, OpenBGPD ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: AS_PATH len ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: bogon ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: client blacklist ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: global blacklist ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: invalid ASN in AS-PATH ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: invalid NEXT_HOP ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: left-most ASN ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: never via route servers ASN in AS-PATH (asns list) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: never via route servers ASN in AS-PATH (PeeringDB) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: origin not in AS-SET ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: prefix not in AS-SET ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: invalid prefix-len ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: transit-free ASN in AS-PATH ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: transit-free ASN in AS-PATH from a transit peer ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: unknown NEXT_HOP ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: RPKI ROAs as route objects failed ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: default route ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes not received by clients ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: bogon (wrong tag) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad prefixes received by rs: global blacklist (wrong tag) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: RPKI, blackhole request for a covered prefix ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: RPKI, invalid prefix (bad ASN) received by rs ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: RPKI, invalid prefix (bad length) received by rs ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: RPKI, invalid prefix (bad ASN) not propagated to clients ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: RPKI, valid prefix received by rs ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: RPKI, valid prefix propagated to clients ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: prefixes from AS101 received by its upstreams ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: prefixes from AS101 received by rs ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad communities as seen by AS101 upstreams ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad communities scrubbed by rs (lrg) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: bad communities scrubbed by rs (std) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: other communities not scrubbed by rs (lrg) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: other communities not scrubbed by rs (std) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: blackhole filtering requests as seen by rs (BLACKHOLE) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: blackhole filtering requests as seen by rs (lrg cust) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: blackhole filtering requests as seen by rs (std cust) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: blackholed prefixes as seen by enabled clients (BLACKHOLE) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: blackholed prefixes as seen by enabled clients (lrg_cust) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: blackholed prefixes as seen by enabled clients (std_cust) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: blackholed prefixes not seen by not enabled clients ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: gshut by an enabled client ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: gshut by a not enabled client ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, announce to AS1 only ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, don't announce to any ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, announce to all except AS1 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, prepend once to any ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, prepend twice to any ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, prepend thrice to any ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, prepend once to AS1 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, prepend twice to AS2 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, prepend thrice to AS1, once to others ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, NO_EXPORT to AS1 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, NO_EXPORT to any ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, RFC1997 NO_EXPORT ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, RTT, blackhole, not peers > 20 ms ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, RTT, not peers > 15 ms ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, RTT, not peers > 5 ms ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, RTT, not peers > 5 ms + AS3 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, RTT, not peers <= 5 and > 100 ms ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, RTT, only peers <= 15 ms ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, RTT, only peers <= 5 ms ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, RTT, ext comms, prepend 1x > 10 ms, 2x > 20 ms ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, RTT, prepend 3x > 100 ms, 2x > 10 ms ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: control communities, RTT, prepend 3x <= 5 ms, 2x <= 20 ms, 1x any ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: prefixes received by clients: AS1_1 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: prefixes received by clients: AS1_2 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: prefixes received by clients: AS2 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: prefixes received by clients: AS3 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: prefixes received by clients: AS3 (with ADD-PATH) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: reconfigure ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: log contains errors ... ok +Live test, OpenBGPD 7.6, global scenario, IPv4: dumping rs config... +Live test, OpenBGPD 7.6, global scenario, IPv4: dumping routes... +Live test, OpenBGPD 7.6, global scenario, IPv4: stopping instances... +Live test, OpenBGPD 7.6, global scenario, IPv6: setting instances up... +Live test, OpenBGPD 7.6, global scenario, IPv6: instances setup ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: sessions are up ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: session configured via local include files ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: good prefixes because of use_arin_bulk_whois_data ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: good prefixes received by rs: IRRdb white-list ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: good prefixes because of use_registrobr_bulk_whois_data ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: good prefixes because of use_rpki_roas_as_route_objects: exact ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: good prefixes because of use_rpki_roas_as_route_objects: covering ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: good prefixes received by rs ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: good prefixes received by rs: non-client NEXT_HOP ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: not IPv6 global unicast space ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: IRRdb white-list ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: AS_SET origin, RFC6907 7.1.9 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: IRR check for AS_SET origin, BIRD ... SKIP: BIRD specific +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: IRR check for AS_SET origin, OpenBGPD ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: AS_PATH len ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: bogon ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: client blacklist ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: global blacklist ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: invalid ASN in AS-PATH ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: invalid NEXT_HOP ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: left-most ASN ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: never via route servers ASN in AS-PATH (asns list) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: never via route servers ASN in AS-PATH (PeeringDB) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: origin not in AS-SET ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: prefix not in AS-SET ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: invalid prefix-len ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: transit-free ASN in AS-PATH ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: transit-free ASN in AS-PATH from a transit peer ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: unknown NEXT_HOP ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: RPKI ROAs as route objects failed ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: default route ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes not received by clients ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: bogon (wrong tag) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad prefixes received by rs: global blacklist (wrong tag) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: RPKI, blackhole request for a covered prefix ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: RPKI, invalid prefix (bad ASN) received by rs ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: RPKI, invalid prefix (bad length) received by rs ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: RPKI, invalid prefix (bad ASN) not propagated to clients ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: RPKI, valid prefix received by rs ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: RPKI, valid prefix propagated to clients ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: prefixes from AS101 received by its upstreams ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: prefixes from AS101 received by rs ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad communities as seen by AS101 upstreams ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad communities scrubbed by rs (lrg) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: bad communities scrubbed by rs (std) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: other communities not scrubbed by rs (lrg) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: other communities not scrubbed by rs (std) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: blackhole filtering requests as seen by rs (BLACKHOLE) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: blackhole filtering requests as seen by rs (lrg cust) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: blackhole filtering requests as seen by rs (std cust) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: blackholed prefixes as seen by enabled clients (BLACKHOLE) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: blackholed prefixes as seen by enabled clients (lrg_cust) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: blackholed prefixes as seen by enabled clients (std_cust) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: blackholed prefixes not seen by not enabled clients ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: gshut by an enabled client ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: gshut by a not enabled client ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, announce to AS1 only ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, don't announce to any ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, announce to all except AS1 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, prepend once to any ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, prepend twice to any ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, prepend thrice to any ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, prepend once to AS1 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, prepend twice to AS2 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, prepend thrice to AS1, once to others ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, NO_EXPORT to AS1 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, NO_EXPORT to any ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, RFC1997 NO_EXPORT ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, RTT, blackhole, not peers > 20 ms ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, RTT, not peers > 15 ms ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, RTT, not peers > 5 ms ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, RTT, not peers > 5 ms + AS3 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, RTT, not peers <= 5 and > 100 ms ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, RTT, only peers <= 15 ms ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, RTT, only peers <= 5 ms ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, RTT, ext comms, prepend 1x > 10 ms, 2x > 20 ms ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, RTT, prepend 3x > 100 ms, 2x > 10 ms ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: control communities, RTT, prepend 3x <= 5 ms, 2x <= 20 ms, 1x any ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: prefixes received by clients: AS1_1 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: prefixes received by clients: AS1_2 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: prefixes received by clients: AS2 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: prefixes received by clients: AS3 ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: prefixes received by clients: AS3 (with ADD-PATH) ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: reconfigure ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: log contains errors ... ok +Live test, OpenBGPD 7.6, global scenario, IPv6: dumping rs config... +Live test, OpenBGPD 7.6, global scenario, IPv6: dumping routes... +Live test, OpenBGPD 7.6, global scenario, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 344 tests in 329.423s +Ran 344 tests in 372.628s -OK (SKIP=6) +OK (SKIP=4) diff --git a/tests/last_results/live_gshut_bird1.last b/tests/last_results/live_gshut_bird1.last index 4d0856d1..d2ede3e2 100644 --- a/tests/last_results/live_gshut_bird1.last +++ b/tests/last_results/live_gshut_bird1.last @@ -18,6 +18,6 @@ Live test, BIRD, gshut, IPv6: dumping routes... Live test, BIRD, gshut, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 10 tests in 44.425s +Ran 10 tests in 49.582s OK diff --git a/tests/last_results/live_gshut_bird2.last b/tests/last_results/live_gshut_bird2.last index e433400f..0de78281 100644 --- a/tests/last_results/live_gshut_bird2.last +++ b/tests/last_results/live_gshut_bird2.last @@ -18,6 +18,6 @@ Live test, BIRD v2, gshut, IPv6: dumping routes... Live test, BIRD v2, gshut, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 10 tests in 44.138s +Ran 10 tests in 50.348s OK diff --git a/tests/last_results/live_gshut_openbgpd_portable.last b/tests/last_results/live_gshut_openbgpd_portable.last index ec46baf6..5ad80810 100644 --- a/tests/last_results/live_gshut_openbgpd_portable.last +++ b/tests/last_results/live_gshut_openbgpd_portable.last @@ -1,23 +1,23 @@ -Live test, OpenBGPD 7.5, gshut, IPv4: setting instances up... -Live test, OpenBGPD 7.5, gshut, IPv4: instances setup ... ok -Live test, OpenBGPD 7.5, gshut, IPv4: sessions are up ... ok -Live test, OpenBGPD 7.5, gshut, IPv4: clients receive routes tagged with GRACEFUL_SHUTDOWN ... ok -Live test, OpenBGPD 7.5, gshut, IPv4: reconfigure ... ok -Live test, OpenBGPD 7.5, gshut, IPv4: log contains errors ... ok -Live test, OpenBGPD 7.5, gshut, IPv4: dumping rs config... -Live test, OpenBGPD 7.5, gshut, IPv4: dumping routes... -Live test, OpenBGPD 7.5, gshut, IPv4: stopping instances... -Live test, OpenBGPD 7.5, gshut, IPv6: setting instances up... -Live test, OpenBGPD 7.5, gshut, IPv6: instances setup ... ok -Live test, OpenBGPD 7.5, gshut, IPv6: sessions are up ... ok -Live test, OpenBGPD 7.5, gshut, IPv6: clients receive routes tagged with GRACEFUL_SHUTDOWN ... ok -Live test, OpenBGPD 7.5, gshut, IPv6: reconfigure ... ok -Live test, OpenBGPD 7.5, gshut, IPv6: log contains errors ... ok -Live test, OpenBGPD 7.5, gshut, IPv6: dumping rs config... -Live test, OpenBGPD 7.5, gshut, IPv6: dumping routes... -Live test, OpenBGPD 7.5, gshut, IPv6: stopping instances... +Live test, OpenBGPD 7.7, gshut, IPv4: setting instances up... +Live test, OpenBGPD 7.7, gshut, IPv4: instances setup ... ok +Live test, OpenBGPD 7.7, gshut, IPv4: sessions are up ... ok +Live test, OpenBGPD 7.7, gshut, IPv4: clients receive routes tagged with GRACEFUL_SHUTDOWN ... ok +Live test, OpenBGPD 7.7, gshut, IPv4: reconfigure ... ok +Live test, OpenBGPD 7.7, gshut, IPv4: log contains errors ... ok +Live test, OpenBGPD 7.7, gshut, IPv4: dumping rs config... +Live test, OpenBGPD 7.7, gshut, IPv4: dumping routes... +Live test, OpenBGPD 7.7, gshut, IPv4: stopping instances... +Live test, OpenBGPD 7.7, gshut, IPv6: setting instances up... +Live test, OpenBGPD 7.7, gshut, IPv6: instances setup ... ok +Live test, OpenBGPD 7.7, gshut, IPv6: sessions are up ... ok +Live test, OpenBGPD 7.7, gshut, IPv6: clients receive routes tagged with GRACEFUL_SHUTDOWN ... ok +Live test, OpenBGPD 7.7, gshut, IPv6: reconfigure ... ok +Live test, OpenBGPD 7.7, gshut, IPv6: log contains errors ... ok +Live test, OpenBGPD 7.7, gshut, IPv6: dumping rs config... +Live test, OpenBGPD 7.7, gshut, IPv6: dumping routes... +Live test, OpenBGPD 7.7, gshut, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 10 tests in 49.272s +Ran 10 tests in 53.914s OK diff --git a/tests/last_results/live_max_prefix_bird1.last b/tests/last_results/live_max_prefix_bird1.last index 4fdcc454..95b36e02 100644 --- a/tests/last_results/live_max_prefix_bird1.last +++ b/tests/last_results/live_max_prefix_bird1.last @@ -34,6 +34,6 @@ Live test, BIRD, max-prefix, IPv6: dumping routes... Live test, BIRD, max-prefix, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 26 tests in 165.497s +Ran 26 tests in 172.653s OK diff --git a/tests/last_results/live_max_prefix_bird2.last b/tests/last_results/live_max_prefix_bird2.last index 2bee3272..5541eabc 100644 --- a/tests/last_results/live_max_prefix_bird2.last +++ b/tests/last_results/live_max_prefix_bird2.last @@ -34,6 +34,6 @@ Live test, BIRD v2, max-prefix, IPv6: dumping routes... Live test, BIRD v2, max-prefix, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 26 tests in 165.985s +Ran 26 tests in 183.754s OK diff --git a/tests/last_results/live_max_prefix_openbgpd_portable.last b/tests/last_results/live_max_prefix_openbgpd_portable.last index 11f19c8f..fcae306f 100644 --- a/tests/last_results/live_max_prefix_openbgpd_portable.last +++ b/tests/last_results/live_max_prefix_openbgpd_portable.last @@ -1,23 +1,23 @@ -Live test, OpenBGPD 7.5, max-prefix, IPv4: setting instances up... -Live test, OpenBGPD 7.5, max-prefix, IPv4: instances setup ... ok -Live test, OpenBGPD 7.5, max-prefix, IPv4: sessions are down ... ok -Live test, OpenBGPD 7.5, max-prefix, IPv4: clients log max-prefix notification ... ok -Live test, OpenBGPD 7.5, max-prefix, IPv4: reconfigure ... ok -Live test, OpenBGPD 7.5, max-prefix, IPv4: log contains errors ... ok -Live test, OpenBGPD 7.5, max-prefix, IPv4: dumping rs config... -Live test, OpenBGPD 7.5, max-prefix, IPv4: dumping routes... -Live test, OpenBGPD 7.5, max-prefix, IPv4: stopping instances... -Live test, OpenBGPD 7.5, max-prefix, IPv6: setting instances up... -Live test, OpenBGPD 7.5, max-prefix, IPv6: instances setup ... ok -Live test, OpenBGPD 7.5, max-prefix, IPv6: sessions are down ... ok -Live test, OpenBGPD 7.5, max-prefix, IPv6: clients log max-prefix notification ... ok -Live test, OpenBGPD 7.5, max-prefix, IPv6: reconfigure ... ok -Live test, OpenBGPD 7.5, max-prefix, IPv6: log contains errors ... ok -Live test, OpenBGPD 7.5, max-prefix, IPv6: dumping rs config... -Live test, OpenBGPD 7.5, max-prefix, IPv6: dumping routes... -Live test, OpenBGPD 7.5, max-prefix, IPv6: stopping instances... +Live test, OpenBGPD 7.7, max-prefix, IPv4: setting instances up... +Live test, OpenBGPD 7.7, max-prefix, IPv4: instances setup ... ok +Live test, OpenBGPD 7.7, max-prefix, IPv4: sessions are down ... ok +Live test, OpenBGPD 7.7, max-prefix, IPv4: clients log max-prefix notification ... ok +Live test, OpenBGPD 7.7, max-prefix, IPv4: reconfigure ... ok +Live test, OpenBGPD 7.7, max-prefix, IPv4: log contains errors ... ok +Live test, OpenBGPD 7.7, max-prefix, IPv4: dumping rs config... +Live test, OpenBGPD 7.7, max-prefix, IPv4: dumping routes... +Live test, OpenBGPD 7.7, max-prefix, IPv4: stopping instances... +Live test, OpenBGPD 7.7, max-prefix, IPv6: setting instances up... +Live test, OpenBGPD 7.7, max-prefix, IPv6: instances setup ... ok +Live test, OpenBGPD 7.7, max-prefix, IPv6: sessions are down ... ok +Live test, OpenBGPD 7.7, max-prefix, IPv6: clients log max-prefix notification ... ok +Live test, OpenBGPD 7.7, max-prefix, IPv6: reconfigure ... ok +Live test, OpenBGPD 7.7, max-prefix, IPv6: log contains errors ... ok +Live test, OpenBGPD 7.7, max-prefix, IPv6: dumping rs config... +Live test, OpenBGPD 7.7, max-prefix, IPv6: dumping routes... +Live test, OpenBGPD 7.7, max-prefix, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 10 tests in 358.497s +Ran 10 tests in 393.754s OK diff --git a/tests/last_results/live_path_hiding_bird1.last b/tests/last_results/live_path_hiding_bird1.last index bb686c0f..009970f2 100644 --- a/tests/last_results/live_path_hiding_bird1.last +++ b/tests/last_results/live_path_hiding_bird1.last @@ -54,6 +54,6 @@ Live test, BIRD, path hiding, mitigation on, IPv6: dumping routes... Live test, BIRD, path hiding, mitigation on, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 38 tests in 174.239s +Ran 38 tests in 176.240s OK (SKIP=2) diff --git a/tests/last_results/live_path_hiding_bird2.last b/tests/last_results/live_path_hiding_bird2.last index e0c3f0d4..2e50910c 100644 --- a/tests/last_results/live_path_hiding_bird2.last +++ b/tests/last_results/live_path_hiding_bird2.last @@ -54,6 +54,6 @@ Live test, BIRD v2, path hiding, mitigation on, IPv6: dumping routes... Live test, BIRD v2, path hiding, mitigation on, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 38 tests in 171.075s +Ran 38 tests in 179.261s OK (SKIP=2) diff --git a/tests/last_results/live_path_hiding_openbgpd_portable.last b/tests/last_results/live_path_hiding_openbgpd_portable.last index c42ef11b..8cd13c0b 100644 --- a/tests/last_results/live_path_hiding_openbgpd_portable.last +++ b/tests/last_results/live_path_hiding_openbgpd_portable.last @@ -1,59 +1,59 @@ -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv4: setting instances up... -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv4: instances setup ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv4: sessions are up ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv4: rs should receive prefix from both AS1 and AS2 ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv4: rs should have best toward AS1 ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv4: AS1 wants rs to not announce to AS3 and AS4 ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv4: AS3 does not receive prefix at all ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv4: AS4 receives the prefix via AS2 because of ADD-PATH ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv4: reconfigure ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv4: log contains errors ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv4: dumping rs config... -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv4: dumping routes... -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv4: stopping instances... -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv4: setting instances up... -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv4: instances setup ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv4: sessions are up ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv4: rs should receive prefix from both AS1 and AS2 ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv4: rs should have best toward AS1 ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv4: AS1 wants rs to not announce to AS3 and AS4 ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv4: AS3 and AS4 receive prefix with sub-optimal path via AS2 ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv4: AS3 and AS4 don't receive prefix via AS1 ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv4: 2nd best is withdrawn and AS3 should not see it anymore ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv4: reconfigure ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv4: log contains errors ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv4: dumping rs config... -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv4: dumping routes... -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv4: stopping instances... -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv6: setting instances up... -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv6: instances setup ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv6: sessions are up ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv6: rs should receive prefix from both AS1 and AS2 ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv6: rs should have best toward AS1 ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv6: AS1 wants rs to not announce to AS3 and AS4 ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv6: AS3 does not receive prefix at all ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv6: AS4 receives the prefix via AS2 because of ADD-PATH ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv6: reconfigure ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv6: log contains errors ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv6: dumping rs config... -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv6: dumping routes... -Live test, OpenBGPD 7.5, path hiding, mitigation off, IPv6: stopping instances... -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv6: setting instances up... -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv6: instances setup ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv6: sessions are up ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv6: rs should receive prefix from both AS1 and AS2 ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv6: rs should have best toward AS1 ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv6: AS1 wants rs to not announce to AS3 and AS4 ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv6: AS3 and AS4 receive prefix with sub-optimal path via AS2 ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv6: AS3 and AS4 don't receive prefix via AS1 ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv6: 2nd best is withdrawn and AS3 should not see it anymore ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv6: reconfigure ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv6: log contains errors ... ok -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv6: dumping rs config... -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv6: dumping routes... -Live test, OpenBGPD 7.5, path hiding, mitigation on, IPv6: stopping instances... +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv4: setting instances up... +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv4: instances setup ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv4: sessions are up ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv4: rs should receive prefix from both AS1 and AS2 ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv4: rs should have best toward AS1 ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv4: AS1 wants rs to not announce to AS3 and AS4 ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv4: AS3 does not receive prefix at all ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv4: AS4 receives the prefix via AS2 because of ADD-PATH ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv4: reconfigure ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv4: log contains errors ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv4: dumping rs config... +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv4: dumping routes... +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv4: stopping instances... +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv4: setting instances up... +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv4: instances setup ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv4: sessions are up ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv4: rs should receive prefix from both AS1 and AS2 ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv4: rs should have best toward AS1 ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv4: AS1 wants rs to not announce to AS3 and AS4 ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv4: AS3 and AS4 receive prefix with sub-optimal path via AS2 ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv4: AS3 and AS4 don't receive prefix via AS1 ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv4: 2nd best is withdrawn and AS3 should not see it anymore ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv4: reconfigure ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv4: log contains errors ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv4: dumping rs config... +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv4: dumping routes... +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv4: stopping instances... +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv6: setting instances up... +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv6: instances setup ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv6: sessions are up ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv6: rs should receive prefix from both AS1 and AS2 ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv6: rs should have best toward AS1 ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv6: AS1 wants rs to not announce to AS3 and AS4 ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv6: AS3 does not receive prefix at all ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv6: AS4 receives the prefix via AS2 because of ADD-PATH ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv6: reconfigure ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv6: log contains errors ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv6: dumping rs config... +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv6: dumping routes... +Live test, OpenBGPD 7.7, path hiding, mitigation off, IPv6: stopping instances... +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv6: setting instances up... +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv6: instances setup ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv6: sessions are up ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv6: rs should receive prefix from both AS1 and AS2 ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv6: rs should have best toward AS1 ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv6: AS1 wants rs to not announce to AS3 and AS4 ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv6: AS3 and AS4 receive prefix with sub-optimal path via AS2 ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv6: AS3 and AS4 don't receive prefix via AS1 ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv6: 2nd best is withdrawn and AS3 should not see it anymore ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv6: reconfigure ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv6: log contains errors ... ok +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv6: dumping rs config... +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv6: dumping routes... +Live test, OpenBGPD 7.7, path hiding, mitigation on, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 38 tests in 192.492s +Ran 38 tests in 197.166s OK diff --git a/tests/last_results/live_rich_example_bird1.last b/tests/last_results/live_rich_example_bird1.last index 66db6cbc..eeed77e8 100644 --- a/tests/last_results/live_rich_example_bird1.last +++ b/tests/last_results/live_rich_example_bird1.last @@ -12,6 +12,6 @@ Live test, BIRD, examples, rich config, IPv6: dumping routes... Live test, BIRD, examples, rich config, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 4 tests in 26.304s +Ran 4 tests in 20.184s OK diff --git a/tests/last_results/live_rich_example_bird2.last b/tests/last_results/live_rich_example_bird2.last index fceac3e1..90101dec 100644 --- a/tests/last_results/live_rich_example_bird2.last +++ b/tests/last_results/live_rich_example_bird2.last @@ -12,6 +12,6 @@ Live test, BIRD v2, examples, rich config, IPv6: dumping routes... Live test, BIRD v2, examples, rich config, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 4 tests in 24.751s +Ran 4 tests in 19.984s OK diff --git a/tests/last_results/live_rich_example_openbgpd_portable.last b/tests/last_results/live_rich_example_openbgpd_portable.last index 3be63f53..9ad9d857 100644 --- a/tests/last_results/live_rich_example_openbgpd_portable.last +++ b/tests/last_results/live_rich_example_openbgpd_portable.last @@ -1,17 +1,17 @@ -Live test, OpenBGPD 7.5, examples, rich config, IPv4: setting instances up... -Live test, OpenBGPD 7.5, examples, rich config, IPv4: instances setup ... ok -Live test, OpenBGPD 7.5, examples, rich config, IPv4: log contains errors ... ok -Live test, OpenBGPD 7.5, examples, rich config, IPv4: dumping rs config... -Live test, OpenBGPD 7.5, examples, rich config, IPv4: dumping routes... -Live test, OpenBGPD 7.5, examples, rich config, IPv4: stopping instances... -Live test, OpenBGPD 7.5, examples, rich config, IPv6: setting instances up... -Live test, OpenBGPD 7.5, examples, rich config, IPv6: instances setup ... ok -Live test, OpenBGPD 7.5, examples, rich config, IPv6: log contains errors ... ok -Live test, OpenBGPD 7.5, examples, rich config, IPv6: dumping rs config... -Live test, OpenBGPD 7.5, examples, rich config, IPv6: dumping routes... -Live test, OpenBGPD 7.5, examples, rich config, IPv6: stopping instances... +Live test, OpenBGPD 7.7, examples, rich config, IPv4: setting instances up... +Live test, OpenBGPD 7.7, examples, rich config, IPv4: instances setup ... ok +Live test, OpenBGPD 7.7, examples, rich config, IPv4: log contains errors ... ok +Live test, OpenBGPD 7.7, examples, rich config, IPv4: dumping rs config... +Live test, OpenBGPD 7.7, examples, rich config, IPv4: dumping routes... +Live test, OpenBGPD 7.7, examples, rich config, IPv4: stopping instances... +Live test, OpenBGPD 7.7, examples, rich config, IPv6: setting instances up... +Live test, OpenBGPD 7.7, examples, rich config, IPv6: instances setup ... ok +Live test, OpenBGPD 7.7, examples, rich config, IPv6: log contains errors ... ok +Live test, OpenBGPD 7.7, examples, rich config, IPv6: dumping rs config... +Live test, OpenBGPD 7.7, examples, rich config, IPv6: dumping routes... +Live test, OpenBGPD 7.7, examples, rich config, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 4 tests in 22.056s +Ran 4 tests in 17.642s OK diff --git a/tests/last_results/live_rpki_bird1.last b/tests/last_results/live_rpki_bird1.last index 8db2f85d..81a5dd89 100644 --- a/tests/last_results/live_rpki_bird1.last +++ b/tests/last_results/live_rpki_bird1.last @@ -36,6 +36,6 @@ Live test, BIRD, RPKI INVALID tagging, IPv6: dumping routes... Live test, BIRD, RPKI INVALID tagging, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 28 tests in 83.631s +Ran 28 tests in 79.876s OK diff --git a/tests/last_results/live_rpki_bird2.last b/tests/last_results/live_rpki_bird2.last index 3c8412f7..743627e9 100644 --- a/tests/last_results/live_rpki_bird2.last +++ b/tests/last_results/live_rpki_bird2.last @@ -36,6 +36,6 @@ Live test, BIRD v2, RPKI INVALID tagging, IPv6: dumping routes... Live test, BIRD v2, RPKI INVALID tagging, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 28 tests in 77.980s +Ran 28 tests in 79.172s OK diff --git a/tests/last_results/live_rpki_bov_comms_bird1.last b/tests/last_results/live_rpki_bov_comms_bird1.last index 23f41a98..24017b5f 100644 --- a/tests/last_results/live_rpki_bov_comms_bird1.last +++ b/tests/last_results/live_rpki_bov_comms_bird1.last @@ -20,6 +20,6 @@ Live test, BIRD, BOV custom comms, IPv6: dumping routes... Live test, BIRD, BOV custom comms, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 12 tests in 46.496s +Ran 12 tests in 45.674s OK diff --git a/tests/last_results/live_rpki_bov_comms_bird2.last b/tests/last_results/live_rpki_bov_comms_bird2.last index 416b061f..b048f02f 100644 --- a/tests/last_results/live_rpki_bov_comms_bird2.last +++ b/tests/last_results/live_rpki_bov_comms_bird2.last @@ -20,6 +20,6 @@ Live test, BIRD v2, BOV custom comms, IPv6: dumping routes... Live test, BIRD v2, BOV custom comms, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 12 tests in 44.362s +Ran 12 tests in 45.535s OK diff --git a/tests/last_results/live_rpki_rtr_example_bird2.last b/tests/last_results/live_rpki_rtr_example_bird2.last index 5ea22317..b26b86e1 100644 --- a/tests/last_results/live_rpki_rtr_example_bird2.last +++ b/tests/last_results/live_rpki_rtr_example_bird2.last @@ -12,6 +12,6 @@ Live test, BIRD v2, RTR protocol: dumping routes... Live test, BIRD v2, RTR protocol: stopping instances... ---------------------------------------------------------------------- -Ran 8 tests in 40.609s +Ran 8 tests in 41.031s OK diff --git a/tests/last_results/live_rpki_rtr_example_openbgpd_portable.last b/tests/last_results/live_rpki_rtr_example_openbgpd_portable.last index 0e7bab0e..be0a1200 100644 --- a/tests/last_results/live_rpki_rtr_example_openbgpd_portable.last +++ b/tests/last_results/live_rpki_rtr_example_openbgpd_portable.last @@ -1,17 +1,17 @@ -Live test, OpenBGPD 7.5, RTR protocol: setting instances up... -Live test, OpenBGPD 7.5, RTR protocol: instances setup ... ok -Live test, OpenBGPD 7.5, RTR protocol: sessions are up ... ok -Live test, OpenBGPD 7.5, RTR protocol: route accepted because validator not running ... ok -Live test, OpenBGPD 7.5, RTR protocol: spin up the validator ... ok -Live test, OpenBGPD 7.5, RTR protocol: restart OpenBGPD to speed up RTR session establishment ... ok -Live test, OpenBGPD 7.5, RTR protocol: check the RTR session is up ... ok -Live test, OpenBGPD 7.5, RTR protocol: route dropped after spinning the validator up ... ok -Live test, OpenBGPD 7.5, RTR protocol: log contains errors ... ok -Live test, OpenBGPD 7.5, RTR protocol: dumping rs config... -Live test, OpenBGPD 7.5, RTR protocol: dumping routes... -Live test, OpenBGPD 7.5, RTR protocol: stopping instances... +Live test, OpenBGPD 7.7, RTR protocol: setting instances up... +Live test, OpenBGPD 7.7, RTR protocol: instances setup ... ok +Live test, OpenBGPD 7.7, RTR protocol: sessions are up ... ok +Live test, OpenBGPD 7.7, RTR protocol: route accepted because validator not running ... ok +Live test, OpenBGPD 7.7, RTR protocol: spin up the validator ... ok +Live test, OpenBGPD 7.7, RTR protocol: restart OpenBGPD to speed up RTR session establishment ... ok +Live test, OpenBGPD 7.7, RTR protocol: check the RTR session is up ... ok +Live test, OpenBGPD 7.7, RTR protocol: route dropped after spinning the validator up ... ok +Live test, OpenBGPD 7.7, RTR protocol: log contains errors ... ok +Live test, OpenBGPD 7.7, RTR protocol: dumping rs config... +Live test, OpenBGPD 7.7, RTR protocol: dumping routes... +Live test, OpenBGPD 7.7, RTR protocol: stopping instances... ---------------------------------------------------------------------- -Ran 8 tests in 43.032s +Ran 8 tests in 44.083s OK diff --git a/tests/last_results/live_tag_as_set_bird1.last b/tests/last_results/live_tag_as_set_bird1.last index 66ee0cd2..6e6f3bff 100644 --- a/tests/last_results/live_tag_as_set_bird1.last +++ b/tests/last_results/live_tag_as_set_bird1.last @@ -182,6 +182,6 @@ Live test, BIRD, tag prefix/origin empty AS-SET, IPv6: dumping routes... Live test, BIRD, tag prefix/origin empty AS-SET, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 166 tests in 168.950s +Ran 166 tests in 172.100s OK diff --git a/tests/last_results/live_tag_as_set_bird2.last b/tests/last_results/live_tag_as_set_bird2.last index 5681139a..eeae0d18 100644 --- a/tests/last_results/live_tag_as_set_bird2.last +++ b/tests/last_results/live_tag_as_set_bird2.last @@ -182,6 +182,6 @@ Live test, BIRD v2, tag prefix/origin empty AS-SET, IPv6: dumping routes... Live test, BIRD v2, tag prefix/origin empty AS-SET, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 166 tests in 163.047s +Ran 166 tests in 181.076s OK diff --git a/tests/last_results/live_tag_as_set_openbgpd_portable.last b/tests/last_results/live_tag_as_set_openbgpd_portable.last index 9957c020..10552536 100644 --- a/tests/last_results/live_tag_as_set_openbgpd_portable.last +++ b/tests/last_results/live_tag_as_set_openbgpd_portable.last @@ -1,187 +1,187 @@ -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: setting instances up... -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: instances setup ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: sessions are up ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS2 prefix ko origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS2 prefix ko origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS2 prefix ok origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS2 prefix ok origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS4 route filtered (origin ko) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS4 prefix ko origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS4 prefix ok origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS4 route filtered (prefix ko, origin ko) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS5 route filtered (prefix ko, origin ko) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS5 route filtered (prefix ko) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS5 prefix ok origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS5 prefix ok origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS2 white list, prefix ko, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS2 white list, prefix ok, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS2 white list, prefix WL, origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS2 white list, prefix WL, origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS2 white list, prefix WL, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS4 route white list, ok (exact) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS4 route white list, reject (more spec) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS4 route white list, ok (more spec) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS4 route white list, reject (origin KO) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS4 route white list, ok (origin any) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS4 white list, prefix ko, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS4 white list, prefix ok, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS4 white list, prefix WL, origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS4 white list, prefix WL, origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS4 white list, prefix WL, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS5 white list, prefix ko, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS5 white list, prefix ok, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS5 white list, prefix WL, origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS5 white list, prefix WL, origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS5 white list, prefix WL, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS2 RPKI ROAs as route objects: tag only (w/ prefix_validated_via_rpki_roas) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS6 RPKI ROAs as route objects: invalid origin ASN ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS6 RPKI ROAs as route objects: ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS2 ARIN Whois DB: tag only (w/ prefix_validated_via_arin_whois_db_dump) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS6 ARIN Whois DB: ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS2 prefix ok, origin ok, ARIN: tag only (w/ prefix_validated_via_arin_whois_db_dump) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS2 prefix ok, origin ok, ROA: tag only (w/ prefix_validated_via_rpki_roas) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS2 ROA + ARIN Whois DB: tag only (w/ comms [arin_whois_db_dump, rpki_roas]) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS6 prefix ok, origin ok, ROA + ARIN: enforce (w/ comms [arin_whois_db_dump, rpki_roas]) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: AS6 ROA + ARIN Whois DB: enforce (w/ comms [arin_whois_db_dump, rpki_roas]) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: reconfigure ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: log contains errors ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: dumping rs config... -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: dumping routes... -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv4: stopping instances... -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: setting instances up... -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: instances setup ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: sessions are up ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS2 no enforcement, prefix and origin not in AS-SET ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS4 origin enforcement ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS4 prefix enforcement ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS2 white list, prefix ko, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS2 white list, prefix ok, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS2 white list, prefix WL, origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS2 white list, prefix WL, origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS2 white list, prefix WL, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS4 route white list, ok (exact) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS4 route white list, reject (more spec) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS4 route white list, ok (more spec) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS4 route white list, reject (origin KO) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS4 route white list, ok (origin any) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS4 white list, prefix ko, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS4 white list, prefix ok, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS4 white list, prefix WL, origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS4 white list, prefix WL, origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS4 white list, prefix WL, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS5 white list, prefix ko, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS5 white list, prefix ok, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS5 white list, prefix WL, origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS5 white list, prefix WL, origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS5 white list, prefix WL, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS2 RPKI ROAs as route objects: tag only (w/o prefix_validated_via_rpki_roas) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS6 RPKI ROAs as route objects: invalid origin ASN ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS6 RPKI ROAs as route objects: ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS2 ARIN Whois DB: tag only (w/o prefix_validated_via_arin_whois_db_dump) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS6 ARIN Whois DB: ok (solely because of route white list) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS2 prefix ok, origin ok, ARIN: tag only (w/o prefix_validated_via_arin_whois_db_dump) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS2 prefix ok, origin ok, ROA: tag only (w/o prefix_validated_via_rpki_roas) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS2 ROA + ARIN Whois DB: tag only (w/o comms [arin_whois_db_dump, rpki_roas]) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS6 prefix ok, origin ok, ROA + ARIN: rejected ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: AS6 ROA + ARIN Whois DB: enforced (rejected) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: reconfigure ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: log contains errors ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: dumping rs config... -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: dumping routes... -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv4: stopping instances... -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: setting instances up... -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: instances setup ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: sessions are up ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS2 prefix ko origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS2 prefix ko origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS2 prefix ok origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS2 prefix ok origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS4 route filtered (origin ko) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS4 prefix ko origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS4 prefix ok origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS4 route filtered (prefix ko, origin ko) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS5 route filtered (prefix ko, origin ko) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS5 route filtered (prefix ko) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS5 prefix ok origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS5 prefix ok origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS2 white list, prefix ko, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS2 white list, prefix ok, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS2 white list, prefix WL, origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS2 white list, prefix WL, origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS2 white list, prefix WL, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS4 route white list, ok (exact) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS4 route white list, reject (more spec) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS4 route white list, ok (more spec) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS4 route white list, reject (origin KO) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS4 route white list, ok (origin any) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS4 white list, prefix ko, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS4 white list, prefix ok, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS4 white list, prefix WL, origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS4 white list, prefix WL, origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS4 white list, prefix WL, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS5 white list, prefix ko, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS5 white list, prefix ok, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS5 white list, prefix WL, origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS5 white list, prefix WL, origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS5 white list, prefix WL, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS2 RPKI ROAs as route objects: tag only (w/ prefix_validated_via_rpki_roas) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS6 RPKI ROAs as route objects: invalid origin ASN ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS6 RPKI ROAs as route objects: ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS2 ARIN Whois DB: tag only (w/ prefix_validated_via_arin_whois_db_dump) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS6 ARIN Whois DB: ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS2 prefix ok, origin ok, ARIN: tag only (w/ prefix_validated_via_arin_whois_db_dump) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS2 prefix ok, origin ok, ROA: tag only (w/ prefix_validated_via_rpki_roas) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS2 ROA + ARIN Whois DB: tag only (w/ comms [arin_whois_db_dump, rpki_roas]) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS6 prefix ok, origin ok, ROA + ARIN: enforce (w/ comms [arin_whois_db_dump, rpki_roas]) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: AS6 ROA + ARIN Whois DB: enforce (w/ comms [arin_whois_db_dump, rpki_roas]) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: reconfigure ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: log contains errors ... ok -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: dumping rs config... -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: dumping routes... -Live test, OpenBGPD 7.5, tag prefix/origin in AS-SET, IPv6: stopping instances... -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: setting instances up... -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: instances setup ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: sessions are up ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS2 no enforcement, prefix and origin not in AS-SET ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS4 origin enforcement ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS4 prefix enforcement ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS2 white list, prefix ko, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS2 white list, prefix ok, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS2 white list, prefix WL, origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS2 white list, prefix WL, origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS2 white list, prefix WL, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS4 route white list, ok (exact) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS4 route white list, reject (more spec) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS4 route white list, ok (more spec) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS4 route white list, reject (origin KO) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS4 route white list, ok (origin any) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS4 white list, prefix ko, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS4 white list, prefix ok, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS4 white list, prefix WL, origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS4 white list, prefix WL, origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS4 white list, prefix WL, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS5 white list, prefix ko, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS5 white list, prefix ok, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS5 white list, prefix WL, origin ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS5 white list, prefix WL, origin ok ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS5 white list, prefix WL, origin WL ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS2 RPKI ROAs as route objects: tag only (w/o prefix_validated_via_rpki_roas) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS6 RPKI ROAs as route objects: invalid origin ASN ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS6 RPKI ROAs as route objects: ko ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS2 ARIN Whois DB: tag only (w/o prefix_validated_via_arin_whois_db_dump) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS6 ARIN Whois DB: ok (solely because of route white list) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS2 prefix ok, origin ok, ARIN: tag only (w/o prefix_validated_via_arin_whois_db_dump) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS2 prefix ok, origin ok, ROA: tag only (w/o prefix_validated_via_rpki_roas) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS2 ROA + ARIN Whois DB: tag only (w/o comms [arin_whois_db_dump, rpki_roas]) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS6 prefix ok, origin ok, ROA + ARIN: rejected ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: AS6 ROA + ARIN Whois DB: enforced (rejected) ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: reconfigure ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: log contains errors ... ok -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: dumping rs config... -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: dumping routes... -Live test, OpenBGPD 7.5, tag prefix/origin empty AS-SET, IPv6: stopping instances... +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: setting instances up... +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: instances setup ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: sessions are up ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS2 prefix ko origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS2 prefix ko origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS2 prefix ok origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS2 prefix ok origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS4 route filtered (origin ko) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS4 prefix ko origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS4 prefix ok origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS4 route filtered (prefix ko, origin ko) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS5 route filtered (prefix ko, origin ko) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS5 route filtered (prefix ko) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS5 prefix ok origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS5 prefix ok origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS2 white list, prefix ko, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS2 white list, prefix ok, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS2 white list, prefix WL, origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS2 white list, prefix WL, origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS2 white list, prefix WL, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS4 route white list, ok (exact) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS4 route white list, reject (more spec) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS4 route white list, ok (more spec) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS4 route white list, reject (origin KO) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS4 route white list, ok (origin any) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS4 white list, prefix ko, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS4 white list, prefix ok, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS4 white list, prefix WL, origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS4 white list, prefix WL, origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS4 white list, prefix WL, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS5 white list, prefix ko, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS5 white list, prefix ok, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS5 white list, prefix WL, origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS5 white list, prefix WL, origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS5 white list, prefix WL, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS2 RPKI ROAs as route objects: tag only (w/ prefix_validated_via_rpki_roas) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS6 RPKI ROAs as route objects: invalid origin ASN ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS6 RPKI ROAs as route objects: ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS2 ARIN Whois DB: tag only (w/ prefix_validated_via_arin_whois_db_dump) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS6 ARIN Whois DB: ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS2 prefix ok, origin ok, ARIN: tag only (w/ prefix_validated_via_arin_whois_db_dump) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS2 prefix ok, origin ok, ROA: tag only (w/ prefix_validated_via_rpki_roas) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS2 ROA + ARIN Whois DB: tag only (w/ comms [arin_whois_db_dump, rpki_roas]) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS6 prefix ok, origin ok, ROA + ARIN: enforce (w/ comms [arin_whois_db_dump, rpki_roas]) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: AS6 ROA + ARIN Whois DB: enforce (w/ comms [arin_whois_db_dump, rpki_roas]) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: reconfigure ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: log contains errors ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: dumping rs config... +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: dumping routes... +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv4: stopping instances... +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: setting instances up... +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: instances setup ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: sessions are up ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS2 no enforcement, prefix and origin not in AS-SET ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS4 origin enforcement ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS4 prefix enforcement ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS2 white list, prefix ko, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS2 white list, prefix ok, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS2 white list, prefix WL, origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS2 white list, prefix WL, origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS2 white list, prefix WL, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS4 route white list, ok (exact) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS4 route white list, reject (more spec) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS4 route white list, ok (more spec) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS4 route white list, reject (origin KO) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS4 route white list, ok (origin any) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS4 white list, prefix ko, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS4 white list, prefix ok, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS4 white list, prefix WL, origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS4 white list, prefix WL, origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS4 white list, prefix WL, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS5 white list, prefix ko, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS5 white list, prefix ok, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS5 white list, prefix WL, origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS5 white list, prefix WL, origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS5 white list, prefix WL, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS2 RPKI ROAs as route objects: tag only (w/o prefix_validated_via_rpki_roas) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS6 RPKI ROAs as route objects: invalid origin ASN ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS6 RPKI ROAs as route objects: ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS2 ARIN Whois DB: tag only (w/o prefix_validated_via_arin_whois_db_dump) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS6 ARIN Whois DB: ok (solely because of route white list) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS2 prefix ok, origin ok, ARIN: tag only (w/o prefix_validated_via_arin_whois_db_dump) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS2 prefix ok, origin ok, ROA: tag only (w/o prefix_validated_via_rpki_roas) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS2 ROA + ARIN Whois DB: tag only (w/o comms [arin_whois_db_dump, rpki_roas]) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS6 prefix ok, origin ok, ROA + ARIN: rejected ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: AS6 ROA + ARIN Whois DB: enforced (rejected) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: reconfigure ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: log contains errors ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: dumping rs config... +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: dumping routes... +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv4: stopping instances... +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: setting instances up... +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: instances setup ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: sessions are up ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS2 prefix ko origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS2 prefix ko origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS2 prefix ok origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS2 prefix ok origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS4 route filtered (origin ko) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS4 prefix ko origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS4 prefix ok origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS4 route filtered (prefix ko, origin ko) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS5 route filtered (prefix ko, origin ko) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS5 route filtered (prefix ko) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS5 prefix ok origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS5 prefix ok origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS2 white list, prefix ko, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS2 white list, prefix ok, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS2 white list, prefix WL, origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS2 white list, prefix WL, origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS2 white list, prefix WL, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS4 route white list, ok (exact) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS4 route white list, reject (more spec) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS4 route white list, ok (more spec) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS4 route white list, reject (origin KO) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS4 route white list, ok (origin any) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS4 white list, prefix ko, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS4 white list, prefix ok, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS4 white list, prefix WL, origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS4 white list, prefix WL, origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS4 white list, prefix WL, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS5 white list, prefix ko, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS5 white list, prefix ok, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS5 white list, prefix WL, origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS5 white list, prefix WL, origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS5 white list, prefix WL, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS2 RPKI ROAs as route objects: tag only (w/ prefix_validated_via_rpki_roas) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS6 RPKI ROAs as route objects: invalid origin ASN ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS6 RPKI ROAs as route objects: ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS2 ARIN Whois DB: tag only (w/ prefix_validated_via_arin_whois_db_dump) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS6 ARIN Whois DB: ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS2 prefix ok, origin ok, ARIN: tag only (w/ prefix_validated_via_arin_whois_db_dump) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS2 prefix ok, origin ok, ROA: tag only (w/ prefix_validated_via_rpki_roas) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS2 ROA + ARIN Whois DB: tag only (w/ comms [arin_whois_db_dump, rpki_roas]) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS6 prefix ok, origin ok, ROA + ARIN: enforce (w/ comms [arin_whois_db_dump, rpki_roas]) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: AS6 ROA + ARIN Whois DB: enforce (w/ comms [arin_whois_db_dump, rpki_roas]) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: reconfigure ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: log contains errors ... ok +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: dumping rs config... +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: dumping routes... +Live test, OpenBGPD 7.7, tag prefix/origin in AS-SET, IPv6: stopping instances... +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: setting instances up... +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: instances setup ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: sessions are up ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS2 no enforcement, prefix and origin not in AS-SET ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS4 origin enforcement ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS4 prefix enforcement ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS2 white list, prefix ko, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS2 white list, prefix ok, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS2 white list, prefix WL, origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS2 white list, prefix WL, origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS2 white list, prefix WL, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS4 route white list, ok (exact) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS4 route white list, reject (more spec) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS4 route white list, ok (more spec) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS4 route white list, reject (origin KO) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS4 route white list, ok (origin any) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS4 white list, prefix ko, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS4 white list, prefix ok, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS4 white list, prefix WL, origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS4 white list, prefix WL, origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS4 white list, prefix WL, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS5 white list, prefix ko, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS5 white list, prefix ok, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS5 white list, prefix WL, origin ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS5 white list, prefix WL, origin ok ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS5 white list, prefix WL, origin WL ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS2 RPKI ROAs as route objects: tag only (w/o prefix_validated_via_rpki_roas) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS6 RPKI ROAs as route objects: invalid origin ASN ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS6 RPKI ROAs as route objects: ko ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS2 ARIN Whois DB: tag only (w/o prefix_validated_via_arin_whois_db_dump) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS6 ARIN Whois DB: ok (solely because of route white list) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS2 prefix ok, origin ok, ARIN: tag only (w/o prefix_validated_via_arin_whois_db_dump) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS2 prefix ok, origin ok, ROA: tag only (w/o prefix_validated_via_rpki_roas) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS2 ROA + ARIN Whois DB: tag only (w/o comms [arin_whois_db_dump, rpki_roas]) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS6 prefix ok, origin ok, ROA + ARIN: rejected ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: AS6 ROA + ARIN Whois DB: enforced (rejected) ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: reconfigure ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: log contains errors ... ok +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: dumping rs config... +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: dumping routes... +Live test, OpenBGPD 7.7, tag prefix/origin empty AS-SET, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 166 tests in 173.555s +Ran 166 tests in 181.276s OK diff --git a/tests/last_results/live_tag_reject_policy_bird1.last b/tests/last_results/live_tag_reject_policy_bird1.last index d0a99b95..d6af5cac 100644 --- a/tests/last_results/live_tag_reject_policy_bird1.last +++ b/tests/last_results/live_tag_reject_policy_bird1.last @@ -52,6 +52,6 @@ Live test, BIRD, 'tag' reject policy scenario, IPv6: dumping routes... Live test, BIRD, 'tag' reject policy scenario, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 44 tests in 114.618s +Ran 44 tests in 121.872s OK (SKIP=1) diff --git a/tests/last_results/live_tag_reject_policy_bird2.last b/tests/last_results/live_tag_reject_policy_bird2.last index 4d950fe2..ac4db591 100644 --- a/tests/last_results/live_tag_reject_policy_bird2.last +++ b/tests/last_results/live_tag_reject_policy_bird2.last @@ -52,6 +52,6 @@ Live test, BIRD v2, 'tag' reject policy scenario, IPv6: dumping routes... Live test, BIRD v2, 'tag' reject policy scenario, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 44 tests in 114.054s +Ran 44 tests in 118.667s OK (SKIP=1) diff --git a/tests/last_results/live_tag_reject_policy_openbgpd_portable.last b/tests/last_results/live_tag_reject_policy_openbgpd_portable.last index 66098030..d8d90c2c 100644 --- a/tests/last_results/live_tag_reject_policy_openbgpd_portable.last +++ b/tests/last_results/live_tag_reject_policy_openbgpd_portable.last @@ -1,57 +1,57 @@ -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: setting instances up... -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: instances setup ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: sessions are up ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: AS_PATH too long ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: bogon prefix ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: bogon prefix, wrong announcing ASN ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: prefix in client's blacklist ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: invalid ASN in AS_PATH ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: invalid NEXT_HOP ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: local black list ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: prefix is not in IPv6 global unicast space ... SKIP: IPv6 only test -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: origin not in as-macro ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: invalid left-most ASN ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: prefix length ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: prefix not in as-macro ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: RPKI INVALID route ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: transit-free ASN in AS_PATH ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: good routes not received ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: prefixes received by clients: AS1_1 ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: prefixes received by clients: AS1_2 ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: prefixes received by clients: AS2 ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: reconfigure ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: log contains errors ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: dumping rs config... -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: dumping routes... -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv4: stopping instances... -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: setting instances up... -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: instances setup ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: sessions are up ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: AS_PATH too long ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: bogon prefix ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: bogon prefix, wrong announcing ASN ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: prefix in client's blacklist ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: invalid ASN in AS_PATH ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: invalid NEXT_HOP ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: local black list ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: prefix is not in IPv6 global unicast space ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: origin not in as-macro ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: invalid left-most ASN ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: prefix length ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: prefix not in as-macro ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: RPKI INVALID route ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: transit-free ASN in AS_PATH ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: good routes not received ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: prefixes received by clients: AS1_1 ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: prefixes received by clients: AS1_2 ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: prefixes received by clients: AS2 ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: reconfigure ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: log contains errors ... ok -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: dumping rs config... -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: dumping routes... -Live test, OpenBGPD 7.5, 'tag' reject policy scenario, IPv6: stopping instances... +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: setting instances up... +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: instances setup ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: sessions are up ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: AS_PATH too long ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: bogon prefix ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: bogon prefix, wrong announcing ASN ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: prefix in client's blacklist ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: invalid ASN in AS_PATH ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: invalid NEXT_HOP ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: local black list ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: prefix is not in IPv6 global unicast space ... SKIP: IPv6 only test +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: origin not in as-macro ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: invalid left-most ASN ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: prefix length ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: prefix not in as-macro ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: RPKI INVALID route ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: transit-free ASN in AS_PATH ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: good routes not received ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: prefixes received by clients: AS1_1 ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: prefixes received by clients: AS1_2 ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: prefixes received by clients: AS2 ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: reconfigure ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: log contains errors ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: dumping rs config... +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: dumping routes... +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv4: stopping instances... +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: setting instances up... +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: instances setup ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: sessions are up ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: AS_PATH too long ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: bogon prefix ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: bogon prefix, wrong announcing ASN ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: prefix in client's blacklist ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: invalid ASN in AS_PATH ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: invalid NEXT_HOP ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: local black list ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: prefix is not in IPv6 global unicast space ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: origin not in as-macro ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: invalid left-most ASN ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: prefix length ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: prefix not in as-macro ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: RPKI INVALID route ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: transit-free ASN in AS_PATH ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: good routes not received ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: prefixes received by clients: AS1_1 ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: prefixes received by clients: AS1_2 ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: prefixes received by clients: AS2 ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: reconfigure ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: log contains errors ... ok +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: dumping rs config... +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: dumping routes... +Live test, OpenBGPD 7.7, 'tag' reject policy scenario, IPv6: stopping instances... ---------------------------------------------------------------------- -Ran 44 tests in 124.940s +Ran 44 tests in 124.558s OK (SKIP=1) diff --git a/tests/last_results/static.last b/tests/last_results/static.last index ae1b8b97..7bffbd02 100644 --- a/tests/last_results/static.last +++ b/tests/last_results/static.last @@ -247,6 +247,6 @@ RTT getter parser: new line only ... ok RTT getter parser: none ... ok ---------------------------------------------------------------------- -Ran 247 tests in 68.563s +Ran 247 tests in 63.405s OK diff --git a/tests/live_tests/scenarios/communities/configs/BGPCommunitiesScenario_OpenBGPDIPv4/openbgpd76p.conf b/tests/live_tests/scenarios/communities/configs/BGPCommunitiesScenario_OpenBGPDIPv4/openbgpd76p.conf new file mode 100644 index 00000000..b171bc60 --- /dev/null +++ b/tests/live_tests/scenarios/communities/configs/BGPCommunitiesScenario_OpenBGPDIPv4/openbgpd76p.conf @@ -0,0 +1,1887 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.33 { + remote-as 131073 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::33 { + remote-as 131073 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.11 { + remote-as 1 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::11 { + remote-as 1 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.22 { + remote-as 2 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::22 { + remote-as 2 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + +# cust_comm1 +match from group clients set community delete 65501:65501 +match from group clients set ext-community delete rt 65501:65501 +match from group clients set large-community delete 999:65501:65501 + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + + + + + + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.33 set ext-community rt 65520:131073 + +match from 2001:db8:1:1::33 set ext-community rt 65520:131073 + +match from 192.0.2.11 set ext-community rt 65520:1 + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + +match from 192.0.2.22 set ext-community rt 65520:2 + +match from 2001:db8:1:1::22 set ext-community rt 65520:2 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +allow quick from group clients max-as-len 32 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS131073_1, inbound + + + +# NEXT_HOP +match from 192.0.2.33 set community NO_ADVERTISE +match from 192.0.2.33 nexthop 192.0.2.33 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.33 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.33 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.33 peer-as != 131073' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.33 peer-as != 131073 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.33 AS 23456' - reject code: 7 +allow quick from 192.0.2.33 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.33 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.33 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.33 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.33 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.33 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.33 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.33 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.33 set ext-community delete rt 65520:131073 + + + +allow quick from 192.0.2.33 + + + +# --------------------------------------------- +# client AS131073_1, outbound + +deny quick to 192.0.2.33 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.33 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.33 + +# do_not_announce_to_any +deny to 192.0.2.33 community 0:999 +deny to 192.0.2.33 ext-community rt 0:999 +deny to 192.0.2.33 large-community 999:0:999 + +# do_not_announce_to_peer +# Warning: must skip 0:peer_as because peer_as > 65535 (131073) +deny quick to 192.0.2.33 ext-community rt 0:131073 +deny quick to 192.0.2.33 large-community 999:0:131073 + +# announce_to_peer +# Warning: must skip 999:peer_as because peer_as > 65535 (131073) +allow to 192.0.2.33 ext-community rt 999:131073 +allow to 192.0.2.33 large-community 999:999:131073 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.33 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS131073_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::33 set community NO_ADVERTISE +match from 2001:db8:1:1::33 nexthop 2001:db8:1:1::33 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::33 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::33 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::33 peer-as != 131073' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::33 peer-as != 131073 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::33 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::33 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::33 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::33 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::33 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::33 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::33 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::33 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::33 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::33 set ext-community delete rt 65520:131073 + + + +allow quick from 2001:db8:1:1::33 + + + +# --------------------------------------------- +# client AS131073_2, outbound + +deny quick to 2001:db8:1:1::33 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::33 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::33 + +# do_not_announce_to_any +deny to 2001:db8:1:1::33 community 0:999 +deny to 2001:db8:1:1::33 ext-community rt 0:999 +deny to 2001:db8:1:1::33 large-community 999:0:999 + +# do_not_announce_to_peer +# Warning: must skip 0:peer_as because peer_as > 65535 (131073) +deny quick to 2001:db8:1:1::33 ext-community rt 0:131073 +deny quick to 2001:db8:1:1::33 large-community 999:0:131073 + +# announce_to_peer +# Warning: must skip 999:peer_as because peer_as > 65535 (131073) +allow to 2001:db8:1:1::33 ext-community rt 999:131073 +allow to 2001:db8:1:1::33 large-community 999:999:131073 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::33 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_1, inbound + + +# Attach custom BGP communities +# cust_comm1 +match from 192.0.2.11 set community 65501:65501 +match from 192.0.2.11 set ext-community rt 65501:65501 +match from 192.0.2.11 set large-community 999:65501:65501 + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + +# do_not_announce_to_any +deny to 192.0.2.11 community 0:999 +deny to 192.0.2.11 ext-community rt 0:999 +deny to 192.0.2.11 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.11 community 0:1 +deny quick to 192.0.2.11 ext-community rt 0:1 +deny quick to 192.0.2.11 large-community 999:0:1 + +# announce_to_peer +allow to 192.0.2.11 community 999:1 +allow to 192.0.2.11 ext-community rt 999:1 +allow to 192.0.2.11 large-community 999:999:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_2, inbound + + +# Attach custom BGP communities +# cust_comm1 +match from 2001:db8:1:1::11 set community 65501:65501 +match from 2001:db8:1:1::11 set ext-community rt 65501:65501 +match from 2001:db8:1:1::11 set large-community 999:65501:65501 + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + +deny quick to 2001:db8:1:1::11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::11 + +# do_not_announce_to_any +deny to 2001:db8:1:1::11 community 0:999 +deny to 2001:db8:1:1::11 ext-community rt 0:999 +deny to 2001:db8:1:1::11 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::11 community 0:1 +deny quick to 2001:db8:1:1::11 ext-community rt 0:1 +deny quick to 2001:db8:1:1::11 large-community 999:0:1 + +# announce_to_peer +allow to 2001:db8:1:1::11 community 999:1 +allow to 2001:db8:1:1::11 ext-community rt 999:1 +allow to 2001:db8:1:1::11 large-community 999:999:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.22 set community NO_ADVERTISE +match from 192.0.2.22 nexthop 192.0.2.22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.22 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.22 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.22 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.22 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.22 AS 23456' - reject code: 7 +allow quick from 192.0.2.22 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.22 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.22 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.22 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.22 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.22 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.22 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.22 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.22 set ext-community delete rt 65520:2 + + + +allow quick from 192.0.2.22 + + + +# --------------------------------------------- +# client AS2_1, outbound + +deny quick to 192.0.2.22 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.22 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.22 + +# do_not_announce_to_any +deny to 192.0.2.22 community 0:999 +deny to 192.0.2.22 ext-community rt 0:999 +deny to 192.0.2.22 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.22 community 0:2 +deny quick to 192.0.2.22 ext-community rt 0:2 +deny quick to 192.0.2.22 large-community 999:0:2 + +# announce_to_peer +allow to 192.0.2.22 community 999:2 +allow to 192.0.2.22 ext-community rt 999:2 +allow to 192.0.2.22 large-community 999:999:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.22 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::22 set community NO_ADVERTISE +match from 2001:db8:1:1::22 nexthop 2001:db8:1:1::22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::22 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::22 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::22 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::22 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::22 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::22 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::22 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::22 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::22 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::22 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::22 set ext-community delete rt 65520:2 + + + +allow quick from 2001:db8:1:1::22 + + + +# --------------------------------------------- +# client AS2_2, outbound + +deny quick to 2001:db8:1:1::22 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::22 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::22 + +# do_not_announce_to_any +deny to 2001:db8:1:1::22 community 0:999 +deny to 2001:db8:1:1::22 ext-community rt 0:999 +deny to 2001:db8:1:1::22 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::22 community 0:2 +deny quick to 2001:db8:1:1::22 ext-community rt 0:2 +deny quick to 2001:db8:1:1::22 large-community 999:0:2 + +# announce_to_peer +allow to 2001:db8:1:1::22 community 999:2 +allow to 2001:db8:1:1::22 ext-community rt 999:2 +allow to 2001:db8:1:1::22 large-community 999:999:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::22 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes +# announce_to_peer +match to group clients set community delete 999:* +match to group clients set ext-community delete rt 999:* +match to group clients set large-community delete 999:999:* + +# do_not_announce_to_any +match to group clients set community delete 0:999 +match to group clients set ext-community delete rt 0:999 +match to group clients set large-community delete 999:0:999 + +# do_not_announce_to_peer +match to group clients set community delete 0:* +match to group clients set ext-community delete rt 0:* +match to group clients set large-community delete 999:0:* + +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/communities/configs/BGPCommunitiesScenario_OpenBGPDIPv4/openbgpd77p.conf b/tests/live_tests/scenarios/communities/configs/BGPCommunitiesScenario_OpenBGPDIPv4/openbgpd77p.conf new file mode 100644 index 00000000..b171bc60 --- /dev/null +++ b/tests/live_tests/scenarios/communities/configs/BGPCommunitiesScenario_OpenBGPDIPv4/openbgpd77p.conf @@ -0,0 +1,1887 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.33 { + remote-as 131073 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::33 { + remote-as 131073 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.11 { + remote-as 1 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::11 { + remote-as 1 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.22 { + remote-as 2 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::22 { + remote-as 2 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + +# cust_comm1 +match from group clients set community delete 65501:65501 +match from group clients set ext-community delete rt 65501:65501 +match from group clients set large-community delete 999:65501:65501 + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + + + + + + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.33 set ext-community rt 65520:131073 + +match from 2001:db8:1:1::33 set ext-community rt 65520:131073 + +match from 192.0.2.11 set ext-community rt 65520:1 + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + +match from 192.0.2.22 set ext-community rt 65520:2 + +match from 2001:db8:1:1::22 set ext-community rt 65520:2 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +allow quick from group clients max-as-len 32 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS131073_1, inbound + + + +# NEXT_HOP +match from 192.0.2.33 set community NO_ADVERTISE +match from 192.0.2.33 nexthop 192.0.2.33 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.33 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.33 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.33 peer-as != 131073' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.33 peer-as != 131073 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.33 AS 23456' - reject code: 7 +allow quick from 192.0.2.33 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.33 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.33 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.33 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.33 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.33 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.33 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.33 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.33 set ext-community delete rt 65520:131073 + + + +allow quick from 192.0.2.33 + + + +# --------------------------------------------- +# client AS131073_1, outbound + +deny quick to 192.0.2.33 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.33 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.33 + +# do_not_announce_to_any +deny to 192.0.2.33 community 0:999 +deny to 192.0.2.33 ext-community rt 0:999 +deny to 192.0.2.33 large-community 999:0:999 + +# do_not_announce_to_peer +# Warning: must skip 0:peer_as because peer_as > 65535 (131073) +deny quick to 192.0.2.33 ext-community rt 0:131073 +deny quick to 192.0.2.33 large-community 999:0:131073 + +# announce_to_peer +# Warning: must skip 999:peer_as because peer_as > 65535 (131073) +allow to 192.0.2.33 ext-community rt 999:131073 +allow to 192.0.2.33 large-community 999:999:131073 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.33 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS131073_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::33 set community NO_ADVERTISE +match from 2001:db8:1:1::33 nexthop 2001:db8:1:1::33 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::33 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::33 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::33 peer-as != 131073' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::33 peer-as != 131073 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::33 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::33 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::33 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::33 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::33 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::33 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::33 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::33 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::33 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::33 set ext-community delete rt 65520:131073 + + + +allow quick from 2001:db8:1:1::33 + + + +# --------------------------------------------- +# client AS131073_2, outbound + +deny quick to 2001:db8:1:1::33 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::33 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::33 + +# do_not_announce_to_any +deny to 2001:db8:1:1::33 community 0:999 +deny to 2001:db8:1:1::33 ext-community rt 0:999 +deny to 2001:db8:1:1::33 large-community 999:0:999 + +# do_not_announce_to_peer +# Warning: must skip 0:peer_as because peer_as > 65535 (131073) +deny quick to 2001:db8:1:1::33 ext-community rt 0:131073 +deny quick to 2001:db8:1:1::33 large-community 999:0:131073 + +# announce_to_peer +# Warning: must skip 999:peer_as because peer_as > 65535 (131073) +allow to 2001:db8:1:1::33 ext-community rt 999:131073 +allow to 2001:db8:1:1::33 large-community 999:999:131073 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::33 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_1, inbound + + +# Attach custom BGP communities +# cust_comm1 +match from 192.0.2.11 set community 65501:65501 +match from 192.0.2.11 set ext-community rt 65501:65501 +match from 192.0.2.11 set large-community 999:65501:65501 + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + +# do_not_announce_to_any +deny to 192.0.2.11 community 0:999 +deny to 192.0.2.11 ext-community rt 0:999 +deny to 192.0.2.11 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.11 community 0:1 +deny quick to 192.0.2.11 ext-community rt 0:1 +deny quick to 192.0.2.11 large-community 999:0:1 + +# announce_to_peer +allow to 192.0.2.11 community 999:1 +allow to 192.0.2.11 ext-community rt 999:1 +allow to 192.0.2.11 large-community 999:999:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_2, inbound + + +# Attach custom BGP communities +# cust_comm1 +match from 2001:db8:1:1::11 set community 65501:65501 +match from 2001:db8:1:1::11 set ext-community rt 65501:65501 +match from 2001:db8:1:1::11 set large-community 999:65501:65501 + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + +deny quick to 2001:db8:1:1::11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::11 + +# do_not_announce_to_any +deny to 2001:db8:1:1::11 community 0:999 +deny to 2001:db8:1:1::11 ext-community rt 0:999 +deny to 2001:db8:1:1::11 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::11 community 0:1 +deny quick to 2001:db8:1:1::11 ext-community rt 0:1 +deny quick to 2001:db8:1:1::11 large-community 999:0:1 + +# announce_to_peer +allow to 2001:db8:1:1::11 community 999:1 +allow to 2001:db8:1:1::11 ext-community rt 999:1 +allow to 2001:db8:1:1::11 large-community 999:999:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.22 set community NO_ADVERTISE +match from 192.0.2.22 nexthop 192.0.2.22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.22 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.22 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.22 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.22 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.22 AS 23456' - reject code: 7 +allow quick from 192.0.2.22 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.22 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.22 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.22 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.22 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.22 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.22 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.22 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.22 set ext-community delete rt 65520:2 + + + +allow quick from 192.0.2.22 + + + +# --------------------------------------------- +# client AS2_1, outbound + +deny quick to 192.0.2.22 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.22 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.22 + +# do_not_announce_to_any +deny to 192.0.2.22 community 0:999 +deny to 192.0.2.22 ext-community rt 0:999 +deny to 192.0.2.22 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.22 community 0:2 +deny quick to 192.0.2.22 ext-community rt 0:2 +deny quick to 192.0.2.22 large-community 999:0:2 + +# announce_to_peer +allow to 192.0.2.22 community 999:2 +allow to 192.0.2.22 ext-community rt 999:2 +allow to 192.0.2.22 large-community 999:999:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.22 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::22 set community NO_ADVERTISE +match from 2001:db8:1:1::22 nexthop 2001:db8:1:1::22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::22 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::22 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::22 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::22 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::22 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::22 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::22 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::22 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::22 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::22 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::22 set ext-community delete rt 65520:2 + + + +allow quick from 2001:db8:1:1::22 + + + +# --------------------------------------------- +# client AS2_2, outbound + +deny quick to 2001:db8:1:1::22 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::22 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::22 + +# do_not_announce_to_any +deny to 2001:db8:1:1::22 community 0:999 +deny to 2001:db8:1:1::22 ext-community rt 0:999 +deny to 2001:db8:1:1::22 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::22 community 0:2 +deny quick to 2001:db8:1:1::22 ext-community rt 0:2 +deny quick to 2001:db8:1:1::22 large-community 999:0:2 + +# announce_to_peer +allow to 2001:db8:1:1::22 community 999:2 +allow to 2001:db8:1:1::22 ext-community rt 999:2 +allow to 2001:db8:1:1::22 large-community 999:999:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::22 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes +# announce_to_peer +match to group clients set community delete 999:* +match to group clients set ext-community delete rt 999:* +match to group clients set large-community delete 999:999:* + +# do_not_announce_to_any +match to group clients set community delete 0:999 +match to group clients set ext-community delete rt 0:999 +match to group clients set large-community delete 999:0:999 + +# do_not_announce_to_peer +match to group clients set community delete 0:* +match to group clients set ext-community delete rt 0:* +match to group clients set large-community delete 999:0:* + +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/communities/configs/BGPCommunitiesScenario_OpenBGPDIPv6/openbgpd76p.conf b/tests/live_tests/scenarios/communities/configs/BGPCommunitiesScenario_OpenBGPDIPv6/openbgpd76p.conf new file mode 100644 index 00000000..b171bc60 --- /dev/null +++ b/tests/live_tests/scenarios/communities/configs/BGPCommunitiesScenario_OpenBGPDIPv6/openbgpd76p.conf @@ -0,0 +1,1887 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.33 { + remote-as 131073 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::33 { + remote-as 131073 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.11 { + remote-as 1 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::11 { + remote-as 1 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.22 { + remote-as 2 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::22 { + remote-as 2 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + +# cust_comm1 +match from group clients set community delete 65501:65501 +match from group clients set ext-community delete rt 65501:65501 +match from group clients set large-community delete 999:65501:65501 + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + + + + + + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.33 set ext-community rt 65520:131073 + +match from 2001:db8:1:1::33 set ext-community rt 65520:131073 + +match from 192.0.2.11 set ext-community rt 65520:1 + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + +match from 192.0.2.22 set ext-community rt 65520:2 + +match from 2001:db8:1:1::22 set ext-community rt 65520:2 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +allow quick from group clients max-as-len 32 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS131073_1, inbound + + + +# NEXT_HOP +match from 192.0.2.33 set community NO_ADVERTISE +match from 192.0.2.33 nexthop 192.0.2.33 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.33 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.33 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.33 peer-as != 131073' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.33 peer-as != 131073 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.33 AS 23456' - reject code: 7 +allow quick from 192.0.2.33 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.33 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.33 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.33 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.33 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.33 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.33 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.33 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.33 set ext-community delete rt 65520:131073 + + + +allow quick from 192.0.2.33 + + + +# --------------------------------------------- +# client AS131073_1, outbound + +deny quick to 192.0.2.33 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.33 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.33 + +# do_not_announce_to_any +deny to 192.0.2.33 community 0:999 +deny to 192.0.2.33 ext-community rt 0:999 +deny to 192.0.2.33 large-community 999:0:999 + +# do_not_announce_to_peer +# Warning: must skip 0:peer_as because peer_as > 65535 (131073) +deny quick to 192.0.2.33 ext-community rt 0:131073 +deny quick to 192.0.2.33 large-community 999:0:131073 + +# announce_to_peer +# Warning: must skip 999:peer_as because peer_as > 65535 (131073) +allow to 192.0.2.33 ext-community rt 999:131073 +allow to 192.0.2.33 large-community 999:999:131073 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.33 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS131073_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::33 set community NO_ADVERTISE +match from 2001:db8:1:1::33 nexthop 2001:db8:1:1::33 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::33 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::33 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::33 peer-as != 131073' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::33 peer-as != 131073 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::33 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::33 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::33 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::33 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::33 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::33 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::33 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::33 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::33 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::33 set ext-community delete rt 65520:131073 + + + +allow quick from 2001:db8:1:1::33 + + + +# --------------------------------------------- +# client AS131073_2, outbound + +deny quick to 2001:db8:1:1::33 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::33 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::33 + +# do_not_announce_to_any +deny to 2001:db8:1:1::33 community 0:999 +deny to 2001:db8:1:1::33 ext-community rt 0:999 +deny to 2001:db8:1:1::33 large-community 999:0:999 + +# do_not_announce_to_peer +# Warning: must skip 0:peer_as because peer_as > 65535 (131073) +deny quick to 2001:db8:1:1::33 ext-community rt 0:131073 +deny quick to 2001:db8:1:1::33 large-community 999:0:131073 + +# announce_to_peer +# Warning: must skip 999:peer_as because peer_as > 65535 (131073) +allow to 2001:db8:1:1::33 ext-community rt 999:131073 +allow to 2001:db8:1:1::33 large-community 999:999:131073 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::33 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_1, inbound + + +# Attach custom BGP communities +# cust_comm1 +match from 192.0.2.11 set community 65501:65501 +match from 192.0.2.11 set ext-community rt 65501:65501 +match from 192.0.2.11 set large-community 999:65501:65501 + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + +# do_not_announce_to_any +deny to 192.0.2.11 community 0:999 +deny to 192.0.2.11 ext-community rt 0:999 +deny to 192.0.2.11 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.11 community 0:1 +deny quick to 192.0.2.11 ext-community rt 0:1 +deny quick to 192.0.2.11 large-community 999:0:1 + +# announce_to_peer +allow to 192.0.2.11 community 999:1 +allow to 192.0.2.11 ext-community rt 999:1 +allow to 192.0.2.11 large-community 999:999:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_2, inbound + + +# Attach custom BGP communities +# cust_comm1 +match from 2001:db8:1:1::11 set community 65501:65501 +match from 2001:db8:1:1::11 set ext-community rt 65501:65501 +match from 2001:db8:1:1::11 set large-community 999:65501:65501 + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + +deny quick to 2001:db8:1:1::11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::11 + +# do_not_announce_to_any +deny to 2001:db8:1:1::11 community 0:999 +deny to 2001:db8:1:1::11 ext-community rt 0:999 +deny to 2001:db8:1:1::11 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::11 community 0:1 +deny quick to 2001:db8:1:1::11 ext-community rt 0:1 +deny quick to 2001:db8:1:1::11 large-community 999:0:1 + +# announce_to_peer +allow to 2001:db8:1:1::11 community 999:1 +allow to 2001:db8:1:1::11 ext-community rt 999:1 +allow to 2001:db8:1:1::11 large-community 999:999:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.22 set community NO_ADVERTISE +match from 192.0.2.22 nexthop 192.0.2.22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.22 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.22 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.22 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.22 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.22 AS 23456' - reject code: 7 +allow quick from 192.0.2.22 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.22 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.22 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.22 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.22 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.22 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.22 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.22 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.22 set ext-community delete rt 65520:2 + + + +allow quick from 192.0.2.22 + + + +# --------------------------------------------- +# client AS2_1, outbound + +deny quick to 192.0.2.22 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.22 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.22 + +# do_not_announce_to_any +deny to 192.0.2.22 community 0:999 +deny to 192.0.2.22 ext-community rt 0:999 +deny to 192.0.2.22 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.22 community 0:2 +deny quick to 192.0.2.22 ext-community rt 0:2 +deny quick to 192.0.2.22 large-community 999:0:2 + +# announce_to_peer +allow to 192.0.2.22 community 999:2 +allow to 192.0.2.22 ext-community rt 999:2 +allow to 192.0.2.22 large-community 999:999:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.22 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::22 set community NO_ADVERTISE +match from 2001:db8:1:1::22 nexthop 2001:db8:1:1::22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::22 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::22 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::22 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::22 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::22 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::22 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::22 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::22 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::22 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::22 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::22 set ext-community delete rt 65520:2 + + + +allow quick from 2001:db8:1:1::22 + + + +# --------------------------------------------- +# client AS2_2, outbound + +deny quick to 2001:db8:1:1::22 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::22 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::22 + +# do_not_announce_to_any +deny to 2001:db8:1:1::22 community 0:999 +deny to 2001:db8:1:1::22 ext-community rt 0:999 +deny to 2001:db8:1:1::22 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::22 community 0:2 +deny quick to 2001:db8:1:1::22 ext-community rt 0:2 +deny quick to 2001:db8:1:1::22 large-community 999:0:2 + +# announce_to_peer +allow to 2001:db8:1:1::22 community 999:2 +allow to 2001:db8:1:1::22 ext-community rt 999:2 +allow to 2001:db8:1:1::22 large-community 999:999:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::22 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes +# announce_to_peer +match to group clients set community delete 999:* +match to group clients set ext-community delete rt 999:* +match to group clients set large-community delete 999:999:* + +# do_not_announce_to_any +match to group clients set community delete 0:999 +match to group clients set ext-community delete rt 0:999 +match to group clients set large-community delete 999:0:999 + +# do_not_announce_to_peer +match to group clients set community delete 0:* +match to group clients set ext-community delete rt 0:* +match to group clients set large-community delete 999:0:* + +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/communities/configs/BGPCommunitiesScenario_OpenBGPDIPv6/openbgpd77p.conf b/tests/live_tests/scenarios/communities/configs/BGPCommunitiesScenario_OpenBGPDIPv6/openbgpd77p.conf new file mode 100644 index 00000000..b171bc60 --- /dev/null +++ b/tests/live_tests/scenarios/communities/configs/BGPCommunitiesScenario_OpenBGPDIPv6/openbgpd77p.conf @@ -0,0 +1,1887 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.33 { + remote-as 131073 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::33 { + remote-as 131073 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.11 { + remote-as 1 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::11 { + remote-as 1 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.22 { + remote-as 2 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::22 { + remote-as 2 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + +# cust_comm1 +match from group clients set community delete 65501:65501 +match from group clients set ext-community delete rt 65501:65501 +match from group clients set large-community delete 999:65501:65501 + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + + + + + + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.33 set ext-community rt 65520:131073 + +match from 2001:db8:1:1::33 set ext-community rt 65520:131073 + +match from 192.0.2.11 set ext-community rt 65520:1 + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + +match from 192.0.2.22 set ext-community rt 65520:2 + +match from 2001:db8:1:1::22 set ext-community rt 65520:2 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +allow quick from group clients max-as-len 32 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS131073_1, inbound + + + +# NEXT_HOP +match from 192.0.2.33 set community NO_ADVERTISE +match from 192.0.2.33 nexthop 192.0.2.33 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.33 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.33 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.33 peer-as != 131073' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.33 peer-as != 131073 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.33 AS 23456' - reject code: 7 +allow quick from 192.0.2.33 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.33 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.33 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.33 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.33 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.33 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.33 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.33 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.33 set ext-community delete rt 65520:131073 + + + +allow quick from 192.0.2.33 + + + +# --------------------------------------------- +# client AS131073_1, outbound + +deny quick to 192.0.2.33 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.33 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.33 + +# do_not_announce_to_any +deny to 192.0.2.33 community 0:999 +deny to 192.0.2.33 ext-community rt 0:999 +deny to 192.0.2.33 large-community 999:0:999 + +# do_not_announce_to_peer +# Warning: must skip 0:peer_as because peer_as > 65535 (131073) +deny quick to 192.0.2.33 ext-community rt 0:131073 +deny quick to 192.0.2.33 large-community 999:0:131073 + +# announce_to_peer +# Warning: must skip 999:peer_as because peer_as > 65535 (131073) +allow to 192.0.2.33 ext-community rt 999:131073 +allow to 192.0.2.33 large-community 999:999:131073 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.33 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS131073_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::33 set community NO_ADVERTISE +match from 2001:db8:1:1::33 nexthop 2001:db8:1:1::33 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::33 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::33 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::33 peer-as != 131073' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::33 peer-as != 131073 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::33 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::33 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::33 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::33 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::33 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::33 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::33 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::33 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::33 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::33 set ext-community delete rt 65520:131073 + + + +allow quick from 2001:db8:1:1::33 + + + +# --------------------------------------------- +# client AS131073_2, outbound + +deny quick to 2001:db8:1:1::33 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::33 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::33 + +# do_not_announce_to_any +deny to 2001:db8:1:1::33 community 0:999 +deny to 2001:db8:1:1::33 ext-community rt 0:999 +deny to 2001:db8:1:1::33 large-community 999:0:999 + +# do_not_announce_to_peer +# Warning: must skip 0:peer_as because peer_as > 65535 (131073) +deny quick to 2001:db8:1:1::33 ext-community rt 0:131073 +deny quick to 2001:db8:1:1::33 large-community 999:0:131073 + +# announce_to_peer +# Warning: must skip 999:peer_as because peer_as > 65535 (131073) +allow to 2001:db8:1:1::33 ext-community rt 999:131073 +allow to 2001:db8:1:1::33 large-community 999:999:131073 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::33 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_1, inbound + + +# Attach custom BGP communities +# cust_comm1 +match from 192.0.2.11 set community 65501:65501 +match from 192.0.2.11 set ext-community rt 65501:65501 +match from 192.0.2.11 set large-community 999:65501:65501 + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + +# do_not_announce_to_any +deny to 192.0.2.11 community 0:999 +deny to 192.0.2.11 ext-community rt 0:999 +deny to 192.0.2.11 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.11 community 0:1 +deny quick to 192.0.2.11 ext-community rt 0:1 +deny quick to 192.0.2.11 large-community 999:0:1 + +# announce_to_peer +allow to 192.0.2.11 community 999:1 +allow to 192.0.2.11 ext-community rt 999:1 +allow to 192.0.2.11 large-community 999:999:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_2, inbound + + +# Attach custom BGP communities +# cust_comm1 +match from 2001:db8:1:1::11 set community 65501:65501 +match from 2001:db8:1:1::11 set ext-community rt 65501:65501 +match from 2001:db8:1:1::11 set large-community 999:65501:65501 + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + +deny quick to 2001:db8:1:1::11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::11 + +# do_not_announce_to_any +deny to 2001:db8:1:1::11 community 0:999 +deny to 2001:db8:1:1::11 ext-community rt 0:999 +deny to 2001:db8:1:1::11 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::11 community 0:1 +deny quick to 2001:db8:1:1::11 ext-community rt 0:1 +deny quick to 2001:db8:1:1::11 large-community 999:0:1 + +# announce_to_peer +allow to 2001:db8:1:1::11 community 999:1 +allow to 2001:db8:1:1::11 ext-community rt 999:1 +allow to 2001:db8:1:1::11 large-community 999:999:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.22 set community NO_ADVERTISE +match from 192.0.2.22 nexthop 192.0.2.22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.22 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.22 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.22 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.22 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.22 AS 23456' - reject code: 7 +allow quick from 192.0.2.22 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.22 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.22 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.22 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.22 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.22 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.22 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.22 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.22 set ext-community delete rt 65520:2 + + + +allow quick from 192.0.2.22 + + + +# --------------------------------------------- +# client AS2_1, outbound + +deny quick to 192.0.2.22 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.22 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.22 + +# do_not_announce_to_any +deny to 192.0.2.22 community 0:999 +deny to 192.0.2.22 ext-community rt 0:999 +deny to 192.0.2.22 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.22 community 0:2 +deny quick to 192.0.2.22 ext-community rt 0:2 +deny quick to 192.0.2.22 large-community 999:0:2 + +# announce_to_peer +allow to 192.0.2.22 community 999:2 +allow to 192.0.2.22 ext-community rt 999:2 +allow to 192.0.2.22 large-community 999:999:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.22 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::22 set community NO_ADVERTISE +match from 2001:db8:1:1::22 nexthop 2001:db8:1:1::22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::22 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::22 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::22 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::22 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::22 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::22 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::22 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::22 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::22 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::22 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::22 set ext-community delete rt 65520:2 + + + +allow quick from 2001:db8:1:1::22 + + + +# --------------------------------------------- +# client AS2_2, outbound + +deny quick to 2001:db8:1:1::22 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::22 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::22 + +# do_not_announce_to_any +deny to 2001:db8:1:1::22 community 0:999 +deny to 2001:db8:1:1::22 ext-community rt 0:999 +deny to 2001:db8:1:1::22 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::22 community 0:2 +deny quick to 2001:db8:1:1::22 ext-community rt 0:2 +deny quick to 2001:db8:1:1::22 large-community 999:0:2 + +# announce_to_peer +allow to 2001:db8:1:1::22 community 999:2 +allow to 2001:db8:1:1::22 ext-community rt 999:2 +allow to 2001:db8:1:1::22 large-community 999:999:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::22 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes +# announce_to_peer +match to group clients set community delete 999:* +match to group clients set ext-community delete rt 999:* +match to group clients set large-community delete 999:999:* + +# do_not_announce_to_any +match to group clients set community delete 0:999 +match to group clients set ext-community delete rt 0:999 +match to group clients set large-community delete 999:0:999 + +# do_not_announce_to_peer +match to group clients set community delete 0:* +match to group clients set ext-community delete rt 0:* +match to group clients set large-community delete 999:0:* + +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/communities/routes/BGPCommunitiesScenario_OpenBGPDIPv4/openbgpd77p/AS1.txt b/tests/live_tests/scenarios/communities/routes/BGPCommunitiesScenario_OpenBGPDIPv4/openbgpd77p/AS1.txt new file mode 100644 index 00000000..5da2643f --- /dev/null +++ b/tests/live_tests/scenarios/communities/routes/BGPCommunitiesScenario_OpenBGPDIPv4/openbgpd77p/AS1.txt @@ -0,0 +1,28 @@ +2.0.1.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.22, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.2.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.22, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.22, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.6.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.22, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/communities/routes/BGPCommunitiesScenario_OpenBGPDIPv4/openbgpd77p/AS131073.txt b/tests/live_tests/scenarios/communities/routes/BGPCommunitiesScenario_OpenBGPDIPv4/openbgpd77p/AS131073.txt new file mode 100644 index 00000000..8600918f --- /dev/null +++ b/tests/live_tests/scenarios/communities/routes/BGPCommunitiesScenario_OpenBGPDIPv4/openbgpd77p/AS131073.txt @@ -0,0 +1,28 @@ +1.0.1.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: 65501:65501 + ext comms: rt:65501:65501 + lrg comms: 999:65501:65501 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.4.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.22, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.5.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.22, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.6.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.22, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/communities/routes/BGPCommunitiesScenario_OpenBGPDIPv4/openbgpd77p/AS2.txt b/tests/live_tests/scenarios/communities/routes/BGPCommunitiesScenario_OpenBGPDIPv4/openbgpd77p/AS2.txt new file mode 100644 index 00000000..0cb7d282 --- /dev/null +++ b/tests/live_tests/scenarios/communities/routes/BGPCommunitiesScenario_OpenBGPDIPv4/openbgpd77p/AS2.txt @@ -0,0 +1,7 @@ +1.0.1.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: 65501:65501 + ext comms: rt:65501:65501 + lrg comms: 999:65501:65501 + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/communities/routes/BGPCommunitiesScenario_OpenBGPDIPv4/openbgpd77p/rs.txt b/tests/live_tests/scenarios/communities/routes/BGPCommunitiesScenario_OpenBGPDIPv4/openbgpd77p/rs.txt new file mode 100644 index 00000000..d7d39207 --- /dev/null +++ b/tests/live_tests/scenarios/communities/routes/BGPCommunitiesScenario_OpenBGPDIPv4/openbgpd77p/rs.txt @@ -0,0 +1,49 @@ +1.0.1.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: 65501:65501 + ext comms: rt:65501:65501 + lrg comms: 999:65501:65501 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.1.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.22, via 192.0.2.22 + std comms: 0:999, 999:1 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.2.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.22, via 192.0.2.22 + std comms: + ext comms: rt:0:999, rt:999:1 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.22, via 192.0.2.22 + std comms: + ext comms: + lrg comms: 999:0:999, 999:999:1 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.4.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.22, via 192.0.2.22 + std comms: 0:999 + ext comms: rt:999:131073 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.5.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.22, via 192.0.2.22 + std comms: + ext comms: + lrg comms: 999:0:999, 999:999:131073 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.6.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.22, via 192.0.2.22 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/communities/routes/BGPCommunitiesScenario_OpenBGPDIPv6/openbgpd77p/AS1.txt b/tests/live_tests/scenarios/communities/routes/BGPCommunitiesScenario_OpenBGPDIPv6/openbgpd77p/AS1.txt new file mode 100644 index 00000000..99f3fa19 --- /dev/null +++ b/tests/live_tests/scenarios/communities/routes/BGPCommunitiesScenario_OpenBGPDIPv6/openbgpd77p/AS1.txt @@ -0,0 +1,28 @@ +2a00:1::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::22, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a00:2::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::22, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a00:3::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::22, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a00:6::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::22, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/communities/routes/BGPCommunitiesScenario_OpenBGPDIPv6/openbgpd77p/AS131073.txt b/tests/live_tests/scenarios/communities/routes/BGPCommunitiesScenario_OpenBGPDIPv6/openbgpd77p/AS131073.txt new file mode 100644 index 00000000..ff54ced5 --- /dev/null +++ b/tests/live_tests/scenarios/communities/routes/BGPCommunitiesScenario_OpenBGPDIPv6/openbgpd77p/AS131073.txt @@ -0,0 +1,28 @@ +2a00:4::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::22, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a00:5::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::22, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a00:6::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::22, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a01:1::/32, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 65501:65501 + ext comms: rt:65501:65501 + lrg comms: 999:65501:65501 + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/communities/routes/BGPCommunitiesScenario_OpenBGPDIPv6/openbgpd77p/AS2.txt b/tests/live_tests/scenarios/communities/routes/BGPCommunitiesScenario_OpenBGPDIPv6/openbgpd77p/AS2.txt new file mode 100644 index 00000000..6f4f0803 --- /dev/null +++ b/tests/live_tests/scenarios/communities/routes/BGPCommunitiesScenario_OpenBGPDIPv6/openbgpd77p/AS2.txt @@ -0,0 +1,7 @@ +2a01:1::/32, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 65501:65501 + ext comms: rt:65501:65501 + lrg comms: 999:65501:65501 + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/communities/routes/BGPCommunitiesScenario_OpenBGPDIPv6/openbgpd77p/rs.txt b/tests/live_tests/scenarios/communities/routes/BGPCommunitiesScenario_OpenBGPDIPv6/openbgpd77p/rs.txt new file mode 100644 index 00000000..fff34e4e --- /dev/null +++ b/tests/live_tests/scenarios/communities/routes/BGPCommunitiesScenario_OpenBGPDIPv6/openbgpd77p/rs.txt @@ -0,0 +1,49 @@ +2a00:1::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::22, via 2001:db8:1:1::22 + std comms: 0:999, 999:1 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a00:2::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::22, via 2001:db8:1:1::22 + std comms: + ext comms: rt:0:999, rt:999:1 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a00:3::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::22, via 2001:db8:1:1::22 + std comms: + ext comms: + lrg comms: 999:0:999, 999:999:1 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a00:4::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::22, via 2001:db8:1:1::22 + std comms: 0:999 + ext comms: rt:999:131073 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a00:5::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::22, via 2001:db8:1:1::22 + std comms: + ext comms: + lrg comms: 999:0:999, 999:999:131073 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a00:6::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::22, via 2001:db8:1:1::22 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a01:1::/32, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 65501:65501 + ext comms: rt:65501:65501 + lrg comms: 999:65501:65501 + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/default/configs/DefaultConfigScenarioOpenBGPD_IPv4/openbgpd76p.conf b/tests/live_tests/scenarios/default/configs/DefaultConfigScenarioOpenBGPD_IPv4/openbgpd76p.conf new file mode 100644 index 00000000..c47a7620 --- /dev/null +++ b/tests/live_tests/scenarios/default/configs/DefaultConfigScenarioOpenBGPD_IPv4/openbgpd76p.conf @@ -0,0 +1,1273 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + +# AS3333, used by client AS3333_1 +as-set "AS_SET_AS3333_asns" { + 3333 +} +prefix-set "AS_SET_AS3333_prefixes" { + 193.0.0.0/21 +} + +# AS10745, used by client AS10745_1, client AS10745_2 +as-set "AS_SET_AS10745_asns" { + 10745 +} +prefix-set "AS_SET_AS10745_prefixes" { + 199.43.0.0/24 +} + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.22 { + remote-as 10745 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db:1:1::22 { + remote-as 10745 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.11 { + remote-as 3333 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + + + + + + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.22 set ext-community rt 65520:10745 + +match from 2001:db:1:1::22 set ext-community rt 65520:10745 + +match from 192.0.2.11 set ext-community rt 65520:3333 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +allow quick from group clients max-as-len 32 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS10745_1, inbound + + + +# NEXT_HOP +match from 192.0.2.22 set community NO_ADVERTISE +match from 192.0.2.22 nexthop 192.0.2.22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.22 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.22 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.22 peer-as != 10745' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.22 peer-as != 10745 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.22 AS 23456' - reject code: 7 +allow quick from 192.0.2.22 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.22 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.22 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.22 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.22 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 192.0.2.22 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS10745_1, AS10745: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.22 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.22 source-as as-set AS_SET_AS10745_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS10745 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS10745_1, AS10745: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.22 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.22 prefix-set AS_SET_AS10745_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS10745 + + + + + + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.22 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.22 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.22 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.22 set ext-community delete rt 65520:10745 + + + +allow quick from 192.0.2.22 + + + +# --------------------------------------------- +# client AS10745_1, outbound + +deny quick to 192.0.2.22 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.22 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.22 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.22 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS10745_2, inbound + + + +# NEXT_HOP +match from 2001:db:1:1::22 set community NO_ADVERTISE +match from 2001:db:1:1::22 nexthop 2001:db:1:1::22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db:1:1::22 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db:1:1::22 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db:1:1::22 peer-as != 10745' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db:1:1::22 peer-as != 10745 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db:1:1::22 AS 23456' - reject code: 7 +allow quick from 2001:db:1:1::22 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db:1:1::22 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db:1:1::22 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db:1:1::22 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db:1:1::22 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 2001:db:1:1::22 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS10745_2, AS10745: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db:1:1::22 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db:1:1::22 source-as as-set AS_SET_AS10745_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS10745 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS10745_2, AS10745: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db:1:1::22 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db:1:1::22 prefix-set AS_SET_AS10745_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS10745 + + + + + + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db:1:1::22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db:1:1::22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db:1:1::22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db:1:1::22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db:1:1::22 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db:1:1::22 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db:1:1::22 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db:1:1::22 set ext-community delete rt 65520:10745 + + + +allow quick from 2001:db:1:1::22 + + + +# --------------------------------------------- +# client AS10745_2, outbound + +deny quick to 2001:db:1:1::22 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db:1:1::22 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db:1:1::22 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db:1:1::22 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3333_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 3333' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 3333 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 192.0.2.11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS3333_1, AS3333: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.11 source-as as-set AS_SET_AS3333_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS3333 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS3333_1, AS3333: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.11 prefix-set AS_SET_AS3333_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS3333 + + + + + + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:3333 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS3333_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/default/configs/DefaultConfigScenarioOpenBGPD_IPv4/openbgpd77p.conf b/tests/live_tests/scenarios/default/configs/DefaultConfigScenarioOpenBGPD_IPv4/openbgpd77p.conf new file mode 100644 index 00000000..c47a7620 --- /dev/null +++ b/tests/live_tests/scenarios/default/configs/DefaultConfigScenarioOpenBGPD_IPv4/openbgpd77p.conf @@ -0,0 +1,1273 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + +# AS3333, used by client AS3333_1 +as-set "AS_SET_AS3333_asns" { + 3333 +} +prefix-set "AS_SET_AS3333_prefixes" { + 193.0.0.0/21 +} + +# AS10745, used by client AS10745_1, client AS10745_2 +as-set "AS_SET_AS10745_asns" { + 10745 +} +prefix-set "AS_SET_AS10745_prefixes" { + 199.43.0.0/24 +} + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.22 { + remote-as 10745 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db:1:1::22 { + remote-as 10745 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.11 { + remote-as 3333 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + + + + + + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.22 set ext-community rt 65520:10745 + +match from 2001:db:1:1::22 set ext-community rt 65520:10745 + +match from 192.0.2.11 set ext-community rt 65520:3333 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +allow quick from group clients max-as-len 32 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS10745_1, inbound + + + +# NEXT_HOP +match from 192.0.2.22 set community NO_ADVERTISE +match from 192.0.2.22 nexthop 192.0.2.22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.22 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.22 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.22 peer-as != 10745' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.22 peer-as != 10745 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.22 AS 23456' - reject code: 7 +allow quick from 192.0.2.22 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.22 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.22 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.22 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.22 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 192.0.2.22 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS10745_1, AS10745: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.22 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.22 source-as as-set AS_SET_AS10745_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS10745 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS10745_1, AS10745: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.22 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.22 prefix-set AS_SET_AS10745_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS10745 + + + + + + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.22 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.22 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.22 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.22 set ext-community delete rt 65520:10745 + + + +allow quick from 192.0.2.22 + + + +# --------------------------------------------- +# client AS10745_1, outbound + +deny quick to 192.0.2.22 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.22 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.22 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.22 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS10745_2, inbound + + + +# NEXT_HOP +match from 2001:db:1:1::22 set community NO_ADVERTISE +match from 2001:db:1:1::22 nexthop 2001:db:1:1::22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db:1:1::22 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db:1:1::22 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db:1:1::22 peer-as != 10745' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db:1:1::22 peer-as != 10745 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db:1:1::22 AS 23456' - reject code: 7 +allow quick from 2001:db:1:1::22 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db:1:1::22 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db:1:1::22 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db:1:1::22 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db:1:1::22 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 2001:db:1:1::22 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS10745_2, AS10745: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db:1:1::22 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db:1:1::22 source-as as-set AS_SET_AS10745_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS10745 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS10745_2, AS10745: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db:1:1::22 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db:1:1::22 prefix-set AS_SET_AS10745_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS10745 + + + + + + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db:1:1::22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db:1:1::22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db:1:1::22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db:1:1::22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db:1:1::22 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db:1:1::22 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db:1:1::22 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db:1:1::22 set ext-community delete rt 65520:10745 + + + +allow quick from 2001:db:1:1::22 + + + +# --------------------------------------------- +# client AS10745_2, outbound + +deny quick to 2001:db:1:1::22 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db:1:1::22 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db:1:1::22 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db:1:1::22 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3333_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 3333' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 3333 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 192.0.2.11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS3333_1, AS3333: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.11 source-as as-set AS_SET_AS3333_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS3333 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS3333_1, AS3333: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.11 prefix-set AS_SET_AS3333_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS3333 + + + + + + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:3333 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS3333_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/default/configs/DefaultConfigScenarioOpenBGPD_IPv6/openbgpd76p.conf b/tests/live_tests/scenarios/default/configs/DefaultConfigScenarioOpenBGPD_IPv6/openbgpd76p.conf new file mode 100644 index 00000000..423372e3 --- /dev/null +++ b/tests/live_tests/scenarios/default/configs/DefaultConfigScenarioOpenBGPD_IPv6/openbgpd76p.conf @@ -0,0 +1,1273 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + +# AS3333, used by client AS3333_1 +as-set "AS_SET_AS3333_asns" { + 3333 +} +prefix-set "AS_SET_AS3333_prefixes" { + 2001:67c:2e8::/48 +} + +# AS10745, used by client AS10745_1, client AS10745_2 +as-set "AS_SET_AS10745_asns" { + 10745 +} +prefix-set "AS_SET_AS10745_prefixes" { + 2001:500:4::/48 +} + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.22 { + remote-as 10745 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db:1:1::22 { + remote-as 10745 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.11 { + remote-as 3333 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + + + + + + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.22 set ext-community rt 65520:10745 + +match from 2001:db:1:1::22 set ext-community rt 65520:10745 + +match from 192.0.2.11 set ext-community rt 65520:3333 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +allow quick from group clients max-as-len 32 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS10745_1, inbound + + + +# NEXT_HOP +match from 192.0.2.22 set community NO_ADVERTISE +match from 192.0.2.22 nexthop 192.0.2.22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.22 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.22 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.22 peer-as != 10745' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.22 peer-as != 10745 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.22 AS 23456' - reject code: 7 +allow quick from 192.0.2.22 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.22 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.22 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.22 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.22 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 192.0.2.22 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS10745_1, AS10745: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.22 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.22 source-as as-set AS_SET_AS10745_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS10745 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS10745_1, AS10745: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.22 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.22 prefix-set AS_SET_AS10745_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS10745 + + + + + + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.22 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.22 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.22 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.22 set ext-community delete rt 65520:10745 + + + +allow quick from 192.0.2.22 + + + +# --------------------------------------------- +# client AS10745_1, outbound + +deny quick to 192.0.2.22 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.22 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.22 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.22 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS10745_2, inbound + + + +# NEXT_HOP +match from 2001:db:1:1::22 set community NO_ADVERTISE +match from 2001:db:1:1::22 nexthop 2001:db:1:1::22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db:1:1::22 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db:1:1::22 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db:1:1::22 peer-as != 10745' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db:1:1::22 peer-as != 10745 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db:1:1::22 AS 23456' - reject code: 7 +allow quick from 2001:db:1:1::22 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db:1:1::22 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db:1:1::22 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db:1:1::22 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db:1:1::22 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 2001:db:1:1::22 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS10745_2, AS10745: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db:1:1::22 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db:1:1::22 source-as as-set AS_SET_AS10745_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS10745 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS10745_2, AS10745: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db:1:1::22 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db:1:1::22 prefix-set AS_SET_AS10745_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS10745 + + + + + + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db:1:1::22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db:1:1::22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db:1:1::22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db:1:1::22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db:1:1::22 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db:1:1::22 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db:1:1::22 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db:1:1::22 set ext-community delete rt 65520:10745 + + + +allow quick from 2001:db:1:1::22 + + + +# --------------------------------------------- +# client AS10745_2, outbound + +deny quick to 2001:db:1:1::22 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db:1:1::22 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db:1:1::22 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db:1:1::22 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3333_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 3333' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 3333 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 192.0.2.11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS3333_1, AS3333: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.11 source-as as-set AS_SET_AS3333_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS3333 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS3333_1, AS3333: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.11 prefix-set AS_SET_AS3333_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS3333 + + + + + + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:3333 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS3333_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/default/configs/DefaultConfigScenarioOpenBGPD_IPv6/openbgpd77p.conf b/tests/live_tests/scenarios/default/configs/DefaultConfigScenarioOpenBGPD_IPv6/openbgpd77p.conf new file mode 100644 index 00000000..423372e3 --- /dev/null +++ b/tests/live_tests/scenarios/default/configs/DefaultConfigScenarioOpenBGPD_IPv6/openbgpd77p.conf @@ -0,0 +1,1273 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + +# AS3333, used by client AS3333_1 +as-set "AS_SET_AS3333_asns" { + 3333 +} +prefix-set "AS_SET_AS3333_prefixes" { + 2001:67c:2e8::/48 +} + +# AS10745, used by client AS10745_1, client AS10745_2 +as-set "AS_SET_AS10745_asns" { + 10745 +} +prefix-set "AS_SET_AS10745_prefixes" { + 2001:500:4::/48 +} + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.22 { + remote-as 10745 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db:1:1::22 { + remote-as 10745 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.11 { + remote-as 3333 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + + + + + + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.22 set ext-community rt 65520:10745 + +match from 2001:db:1:1::22 set ext-community rt 65520:10745 + +match from 192.0.2.11 set ext-community rt 65520:3333 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +allow quick from group clients max-as-len 32 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS10745_1, inbound + + + +# NEXT_HOP +match from 192.0.2.22 set community NO_ADVERTISE +match from 192.0.2.22 nexthop 192.0.2.22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.22 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.22 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.22 peer-as != 10745' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.22 peer-as != 10745 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.22 AS 23456' - reject code: 7 +allow quick from 192.0.2.22 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.22 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.22 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.22 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.22 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 192.0.2.22 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS10745_1, AS10745: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.22 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.22 source-as as-set AS_SET_AS10745_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS10745 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS10745_1, AS10745: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.22 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.22 prefix-set AS_SET_AS10745_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS10745 + + + + + + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.22 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.22 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.22 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.22 set ext-community delete rt 65520:10745 + + + +allow quick from 192.0.2.22 + + + +# --------------------------------------------- +# client AS10745_1, outbound + +deny quick to 192.0.2.22 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.22 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.22 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.22 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS10745_2, inbound + + + +# NEXT_HOP +match from 2001:db:1:1::22 set community NO_ADVERTISE +match from 2001:db:1:1::22 nexthop 2001:db:1:1::22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db:1:1::22 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db:1:1::22 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db:1:1::22 peer-as != 10745' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db:1:1::22 peer-as != 10745 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db:1:1::22 AS 23456' - reject code: 7 +allow quick from 2001:db:1:1::22 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db:1:1::22 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db:1:1::22 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db:1:1::22 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db:1:1::22 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 2001:db:1:1::22 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS10745_2, AS10745: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db:1:1::22 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db:1:1::22 source-as as-set AS_SET_AS10745_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS10745 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS10745_2, AS10745: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db:1:1::22 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db:1:1::22 prefix-set AS_SET_AS10745_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS10745 + + + + + + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db:1:1::22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db:1:1::22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db:1:1::22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db:1:1::22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db:1:1::22 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db:1:1::22 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db:1:1::22 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db:1:1::22 set ext-community delete rt 65520:10745 + + + +allow quick from 2001:db:1:1::22 + + + +# --------------------------------------------- +# client AS10745_2, outbound + +deny quick to 2001:db:1:1::22 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db:1:1::22 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db:1:1::22 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db:1:1::22 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3333_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 3333' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 3333 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 192.0.2.11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS3333_1, AS3333: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.11 source-as as-set AS_SET_AS3333_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS3333 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS3333_1, AS3333: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.11 prefix-set AS_SET_AS3333_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS3333 + + + + + + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:3333 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS3333_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/default/routes/DefaultConfigScenarioOpenBGPD_IPv4/openbgpd77p/rs.txt b/tests/live_tests/scenarios/default/routes/DefaultConfigScenarioOpenBGPD_IPv4/openbgpd77p/rs.txt new file mode 100644 index 00000000..e69de29b diff --git a/tests/live_tests/scenarios/default/routes/DefaultConfigScenarioOpenBGPD_IPv6/openbgpd77p/rs.txt b/tests/live_tests/scenarios/default/routes/DefaultConfigScenarioOpenBGPD_IPv6/openbgpd77p/rs.txt new file mode 100644 index 00000000..e69de29b diff --git a/tests/live_tests/scenarios/global/configs/BasicScenario_OpenBGPDIPv4/openbgpd76p.conf b/tests/live_tests/scenarios/global/configs/BasicScenario_OpenBGPDIPv4/openbgpd76p.conf new file mode 100644 index 00000000..f3b3121f --- /dev/null +++ b/tests/live_tests/scenarios/global/configs/BasicScenario_OpenBGPDIPv4/openbgpd76p.conf @@ -0,0 +1,10254 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + +# AS222, used by client AS222_1, client AS222_2 +# no origin ASNs found for AS222 +# no prefixes found for AS222 + +# AS2, used by client AS2_1, client AS2_2 +# no origin ASNs found for AS2 +# no prefixes found for AS2 + +# AS-AS1, AS-AS1_CUSTOMERS, used by client AS1_1, client AS1_2, client AS1_3, client AS1_4 +as-set "AS_SET_AS_AS1_AS_AS1_CUSTOMERS_asns" { + 1 101 103 104 +} +prefix-set "AS_SET_AS_AS1_AS_AS1_CUSTOMERS_prefixes" { + 1.0.0.0/8 prefixlen 8 - 32 + 128.0.0.0/7 prefixlen 7 - 32 + 101.0.0.0/16 prefixlen 16 - 32 + 103.0.0.0/16 prefixlen 16 - 32 +} + +# AS-AS2, AS-AS2_CUSTOMERS, used by client AS2_1, client AS2_2 +as-set "AS_SET_AS_AS2_AS_AS2_CUSTOMERS_asns" { + 2 101 103 +} +prefix-set "AS_SET_AS_AS2_AS_AS2_CUSTOMERS_prefixes" { + 2.0.0.0/16 prefixlen 16 - 32 + 101.0.0.0/16 prefixlen 16 - 32 + 103.0.0.0/16 prefixlen 16 - 32 +} + +# WHITE_LIST_AS1_2, used by client AS1_2 white list +as-set "AS_SET_WHITE_LIST_AS1_2_asns" { + 1011 +} +prefix-set "AS_SET_WHITE_LIST_AS1_2_prefixes" { + 11.1.0.0/16 prefixlen 16 - 32 + 2a11:1::/32 prefixlen 32 - 128 +} + +# AS-AS222, used by client AS222_1, client AS222_2 +as-set "AS_SET_AS_AS222_asns" { + 333 +} +prefix-set "AS_SET_AS_AS222_prefixes" { + 222.0.0.0/8 prefixlen 8 - 32 +} + +# AS1, used by client AS1_1, client AS1_2, client AS1_3, client AS1_4 +# no origin ASNs found for AS1 +# no prefixes found for AS1 + +# WHITE_LIST_AS1_1, used by client AS1_1 white list +as-set "AS_SET_WHITE_LIST_AS1_1_asns" { + 1011 +} +prefix-set "AS_SET_WHITE_LIST_AS1_1_prefixes" { + 11.1.0.0/16 prefixlen 16 - 32 + 2a11:1::/32 prefixlen 32 - 128 +} + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + # RTT: 0.1 ms (normalized value: 1) + neighbor 192.0.2.11 { + remote-as 1 + + rde evaluate all + + descr "AS1_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::11 { + remote-as 1 + + rde evaluate all + + descr "AS1_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + # RTT: 5 ms (normalized value: 5) + neighbor 192.0.2.12 { + remote-as 1 + + rde evaluate all + + descr "AS1_2 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::12 { + remote-as 1 + + rde evaluate all + + descr "AS1_2 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.222 { + remote-as 222 + + rde evaluate all + + descr "AS222_1 client" + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::222 { + remote-as 222 + + rde evaluate all + + descr "AS222_1 client" + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + # RTT: 17.3 ms (normalized value: 17) + neighbor 192.0.2.21 { + remote-as 2 + + rde evaluate all + + descr "AS2_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::21 { + remote-as 2 + + rde evaluate all + + descr "AS2_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + # RTT: 123.8 ms (normalized value: 124) + neighbor 192.0.2.31 { + remote-as 3 + + rde evaluate all + + descr "AS3_1 client" + ttl-security no + transparent-as no + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::31 { + remote-as 3 + + rde evaluate all + + descr "AS3_1 client" + ttl-security no + transparent-as no + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } + + # RTT: 600 ms (normalized value: 600) + neighbor 192.0.2.41 { + remote-as 4 + + rde evaluate all + + descr "AS4_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::41 { + remote-as 4 + + rde evaluate all + + descr "AS4_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } +} + +include "/etc/bgpd/post-clients.local" + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + +prefix-set "global_black_list_pref" { + 192.0.2.0/24 prefixlen 24 - 32 + 2001:db8::/32 prefixlen 32 - 128 + +} + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + +# never via route-servers ASNs +as-set "neverviarouteserver" { + 666, 777 +} + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# origin_not_present_in_as_set +match from group clients set community delete 65530:0 +match from group clients set large-community delete 999:65530:0 + +# origin_present_in_as_set +match from group clients set community delete 65530:1 +match from group clients set large-community delete 999:65530:1 + +# prefix_validated_via_arin_whois_db_dump +match from group clients set community delete 65530:3 +match from group clients set large-community delete 999:65530:3 + +# prefix_validated_via_rpki_roas +match from group clients set community delete 65530:2 +match from group clients set large-community delete 999:65530:2 + +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + +# rpki_bgp_origin_validation_not_performed +match from group clients set community delete 65530:4 +match from group clients set large-community delete 999:65530:4 + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + +# --------------------------------------------------------- +# ROAs source + + +roa-set { + 101.3.0.0/16 maxlen 24 source-as 105 expires 4102444799 + 101.2.0.0/17 source-as 101 expires 4102444799 + 101.2.128.0/17 maxlen 24 source-as 101 expires 4102444799 + 101.0.128.0/20 maxlen 23 source-as 101 expires 4102444799 + 101.0.8.0/24 source-as 101 expires 4102444799 + 101.0.9.0/24 source-as 102 expires 4102444799 + 222.1.1.0/24 source-as 333 expires 4102444799 + 3101:3::/32 maxlen 48 source-as 105 expires 4102444799 + 3101:0:8000::/33 maxlen 34 source-as 101 expires 4102444799 + 3101:2:8000::/33 maxlen 48 source-as 101 expires 4102444799 + 3101:2::/33 source-as 101 expires 4102444799 + 3101:0:8::/48 source-as 101 expires 4102444799 + 3101:0:9::/48 source-as 102 expires 4102444799 + 3222:0:1::/48 source-as 333 expires 4102444799 + +} + + + +# --------------------------------------------------------- +# RPKI-based Origin Validation + + +# Add $INTCOMM_RPKI_UNKNOWN, $INTCOMM_RPKI_INVALID and $INTCOMM_RPKI_VALID +# ext community on the basis of ovs. +match from group clients ovs not-found set { + ext-community $INTCOMM_RPKI_UNKNOWN + ext-community ovs not-found + +} +match from group clients ovs valid set { + ext-community $INTCOMM_RPKI_VALID + ext-community ovs valid + +} +match from group clients ovs invalid set { + ext-community $INTCOMM_RPKI_INVALID + ext-community ovs invalid + +} + + + +# --------------------------------------------------------- +# RPKI ROAs used as route objects. + +# Add the $INTCOMM_PREF_OK_ROA ext community to routes whose +# origin ASN has a ROA for the announced prefix. +# It will be used later during IRRDB validation in +# case the origin ASN is authorized by a client's +# AS-SET but the prefix is not. + +# Since RPKI-based Origin Validation is already performed above, +# use the origin validation state to identify valid routes. +match from group clients ovs valid set ext-community $INTCOMM_PREF_OK_ROA + + +# ARIN Whois records used for preifx validation +# --------------------------------------------- + +# Add the $INTCOMM_PREF_OK_ARINDB ext community to routes whose +# origin ASN has an ARIN Whois record for the announced prefix. +# It will be used later during IRRDB validation in +# case the origin ASN is authorized by a client's +# AS-SET but the prefix is not. +origin-set "ARINDB" { +104.0.0.0/23 prefixlen 23 - 32 source-as 104 +3104::/32 prefixlen 32 - 128 source-as 104 +} +match from group clients origin-set ARINDB set ext-community $INTCOMM_PREF_OK_ARINDB + +# NIC.BR Whois records used for preifx validation +# ----------------------------------------------- + +# Add the $INTCOMM_PREF_OK_REGISTROBRDB ext community to routes whose +# origin ASN has a NIC.BR Whois record for the announced prefix. +# It will be used later during IRRDB validation in +# case the origin ASN is authorized by a client's +# AS-SET but the prefix is not. +origin-set "REGISTROBRDB" { +104.1.1.0/24 prefixlen 24 - 32 source-as 104 +3104:1:1::/48 prefixlen 48 - 128 source-as 104 +} +match from group clients origin-set REGISTROBRDB set ext-community $INTCOMM_PREF_OK_REGISTROBRDB + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.11 set ext-community rt 65520:1 + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + +match from 192.0.2.12 set ext-community rt 65520:1 + +match from 2001:db8:1:1::12 set ext-community rt 65520:1 + +match from 192.0.2.222 set ext-community rt 65520:222 + +match from 2001:db8:1:1::222 set ext-community rt 65520:222 + +match from 192.0.2.21 set ext-community rt 65520:2 + +match from 2001:db8:1:1::21 set ext-community rt 65520:2 + +match from 192.0.2.31 set ext-community rt 65520:3 + +match from 2001:db8:1:1::31 set ext-community rt 65520:3 + +match from 192.0.2.41 set ext-community rt 65520:4 + +match from 2001:db8:1:1::41 set ext-community rt 65520:4 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 6' - reject code: 1 +allow quick from group clients max-as-len 6 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: global blacklist +# Reject inbound routes when 'from group clients prefix-set global_black_list_pref' - reject code: 3 +allow quick from group clients prefix-set global_black_list_pref set { + localpref 1 + community 65520:0 + community 65520:3 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS1_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.11 AS { 3, 174 }' - reject code: 8 +allow quick from 192.0.2.11 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.11 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.11 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 192.0.2.11 prefix 11.3.0.0/16 source-as 1011 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.11 prefix 11.4.0.0/16 prefixlen 16 - 32 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.11 prefix 2a11:3::/32 source-as 1011 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.11 prefix 2a11:4::/32 prefixlen 32 - 128 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 192.0.2.11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_1, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.11 source-as as-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. +match from 192.0.2.11 source-as as-set AS_SET_WHITE_LIST_AS1_1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS1_1 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_1, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.11 prefix-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. +match from 192.0.2.11 prefix-set AS_SET_WHITE_LIST_AS1_1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS1_1 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_REGISTROBRDB community have the prefix validated by a NICBR Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_REGISTROBRDB set ext-community delete $INTCOMM_IRR_REJECT + +# route authorized by a client's white list? +match from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 192.0.2.11 set ext-community delete rt 65520:1 + + +# Remove internal communities before accepting the route +match from 192.0.2.11 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.11 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.11 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.11 community BLACKHOLE set community 65530:4 +match from 192.0.2.11 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.11 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.11 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.11 community BLACKHOLE +allow quick from 192.0.2.11 community 65534:0 +allow quick from 192.0.2.11 large-community 65534:0:0 + + +match from 192.0.2.11 set ext-community rt 65520:1 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.11 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 192.0.2.11 community 65534:0 set community BLACKHOLE +match to 192.0.2.11 large-community 65534:0:0 set community BLACKHOLE + +match to 192.0.2.11 community BLACKHOLE set community NO_EXPORT +match to 192.0.2.11 community BLACKHOLE set nexthop 192.0.2.66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.11 community 65507:999 set community NO_EXPORT +match to 192.0.2.11 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.11 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.11 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.11 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.11 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.11 community 65509:1 set community NO_EXPORT +match to 192.0.2.11 ext-community rt 65509:1 set community NO_EXPORT +match to 192.0.2.11 large-community 999:65509:1 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.11 community 65510:1 set community NO_ADVERTISE +match to 192.0.2.11 ext-community rt 65510:1 set community NO_ADVERTISE +match to 192.0.2.11 large-community 999:65510:1 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.11 + +# do_not_announce_to_any +deny to 192.0.2.11 community 0:999 +deny to 192.0.2.11 ext-community rt 0:999 +deny to 192.0.2.11 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.11 community 0:1 +deny quick to 192.0.2.11 ext-community rt 0:1 +deny quick to 192.0.2.11 large-community 999:0:1 + +# do_not_announce_to_peers_with_rtt_lower_than 5 ms +deny to 192.0.2.11 community 64530:5 +deny to 192.0.2.11 ext-community rt 64530:5 +deny to 192.0.2.11 large-community 999:64530:5 + + +# do_not_announce_to_peers_with_rtt_lower_than 10 ms +deny to 192.0.2.11 community 64530:10 +deny to 192.0.2.11 ext-community rt 64530:10 +deny to 192.0.2.11 large-community 999:64530:10 + + +# do_not_announce_to_peers_with_rtt_lower_than 15 ms +deny to 192.0.2.11 community 64530:15 +deny to 192.0.2.11 ext-community rt 64530:15 +deny to 192.0.2.11 large-community 999:64530:15 + + +# do_not_announce_to_peers_with_rtt_lower_than 20 ms +deny to 192.0.2.11 community 64530:20 +deny to 192.0.2.11 ext-community rt 64530:20 +deny to 192.0.2.11 large-community 999:64530:20 + + +# do_not_announce_to_peers_with_rtt_lower_than 30 ms +deny to 192.0.2.11 community 64530:30 +deny to 192.0.2.11 ext-community rt 64530:30 +deny to 192.0.2.11 large-community 999:64530:30 + + +# do_not_announce_to_peers_with_rtt_lower_than 50 ms +deny to 192.0.2.11 community 64530:50 +deny to 192.0.2.11 ext-community rt 64530:50 +deny to 192.0.2.11 large-community 999:64530:50 + + +# do_not_announce_to_peers_with_rtt_lower_than 100 ms +deny to 192.0.2.11 community 64530:100 +deny to 192.0.2.11 ext-community rt 64530:100 +deny to 192.0.2.11 large-community 999:64530:100 + + +# do_not_announce_to_peers_with_rtt_lower_than 200 ms +deny to 192.0.2.11 community 64530:200 +deny to 192.0.2.11 ext-community rt 64530:200 +deny to 192.0.2.11 large-community 999:64530:200 + + +# do_not_announce_to_peers_with_rtt_lower_than 500 ms +deny to 192.0.2.11 community 64530:500 +deny to 192.0.2.11 ext-community rt 64530:500 +deny to 192.0.2.11 large-community 999:64530:500 + + +# announce_to_peers_with_rtt_lower_than 5 ms +allow to 192.0.2.11 community 64532:5 +allow to 192.0.2.11 ext-community rt 64532:5 +allow to 192.0.2.11 large-community 999:64532:5 + + +# announce_to_peers_with_rtt_lower_than 10 ms +allow to 192.0.2.11 community 64532:10 +allow to 192.0.2.11 ext-community rt 64532:10 +allow to 192.0.2.11 large-community 999:64532:10 + + +# announce_to_peers_with_rtt_lower_than 15 ms +allow to 192.0.2.11 community 64532:15 +allow to 192.0.2.11 ext-community rt 64532:15 +allow to 192.0.2.11 large-community 999:64532:15 + + +# announce_to_peers_with_rtt_lower_than 20 ms +allow to 192.0.2.11 community 64532:20 +allow to 192.0.2.11 ext-community rt 64532:20 +allow to 192.0.2.11 large-community 999:64532:20 + + +# announce_to_peers_with_rtt_lower_than 30 ms +allow to 192.0.2.11 community 64532:30 +allow to 192.0.2.11 ext-community rt 64532:30 +allow to 192.0.2.11 large-community 999:64532:30 + + +# announce_to_peers_with_rtt_lower_than 50 ms +allow to 192.0.2.11 community 64532:50 +allow to 192.0.2.11 ext-community rt 64532:50 +allow to 192.0.2.11 large-community 999:64532:50 + + +# announce_to_peers_with_rtt_lower_than 100 ms +allow to 192.0.2.11 community 64532:100 +allow to 192.0.2.11 ext-community rt 64532:100 +allow to 192.0.2.11 large-community 999:64532:100 + + +# announce_to_peers_with_rtt_lower_than 200 ms +allow to 192.0.2.11 community 64532:200 +allow to 192.0.2.11 ext-community rt 64532:200 +allow to 192.0.2.11 large-community 999:64532:200 + + +# announce_to_peers_with_rtt_lower_than 500 ms +allow to 192.0.2.11 community 64532:500 +allow to 192.0.2.11 ext-community rt 64532:500 +allow to 192.0.2.11 large-community 999:64532:500 + + +# announce_to_peer +allow to 192.0.2.11 community 65501:1 +allow to 192.0.2.11 ext-community rt 65501:1 +allow to 192.0.2.11 large-community 999:65501:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS1_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS { 3, 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::11 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::11 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 2001:db8:1:1::11 prefix 11.3.0.0/16 source-as 1011 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::11 prefix 11.4.0.0/16 prefixlen 16 - 32 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::11 prefix 2a11:3::/32 source-as 1011 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::11 prefix 2a11:4::/32 prefixlen 32 - 128 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 2001:db8:1:1::11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_2, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::11 source-as as-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS1_AS_AS1_CUSTOMERS +match from 2001:db8:1:1::11 source-as as-set AS_SET_WHITE_LIST_AS1_2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS1_2 +# AS-SET AS1 referenced but empty. + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_2, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::11 prefix-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS1_AS_AS1_CUSTOMERS +match from 2001:db8:1:1::11 prefix-set AS_SET_WHITE_LIST_AS1_2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS1_2 +# AS-SET AS1 referenced but empty. + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_REGISTROBRDB community have the prefix validated by a NICBR Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_REGISTROBRDB set ext-community delete $INTCOMM_IRR_REJECT + +# route authorized by a client's white list? +match from 2001:db8:1:1::11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::11 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::11 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::11 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::11 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::11 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::11 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::11 community BLACKHOLE +allow quick from 2001:db8:1:1::11 community 65534:0 +allow quick from 2001:db8:1:1::11 large-community 65534:0:0 + + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::11 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::11 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::11 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + +deny quick to 2001:db8:1:1::11 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 2001:db8:1:1::11 community 65534:0 set community BLACKHOLE +match to 2001:db8:1:1::11 large-community 65534:0:0 set community BLACKHOLE + +match to 2001:db8:1:1::11 community BLACKHOLE set community NO_EXPORT +match to 2001:db8:1:1::11 community BLACKHOLE set nexthop 2001:db8:1:1::66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::11 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::11 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::11 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::11 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::11 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::11 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::11 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::11 community 65509:1 set community NO_EXPORT +match to 2001:db8:1:1::11 ext-community rt 65509:1 set community NO_EXPORT +match to 2001:db8:1:1::11 large-community 999:65509:1 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::11 community 65510:1 set community NO_ADVERTISE +match to 2001:db8:1:1::11 ext-community rt 65510:1 set community NO_ADVERTISE +match to 2001:db8:1:1::11 large-community 999:65510:1 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::11 + +# do_not_announce_to_any +deny to 2001:db8:1:1::11 community 0:999 +deny to 2001:db8:1:1::11 ext-community rt 0:999 +deny to 2001:db8:1:1::11 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::11 community 0:1 +deny quick to 2001:db8:1:1::11 ext-community rt 0:1 +deny quick to 2001:db8:1:1::11 large-community 999:0:1 + +# announce_to_peer +allow to 2001:db8:1:1::11 community 65501:1 +allow to 2001:db8:1:1::11 ext-community rt 65501:1 +allow to 2001:db8:1:1::11 large-community 999:65501:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS1_3, inbound + + + +# NEXT_HOP +match from 192.0.2.12 set community NO_ADVERTISE +match from 192.0.2.12 nexthop 192.0.2.11 set community delete NO_ADVERTISE +match from 192.0.2.12 nexthop 192.0.2.12 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.12 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.12 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.12 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.12 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.12 AS 23456' - reject code: 7 +allow quick from 192.0.2.12 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.12 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.12 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.12 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.12 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.12 AS { 3, 174 }' - reject code: 8 +allow quick from 192.0.2.12 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.12 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.12 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +match from 192.0.2.12 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_3, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.12 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.12 source-as as-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_3, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.12 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.12 prefix-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.12 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.12 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_REGISTROBRDB community have the prefix validated by a NICBR Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.12 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_REGISTROBRDB set ext-community delete $INTCOMM_IRR_REJECT + + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 192.0.2.12 set ext-community delete rt 65520:1 + + +# Remove internal communities before accepting the route +match from 192.0.2.12 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.12 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.12 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.12 community BLACKHOLE set community 65530:4 +match from 192.0.2.12 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.12 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.12 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.12 community BLACKHOLE +allow quick from 192.0.2.12 community 65534:0 +allow quick from 192.0.2.12 large-community 65534:0:0 + + +match from 192.0.2.12 set ext-community rt 65520:1 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.12 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.12 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.12 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.12 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.12 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 192.0.2.12 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.12 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.12 + + + +# --------------------------------------------- +# client AS1_3, outbound + +deny quick to 192.0.2.12 community 65520:0 + + + +# Blackhole request? +# Client not enabled to receive blackhole routes +deny quick to 192.0.2.12 community BLACKHOLE +deny quick to 192.0.2.12 community 65534:0 +deny quick to 192.0.2.12 large-community 65534:0:0 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.12 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.12 community 65507:999 set community NO_EXPORT +match to 192.0.2.12 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.12 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.12 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.12 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.12 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.12 community 65509:1 set community NO_EXPORT +match to 192.0.2.12 ext-community rt 65509:1 set community NO_EXPORT +match to 192.0.2.12 large-community 999:65509:1 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.12 community 65510:1 set community NO_ADVERTISE +match to 192.0.2.12 ext-community rt 65510:1 set community NO_ADVERTISE +match to 192.0.2.12 large-community 999:65510:1 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.12 + +# do_not_announce_to_any +deny to 192.0.2.12 community 0:999 +deny to 192.0.2.12 ext-community rt 0:999 +deny to 192.0.2.12 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.12 community 0:1 +deny quick to 192.0.2.12 ext-community rt 0:1 +deny quick to 192.0.2.12 large-community 999:0:1 + +# do_not_announce_to_peers_with_rtt_lower_than 5 ms +deny to 192.0.2.12 community 64530:5 +deny to 192.0.2.12 ext-community rt 64530:5 +deny to 192.0.2.12 large-community 999:64530:5 + + +# do_not_announce_to_peers_with_rtt_lower_than 10 ms +deny to 192.0.2.12 community 64530:10 +deny to 192.0.2.12 ext-community rt 64530:10 +deny to 192.0.2.12 large-community 999:64530:10 + + +# do_not_announce_to_peers_with_rtt_lower_than 15 ms +deny to 192.0.2.12 community 64530:15 +deny to 192.0.2.12 ext-community rt 64530:15 +deny to 192.0.2.12 large-community 999:64530:15 + + +# do_not_announce_to_peers_with_rtt_lower_than 20 ms +deny to 192.0.2.12 community 64530:20 +deny to 192.0.2.12 ext-community rt 64530:20 +deny to 192.0.2.12 large-community 999:64530:20 + + +# do_not_announce_to_peers_with_rtt_lower_than 30 ms +deny to 192.0.2.12 community 64530:30 +deny to 192.0.2.12 ext-community rt 64530:30 +deny to 192.0.2.12 large-community 999:64530:30 + + +# do_not_announce_to_peers_with_rtt_lower_than 50 ms +deny to 192.0.2.12 community 64530:50 +deny to 192.0.2.12 ext-community rt 64530:50 +deny to 192.0.2.12 large-community 999:64530:50 + + +# do_not_announce_to_peers_with_rtt_lower_than 100 ms +deny to 192.0.2.12 community 64530:100 +deny to 192.0.2.12 ext-community rt 64530:100 +deny to 192.0.2.12 large-community 999:64530:100 + + +# do_not_announce_to_peers_with_rtt_lower_than 200 ms +deny to 192.0.2.12 community 64530:200 +deny to 192.0.2.12 ext-community rt 64530:200 +deny to 192.0.2.12 large-community 999:64530:200 + + +# do_not_announce_to_peers_with_rtt_lower_than 500 ms +deny to 192.0.2.12 community 64530:500 +deny to 192.0.2.12 ext-community rt 64530:500 +deny to 192.0.2.12 large-community 999:64530:500 + + +# announce_to_peers_with_rtt_lower_than 5 ms +allow to 192.0.2.12 community 64532:5 +allow to 192.0.2.12 ext-community rt 64532:5 +allow to 192.0.2.12 large-community 999:64532:5 + + +# announce_to_peers_with_rtt_lower_than 10 ms +allow to 192.0.2.12 community 64532:10 +allow to 192.0.2.12 ext-community rt 64532:10 +allow to 192.0.2.12 large-community 999:64532:10 + + +# announce_to_peers_with_rtt_lower_than 15 ms +allow to 192.0.2.12 community 64532:15 +allow to 192.0.2.12 ext-community rt 64532:15 +allow to 192.0.2.12 large-community 999:64532:15 + + +# announce_to_peers_with_rtt_lower_than 20 ms +allow to 192.0.2.12 community 64532:20 +allow to 192.0.2.12 ext-community rt 64532:20 +allow to 192.0.2.12 large-community 999:64532:20 + + +# announce_to_peers_with_rtt_lower_than 30 ms +allow to 192.0.2.12 community 64532:30 +allow to 192.0.2.12 ext-community rt 64532:30 +allow to 192.0.2.12 large-community 999:64532:30 + + +# announce_to_peers_with_rtt_lower_than 50 ms +allow to 192.0.2.12 community 64532:50 +allow to 192.0.2.12 ext-community rt 64532:50 +allow to 192.0.2.12 large-community 999:64532:50 + + +# announce_to_peers_with_rtt_lower_than 100 ms +allow to 192.0.2.12 community 64532:100 +allow to 192.0.2.12 ext-community rt 64532:100 +allow to 192.0.2.12 large-community 999:64532:100 + + +# announce_to_peers_with_rtt_lower_than 200 ms +allow to 192.0.2.12 community 64532:200 +allow to 192.0.2.12 ext-community rt 64532:200 +allow to 192.0.2.12 large-community 999:64532:200 + + +# announce_to_peers_with_rtt_lower_than 500 ms +allow to 192.0.2.12 community 64532:500 +allow to 192.0.2.12 ext-community rt 64532:500 +allow to 192.0.2.12 large-community 999:64532:500 + + +# announce_to_peer +allow to 192.0.2.12 community 65501:1 +allow to 192.0.2.12 ext-community rt 65501:1 +allow to 192.0.2.12 large-community 999:65501:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.12 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS1_4, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::12 set community NO_ADVERTISE +match from 2001:db8:1:1::12 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +match from 2001:db8:1:1::12 nexthop 2001:db8:1:1::12 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::12 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::12 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::12 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::12 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::12 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::12 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::12 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::12 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::12 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::12 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::12 AS { 3, 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::12 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::12 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::12 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +match from 2001:db8:1:1::12 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_4, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::12 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::12 source-as as-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_4, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::12 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::12 prefix-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::12 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::12 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_REGISTROBRDB community have the prefix validated by a NICBR Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::12 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_REGISTROBRDB set ext-community delete $INTCOMM_IRR_REJECT + + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 2001:db8:1:1::12 set ext-community delete rt 65520:1 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::12 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::12 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::12 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::12 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::12 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::12 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::12 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::12 community BLACKHOLE +allow quick from 2001:db8:1:1::12 community 65534:0 +allow quick from 2001:db8:1:1::12 large-community 65534:0:0 + + +match from 2001:db8:1:1::12 set ext-community rt 65520:1 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::12 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::12 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::12 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::12 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::12 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::12 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::12 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::12 + + + +# --------------------------------------------- +# client AS1_4, outbound + +deny quick to 2001:db8:1:1::12 community 65520:0 + + + +# Blackhole request? +# Client not enabled to receive blackhole routes +deny quick to 2001:db8:1:1::12 community BLACKHOLE +deny quick to 2001:db8:1:1::12 community 65534:0 +deny quick to 2001:db8:1:1::12 large-community 65534:0:0 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::12 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::12 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::12 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::12 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::12 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::12 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::12 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::12 community 65509:1 set community NO_EXPORT +match to 2001:db8:1:1::12 ext-community rt 65509:1 set community NO_EXPORT +match to 2001:db8:1:1::12 large-community 999:65509:1 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::12 community 65510:1 set community NO_ADVERTISE +match to 2001:db8:1:1::12 ext-community rt 65510:1 set community NO_ADVERTISE +match to 2001:db8:1:1::12 large-community 999:65510:1 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::12 + +# do_not_announce_to_any +deny to 2001:db8:1:1::12 community 0:999 +deny to 2001:db8:1:1::12 ext-community rt 0:999 +deny to 2001:db8:1:1::12 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::12 community 0:1 +deny quick to 2001:db8:1:1::12 ext-community rt 0:1 +deny quick to 2001:db8:1:1::12 large-community 999:0:1 + +# announce_to_peer +allow to 2001:db8:1:1::12 community 65501:1 +allow to 2001:db8:1:1::12 ext-community rt 65501:1 +allow to 2001:db8:1:1::12 large-community 999:65501:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::12 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS222_1, inbound + + + +# NEXT_HOP +match from 192.0.2.222 set community NO_ADVERTISE +match from 192.0.2.222 nexthop 192.0.2.222 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.222 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.222 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.222 peer-as != 222' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.222 peer-as != 222 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.222 AS 23456' - reject code: 7 +allow quick from 192.0.2.222 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.222 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.222 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.222 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.222 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.222 AS { 3, 174 }' - reject code: 8 +allow quick from 192.0.2.222 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.222 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.222 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 192.0.2.222 prefix 222.1.1.0/24 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.222 prefix 3222:0:1::/48 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 192.0.2.222 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS222_1, AS222: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.222 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS222 referenced but empty. +match from 192.0.2.222 source-as as-set AS_SET_AS_AS222_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS222 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS222_1, AS222: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.222 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS222 referenced but empty. +match from 192.0.2.222 prefix-set AS_SET_AS_AS222_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS222 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.222 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.222 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_REGISTROBRDB community have the prefix validated by a NICBR Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.222 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_REGISTROBRDB set ext-community delete $INTCOMM_IRR_REJECT + +# route authorized by a client's white list? +match from 192.0.2.222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 192.0.2.222 set ext-community delete rt 65520:222 + + +# Remove internal communities before accepting the route +match from 192.0.2.222 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.222 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.222 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.222 community BLACKHOLE set community 65530:4 +match from 192.0.2.222 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.222 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.222 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.222 community BLACKHOLE +allow quick from 192.0.2.222 community 65534:0 +allow quick from 192.0.2.222 large-community 65534:0:0 + + +match from 192.0.2.222 set ext-community rt 65520:222 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.222 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.222 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.222 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.222 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.222 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 192.0.2.222 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.222 set ext-community delete rt 65520:222 + + + +allow quick from 192.0.2.222 + + + +# --------------------------------------------- +# client AS222_1, outbound + +deny quick to 192.0.2.222 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 192.0.2.222 community 65534:0 set community BLACKHOLE +match to 192.0.2.222 large-community 65534:0:0 set community BLACKHOLE + +match to 192.0.2.222 community BLACKHOLE set community NO_EXPORT +match to 192.0.2.222 community BLACKHOLE set nexthop 192.0.2.66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.222 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.222 community 65507:999 set community NO_EXPORT +match to 192.0.2.222 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.222 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.222 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.222 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.222 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.222 community 65509:222 set community NO_EXPORT +match to 192.0.2.222 ext-community rt 65509:222 set community NO_EXPORT +match to 192.0.2.222 large-community 999:65509:222 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.222 community 65510:222 set community NO_ADVERTISE +match to 192.0.2.222 ext-community rt 65510:222 set community NO_ADVERTISE +match to 192.0.2.222 large-community 999:65510:222 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.222 + +# do_not_announce_to_any +deny to 192.0.2.222 community 0:999 +deny to 192.0.2.222 ext-community rt 0:999 +deny to 192.0.2.222 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.222 community 0:222 +deny quick to 192.0.2.222 ext-community rt 0:222 +deny quick to 192.0.2.222 large-community 999:0:222 + +# announce_to_peer +allow to 192.0.2.222 community 65501:222 +allow to 192.0.2.222 ext-community rt 65501:222 +allow to 192.0.2.222 large-community 999:65501:222 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.222 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS222_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::222 set community NO_ADVERTISE +match from 2001:db8:1:1::222 nexthop 2001:db8:1:1::222 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::222 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::222 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::222 peer-as != 222' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::222 peer-as != 222 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::222 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::222 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::222 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::222 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::222 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::222 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::222 AS { 3, 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::222 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::222 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::222 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 2001:db8:1:1::222 prefix 222.1.1.0/24 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::222 prefix 3222:0:1::/48 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 2001:db8:1:1::222 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS222_2, AS222: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::222 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS222 referenced but empty. +match from 2001:db8:1:1::222 source-as as-set AS_SET_AS_AS222_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS222 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS222_2, AS222: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::222 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS222 referenced but empty. +match from 2001:db8:1:1::222 prefix-set AS_SET_AS_AS222_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS222 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::222 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::222 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_REGISTROBRDB community have the prefix validated by a NICBR Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::222 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_REGISTROBRDB set ext-community delete $INTCOMM_IRR_REJECT + +# route authorized by a client's white list? +match from 2001:db8:1:1::222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 2001:db8:1:1::222 set ext-community delete rt 65520:222 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::222 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::222 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::222 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::222 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::222 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::222 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::222 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::222 community BLACKHOLE +allow quick from 2001:db8:1:1::222 community 65534:0 +allow quick from 2001:db8:1:1::222 large-community 65534:0:0 + + +match from 2001:db8:1:1::222 set ext-community rt 65520:222 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::222 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::222 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::222 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::222 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::222 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::222 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::222 set ext-community delete rt 65520:222 + + + +allow quick from 2001:db8:1:1::222 + + + +# --------------------------------------------- +# client AS222_2, outbound + +deny quick to 2001:db8:1:1::222 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 2001:db8:1:1::222 community 65534:0 set community BLACKHOLE +match to 2001:db8:1:1::222 large-community 65534:0:0 set community BLACKHOLE + +match to 2001:db8:1:1::222 community BLACKHOLE set community NO_EXPORT +match to 2001:db8:1:1::222 community BLACKHOLE set nexthop 2001:db8:1:1::66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::222 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::222 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::222 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::222 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::222 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::222 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::222 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::222 community 65509:222 set community NO_EXPORT +match to 2001:db8:1:1::222 ext-community rt 65509:222 set community NO_EXPORT +match to 2001:db8:1:1::222 large-community 999:65509:222 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::222 community 65510:222 set community NO_ADVERTISE +match to 2001:db8:1:1::222 ext-community rt 65510:222 set community NO_ADVERTISE +match to 2001:db8:1:1::222 large-community 999:65510:222 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::222 + +# do_not_announce_to_any +deny to 2001:db8:1:1::222 community 0:999 +deny to 2001:db8:1:1::222 ext-community rt 0:999 +deny to 2001:db8:1:1::222 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::222 community 0:222 +deny quick to 2001:db8:1:1::222 ext-community rt 0:222 +deny quick to 2001:db8:1:1::222 large-community 999:0:222 + +# announce_to_peer +allow to 2001:db8:1:1::222 community 65501:222 +allow to 2001:db8:1:1::222 ext-community rt 65501:222 +allow to 2001:db8:1:1::222 large-community 999:65501:222 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::222 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.21 set community NO_ADVERTISE +match from 192.0.2.21 nexthop 192.0.2.21 set community delete NO_ADVERTISE +match from 192.0.2.21 nexthop 192.0.2.22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.21 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.21 AS 23456' - reject code: 7 +allow quick from 192.0.2.21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.21 AS { 3, 174 }' - reject code: 8 +allow quick from 192.0.2.21 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.21 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.21 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +match from 192.0.2.21 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS2_1, AS2: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.21 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 192.0.2.21 source-as as-set AS_SET_AS_AS2_AS_AS2_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS2_AS_AS2_CUSTOMERS + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS2_1, AS2: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.21 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 192.0.2.21 prefix-set AS_SET_AS_AS2_AS_AS2_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS2_AS_AS2_CUSTOMERS + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_REGISTROBRDB community have the prefix validated by a NICBR Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_REGISTROBRDB set ext-community delete $INTCOMM_IRR_REJECT + + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 192.0.2.21 set ext-community delete rt 65520:2 + + +# Remove internal communities before accepting the route +match from 192.0.2.21 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.21 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.21 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.21 community BLACKHOLE set community 65530:4 +match from 192.0.2.21 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.21 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.21 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.21 community BLACKHOLE +allow quick from 192.0.2.21 community 65534:0 +allow quick from 192.0.2.21 large-community 65534:0:0 + + +match from 192.0.2.21 set ext-community rt 65520:2 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.21 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.21 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.21 community GRACEFUL_SHUTDOWN set community delete GRACEFUL_SHUTDOWN + +# Remove internal communities before accepting the route +match from 192.0.2.21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.21 set ext-community delete rt 65520:2 + + + +allow quick from 192.0.2.21 + + + +# --------------------------------------------- +# client AS2_1, outbound + +deny quick to 192.0.2.21 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 192.0.2.21 community 65534:0 set community BLACKHOLE +match to 192.0.2.21 large-community 65534:0:0 set community BLACKHOLE + +match to 192.0.2.21 community BLACKHOLE set community NO_EXPORT +match to 192.0.2.21 community BLACKHOLE set nexthop 192.0.2.66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.21 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.21 community 65507:999 set community NO_EXPORT +match to 192.0.2.21 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.21 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.21 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.21 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.21 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.21 community 65509:2 set community NO_EXPORT +match to 192.0.2.21 ext-community rt 65509:2 set community NO_EXPORT +match to 192.0.2.21 large-community 999:65509:2 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.21 community 65510:2 set community NO_ADVERTISE +match to 192.0.2.21 ext-community rt 65510:2 set community NO_ADVERTISE +match to 192.0.2.21 large-community 999:65510:2 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.21 + +# do_not_announce_to_any +deny to 192.0.2.21 community 0:999 +deny to 192.0.2.21 ext-community rt 0:999 +deny to 192.0.2.21 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.21 community 0:2 +deny quick to 192.0.2.21 ext-community rt 0:2 +deny quick to 192.0.2.21 large-community 999:0:2 + +# do_not_announce_to_peers_with_rtt_lower_than 20 ms +deny to 192.0.2.21 community 64530:20 +deny to 192.0.2.21 ext-community rt 64530:20 +deny to 192.0.2.21 large-community 999:64530:20 + + +# do_not_announce_to_peers_with_rtt_lower_than 30 ms +deny to 192.0.2.21 community 64530:30 +deny to 192.0.2.21 ext-community rt 64530:30 +deny to 192.0.2.21 large-community 999:64530:30 + + +# do_not_announce_to_peers_with_rtt_lower_than 50 ms +deny to 192.0.2.21 community 64530:50 +deny to 192.0.2.21 ext-community rt 64530:50 +deny to 192.0.2.21 large-community 999:64530:50 + + +# do_not_announce_to_peers_with_rtt_lower_than 100 ms +deny to 192.0.2.21 community 64530:100 +deny to 192.0.2.21 ext-community rt 64530:100 +deny to 192.0.2.21 large-community 999:64530:100 + + +# do_not_announce_to_peers_with_rtt_lower_than 200 ms +deny to 192.0.2.21 community 64530:200 +deny to 192.0.2.21 ext-community rt 64530:200 +deny to 192.0.2.21 large-community 999:64530:200 + + +# do_not_announce_to_peers_with_rtt_lower_than 500 ms +deny to 192.0.2.21 community 64530:500 +deny to 192.0.2.21 ext-community rt 64530:500 +deny to 192.0.2.21 large-community 999:64530:500 + + +# announce_to_peers_with_rtt_lower_than 20 ms +allow to 192.0.2.21 community 64532:20 +allow to 192.0.2.21 ext-community rt 64532:20 +allow to 192.0.2.21 large-community 999:64532:20 + + +# announce_to_peers_with_rtt_lower_than 30 ms +allow to 192.0.2.21 community 64532:30 +allow to 192.0.2.21 ext-community rt 64532:30 +allow to 192.0.2.21 large-community 999:64532:30 + + +# announce_to_peers_with_rtt_lower_than 50 ms +allow to 192.0.2.21 community 64532:50 +allow to 192.0.2.21 ext-community rt 64532:50 +allow to 192.0.2.21 large-community 999:64532:50 + + +# announce_to_peers_with_rtt_lower_than 100 ms +allow to 192.0.2.21 community 64532:100 +allow to 192.0.2.21 ext-community rt 64532:100 +allow to 192.0.2.21 large-community 999:64532:100 + + +# announce_to_peers_with_rtt_lower_than 200 ms +allow to 192.0.2.21 community 64532:200 +allow to 192.0.2.21 ext-community rt 64532:200 +allow to 192.0.2.21 large-community 999:64532:200 + + +# announce_to_peers_with_rtt_lower_than 500 ms +allow to 192.0.2.21 community 64532:500 +allow to 192.0.2.21 ext-community rt 64532:500 +allow to 192.0.2.21 large-community 999:64532:500 + + +# do_not_announce_to_peers_with_rtt_higher_than 5 ms +deny to 192.0.2.21 community 64531:5 +deny to 192.0.2.21 ext-community rt 64531:5 +deny to 192.0.2.21 large-community 999:64531:5 + + +# do_not_announce_to_peers_with_rtt_higher_than 10 ms +deny to 192.0.2.21 community 64531:10 +deny to 192.0.2.21 ext-community rt 64531:10 +deny to 192.0.2.21 large-community 999:64531:10 + + +# do_not_announce_to_peers_with_rtt_higher_than 15 ms +deny to 192.0.2.21 community 64531:15 +deny to 192.0.2.21 ext-community rt 64531:15 +deny to 192.0.2.21 large-community 999:64531:15 + + +# announce_to_peers_with_rtt_higher_than 5 ms +allow to 192.0.2.21 community 64533:5 +allow to 192.0.2.21 ext-community rt 64533:5 +allow to 192.0.2.21 large-community 999:64533:5 + + +# announce_to_peers_with_rtt_higher_than 10 ms +allow to 192.0.2.21 community 64533:10 +allow to 192.0.2.21 ext-community rt 64533:10 +allow to 192.0.2.21 large-community 999:64533:10 + + +# announce_to_peers_with_rtt_higher_than 15 ms +allow to 192.0.2.21 community 64533:15 +allow to 192.0.2.21 ext-community rt 64533:15 +allow to 192.0.2.21 large-community 999:64533:15 + + +# announce_to_peer +allow to 192.0.2.21 community 65501:2 +allow to 192.0.2.21 ext-community rt 65501:2 +allow to 192.0.2.21 large-community 999:65501:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::21 set community NO_ADVERTISE +match from 2001:db8:1:1::21 nexthop 2001:db8:1:1::21 set community delete NO_ADVERTISE +match from 2001:db8:1:1::21 nexthop 2001:db8:1:1::22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::21 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS { 3, 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::21 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::21 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +match from 2001:db8:1:1::21 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS2_2, AS2: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::21 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 2001:db8:1:1::21 source-as as-set AS_SET_AS_AS2_AS_AS2_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS2_AS_AS2_CUSTOMERS + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS2_2, AS2: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::21 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 2001:db8:1:1::21 prefix-set AS_SET_AS_AS2_AS_AS2_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS2_AS_AS2_CUSTOMERS + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_REGISTROBRDB community have the prefix validated by a NICBR Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_REGISTROBRDB set ext-community delete $INTCOMM_IRR_REJECT + + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 2001:db8:1:1::21 set ext-community delete rt 65520:2 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::21 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::21 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::21 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::21 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::21 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::21 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::21 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::21 community BLACKHOLE +allow quick from 2001:db8:1:1::21 community 65534:0 +allow quick from 2001:db8:1:1::21 large-community 65534:0:0 + + +match from 2001:db8:1:1::21 set ext-community rt 65520:2 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::21 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::21 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::21 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::21 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::21 community GRACEFUL_SHUTDOWN set community delete GRACEFUL_SHUTDOWN + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::21 set ext-community delete rt 65520:2 + + + +allow quick from 2001:db8:1:1::21 + + + +# --------------------------------------------- +# client AS2_2, outbound + +deny quick to 2001:db8:1:1::21 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 2001:db8:1:1::21 community 65534:0 set community BLACKHOLE +match to 2001:db8:1:1::21 large-community 65534:0:0 set community BLACKHOLE + +match to 2001:db8:1:1::21 community BLACKHOLE set community NO_EXPORT +match to 2001:db8:1:1::21 community BLACKHOLE set nexthop 2001:db8:1:1::66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::21 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::21 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::21 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::21 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::21 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::21 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::21 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::21 community 65509:2 set community NO_EXPORT +match to 2001:db8:1:1::21 ext-community rt 65509:2 set community NO_EXPORT +match to 2001:db8:1:1::21 large-community 999:65509:2 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::21 community 65510:2 set community NO_ADVERTISE +match to 2001:db8:1:1::21 ext-community rt 65510:2 set community NO_ADVERTISE +match to 2001:db8:1:1::21 large-community 999:65510:2 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::21 + +# do_not_announce_to_any +deny to 2001:db8:1:1::21 community 0:999 +deny to 2001:db8:1:1::21 ext-community rt 0:999 +deny to 2001:db8:1:1::21 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::21 community 0:2 +deny quick to 2001:db8:1:1::21 ext-community rt 0:2 +deny quick to 2001:db8:1:1::21 large-community 999:0:2 + +# announce_to_peer +allow to 2001:db8:1:1::21 community 65501:2 +allow to 2001:db8:1:1::21 ext-community rt 65501:2 +allow to 2001:db8:1:1::21 large-community 999:65501:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS3_1, inbound + + + +# NEXT_HOP +match from 192.0.2.31 set community NO_ADVERTISE +match from 192.0.2.31 nexthop 192.0.2.31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.31 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.31 AS 23456' - reject code: 7 +allow quick from 192.0.2.31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.31 AS { 174 }' - reject code: 8 +allow quick from 192.0.2.31 AS { 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.31 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.31 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +# Prefix: client's blacklist +prefix-set "client_AS3_1_black_list_pref_ipv4" { + 3.0.1.0/24 prefixlen 24 - 32 + +} +# Reject inbound routes when 'from 192.0.2.31 prefix-set client_AS3_1_black_list_pref_ipv4' - reject code: 11 +allow quick from 192.0.2.31 prefix-set client_AS3_1_black_list_pref_ipv4 set { + localpref 1 + community 65520:0 + community 65520:11 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Blackhole request? +match from 192.0.2.31 set ext-community delete rt 65520:3 + + +# Remove internal communities before accepting the route +match from 192.0.2.31 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.31 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.31 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.31 community BLACKHOLE set community 65530:4 +match from 192.0.2.31 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.31 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.31 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.31 community BLACKHOLE +allow quick from 192.0.2.31 community 65534:0 +allow quick from 192.0.2.31 large-community 65534:0:0 + + +match from 192.0.2.31 set ext-community rt 65520:3 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.31 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.31 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.31 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 192.0.2.31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.31 set ext-community delete rt 65520:3 + + + +allow quick from 192.0.2.31 + + + +# --------------------------------------------- +# client AS3_1, outbound + +deny quick to 192.0.2.31 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 192.0.2.31 community 65534:0 set community BLACKHOLE +match to 192.0.2.31 large-community 65534:0:0 set community BLACKHOLE + +match to 192.0.2.31 community BLACKHOLE set community NO_EXPORT +match to 192.0.2.31 community BLACKHOLE set nexthop 192.0.2.66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.31 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.31 community 65507:999 set community NO_EXPORT +match to 192.0.2.31 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.31 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.31 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.31 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.31 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.31 community 65509:3 set community NO_EXPORT +match to 192.0.2.31 ext-community rt 65509:3 set community NO_EXPORT +match to 192.0.2.31 large-community 999:65509:3 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.31 community 65510:3 set community NO_ADVERTISE +match to 192.0.2.31 ext-community rt 65510:3 set community NO_ADVERTISE +match to 192.0.2.31 large-community 999:65510:3 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.31 + +# do_not_announce_to_any +deny to 192.0.2.31 community 0:999 +deny to 192.0.2.31 ext-community rt 0:999 +deny to 192.0.2.31 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.31 community 0:3 +deny quick to 192.0.2.31 ext-community rt 0:3 +deny quick to 192.0.2.31 large-community 999:0:3 + +# do_not_announce_to_peers_with_rtt_lower_than 200 ms +deny to 192.0.2.31 community 64530:200 +deny to 192.0.2.31 ext-community rt 64530:200 +deny to 192.0.2.31 large-community 999:64530:200 + + +# do_not_announce_to_peers_with_rtt_lower_than 500 ms +deny to 192.0.2.31 community 64530:500 +deny to 192.0.2.31 ext-community rt 64530:500 +deny to 192.0.2.31 large-community 999:64530:500 + + +# announce_to_peers_with_rtt_lower_than 200 ms +allow to 192.0.2.31 community 64532:200 +allow to 192.0.2.31 ext-community rt 64532:200 +allow to 192.0.2.31 large-community 999:64532:200 + + +# announce_to_peers_with_rtt_lower_than 500 ms +allow to 192.0.2.31 community 64532:500 +allow to 192.0.2.31 ext-community rt 64532:500 +allow to 192.0.2.31 large-community 999:64532:500 + + +# do_not_announce_to_peers_with_rtt_higher_than 5 ms +deny to 192.0.2.31 community 64531:5 +deny to 192.0.2.31 ext-community rt 64531:5 +deny to 192.0.2.31 large-community 999:64531:5 + + +# do_not_announce_to_peers_with_rtt_higher_than 10 ms +deny to 192.0.2.31 community 64531:10 +deny to 192.0.2.31 ext-community rt 64531:10 +deny to 192.0.2.31 large-community 999:64531:10 + + +# do_not_announce_to_peers_with_rtt_higher_than 15 ms +deny to 192.0.2.31 community 64531:15 +deny to 192.0.2.31 ext-community rt 64531:15 +deny to 192.0.2.31 large-community 999:64531:15 + + +# do_not_announce_to_peers_with_rtt_higher_than 20 ms +deny to 192.0.2.31 community 64531:20 +deny to 192.0.2.31 ext-community rt 64531:20 +deny to 192.0.2.31 large-community 999:64531:20 + + +# do_not_announce_to_peers_with_rtt_higher_than 30 ms +deny to 192.0.2.31 community 64531:30 +deny to 192.0.2.31 ext-community rt 64531:30 +deny to 192.0.2.31 large-community 999:64531:30 + + +# do_not_announce_to_peers_with_rtt_higher_than 50 ms +deny to 192.0.2.31 community 64531:50 +deny to 192.0.2.31 ext-community rt 64531:50 +deny to 192.0.2.31 large-community 999:64531:50 + + +# do_not_announce_to_peers_with_rtt_higher_than 100 ms +deny to 192.0.2.31 community 64531:100 +deny to 192.0.2.31 ext-community rt 64531:100 +deny to 192.0.2.31 large-community 999:64531:100 + + +# announce_to_peers_with_rtt_higher_than 5 ms +allow to 192.0.2.31 community 64533:5 +allow to 192.0.2.31 ext-community rt 64533:5 +allow to 192.0.2.31 large-community 999:64533:5 + + +# announce_to_peers_with_rtt_higher_than 10 ms +allow to 192.0.2.31 community 64533:10 +allow to 192.0.2.31 ext-community rt 64533:10 +allow to 192.0.2.31 large-community 999:64533:10 + + +# announce_to_peers_with_rtt_higher_than 15 ms +allow to 192.0.2.31 community 64533:15 +allow to 192.0.2.31 ext-community rt 64533:15 +allow to 192.0.2.31 large-community 999:64533:15 + + +# announce_to_peers_with_rtt_higher_than 20 ms +allow to 192.0.2.31 community 64533:20 +allow to 192.0.2.31 ext-community rt 64533:20 +allow to 192.0.2.31 large-community 999:64533:20 + + +# announce_to_peers_with_rtt_higher_than 30 ms +allow to 192.0.2.31 community 64533:30 +allow to 192.0.2.31 ext-community rt 64533:30 +allow to 192.0.2.31 large-community 999:64533:30 + + +# announce_to_peers_with_rtt_higher_than 50 ms +allow to 192.0.2.31 community 64533:50 +allow to 192.0.2.31 ext-community rt 64533:50 +allow to 192.0.2.31 large-community 999:64533:50 + + +# announce_to_peers_with_rtt_higher_than 100 ms +allow to 192.0.2.31 community 64533:100 +allow to 192.0.2.31 ext-community rt 64533:100 +allow to 192.0.2.31 large-community 999:64533:100 + + +# announce_to_peer +allow to 192.0.2.31 community 65501:3 +allow to 192.0.2.31 ext-community rt 65501:3 +allow to 192.0.2.31 large-community 999:65501:3 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS3_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::31 set community NO_ADVERTISE +match from 2001:db8:1:1::31 nexthop 2001:db8:1:1::31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::31 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::31 AS { 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::31 AS { 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::31 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::31 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +# Prefix: client's blacklist +prefix-set "client_AS3_2_black_list_pref_ipv6" { + 2a03:0:1::/48 prefixlen 48 - 128 + +} +# Reject inbound routes when 'from 2001:db8:1:1::31 prefix-set client_AS3_2_black_list_pref_ipv6' - reject code: 11 +allow quick from 2001:db8:1:1::31 prefix-set client_AS3_2_black_list_pref_ipv6 set { + localpref 1 + community 65520:0 + community 65520:11 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Blackhole request? +match from 2001:db8:1:1::31 set ext-community delete rt 65520:3 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::31 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::31 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::31 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::31 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::31 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::31 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::31 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::31 community BLACKHOLE +allow quick from 2001:db8:1:1::31 community 65534:0 +allow quick from 2001:db8:1:1::31 large-community 65534:0:0 + + +match from 2001:db8:1:1::31 set ext-community rt 65520:3 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::31 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::31 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::31 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::31 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::31 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::31 set ext-community delete rt 65520:3 + + + +allow quick from 2001:db8:1:1::31 + + + +# --------------------------------------------- +# client AS3_2, outbound + +deny quick to 2001:db8:1:1::31 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 2001:db8:1:1::31 community 65534:0 set community BLACKHOLE +match to 2001:db8:1:1::31 large-community 65534:0:0 set community BLACKHOLE + +match to 2001:db8:1:1::31 community BLACKHOLE set community NO_EXPORT +match to 2001:db8:1:1::31 community BLACKHOLE set nexthop 2001:db8:1:1::66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::31 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::31 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::31 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::31 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::31 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::31 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::31 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::31 community 65509:3 set community NO_EXPORT +match to 2001:db8:1:1::31 ext-community rt 65509:3 set community NO_EXPORT +match to 2001:db8:1:1::31 large-community 999:65509:3 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::31 community 65510:3 set community NO_ADVERTISE +match to 2001:db8:1:1::31 ext-community rt 65510:3 set community NO_ADVERTISE +match to 2001:db8:1:1::31 large-community 999:65510:3 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::31 + +# do_not_announce_to_any +deny to 2001:db8:1:1::31 community 0:999 +deny to 2001:db8:1:1::31 ext-community rt 0:999 +deny to 2001:db8:1:1::31 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::31 community 0:3 +deny quick to 2001:db8:1:1::31 ext-community rt 0:3 +deny quick to 2001:db8:1:1::31 large-community 999:0:3 + +# announce_to_peer +allow to 2001:db8:1:1::31 community 65501:3 +allow to 2001:db8:1:1::31 ext-community rt 65501:3 +allow to 2001:db8:1:1::31 large-community 999:65501:3 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS4_1, inbound + + + +# NEXT_HOP +match from 192.0.2.41 set community NO_ADVERTISE +match from 192.0.2.41 nexthop 192.0.2.41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.41 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.41 AS 23456' - reject code: 7 +allow quick from 192.0.2.41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.41 AS { 3, 174 }' - reject code: 8 +allow quick from 192.0.2.41 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.41 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.41 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + +# Blackhole request? +match from 192.0.2.41 set ext-community delete rt 65520:4 + + +# Remove internal communities before accepting the route +match from 192.0.2.41 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.41 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.41 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.41 community BLACKHOLE set community 65530:4 +match from 192.0.2.41 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.41 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.41 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.41 community BLACKHOLE +allow quick from 192.0.2.41 community 65534:0 +allow quick from 192.0.2.41 large-community 65534:0:0 + + +match from 192.0.2.41 set ext-community rt 65520:4 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.41 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.41 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.41 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 192.0.2.41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.41 set ext-community delete rt 65520:4 + + + +allow quick from 192.0.2.41 + + + +# --------------------------------------------- +# client AS4_1, outbound + +deny quick to 192.0.2.41 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 192.0.2.41 community 65534:0 set community BLACKHOLE +match to 192.0.2.41 large-community 65534:0:0 set community BLACKHOLE + +match to 192.0.2.41 community BLACKHOLE set community NO_EXPORT +match to 192.0.2.41 community BLACKHOLE set nexthop 192.0.2.66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.41 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.41 community 65507:999 set community NO_EXPORT +match to 192.0.2.41 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.41 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.41 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.41 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.41 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.41 community 65509:4 set community NO_EXPORT +match to 192.0.2.41 ext-community rt 65509:4 set community NO_EXPORT +match to 192.0.2.41 large-community 999:65509:4 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.41 community 65510:4 set community NO_ADVERTISE +match to 192.0.2.41 ext-community rt 65510:4 set community NO_ADVERTISE +match to 192.0.2.41 large-community 999:65510:4 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.41 + +# do_not_announce_to_any +deny to 192.0.2.41 community 0:999 +deny to 192.0.2.41 ext-community rt 0:999 +deny to 192.0.2.41 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.41 community 0:4 +deny quick to 192.0.2.41 ext-community rt 0:4 +deny quick to 192.0.2.41 large-community 999:0:4 + +# do_not_announce_to_peers_with_rtt_higher_than 5 ms +deny to 192.0.2.41 community 64531:5 +deny to 192.0.2.41 ext-community rt 64531:5 +deny to 192.0.2.41 large-community 999:64531:5 + + +# do_not_announce_to_peers_with_rtt_higher_than 10 ms +deny to 192.0.2.41 community 64531:10 +deny to 192.0.2.41 ext-community rt 64531:10 +deny to 192.0.2.41 large-community 999:64531:10 + + +# do_not_announce_to_peers_with_rtt_higher_than 15 ms +deny to 192.0.2.41 community 64531:15 +deny to 192.0.2.41 ext-community rt 64531:15 +deny to 192.0.2.41 large-community 999:64531:15 + + +# do_not_announce_to_peers_with_rtt_higher_than 20 ms +deny to 192.0.2.41 community 64531:20 +deny to 192.0.2.41 ext-community rt 64531:20 +deny to 192.0.2.41 large-community 999:64531:20 + + +# do_not_announce_to_peers_with_rtt_higher_than 30 ms +deny to 192.0.2.41 community 64531:30 +deny to 192.0.2.41 ext-community rt 64531:30 +deny to 192.0.2.41 large-community 999:64531:30 + + +# do_not_announce_to_peers_with_rtt_higher_than 50 ms +deny to 192.0.2.41 community 64531:50 +deny to 192.0.2.41 ext-community rt 64531:50 +deny to 192.0.2.41 large-community 999:64531:50 + + +# do_not_announce_to_peers_with_rtt_higher_than 100 ms +deny to 192.0.2.41 community 64531:100 +deny to 192.0.2.41 ext-community rt 64531:100 +deny to 192.0.2.41 large-community 999:64531:100 + + +# do_not_announce_to_peers_with_rtt_higher_than 200 ms +deny to 192.0.2.41 community 64531:200 +deny to 192.0.2.41 ext-community rt 64531:200 +deny to 192.0.2.41 large-community 999:64531:200 + + +# do_not_announce_to_peers_with_rtt_higher_than 500 ms +deny to 192.0.2.41 community 64531:500 +deny to 192.0.2.41 ext-community rt 64531:500 +deny to 192.0.2.41 large-community 999:64531:500 + + +# announce_to_peers_with_rtt_higher_than 5 ms +allow to 192.0.2.41 community 64533:5 +allow to 192.0.2.41 ext-community rt 64533:5 +allow to 192.0.2.41 large-community 999:64533:5 + + +# announce_to_peers_with_rtt_higher_than 10 ms +allow to 192.0.2.41 community 64533:10 +allow to 192.0.2.41 ext-community rt 64533:10 +allow to 192.0.2.41 large-community 999:64533:10 + + +# announce_to_peers_with_rtt_higher_than 15 ms +allow to 192.0.2.41 community 64533:15 +allow to 192.0.2.41 ext-community rt 64533:15 +allow to 192.0.2.41 large-community 999:64533:15 + + +# announce_to_peers_with_rtt_higher_than 20 ms +allow to 192.0.2.41 community 64533:20 +allow to 192.0.2.41 ext-community rt 64533:20 +allow to 192.0.2.41 large-community 999:64533:20 + + +# announce_to_peers_with_rtt_higher_than 30 ms +allow to 192.0.2.41 community 64533:30 +allow to 192.0.2.41 ext-community rt 64533:30 +allow to 192.0.2.41 large-community 999:64533:30 + + +# announce_to_peers_with_rtt_higher_than 50 ms +allow to 192.0.2.41 community 64533:50 +allow to 192.0.2.41 ext-community rt 64533:50 +allow to 192.0.2.41 large-community 999:64533:50 + + +# announce_to_peers_with_rtt_higher_than 100 ms +allow to 192.0.2.41 community 64533:100 +allow to 192.0.2.41 ext-community rt 64533:100 +allow to 192.0.2.41 large-community 999:64533:100 + + +# announce_to_peers_with_rtt_higher_than 200 ms +allow to 192.0.2.41 community 64533:200 +allow to 192.0.2.41 ext-community rt 64533:200 +allow to 192.0.2.41 large-community 999:64533:200 + + +# announce_to_peers_with_rtt_higher_than 500 ms +allow to 192.0.2.41 community 64533:500 +allow to 192.0.2.41 ext-community rt 64533:500 +allow to 192.0.2.41 large-community 999:64533:500 + + +# announce_to_peer +allow to 192.0.2.41 community 65501:4 +allow to 192.0.2.41 ext-community rt 65501:4 +allow to 192.0.2.41 large-community 999:65501:4 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS4_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::41 set community NO_ADVERTISE +match from 2001:db8:1:1::41 nexthop 2001:db8:1:1::41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::41 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS { 3, 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::41 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::41 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + +# Blackhole request? +match from 2001:db8:1:1::41 set ext-community delete rt 65520:4 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::41 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::41 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::41 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::41 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::41 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::41 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::41 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::41 community BLACKHOLE +allow quick from 2001:db8:1:1::41 community 65534:0 +allow quick from 2001:db8:1:1::41 large-community 65534:0:0 + + +match from 2001:db8:1:1::41 set ext-community rt 65520:4 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::41 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::41 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::41 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::41 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::41 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::41 set ext-community delete rt 65520:4 + + + +allow quick from 2001:db8:1:1::41 + + + +# --------------------------------------------- +# client AS4_2, outbound + +deny quick to 2001:db8:1:1::41 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 2001:db8:1:1::41 community 65534:0 set community BLACKHOLE +match to 2001:db8:1:1::41 large-community 65534:0:0 set community BLACKHOLE + +match to 2001:db8:1:1::41 community BLACKHOLE set community NO_EXPORT +match to 2001:db8:1:1::41 community BLACKHOLE set nexthop 2001:db8:1:1::66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::41 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::41 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::41 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::41 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::41 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::41 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::41 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::41 community 65509:4 set community NO_EXPORT +match to 2001:db8:1:1::41 ext-community rt 65509:4 set community NO_EXPORT +match to 2001:db8:1:1::41 large-community 999:65509:4 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::41 community 65510:4 set community NO_ADVERTISE +match to 2001:db8:1:1::41 ext-community rt 65510:4 set community NO_ADVERTISE +match to 2001:db8:1:1::41 large-community 999:65510:4 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::41 + +# do_not_announce_to_any +deny to 2001:db8:1:1::41 community 0:999 +deny to 2001:db8:1:1::41 ext-community rt 0:999 +deny to 2001:db8:1:1::41 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::41 community 0:4 +deny quick to 2001:db8:1:1::41 ext-community rt 0:4 +deny quick to 2001:db8:1:1::41 large-community 999:0:4 + +# announce_to_peer +allow to 2001:db8:1:1::41 community 65501:4 +allow to 2001:db8:1:1::41 ext-community rt 65501:4 +allow to 2001:db8:1:1::41 large-community 999:65501:4 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + + + +# Scrub communities from outbound routes +# add_noadvertise_to_any +match to group clients set community delete 65508:999 +match to group clients set ext-community delete rt 65508:999 +match to group clients set large-community delete 999:65508:999 + +# add_noadvertise_to_peer +match to group clients set community delete 65510:* +match to group clients set ext-community delete rt 65510:* +match to group clients set large-community delete 999:65510:* + +# add_noexport_to_any +match to group clients set community delete 65507:999 +match to group clients set ext-community delete rt 65507:999 +match to group clients set large-community delete 999:65507:999 + +# add_noexport_to_peer +match to group clients set community delete 65509:* +match to group clients set ext-community delete rt 65509:* +match to group clients set large-community delete 999:65509:* + +# announce_to_peer +match to group clients set community delete 65501:* +match to group clients set ext-community delete rt 65501:* +match to group clients set large-community delete 999:65501:* + +# announce_to_peers_with_rtt_higher_than +match to group clients set community delete 64533:* +match to group clients set ext-community delete rt 64533:* +match to group clients set large-community delete 999:64533:* + +# announce_to_peers_with_rtt_lower_than +match to group clients set community delete 64532:* +match to group clients set ext-community delete rt 64532:* +match to group clients set large-community delete 999:64532:* + +# blackholing +match to group clients set community delete 65534:0 +match to group clients set large-community delete 65534:0:0 + +# do_not_announce_to_any +match to group clients set community delete 0:999 +match to group clients set ext-community delete rt 0:999 +match to group clients set large-community delete 999:0:999 + +# do_not_announce_to_peer +match to group clients set community delete 0:* +match to group clients set ext-community delete rt 0:* +match to group clients set large-community delete 999:0:* + +# do_not_announce_to_peers_with_rtt_higher_than +match to group clients set community delete 64531:* +match to group clients set ext-community delete rt 64531:* +match to group clients set large-community delete 999:64531:* + +# do_not_announce_to_peers_with_rtt_lower_than +match to group clients set community delete 64530:* +match to group clients set ext-community delete rt 64530:* +match to group clients set large-community delete 999:64530:* + +# prepend_once_to_any +match to group clients set community delete 65521:65521 +match to group clients set ext-community delete rt 65521:65521 +match to group clients set large-community delete 999:65521:65521 + +# prepend_once_to_peer +match to group clients set community delete 65521:* +match to group clients set ext-community delete rt 65521:* +match to group clients set large-community delete 999:65521:* + +# prepend_once_to_peers_with_rtt_higher_than +match to group clients set community delete 64537:* +match to group clients set ext-community delete rt 64537:* +match to group clients set large-community delete 999:64537:* + +# prepend_once_to_peers_with_rtt_lower_than +match to group clients set community delete 64534:* +match to group clients set ext-community delete rt 64534:* +match to group clients set large-community delete 999:64534:* + +# prepend_thrice_to_any +match to group clients set community delete 65523:65523 +match to group clients set ext-community delete rt 65523:65523 +match to group clients set large-community delete 999:65523:65523 + +# prepend_thrice_to_peer +match to group clients set community delete 65523:* +match to group clients set ext-community delete rt 65523:* +match to group clients set large-community delete 999:65523:* + +# prepend_thrice_to_peers_with_rtt_higher_than +match to group clients set community delete 64539:* +match to group clients set ext-community delete rt 64539:* +match to group clients set large-community delete 999:64539:* + +# prepend_thrice_to_peers_with_rtt_lower_than +match to group clients set community delete 64536:* +match to group clients set ext-community delete rt 64536:* +match to group clients set large-community delete 999:64536:* + +# prepend_twice_to_any +match to group clients set community delete 65522:65522 +match to group clients set ext-community delete rt 65522:65522 +match to group clients set large-community delete 999:65522:65522 + +# prepend_twice_to_peer +match to group clients set community delete 65522:* +match to group clients set ext-community delete rt 65522:* +match to group clients set large-community delete 999:65522:* + +# prepend_twice_to_peers_with_rtt_higher_than +match to group clients set community delete 64538:* +match to group clients set ext-community delete rt 64538:* +match to group clients set large-community delete 999:64538:* + +# prepend_twice_to_peers_with_rtt_lower_than +match to group clients set community delete 64535:* +match to group clients set ext-community delete rt 64535:* +match to group clients set large-community delete 999:64535:* + +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities +match to group clients set { + community delete 65521:65521 + ext-community delete rt 65521:65521 + large-community delete 999:65521:65521 + +} +match to group clients set { + community delete 65521:* + ext-community delete rt 65521:* + large-community delete 999:65521:* + +} +match to group clients set { + community delete 64537:* + ext-community delete rt 64537:* + large-community delete 999:64537:* + +} +match to group clients set { + community delete 64534:* + ext-community delete rt 64534:* + large-community delete 999:64534:* + +} +match to group clients set { + community delete 65523:65523 + ext-community delete rt 65523:65523 + large-community delete 999:65523:65523 + +} +match to group clients set { + community delete 65523:* + ext-community delete rt 65523:* + large-community delete 999:65523:* + +} +match to group clients set { + community delete 64539:* + ext-community delete rt 64539:* + large-community delete 999:64539:* + +} +match to group clients set { + community delete 64536:* + ext-community delete rt 64536:* + large-community delete 999:64536:* + +} +match to group clients set { + community delete 65522:65522 + ext-community delete rt 65522:65522 + large-community delete 999:65522:65522 + +} +match to group clients set { + community delete 65522:* + ext-community delete rt 65522:* + large-community delete 999:65522:* + +} +match to group clients set { + community delete 64538:* + ext-community delete rt 64538:* + large-community delete 999:64538:* + +} +match to group clients set { + community delete 64535:* + ext-community delete rt 64535:* + large-community delete 999:64535:* + +} + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +include "/etc/bgpd/post-filters.local" + + diff --git a/tests/live_tests/scenarios/global/configs/BasicScenario_OpenBGPDIPv4/openbgpd77p.conf b/tests/live_tests/scenarios/global/configs/BasicScenario_OpenBGPDIPv4/openbgpd77p.conf new file mode 100644 index 00000000..f3b3121f --- /dev/null +++ b/tests/live_tests/scenarios/global/configs/BasicScenario_OpenBGPDIPv4/openbgpd77p.conf @@ -0,0 +1,10254 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + +# AS222, used by client AS222_1, client AS222_2 +# no origin ASNs found for AS222 +# no prefixes found for AS222 + +# AS2, used by client AS2_1, client AS2_2 +# no origin ASNs found for AS2 +# no prefixes found for AS2 + +# AS-AS1, AS-AS1_CUSTOMERS, used by client AS1_1, client AS1_2, client AS1_3, client AS1_4 +as-set "AS_SET_AS_AS1_AS_AS1_CUSTOMERS_asns" { + 1 101 103 104 +} +prefix-set "AS_SET_AS_AS1_AS_AS1_CUSTOMERS_prefixes" { + 1.0.0.0/8 prefixlen 8 - 32 + 128.0.0.0/7 prefixlen 7 - 32 + 101.0.0.0/16 prefixlen 16 - 32 + 103.0.0.0/16 prefixlen 16 - 32 +} + +# AS-AS2, AS-AS2_CUSTOMERS, used by client AS2_1, client AS2_2 +as-set "AS_SET_AS_AS2_AS_AS2_CUSTOMERS_asns" { + 2 101 103 +} +prefix-set "AS_SET_AS_AS2_AS_AS2_CUSTOMERS_prefixes" { + 2.0.0.0/16 prefixlen 16 - 32 + 101.0.0.0/16 prefixlen 16 - 32 + 103.0.0.0/16 prefixlen 16 - 32 +} + +# WHITE_LIST_AS1_2, used by client AS1_2 white list +as-set "AS_SET_WHITE_LIST_AS1_2_asns" { + 1011 +} +prefix-set "AS_SET_WHITE_LIST_AS1_2_prefixes" { + 11.1.0.0/16 prefixlen 16 - 32 + 2a11:1::/32 prefixlen 32 - 128 +} + +# AS-AS222, used by client AS222_1, client AS222_2 +as-set "AS_SET_AS_AS222_asns" { + 333 +} +prefix-set "AS_SET_AS_AS222_prefixes" { + 222.0.0.0/8 prefixlen 8 - 32 +} + +# AS1, used by client AS1_1, client AS1_2, client AS1_3, client AS1_4 +# no origin ASNs found for AS1 +# no prefixes found for AS1 + +# WHITE_LIST_AS1_1, used by client AS1_1 white list +as-set "AS_SET_WHITE_LIST_AS1_1_asns" { + 1011 +} +prefix-set "AS_SET_WHITE_LIST_AS1_1_prefixes" { + 11.1.0.0/16 prefixlen 16 - 32 + 2a11:1::/32 prefixlen 32 - 128 +} + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + # RTT: 0.1 ms (normalized value: 1) + neighbor 192.0.2.11 { + remote-as 1 + + rde evaluate all + + descr "AS1_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::11 { + remote-as 1 + + rde evaluate all + + descr "AS1_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + # RTT: 5 ms (normalized value: 5) + neighbor 192.0.2.12 { + remote-as 1 + + rde evaluate all + + descr "AS1_2 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::12 { + remote-as 1 + + rde evaluate all + + descr "AS1_2 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.222 { + remote-as 222 + + rde evaluate all + + descr "AS222_1 client" + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::222 { + remote-as 222 + + rde evaluate all + + descr "AS222_1 client" + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + # RTT: 17.3 ms (normalized value: 17) + neighbor 192.0.2.21 { + remote-as 2 + + rde evaluate all + + descr "AS2_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::21 { + remote-as 2 + + rde evaluate all + + descr "AS2_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + # RTT: 123.8 ms (normalized value: 124) + neighbor 192.0.2.31 { + remote-as 3 + + rde evaluate all + + descr "AS3_1 client" + ttl-security no + transparent-as no + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::31 { + remote-as 3 + + rde evaluate all + + descr "AS3_1 client" + ttl-security no + transparent-as no + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } + + # RTT: 600 ms (normalized value: 600) + neighbor 192.0.2.41 { + remote-as 4 + + rde evaluate all + + descr "AS4_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::41 { + remote-as 4 + + rde evaluate all + + descr "AS4_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } +} + +include "/etc/bgpd/post-clients.local" + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + +prefix-set "global_black_list_pref" { + 192.0.2.0/24 prefixlen 24 - 32 + 2001:db8::/32 prefixlen 32 - 128 + +} + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + +# never via route-servers ASNs +as-set "neverviarouteserver" { + 666, 777 +} + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# origin_not_present_in_as_set +match from group clients set community delete 65530:0 +match from group clients set large-community delete 999:65530:0 + +# origin_present_in_as_set +match from group clients set community delete 65530:1 +match from group clients set large-community delete 999:65530:1 + +# prefix_validated_via_arin_whois_db_dump +match from group clients set community delete 65530:3 +match from group clients set large-community delete 999:65530:3 + +# prefix_validated_via_rpki_roas +match from group clients set community delete 65530:2 +match from group clients set large-community delete 999:65530:2 + +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + +# rpki_bgp_origin_validation_not_performed +match from group clients set community delete 65530:4 +match from group clients set large-community delete 999:65530:4 + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + +# --------------------------------------------------------- +# ROAs source + + +roa-set { + 101.3.0.0/16 maxlen 24 source-as 105 expires 4102444799 + 101.2.0.0/17 source-as 101 expires 4102444799 + 101.2.128.0/17 maxlen 24 source-as 101 expires 4102444799 + 101.0.128.0/20 maxlen 23 source-as 101 expires 4102444799 + 101.0.8.0/24 source-as 101 expires 4102444799 + 101.0.9.0/24 source-as 102 expires 4102444799 + 222.1.1.0/24 source-as 333 expires 4102444799 + 3101:3::/32 maxlen 48 source-as 105 expires 4102444799 + 3101:0:8000::/33 maxlen 34 source-as 101 expires 4102444799 + 3101:2:8000::/33 maxlen 48 source-as 101 expires 4102444799 + 3101:2::/33 source-as 101 expires 4102444799 + 3101:0:8::/48 source-as 101 expires 4102444799 + 3101:0:9::/48 source-as 102 expires 4102444799 + 3222:0:1::/48 source-as 333 expires 4102444799 + +} + + + +# --------------------------------------------------------- +# RPKI-based Origin Validation + + +# Add $INTCOMM_RPKI_UNKNOWN, $INTCOMM_RPKI_INVALID and $INTCOMM_RPKI_VALID +# ext community on the basis of ovs. +match from group clients ovs not-found set { + ext-community $INTCOMM_RPKI_UNKNOWN + ext-community ovs not-found + +} +match from group clients ovs valid set { + ext-community $INTCOMM_RPKI_VALID + ext-community ovs valid + +} +match from group clients ovs invalid set { + ext-community $INTCOMM_RPKI_INVALID + ext-community ovs invalid + +} + + + +# --------------------------------------------------------- +# RPKI ROAs used as route objects. + +# Add the $INTCOMM_PREF_OK_ROA ext community to routes whose +# origin ASN has a ROA for the announced prefix. +# It will be used later during IRRDB validation in +# case the origin ASN is authorized by a client's +# AS-SET but the prefix is not. + +# Since RPKI-based Origin Validation is already performed above, +# use the origin validation state to identify valid routes. +match from group clients ovs valid set ext-community $INTCOMM_PREF_OK_ROA + + +# ARIN Whois records used for preifx validation +# --------------------------------------------- + +# Add the $INTCOMM_PREF_OK_ARINDB ext community to routes whose +# origin ASN has an ARIN Whois record for the announced prefix. +# It will be used later during IRRDB validation in +# case the origin ASN is authorized by a client's +# AS-SET but the prefix is not. +origin-set "ARINDB" { +104.0.0.0/23 prefixlen 23 - 32 source-as 104 +3104::/32 prefixlen 32 - 128 source-as 104 +} +match from group clients origin-set ARINDB set ext-community $INTCOMM_PREF_OK_ARINDB + +# NIC.BR Whois records used for preifx validation +# ----------------------------------------------- + +# Add the $INTCOMM_PREF_OK_REGISTROBRDB ext community to routes whose +# origin ASN has a NIC.BR Whois record for the announced prefix. +# It will be used later during IRRDB validation in +# case the origin ASN is authorized by a client's +# AS-SET but the prefix is not. +origin-set "REGISTROBRDB" { +104.1.1.0/24 prefixlen 24 - 32 source-as 104 +3104:1:1::/48 prefixlen 48 - 128 source-as 104 +} +match from group clients origin-set REGISTROBRDB set ext-community $INTCOMM_PREF_OK_REGISTROBRDB + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.11 set ext-community rt 65520:1 + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + +match from 192.0.2.12 set ext-community rt 65520:1 + +match from 2001:db8:1:1::12 set ext-community rt 65520:1 + +match from 192.0.2.222 set ext-community rt 65520:222 + +match from 2001:db8:1:1::222 set ext-community rt 65520:222 + +match from 192.0.2.21 set ext-community rt 65520:2 + +match from 2001:db8:1:1::21 set ext-community rt 65520:2 + +match from 192.0.2.31 set ext-community rt 65520:3 + +match from 2001:db8:1:1::31 set ext-community rt 65520:3 + +match from 192.0.2.41 set ext-community rt 65520:4 + +match from 2001:db8:1:1::41 set ext-community rt 65520:4 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 6' - reject code: 1 +allow quick from group clients max-as-len 6 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: global blacklist +# Reject inbound routes when 'from group clients prefix-set global_black_list_pref' - reject code: 3 +allow quick from group clients prefix-set global_black_list_pref set { + localpref 1 + community 65520:0 + community 65520:3 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS1_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.11 AS { 3, 174 }' - reject code: 8 +allow quick from 192.0.2.11 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.11 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.11 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 192.0.2.11 prefix 11.3.0.0/16 source-as 1011 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.11 prefix 11.4.0.0/16 prefixlen 16 - 32 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.11 prefix 2a11:3::/32 source-as 1011 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.11 prefix 2a11:4::/32 prefixlen 32 - 128 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 192.0.2.11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_1, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.11 source-as as-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. +match from 192.0.2.11 source-as as-set AS_SET_WHITE_LIST_AS1_1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS1_1 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_1, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.11 prefix-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. +match from 192.0.2.11 prefix-set AS_SET_WHITE_LIST_AS1_1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS1_1 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_REGISTROBRDB community have the prefix validated by a NICBR Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_REGISTROBRDB set ext-community delete $INTCOMM_IRR_REJECT + +# route authorized by a client's white list? +match from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 192.0.2.11 set ext-community delete rt 65520:1 + + +# Remove internal communities before accepting the route +match from 192.0.2.11 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.11 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.11 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.11 community BLACKHOLE set community 65530:4 +match from 192.0.2.11 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.11 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.11 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.11 community BLACKHOLE +allow quick from 192.0.2.11 community 65534:0 +allow quick from 192.0.2.11 large-community 65534:0:0 + + +match from 192.0.2.11 set ext-community rt 65520:1 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.11 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 192.0.2.11 community 65534:0 set community BLACKHOLE +match to 192.0.2.11 large-community 65534:0:0 set community BLACKHOLE + +match to 192.0.2.11 community BLACKHOLE set community NO_EXPORT +match to 192.0.2.11 community BLACKHOLE set nexthop 192.0.2.66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.11 community 65507:999 set community NO_EXPORT +match to 192.0.2.11 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.11 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.11 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.11 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.11 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.11 community 65509:1 set community NO_EXPORT +match to 192.0.2.11 ext-community rt 65509:1 set community NO_EXPORT +match to 192.0.2.11 large-community 999:65509:1 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.11 community 65510:1 set community NO_ADVERTISE +match to 192.0.2.11 ext-community rt 65510:1 set community NO_ADVERTISE +match to 192.0.2.11 large-community 999:65510:1 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.11 + +# do_not_announce_to_any +deny to 192.0.2.11 community 0:999 +deny to 192.0.2.11 ext-community rt 0:999 +deny to 192.0.2.11 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.11 community 0:1 +deny quick to 192.0.2.11 ext-community rt 0:1 +deny quick to 192.0.2.11 large-community 999:0:1 + +# do_not_announce_to_peers_with_rtt_lower_than 5 ms +deny to 192.0.2.11 community 64530:5 +deny to 192.0.2.11 ext-community rt 64530:5 +deny to 192.0.2.11 large-community 999:64530:5 + + +# do_not_announce_to_peers_with_rtt_lower_than 10 ms +deny to 192.0.2.11 community 64530:10 +deny to 192.0.2.11 ext-community rt 64530:10 +deny to 192.0.2.11 large-community 999:64530:10 + + +# do_not_announce_to_peers_with_rtt_lower_than 15 ms +deny to 192.0.2.11 community 64530:15 +deny to 192.0.2.11 ext-community rt 64530:15 +deny to 192.0.2.11 large-community 999:64530:15 + + +# do_not_announce_to_peers_with_rtt_lower_than 20 ms +deny to 192.0.2.11 community 64530:20 +deny to 192.0.2.11 ext-community rt 64530:20 +deny to 192.0.2.11 large-community 999:64530:20 + + +# do_not_announce_to_peers_with_rtt_lower_than 30 ms +deny to 192.0.2.11 community 64530:30 +deny to 192.0.2.11 ext-community rt 64530:30 +deny to 192.0.2.11 large-community 999:64530:30 + + +# do_not_announce_to_peers_with_rtt_lower_than 50 ms +deny to 192.0.2.11 community 64530:50 +deny to 192.0.2.11 ext-community rt 64530:50 +deny to 192.0.2.11 large-community 999:64530:50 + + +# do_not_announce_to_peers_with_rtt_lower_than 100 ms +deny to 192.0.2.11 community 64530:100 +deny to 192.0.2.11 ext-community rt 64530:100 +deny to 192.0.2.11 large-community 999:64530:100 + + +# do_not_announce_to_peers_with_rtt_lower_than 200 ms +deny to 192.0.2.11 community 64530:200 +deny to 192.0.2.11 ext-community rt 64530:200 +deny to 192.0.2.11 large-community 999:64530:200 + + +# do_not_announce_to_peers_with_rtt_lower_than 500 ms +deny to 192.0.2.11 community 64530:500 +deny to 192.0.2.11 ext-community rt 64530:500 +deny to 192.0.2.11 large-community 999:64530:500 + + +# announce_to_peers_with_rtt_lower_than 5 ms +allow to 192.0.2.11 community 64532:5 +allow to 192.0.2.11 ext-community rt 64532:5 +allow to 192.0.2.11 large-community 999:64532:5 + + +# announce_to_peers_with_rtt_lower_than 10 ms +allow to 192.0.2.11 community 64532:10 +allow to 192.0.2.11 ext-community rt 64532:10 +allow to 192.0.2.11 large-community 999:64532:10 + + +# announce_to_peers_with_rtt_lower_than 15 ms +allow to 192.0.2.11 community 64532:15 +allow to 192.0.2.11 ext-community rt 64532:15 +allow to 192.0.2.11 large-community 999:64532:15 + + +# announce_to_peers_with_rtt_lower_than 20 ms +allow to 192.0.2.11 community 64532:20 +allow to 192.0.2.11 ext-community rt 64532:20 +allow to 192.0.2.11 large-community 999:64532:20 + + +# announce_to_peers_with_rtt_lower_than 30 ms +allow to 192.0.2.11 community 64532:30 +allow to 192.0.2.11 ext-community rt 64532:30 +allow to 192.0.2.11 large-community 999:64532:30 + + +# announce_to_peers_with_rtt_lower_than 50 ms +allow to 192.0.2.11 community 64532:50 +allow to 192.0.2.11 ext-community rt 64532:50 +allow to 192.0.2.11 large-community 999:64532:50 + + +# announce_to_peers_with_rtt_lower_than 100 ms +allow to 192.0.2.11 community 64532:100 +allow to 192.0.2.11 ext-community rt 64532:100 +allow to 192.0.2.11 large-community 999:64532:100 + + +# announce_to_peers_with_rtt_lower_than 200 ms +allow to 192.0.2.11 community 64532:200 +allow to 192.0.2.11 ext-community rt 64532:200 +allow to 192.0.2.11 large-community 999:64532:200 + + +# announce_to_peers_with_rtt_lower_than 500 ms +allow to 192.0.2.11 community 64532:500 +allow to 192.0.2.11 ext-community rt 64532:500 +allow to 192.0.2.11 large-community 999:64532:500 + + +# announce_to_peer +allow to 192.0.2.11 community 65501:1 +allow to 192.0.2.11 ext-community rt 65501:1 +allow to 192.0.2.11 large-community 999:65501:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS1_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS { 3, 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::11 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::11 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 2001:db8:1:1::11 prefix 11.3.0.0/16 source-as 1011 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::11 prefix 11.4.0.0/16 prefixlen 16 - 32 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::11 prefix 2a11:3::/32 source-as 1011 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::11 prefix 2a11:4::/32 prefixlen 32 - 128 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 2001:db8:1:1::11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_2, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::11 source-as as-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS1_AS_AS1_CUSTOMERS +match from 2001:db8:1:1::11 source-as as-set AS_SET_WHITE_LIST_AS1_2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS1_2 +# AS-SET AS1 referenced but empty. + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_2, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::11 prefix-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS1_AS_AS1_CUSTOMERS +match from 2001:db8:1:1::11 prefix-set AS_SET_WHITE_LIST_AS1_2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS1_2 +# AS-SET AS1 referenced but empty. + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_REGISTROBRDB community have the prefix validated by a NICBR Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_REGISTROBRDB set ext-community delete $INTCOMM_IRR_REJECT + +# route authorized by a client's white list? +match from 2001:db8:1:1::11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::11 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::11 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::11 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::11 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::11 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::11 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::11 community BLACKHOLE +allow quick from 2001:db8:1:1::11 community 65534:0 +allow quick from 2001:db8:1:1::11 large-community 65534:0:0 + + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::11 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::11 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::11 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + +deny quick to 2001:db8:1:1::11 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 2001:db8:1:1::11 community 65534:0 set community BLACKHOLE +match to 2001:db8:1:1::11 large-community 65534:0:0 set community BLACKHOLE + +match to 2001:db8:1:1::11 community BLACKHOLE set community NO_EXPORT +match to 2001:db8:1:1::11 community BLACKHOLE set nexthop 2001:db8:1:1::66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::11 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::11 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::11 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::11 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::11 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::11 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::11 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::11 community 65509:1 set community NO_EXPORT +match to 2001:db8:1:1::11 ext-community rt 65509:1 set community NO_EXPORT +match to 2001:db8:1:1::11 large-community 999:65509:1 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::11 community 65510:1 set community NO_ADVERTISE +match to 2001:db8:1:1::11 ext-community rt 65510:1 set community NO_ADVERTISE +match to 2001:db8:1:1::11 large-community 999:65510:1 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::11 + +# do_not_announce_to_any +deny to 2001:db8:1:1::11 community 0:999 +deny to 2001:db8:1:1::11 ext-community rt 0:999 +deny to 2001:db8:1:1::11 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::11 community 0:1 +deny quick to 2001:db8:1:1::11 ext-community rt 0:1 +deny quick to 2001:db8:1:1::11 large-community 999:0:1 + +# announce_to_peer +allow to 2001:db8:1:1::11 community 65501:1 +allow to 2001:db8:1:1::11 ext-community rt 65501:1 +allow to 2001:db8:1:1::11 large-community 999:65501:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS1_3, inbound + + + +# NEXT_HOP +match from 192.0.2.12 set community NO_ADVERTISE +match from 192.0.2.12 nexthop 192.0.2.11 set community delete NO_ADVERTISE +match from 192.0.2.12 nexthop 192.0.2.12 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.12 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.12 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.12 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.12 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.12 AS 23456' - reject code: 7 +allow quick from 192.0.2.12 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.12 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.12 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.12 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.12 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.12 AS { 3, 174 }' - reject code: 8 +allow quick from 192.0.2.12 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.12 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.12 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +match from 192.0.2.12 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_3, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.12 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.12 source-as as-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_3, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.12 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.12 prefix-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.12 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.12 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_REGISTROBRDB community have the prefix validated by a NICBR Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.12 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_REGISTROBRDB set ext-community delete $INTCOMM_IRR_REJECT + + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 192.0.2.12 set ext-community delete rt 65520:1 + + +# Remove internal communities before accepting the route +match from 192.0.2.12 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.12 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.12 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.12 community BLACKHOLE set community 65530:4 +match from 192.0.2.12 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.12 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.12 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.12 community BLACKHOLE +allow quick from 192.0.2.12 community 65534:0 +allow quick from 192.0.2.12 large-community 65534:0:0 + + +match from 192.0.2.12 set ext-community rt 65520:1 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.12 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.12 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.12 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.12 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.12 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 192.0.2.12 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.12 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.12 + + + +# --------------------------------------------- +# client AS1_3, outbound + +deny quick to 192.0.2.12 community 65520:0 + + + +# Blackhole request? +# Client not enabled to receive blackhole routes +deny quick to 192.0.2.12 community BLACKHOLE +deny quick to 192.0.2.12 community 65534:0 +deny quick to 192.0.2.12 large-community 65534:0:0 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.12 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.12 community 65507:999 set community NO_EXPORT +match to 192.0.2.12 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.12 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.12 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.12 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.12 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.12 community 65509:1 set community NO_EXPORT +match to 192.0.2.12 ext-community rt 65509:1 set community NO_EXPORT +match to 192.0.2.12 large-community 999:65509:1 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.12 community 65510:1 set community NO_ADVERTISE +match to 192.0.2.12 ext-community rt 65510:1 set community NO_ADVERTISE +match to 192.0.2.12 large-community 999:65510:1 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.12 + +# do_not_announce_to_any +deny to 192.0.2.12 community 0:999 +deny to 192.0.2.12 ext-community rt 0:999 +deny to 192.0.2.12 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.12 community 0:1 +deny quick to 192.0.2.12 ext-community rt 0:1 +deny quick to 192.0.2.12 large-community 999:0:1 + +# do_not_announce_to_peers_with_rtt_lower_than 5 ms +deny to 192.0.2.12 community 64530:5 +deny to 192.0.2.12 ext-community rt 64530:5 +deny to 192.0.2.12 large-community 999:64530:5 + + +# do_not_announce_to_peers_with_rtt_lower_than 10 ms +deny to 192.0.2.12 community 64530:10 +deny to 192.0.2.12 ext-community rt 64530:10 +deny to 192.0.2.12 large-community 999:64530:10 + + +# do_not_announce_to_peers_with_rtt_lower_than 15 ms +deny to 192.0.2.12 community 64530:15 +deny to 192.0.2.12 ext-community rt 64530:15 +deny to 192.0.2.12 large-community 999:64530:15 + + +# do_not_announce_to_peers_with_rtt_lower_than 20 ms +deny to 192.0.2.12 community 64530:20 +deny to 192.0.2.12 ext-community rt 64530:20 +deny to 192.0.2.12 large-community 999:64530:20 + + +# do_not_announce_to_peers_with_rtt_lower_than 30 ms +deny to 192.0.2.12 community 64530:30 +deny to 192.0.2.12 ext-community rt 64530:30 +deny to 192.0.2.12 large-community 999:64530:30 + + +# do_not_announce_to_peers_with_rtt_lower_than 50 ms +deny to 192.0.2.12 community 64530:50 +deny to 192.0.2.12 ext-community rt 64530:50 +deny to 192.0.2.12 large-community 999:64530:50 + + +# do_not_announce_to_peers_with_rtt_lower_than 100 ms +deny to 192.0.2.12 community 64530:100 +deny to 192.0.2.12 ext-community rt 64530:100 +deny to 192.0.2.12 large-community 999:64530:100 + + +# do_not_announce_to_peers_with_rtt_lower_than 200 ms +deny to 192.0.2.12 community 64530:200 +deny to 192.0.2.12 ext-community rt 64530:200 +deny to 192.0.2.12 large-community 999:64530:200 + + +# do_not_announce_to_peers_with_rtt_lower_than 500 ms +deny to 192.0.2.12 community 64530:500 +deny to 192.0.2.12 ext-community rt 64530:500 +deny to 192.0.2.12 large-community 999:64530:500 + + +# announce_to_peers_with_rtt_lower_than 5 ms +allow to 192.0.2.12 community 64532:5 +allow to 192.0.2.12 ext-community rt 64532:5 +allow to 192.0.2.12 large-community 999:64532:5 + + +# announce_to_peers_with_rtt_lower_than 10 ms +allow to 192.0.2.12 community 64532:10 +allow to 192.0.2.12 ext-community rt 64532:10 +allow to 192.0.2.12 large-community 999:64532:10 + + +# announce_to_peers_with_rtt_lower_than 15 ms +allow to 192.0.2.12 community 64532:15 +allow to 192.0.2.12 ext-community rt 64532:15 +allow to 192.0.2.12 large-community 999:64532:15 + + +# announce_to_peers_with_rtt_lower_than 20 ms +allow to 192.0.2.12 community 64532:20 +allow to 192.0.2.12 ext-community rt 64532:20 +allow to 192.0.2.12 large-community 999:64532:20 + + +# announce_to_peers_with_rtt_lower_than 30 ms +allow to 192.0.2.12 community 64532:30 +allow to 192.0.2.12 ext-community rt 64532:30 +allow to 192.0.2.12 large-community 999:64532:30 + + +# announce_to_peers_with_rtt_lower_than 50 ms +allow to 192.0.2.12 community 64532:50 +allow to 192.0.2.12 ext-community rt 64532:50 +allow to 192.0.2.12 large-community 999:64532:50 + + +# announce_to_peers_with_rtt_lower_than 100 ms +allow to 192.0.2.12 community 64532:100 +allow to 192.0.2.12 ext-community rt 64532:100 +allow to 192.0.2.12 large-community 999:64532:100 + + +# announce_to_peers_with_rtt_lower_than 200 ms +allow to 192.0.2.12 community 64532:200 +allow to 192.0.2.12 ext-community rt 64532:200 +allow to 192.0.2.12 large-community 999:64532:200 + + +# announce_to_peers_with_rtt_lower_than 500 ms +allow to 192.0.2.12 community 64532:500 +allow to 192.0.2.12 ext-community rt 64532:500 +allow to 192.0.2.12 large-community 999:64532:500 + + +# announce_to_peer +allow to 192.0.2.12 community 65501:1 +allow to 192.0.2.12 ext-community rt 65501:1 +allow to 192.0.2.12 large-community 999:65501:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.12 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS1_4, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::12 set community NO_ADVERTISE +match from 2001:db8:1:1::12 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +match from 2001:db8:1:1::12 nexthop 2001:db8:1:1::12 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::12 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::12 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::12 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::12 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::12 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::12 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::12 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::12 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::12 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::12 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::12 AS { 3, 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::12 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::12 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::12 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +match from 2001:db8:1:1::12 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_4, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::12 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::12 source-as as-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_4, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::12 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::12 prefix-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::12 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::12 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_REGISTROBRDB community have the prefix validated by a NICBR Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::12 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_REGISTROBRDB set ext-community delete $INTCOMM_IRR_REJECT + + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 2001:db8:1:1::12 set ext-community delete rt 65520:1 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::12 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::12 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::12 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::12 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::12 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::12 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::12 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::12 community BLACKHOLE +allow quick from 2001:db8:1:1::12 community 65534:0 +allow quick from 2001:db8:1:1::12 large-community 65534:0:0 + + +match from 2001:db8:1:1::12 set ext-community rt 65520:1 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::12 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::12 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::12 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::12 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::12 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::12 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::12 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::12 + + + +# --------------------------------------------- +# client AS1_4, outbound + +deny quick to 2001:db8:1:1::12 community 65520:0 + + + +# Blackhole request? +# Client not enabled to receive blackhole routes +deny quick to 2001:db8:1:1::12 community BLACKHOLE +deny quick to 2001:db8:1:1::12 community 65534:0 +deny quick to 2001:db8:1:1::12 large-community 65534:0:0 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::12 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::12 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::12 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::12 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::12 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::12 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::12 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::12 community 65509:1 set community NO_EXPORT +match to 2001:db8:1:1::12 ext-community rt 65509:1 set community NO_EXPORT +match to 2001:db8:1:1::12 large-community 999:65509:1 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::12 community 65510:1 set community NO_ADVERTISE +match to 2001:db8:1:1::12 ext-community rt 65510:1 set community NO_ADVERTISE +match to 2001:db8:1:1::12 large-community 999:65510:1 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::12 + +# do_not_announce_to_any +deny to 2001:db8:1:1::12 community 0:999 +deny to 2001:db8:1:1::12 ext-community rt 0:999 +deny to 2001:db8:1:1::12 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::12 community 0:1 +deny quick to 2001:db8:1:1::12 ext-community rt 0:1 +deny quick to 2001:db8:1:1::12 large-community 999:0:1 + +# announce_to_peer +allow to 2001:db8:1:1::12 community 65501:1 +allow to 2001:db8:1:1::12 ext-community rt 65501:1 +allow to 2001:db8:1:1::12 large-community 999:65501:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::12 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS222_1, inbound + + + +# NEXT_HOP +match from 192.0.2.222 set community NO_ADVERTISE +match from 192.0.2.222 nexthop 192.0.2.222 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.222 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.222 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.222 peer-as != 222' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.222 peer-as != 222 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.222 AS 23456' - reject code: 7 +allow quick from 192.0.2.222 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.222 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.222 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.222 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.222 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.222 AS { 3, 174 }' - reject code: 8 +allow quick from 192.0.2.222 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.222 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.222 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 192.0.2.222 prefix 222.1.1.0/24 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.222 prefix 3222:0:1::/48 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 192.0.2.222 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS222_1, AS222: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.222 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS222 referenced but empty. +match from 192.0.2.222 source-as as-set AS_SET_AS_AS222_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS222 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS222_1, AS222: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.222 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS222 referenced but empty. +match from 192.0.2.222 prefix-set AS_SET_AS_AS222_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS222 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.222 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.222 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_REGISTROBRDB community have the prefix validated by a NICBR Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.222 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_REGISTROBRDB set ext-community delete $INTCOMM_IRR_REJECT + +# route authorized by a client's white list? +match from 192.0.2.222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 192.0.2.222 set ext-community delete rt 65520:222 + + +# Remove internal communities before accepting the route +match from 192.0.2.222 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.222 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.222 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.222 community BLACKHOLE set community 65530:4 +match from 192.0.2.222 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.222 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.222 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.222 community BLACKHOLE +allow quick from 192.0.2.222 community 65534:0 +allow quick from 192.0.2.222 large-community 65534:0:0 + + +match from 192.0.2.222 set ext-community rt 65520:222 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.222 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.222 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.222 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.222 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.222 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 192.0.2.222 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.222 set ext-community delete rt 65520:222 + + + +allow quick from 192.0.2.222 + + + +# --------------------------------------------- +# client AS222_1, outbound + +deny quick to 192.0.2.222 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 192.0.2.222 community 65534:0 set community BLACKHOLE +match to 192.0.2.222 large-community 65534:0:0 set community BLACKHOLE + +match to 192.0.2.222 community BLACKHOLE set community NO_EXPORT +match to 192.0.2.222 community BLACKHOLE set nexthop 192.0.2.66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.222 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.222 community 65507:999 set community NO_EXPORT +match to 192.0.2.222 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.222 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.222 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.222 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.222 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.222 community 65509:222 set community NO_EXPORT +match to 192.0.2.222 ext-community rt 65509:222 set community NO_EXPORT +match to 192.0.2.222 large-community 999:65509:222 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.222 community 65510:222 set community NO_ADVERTISE +match to 192.0.2.222 ext-community rt 65510:222 set community NO_ADVERTISE +match to 192.0.2.222 large-community 999:65510:222 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.222 + +# do_not_announce_to_any +deny to 192.0.2.222 community 0:999 +deny to 192.0.2.222 ext-community rt 0:999 +deny to 192.0.2.222 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.222 community 0:222 +deny quick to 192.0.2.222 ext-community rt 0:222 +deny quick to 192.0.2.222 large-community 999:0:222 + +# announce_to_peer +allow to 192.0.2.222 community 65501:222 +allow to 192.0.2.222 ext-community rt 65501:222 +allow to 192.0.2.222 large-community 999:65501:222 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.222 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS222_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::222 set community NO_ADVERTISE +match from 2001:db8:1:1::222 nexthop 2001:db8:1:1::222 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::222 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::222 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::222 peer-as != 222' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::222 peer-as != 222 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::222 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::222 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::222 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::222 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::222 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::222 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::222 AS { 3, 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::222 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::222 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::222 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 2001:db8:1:1::222 prefix 222.1.1.0/24 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::222 prefix 3222:0:1::/48 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 2001:db8:1:1::222 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS222_2, AS222: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::222 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS222 referenced but empty. +match from 2001:db8:1:1::222 source-as as-set AS_SET_AS_AS222_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS222 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS222_2, AS222: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::222 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS222 referenced but empty. +match from 2001:db8:1:1::222 prefix-set AS_SET_AS_AS222_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS222 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::222 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::222 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_REGISTROBRDB community have the prefix validated by a NICBR Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::222 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_REGISTROBRDB set ext-community delete $INTCOMM_IRR_REJECT + +# route authorized by a client's white list? +match from 2001:db8:1:1::222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 2001:db8:1:1::222 set ext-community delete rt 65520:222 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::222 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::222 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::222 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::222 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::222 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::222 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::222 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::222 community BLACKHOLE +allow quick from 2001:db8:1:1::222 community 65534:0 +allow quick from 2001:db8:1:1::222 large-community 65534:0:0 + + +match from 2001:db8:1:1::222 set ext-community rt 65520:222 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::222 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::222 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::222 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::222 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::222 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::222 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::222 set ext-community delete rt 65520:222 + + + +allow quick from 2001:db8:1:1::222 + + + +# --------------------------------------------- +# client AS222_2, outbound + +deny quick to 2001:db8:1:1::222 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 2001:db8:1:1::222 community 65534:0 set community BLACKHOLE +match to 2001:db8:1:1::222 large-community 65534:0:0 set community BLACKHOLE + +match to 2001:db8:1:1::222 community BLACKHOLE set community NO_EXPORT +match to 2001:db8:1:1::222 community BLACKHOLE set nexthop 2001:db8:1:1::66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::222 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::222 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::222 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::222 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::222 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::222 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::222 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::222 community 65509:222 set community NO_EXPORT +match to 2001:db8:1:1::222 ext-community rt 65509:222 set community NO_EXPORT +match to 2001:db8:1:1::222 large-community 999:65509:222 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::222 community 65510:222 set community NO_ADVERTISE +match to 2001:db8:1:1::222 ext-community rt 65510:222 set community NO_ADVERTISE +match to 2001:db8:1:1::222 large-community 999:65510:222 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::222 + +# do_not_announce_to_any +deny to 2001:db8:1:1::222 community 0:999 +deny to 2001:db8:1:1::222 ext-community rt 0:999 +deny to 2001:db8:1:1::222 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::222 community 0:222 +deny quick to 2001:db8:1:1::222 ext-community rt 0:222 +deny quick to 2001:db8:1:1::222 large-community 999:0:222 + +# announce_to_peer +allow to 2001:db8:1:1::222 community 65501:222 +allow to 2001:db8:1:1::222 ext-community rt 65501:222 +allow to 2001:db8:1:1::222 large-community 999:65501:222 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::222 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.21 set community NO_ADVERTISE +match from 192.0.2.21 nexthop 192.0.2.21 set community delete NO_ADVERTISE +match from 192.0.2.21 nexthop 192.0.2.22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.21 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.21 AS 23456' - reject code: 7 +allow quick from 192.0.2.21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.21 AS { 3, 174 }' - reject code: 8 +allow quick from 192.0.2.21 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.21 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.21 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +match from 192.0.2.21 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS2_1, AS2: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.21 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 192.0.2.21 source-as as-set AS_SET_AS_AS2_AS_AS2_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS2_AS_AS2_CUSTOMERS + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS2_1, AS2: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.21 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 192.0.2.21 prefix-set AS_SET_AS_AS2_AS_AS2_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS2_AS_AS2_CUSTOMERS + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_REGISTROBRDB community have the prefix validated by a NICBR Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_REGISTROBRDB set ext-community delete $INTCOMM_IRR_REJECT + + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 192.0.2.21 set ext-community delete rt 65520:2 + + +# Remove internal communities before accepting the route +match from 192.0.2.21 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.21 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.21 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.21 community BLACKHOLE set community 65530:4 +match from 192.0.2.21 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.21 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.21 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.21 community BLACKHOLE +allow quick from 192.0.2.21 community 65534:0 +allow quick from 192.0.2.21 large-community 65534:0:0 + + +match from 192.0.2.21 set ext-community rt 65520:2 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.21 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.21 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.21 community GRACEFUL_SHUTDOWN set community delete GRACEFUL_SHUTDOWN + +# Remove internal communities before accepting the route +match from 192.0.2.21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.21 set ext-community delete rt 65520:2 + + + +allow quick from 192.0.2.21 + + + +# --------------------------------------------- +# client AS2_1, outbound + +deny quick to 192.0.2.21 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 192.0.2.21 community 65534:0 set community BLACKHOLE +match to 192.0.2.21 large-community 65534:0:0 set community BLACKHOLE + +match to 192.0.2.21 community BLACKHOLE set community NO_EXPORT +match to 192.0.2.21 community BLACKHOLE set nexthop 192.0.2.66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.21 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.21 community 65507:999 set community NO_EXPORT +match to 192.0.2.21 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.21 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.21 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.21 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.21 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.21 community 65509:2 set community NO_EXPORT +match to 192.0.2.21 ext-community rt 65509:2 set community NO_EXPORT +match to 192.0.2.21 large-community 999:65509:2 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.21 community 65510:2 set community NO_ADVERTISE +match to 192.0.2.21 ext-community rt 65510:2 set community NO_ADVERTISE +match to 192.0.2.21 large-community 999:65510:2 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.21 + +# do_not_announce_to_any +deny to 192.0.2.21 community 0:999 +deny to 192.0.2.21 ext-community rt 0:999 +deny to 192.0.2.21 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.21 community 0:2 +deny quick to 192.0.2.21 ext-community rt 0:2 +deny quick to 192.0.2.21 large-community 999:0:2 + +# do_not_announce_to_peers_with_rtt_lower_than 20 ms +deny to 192.0.2.21 community 64530:20 +deny to 192.0.2.21 ext-community rt 64530:20 +deny to 192.0.2.21 large-community 999:64530:20 + + +# do_not_announce_to_peers_with_rtt_lower_than 30 ms +deny to 192.0.2.21 community 64530:30 +deny to 192.0.2.21 ext-community rt 64530:30 +deny to 192.0.2.21 large-community 999:64530:30 + + +# do_not_announce_to_peers_with_rtt_lower_than 50 ms +deny to 192.0.2.21 community 64530:50 +deny to 192.0.2.21 ext-community rt 64530:50 +deny to 192.0.2.21 large-community 999:64530:50 + + +# do_not_announce_to_peers_with_rtt_lower_than 100 ms +deny to 192.0.2.21 community 64530:100 +deny to 192.0.2.21 ext-community rt 64530:100 +deny to 192.0.2.21 large-community 999:64530:100 + + +# do_not_announce_to_peers_with_rtt_lower_than 200 ms +deny to 192.0.2.21 community 64530:200 +deny to 192.0.2.21 ext-community rt 64530:200 +deny to 192.0.2.21 large-community 999:64530:200 + + +# do_not_announce_to_peers_with_rtt_lower_than 500 ms +deny to 192.0.2.21 community 64530:500 +deny to 192.0.2.21 ext-community rt 64530:500 +deny to 192.0.2.21 large-community 999:64530:500 + + +# announce_to_peers_with_rtt_lower_than 20 ms +allow to 192.0.2.21 community 64532:20 +allow to 192.0.2.21 ext-community rt 64532:20 +allow to 192.0.2.21 large-community 999:64532:20 + + +# announce_to_peers_with_rtt_lower_than 30 ms +allow to 192.0.2.21 community 64532:30 +allow to 192.0.2.21 ext-community rt 64532:30 +allow to 192.0.2.21 large-community 999:64532:30 + + +# announce_to_peers_with_rtt_lower_than 50 ms +allow to 192.0.2.21 community 64532:50 +allow to 192.0.2.21 ext-community rt 64532:50 +allow to 192.0.2.21 large-community 999:64532:50 + + +# announce_to_peers_with_rtt_lower_than 100 ms +allow to 192.0.2.21 community 64532:100 +allow to 192.0.2.21 ext-community rt 64532:100 +allow to 192.0.2.21 large-community 999:64532:100 + + +# announce_to_peers_with_rtt_lower_than 200 ms +allow to 192.0.2.21 community 64532:200 +allow to 192.0.2.21 ext-community rt 64532:200 +allow to 192.0.2.21 large-community 999:64532:200 + + +# announce_to_peers_with_rtt_lower_than 500 ms +allow to 192.0.2.21 community 64532:500 +allow to 192.0.2.21 ext-community rt 64532:500 +allow to 192.0.2.21 large-community 999:64532:500 + + +# do_not_announce_to_peers_with_rtt_higher_than 5 ms +deny to 192.0.2.21 community 64531:5 +deny to 192.0.2.21 ext-community rt 64531:5 +deny to 192.0.2.21 large-community 999:64531:5 + + +# do_not_announce_to_peers_with_rtt_higher_than 10 ms +deny to 192.0.2.21 community 64531:10 +deny to 192.0.2.21 ext-community rt 64531:10 +deny to 192.0.2.21 large-community 999:64531:10 + + +# do_not_announce_to_peers_with_rtt_higher_than 15 ms +deny to 192.0.2.21 community 64531:15 +deny to 192.0.2.21 ext-community rt 64531:15 +deny to 192.0.2.21 large-community 999:64531:15 + + +# announce_to_peers_with_rtt_higher_than 5 ms +allow to 192.0.2.21 community 64533:5 +allow to 192.0.2.21 ext-community rt 64533:5 +allow to 192.0.2.21 large-community 999:64533:5 + + +# announce_to_peers_with_rtt_higher_than 10 ms +allow to 192.0.2.21 community 64533:10 +allow to 192.0.2.21 ext-community rt 64533:10 +allow to 192.0.2.21 large-community 999:64533:10 + + +# announce_to_peers_with_rtt_higher_than 15 ms +allow to 192.0.2.21 community 64533:15 +allow to 192.0.2.21 ext-community rt 64533:15 +allow to 192.0.2.21 large-community 999:64533:15 + + +# announce_to_peer +allow to 192.0.2.21 community 65501:2 +allow to 192.0.2.21 ext-community rt 65501:2 +allow to 192.0.2.21 large-community 999:65501:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::21 set community NO_ADVERTISE +match from 2001:db8:1:1::21 nexthop 2001:db8:1:1::21 set community delete NO_ADVERTISE +match from 2001:db8:1:1::21 nexthop 2001:db8:1:1::22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::21 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS { 3, 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::21 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::21 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +match from 2001:db8:1:1::21 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS2_2, AS2: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::21 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 2001:db8:1:1::21 source-as as-set AS_SET_AS_AS2_AS_AS2_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS2_AS_AS2_CUSTOMERS + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS2_2, AS2: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::21 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 2001:db8:1:1::21 prefix-set AS_SET_AS_AS2_AS_AS2_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS2_AS_AS2_CUSTOMERS + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_REGISTROBRDB community have the prefix validated by a NICBR Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_REGISTROBRDB set ext-community delete $INTCOMM_IRR_REJECT + + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 2001:db8:1:1::21 set ext-community delete rt 65520:2 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::21 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::21 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::21 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::21 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::21 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::21 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::21 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::21 community BLACKHOLE +allow quick from 2001:db8:1:1::21 community 65534:0 +allow quick from 2001:db8:1:1::21 large-community 65534:0:0 + + +match from 2001:db8:1:1::21 set ext-community rt 65520:2 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::21 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::21 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::21 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::21 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::21 community GRACEFUL_SHUTDOWN set community delete GRACEFUL_SHUTDOWN + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::21 set ext-community delete rt 65520:2 + + + +allow quick from 2001:db8:1:1::21 + + + +# --------------------------------------------- +# client AS2_2, outbound + +deny quick to 2001:db8:1:1::21 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 2001:db8:1:1::21 community 65534:0 set community BLACKHOLE +match to 2001:db8:1:1::21 large-community 65534:0:0 set community BLACKHOLE + +match to 2001:db8:1:1::21 community BLACKHOLE set community NO_EXPORT +match to 2001:db8:1:1::21 community BLACKHOLE set nexthop 2001:db8:1:1::66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::21 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::21 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::21 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::21 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::21 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::21 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::21 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::21 community 65509:2 set community NO_EXPORT +match to 2001:db8:1:1::21 ext-community rt 65509:2 set community NO_EXPORT +match to 2001:db8:1:1::21 large-community 999:65509:2 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::21 community 65510:2 set community NO_ADVERTISE +match to 2001:db8:1:1::21 ext-community rt 65510:2 set community NO_ADVERTISE +match to 2001:db8:1:1::21 large-community 999:65510:2 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::21 + +# do_not_announce_to_any +deny to 2001:db8:1:1::21 community 0:999 +deny to 2001:db8:1:1::21 ext-community rt 0:999 +deny to 2001:db8:1:1::21 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::21 community 0:2 +deny quick to 2001:db8:1:1::21 ext-community rt 0:2 +deny quick to 2001:db8:1:1::21 large-community 999:0:2 + +# announce_to_peer +allow to 2001:db8:1:1::21 community 65501:2 +allow to 2001:db8:1:1::21 ext-community rt 65501:2 +allow to 2001:db8:1:1::21 large-community 999:65501:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS3_1, inbound + + + +# NEXT_HOP +match from 192.0.2.31 set community NO_ADVERTISE +match from 192.0.2.31 nexthop 192.0.2.31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.31 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.31 AS 23456' - reject code: 7 +allow quick from 192.0.2.31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.31 AS { 174 }' - reject code: 8 +allow quick from 192.0.2.31 AS { 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.31 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.31 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +# Prefix: client's blacklist +prefix-set "client_AS3_1_black_list_pref_ipv4" { + 3.0.1.0/24 prefixlen 24 - 32 + +} +# Reject inbound routes when 'from 192.0.2.31 prefix-set client_AS3_1_black_list_pref_ipv4' - reject code: 11 +allow quick from 192.0.2.31 prefix-set client_AS3_1_black_list_pref_ipv4 set { + localpref 1 + community 65520:0 + community 65520:11 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Blackhole request? +match from 192.0.2.31 set ext-community delete rt 65520:3 + + +# Remove internal communities before accepting the route +match from 192.0.2.31 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.31 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.31 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.31 community BLACKHOLE set community 65530:4 +match from 192.0.2.31 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.31 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.31 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.31 community BLACKHOLE +allow quick from 192.0.2.31 community 65534:0 +allow quick from 192.0.2.31 large-community 65534:0:0 + + +match from 192.0.2.31 set ext-community rt 65520:3 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.31 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.31 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.31 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 192.0.2.31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.31 set ext-community delete rt 65520:3 + + + +allow quick from 192.0.2.31 + + + +# --------------------------------------------- +# client AS3_1, outbound + +deny quick to 192.0.2.31 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 192.0.2.31 community 65534:0 set community BLACKHOLE +match to 192.0.2.31 large-community 65534:0:0 set community BLACKHOLE + +match to 192.0.2.31 community BLACKHOLE set community NO_EXPORT +match to 192.0.2.31 community BLACKHOLE set nexthop 192.0.2.66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.31 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.31 community 65507:999 set community NO_EXPORT +match to 192.0.2.31 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.31 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.31 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.31 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.31 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.31 community 65509:3 set community NO_EXPORT +match to 192.0.2.31 ext-community rt 65509:3 set community NO_EXPORT +match to 192.0.2.31 large-community 999:65509:3 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.31 community 65510:3 set community NO_ADVERTISE +match to 192.0.2.31 ext-community rt 65510:3 set community NO_ADVERTISE +match to 192.0.2.31 large-community 999:65510:3 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.31 + +# do_not_announce_to_any +deny to 192.0.2.31 community 0:999 +deny to 192.0.2.31 ext-community rt 0:999 +deny to 192.0.2.31 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.31 community 0:3 +deny quick to 192.0.2.31 ext-community rt 0:3 +deny quick to 192.0.2.31 large-community 999:0:3 + +# do_not_announce_to_peers_with_rtt_lower_than 200 ms +deny to 192.0.2.31 community 64530:200 +deny to 192.0.2.31 ext-community rt 64530:200 +deny to 192.0.2.31 large-community 999:64530:200 + + +# do_not_announce_to_peers_with_rtt_lower_than 500 ms +deny to 192.0.2.31 community 64530:500 +deny to 192.0.2.31 ext-community rt 64530:500 +deny to 192.0.2.31 large-community 999:64530:500 + + +# announce_to_peers_with_rtt_lower_than 200 ms +allow to 192.0.2.31 community 64532:200 +allow to 192.0.2.31 ext-community rt 64532:200 +allow to 192.0.2.31 large-community 999:64532:200 + + +# announce_to_peers_with_rtt_lower_than 500 ms +allow to 192.0.2.31 community 64532:500 +allow to 192.0.2.31 ext-community rt 64532:500 +allow to 192.0.2.31 large-community 999:64532:500 + + +# do_not_announce_to_peers_with_rtt_higher_than 5 ms +deny to 192.0.2.31 community 64531:5 +deny to 192.0.2.31 ext-community rt 64531:5 +deny to 192.0.2.31 large-community 999:64531:5 + + +# do_not_announce_to_peers_with_rtt_higher_than 10 ms +deny to 192.0.2.31 community 64531:10 +deny to 192.0.2.31 ext-community rt 64531:10 +deny to 192.0.2.31 large-community 999:64531:10 + + +# do_not_announce_to_peers_with_rtt_higher_than 15 ms +deny to 192.0.2.31 community 64531:15 +deny to 192.0.2.31 ext-community rt 64531:15 +deny to 192.0.2.31 large-community 999:64531:15 + + +# do_not_announce_to_peers_with_rtt_higher_than 20 ms +deny to 192.0.2.31 community 64531:20 +deny to 192.0.2.31 ext-community rt 64531:20 +deny to 192.0.2.31 large-community 999:64531:20 + + +# do_not_announce_to_peers_with_rtt_higher_than 30 ms +deny to 192.0.2.31 community 64531:30 +deny to 192.0.2.31 ext-community rt 64531:30 +deny to 192.0.2.31 large-community 999:64531:30 + + +# do_not_announce_to_peers_with_rtt_higher_than 50 ms +deny to 192.0.2.31 community 64531:50 +deny to 192.0.2.31 ext-community rt 64531:50 +deny to 192.0.2.31 large-community 999:64531:50 + + +# do_not_announce_to_peers_with_rtt_higher_than 100 ms +deny to 192.0.2.31 community 64531:100 +deny to 192.0.2.31 ext-community rt 64531:100 +deny to 192.0.2.31 large-community 999:64531:100 + + +# announce_to_peers_with_rtt_higher_than 5 ms +allow to 192.0.2.31 community 64533:5 +allow to 192.0.2.31 ext-community rt 64533:5 +allow to 192.0.2.31 large-community 999:64533:5 + + +# announce_to_peers_with_rtt_higher_than 10 ms +allow to 192.0.2.31 community 64533:10 +allow to 192.0.2.31 ext-community rt 64533:10 +allow to 192.0.2.31 large-community 999:64533:10 + + +# announce_to_peers_with_rtt_higher_than 15 ms +allow to 192.0.2.31 community 64533:15 +allow to 192.0.2.31 ext-community rt 64533:15 +allow to 192.0.2.31 large-community 999:64533:15 + + +# announce_to_peers_with_rtt_higher_than 20 ms +allow to 192.0.2.31 community 64533:20 +allow to 192.0.2.31 ext-community rt 64533:20 +allow to 192.0.2.31 large-community 999:64533:20 + + +# announce_to_peers_with_rtt_higher_than 30 ms +allow to 192.0.2.31 community 64533:30 +allow to 192.0.2.31 ext-community rt 64533:30 +allow to 192.0.2.31 large-community 999:64533:30 + + +# announce_to_peers_with_rtt_higher_than 50 ms +allow to 192.0.2.31 community 64533:50 +allow to 192.0.2.31 ext-community rt 64533:50 +allow to 192.0.2.31 large-community 999:64533:50 + + +# announce_to_peers_with_rtt_higher_than 100 ms +allow to 192.0.2.31 community 64533:100 +allow to 192.0.2.31 ext-community rt 64533:100 +allow to 192.0.2.31 large-community 999:64533:100 + + +# announce_to_peer +allow to 192.0.2.31 community 65501:3 +allow to 192.0.2.31 ext-community rt 65501:3 +allow to 192.0.2.31 large-community 999:65501:3 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS3_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::31 set community NO_ADVERTISE +match from 2001:db8:1:1::31 nexthop 2001:db8:1:1::31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::31 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::31 AS { 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::31 AS { 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::31 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::31 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +# Prefix: client's blacklist +prefix-set "client_AS3_2_black_list_pref_ipv6" { + 2a03:0:1::/48 prefixlen 48 - 128 + +} +# Reject inbound routes when 'from 2001:db8:1:1::31 prefix-set client_AS3_2_black_list_pref_ipv6' - reject code: 11 +allow quick from 2001:db8:1:1::31 prefix-set client_AS3_2_black_list_pref_ipv6 set { + localpref 1 + community 65520:0 + community 65520:11 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Blackhole request? +match from 2001:db8:1:1::31 set ext-community delete rt 65520:3 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::31 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::31 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::31 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::31 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::31 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::31 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::31 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::31 community BLACKHOLE +allow quick from 2001:db8:1:1::31 community 65534:0 +allow quick from 2001:db8:1:1::31 large-community 65534:0:0 + + +match from 2001:db8:1:1::31 set ext-community rt 65520:3 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::31 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::31 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::31 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::31 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::31 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::31 set ext-community delete rt 65520:3 + + + +allow quick from 2001:db8:1:1::31 + + + +# --------------------------------------------- +# client AS3_2, outbound + +deny quick to 2001:db8:1:1::31 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 2001:db8:1:1::31 community 65534:0 set community BLACKHOLE +match to 2001:db8:1:1::31 large-community 65534:0:0 set community BLACKHOLE + +match to 2001:db8:1:1::31 community BLACKHOLE set community NO_EXPORT +match to 2001:db8:1:1::31 community BLACKHOLE set nexthop 2001:db8:1:1::66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::31 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::31 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::31 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::31 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::31 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::31 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::31 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::31 community 65509:3 set community NO_EXPORT +match to 2001:db8:1:1::31 ext-community rt 65509:3 set community NO_EXPORT +match to 2001:db8:1:1::31 large-community 999:65509:3 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::31 community 65510:3 set community NO_ADVERTISE +match to 2001:db8:1:1::31 ext-community rt 65510:3 set community NO_ADVERTISE +match to 2001:db8:1:1::31 large-community 999:65510:3 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::31 + +# do_not_announce_to_any +deny to 2001:db8:1:1::31 community 0:999 +deny to 2001:db8:1:1::31 ext-community rt 0:999 +deny to 2001:db8:1:1::31 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::31 community 0:3 +deny quick to 2001:db8:1:1::31 ext-community rt 0:3 +deny quick to 2001:db8:1:1::31 large-community 999:0:3 + +# announce_to_peer +allow to 2001:db8:1:1::31 community 65501:3 +allow to 2001:db8:1:1::31 ext-community rt 65501:3 +allow to 2001:db8:1:1::31 large-community 999:65501:3 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS4_1, inbound + + + +# NEXT_HOP +match from 192.0.2.41 set community NO_ADVERTISE +match from 192.0.2.41 nexthop 192.0.2.41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.41 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.41 AS 23456' - reject code: 7 +allow quick from 192.0.2.41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.41 AS { 3, 174 }' - reject code: 8 +allow quick from 192.0.2.41 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.41 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.41 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + +# Blackhole request? +match from 192.0.2.41 set ext-community delete rt 65520:4 + + +# Remove internal communities before accepting the route +match from 192.0.2.41 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.41 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.41 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.41 community BLACKHOLE set community 65530:4 +match from 192.0.2.41 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.41 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.41 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.41 community BLACKHOLE +allow quick from 192.0.2.41 community 65534:0 +allow quick from 192.0.2.41 large-community 65534:0:0 + + +match from 192.0.2.41 set ext-community rt 65520:4 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.41 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.41 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.41 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 192.0.2.41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.41 set ext-community delete rt 65520:4 + + + +allow quick from 192.0.2.41 + + + +# --------------------------------------------- +# client AS4_1, outbound + +deny quick to 192.0.2.41 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 192.0.2.41 community 65534:0 set community BLACKHOLE +match to 192.0.2.41 large-community 65534:0:0 set community BLACKHOLE + +match to 192.0.2.41 community BLACKHOLE set community NO_EXPORT +match to 192.0.2.41 community BLACKHOLE set nexthop 192.0.2.66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.41 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.41 community 65507:999 set community NO_EXPORT +match to 192.0.2.41 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.41 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.41 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.41 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.41 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.41 community 65509:4 set community NO_EXPORT +match to 192.0.2.41 ext-community rt 65509:4 set community NO_EXPORT +match to 192.0.2.41 large-community 999:65509:4 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.41 community 65510:4 set community NO_ADVERTISE +match to 192.0.2.41 ext-community rt 65510:4 set community NO_ADVERTISE +match to 192.0.2.41 large-community 999:65510:4 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.41 + +# do_not_announce_to_any +deny to 192.0.2.41 community 0:999 +deny to 192.0.2.41 ext-community rt 0:999 +deny to 192.0.2.41 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.41 community 0:4 +deny quick to 192.0.2.41 ext-community rt 0:4 +deny quick to 192.0.2.41 large-community 999:0:4 + +# do_not_announce_to_peers_with_rtt_higher_than 5 ms +deny to 192.0.2.41 community 64531:5 +deny to 192.0.2.41 ext-community rt 64531:5 +deny to 192.0.2.41 large-community 999:64531:5 + + +# do_not_announce_to_peers_with_rtt_higher_than 10 ms +deny to 192.0.2.41 community 64531:10 +deny to 192.0.2.41 ext-community rt 64531:10 +deny to 192.0.2.41 large-community 999:64531:10 + + +# do_not_announce_to_peers_with_rtt_higher_than 15 ms +deny to 192.0.2.41 community 64531:15 +deny to 192.0.2.41 ext-community rt 64531:15 +deny to 192.0.2.41 large-community 999:64531:15 + + +# do_not_announce_to_peers_with_rtt_higher_than 20 ms +deny to 192.0.2.41 community 64531:20 +deny to 192.0.2.41 ext-community rt 64531:20 +deny to 192.0.2.41 large-community 999:64531:20 + + +# do_not_announce_to_peers_with_rtt_higher_than 30 ms +deny to 192.0.2.41 community 64531:30 +deny to 192.0.2.41 ext-community rt 64531:30 +deny to 192.0.2.41 large-community 999:64531:30 + + +# do_not_announce_to_peers_with_rtt_higher_than 50 ms +deny to 192.0.2.41 community 64531:50 +deny to 192.0.2.41 ext-community rt 64531:50 +deny to 192.0.2.41 large-community 999:64531:50 + + +# do_not_announce_to_peers_with_rtt_higher_than 100 ms +deny to 192.0.2.41 community 64531:100 +deny to 192.0.2.41 ext-community rt 64531:100 +deny to 192.0.2.41 large-community 999:64531:100 + + +# do_not_announce_to_peers_with_rtt_higher_than 200 ms +deny to 192.0.2.41 community 64531:200 +deny to 192.0.2.41 ext-community rt 64531:200 +deny to 192.0.2.41 large-community 999:64531:200 + + +# do_not_announce_to_peers_with_rtt_higher_than 500 ms +deny to 192.0.2.41 community 64531:500 +deny to 192.0.2.41 ext-community rt 64531:500 +deny to 192.0.2.41 large-community 999:64531:500 + + +# announce_to_peers_with_rtt_higher_than 5 ms +allow to 192.0.2.41 community 64533:5 +allow to 192.0.2.41 ext-community rt 64533:5 +allow to 192.0.2.41 large-community 999:64533:5 + + +# announce_to_peers_with_rtt_higher_than 10 ms +allow to 192.0.2.41 community 64533:10 +allow to 192.0.2.41 ext-community rt 64533:10 +allow to 192.0.2.41 large-community 999:64533:10 + + +# announce_to_peers_with_rtt_higher_than 15 ms +allow to 192.0.2.41 community 64533:15 +allow to 192.0.2.41 ext-community rt 64533:15 +allow to 192.0.2.41 large-community 999:64533:15 + + +# announce_to_peers_with_rtt_higher_than 20 ms +allow to 192.0.2.41 community 64533:20 +allow to 192.0.2.41 ext-community rt 64533:20 +allow to 192.0.2.41 large-community 999:64533:20 + + +# announce_to_peers_with_rtt_higher_than 30 ms +allow to 192.0.2.41 community 64533:30 +allow to 192.0.2.41 ext-community rt 64533:30 +allow to 192.0.2.41 large-community 999:64533:30 + + +# announce_to_peers_with_rtt_higher_than 50 ms +allow to 192.0.2.41 community 64533:50 +allow to 192.0.2.41 ext-community rt 64533:50 +allow to 192.0.2.41 large-community 999:64533:50 + + +# announce_to_peers_with_rtt_higher_than 100 ms +allow to 192.0.2.41 community 64533:100 +allow to 192.0.2.41 ext-community rt 64533:100 +allow to 192.0.2.41 large-community 999:64533:100 + + +# announce_to_peers_with_rtt_higher_than 200 ms +allow to 192.0.2.41 community 64533:200 +allow to 192.0.2.41 ext-community rt 64533:200 +allow to 192.0.2.41 large-community 999:64533:200 + + +# announce_to_peers_with_rtt_higher_than 500 ms +allow to 192.0.2.41 community 64533:500 +allow to 192.0.2.41 ext-community rt 64533:500 +allow to 192.0.2.41 large-community 999:64533:500 + + +# announce_to_peer +allow to 192.0.2.41 community 65501:4 +allow to 192.0.2.41 ext-community rt 65501:4 +allow to 192.0.2.41 large-community 999:65501:4 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS4_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::41 set community NO_ADVERTISE +match from 2001:db8:1:1::41 nexthop 2001:db8:1:1::41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::41 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS { 3, 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::41 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::41 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + +# Blackhole request? +match from 2001:db8:1:1::41 set ext-community delete rt 65520:4 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::41 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::41 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::41 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::41 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::41 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::41 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::41 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::41 community BLACKHOLE +allow quick from 2001:db8:1:1::41 community 65534:0 +allow quick from 2001:db8:1:1::41 large-community 65534:0:0 + + +match from 2001:db8:1:1::41 set ext-community rt 65520:4 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::41 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::41 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::41 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::41 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::41 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::41 set ext-community delete rt 65520:4 + + + +allow quick from 2001:db8:1:1::41 + + + +# --------------------------------------------- +# client AS4_2, outbound + +deny quick to 2001:db8:1:1::41 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 2001:db8:1:1::41 community 65534:0 set community BLACKHOLE +match to 2001:db8:1:1::41 large-community 65534:0:0 set community BLACKHOLE + +match to 2001:db8:1:1::41 community BLACKHOLE set community NO_EXPORT +match to 2001:db8:1:1::41 community BLACKHOLE set nexthop 2001:db8:1:1::66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::41 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::41 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::41 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::41 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::41 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::41 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::41 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::41 community 65509:4 set community NO_EXPORT +match to 2001:db8:1:1::41 ext-community rt 65509:4 set community NO_EXPORT +match to 2001:db8:1:1::41 large-community 999:65509:4 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::41 community 65510:4 set community NO_ADVERTISE +match to 2001:db8:1:1::41 ext-community rt 65510:4 set community NO_ADVERTISE +match to 2001:db8:1:1::41 large-community 999:65510:4 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::41 + +# do_not_announce_to_any +deny to 2001:db8:1:1::41 community 0:999 +deny to 2001:db8:1:1::41 ext-community rt 0:999 +deny to 2001:db8:1:1::41 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::41 community 0:4 +deny quick to 2001:db8:1:1::41 ext-community rt 0:4 +deny quick to 2001:db8:1:1::41 large-community 999:0:4 + +# announce_to_peer +allow to 2001:db8:1:1::41 community 65501:4 +allow to 2001:db8:1:1::41 ext-community rt 65501:4 +allow to 2001:db8:1:1::41 large-community 999:65501:4 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + + + +# Scrub communities from outbound routes +# add_noadvertise_to_any +match to group clients set community delete 65508:999 +match to group clients set ext-community delete rt 65508:999 +match to group clients set large-community delete 999:65508:999 + +# add_noadvertise_to_peer +match to group clients set community delete 65510:* +match to group clients set ext-community delete rt 65510:* +match to group clients set large-community delete 999:65510:* + +# add_noexport_to_any +match to group clients set community delete 65507:999 +match to group clients set ext-community delete rt 65507:999 +match to group clients set large-community delete 999:65507:999 + +# add_noexport_to_peer +match to group clients set community delete 65509:* +match to group clients set ext-community delete rt 65509:* +match to group clients set large-community delete 999:65509:* + +# announce_to_peer +match to group clients set community delete 65501:* +match to group clients set ext-community delete rt 65501:* +match to group clients set large-community delete 999:65501:* + +# announce_to_peers_with_rtt_higher_than +match to group clients set community delete 64533:* +match to group clients set ext-community delete rt 64533:* +match to group clients set large-community delete 999:64533:* + +# announce_to_peers_with_rtt_lower_than +match to group clients set community delete 64532:* +match to group clients set ext-community delete rt 64532:* +match to group clients set large-community delete 999:64532:* + +# blackholing +match to group clients set community delete 65534:0 +match to group clients set large-community delete 65534:0:0 + +# do_not_announce_to_any +match to group clients set community delete 0:999 +match to group clients set ext-community delete rt 0:999 +match to group clients set large-community delete 999:0:999 + +# do_not_announce_to_peer +match to group clients set community delete 0:* +match to group clients set ext-community delete rt 0:* +match to group clients set large-community delete 999:0:* + +# do_not_announce_to_peers_with_rtt_higher_than +match to group clients set community delete 64531:* +match to group clients set ext-community delete rt 64531:* +match to group clients set large-community delete 999:64531:* + +# do_not_announce_to_peers_with_rtt_lower_than +match to group clients set community delete 64530:* +match to group clients set ext-community delete rt 64530:* +match to group clients set large-community delete 999:64530:* + +# prepend_once_to_any +match to group clients set community delete 65521:65521 +match to group clients set ext-community delete rt 65521:65521 +match to group clients set large-community delete 999:65521:65521 + +# prepend_once_to_peer +match to group clients set community delete 65521:* +match to group clients set ext-community delete rt 65521:* +match to group clients set large-community delete 999:65521:* + +# prepend_once_to_peers_with_rtt_higher_than +match to group clients set community delete 64537:* +match to group clients set ext-community delete rt 64537:* +match to group clients set large-community delete 999:64537:* + +# prepend_once_to_peers_with_rtt_lower_than +match to group clients set community delete 64534:* +match to group clients set ext-community delete rt 64534:* +match to group clients set large-community delete 999:64534:* + +# prepend_thrice_to_any +match to group clients set community delete 65523:65523 +match to group clients set ext-community delete rt 65523:65523 +match to group clients set large-community delete 999:65523:65523 + +# prepend_thrice_to_peer +match to group clients set community delete 65523:* +match to group clients set ext-community delete rt 65523:* +match to group clients set large-community delete 999:65523:* + +# prepend_thrice_to_peers_with_rtt_higher_than +match to group clients set community delete 64539:* +match to group clients set ext-community delete rt 64539:* +match to group clients set large-community delete 999:64539:* + +# prepend_thrice_to_peers_with_rtt_lower_than +match to group clients set community delete 64536:* +match to group clients set ext-community delete rt 64536:* +match to group clients set large-community delete 999:64536:* + +# prepend_twice_to_any +match to group clients set community delete 65522:65522 +match to group clients set ext-community delete rt 65522:65522 +match to group clients set large-community delete 999:65522:65522 + +# prepend_twice_to_peer +match to group clients set community delete 65522:* +match to group clients set ext-community delete rt 65522:* +match to group clients set large-community delete 999:65522:* + +# prepend_twice_to_peers_with_rtt_higher_than +match to group clients set community delete 64538:* +match to group clients set ext-community delete rt 64538:* +match to group clients set large-community delete 999:64538:* + +# prepend_twice_to_peers_with_rtt_lower_than +match to group clients set community delete 64535:* +match to group clients set ext-community delete rt 64535:* +match to group clients set large-community delete 999:64535:* + +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities +match to group clients set { + community delete 65521:65521 + ext-community delete rt 65521:65521 + large-community delete 999:65521:65521 + +} +match to group clients set { + community delete 65521:* + ext-community delete rt 65521:* + large-community delete 999:65521:* + +} +match to group clients set { + community delete 64537:* + ext-community delete rt 64537:* + large-community delete 999:64537:* + +} +match to group clients set { + community delete 64534:* + ext-community delete rt 64534:* + large-community delete 999:64534:* + +} +match to group clients set { + community delete 65523:65523 + ext-community delete rt 65523:65523 + large-community delete 999:65523:65523 + +} +match to group clients set { + community delete 65523:* + ext-community delete rt 65523:* + large-community delete 999:65523:* + +} +match to group clients set { + community delete 64539:* + ext-community delete rt 64539:* + large-community delete 999:64539:* + +} +match to group clients set { + community delete 64536:* + ext-community delete rt 64536:* + large-community delete 999:64536:* + +} +match to group clients set { + community delete 65522:65522 + ext-community delete rt 65522:65522 + large-community delete 999:65522:65522 + +} +match to group clients set { + community delete 65522:* + ext-community delete rt 65522:* + large-community delete 999:65522:* + +} +match to group clients set { + community delete 64538:* + ext-community delete rt 64538:* + large-community delete 999:64538:* + +} +match to group clients set { + community delete 64535:* + ext-community delete rt 64535:* + large-community delete 999:64535:* + +} + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +include "/etc/bgpd/post-filters.local" + + diff --git a/tests/live_tests/scenarios/global/configs/BasicScenario_OpenBGPDIPv6/openbgpd76p.conf b/tests/live_tests/scenarios/global/configs/BasicScenario_OpenBGPDIPv6/openbgpd76p.conf new file mode 100644 index 00000000..28ccbce0 --- /dev/null +++ b/tests/live_tests/scenarios/global/configs/BasicScenario_OpenBGPDIPv6/openbgpd76p.conf @@ -0,0 +1,10254 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + +# AS222, used by client AS222_1, client AS222_2 +# no origin ASNs found for AS222 +# no prefixes found for AS222 + +# AS2, used by client AS2_1, client AS2_2 +# no origin ASNs found for AS2 +# no prefixes found for AS2 + +# AS-AS1, AS-AS1_CUSTOMERS, used by client AS1_1, client AS1_2, client AS1_3, client AS1_4 +as-set "AS_SET_AS_AS1_AS_AS1_CUSTOMERS_asns" { + 1 101 103 104 +} +prefix-set "AS_SET_AS_AS1_AS_AS1_CUSTOMERS_prefixes" { + 2a01::/32 prefixlen 32 - 128 + 2a99::/16 prefixlen 16 - 128 + 3101::/32 prefixlen 32 - 128 + 3103::/32 prefixlen 32 - 128 +} + +# AS-AS2, AS-AS2_CUSTOMERS, used by client AS2_1, client AS2_2 +as-set "AS_SET_AS_AS2_AS_AS2_CUSTOMERS_asns" { + 2 101 103 +} +prefix-set "AS_SET_AS_AS2_AS_AS2_CUSTOMERS_prefixes" { + 2a02::/32 prefixlen 32 - 128 + 3101::/32 prefixlen 32 - 128 + 3103::/32 prefixlen 32 - 128 +} + +# WHITE_LIST_AS1_2, used by client AS1_2 white list +as-set "AS_SET_WHITE_LIST_AS1_2_asns" { + 1011 +} +prefix-set "AS_SET_WHITE_LIST_AS1_2_prefixes" { + 11.1.0.0/16 prefixlen 16 - 32 + 2a11:1::/32 prefixlen 32 - 128 +} + +# AS-AS222, used by client AS222_1, client AS222_2 +as-set "AS_SET_AS_AS222_asns" { + 333 +} +prefix-set "AS_SET_AS_AS222_prefixes" { + 3222::/32 prefixlen 32 - 128 +} + +# AS1, used by client AS1_1, client AS1_2, client AS1_3, client AS1_4 +# no origin ASNs found for AS1 +# no prefixes found for AS1 + +# WHITE_LIST_AS1_1, used by client AS1_1 white list +as-set "AS_SET_WHITE_LIST_AS1_1_asns" { + 1011 +} +prefix-set "AS_SET_WHITE_LIST_AS1_1_prefixes" { + 11.1.0.0/16 prefixlen 16 - 32 + 2a11:1::/32 prefixlen 32 - 128 +} + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.11 { + remote-as 1 + + rde evaluate all + + descr "AS1_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + # RTT: 0.1 ms (normalized value: 1) + neighbor 2001:db8:1:1::11 { + remote-as 1 + + rde evaluate all + + descr "AS1_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.12 { + remote-as 1 + + rde evaluate all + + descr "AS1_2 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + # RTT: 5 ms (normalized value: 5) + neighbor 2001:db8:1:1::12 { + remote-as 1 + + rde evaluate all + + descr "AS1_2 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.222 { + remote-as 222 + + rde evaluate all + + descr "AS222_1 client" + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::222 { + remote-as 222 + + rde evaluate all + + descr "AS222_1 client" + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.21 { + remote-as 2 + + rde evaluate all + + descr "AS2_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + # RTT: 17.3 ms (normalized value: 17) + neighbor 2001:db8:1:1::21 { + remote-as 2 + + rde evaluate all + + descr "AS2_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.31 { + remote-as 3 + + rde evaluate all + + descr "AS3_1 client" + ttl-security no + transparent-as no + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + # RTT: 123.8 ms (normalized value: 124) + neighbor 2001:db8:1:1::31 { + remote-as 3 + + rde evaluate all + + descr "AS3_1 client" + ttl-security no + transparent-as no + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 192.0.2.41 { + remote-as 4 + + rde evaluate all + + descr "AS4_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + # RTT: 600 ms (normalized value: 600) + neighbor 2001:db8:1:1::41 { + remote-as 4 + + rde evaluate all + + descr "AS4_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } +} + +include "/etc/bgpd/post-clients.local" + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + +prefix-set "global_black_list_pref" { + 192.0.2.0/24 prefixlen 24 - 32 + 2001:db8::/32 prefixlen 32 - 128 + +} + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + +# never via route-servers ASNs +as-set "neverviarouteserver" { + 666, 777 +} + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# origin_not_present_in_as_set +match from group clients set community delete 65530:0 +match from group clients set large-community delete 999:65530:0 + +# origin_present_in_as_set +match from group clients set community delete 65530:1 +match from group clients set large-community delete 999:65530:1 + +# prefix_validated_via_arin_whois_db_dump +match from group clients set community delete 65530:3 +match from group clients set large-community delete 999:65530:3 + +# prefix_validated_via_rpki_roas +match from group clients set community delete 65530:2 +match from group clients set large-community delete 999:65530:2 + +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + +# rpki_bgp_origin_validation_not_performed +match from group clients set community delete 65530:4 +match from group clients set large-community delete 999:65530:4 + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + +# --------------------------------------------------------- +# ROAs source + + +roa-set { + 101.3.0.0/16 maxlen 24 source-as 105 expires 4102444799 + 101.2.0.0/17 source-as 101 expires 4102444799 + 101.2.128.0/17 maxlen 24 source-as 101 expires 4102444799 + 101.0.128.0/20 maxlen 23 source-as 101 expires 4102444799 + 101.0.8.0/24 source-as 101 expires 4102444799 + 101.0.9.0/24 source-as 102 expires 4102444799 + 222.1.1.0/24 source-as 333 expires 4102444799 + 3101:3::/32 maxlen 48 source-as 105 expires 4102444799 + 3101:0:8000::/33 maxlen 34 source-as 101 expires 4102444799 + 3101:2:8000::/33 maxlen 48 source-as 101 expires 4102444799 + 3101:2::/33 source-as 101 expires 4102444799 + 3101:0:8::/48 source-as 101 expires 4102444799 + 3101:0:9::/48 source-as 102 expires 4102444799 + 3222:0:1::/48 source-as 333 expires 4102444799 + +} + + + +# --------------------------------------------------------- +# RPKI-based Origin Validation + + +# Add $INTCOMM_RPKI_UNKNOWN, $INTCOMM_RPKI_INVALID and $INTCOMM_RPKI_VALID +# ext community on the basis of ovs. +match from group clients ovs not-found set { + ext-community $INTCOMM_RPKI_UNKNOWN + ext-community ovs not-found + +} +match from group clients ovs valid set { + ext-community $INTCOMM_RPKI_VALID + ext-community ovs valid + +} +match from group clients ovs invalid set { + ext-community $INTCOMM_RPKI_INVALID + ext-community ovs invalid + +} + + + +# --------------------------------------------------------- +# RPKI ROAs used as route objects. + +# Add the $INTCOMM_PREF_OK_ROA ext community to routes whose +# origin ASN has a ROA for the announced prefix. +# It will be used later during IRRDB validation in +# case the origin ASN is authorized by a client's +# AS-SET but the prefix is not. + +# Since RPKI-based Origin Validation is already performed above, +# use the origin validation state to identify valid routes. +match from group clients ovs valid set ext-community $INTCOMM_PREF_OK_ROA + + +# ARIN Whois records used for preifx validation +# --------------------------------------------- + +# Add the $INTCOMM_PREF_OK_ARINDB ext community to routes whose +# origin ASN has an ARIN Whois record for the announced prefix. +# It will be used later during IRRDB validation in +# case the origin ASN is authorized by a client's +# AS-SET but the prefix is not. +origin-set "ARINDB" { +104.0.0.0/23 prefixlen 23 - 32 source-as 104 +3104::/32 prefixlen 32 - 128 source-as 104 +} +match from group clients origin-set ARINDB set ext-community $INTCOMM_PREF_OK_ARINDB + +# NIC.BR Whois records used for preifx validation +# ----------------------------------------------- + +# Add the $INTCOMM_PREF_OK_REGISTROBRDB ext community to routes whose +# origin ASN has a NIC.BR Whois record for the announced prefix. +# It will be used later during IRRDB validation in +# case the origin ASN is authorized by a client's +# AS-SET but the prefix is not. +origin-set "REGISTROBRDB" { +104.1.1.0/24 prefixlen 24 - 32 source-as 104 +3104:1:1::/48 prefixlen 48 - 128 source-as 104 +} +match from group clients origin-set REGISTROBRDB set ext-community $INTCOMM_PREF_OK_REGISTROBRDB + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.11 set ext-community rt 65520:1 + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + +match from 192.0.2.12 set ext-community rt 65520:1 + +match from 2001:db8:1:1::12 set ext-community rt 65520:1 + +match from 192.0.2.222 set ext-community rt 65520:222 + +match from 2001:db8:1:1::222 set ext-community rt 65520:222 + +match from 192.0.2.21 set ext-community rt 65520:2 + +match from 2001:db8:1:1::21 set ext-community rt 65520:2 + +match from 192.0.2.31 set ext-community rt 65520:3 + +match from 2001:db8:1:1::31 set ext-community rt 65520:3 + +match from 192.0.2.41 set ext-community rt 65520:4 + +match from 2001:db8:1:1::41 set ext-community rt 65520:4 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 6' - reject code: 1 +allow quick from group clients max-as-len 6 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: global blacklist +# Reject inbound routes when 'from group clients prefix-set global_black_list_pref' - reject code: 3 +allow quick from group clients prefix-set global_black_list_pref set { + localpref 1 + community 65520:0 + community 65520:3 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS1_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.11 AS { 3, 174 }' - reject code: 8 +allow quick from 192.0.2.11 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.11 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.11 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 192.0.2.11 prefix 11.3.0.0/16 source-as 1011 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.11 prefix 11.4.0.0/16 prefixlen 16 - 32 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.11 prefix 2a11:3::/32 source-as 1011 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.11 prefix 2a11:4::/32 prefixlen 32 - 128 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 192.0.2.11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_1, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.11 source-as as-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. +match from 192.0.2.11 source-as as-set AS_SET_WHITE_LIST_AS1_1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS1_1 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_1, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.11 prefix-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. +match from 192.0.2.11 prefix-set AS_SET_WHITE_LIST_AS1_1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS1_1 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_REGISTROBRDB community have the prefix validated by a NICBR Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_REGISTROBRDB set ext-community delete $INTCOMM_IRR_REJECT + +# route authorized by a client's white list? +match from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 192.0.2.11 set ext-community delete rt 65520:1 + + +# Remove internal communities before accepting the route +match from 192.0.2.11 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.11 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.11 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.11 community BLACKHOLE set community 65530:4 +match from 192.0.2.11 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.11 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.11 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.11 community BLACKHOLE +allow quick from 192.0.2.11 community 65534:0 +allow quick from 192.0.2.11 large-community 65534:0:0 + + +match from 192.0.2.11 set ext-community rt 65520:1 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.11 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 192.0.2.11 community 65534:0 set community BLACKHOLE +match to 192.0.2.11 large-community 65534:0:0 set community BLACKHOLE + +match to 192.0.2.11 community BLACKHOLE set community NO_EXPORT +match to 192.0.2.11 community BLACKHOLE set nexthop 192.0.2.66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.11 community 65507:999 set community NO_EXPORT +match to 192.0.2.11 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.11 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.11 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.11 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.11 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.11 community 65509:1 set community NO_EXPORT +match to 192.0.2.11 ext-community rt 65509:1 set community NO_EXPORT +match to 192.0.2.11 large-community 999:65509:1 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.11 community 65510:1 set community NO_ADVERTISE +match to 192.0.2.11 ext-community rt 65510:1 set community NO_ADVERTISE +match to 192.0.2.11 large-community 999:65510:1 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.11 + +# do_not_announce_to_any +deny to 192.0.2.11 community 0:999 +deny to 192.0.2.11 ext-community rt 0:999 +deny to 192.0.2.11 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.11 community 0:1 +deny quick to 192.0.2.11 ext-community rt 0:1 +deny quick to 192.0.2.11 large-community 999:0:1 + +# announce_to_peer +allow to 192.0.2.11 community 65501:1 +allow to 192.0.2.11 ext-community rt 65501:1 +allow to 192.0.2.11 large-community 999:65501:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS1_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS { 3, 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::11 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::11 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 2001:db8:1:1::11 prefix 11.3.0.0/16 source-as 1011 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::11 prefix 11.4.0.0/16 prefixlen 16 - 32 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::11 prefix 2a11:3::/32 source-as 1011 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::11 prefix 2a11:4::/32 prefixlen 32 - 128 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 2001:db8:1:1::11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_2, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::11 source-as as-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS1_AS_AS1_CUSTOMERS +match from 2001:db8:1:1::11 source-as as-set AS_SET_WHITE_LIST_AS1_2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS1_2 +# AS-SET AS1 referenced but empty. + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_2, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::11 prefix-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS1_AS_AS1_CUSTOMERS +match from 2001:db8:1:1::11 prefix-set AS_SET_WHITE_LIST_AS1_2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS1_2 +# AS-SET AS1 referenced but empty. + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_REGISTROBRDB community have the prefix validated by a NICBR Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_REGISTROBRDB set ext-community delete $INTCOMM_IRR_REJECT + +# route authorized by a client's white list? +match from 2001:db8:1:1::11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::11 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::11 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::11 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::11 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::11 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::11 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::11 community BLACKHOLE +allow quick from 2001:db8:1:1::11 community 65534:0 +allow quick from 2001:db8:1:1::11 large-community 65534:0:0 + + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::11 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::11 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::11 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + +deny quick to 2001:db8:1:1::11 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 2001:db8:1:1::11 community 65534:0 set community BLACKHOLE +match to 2001:db8:1:1::11 large-community 65534:0:0 set community BLACKHOLE + +match to 2001:db8:1:1::11 community BLACKHOLE set community NO_EXPORT +match to 2001:db8:1:1::11 community BLACKHOLE set nexthop 2001:db8:1:1::66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::11 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::11 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::11 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::11 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::11 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::11 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::11 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::11 community 65509:1 set community NO_EXPORT +match to 2001:db8:1:1::11 ext-community rt 65509:1 set community NO_EXPORT +match to 2001:db8:1:1::11 large-community 999:65509:1 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::11 community 65510:1 set community NO_ADVERTISE +match to 2001:db8:1:1::11 ext-community rt 65510:1 set community NO_ADVERTISE +match to 2001:db8:1:1::11 large-community 999:65510:1 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::11 + +# do_not_announce_to_any +deny to 2001:db8:1:1::11 community 0:999 +deny to 2001:db8:1:1::11 ext-community rt 0:999 +deny to 2001:db8:1:1::11 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::11 community 0:1 +deny quick to 2001:db8:1:1::11 ext-community rt 0:1 +deny quick to 2001:db8:1:1::11 large-community 999:0:1 + +# do_not_announce_to_peers_with_rtt_lower_than 5 ms +deny to 2001:db8:1:1::11 community 64530:5 +deny to 2001:db8:1:1::11 ext-community rt 64530:5 +deny to 2001:db8:1:1::11 large-community 999:64530:5 + + +# do_not_announce_to_peers_with_rtt_lower_than 10 ms +deny to 2001:db8:1:1::11 community 64530:10 +deny to 2001:db8:1:1::11 ext-community rt 64530:10 +deny to 2001:db8:1:1::11 large-community 999:64530:10 + + +# do_not_announce_to_peers_with_rtt_lower_than 15 ms +deny to 2001:db8:1:1::11 community 64530:15 +deny to 2001:db8:1:1::11 ext-community rt 64530:15 +deny to 2001:db8:1:1::11 large-community 999:64530:15 + + +# do_not_announce_to_peers_with_rtt_lower_than 20 ms +deny to 2001:db8:1:1::11 community 64530:20 +deny to 2001:db8:1:1::11 ext-community rt 64530:20 +deny to 2001:db8:1:1::11 large-community 999:64530:20 + + +# do_not_announce_to_peers_with_rtt_lower_than 30 ms +deny to 2001:db8:1:1::11 community 64530:30 +deny to 2001:db8:1:1::11 ext-community rt 64530:30 +deny to 2001:db8:1:1::11 large-community 999:64530:30 + + +# do_not_announce_to_peers_with_rtt_lower_than 50 ms +deny to 2001:db8:1:1::11 community 64530:50 +deny to 2001:db8:1:1::11 ext-community rt 64530:50 +deny to 2001:db8:1:1::11 large-community 999:64530:50 + + +# do_not_announce_to_peers_with_rtt_lower_than 100 ms +deny to 2001:db8:1:1::11 community 64530:100 +deny to 2001:db8:1:1::11 ext-community rt 64530:100 +deny to 2001:db8:1:1::11 large-community 999:64530:100 + + +# do_not_announce_to_peers_with_rtt_lower_than 200 ms +deny to 2001:db8:1:1::11 community 64530:200 +deny to 2001:db8:1:1::11 ext-community rt 64530:200 +deny to 2001:db8:1:1::11 large-community 999:64530:200 + + +# do_not_announce_to_peers_with_rtt_lower_than 500 ms +deny to 2001:db8:1:1::11 community 64530:500 +deny to 2001:db8:1:1::11 ext-community rt 64530:500 +deny to 2001:db8:1:1::11 large-community 999:64530:500 + + +# announce_to_peers_with_rtt_lower_than 5 ms +allow to 2001:db8:1:1::11 community 64532:5 +allow to 2001:db8:1:1::11 ext-community rt 64532:5 +allow to 2001:db8:1:1::11 large-community 999:64532:5 + + +# announce_to_peers_with_rtt_lower_than 10 ms +allow to 2001:db8:1:1::11 community 64532:10 +allow to 2001:db8:1:1::11 ext-community rt 64532:10 +allow to 2001:db8:1:1::11 large-community 999:64532:10 + + +# announce_to_peers_with_rtt_lower_than 15 ms +allow to 2001:db8:1:1::11 community 64532:15 +allow to 2001:db8:1:1::11 ext-community rt 64532:15 +allow to 2001:db8:1:1::11 large-community 999:64532:15 + + +# announce_to_peers_with_rtt_lower_than 20 ms +allow to 2001:db8:1:1::11 community 64532:20 +allow to 2001:db8:1:1::11 ext-community rt 64532:20 +allow to 2001:db8:1:1::11 large-community 999:64532:20 + + +# announce_to_peers_with_rtt_lower_than 30 ms +allow to 2001:db8:1:1::11 community 64532:30 +allow to 2001:db8:1:1::11 ext-community rt 64532:30 +allow to 2001:db8:1:1::11 large-community 999:64532:30 + + +# announce_to_peers_with_rtt_lower_than 50 ms +allow to 2001:db8:1:1::11 community 64532:50 +allow to 2001:db8:1:1::11 ext-community rt 64532:50 +allow to 2001:db8:1:1::11 large-community 999:64532:50 + + +# announce_to_peers_with_rtt_lower_than 100 ms +allow to 2001:db8:1:1::11 community 64532:100 +allow to 2001:db8:1:1::11 ext-community rt 64532:100 +allow to 2001:db8:1:1::11 large-community 999:64532:100 + + +# announce_to_peers_with_rtt_lower_than 200 ms +allow to 2001:db8:1:1::11 community 64532:200 +allow to 2001:db8:1:1::11 ext-community rt 64532:200 +allow to 2001:db8:1:1::11 large-community 999:64532:200 + + +# announce_to_peers_with_rtt_lower_than 500 ms +allow to 2001:db8:1:1::11 community 64532:500 +allow to 2001:db8:1:1::11 ext-community rt 64532:500 +allow to 2001:db8:1:1::11 large-community 999:64532:500 + + +# announce_to_peer +allow to 2001:db8:1:1::11 community 65501:1 +allow to 2001:db8:1:1::11 ext-community rt 65501:1 +allow to 2001:db8:1:1::11 large-community 999:65501:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS1_3, inbound + + + +# NEXT_HOP +match from 192.0.2.12 set community NO_ADVERTISE +match from 192.0.2.12 nexthop 192.0.2.11 set community delete NO_ADVERTISE +match from 192.0.2.12 nexthop 192.0.2.12 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.12 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.12 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.12 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.12 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.12 AS 23456' - reject code: 7 +allow quick from 192.0.2.12 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.12 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.12 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.12 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.12 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.12 AS { 3, 174 }' - reject code: 8 +allow quick from 192.0.2.12 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.12 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.12 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +match from 192.0.2.12 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_3, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.12 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.12 source-as as-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_3, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.12 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.12 prefix-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.12 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.12 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_REGISTROBRDB community have the prefix validated by a NICBR Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.12 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_REGISTROBRDB set ext-community delete $INTCOMM_IRR_REJECT + + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 192.0.2.12 set ext-community delete rt 65520:1 + + +# Remove internal communities before accepting the route +match from 192.0.2.12 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.12 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.12 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.12 community BLACKHOLE set community 65530:4 +match from 192.0.2.12 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.12 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.12 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.12 community BLACKHOLE +allow quick from 192.0.2.12 community 65534:0 +allow quick from 192.0.2.12 large-community 65534:0:0 + + +match from 192.0.2.12 set ext-community rt 65520:1 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.12 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.12 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.12 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.12 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.12 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 192.0.2.12 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.12 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.12 + + + +# --------------------------------------------- +# client AS1_3, outbound + +deny quick to 192.0.2.12 community 65520:0 + + + +# Blackhole request? +# Client not enabled to receive blackhole routes +deny quick to 192.0.2.12 community BLACKHOLE +deny quick to 192.0.2.12 community 65534:0 +deny quick to 192.0.2.12 large-community 65534:0:0 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.12 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.12 community 65507:999 set community NO_EXPORT +match to 192.0.2.12 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.12 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.12 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.12 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.12 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.12 community 65509:1 set community NO_EXPORT +match to 192.0.2.12 ext-community rt 65509:1 set community NO_EXPORT +match to 192.0.2.12 large-community 999:65509:1 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.12 community 65510:1 set community NO_ADVERTISE +match to 192.0.2.12 ext-community rt 65510:1 set community NO_ADVERTISE +match to 192.0.2.12 large-community 999:65510:1 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.12 + +# do_not_announce_to_any +deny to 192.0.2.12 community 0:999 +deny to 192.0.2.12 ext-community rt 0:999 +deny to 192.0.2.12 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.12 community 0:1 +deny quick to 192.0.2.12 ext-community rt 0:1 +deny quick to 192.0.2.12 large-community 999:0:1 + +# announce_to_peer +allow to 192.0.2.12 community 65501:1 +allow to 192.0.2.12 ext-community rt 65501:1 +allow to 192.0.2.12 large-community 999:65501:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.12 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS1_4, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::12 set community NO_ADVERTISE +match from 2001:db8:1:1::12 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +match from 2001:db8:1:1::12 nexthop 2001:db8:1:1::12 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::12 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::12 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::12 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::12 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::12 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::12 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::12 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::12 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::12 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::12 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::12 AS { 3, 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::12 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::12 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::12 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +match from 2001:db8:1:1::12 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_4, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::12 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::12 source-as as-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_4, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::12 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::12 prefix-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::12 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::12 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_REGISTROBRDB community have the prefix validated by a NICBR Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::12 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_REGISTROBRDB set ext-community delete $INTCOMM_IRR_REJECT + + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 2001:db8:1:1::12 set ext-community delete rt 65520:1 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::12 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::12 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::12 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::12 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::12 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::12 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::12 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::12 community BLACKHOLE +allow quick from 2001:db8:1:1::12 community 65534:0 +allow quick from 2001:db8:1:1::12 large-community 65534:0:0 + + +match from 2001:db8:1:1::12 set ext-community rt 65520:1 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::12 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::12 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::12 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::12 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::12 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::12 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::12 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::12 + + + +# --------------------------------------------- +# client AS1_4, outbound + +deny quick to 2001:db8:1:1::12 community 65520:0 + + + +# Blackhole request? +# Client not enabled to receive blackhole routes +deny quick to 2001:db8:1:1::12 community BLACKHOLE +deny quick to 2001:db8:1:1::12 community 65534:0 +deny quick to 2001:db8:1:1::12 large-community 65534:0:0 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::12 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::12 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::12 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::12 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::12 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::12 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::12 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::12 community 65509:1 set community NO_EXPORT +match to 2001:db8:1:1::12 ext-community rt 65509:1 set community NO_EXPORT +match to 2001:db8:1:1::12 large-community 999:65509:1 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::12 community 65510:1 set community NO_ADVERTISE +match to 2001:db8:1:1::12 ext-community rt 65510:1 set community NO_ADVERTISE +match to 2001:db8:1:1::12 large-community 999:65510:1 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::12 + +# do_not_announce_to_any +deny to 2001:db8:1:1::12 community 0:999 +deny to 2001:db8:1:1::12 ext-community rt 0:999 +deny to 2001:db8:1:1::12 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::12 community 0:1 +deny quick to 2001:db8:1:1::12 ext-community rt 0:1 +deny quick to 2001:db8:1:1::12 large-community 999:0:1 + +# do_not_announce_to_peers_with_rtt_lower_than 5 ms +deny to 2001:db8:1:1::12 community 64530:5 +deny to 2001:db8:1:1::12 ext-community rt 64530:5 +deny to 2001:db8:1:1::12 large-community 999:64530:5 + + +# do_not_announce_to_peers_with_rtt_lower_than 10 ms +deny to 2001:db8:1:1::12 community 64530:10 +deny to 2001:db8:1:1::12 ext-community rt 64530:10 +deny to 2001:db8:1:1::12 large-community 999:64530:10 + + +# do_not_announce_to_peers_with_rtt_lower_than 15 ms +deny to 2001:db8:1:1::12 community 64530:15 +deny to 2001:db8:1:1::12 ext-community rt 64530:15 +deny to 2001:db8:1:1::12 large-community 999:64530:15 + + +# do_not_announce_to_peers_with_rtt_lower_than 20 ms +deny to 2001:db8:1:1::12 community 64530:20 +deny to 2001:db8:1:1::12 ext-community rt 64530:20 +deny to 2001:db8:1:1::12 large-community 999:64530:20 + + +# do_not_announce_to_peers_with_rtt_lower_than 30 ms +deny to 2001:db8:1:1::12 community 64530:30 +deny to 2001:db8:1:1::12 ext-community rt 64530:30 +deny to 2001:db8:1:1::12 large-community 999:64530:30 + + +# do_not_announce_to_peers_with_rtt_lower_than 50 ms +deny to 2001:db8:1:1::12 community 64530:50 +deny to 2001:db8:1:1::12 ext-community rt 64530:50 +deny to 2001:db8:1:1::12 large-community 999:64530:50 + + +# do_not_announce_to_peers_with_rtt_lower_than 100 ms +deny to 2001:db8:1:1::12 community 64530:100 +deny to 2001:db8:1:1::12 ext-community rt 64530:100 +deny to 2001:db8:1:1::12 large-community 999:64530:100 + + +# do_not_announce_to_peers_with_rtt_lower_than 200 ms +deny to 2001:db8:1:1::12 community 64530:200 +deny to 2001:db8:1:1::12 ext-community rt 64530:200 +deny to 2001:db8:1:1::12 large-community 999:64530:200 + + +# do_not_announce_to_peers_with_rtt_lower_than 500 ms +deny to 2001:db8:1:1::12 community 64530:500 +deny to 2001:db8:1:1::12 ext-community rt 64530:500 +deny to 2001:db8:1:1::12 large-community 999:64530:500 + + +# announce_to_peers_with_rtt_lower_than 5 ms +allow to 2001:db8:1:1::12 community 64532:5 +allow to 2001:db8:1:1::12 ext-community rt 64532:5 +allow to 2001:db8:1:1::12 large-community 999:64532:5 + + +# announce_to_peers_with_rtt_lower_than 10 ms +allow to 2001:db8:1:1::12 community 64532:10 +allow to 2001:db8:1:1::12 ext-community rt 64532:10 +allow to 2001:db8:1:1::12 large-community 999:64532:10 + + +# announce_to_peers_with_rtt_lower_than 15 ms +allow to 2001:db8:1:1::12 community 64532:15 +allow to 2001:db8:1:1::12 ext-community rt 64532:15 +allow to 2001:db8:1:1::12 large-community 999:64532:15 + + +# announce_to_peers_with_rtt_lower_than 20 ms +allow to 2001:db8:1:1::12 community 64532:20 +allow to 2001:db8:1:1::12 ext-community rt 64532:20 +allow to 2001:db8:1:1::12 large-community 999:64532:20 + + +# announce_to_peers_with_rtt_lower_than 30 ms +allow to 2001:db8:1:1::12 community 64532:30 +allow to 2001:db8:1:1::12 ext-community rt 64532:30 +allow to 2001:db8:1:1::12 large-community 999:64532:30 + + +# announce_to_peers_with_rtt_lower_than 50 ms +allow to 2001:db8:1:1::12 community 64532:50 +allow to 2001:db8:1:1::12 ext-community rt 64532:50 +allow to 2001:db8:1:1::12 large-community 999:64532:50 + + +# announce_to_peers_with_rtt_lower_than 100 ms +allow to 2001:db8:1:1::12 community 64532:100 +allow to 2001:db8:1:1::12 ext-community rt 64532:100 +allow to 2001:db8:1:1::12 large-community 999:64532:100 + + +# announce_to_peers_with_rtt_lower_than 200 ms +allow to 2001:db8:1:1::12 community 64532:200 +allow to 2001:db8:1:1::12 ext-community rt 64532:200 +allow to 2001:db8:1:1::12 large-community 999:64532:200 + + +# announce_to_peers_with_rtt_lower_than 500 ms +allow to 2001:db8:1:1::12 community 64532:500 +allow to 2001:db8:1:1::12 ext-community rt 64532:500 +allow to 2001:db8:1:1::12 large-community 999:64532:500 + + +# announce_to_peer +allow to 2001:db8:1:1::12 community 65501:1 +allow to 2001:db8:1:1::12 ext-community rt 65501:1 +allow to 2001:db8:1:1::12 large-community 999:65501:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::12 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS222_1, inbound + + + +# NEXT_HOP +match from 192.0.2.222 set community NO_ADVERTISE +match from 192.0.2.222 nexthop 192.0.2.222 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.222 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.222 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.222 peer-as != 222' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.222 peer-as != 222 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.222 AS 23456' - reject code: 7 +allow quick from 192.0.2.222 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.222 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.222 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.222 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.222 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.222 AS { 3, 174 }' - reject code: 8 +allow quick from 192.0.2.222 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.222 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.222 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 192.0.2.222 prefix 222.1.1.0/24 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.222 prefix 3222:0:1::/48 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 192.0.2.222 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS222_1, AS222: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.222 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS222 referenced but empty. +match from 192.0.2.222 source-as as-set AS_SET_AS_AS222_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS222 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS222_1, AS222: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.222 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS222 referenced but empty. +match from 192.0.2.222 prefix-set AS_SET_AS_AS222_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS222 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.222 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.222 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_REGISTROBRDB community have the prefix validated by a NICBR Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.222 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_REGISTROBRDB set ext-community delete $INTCOMM_IRR_REJECT + +# route authorized by a client's white list? +match from 192.0.2.222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 192.0.2.222 set ext-community delete rt 65520:222 + + +# Remove internal communities before accepting the route +match from 192.0.2.222 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.222 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.222 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.222 community BLACKHOLE set community 65530:4 +match from 192.0.2.222 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.222 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.222 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.222 community BLACKHOLE +allow quick from 192.0.2.222 community 65534:0 +allow quick from 192.0.2.222 large-community 65534:0:0 + + +match from 192.0.2.222 set ext-community rt 65520:222 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.222 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.222 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.222 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.222 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.222 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 192.0.2.222 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.222 set ext-community delete rt 65520:222 + + + +allow quick from 192.0.2.222 + + + +# --------------------------------------------- +# client AS222_1, outbound + +deny quick to 192.0.2.222 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 192.0.2.222 community 65534:0 set community BLACKHOLE +match to 192.0.2.222 large-community 65534:0:0 set community BLACKHOLE + +match to 192.0.2.222 community BLACKHOLE set community NO_EXPORT +match to 192.0.2.222 community BLACKHOLE set nexthop 192.0.2.66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.222 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.222 community 65507:999 set community NO_EXPORT +match to 192.0.2.222 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.222 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.222 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.222 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.222 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.222 community 65509:222 set community NO_EXPORT +match to 192.0.2.222 ext-community rt 65509:222 set community NO_EXPORT +match to 192.0.2.222 large-community 999:65509:222 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.222 community 65510:222 set community NO_ADVERTISE +match to 192.0.2.222 ext-community rt 65510:222 set community NO_ADVERTISE +match to 192.0.2.222 large-community 999:65510:222 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.222 + +# do_not_announce_to_any +deny to 192.0.2.222 community 0:999 +deny to 192.0.2.222 ext-community rt 0:999 +deny to 192.0.2.222 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.222 community 0:222 +deny quick to 192.0.2.222 ext-community rt 0:222 +deny quick to 192.0.2.222 large-community 999:0:222 + +# announce_to_peer +allow to 192.0.2.222 community 65501:222 +allow to 192.0.2.222 ext-community rt 65501:222 +allow to 192.0.2.222 large-community 999:65501:222 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.222 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS222_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::222 set community NO_ADVERTISE +match from 2001:db8:1:1::222 nexthop 2001:db8:1:1::222 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::222 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::222 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::222 peer-as != 222' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::222 peer-as != 222 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::222 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::222 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::222 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::222 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::222 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::222 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::222 AS { 3, 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::222 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::222 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::222 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 2001:db8:1:1::222 prefix 222.1.1.0/24 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::222 prefix 3222:0:1::/48 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 2001:db8:1:1::222 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS222_2, AS222: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::222 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS222 referenced but empty. +match from 2001:db8:1:1::222 source-as as-set AS_SET_AS_AS222_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS222 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS222_2, AS222: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::222 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS222 referenced but empty. +match from 2001:db8:1:1::222 prefix-set AS_SET_AS_AS222_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS222 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::222 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::222 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_REGISTROBRDB community have the prefix validated by a NICBR Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::222 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_REGISTROBRDB set ext-community delete $INTCOMM_IRR_REJECT + +# route authorized by a client's white list? +match from 2001:db8:1:1::222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 2001:db8:1:1::222 set ext-community delete rt 65520:222 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::222 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::222 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::222 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::222 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::222 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::222 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::222 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::222 community BLACKHOLE +allow quick from 2001:db8:1:1::222 community 65534:0 +allow quick from 2001:db8:1:1::222 large-community 65534:0:0 + + +match from 2001:db8:1:1::222 set ext-community rt 65520:222 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::222 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::222 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::222 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::222 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::222 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::222 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::222 set ext-community delete rt 65520:222 + + + +allow quick from 2001:db8:1:1::222 + + + +# --------------------------------------------- +# client AS222_2, outbound + +deny quick to 2001:db8:1:1::222 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 2001:db8:1:1::222 community 65534:0 set community BLACKHOLE +match to 2001:db8:1:1::222 large-community 65534:0:0 set community BLACKHOLE + +match to 2001:db8:1:1::222 community BLACKHOLE set community NO_EXPORT +match to 2001:db8:1:1::222 community BLACKHOLE set nexthop 2001:db8:1:1::66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::222 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::222 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::222 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::222 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::222 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::222 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::222 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::222 community 65509:222 set community NO_EXPORT +match to 2001:db8:1:1::222 ext-community rt 65509:222 set community NO_EXPORT +match to 2001:db8:1:1::222 large-community 999:65509:222 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::222 community 65510:222 set community NO_ADVERTISE +match to 2001:db8:1:1::222 ext-community rt 65510:222 set community NO_ADVERTISE +match to 2001:db8:1:1::222 large-community 999:65510:222 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::222 + +# do_not_announce_to_any +deny to 2001:db8:1:1::222 community 0:999 +deny to 2001:db8:1:1::222 ext-community rt 0:999 +deny to 2001:db8:1:1::222 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::222 community 0:222 +deny quick to 2001:db8:1:1::222 ext-community rt 0:222 +deny quick to 2001:db8:1:1::222 large-community 999:0:222 + +# announce_to_peer +allow to 2001:db8:1:1::222 community 65501:222 +allow to 2001:db8:1:1::222 ext-community rt 65501:222 +allow to 2001:db8:1:1::222 large-community 999:65501:222 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::222 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.21 set community NO_ADVERTISE +match from 192.0.2.21 nexthop 192.0.2.21 set community delete NO_ADVERTISE +match from 192.0.2.21 nexthop 192.0.2.22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.21 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.21 AS 23456' - reject code: 7 +allow quick from 192.0.2.21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.21 AS { 3, 174 }' - reject code: 8 +allow quick from 192.0.2.21 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.21 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.21 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +match from 192.0.2.21 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS2_1, AS2: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.21 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 192.0.2.21 source-as as-set AS_SET_AS_AS2_AS_AS2_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS2_AS_AS2_CUSTOMERS + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS2_1, AS2: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.21 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 192.0.2.21 prefix-set AS_SET_AS_AS2_AS_AS2_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS2_AS_AS2_CUSTOMERS + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_REGISTROBRDB community have the prefix validated by a NICBR Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_REGISTROBRDB set ext-community delete $INTCOMM_IRR_REJECT + + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 192.0.2.21 set ext-community delete rt 65520:2 + + +# Remove internal communities before accepting the route +match from 192.0.2.21 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.21 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.21 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.21 community BLACKHOLE set community 65530:4 +match from 192.0.2.21 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.21 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.21 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.21 community BLACKHOLE +allow quick from 192.0.2.21 community 65534:0 +allow quick from 192.0.2.21 large-community 65534:0:0 + + +match from 192.0.2.21 set ext-community rt 65520:2 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.21 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.21 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.21 community GRACEFUL_SHUTDOWN set community delete GRACEFUL_SHUTDOWN + +# Remove internal communities before accepting the route +match from 192.0.2.21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.21 set ext-community delete rt 65520:2 + + + +allow quick from 192.0.2.21 + + + +# --------------------------------------------- +# client AS2_1, outbound + +deny quick to 192.0.2.21 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 192.0.2.21 community 65534:0 set community BLACKHOLE +match to 192.0.2.21 large-community 65534:0:0 set community BLACKHOLE + +match to 192.0.2.21 community BLACKHOLE set community NO_EXPORT +match to 192.0.2.21 community BLACKHOLE set nexthop 192.0.2.66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.21 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.21 community 65507:999 set community NO_EXPORT +match to 192.0.2.21 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.21 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.21 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.21 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.21 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.21 community 65509:2 set community NO_EXPORT +match to 192.0.2.21 ext-community rt 65509:2 set community NO_EXPORT +match to 192.0.2.21 large-community 999:65509:2 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.21 community 65510:2 set community NO_ADVERTISE +match to 192.0.2.21 ext-community rt 65510:2 set community NO_ADVERTISE +match to 192.0.2.21 large-community 999:65510:2 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.21 + +# do_not_announce_to_any +deny to 192.0.2.21 community 0:999 +deny to 192.0.2.21 ext-community rt 0:999 +deny to 192.0.2.21 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.21 community 0:2 +deny quick to 192.0.2.21 ext-community rt 0:2 +deny quick to 192.0.2.21 large-community 999:0:2 + +# announce_to_peer +allow to 192.0.2.21 community 65501:2 +allow to 192.0.2.21 ext-community rt 65501:2 +allow to 192.0.2.21 large-community 999:65501:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::21 set community NO_ADVERTISE +match from 2001:db8:1:1::21 nexthop 2001:db8:1:1::21 set community delete NO_ADVERTISE +match from 2001:db8:1:1::21 nexthop 2001:db8:1:1::22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::21 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS { 3, 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::21 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::21 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +match from 2001:db8:1:1::21 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS2_2, AS2: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::21 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 2001:db8:1:1::21 source-as as-set AS_SET_AS_AS2_AS_AS2_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS2_AS_AS2_CUSTOMERS + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS2_2, AS2: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::21 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 2001:db8:1:1::21 prefix-set AS_SET_AS_AS2_AS_AS2_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS2_AS_AS2_CUSTOMERS + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_REGISTROBRDB community have the prefix validated by a NICBR Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_REGISTROBRDB set ext-community delete $INTCOMM_IRR_REJECT + + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 2001:db8:1:1::21 set ext-community delete rt 65520:2 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::21 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::21 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::21 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::21 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::21 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::21 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::21 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::21 community BLACKHOLE +allow quick from 2001:db8:1:1::21 community 65534:0 +allow quick from 2001:db8:1:1::21 large-community 65534:0:0 + + +match from 2001:db8:1:1::21 set ext-community rt 65520:2 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::21 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::21 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::21 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::21 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::21 community GRACEFUL_SHUTDOWN set community delete GRACEFUL_SHUTDOWN + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::21 set ext-community delete rt 65520:2 + + + +allow quick from 2001:db8:1:1::21 + + + +# --------------------------------------------- +# client AS2_2, outbound + +deny quick to 2001:db8:1:1::21 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 2001:db8:1:1::21 community 65534:0 set community BLACKHOLE +match to 2001:db8:1:1::21 large-community 65534:0:0 set community BLACKHOLE + +match to 2001:db8:1:1::21 community BLACKHOLE set community NO_EXPORT +match to 2001:db8:1:1::21 community BLACKHOLE set nexthop 2001:db8:1:1::66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::21 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::21 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::21 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::21 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::21 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::21 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::21 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::21 community 65509:2 set community NO_EXPORT +match to 2001:db8:1:1::21 ext-community rt 65509:2 set community NO_EXPORT +match to 2001:db8:1:1::21 large-community 999:65509:2 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::21 community 65510:2 set community NO_ADVERTISE +match to 2001:db8:1:1::21 ext-community rt 65510:2 set community NO_ADVERTISE +match to 2001:db8:1:1::21 large-community 999:65510:2 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::21 + +# do_not_announce_to_any +deny to 2001:db8:1:1::21 community 0:999 +deny to 2001:db8:1:1::21 ext-community rt 0:999 +deny to 2001:db8:1:1::21 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::21 community 0:2 +deny quick to 2001:db8:1:1::21 ext-community rt 0:2 +deny quick to 2001:db8:1:1::21 large-community 999:0:2 + +# do_not_announce_to_peers_with_rtt_lower_than 20 ms +deny to 2001:db8:1:1::21 community 64530:20 +deny to 2001:db8:1:1::21 ext-community rt 64530:20 +deny to 2001:db8:1:1::21 large-community 999:64530:20 + + +# do_not_announce_to_peers_with_rtt_lower_than 30 ms +deny to 2001:db8:1:1::21 community 64530:30 +deny to 2001:db8:1:1::21 ext-community rt 64530:30 +deny to 2001:db8:1:1::21 large-community 999:64530:30 + + +# do_not_announce_to_peers_with_rtt_lower_than 50 ms +deny to 2001:db8:1:1::21 community 64530:50 +deny to 2001:db8:1:1::21 ext-community rt 64530:50 +deny to 2001:db8:1:1::21 large-community 999:64530:50 + + +# do_not_announce_to_peers_with_rtt_lower_than 100 ms +deny to 2001:db8:1:1::21 community 64530:100 +deny to 2001:db8:1:1::21 ext-community rt 64530:100 +deny to 2001:db8:1:1::21 large-community 999:64530:100 + + +# do_not_announce_to_peers_with_rtt_lower_than 200 ms +deny to 2001:db8:1:1::21 community 64530:200 +deny to 2001:db8:1:1::21 ext-community rt 64530:200 +deny to 2001:db8:1:1::21 large-community 999:64530:200 + + +# do_not_announce_to_peers_with_rtt_lower_than 500 ms +deny to 2001:db8:1:1::21 community 64530:500 +deny to 2001:db8:1:1::21 ext-community rt 64530:500 +deny to 2001:db8:1:1::21 large-community 999:64530:500 + + +# announce_to_peers_with_rtt_lower_than 20 ms +allow to 2001:db8:1:1::21 community 64532:20 +allow to 2001:db8:1:1::21 ext-community rt 64532:20 +allow to 2001:db8:1:1::21 large-community 999:64532:20 + + +# announce_to_peers_with_rtt_lower_than 30 ms +allow to 2001:db8:1:1::21 community 64532:30 +allow to 2001:db8:1:1::21 ext-community rt 64532:30 +allow to 2001:db8:1:1::21 large-community 999:64532:30 + + +# announce_to_peers_with_rtt_lower_than 50 ms +allow to 2001:db8:1:1::21 community 64532:50 +allow to 2001:db8:1:1::21 ext-community rt 64532:50 +allow to 2001:db8:1:1::21 large-community 999:64532:50 + + +# announce_to_peers_with_rtt_lower_than 100 ms +allow to 2001:db8:1:1::21 community 64532:100 +allow to 2001:db8:1:1::21 ext-community rt 64532:100 +allow to 2001:db8:1:1::21 large-community 999:64532:100 + + +# announce_to_peers_with_rtt_lower_than 200 ms +allow to 2001:db8:1:1::21 community 64532:200 +allow to 2001:db8:1:1::21 ext-community rt 64532:200 +allow to 2001:db8:1:1::21 large-community 999:64532:200 + + +# announce_to_peers_with_rtt_lower_than 500 ms +allow to 2001:db8:1:1::21 community 64532:500 +allow to 2001:db8:1:1::21 ext-community rt 64532:500 +allow to 2001:db8:1:1::21 large-community 999:64532:500 + + +# do_not_announce_to_peers_with_rtt_higher_than 5 ms +deny to 2001:db8:1:1::21 community 64531:5 +deny to 2001:db8:1:1::21 ext-community rt 64531:5 +deny to 2001:db8:1:1::21 large-community 999:64531:5 + + +# do_not_announce_to_peers_with_rtt_higher_than 10 ms +deny to 2001:db8:1:1::21 community 64531:10 +deny to 2001:db8:1:1::21 ext-community rt 64531:10 +deny to 2001:db8:1:1::21 large-community 999:64531:10 + + +# do_not_announce_to_peers_with_rtt_higher_than 15 ms +deny to 2001:db8:1:1::21 community 64531:15 +deny to 2001:db8:1:1::21 ext-community rt 64531:15 +deny to 2001:db8:1:1::21 large-community 999:64531:15 + + +# announce_to_peers_with_rtt_higher_than 5 ms +allow to 2001:db8:1:1::21 community 64533:5 +allow to 2001:db8:1:1::21 ext-community rt 64533:5 +allow to 2001:db8:1:1::21 large-community 999:64533:5 + + +# announce_to_peers_with_rtt_higher_than 10 ms +allow to 2001:db8:1:1::21 community 64533:10 +allow to 2001:db8:1:1::21 ext-community rt 64533:10 +allow to 2001:db8:1:1::21 large-community 999:64533:10 + + +# announce_to_peers_with_rtt_higher_than 15 ms +allow to 2001:db8:1:1::21 community 64533:15 +allow to 2001:db8:1:1::21 ext-community rt 64533:15 +allow to 2001:db8:1:1::21 large-community 999:64533:15 + + +# announce_to_peer +allow to 2001:db8:1:1::21 community 65501:2 +allow to 2001:db8:1:1::21 ext-community rt 65501:2 +allow to 2001:db8:1:1::21 large-community 999:65501:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS3_1, inbound + + + +# NEXT_HOP +match from 192.0.2.31 set community NO_ADVERTISE +match from 192.0.2.31 nexthop 192.0.2.31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.31 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.31 AS 23456' - reject code: 7 +allow quick from 192.0.2.31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.31 AS { 174 }' - reject code: 8 +allow quick from 192.0.2.31 AS { 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.31 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.31 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +# Prefix: client's blacklist +prefix-set "client_AS3_1_black_list_pref_ipv4" { + 3.0.1.0/24 prefixlen 24 - 32 + +} +# Reject inbound routes when 'from 192.0.2.31 prefix-set client_AS3_1_black_list_pref_ipv4' - reject code: 11 +allow quick from 192.0.2.31 prefix-set client_AS3_1_black_list_pref_ipv4 set { + localpref 1 + community 65520:0 + community 65520:11 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Blackhole request? +match from 192.0.2.31 set ext-community delete rt 65520:3 + + +# Remove internal communities before accepting the route +match from 192.0.2.31 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.31 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.31 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.31 community BLACKHOLE set community 65530:4 +match from 192.0.2.31 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.31 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.31 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.31 community BLACKHOLE +allow quick from 192.0.2.31 community 65534:0 +allow quick from 192.0.2.31 large-community 65534:0:0 + + +match from 192.0.2.31 set ext-community rt 65520:3 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.31 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.31 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.31 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 192.0.2.31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.31 set ext-community delete rt 65520:3 + + + +allow quick from 192.0.2.31 + + + +# --------------------------------------------- +# client AS3_1, outbound + +deny quick to 192.0.2.31 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 192.0.2.31 community 65534:0 set community BLACKHOLE +match to 192.0.2.31 large-community 65534:0:0 set community BLACKHOLE + +match to 192.0.2.31 community BLACKHOLE set community NO_EXPORT +match to 192.0.2.31 community BLACKHOLE set nexthop 192.0.2.66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.31 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.31 community 65507:999 set community NO_EXPORT +match to 192.0.2.31 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.31 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.31 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.31 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.31 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.31 community 65509:3 set community NO_EXPORT +match to 192.0.2.31 ext-community rt 65509:3 set community NO_EXPORT +match to 192.0.2.31 large-community 999:65509:3 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.31 community 65510:3 set community NO_ADVERTISE +match to 192.0.2.31 ext-community rt 65510:3 set community NO_ADVERTISE +match to 192.0.2.31 large-community 999:65510:3 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.31 + +# do_not_announce_to_any +deny to 192.0.2.31 community 0:999 +deny to 192.0.2.31 ext-community rt 0:999 +deny to 192.0.2.31 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.31 community 0:3 +deny quick to 192.0.2.31 ext-community rt 0:3 +deny quick to 192.0.2.31 large-community 999:0:3 + +# announce_to_peer +allow to 192.0.2.31 community 65501:3 +allow to 192.0.2.31 ext-community rt 65501:3 +allow to 192.0.2.31 large-community 999:65501:3 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS3_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::31 set community NO_ADVERTISE +match from 2001:db8:1:1::31 nexthop 2001:db8:1:1::31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::31 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::31 AS { 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::31 AS { 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::31 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::31 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +# Prefix: client's blacklist +prefix-set "client_AS3_2_black_list_pref_ipv6" { + 2a03:0:1::/48 prefixlen 48 - 128 + +} +# Reject inbound routes when 'from 2001:db8:1:1::31 prefix-set client_AS3_2_black_list_pref_ipv6' - reject code: 11 +allow quick from 2001:db8:1:1::31 prefix-set client_AS3_2_black_list_pref_ipv6 set { + localpref 1 + community 65520:0 + community 65520:11 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Blackhole request? +match from 2001:db8:1:1::31 set ext-community delete rt 65520:3 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::31 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::31 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::31 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::31 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::31 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::31 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::31 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::31 community BLACKHOLE +allow quick from 2001:db8:1:1::31 community 65534:0 +allow quick from 2001:db8:1:1::31 large-community 65534:0:0 + + +match from 2001:db8:1:1::31 set ext-community rt 65520:3 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::31 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::31 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::31 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::31 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::31 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::31 set ext-community delete rt 65520:3 + + + +allow quick from 2001:db8:1:1::31 + + + +# --------------------------------------------- +# client AS3_2, outbound + +deny quick to 2001:db8:1:1::31 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 2001:db8:1:1::31 community 65534:0 set community BLACKHOLE +match to 2001:db8:1:1::31 large-community 65534:0:0 set community BLACKHOLE + +match to 2001:db8:1:1::31 community BLACKHOLE set community NO_EXPORT +match to 2001:db8:1:1::31 community BLACKHOLE set nexthop 2001:db8:1:1::66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::31 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::31 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::31 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::31 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::31 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::31 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::31 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::31 community 65509:3 set community NO_EXPORT +match to 2001:db8:1:1::31 ext-community rt 65509:3 set community NO_EXPORT +match to 2001:db8:1:1::31 large-community 999:65509:3 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::31 community 65510:3 set community NO_ADVERTISE +match to 2001:db8:1:1::31 ext-community rt 65510:3 set community NO_ADVERTISE +match to 2001:db8:1:1::31 large-community 999:65510:3 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::31 + +# do_not_announce_to_any +deny to 2001:db8:1:1::31 community 0:999 +deny to 2001:db8:1:1::31 ext-community rt 0:999 +deny to 2001:db8:1:1::31 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::31 community 0:3 +deny quick to 2001:db8:1:1::31 ext-community rt 0:3 +deny quick to 2001:db8:1:1::31 large-community 999:0:3 + +# do_not_announce_to_peers_with_rtt_lower_than 200 ms +deny to 2001:db8:1:1::31 community 64530:200 +deny to 2001:db8:1:1::31 ext-community rt 64530:200 +deny to 2001:db8:1:1::31 large-community 999:64530:200 + + +# do_not_announce_to_peers_with_rtt_lower_than 500 ms +deny to 2001:db8:1:1::31 community 64530:500 +deny to 2001:db8:1:1::31 ext-community rt 64530:500 +deny to 2001:db8:1:1::31 large-community 999:64530:500 + + +# announce_to_peers_with_rtt_lower_than 200 ms +allow to 2001:db8:1:1::31 community 64532:200 +allow to 2001:db8:1:1::31 ext-community rt 64532:200 +allow to 2001:db8:1:1::31 large-community 999:64532:200 + + +# announce_to_peers_with_rtt_lower_than 500 ms +allow to 2001:db8:1:1::31 community 64532:500 +allow to 2001:db8:1:1::31 ext-community rt 64532:500 +allow to 2001:db8:1:1::31 large-community 999:64532:500 + + +# do_not_announce_to_peers_with_rtt_higher_than 5 ms +deny to 2001:db8:1:1::31 community 64531:5 +deny to 2001:db8:1:1::31 ext-community rt 64531:5 +deny to 2001:db8:1:1::31 large-community 999:64531:5 + + +# do_not_announce_to_peers_with_rtt_higher_than 10 ms +deny to 2001:db8:1:1::31 community 64531:10 +deny to 2001:db8:1:1::31 ext-community rt 64531:10 +deny to 2001:db8:1:1::31 large-community 999:64531:10 + + +# do_not_announce_to_peers_with_rtt_higher_than 15 ms +deny to 2001:db8:1:1::31 community 64531:15 +deny to 2001:db8:1:1::31 ext-community rt 64531:15 +deny to 2001:db8:1:1::31 large-community 999:64531:15 + + +# do_not_announce_to_peers_with_rtt_higher_than 20 ms +deny to 2001:db8:1:1::31 community 64531:20 +deny to 2001:db8:1:1::31 ext-community rt 64531:20 +deny to 2001:db8:1:1::31 large-community 999:64531:20 + + +# do_not_announce_to_peers_with_rtt_higher_than 30 ms +deny to 2001:db8:1:1::31 community 64531:30 +deny to 2001:db8:1:1::31 ext-community rt 64531:30 +deny to 2001:db8:1:1::31 large-community 999:64531:30 + + +# do_not_announce_to_peers_with_rtt_higher_than 50 ms +deny to 2001:db8:1:1::31 community 64531:50 +deny to 2001:db8:1:1::31 ext-community rt 64531:50 +deny to 2001:db8:1:1::31 large-community 999:64531:50 + + +# do_not_announce_to_peers_with_rtt_higher_than 100 ms +deny to 2001:db8:1:1::31 community 64531:100 +deny to 2001:db8:1:1::31 ext-community rt 64531:100 +deny to 2001:db8:1:1::31 large-community 999:64531:100 + + +# announce_to_peers_with_rtt_higher_than 5 ms +allow to 2001:db8:1:1::31 community 64533:5 +allow to 2001:db8:1:1::31 ext-community rt 64533:5 +allow to 2001:db8:1:1::31 large-community 999:64533:5 + + +# announce_to_peers_with_rtt_higher_than 10 ms +allow to 2001:db8:1:1::31 community 64533:10 +allow to 2001:db8:1:1::31 ext-community rt 64533:10 +allow to 2001:db8:1:1::31 large-community 999:64533:10 + + +# announce_to_peers_with_rtt_higher_than 15 ms +allow to 2001:db8:1:1::31 community 64533:15 +allow to 2001:db8:1:1::31 ext-community rt 64533:15 +allow to 2001:db8:1:1::31 large-community 999:64533:15 + + +# announce_to_peers_with_rtt_higher_than 20 ms +allow to 2001:db8:1:1::31 community 64533:20 +allow to 2001:db8:1:1::31 ext-community rt 64533:20 +allow to 2001:db8:1:1::31 large-community 999:64533:20 + + +# announce_to_peers_with_rtt_higher_than 30 ms +allow to 2001:db8:1:1::31 community 64533:30 +allow to 2001:db8:1:1::31 ext-community rt 64533:30 +allow to 2001:db8:1:1::31 large-community 999:64533:30 + + +# announce_to_peers_with_rtt_higher_than 50 ms +allow to 2001:db8:1:1::31 community 64533:50 +allow to 2001:db8:1:1::31 ext-community rt 64533:50 +allow to 2001:db8:1:1::31 large-community 999:64533:50 + + +# announce_to_peers_with_rtt_higher_than 100 ms +allow to 2001:db8:1:1::31 community 64533:100 +allow to 2001:db8:1:1::31 ext-community rt 64533:100 +allow to 2001:db8:1:1::31 large-community 999:64533:100 + + +# announce_to_peer +allow to 2001:db8:1:1::31 community 65501:3 +allow to 2001:db8:1:1::31 ext-community rt 65501:3 +allow to 2001:db8:1:1::31 large-community 999:65501:3 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS4_1, inbound + + + +# NEXT_HOP +match from 192.0.2.41 set community NO_ADVERTISE +match from 192.0.2.41 nexthop 192.0.2.41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.41 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.41 AS 23456' - reject code: 7 +allow quick from 192.0.2.41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.41 AS { 3, 174 }' - reject code: 8 +allow quick from 192.0.2.41 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.41 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.41 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + +# Blackhole request? +match from 192.0.2.41 set ext-community delete rt 65520:4 + + +# Remove internal communities before accepting the route +match from 192.0.2.41 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.41 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.41 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.41 community BLACKHOLE set community 65530:4 +match from 192.0.2.41 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.41 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.41 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.41 community BLACKHOLE +allow quick from 192.0.2.41 community 65534:0 +allow quick from 192.0.2.41 large-community 65534:0:0 + + +match from 192.0.2.41 set ext-community rt 65520:4 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.41 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.41 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.41 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 192.0.2.41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.41 set ext-community delete rt 65520:4 + + + +allow quick from 192.0.2.41 + + + +# --------------------------------------------- +# client AS4_1, outbound + +deny quick to 192.0.2.41 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 192.0.2.41 community 65534:0 set community BLACKHOLE +match to 192.0.2.41 large-community 65534:0:0 set community BLACKHOLE + +match to 192.0.2.41 community BLACKHOLE set community NO_EXPORT +match to 192.0.2.41 community BLACKHOLE set nexthop 192.0.2.66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.41 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.41 community 65507:999 set community NO_EXPORT +match to 192.0.2.41 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.41 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.41 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.41 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.41 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.41 community 65509:4 set community NO_EXPORT +match to 192.0.2.41 ext-community rt 65509:4 set community NO_EXPORT +match to 192.0.2.41 large-community 999:65509:4 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.41 community 65510:4 set community NO_ADVERTISE +match to 192.0.2.41 ext-community rt 65510:4 set community NO_ADVERTISE +match to 192.0.2.41 large-community 999:65510:4 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.41 + +# do_not_announce_to_any +deny to 192.0.2.41 community 0:999 +deny to 192.0.2.41 ext-community rt 0:999 +deny to 192.0.2.41 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.41 community 0:4 +deny quick to 192.0.2.41 ext-community rt 0:4 +deny quick to 192.0.2.41 large-community 999:0:4 + +# announce_to_peer +allow to 192.0.2.41 community 65501:4 +allow to 192.0.2.41 ext-community rt 65501:4 +allow to 192.0.2.41 large-community 999:65501:4 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS4_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::41 set community NO_ADVERTISE +match from 2001:db8:1:1::41 nexthop 2001:db8:1:1::41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::41 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS { 3, 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::41 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::41 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + +# Blackhole request? +match from 2001:db8:1:1::41 set ext-community delete rt 65520:4 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::41 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::41 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::41 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::41 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::41 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::41 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::41 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::41 community BLACKHOLE +allow quick from 2001:db8:1:1::41 community 65534:0 +allow quick from 2001:db8:1:1::41 large-community 65534:0:0 + + +match from 2001:db8:1:1::41 set ext-community rt 65520:4 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::41 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::41 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::41 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::41 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::41 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::41 set ext-community delete rt 65520:4 + + + +allow quick from 2001:db8:1:1::41 + + + +# --------------------------------------------- +# client AS4_2, outbound + +deny quick to 2001:db8:1:1::41 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 2001:db8:1:1::41 community 65534:0 set community BLACKHOLE +match to 2001:db8:1:1::41 large-community 65534:0:0 set community BLACKHOLE + +match to 2001:db8:1:1::41 community BLACKHOLE set community NO_EXPORT +match to 2001:db8:1:1::41 community BLACKHOLE set nexthop 2001:db8:1:1::66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::41 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::41 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::41 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::41 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::41 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::41 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::41 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::41 community 65509:4 set community NO_EXPORT +match to 2001:db8:1:1::41 ext-community rt 65509:4 set community NO_EXPORT +match to 2001:db8:1:1::41 large-community 999:65509:4 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::41 community 65510:4 set community NO_ADVERTISE +match to 2001:db8:1:1::41 ext-community rt 65510:4 set community NO_ADVERTISE +match to 2001:db8:1:1::41 large-community 999:65510:4 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::41 + +# do_not_announce_to_any +deny to 2001:db8:1:1::41 community 0:999 +deny to 2001:db8:1:1::41 ext-community rt 0:999 +deny to 2001:db8:1:1::41 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::41 community 0:4 +deny quick to 2001:db8:1:1::41 ext-community rt 0:4 +deny quick to 2001:db8:1:1::41 large-community 999:0:4 + +# do_not_announce_to_peers_with_rtt_higher_than 5 ms +deny to 2001:db8:1:1::41 community 64531:5 +deny to 2001:db8:1:1::41 ext-community rt 64531:5 +deny to 2001:db8:1:1::41 large-community 999:64531:5 + + +# do_not_announce_to_peers_with_rtt_higher_than 10 ms +deny to 2001:db8:1:1::41 community 64531:10 +deny to 2001:db8:1:1::41 ext-community rt 64531:10 +deny to 2001:db8:1:1::41 large-community 999:64531:10 + + +# do_not_announce_to_peers_with_rtt_higher_than 15 ms +deny to 2001:db8:1:1::41 community 64531:15 +deny to 2001:db8:1:1::41 ext-community rt 64531:15 +deny to 2001:db8:1:1::41 large-community 999:64531:15 + + +# do_not_announce_to_peers_with_rtt_higher_than 20 ms +deny to 2001:db8:1:1::41 community 64531:20 +deny to 2001:db8:1:1::41 ext-community rt 64531:20 +deny to 2001:db8:1:1::41 large-community 999:64531:20 + + +# do_not_announce_to_peers_with_rtt_higher_than 30 ms +deny to 2001:db8:1:1::41 community 64531:30 +deny to 2001:db8:1:1::41 ext-community rt 64531:30 +deny to 2001:db8:1:1::41 large-community 999:64531:30 + + +# do_not_announce_to_peers_with_rtt_higher_than 50 ms +deny to 2001:db8:1:1::41 community 64531:50 +deny to 2001:db8:1:1::41 ext-community rt 64531:50 +deny to 2001:db8:1:1::41 large-community 999:64531:50 + + +# do_not_announce_to_peers_with_rtt_higher_than 100 ms +deny to 2001:db8:1:1::41 community 64531:100 +deny to 2001:db8:1:1::41 ext-community rt 64531:100 +deny to 2001:db8:1:1::41 large-community 999:64531:100 + + +# do_not_announce_to_peers_with_rtt_higher_than 200 ms +deny to 2001:db8:1:1::41 community 64531:200 +deny to 2001:db8:1:1::41 ext-community rt 64531:200 +deny to 2001:db8:1:1::41 large-community 999:64531:200 + + +# do_not_announce_to_peers_with_rtt_higher_than 500 ms +deny to 2001:db8:1:1::41 community 64531:500 +deny to 2001:db8:1:1::41 ext-community rt 64531:500 +deny to 2001:db8:1:1::41 large-community 999:64531:500 + + +# announce_to_peers_with_rtt_higher_than 5 ms +allow to 2001:db8:1:1::41 community 64533:5 +allow to 2001:db8:1:1::41 ext-community rt 64533:5 +allow to 2001:db8:1:1::41 large-community 999:64533:5 + + +# announce_to_peers_with_rtt_higher_than 10 ms +allow to 2001:db8:1:1::41 community 64533:10 +allow to 2001:db8:1:1::41 ext-community rt 64533:10 +allow to 2001:db8:1:1::41 large-community 999:64533:10 + + +# announce_to_peers_with_rtt_higher_than 15 ms +allow to 2001:db8:1:1::41 community 64533:15 +allow to 2001:db8:1:1::41 ext-community rt 64533:15 +allow to 2001:db8:1:1::41 large-community 999:64533:15 + + +# announce_to_peers_with_rtt_higher_than 20 ms +allow to 2001:db8:1:1::41 community 64533:20 +allow to 2001:db8:1:1::41 ext-community rt 64533:20 +allow to 2001:db8:1:1::41 large-community 999:64533:20 + + +# announce_to_peers_with_rtt_higher_than 30 ms +allow to 2001:db8:1:1::41 community 64533:30 +allow to 2001:db8:1:1::41 ext-community rt 64533:30 +allow to 2001:db8:1:1::41 large-community 999:64533:30 + + +# announce_to_peers_with_rtt_higher_than 50 ms +allow to 2001:db8:1:1::41 community 64533:50 +allow to 2001:db8:1:1::41 ext-community rt 64533:50 +allow to 2001:db8:1:1::41 large-community 999:64533:50 + + +# announce_to_peers_with_rtt_higher_than 100 ms +allow to 2001:db8:1:1::41 community 64533:100 +allow to 2001:db8:1:1::41 ext-community rt 64533:100 +allow to 2001:db8:1:1::41 large-community 999:64533:100 + + +# announce_to_peers_with_rtt_higher_than 200 ms +allow to 2001:db8:1:1::41 community 64533:200 +allow to 2001:db8:1:1::41 ext-community rt 64533:200 +allow to 2001:db8:1:1::41 large-community 999:64533:200 + + +# announce_to_peers_with_rtt_higher_than 500 ms +allow to 2001:db8:1:1::41 community 64533:500 +allow to 2001:db8:1:1::41 ext-community rt 64533:500 +allow to 2001:db8:1:1::41 large-community 999:64533:500 + + +# announce_to_peer +allow to 2001:db8:1:1::41 community 65501:4 +allow to 2001:db8:1:1::41 ext-community rt 65501:4 +allow to 2001:db8:1:1::41 large-community 999:65501:4 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + + + +# Scrub communities from outbound routes +# add_noadvertise_to_any +match to group clients set community delete 65508:999 +match to group clients set ext-community delete rt 65508:999 +match to group clients set large-community delete 999:65508:999 + +# add_noadvertise_to_peer +match to group clients set community delete 65510:* +match to group clients set ext-community delete rt 65510:* +match to group clients set large-community delete 999:65510:* + +# add_noexport_to_any +match to group clients set community delete 65507:999 +match to group clients set ext-community delete rt 65507:999 +match to group clients set large-community delete 999:65507:999 + +# add_noexport_to_peer +match to group clients set community delete 65509:* +match to group clients set ext-community delete rt 65509:* +match to group clients set large-community delete 999:65509:* + +# announce_to_peer +match to group clients set community delete 65501:* +match to group clients set ext-community delete rt 65501:* +match to group clients set large-community delete 999:65501:* + +# announce_to_peers_with_rtt_higher_than +match to group clients set community delete 64533:* +match to group clients set ext-community delete rt 64533:* +match to group clients set large-community delete 999:64533:* + +# announce_to_peers_with_rtt_lower_than +match to group clients set community delete 64532:* +match to group clients set ext-community delete rt 64532:* +match to group clients set large-community delete 999:64532:* + +# blackholing +match to group clients set community delete 65534:0 +match to group clients set large-community delete 65534:0:0 + +# do_not_announce_to_any +match to group clients set community delete 0:999 +match to group clients set ext-community delete rt 0:999 +match to group clients set large-community delete 999:0:999 + +# do_not_announce_to_peer +match to group clients set community delete 0:* +match to group clients set ext-community delete rt 0:* +match to group clients set large-community delete 999:0:* + +# do_not_announce_to_peers_with_rtt_higher_than +match to group clients set community delete 64531:* +match to group clients set ext-community delete rt 64531:* +match to group clients set large-community delete 999:64531:* + +# do_not_announce_to_peers_with_rtt_lower_than +match to group clients set community delete 64530:* +match to group clients set ext-community delete rt 64530:* +match to group clients set large-community delete 999:64530:* + +# prepend_once_to_any +match to group clients set community delete 65521:65521 +match to group clients set ext-community delete rt 65521:65521 +match to group clients set large-community delete 999:65521:65521 + +# prepend_once_to_peer +match to group clients set community delete 65521:* +match to group clients set ext-community delete rt 65521:* +match to group clients set large-community delete 999:65521:* + +# prepend_once_to_peers_with_rtt_higher_than +match to group clients set community delete 64537:* +match to group clients set ext-community delete rt 64537:* +match to group clients set large-community delete 999:64537:* + +# prepend_once_to_peers_with_rtt_lower_than +match to group clients set community delete 64534:* +match to group clients set ext-community delete rt 64534:* +match to group clients set large-community delete 999:64534:* + +# prepend_thrice_to_any +match to group clients set community delete 65523:65523 +match to group clients set ext-community delete rt 65523:65523 +match to group clients set large-community delete 999:65523:65523 + +# prepend_thrice_to_peer +match to group clients set community delete 65523:* +match to group clients set ext-community delete rt 65523:* +match to group clients set large-community delete 999:65523:* + +# prepend_thrice_to_peers_with_rtt_higher_than +match to group clients set community delete 64539:* +match to group clients set ext-community delete rt 64539:* +match to group clients set large-community delete 999:64539:* + +# prepend_thrice_to_peers_with_rtt_lower_than +match to group clients set community delete 64536:* +match to group clients set ext-community delete rt 64536:* +match to group clients set large-community delete 999:64536:* + +# prepend_twice_to_any +match to group clients set community delete 65522:65522 +match to group clients set ext-community delete rt 65522:65522 +match to group clients set large-community delete 999:65522:65522 + +# prepend_twice_to_peer +match to group clients set community delete 65522:* +match to group clients set ext-community delete rt 65522:* +match to group clients set large-community delete 999:65522:* + +# prepend_twice_to_peers_with_rtt_higher_than +match to group clients set community delete 64538:* +match to group clients set ext-community delete rt 64538:* +match to group clients set large-community delete 999:64538:* + +# prepend_twice_to_peers_with_rtt_lower_than +match to group clients set community delete 64535:* +match to group clients set ext-community delete rt 64535:* +match to group clients set large-community delete 999:64535:* + +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities +match to group clients set { + community delete 65521:65521 + ext-community delete rt 65521:65521 + large-community delete 999:65521:65521 + +} +match to group clients set { + community delete 65521:* + ext-community delete rt 65521:* + large-community delete 999:65521:* + +} +match to group clients set { + community delete 64537:* + ext-community delete rt 64537:* + large-community delete 999:64537:* + +} +match to group clients set { + community delete 64534:* + ext-community delete rt 64534:* + large-community delete 999:64534:* + +} +match to group clients set { + community delete 65523:65523 + ext-community delete rt 65523:65523 + large-community delete 999:65523:65523 + +} +match to group clients set { + community delete 65523:* + ext-community delete rt 65523:* + large-community delete 999:65523:* + +} +match to group clients set { + community delete 64539:* + ext-community delete rt 64539:* + large-community delete 999:64539:* + +} +match to group clients set { + community delete 64536:* + ext-community delete rt 64536:* + large-community delete 999:64536:* + +} +match to group clients set { + community delete 65522:65522 + ext-community delete rt 65522:65522 + large-community delete 999:65522:65522 + +} +match to group clients set { + community delete 65522:* + ext-community delete rt 65522:* + large-community delete 999:65522:* + +} +match to group clients set { + community delete 64538:* + ext-community delete rt 64538:* + large-community delete 999:64538:* + +} +match to group clients set { + community delete 64535:* + ext-community delete rt 64535:* + large-community delete 999:64535:* + +} + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +include "/etc/bgpd/post-filters.local" + + diff --git a/tests/live_tests/scenarios/global/configs/BasicScenario_OpenBGPDIPv6/openbgpd77p.conf b/tests/live_tests/scenarios/global/configs/BasicScenario_OpenBGPDIPv6/openbgpd77p.conf new file mode 100644 index 00000000..28ccbce0 --- /dev/null +++ b/tests/live_tests/scenarios/global/configs/BasicScenario_OpenBGPDIPv6/openbgpd77p.conf @@ -0,0 +1,10254 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + +# AS222, used by client AS222_1, client AS222_2 +# no origin ASNs found for AS222 +# no prefixes found for AS222 + +# AS2, used by client AS2_1, client AS2_2 +# no origin ASNs found for AS2 +# no prefixes found for AS2 + +# AS-AS1, AS-AS1_CUSTOMERS, used by client AS1_1, client AS1_2, client AS1_3, client AS1_4 +as-set "AS_SET_AS_AS1_AS_AS1_CUSTOMERS_asns" { + 1 101 103 104 +} +prefix-set "AS_SET_AS_AS1_AS_AS1_CUSTOMERS_prefixes" { + 2a01::/32 prefixlen 32 - 128 + 2a99::/16 prefixlen 16 - 128 + 3101::/32 prefixlen 32 - 128 + 3103::/32 prefixlen 32 - 128 +} + +# AS-AS2, AS-AS2_CUSTOMERS, used by client AS2_1, client AS2_2 +as-set "AS_SET_AS_AS2_AS_AS2_CUSTOMERS_asns" { + 2 101 103 +} +prefix-set "AS_SET_AS_AS2_AS_AS2_CUSTOMERS_prefixes" { + 2a02::/32 prefixlen 32 - 128 + 3101::/32 prefixlen 32 - 128 + 3103::/32 prefixlen 32 - 128 +} + +# WHITE_LIST_AS1_2, used by client AS1_2 white list +as-set "AS_SET_WHITE_LIST_AS1_2_asns" { + 1011 +} +prefix-set "AS_SET_WHITE_LIST_AS1_2_prefixes" { + 11.1.0.0/16 prefixlen 16 - 32 + 2a11:1::/32 prefixlen 32 - 128 +} + +# AS-AS222, used by client AS222_1, client AS222_2 +as-set "AS_SET_AS_AS222_asns" { + 333 +} +prefix-set "AS_SET_AS_AS222_prefixes" { + 3222::/32 prefixlen 32 - 128 +} + +# AS1, used by client AS1_1, client AS1_2, client AS1_3, client AS1_4 +# no origin ASNs found for AS1 +# no prefixes found for AS1 + +# WHITE_LIST_AS1_1, used by client AS1_1 white list +as-set "AS_SET_WHITE_LIST_AS1_1_asns" { + 1011 +} +prefix-set "AS_SET_WHITE_LIST_AS1_1_prefixes" { + 11.1.0.0/16 prefixlen 16 - 32 + 2a11:1::/32 prefixlen 32 - 128 +} + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.11 { + remote-as 1 + + rde evaluate all + + descr "AS1_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + # RTT: 0.1 ms (normalized value: 1) + neighbor 2001:db8:1:1::11 { + remote-as 1 + + rde evaluate all + + descr "AS1_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.12 { + remote-as 1 + + rde evaluate all + + descr "AS1_2 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + # RTT: 5 ms (normalized value: 5) + neighbor 2001:db8:1:1::12 { + remote-as 1 + + rde evaluate all + + descr "AS1_2 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.222 { + remote-as 222 + + rde evaluate all + + descr "AS222_1 client" + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::222 { + remote-as 222 + + rde evaluate all + + descr "AS222_1 client" + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.21 { + remote-as 2 + + rde evaluate all + + descr "AS2_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + # RTT: 17.3 ms (normalized value: 17) + neighbor 2001:db8:1:1::21 { + remote-as 2 + + rde evaluate all + + descr "AS2_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.31 { + remote-as 3 + + rde evaluate all + + descr "AS3_1 client" + ttl-security no + transparent-as no + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + # RTT: 123.8 ms (normalized value: 124) + neighbor 2001:db8:1:1::31 { + remote-as 3 + + rde evaluate all + + descr "AS3_1 client" + ttl-security no + transparent-as no + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 192.0.2.41 { + remote-as 4 + + rde evaluate all + + descr "AS4_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + # RTT: 600 ms (normalized value: 600) + neighbor 2001:db8:1:1::41 { + remote-as 4 + + rde evaluate all + + descr "AS4_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } +} + +include "/etc/bgpd/post-clients.local" + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + +prefix-set "global_black_list_pref" { + 192.0.2.0/24 prefixlen 24 - 32 + 2001:db8::/32 prefixlen 32 - 128 + +} + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + +# never via route-servers ASNs +as-set "neverviarouteserver" { + 666, 777 +} + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# origin_not_present_in_as_set +match from group clients set community delete 65530:0 +match from group clients set large-community delete 999:65530:0 + +# origin_present_in_as_set +match from group clients set community delete 65530:1 +match from group clients set large-community delete 999:65530:1 + +# prefix_validated_via_arin_whois_db_dump +match from group clients set community delete 65530:3 +match from group clients set large-community delete 999:65530:3 + +# prefix_validated_via_rpki_roas +match from group clients set community delete 65530:2 +match from group clients set large-community delete 999:65530:2 + +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + +# rpki_bgp_origin_validation_not_performed +match from group clients set community delete 65530:4 +match from group clients set large-community delete 999:65530:4 + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + +# --------------------------------------------------------- +# ROAs source + + +roa-set { + 101.3.0.0/16 maxlen 24 source-as 105 expires 4102444799 + 101.2.0.0/17 source-as 101 expires 4102444799 + 101.2.128.0/17 maxlen 24 source-as 101 expires 4102444799 + 101.0.128.0/20 maxlen 23 source-as 101 expires 4102444799 + 101.0.8.0/24 source-as 101 expires 4102444799 + 101.0.9.0/24 source-as 102 expires 4102444799 + 222.1.1.0/24 source-as 333 expires 4102444799 + 3101:3::/32 maxlen 48 source-as 105 expires 4102444799 + 3101:0:8000::/33 maxlen 34 source-as 101 expires 4102444799 + 3101:2:8000::/33 maxlen 48 source-as 101 expires 4102444799 + 3101:2::/33 source-as 101 expires 4102444799 + 3101:0:8::/48 source-as 101 expires 4102444799 + 3101:0:9::/48 source-as 102 expires 4102444799 + 3222:0:1::/48 source-as 333 expires 4102444799 + +} + + + +# --------------------------------------------------------- +# RPKI-based Origin Validation + + +# Add $INTCOMM_RPKI_UNKNOWN, $INTCOMM_RPKI_INVALID and $INTCOMM_RPKI_VALID +# ext community on the basis of ovs. +match from group clients ovs not-found set { + ext-community $INTCOMM_RPKI_UNKNOWN + ext-community ovs not-found + +} +match from group clients ovs valid set { + ext-community $INTCOMM_RPKI_VALID + ext-community ovs valid + +} +match from group clients ovs invalid set { + ext-community $INTCOMM_RPKI_INVALID + ext-community ovs invalid + +} + + + +# --------------------------------------------------------- +# RPKI ROAs used as route objects. + +# Add the $INTCOMM_PREF_OK_ROA ext community to routes whose +# origin ASN has a ROA for the announced prefix. +# It will be used later during IRRDB validation in +# case the origin ASN is authorized by a client's +# AS-SET but the prefix is not. + +# Since RPKI-based Origin Validation is already performed above, +# use the origin validation state to identify valid routes. +match from group clients ovs valid set ext-community $INTCOMM_PREF_OK_ROA + + +# ARIN Whois records used for preifx validation +# --------------------------------------------- + +# Add the $INTCOMM_PREF_OK_ARINDB ext community to routes whose +# origin ASN has an ARIN Whois record for the announced prefix. +# It will be used later during IRRDB validation in +# case the origin ASN is authorized by a client's +# AS-SET but the prefix is not. +origin-set "ARINDB" { +104.0.0.0/23 prefixlen 23 - 32 source-as 104 +3104::/32 prefixlen 32 - 128 source-as 104 +} +match from group clients origin-set ARINDB set ext-community $INTCOMM_PREF_OK_ARINDB + +# NIC.BR Whois records used for preifx validation +# ----------------------------------------------- + +# Add the $INTCOMM_PREF_OK_REGISTROBRDB ext community to routes whose +# origin ASN has a NIC.BR Whois record for the announced prefix. +# It will be used later during IRRDB validation in +# case the origin ASN is authorized by a client's +# AS-SET but the prefix is not. +origin-set "REGISTROBRDB" { +104.1.1.0/24 prefixlen 24 - 32 source-as 104 +3104:1:1::/48 prefixlen 48 - 128 source-as 104 +} +match from group clients origin-set REGISTROBRDB set ext-community $INTCOMM_PREF_OK_REGISTROBRDB + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.11 set ext-community rt 65520:1 + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + +match from 192.0.2.12 set ext-community rt 65520:1 + +match from 2001:db8:1:1::12 set ext-community rt 65520:1 + +match from 192.0.2.222 set ext-community rt 65520:222 + +match from 2001:db8:1:1::222 set ext-community rt 65520:222 + +match from 192.0.2.21 set ext-community rt 65520:2 + +match from 2001:db8:1:1::21 set ext-community rt 65520:2 + +match from 192.0.2.31 set ext-community rt 65520:3 + +match from 2001:db8:1:1::31 set ext-community rt 65520:3 + +match from 192.0.2.41 set ext-community rt 65520:4 + +match from 2001:db8:1:1::41 set ext-community rt 65520:4 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 6' - reject code: 1 +allow quick from group clients max-as-len 6 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: global blacklist +# Reject inbound routes when 'from group clients prefix-set global_black_list_pref' - reject code: 3 +allow quick from group clients prefix-set global_black_list_pref set { + localpref 1 + community 65520:0 + community 65520:3 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS1_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.11 AS { 3, 174 }' - reject code: 8 +allow quick from 192.0.2.11 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.11 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.11 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 192.0.2.11 prefix 11.3.0.0/16 source-as 1011 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.11 prefix 11.4.0.0/16 prefixlen 16 - 32 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.11 prefix 2a11:3::/32 source-as 1011 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.11 prefix 2a11:4::/32 prefixlen 32 - 128 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 192.0.2.11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_1, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.11 source-as as-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. +match from 192.0.2.11 source-as as-set AS_SET_WHITE_LIST_AS1_1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS1_1 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_1, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.11 prefix-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. +match from 192.0.2.11 prefix-set AS_SET_WHITE_LIST_AS1_1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS1_1 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_REGISTROBRDB community have the prefix validated by a NICBR Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_REGISTROBRDB set ext-community delete $INTCOMM_IRR_REJECT + +# route authorized by a client's white list? +match from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 192.0.2.11 set ext-community delete rt 65520:1 + + +# Remove internal communities before accepting the route +match from 192.0.2.11 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.11 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.11 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.11 community BLACKHOLE set community 65530:4 +match from 192.0.2.11 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.11 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.11 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.11 community BLACKHOLE +allow quick from 192.0.2.11 community 65534:0 +allow quick from 192.0.2.11 large-community 65534:0:0 + + +match from 192.0.2.11 set ext-community rt 65520:1 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.11 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 192.0.2.11 community 65534:0 set community BLACKHOLE +match to 192.0.2.11 large-community 65534:0:0 set community BLACKHOLE + +match to 192.0.2.11 community BLACKHOLE set community NO_EXPORT +match to 192.0.2.11 community BLACKHOLE set nexthop 192.0.2.66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.11 community 65507:999 set community NO_EXPORT +match to 192.0.2.11 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.11 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.11 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.11 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.11 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.11 community 65509:1 set community NO_EXPORT +match to 192.0.2.11 ext-community rt 65509:1 set community NO_EXPORT +match to 192.0.2.11 large-community 999:65509:1 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.11 community 65510:1 set community NO_ADVERTISE +match to 192.0.2.11 ext-community rt 65510:1 set community NO_ADVERTISE +match to 192.0.2.11 large-community 999:65510:1 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.11 + +# do_not_announce_to_any +deny to 192.0.2.11 community 0:999 +deny to 192.0.2.11 ext-community rt 0:999 +deny to 192.0.2.11 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.11 community 0:1 +deny quick to 192.0.2.11 ext-community rt 0:1 +deny quick to 192.0.2.11 large-community 999:0:1 + +# announce_to_peer +allow to 192.0.2.11 community 65501:1 +allow to 192.0.2.11 ext-community rt 65501:1 +allow to 192.0.2.11 large-community 999:65501:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS1_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS { 3, 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::11 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::11 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 2001:db8:1:1::11 prefix 11.3.0.0/16 source-as 1011 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::11 prefix 11.4.0.0/16 prefixlen 16 - 32 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::11 prefix 2a11:3::/32 source-as 1011 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::11 prefix 2a11:4::/32 prefixlen 32 - 128 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 2001:db8:1:1::11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_2, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::11 source-as as-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS1_AS_AS1_CUSTOMERS +match from 2001:db8:1:1::11 source-as as-set AS_SET_WHITE_LIST_AS1_2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS1_2 +# AS-SET AS1 referenced but empty. + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_2, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::11 prefix-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS1_AS_AS1_CUSTOMERS +match from 2001:db8:1:1::11 prefix-set AS_SET_WHITE_LIST_AS1_2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS1_2 +# AS-SET AS1 referenced but empty. + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_REGISTROBRDB community have the prefix validated by a NICBR Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_REGISTROBRDB set ext-community delete $INTCOMM_IRR_REJECT + +# route authorized by a client's white list? +match from 2001:db8:1:1::11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::11 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::11 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::11 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::11 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::11 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::11 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::11 community BLACKHOLE +allow quick from 2001:db8:1:1::11 community 65534:0 +allow quick from 2001:db8:1:1::11 large-community 65534:0:0 + + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::11 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::11 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::11 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + +deny quick to 2001:db8:1:1::11 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 2001:db8:1:1::11 community 65534:0 set community BLACKHOLE +match to 2001:db8:1:1::11 large-community 65534:0:0 set community BLACKHOLE + +match to 2001:db8:1:1::11 community BLACKHOLE set community NO_EXPORT +match to 2001:db8:1:1::11 community BLACKHOLE set nexthop 2001:db8:1:1::66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::11 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::11 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::11 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::11 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::11 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::11 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::11 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::11 community 65509:1 set community NO_EXPORT +match to 2001:db8:1:1::11 ext-community rt 65509:1 set community NO_EXPORT +match to 2001:db8:1:1::11 large-community 999:65509:1 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::11 community 65510:1 set community NO_ADVERTISE +match to 2001:db8:1:1::11 ext-community rt 65510:1 set community NO_ADVERTISE +match to 2001:db8:1:1::11 large-community 999:65510:1 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::11 + +# do_not_announce_to_any +deny to 2001:db8:1:1::11 community 0:999 +deny to 2001:db8:1:1::11 ext-community rt 0:999 +deny to 2001:db8:1:1::11 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::11 community 0:1 +deny quick to 2001:db8:1:1::11 ext-community rt 0:1 +deny quick to 2001:db8:1:1::11 large-community 999:0:1 + +# do_not_announce_to_peers_with_rtt_lower_than 5 ms +deny to 2001:db8:1:1::11 community 64530:5 +deny to 2001:db8:1:1::11 ext-community rt 64530:5 +deny to 2001:db8:1:1::11 large-community 999:64530:5 + + +# do_not_announce_to_peers_with_rtt_lower_than 10 ms +deny to 2001:db8:1:1::11 community 64530:10 +deny to 2001:db8:1:1::11 ext-community rt 64530:10 +deny to 2001:db8:1:1::11 large-community 999:64530:10 + + +# do_not_announce_to_peers_with_rtt_lower_than 15 ms +deny to 2001:db8:1:1::11 community 64530:15 +deny to 2001:db8:1:1::11 ext-community rt 64530:15 +deny to 2001:db8:1:1::11 large-community 999:64530:15 + + +# do_not_announce_to_peers_with_rtt_lower_than 20 ms +deny to 2001:db8:1:1::11 community 64530:20 +deny to 2001:db8:1:1::11 ext-community rt 64530:20 +deny to 2001:db8:1:1::11 large-community 999:64530:20 + + +# do_not_announce_to_peers_with_rtt_lower_than 30 ms +deny to 2001:db8:1:1::11 community 64530:30 +deny to 2001:db8:1:1::11 ext-community rt 64530:30 +deny to 2001:db8:1:1::11 large-community 999:64530:30 + + +# do_not_announce_to_peers_with_rtt_lower_than 50 ms +deny to 2001:db8:1:1::11 community 64530:50 +deny to 2001:db8:1:1::11 ext-community rt 64530:50 +deny to 2001:db8:1:1::11 large-community 999:64530:50 + + +# do_not_announce_to_peers_with_rtt_lower_than 100 ms +deny to 2001:db8:1:1::11 community 64530:100 +deny to 2001:db8:1:1::11 ext-community rt 64530:100 +deny to 2001:db8:1:1::11 large-community 999:64530:100 + + +# do_not_announce_to_peers_with_rtt_lower_than 200 ms +deny to 2001:db8:1:1::11 community 64530:200 +deny to 2001:db8:1:1::11 ext-community rt 64530:200 +deny to 2001:db8:1:1::11 large-community 999:64530:200 + + +# do_not_announce_to_peers_with_rtt_lower_than 500 ms +deny to 2001:db8:1:1::11 community 64530:500 +deny to 2001:db8:1:1::11 ext-community rt 64530:500 +deny to 2001:db8:1:1::11 large-community 999:64530:500 + + +# announce_to_peers_with_rtt_lower_than 5 ms +allow to 2001:db8:1:1::11 community 64532:5 +allow to 2001:db8:1:1::11 ext-community rt 64532:5 +allow to 2001:db8:1:1::11 large-community 999:64532:5 + + +# announce_to_peers_with_rtt_lower_than 10 ms +allow to 2001:db8:1:1::11 community 64532:10 +allow to 2001:db8:1:1::11 ext-community rt 64532:10 +allow to 2001:db8:1:1::11 large-community 999:64532:10 + + +# announce_to_peers_with_rtt_lower_than 15 ms +allow to 2001:db8:1:1::11 community 64532:15 +allow to 2001:db8:1:1::11 ext-community rt 64532:15 +allow to 2001:db8:1:1::11 large-community 999:64532:15 + + +# announce_to_peers_with_rtt_lower_than 20 ms +allow to 2001:db8:1:1::11 community 64532:20 +allow to 2001:db8:1:1::11 ext-community rt 64532:20 +allow to 2001:db8:1:1::11 large-community 999:64532:20 + + +# announce_to_peers_with_rtt_lower_than 30 ms +allow to 2001:db8:1:1::11 community 64532:30 +allow to 2001:db8:1:1::11 ext-community rt 64532:30 +allow to 2001:db8:1:1::11 large-community 999:64532:30 + + +# announce_to_peers_with_rtt_lower_than 50 ms +allow to 2001:db8:1:1::11 community 64532:50 +allow to 2001:db8:1:1::11 ext-community rt 64532:50 +allow to 2001:db8:1:1::11 large-community 999:64532:50 + + +# announce_to_peers_with_rtt_lower_than 100 ms +allow to 2001:db8:1:1::11 community 64532:100 +allow to 2001:db8:1:1::11 ext-community rt 64532:100 +allow to 2001:db8:1:1::11 large-community 999:64532:100 + + +# announce_to_peers_with_rtt_lower_than 200 ms +allow to 2001:db8:1:1::11 community 64532:200 +allow to 2001:db8:1:1::11 ext-community rt 64532:200 +allow to 2001:db8:1:1::11 large-community 999:64532:200 + + +# announce_to_peers_with_rtt_lower_than 500 ms +allow to 2001:db8:1:1::11 community 64532:500 +allow to 2001:db8:1:1::11 ext-community rt 64532:500 +allow to 2001:db8:1:1::11 large-community 999:64532:500 + + +# announce_to_peer +allow to 2001:db8:1:1::11 community 65501:1 +allow to 2001:db8:1:1::11 ext-community rt 65501:1 +allow to 2001:db8:1:1::11 large-community 999:65501:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS1_3, inbound + + + +# NEXT_HOP +match from 192.0.2.12 set community NO_ADVERTISE +match from 192.0.2.12 nexthop 192.0.2.11 set community delete NO_ADVERTISE +match from 192.0.2.12 nexthop 192.0.2.12 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.12 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.12 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.12 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.12 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.12 AS 23456' - reject code: 7 +allow quick from 192.0.2.12 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.12 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.12 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.12 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.12 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.12 AS { 3, 174 }' - reject code: 8 +allow quick from 192.0.2.12 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.12 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.12 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +match from 192.0.2.12 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_3, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.12 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.12 source-as as-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_3, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.12 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.12 prefix-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.12 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.12 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_REGISTROBRDB community have the prefix validated by a NICBR Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.12 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_REGISTROBRDB set ext-community delete $INTCOMM_IRR_REJECT + + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 192.0.2.12 set ext-community delete rt 65520:1 + + +# Remove internal communities before accepting the route +match from 192.0.2.12 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.12 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.12 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.12 community BLACKHOLE set community 65530:4 +match from 192.0.2.12 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.12 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.12 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.12 community BLACKHOLE +allow quick from 192.0.2.12 community 65534:0 +allow quick from 192.0.2.12 large-community 65534:0:0 + + +match from 192.0.2.12 set ext-community rt 65520:1 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.12 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.12 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.12 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.12 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.12 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 192.0.2.12 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.12 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.12 + + + +# --------------------------------------------- +# client AS1_3, outbound + +deny quick to 192.0.2.12 community 65520:0 + + + +# Blackhole request? +# Client not enabled to receive blackhole routes +deny quick to 192.0.2.12 community BLACKHOLE +deny quick to 192.0.2.12 community 65534:0 +deny quick to 192.0.2.12 large-community 65534:0:0 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.12 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.12 community 65507:999 set community NO_EXPORT +match to 192.0.2.12 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.12 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.12 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.12 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.12 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.12 community 65509:1 set community NO_EXPORT +match to 192.0.2.12 ext-community rt 65509:1 set community NO_EXPORT +match to 192.0.2.12 large-community 999:65509:1 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.12 community 65510:1 set community NO_ADVERTISE +match to 192.0.2.12 ext-community rt 65510:1 set community NO_ADVERTISE +match to 192.0.2.12 large-community 999:65510:1 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.12 + +# do_not_announce_to_any +deny to 192.0.2.12 community 0:999 +deny to 192.0.2.12 ext-community rt 0:999 +deny to 192.0.2.12 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.12 community 0:1 +deny quick to 192.0.2.12 ext-community rt 0:1 +deny quick to 192.0.2.12 large-community 999:0:1 + +# announce_to_peer +allow to 192.0.2.12 community 65501:1 +allow to 192.0.2.12 ext-community rt 65501:1 +allow to 192.0.2.12 large-community 999:65501:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.12 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS1_4, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::12 set community NO_ADVERTISE +match from 2001:db8:1:1::12 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +match from 2001:db8:1:1::12 nexthop 2001:db8:1:1::12 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::12 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::12 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::12 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::12 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::12 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::12 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::12 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::12 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::12 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::12 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::12 AS { 3, 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::12 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::12 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::12 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +match from 2001:db8:1:1::12 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_4, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::12 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::12 source-as as-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_4, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::12 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::12 prefix-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::12 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::12 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_REGISTROBRDB community have the prefix validated by a NICBR Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::12 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_REGISTROBRDB set ext-community delete $INTCOMM_IRR_REJECT + + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 2001:db8:1:1::12 set ext-community delete rt 65520:1 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::12 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::12 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::12 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::12 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::12 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::12 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::12 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::12 community BLACKHOLE +allow quick from 2001:db8:1:1::12 community 65534:0 +allow quick from 2001:db8:1:1::12 large-community 65534:0:0 + + +match from 2001:db8:1:1::12 set ext-community rt 65520:1 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::12 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::12 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::12 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::12 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::12 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::12 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::12 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::12 + + + +# --------------------------------------------- +# client AS1_4, outbound + +deny quick to 2001:db8:1:1::12 community 65520:0 + + + +# Blackhole request? +# Client not enabled to receive blackhole routes +deny quick to 2001:db8:1:1::12 community BLACKHOLE +deny quick to 2001:db8:1:1::12 community 65534:0 +deny quick to 2001:db8:1:1::12 large-community 65534:0:0 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::12 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::12 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::12 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::12 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::12 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::12 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::12 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::12 community 65509:1 set community NO_EXPORT +match to 2001:db8:1:1::12 ext-community rt 65509:1 set community NO_EXPORT +match to 2001:db8:1:1::12 large-community 999:65509:1 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::12 community 65510:1 set community NO_ADVERTISE +match to 2001:db8:1:1::12 ext-community rt 65510:1 set community NO_ADVERTISE +match to 2001:db8:1:1::12 large-community 999:65510:1 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::12 + +# do_not_announce_to_any +deny to 2001:db8:1:1::12 community 0:999 +deny to 2001:db8:1:1::12 ext-community rt 0:999 +deny to 2001:db8:1:1::12 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::12 community 0:1 +deny quick to 2001:db8:1:1::12 ext-community rt 0:1 +deny quick to 2001:db8:1:1::12 large-community 999:0:1 + +# do_not_announce_to_peers_with_rtt_lower_than 5 ms +deny to 2001:db8:1:1::12 community 64530:5 +deny to 2001:db8:1:1::12 ext-community rt 64530:5 +deny to 2001:db8:1:1::12 large-community 999:64530:5 + + +# do_not_announce_to_peers_with_rtt_lower_than 10 ms +deny to 2001:db8:1:1::12 community 64530:10 +deny to 2001:db8:1:1::12 ext-community rt 64530:10 +deny to 2001:db8:1:1::12 large-community 999:64530:10 + + +# do_not_announce_to_peers_with_rtt_lower_than 15 ms +deny to 2001:db8:1:1::12 community 64530:15 +deny to 2001:db8:1:1::12 ext-community rt 64530:15 +deny to 2001:db8:1:1::12 large-community 999:64530:15 + + +# do_not_announce_to_peers_with_rtt_lower_than 20 ms +deny to 2001:db8:1:1::12 community 64530:20 +deny to 2001:db8:1:1::12 ext-community rt 64530:20 +deny to 2001:db8:1:1::12 large-community 999:64530:20 + + +# do_not_announce_to_peers_with_rtt_lower_than 30 ms +deny to 2001:db8:1:1::12 community 64530:30 +deny to 2001:db8:1:1::12 ext-community rt 64530:30 +deny to 2001:db8:1:1::12 large-community 999:64530:30 + + +# do_not_announce_to_peers_with_rtt_lower_than 50 ms +deny to 2001:db8:1:1::12 community 64530:50 +deny to 2001:db8:1:1::12 ext-community rt 64530:50 +deny to 2001:db8:1:1::12 large-community 999:64530:50 + + +# do_not_announce_to_peers_with_rtt_lower_than 100 ms +deny to 2001:db8:1:1::12 community 64530:100 +deny to 2001:db8:1:1::12 ext-community rt 64530:100 +deny to 2001:db8:1:1::12 large-community 999:64530:100 + + +# do_not_announce_to_peers_with_rtt_lower_than 200 ms +deny to 2001:db8:1:1::12 community 64530:200 +deny to 2001:db8:1:1::12 ext-community rt 64530:200 +deny to 2001:db8:1:1::12 large-community 999:64530:200 + + +# do_not_announce_to_peers_with_rtt_lower_than 500 ms +deny to 2001:db8:1:1::12 community 64530:500 +deny to 2001:db8:1:1::12 ext-community rt 64530:500 +deny to 2001:db8:1:1::12 large-community 999:64530:500 + + +# announce_to_peers_with_rtt_lower_than 5 ms +allow to 2001:db8:1:1::12 community 64532:5 +allow to 2001:db8:1:1::12 ext-community rt 64532:5 +allow to 2001:db8:1:1::12 large-community 999:64532:5 + + +# announce_to_peers_with_rtt_lower_than 10 ms +allow to 2001:db8:1:1::12 community 64532:10 +allow to 2001:db8:1:1::12 ext-community rt 64532:10 +allow to 2001:db8:1:1::12 large-community 999:64532:10 + + +# announce_to_peers_with_rtt_lower_than 15 ms +allow to 2001:db8:1:1::12 community 64532:15 +allow to 2001:db8:1:1::12 ext-community rt 64532:15 +allow to 2001:db8:1:1::12 large-community 999:64532:15 + + +# announce_to_peers_with_rtt_lower_than 20 ms +allow to 2001:db8:1:1::12 community 64532:20 +allow to 2001:db8:1:1::12 ext-community rt 64532:20 +allow to 2001:db8:1:1::12 large-community 999:64532:20 + + +# announce_to_peers_with_rtt_lower_than 30 ms +allow to 2001:db8:1:1::12 community 64532:30 +allow to 2001:db8:1:1::12 ext-community rt 64532:30 +allow to 2001:db8:1:1::12 large-community 999:64532:30 + + +# announce_to_peers_with_rtt_lower_than 50 ms +allow to 2001:db8:1:1::12 community 64532:50 +allow to 2001:db8:1:1::12 ext-community rt 64532:50 +allow to 2001:db8:1:1::12 large-community 999:64532:50 + + +# announce_to_peers_with_rtt_lower_than 100 ms +allow to 2001:db8:1:1::12 community 64532:100 +allow to 2001:db8:1:1::12 ext-community rt 64532:100 +allow to 2001:db8:1:1::12 large-community 999:64532:100 + + +# announce_to_peers_with_rtt_lower_than 200 ms +allow to 2001:db8:1:1::12 community 64532:200 +allow to 2001:db8:1:1::12 ext-community rt 64532:200 +allow to 2001:db8:1:1::12 large-community 999:64532:200 + + +# announce_to_peers_with_rtt_lower_than 500 ms +allow to 2001:db8:1:1::12 community 64532:500 +allow to 2001:db8:1:1::12 ext-community rt 64532:500 +allow to 2001:db8:1:1::12 large-community 999:64532:500 + + +# announce_to_peer +allow to 2001:db8:1:1::12 community 65501:1 +allow to 2001:db8:1:1::12 ext-community rt 65501:1 +allow to 2001:db8:1:1::12 large-community 999:65501:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::12 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS222_1, inbound + + + +# NEXT_HOP +match from 192.0.2.222 set community NO_ADVERTISE +match from 192.0.2.222 nexthop 192.0.2.222 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.222 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.222 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.222 peer-as != 222' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.222 peer-as != 222 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.222 AS 23456' - reject code: 7 +allow quick from 192.0.2.222 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.222 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.222 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.222 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.222 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.222 AS { 3, 174 }' - reject code: 8 +allow quick from 192.0.2.222 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.222 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.222 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 192.0.2.222 prefix 222.1.1.0/24 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.222 prefix 3222:0:1::/48 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 192.0.2.222 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS222_1, AS222: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.222 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS222 referenced but empty. +match from 192.0.2.222 source-as as-set AS_SET_AS_AS222_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS222 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS222_1, AS222: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.222 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS222 referenced but empty. +match from 192.0.2.222 prefix-set AS_SET_AS_AS222_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS222 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.222 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.222 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_REGISTROBRDB community have the prefix validated by a NICBR Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.222 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_REGISTROBRDB set ext-community delete $INTCOMM_IRR_REJECT + +# route authorized by a client's white list? +match from 192.0.2.222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 192.0.2.222 set ext-community delete rt 65520:222 + + +# Remove internal communities before accepting the route +match from 192.0.2.222 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.222 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.222 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.222 community BLACKHOLE set community 65530:4 +match from 192.0.2.222 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.222 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.222 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.222 community BLACKHOLE +allow quick from 192.0.2.222 community 65534:0 +allow quick from 192.0.2.222 large-community 65534:0:0 + + +match from 192.0.2.222 set ext-community rt 65520:222 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.222 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.222 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.222 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.222 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.222 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 192.0.2.222 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.222 set ext-community delete rt 65520:222 + + + +allow quick from 192.0.2.222 + + + +# --------------------------------------------- +# client AS222_1, outbound + +deny quick to 192.0.2.222 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 192.0.2.222 community 65534:0 set community BLACKHOLE +match to 192.0.2.222 large-community 65534:0:0 set community BLACKHOLE + +match to 192.0.2.222 community BLACKHOLE set community NO_EXPORT +match to 192.0.2.222 community BLACKHOLE set nexthop 192.0.2.66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.222 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.222 community 65507:999 set community NO_EXPORT +match to 192.0.2.222 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.222 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.222 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.222 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.222 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.222 community 65509:222 set community NO_EXPORT +match to 192.0.2.222 ext-community rt 65509:222 set community NO_EXPORT +match to 192.0.2.222 large-community 999:65509:222 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.222 community 65510:222 set community NO_ADVERTISE +match to 192.0.2.222 ext-community rt 65510:222 set community NO_ADVERTISE +match to 192.0.2.222 large-community 999:65510:222 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.222 + +# do_not_announce_to_any +deny to 192.0.2.222 community 0:999 +deny to 192.0.2.222 ext-community rt 0:999 +deny to 192.0.2.222 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.222 community 0:222 +deny quick to 192.0.2.222 ext-community rt 0:222 +deny quick to 192.0.2.222 large-community 999:0:222 + +# announce_to_peer +allow to 192.0.2.222 community 65501:222 +allow to 192.0.2.222 ext-community rt 65501:222 +allow to 192.0.2.222 large-community 999:65501:222 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.222 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS222_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::222 set community NO_ADVERTISE +match from 2001:db8:1:1::222 nexthop 2001:db8:1:1::222 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::222 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::222 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::222 peer-as != 222' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::222 peer-as != 222 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::222 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::222 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::222 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::222 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::222 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::222 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::222 AS { 3, 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::222 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::222 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::222 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 2001:db8:1:1::222 prefix 222.1.1.0/24 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::222 prefix 3222:0:1::/48 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 2001:db8:1:1::222 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS222_2, AS222: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::222 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS222 referenced but empty. +match from 2001:db8:1:1::222 source-as as-set AS_SET_AS_AS222_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS222 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS222_2, AS222: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::222 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS222 referenced but empty. +match from 2001:db8:1:1::222 prefix-set AS_SET_AS_AS222_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS222 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::222 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::222 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_REGISTROBRDB community have the prefix validated by a NICBR Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::222 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_REGISTROBRDB set ext-community delete $INTCOMM_IRR_REJECT + +# route authorized by a client's white list? +match from 2001:db8:1:1::222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 2001:db8:1:1::222 set ext-community delete rt 65520:222 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::222 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::222 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::222 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::222 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::222 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::222 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::222 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::222 community BLACKHOLE +allow quick from 2001:db8:1:1::222 community 65534:0 +allow quick from 2001:db8:1:1::222 large-community 65534:0:0 + + +match from 2001:db8:1:1::222 set ext-community rt 65520:222 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::222 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::222 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::222 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::222 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::222 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::222 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::222 set ext-community delete rt 65520:222 + + + +allow quick from 2001:db8:1:1::222 + + + +# --------------------------------------------- +# client AS222_2, outbound + +deny quick to 2001:db8:1:1::222 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 2001:db8:1:1::222 community 65534:0 set community BLACKHOLE +match to 2001:db8:1:1::222 large-community 65534:0:0 set community BLACKHOLE + +match to 2001:db8:1:1::222 community BLACKHOLE set community NO_EXPORT +match to 2001:db8:1:1::222 community BLACKHOLE set nexthop 2001:db8:1:1::66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::222 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::222 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::222 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::222 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::222 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::222 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::222 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::222 community 65509:222 set community NO_EXPORT +match to 2001:db8:1:1::222 ext-community rt 65509:222 set community NO_EXPORT +match to 2001:db8:1:1::222 large-community 999:65509:222 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::222 community 65510:222 set community NO_ADVERTISE +match to 2001:db8:1:1::222 ext-community rt 65510:222 set community NO_ADVERTISE +match to 2001:db8:1:1::222 large-community 999:65510:222 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::222 + +# do_not_announce_to_any +deny to 2001:db8:1:1::222 community 0:999 +deny to 2001:db8:1:1::222 ext-community rt 0:999 +deny to 2001:db8:1:1::222 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::222 community 0:222 +deny quick to 2001:db8:1:1::222 ext-community rt 0:222 +deny quick to 2001:db8:1:1::222 large-community 999:0:222 + +# announce_to_peer +allow to 2001:db8:1:1::222 community 65501:222 +allow to 2001:db8:1:1::222 ext-community rt 65501:222 +allow to 2001:db8:1:1::222 large-community 999:65501:222 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::222 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.21 set community NO_ADVERTISE +match from 192.0.2.21 nexthop 192.0.2.21 set community delete NO_ADVERTISE +match from 192.0.2.21 nexthop 192.0.2.22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.21 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.21 AS 23456' - reject code: 7 +allow quick from 192.0.2.21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.21 AS { 3, 174 }' - reject code: 8 +allow quick from 192.0.2.21 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.21 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.21 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +match from 192.0.2.21 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS2_1, AS2: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.21 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 192.0.2.21 source-as as-set AS_SET_AS_AS2_AS_AS2_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS2_AS_AS2_CUSTOMERS + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS2_1, AS2: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.21 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 192.0.2.21 prefix-set AS_SET_AS_AS2_AS_AS2_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS2_AS_AS2_CUSTOMERS + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_REGISTROBRDB community have the prefix validated by a NICBR Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_REGISTROBRDB set ext-community delete $INTCOMM_IRR_REJECT + + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 192.0.2.21 set ext-community delete rt 65520:2 + + +# Remove internal communities before accepting the route +match from 192.0.2.21 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.21 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.21 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.21 community BLACKHOLE set community 65530:4 +match from 192.0.2.21 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.21 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.21 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.21 community BLACKHOLE +allow quick from 192.0.2.21 community 65534:0 +allow quick from 192.0.2.21 large-community 65534:0:0 + + +match from 192.0.2.21 set ext-community rt 65520:2 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.21 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.21 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.21 community GRACEFUL_SHUTDOWN set community delete GRACEFUL_SHUTDOWN + +# Remove internal communities before accepting the route +match from 192.0.2.21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.21 set ext-community delete rt 65520:2 + + + +allow quick from 192.0.2.21 + + + +# --------------------------------------------- +# client AS2_1, outbound + +deny quick to 192.0.2.21 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 192.0.2.21 community 65534:0 set community BLACKHOLE +match to 192.0.2.21 large-community 65534:0:0 set community BLACKHOLE + +match to 192.0.2.21 community BLACKHOLE set community NO_EXPORT +match to 192.0.2.21 community BLACKHOLE set nexthop 192.0.2.66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.21 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.21 community 65507:999 set community NO_EXPORT +match to 192.0.2.21 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.21 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.21 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.21 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.21 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.21 community 65509:2 set community NO_EXPORT +match to 192.0.2.21 ext-community rt 65509:2 set community NO_EXPORT +match to 192.0.2.21 large-community 999:65509:2 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.21 community 65510:2 set community NO_ADVERTISE +match to 192.0.2.21 ext-community rt 65510:2 set community NO_ADVERTISE +match to 192.0.2.21 large-community 999:65510:2 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.21 + +# do_not_announce_to_any +deny to 192.0.2.21 community 0:999 +deny to 192.0.2.21 ext-community rt 0:999 +deny to 192.0.2.21 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.21 community 0:2 +deny quick to 192.0.2.21 ext-community rt 0:2 +deny quick to 192.0.2.21 large-community 999:0:2 + +# announce_to_peer +allow to 192.0.2.21 community 65501:2 +allow to 192.0.2.21 ext-community rt 65501:2 +allow to 192.0.2.21 large-community 999:65501:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::21 set community NO_ADVERTISE +match from 2001:db8:1:1::21 nexthop 2001:db8:1:1::21 set community delete NO_ADVERTISE +match from 2001:db8:1:1::21 nexthop 2001:db8:1:1::22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::21 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS { 3, 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::21 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::21 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +match from 2001:db8:1:1::21 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS2_2, AS2: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::21 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 2001:db8:1:1::21 source-as as-set AS_SET_AS_AS2_AS_AS2_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS2_AS_AS2_CUSTOMERS + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS2_2, AS2: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::21 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 2001:db8:1:1::21 prefix-set AS_SET_AS_AS2_AS_AS2_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS2_AS_AS2_CUSTOMERS + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_REGISTROBRDB community have the prefix validated by a NICBR Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_REGISTROBRDB set ext-community delete $INTCOMM_IRR_REJECT + + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 2001:db8:1:1::21 set ext-community delete rt 65520:2 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::21 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::21 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::21 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::21 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::21 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::21 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::21 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::21 community BLACKHOLE +allow quick from 2001:db8:1:1::21 community 65534:0 +allow quick from 2001:db8:1:1::21 large-community 65534:0:0 + + +match from 2001:db8:1:1::21 set ext-community rt 65520:2 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::21 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::21 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::21 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::21 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::21 community GRACEFUL_SHUTDOWN set community delete GRACEFUL_SHUTDOWN + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::21 set ext-community delete rt 65520:2 + + + +allow quick from 2001:db8:1:1::21 + + + +# --------------------------------------------- +# client AS2_2, outbound + +deny quick to 2001:db8:1:1::21 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 2001:db8:1:1::21 community 65534:0 set community BLACKHOLE +match to 2001:db8:1:1::21 large-community 65534:0:0 set community BLACKHOLE + +match to 2001:db8:1:1::21 community BLACKHOLE set community NO_EXPORT +match to 2001:db8:1:1::21 community BLACKHOLE set nexthop 2001:db8:1:1::66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::21 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::21 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::21 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::21 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::21 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::21 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::21 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::21 community 65509:2 set community NO_EXPORT +match to 2001:db8:1:1::21 ext-community rt 65509:2 set community NO_EXPORT +match to 2001:db8:1:1::21 large-community 999:65509:2 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::21 community 65510:2 set community NO_ADVERTISE +match to 2001:db8:1:1::21 ext-community rt 65510:2 set community NO_ADVERTISE +match to 2001:db8:1:1::21 large-community 999:65510:2 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::21 + +# do_not_announce_to_any +deny to 2001:db8:1:1::21 community 0:999 +deny to 2001:db8:1:1::21 ext-community rt 0:999 +deny to 2001:db8:1:1::21 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::21 community 0:2 +deny quick to 2001:db8:1:1::21 ext-community rt 0:2 +deny quick to 2001:db8:1:1::21 large-community 999:0:2 + +# do_not_announce_to_peers_with_rtt_lower_than 20 ms +deny to 2001:db8:1:1::21 community 64530:20 +deny to 2001:db8:1:1::21 ext-community rt 64530:20 +deny to 2001:db8:1:1::21 large-community 999:64530:20 + + +# do_not_announce_to_peers_with_rtt_lower_than 30 ms +deny to 2001:db8:1:1::21 community 64530:30 +deny to 2001:db8:1:1::21 ext-community rt 64530:30 +deny to 2001:db8:1:1::21 large-community 999:64530:30 + + +# do_not_announce_to_peers_with_rtt_lower_than 50 ms +deny to 2001:db8:1:1::21 community 64530:50 +deny to 2001:db8:1:1::21 ext-community rt 64530:50 +deny to 2001:db8:1:1::21 large-community 999:64530:50 + + +# do_not_announce_to_peers_with_rtt_lower_than 100 ms +deny to 2001:db8:1:1::21 community 64530:100 +deny to 2001:db8:1:1::21 ext-community rt 64530:100 +deny to 2001:db8:1:1::21 large-community 999:64530:100 + + +# do_not_announce_to_peers_with_rtt_lower_than 200 ms +deny to 2001:db8:1:1::21 community 64530:200 +deny to 2001:db8:1:1::21 ext-community rt 64530:200 +deny to 2001:db8:1:1::21 large-community 999:64530:200 + + +# do_not_announce_to_peers_with_rtt_lower_than 500 ms +deny to 2001:db8:1:1::21 community 64530:500 +deny to 2001:db8:1:1::21 ext-community rt 64530:500 +deny to 2001:db8:1:1::21 large-community 999:64530:500 + + +# announce_to_peers_with_rtt_lower_than 20 ms +allow to 2001:db8:1:1::21 community 64532:20 +allow to 2001:db8:1:1::21 ext-community rt 64532:20 +allow to 2001:db8:1:1::21 large-community 999:64532:20 + + +# announce_to_peers_with_rtt_lower_than 30 ms +allow to 2001:db8:1:1::21 community 64532:30 +allow to 2001:db8:1:1::21 ext-community rt 64532:30 +allow to 2001:db8:1:1::21 large-community 999:64532:30 + + +# announce_to_peers_with_rtt_lower_than 50 ms +allow to 2001:db8:1:1::21 community 64532:50 +allow to 2001:db8:1:1::21 ext-community rt 64532:50 +allow to 2001:db8:1:1::21 large-community 999:64532:50 + + +# announce_to_peers_with_rtt_lower_than 100 ms +allow to 2001:db8:1:1::21 community 64532:100 +allow to 2001:db8:1:1::21 ext-community rt 64532:100 +allow to 2001:db8:1:1::21 large-community 999:64532:100 + + +# announce_to_peers_with_rtt_lower_than 200 ms +allow to 2001:db8:1:1::21 community 64532:200 +allow to 2001:db8:1:1::21 ext-community rt 64532:200 +allow to 2001:db8:1:1::21 large-community 999:64532:200 + + +# announce_to_peers_with_rtt_lower_than 500 ms +allow to 2001:db8:1:1::21 community 64532:500 +allow to 2001:db8:1:1::21 ext-community rt 64532:500 +allow to 2001:db8:1:1::21 large-community 999:64532:500 + + +# do_not_announce_to_peers_with_rtt_higher_than 5 ms +deny to 2001:db8:1:1::21 community 64531:5 +deny to 2001:db8:1:1::21 ext-community rt 64531:5 +deny to 2001:db8:1:1::21 large-community 999:64531:5 + + +# do_not_announce_to_peers_with_rtt_higher_than 10 ms +deny to 2001:db8:1:1::21 community 64531:10 +deny to 2001:db8:1:1::21 ext-community rt 64531:10 +deny to 2001:db8:1:1::21 large-community 999:64531:10 + + +# do_not_announce_to_peers_with_rtt_higher_than 15 ms +deny to 2001:db8:1:1::21 community 64531:15 +deny to 2001:db8:1:1::21 ext-community rt 64531:15 +deny to 2001:db8:1:1::21 large-community 999:64531:15 + + +# announce_to_peers_with_rtt_higher_than 5 ms +allow to 2001:db8:1:1::21 community 64533:5 +allow to 2001:db8:1:1::21 ext-community rt 64533:5 +allow to 2001:db8:1:1::21 large-community 999:64533:5 + + +# announce_to_peers_with_rtt_higher_than 10 ms +allow to 2001:db8:1:1::21 community 64533:10 +allow to 2001:db8:1:1::21 ext-community rt 64533:10 +allow to 2001:db8:1:1::21 large-community 999:64533:10 + + +# announce_to_peers_with_rtt_higher_than 15 ms +allow to 2001:db8:1:1::21 community 64533:15 +allow to 2001:db8:1:1::21 ext-community rt 64533:15 +allow to 2001:db8:1:1::21 large-community 999:64533:15 + + +# announce_to_peer +allow to 2001:db8:1:1::21 community 65501:2 +allow to 2001:db8:1:1::21 ext-community rt 65501:2 +allow to 2001:db8:1:1::21 large-community 999:65501:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS3_1, inbound + + + +# NEXT_HOP +match from 192.0.2.31 set community NO_ADVERTISE +match from 192.0.2.31 nexthop 192.0.2.31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.31 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.31 AS 23456' - reject code: 7 +allow quick from 192.0.2.31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.31 AS { 174 }' - reject code: 8 +allow quick from 192.0.2.31 AS { 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.31 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.31 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +# Prefix: client's blacklist +prefix-set "client_AS3_1_black_list_pref_ipv4" { + 3.0.1.0/24 prefixlen 24 - 32 + +} +# Reject inbound routes when 'from 192.0.2.31 prefix-set client_AS3_1_black_list_pref_ipv4' - reject code: 11 +allow quick from 192.0.2.31 prefix-set client_AS3_1_black_list_pref_ipv4 set { + localpref 1 + community 65520:0 + community 65520:11 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Blackhole request? +match from 192.0.2.31 set ext-community delete rt 65520:3 + + +# Remove internal communities before accepting the route +match from 192.0.2.31 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.31 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.31 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.31 community BLACKHOLE set community 65530:4 +match from 192.0.2.31 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.31 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.31 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.31 community BLACKHOLE +allow quick from 192.0.2.31 community 65534:0 +allow quick from 192.0.2.31 large-community 65534:0:0 + + +match from 192.0.2.31 set ext-community rt 65520:3 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.31 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.31 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.31 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 192.0.2.31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.31 set ext-community delete rt 65520:3 + + + +allow quick from 192.0.2.31 + + + +# --------------------------------------------- +# client AS3_1, outbound + +deny quick to 192.0.2.31 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 192.0.2.31 community 65534:0 set community BLACKHOLE +match to 192.0.2.31 large-community 65534:0:0 set community BLACKHOLE + +match to 192.0.2.31 community BLACKHOLE set community NO_EXPORT +match to 192.0.2.31 community BLACKHOLE set nexthop 192.0.2.66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.31 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.31 community 65507:999 set community NO_EXPORT +match to 192.0.2.31 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.31 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.31 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.31 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.31 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.31 community 65509:3 set community NO_EXPORT +match to 192.0.2.31 ext-community rt 65509:3 set community NO_EXPORT +match to 192.0.2.31 large-community 999:65509:3 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.31 community 65510:3 set community NO_ADVERTISE +match to 192.0.2.31 ext-community rt 65510:3 set community NO_ADVERTISE +match to 192.0.2.31 large-community 999:65510:3 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.31 + +# do_not_announce_to_any +deny to 192.0.2.31 community 0:999 +deny to 192.0.2.31 ext-community rt 0:999 +deny to 192.0.2.31 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.31 community 0:3 +deny quick to 192.0.2.31 ext-community rt 0:3 +deny quick to 192.0.2.31 large-community 999:0:3 + +# announce_to_peer +allow to 192.0.2.31 community 65501:3 +allow to 192.0.2.31 ext-community rt 65501:3 +allow to 192.0.2.31 large-community 999:65501:3 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS3_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::31 set community NO_ADVERTISE +match from 2001:db8:1:1::31 nexthop 2001:db8:1:1::31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::31 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::31 AS { 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::31 AS { 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::31 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::31 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +# Prefix: client's blacklist +prefix-set "client_AS3_2_black_list_pref_ipv6" { + 2a03:0:1::/48 prefixlen 48 - 128 + +} +# Reject inbound routes when 'from 2001:db8:1:1::31 prefix-set client_AS3_2_black_list_pref_ipv6' - reject code: 11 +allow quick from 2001:db8:1:1::31 prefix-set client_AS3_2_black_list_pref_ipv6 set { + localpref 1 + community 65520:0 + community 65520:11 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Blackhole request? +match from 2001:db8:1:1::31 set ext-community delete rt 65520:3 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::31 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::31 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::31 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::31 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::31 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::31 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::31 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::31 community BLACKHOLE +allow quick from 2001:db8:1:1::31 community 65534:0 +allow quick from 2001:db8:1:1::31 large-community 65534:0:0 + + +match from 2001:db8:1:1::31 set ext-community rt 65520:3 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::31 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::31 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::31 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::31 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::31 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::31 set ext-community delete rt 65520:3 + + + +allow quick from 2001:db8:1:1::31 + + + +# --------------------------------------------- +# client AS3_2, outbound + +deny quick to 2001:db8:1:1::31 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 2001:db8:1:1::31 community 65534:0 set community BLACKHOLE +match to 2001:db8:1:1::31 large-community 65534:0:0 set community BLACKHOLE + +match to 2001:db8:1:1::31 community BLACKHOLE set community NO_EXPORT +match to 2001:db8:1:1::31 community BLACKHOLE set nexthop 2001:db8:1:1::66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::31 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::31 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::31 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::31 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::31 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::31 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::31 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::31 community 65509:3 set community NO_EXPORT +match to 2001:db8:1:1::31 ext-community rt 65509:3 set community NO_EXPORT +match to 2001:db8:1:1::31 large-community 999:65509:3 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::31 community 65510:3 set community NO_ADVERTISE +match to 2001:db8:1:1::31 ext-community rt 65510:3 set community NO_ADVERTISE +match to 2001:db8:1:1::31 large-community 999:65510:3 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::31 + +# do_not_announce_to_any +deny to 2001:db8:1:1::31 community 0:999 +deny to 2001:db8:1:1::31 ext-community rt 0:999 +deny to 2001:db8:1:1::31 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::31 community 0:3 +deny quick to 2001:db8:1:1::31 ext-community rt 0:3 +deny quick to 2001:db8:1:1::31 large-community 999:0:3 + +# do_not_announce_to_peers_with_rtt_lower_than 200 ms +deny to 2001:db8:1:1::31 community 64530:200 +deny to 2001:db8:1:1::31 ext-community rt 64530:200 +deny to 2001:db8:1:1::31 large-community 999:64530:200 + + +# do_not_announce_to_peers_with_rtt_lower_than 500 ms +deny to 2001:db8:1:1::31 community 64530:500 +deny to 2001:db8:1:1::31 ext-community rt 64530:500 +deny to 2001:db8:1:1::31 large-community 999:64530:500 + + +# announce_to_peers_with_rtt_lower_than 200 ms +allow to 2001:db8:1:1::31 community 64532:200 +allow to 2001:db8:1:1::31 ext-community rt 64532:200 +allow to 2001:db8:1:1::31 large-community 999:64532:200 + + +# announce_to_peers_with_rtt_lower_than 500 ms +allow to 2001:db8:1:1::31 community 64532:500 +allow to 2001:db8:1:1::31 ext-community rt 64532:500 +allow to 2001:db8:1:1::31 large-community 999:64532:500 + + +# do_not_announce_to_peers_with_rtt_higher_than 5 ms +deny to 2001:db8:1:1::31 community 64531:5 +deny to 2001:db8:1:1::31 ext-community rt 64531:5 +deny to 2001:db8:1:1::31 large-community 999:64531:5 + + +# do_not_announce_to_peers_with_rtt_higher_than 10 ms +deny to 2001:db8:1:1::31 community 64531:10 +deny to 2001:db8:1:1::31 ext-community rt 64531:10 +deny to 2001:db8:1:1::31 large-community 999:64531:10 + + +# do_not_announce_to_peers_with_rtt_higher_than 15 ms +deny to 2001:db8:1:1::31 community 64531:15 +deny to 2001:db8:1:1::31 ext-community rt 64531:15 +deny to 2001:db8:1:1::31 large-community 999:64531:15 + + +# do_not_announce_to_peers_with_rtt_higher_than 20 ms +deny to 2001:db8:1:1::31 community 64531:20 +deny to 2001:db8:1:1::31 ext-community rt 64531:20 +deny to 2001:db8:1:1::31 large-community 999:64531:20 + + +# do_not_announce_to_peers_with_rtt_higher_than 30 ms +deny to 2001:db8:1:1::31 community 64531:30 +deny to 2001:db8:1:1::31 ext-community rt 64531:30 +deny to 2001:db8:1:1::31 large-community 999:64531:30 + + +# do_not_announce_to_peers_with_rtt_higher_than 50 ms +deny to 2001:db8:1:1::31 community 64531:50 +deny to 2001:db8:1:1::31 ext-community rt 64531:50 +deny to 2001:db8:1:1::31 large-community 999:64531:50 + + +# do_not_announce_to_peers_with_rtt_higher_than 100 ms +deny to 2001:db8:1:1::31 community 64531:100 +deny to 2001:db8:1:1::31 ext-community rt 64531:100 +deny to 2001:db8:1:1::31 large-community 999:64531:100 + + +# announce_to_peers_with_rtt_higher_than 5 ms +allow to 2001:db8:1:1::31 community 64533:5 +allow to 2001:db8:1:1::31 ext-community rt 64533:5 +allow to 2001:db8:1:1::31 large-community 999:64533:5 + + +# announce_to_peers_with_rtt_higher_than 10 ms +allow to 2001:db8:1:1::31 community 64533:10 +allow to 2001:db8:1:1::31 ext-community rt 64533:10 +allow to 2001:db8:1:1::31 large-community 999:64533:10 + + +# announce_to_peers_with_rtt_higher_than 15 ms +allow to 2001:db8:1:1::31 community 64533:15 +allow to 2001:db8:1:1::31 ext-community rt 64533:15 +allow to 2001:db8:1:1::31 large-community 999:64533:15 + + +# announce_to_peers_with_rtt_higher_than 20 ms +allow to 2001:db8:1:1::31 community 64533:20 +allow to 2001:db8:1:1::31 ext-community rt 64533:20 +allow to 2001:db8:1:1::31 large-community 999:64533:20 + + +# announce_to_peers_with_rtt_higher_than 30 ms +allow to 2001:db8:1:1::31 community 64533:30 +allow to 2001:db8:1:1::31 ext-community rt 64533:30 +allow to 2001:db8:1:1::31 large-community 999:64533:30 + + +# announce_to_peers_with_rtt_higher_than 50 ms +allow to 2001:db8:1:1::31 community 64533:50 +allow to 2001:db8:1:1::31 ext-community rt 64533:50 +allow to 2001:db8:1:1::31 large-community 999:64533:50 + + +# announce_to_peers_with_rtt_higher_than 100 ms +allow to 2001:db8:1:1::31 community 64533:100 +allow to 2001:db8:1:1::31 ext-community rt 64533:100 +allow to 2001:db8:1:1::31 large-community 999:64533:100 + + +# announce_to_peer +allow to 2001:db8:1:1::31 community 65501:3 +allow to 2001:db8:1:1::31 ext-community rt 65501:3 +allow to 2001:db8:1:1::31 large-community 999:65501:3 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64534:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64535:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64536:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS4_1, inbound + + + +# NEXT_HOP +match from 192.0.2.41 set community NO_ADVERTISE +match from 192.0.2.41 nexthop 192.0.2.41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.41 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.41 AS 23456' - reject code: 7 +allow quick from 192.0.2.41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.41 AS { 3, 174 }' - reject code: 8 +allow quick from 192.0.2.41 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.41 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.41 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + +# Blackhole request? +match from 192.0.2.41 set ext-community delete rt 65520:4 + + +# Remove internal communities before accepting the route +match from 192.0.2.41 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.41 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.41 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.41 community BLACKHOLE set community 65530:4 +match from 192.0.2.41 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.41 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.41 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.41 community BLACKHOLE +allow quick from 192.0.2.41 community 65534:0 +allow quick from 192.0.2.41 large-community 65534:0:0 + + +match from 192.0.2.41 set ext-community rt 65520:4 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.41 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.41 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.41 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 192.0.2.41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.41 set ext-community delete rt 65520:4 + + + +allow quick from 192.0.2.41 + + + +# --------------------------------------------- +# client AS4_1, outbound + +deny quick to 192.0.2.41 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 192.0.2.41 community 65534:0 set community BLACKHOLE +match to 192.0.2.41 large-community 65534:0:0 set community BLACKHOLE + +match to 192.0.2.41 community BLACKHOLE set community NO_EXPORT +match to 192.0.2.41 community BLACKHOLE set nexthop 192.0.2.66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.41 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.41 community 65507:999 set community NO_EXPORT +match to 192.0.2.41 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.41 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.41 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.41 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.41 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.41 community 65509:4 set community NO_EXPORT +match to 192.0.2.41 ext-community rt 65509:4 set community NO_EXPORT +match to 192.0.2.41 large-community 999:65509:4 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.41 community 65510:4 set community NO_ADVERTISE +match to 192.0.2.41 ext-community rt 65510:4 set community NO_ADVERTISE +match to 192.0.2.41 large-community 999:65510:4 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.41 + +# do_not_announce_to_any +deny to 192.0.2.41 community 0:999 +deny to 192.0.2.41 ext-community rt 0:999 +deny to 192.0.2.41 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.41 community 0:4 +deny quick to 192.0.2.41 ext-community rt 0:4 +deny quick to 192.0.2.41 large-community 999:0:4 + +# announce_to_peer +allow to 192.0.2.41 community 65501:4 +allow to 192.0.2.41 ext-community rt 65501:4 +allow to 192.0.2.41 large-community 999:65501:4 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS4_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::41 set community NO_ADVERTISE +match from 2001:db8:1:1::41 nexthop 2001:db8:1:1::41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::41 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS { 3, 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::41 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::41 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + +# Blackhole request? +match from 2001:db8:1:1::41 set ext-community delete rt 65520:4 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::41 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::41 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::41 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::41 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::41 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::41 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::41 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::41 community BLACKHOLE +allow quick from 2001:db8:1:1::41 community 65534:0 +allow quick from 2001:db8:1:1::41 large-community 65534:0:0 + + +match from 2001:db8:1:1::41 set ext-community rt 65520:4 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::41 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::41 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::41 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::41 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::41 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::41 set ext-community delete rt 65520:4 + + + +allow quick from 2001:db8:1:1::41 + + + +# --------------------------------------------- +# client AS4_2, outbound + +deny quick to 2001:db8:1:1::41 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 2001:db8:1:1::41 community 65534:0 set community BLACKHOLE +match to 2001:db8:1:1::41 large-community 65534:0:0 set community BLACKHOLE + +match to 2001:db8:1:1::41 community BLACKHOLE set community NO_EXPORT +match to 2001:db8:1:1::41 community BLACKHOLE set nexthop 2001:db8:1:1::66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::41 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::41 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::41 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::41 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::41 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::41 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::41 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::41 community 65509:4 set community NO_EXPORT +match to 2001:db8:1:1::41 ext-community rt 65509:4 set community NO_EXPORT +match to 2001:db8:1:1::41 large-community 999:65509:4 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::41 community 65510:4 set community NO_ADVERTISE +match to 2001:db8:1:1::41 ext-community rt 65510:4 set community NO_ADVERTISE +match to 2001:db8:1:1::41 large-community 999:65510:4 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::41 + +# do_not_announce_to_any +deny to 2001:db8:1:1::41 community 0:999 +deny to 2001:db8:1:1::41 ext-community rt 0:999 +deny to 2001:db8:1:1::41 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::41 community 0:4 +deny quick to 2001:db8:1:1::41 ext-community rt 0:4 +deny quick to 2001:db8:1:1::41 large-community 999:0:4 + +# do_not_announce_to_peers_with_rtt_higher_than 5 ms +deny to 2001:db8:1:1::41 community 64531:5 +deny to 2001:db8:1:1::41 ext-community rt 64531:5 +deny to 2001:db8:1:1::41 large-community 999:64531:5 + + +# do_not_announce_to_peers_with_rtt_higher_than 10 ms +deny to 2001:db8:1:1::41 community 64531:10 +deny to 2001:db8:1:1::41 ext-community rt 64531:10 +deny to 2001:db8:1:1::41 large-community 999:64531:10 + + +# do_not_announce_to_peers_with_rtt_higher_than 15 ms +deny to 2001:db8:1:1::41 community 64531:15 +deny to 2001:db8:1:1::41 ext-community rt 64531:15 +deny to 2001:db8:1:1::41 large-community 999:64531:15 + + +# do_not_announce_to_peers_with_rtt_higher_than 20 ms +deny to 2001:db8:1:1::41 community 64531:20 +deny to 2001:db8:1:1::41 ext-community rt 64531:20 +deny to 2001:db8:1:1::41 large-community 999:64531:20 + + +# do_not_announce_to_peers_with_rtt_higher_than 30 ms +deny to 2001:db8:1:1::41 community 64531:30 +deny to 2001:db8:1:1::41 ext-community rt 64531:30 +deny to 2001:db8:1:1::41 large-community 999:64531:30 + + +# do_not_announce_to_peers_with_rtt_higher_than 50 ms +deny to 2001:db8:1:1::41 community 64531:50 +deny to 2001:db8:1:1::41 ext-community rt 64531:50 +deny to 2001:db8:1:1::41 large-community 999:64531:50 + + +# do_not_announce_to_peers_with_rtt_higher_than 100 ms +deny to 2001:db8:1:1::41 community 64531:100 +deny to 2001:db8:1:1::41 ext-community rt 64531:100 +deny to 2001:db8:1:1::41 large-community 999:64531:100 + + +# do_not_announce_to_peers_with_rtt_higher_than 200 ms +deny to 2001:db8:1:1::41 community 64531:200 +deny to 2001:db8:1:1::41 ext-community rt 64531:200 +deny to 2001:db8:1:1::41 large-community 999:64531:200 + + +# do_not_announce_to_peers_with_rtt_higher_than 500 ms +deny to 2001:db8:1:1::41 community 64531:500 +deny to 2001:db8:1:1::41 ext-community rt 64531:500 +deny to 2001:db8:1:1::41 large-community 999:64531:500 + + +# announce_to_peers_with_rtt_higher_than 5 ms +allow to 2001:db8:1:1::41 community 64533:5 +allow to 2001:db8:1:1::41 ext-community rt 64533:5 +allow to 2001:db8:1:1::41 large-community 999:64533:5 + + +# announce_to_peers_with_rtt_higher_than 10 ms +allow to 2001:db8:1:1::41 community 64533:10 +allow to 2001:db8:1:1::41 ext-community rt 64533:10 +allow to 2001:db8:1:1::41 large-community 999:64533:10 + + +# announce_to_peers_with_rtt_higher_than 15 ms +allow to 2001:db8:1:1::41 community 64533:15 +allow to 2001:db8:1:1::41 ext-community rt 64533:15 +allow to 2001:db8:1:1::41 large-community 999:64533:15 + + +# announce_to_peers_with_rtt_higher_than 20 ms +allow to 2001:db8:1:1::41 community 64533:20 +allow to 2001:db8:1:1::41 ext-community rt 64533:20 +allow to 2001:db8:1:1::41 large-community 999:64533:20 + + +# announce_to_peers_with_rtt_higher_than 30 ms +allow to 2001:db8:1:1::41 community 64533:30 +allow to 2001:db8:1:1::41 ext-community rt 64533:30 +allow to 2001:db8:1:1::41 large-community 999:64533:30 + + +# announce_to_peers_with_rtt_higher_than 50 ms +allow to 2001:db8:1:1::41 community 64533:50 +allow to 2001:db8:1:1::41 ext-community rt 64533:50 +allow to 2001:db8:1:1::41 large-community 999:64533:50 + + +# announce_to_peers_with_rtt_higher_than 100 ms +allow to 2001:db8:1:1::41 community 64533:100 +allow to 2001:db8:1:1::41 ext-community rt 64533:100 +allow to 2001:db8:1:1::41 large-community 999:64533:100 + + +# announce_to_peers_with_rtt_higher_than 200 ms +allow to 2001:db8:1:1::41 community 64533:200 +allow to 2001:db8:1:1::41 ext-community rt 64533:200 +allow to 2001:db8:1:1::41 large-community 999:64533:200 + + +# announce_to_peers_with_rtt_higher_than 500 ms +allow to 2001:db8:1:1::41 community 64533:500 +allow to 2001:db8:1:1::41 ext-community rt 64533:500 +allow to 2001:db8:1:1::41 large-community 999:64533:500 + + +# announce_to_peer +allow to 2001:db8:1:1::41 community 65501:4 +allow to 2001:db8:1:1::41 ext-community rt 65501:4 +allow to 2001:db8:1:1::41 large-community 999:65501:4 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64537:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64538:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64539:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + + + +# Scrub communities from outbound routes +# add_noadvertise_to_any +match to group clients set community delete 65508:999 +match to group clients set ext-community delete rt 65508:999 +match to group clients set large-community delete 999:65508:999 + +# add_noadvertise_to_peer +match to group clients set community delete 65510:* +match to group clients set ext-community delete rt 65510:* +match to group clients set large-community delete 999:65510:* + +# add_noexport_to_any +match to group clients set community delete 65507:999 +match to group clients set ext-community delete rt 65507:999 +match to group clients set large-community delete 999:65507:999 + +# add_noexport_to_peer +match to group clients set community delete 65509:* +match to group clients set ext-community delete rt 65509:* +match to group clients set large-community delete 999:65509:* + +# announce_to_peer +match to group clients set community delete 65501:* +match to group clients set ext-community delete rt 65501:* +match to group clients set large-community delete 999:65501:* + +# announce_to_peers_with_rtt_higher_than +match to group clients set community delete 64533:* +match to group clients set ext-community delete rt 64533:* +match to group clients set large-community delete 999:64533:* + +# announce_to_peers_with_rtt_lower_than +match to group clients set community delete 64532:* +match to group clients set ext-community delete rt 64532:* +match to group clients set large-community delete 999:64532:* + +# blackholing +match to group clients set community delete 65534:0 +match to group clients set large-community delete 65534:0:0 + +# do_not_announce_to_any +match to group clients set community delete 0:999 +match to group clients set ext-community delete rt 0:999 +match to group clients set large-community delete 999:0:999 + +# do_not_announce_to_peer +match to group clients set community delete 0:* +match to group clients set ext-community delete rt 0:* +match to group clients set large-community delete 999:0:* + +# do_not_announce_to_peers_with_rtt_higher_than +match to group clients set community delete 64531:* +match to group clients set ext-community delete rt 64531:* +match to group clients set large-community delete 999:64531:* + +# do_not_announce_to_peers_with_rtt_lower_than +match to group clients set community delete 64530:* +match to group clients set ext-community delete rt 64530:* +match to group clients set large-community delete 999:64530:* + +# prepend_once_to_any +match to group clients set community delete 65521:65521 +match to group clients set ext-community delete rt 65521:65521 +match to group clients set large-community delete 999:65521:65521 + +# prepend_once_to_peer +match to group clients set community delete 65521:* +match to group clients set ext-community delete rt 65521:* +match to group clients set large-community delete 999:65521:* + +# prepend_once_to_peers_with_rtt_higher_than +match to group clients set community delete 64537:* +match to group clients set ext-community delete rt 64537:* +match to group clients set large-community delete 999:64537:* + +# prepend_once_to_peers_with_rtt_lower_than +match to group clients set community delete 64534:* +match to group clients set ext-community delete rt 64534:* +match to group clients set large-community delete 999:64534:* + +# prepend_thrice_to_any +match to group clients set community delete 65523:65523 +match to group clients set ext-community delete rt 65523:65523 +match to group clients set large-community delete 999:65523:65523 + +# prepend_thrice_to_peer +match to group clients set community delete 65523:* +match to group clients set ext-community delete rt 65523:* +match to group clients set large-community delete 999:65523:* + +# prepend_thrice_to_peers_with_rtt_higher_than +match to group clients set community delete 64539:* +match to group clients set ext-community delete rt 64539:* +match to group clients set large-community delete 999:64539:* + +# prepend_thrice_to_peers_with_rtt_lower_than +match to group clients set community delete 64536:* +match to group clients set ext-community delete rt 64536:* +match to group clients set large-community delete 999:64536:* + +# prepend_twice_to_any +match to group clients set community delete 65522:65522 +match to group clients set ext-community delete rt 65522:65522 +match to group clients set large-community delete 999:65522:65522 + +# prepend_twice_to_peer +match to group clients set community delete 65522:* +match to group clients set ext-community delete rt 65522:* +match to group clients set large-community delete 999:65522:* + +# prepend_twice_to_peers_with_rtt_higher_than +match to group clients set community delete 64538:* +match to group clients set ext-community delete rt 64538:* +match to group clients set large-community delete 999:64538:* + +# prepend_twice_to_peers_with_rtt_lower_than +match to group clients set community delete 64535:* +match to group clients set ext-community delete rt 64535:* +match to group clients set large-community delete 999:64535:* + +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities +match to group clients set { + community delete 65521:65521 + ext-community delete rt 65521:65521 + large-community delete 999:65521:65521 + +} +match to group clients set { + community delete 65521:* + ext-community delete rt 65521:* + large-community delete 999:65521:* + +} +match to group clients set { + community delete 64537:* + ext-community delete rt 64537:* + large-community delete 999:64537:* + +} +match to group clients set { + community delete 64534:* + ext-community delete rt 64534:* + large-community delete 999:64534:* + +} +match to group clients set { + community delete 65523:65523 + ext-community delete rt 65523:65523 + large-community delete 999:65523:65523 + +} +match to group clients set { + community delete 65523:* + ext-community delete rt 65523:* + large-community delete 999:65523:* + +} +match to group clients set { + community delete 64539:* + ext-community delete rt 64539:* + large-community delete 999:64539:* + +} +match to group clients set { + community delete 64536:* + ext-community delete rt 64536:* + large-community delete 999:64536:* + +} +match to group clients set { + community delete 65522:65522 + ext-community delete rt 65522:65522 + large-community delete 999:65522:65522 + +} +match to group clients set { + community delete 65522:* + ext-community delete rt 65522:* + large-community delete 999:65522:* + +} +match to group clients set { + community delete 64538:* + ext-community delete rt 64538:* + large-community delete 999:64538:* + +} +match to group clients set { + community delete 64535:* + ext-community delete rt 64535:* + large-community delete 999:64535:* + +} + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +include "/etc/bgpd/post-filters.local" + + diff --git a/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd76p/AS101.txt b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd76p/AS101.txt new file mode 100644 index 00000000..6fcbe9f9 --- /dev/null +++ b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd76p/AS101.txt @@ -0,0 +1,588 @@ +1.0.1.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +1.0.1.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.12, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +1.0.1.0/24, AS_PATH: 2 1, NEXT_HOP: 192.0.2.11, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +1.0.2.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +1.0.2.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.12, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +1.0.2.0/24, AS_PATH: 2 1, NEXT_HOP: 192.0.2.11, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +1.0.3.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.12, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +1.0.3.0/24, AS_PATH: 2 1, NEXT_HOP: 192.0.2.11, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +10.0.0.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +11.1.1.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +11.1.1.0/24, AS_PATH: 2 1 1011, NEXT_HOP: 192.0.2.11, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +11.1.2.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +11.2.1.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +11.3.0.0/16, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +11.3.0.0/16, AS_PATH: 2 1 1011, NEXT_HOP: 192.0.2.11, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +11.3.1.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +11.4.1.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +11.4.1.0/24, AS_PATH: 2 1 1000, NEXT_HOP: 192.0.2.11, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +128.0.0.0/10, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +128.0.0.0/7, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +128.0.0.0/8, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +128.0.0.0/9, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +192.0.2.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.1.0/24, AS_PATH: 1 2, NEXT_HOP: 192.0.2.21, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2.0.1.0/24, AS_PATH: 1 2, NEXT_HOP: 192.0.2.21, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2.0.1.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.2.0/24, AS_PATH: 1 2, NEXT_HOP: 192.0.2.21, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2.0.2.0/24, AS_PATH: 1 2, NEXT_HOP: 192.0.2.21, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2.0.2.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.1/32, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.2/32, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.3/32, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.4.0/24, AS_PATH: 1 2, NEXT_HOP: 192.0.2.22, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2.0.4.0/24, AS_PATH: 1 2, NEXT_HOP: 192.0.2.22, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2.0.4.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.5.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +222.2.2.0/24, AS_PATH: 1 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +222.2.2.0/24, AS_PATH: 1 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +222.2.2.0/24, AS_PATH: 2 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +222.3.3.0/24, AS_PATH: 1 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +222.3.3.0/24, AS_PATH: 1 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +222.3.3.0/24, AS_PATH: 2 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3.0.10.0/24, AS_PATH: 1 3 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3.0.10.0/24, AS_PATH: 1 3 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3.0.10.0/24, AS_PATH: 2 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.12.0/24, AS_PATH: 2 3 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.2.0/24, AS_PATH: 1 3, NEXT_HOP: 192.0.2.31, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.2.0/24, AS_PATH: 1 3, NEXT_HOP: 192.0.2.31, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3.0.3.0/24, AS_PATH: 2 3, NEXT_HOP: 192.0.2.31, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.5.0/24, AS_PATH: 1 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.5.0/24, AS_PATH: 1 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3.0.5.0/24, AS_PATH: 2 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3.0.6.0/24, AS_PATH: 1 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.6.0/24, AS_PATH: 1 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3.0.6.0/24, AS_PATH: 2 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3.0.7.0/24, AS_PATH: 1 3 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.7.0/24, AS_PATH: 1 3 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3.0.7.0/24, AS_PATH: 2 3 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3.0.8.0/24, AS_PATH: 1 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3.0.8.0/24, AS_PATH: 1 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3.0.8.0/24, AS_PATH: 2 3, NEXT_HOP: 192.0.2.31, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.9.0/24, AS_PATH: 1 3, NEXT_HOP: 192.0.2.31, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.9.0/24, AS_PATH: 1 3, NEXT_HOP: 192.0.2.31, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3.0.9.0/24, AS_PATH: 2 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +4.0.1.0/24, AS_PATH: 1 4, NEXT_HOP: 192.0.2.41, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.1.0/24, AS_PATH: 1 4, NEXT_HOP: 192.0.2.41, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +4.0.10.0/24, AS_PATH: 1 4, NEXT_HOP: 192.0.2.41, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.10.0/24, AS_PATH: 1 4, NEXT_HOP: 192.0.2.41, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +4.0.10.0/24, AS_PATH: 2 4 4, NEXT_HOP: 192.0.2.41, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +4.0.2.0/24, AS_PATH: 1 4, NEXT_HOP: 192.0.2.41, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.2.0/24, AS_PATH: 1 4, NEXT_HOP: 192.0.2.41, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +4.0.3.0/24, AS_PATH: 1 4, NEXT_HOP: 192.0.2.41, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.3.0/24, AS_PATH: 1 4, NEXT_HOP: 192.0.2.41, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +4.0.4.0/24, AS_PATH: 1 4, NEXT_HOP: 192.0.2.41, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.4.0/24, AS_PATH: 1 4, NEXT_HOP: 192.0.2.41, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +4.0.5.0/24, AS_PATH: 1 4, NEXT_HOP: 192.0.2.41, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.5.0/24, AS_PATH: 1 4, NEXT_HOP: 192.0.2.41, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +4.0.6.0/24, AS_PATH: 2 4, NEXT_HOP: 192.0.2.41, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.8.0/24, AS_PATH: 1 4, NEXT_HOP: 192.0.2.41, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.8.0/24, AS_PATH: 1 4, NEXT_HOP: 192.0.2.41, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +4.0.8.0/24, AS_PATH: 2 4 4 4, NEXT_HOP: 192.0.2.41, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +4.0.9.0/24, AS_PATH: 1 4 4 4 4, NEXT_HOP: 192.0.2.41, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +4.0.9.0/24, AS_PATH: 1 4 4 4 4, NEXT_HOP: 192.0.2.41, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +4.0.9.0/24, AS_PATH: 2 4 4 4, NEXT_HOP: 192.0.2.41, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd76p/AS1_1.txt b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd76p/AS1_1.txt new file mode 100644 index 00000000..3a6fd1d4 --- /dev/null +++ b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd76p/AS1_1.txt @@ -0,0 +1,350 @@ +101.0.1.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.10.0/24, AS_PATH: 101 666, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.11.0/24, AS_PATH: 101 777, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.128.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.128.1/32, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: 65535:666 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.2.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: 65530:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.3.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: 999:65530:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.4.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: 888:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.5.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: 888:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.6.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: 65530:1, 777:0 + ext comms: + lrg comms: 777:0:0, 999:65530:1 + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.7.0/24, AS_PATH: 101 174, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.8.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.9.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.1.0.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.2.0.0/17, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.2.1.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.2.128.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.3.0.0/24, AS_PATH: 101 105, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +102.0.1.0/24, AS_PATH: 101 102, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +103.0.1.0/24, AS_PATH: 101 103, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +103.0.2.0/24, AS_PATH: 101 101 103, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +104.0.1.0/24, AS_PATH: 101 104, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +104.1.1.0/24, AS_PATH: 101 104, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.1.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.2.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.1/32, AS_PATH: 2, NEXT_HOP: 192.0.2.66, via 192.0.2.2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.2/32, AS_PATH: 2, NEXT_HOP: 192.0.2.66, via 192.0.2.2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.3/32, AS_PATH: 2, NEXT_HOP: 192.0.2.66, via 192.0.2.2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.4.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.22, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +222.2.2.0/24, AS_PATH: 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +222.3.3.0/24, AS_PATH: 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.10.0/24, AS_PATH: 3 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.11.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.12.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.13.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.2.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.5.0/24, AS_PATH: 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.6.0/24, AS_PATH: 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.7.0/24, AS_PATH: 3 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.8.0/24, AS_PATH: 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.9.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.1.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.10.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.2.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.3.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.4.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.5.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.7.1/32, AS_PATH: 4, NEXT_HOP: 192.0.2.66, via 192.0.2.2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.8.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.9.0/24, AS_PATH: 4 4 4 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd76p/AS1_2.txt b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd76p/AS1_2.txt new file mode 100644 index 00000000..8642e190 --- /dev/null +++ b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd76p/AS1_2.txt @@ -0,0 +1,322 @@ +101.0.1.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.10.0/24, AS_PATH: 101 666, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.11.0/24, AS_PATH: 101 777, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.128.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.128.1/32, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: 65535:666 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.2.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: 65530:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.3.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: 999:65530:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.4.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: 888:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.5.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: 888:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.6.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: 65530:1, 777:0 + ext comms: + lrg comms: 777:0:0, 999:65530:1 + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.7.0/24, AS_PATH: 101 174, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.8.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.9.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.1.0.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.2.0.0/17, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.2.1.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.2.128.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.3.0.0/24, AS_PATH: 101 105, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +102.0.1.0/24, AS_PATH: 101 102, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +103.0.1.0/24, AS_PATH: 101 103, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +103.0.2.0/24, AS_PATH: 101 101 103, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +104.0.1.0/24, AS_PATH: 101 104, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +104.1.1.0/24, AS_PATH: 101 104, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.1.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.2.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.4.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.22, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +222.2.2.0/24, AS_PATH: 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +222.3.3.0/24, AS_PATH: 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.10.0/24, AS_PATH: 3 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.11.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.12.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.13.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.2.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.5.0/24, AS_PATH: 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.6.0/24, AS_PATH: 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.7.0/24, AS_PATH: 3 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.8.0/24, AS_PATH: 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.9.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.1.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.10.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.2.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.3.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.4.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.5.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.8.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.9.0/24, AS_PATH: 4 4 4 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd76p/AS2.txt b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd76p/AS2.txt new file mode 100644 index 00000000..23715fb7 --- /dev/null +++ b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd76p/AS2.txt @@ -0,0 +1,406 @@ +1.0.1.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +1.0.2.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +1.0.3.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.1.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.1.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.10.0/24, AS_PATH: 101 666, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.11.0/24, AS_PATH: 101 777, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.128.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.128.1/32, AS_PATH: 1 101, NEXT_HOP: 192.0.2.66, via 192.0.2.2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.128.1/32, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: 65535:666 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.2.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.2.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: 65530:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.3.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.3.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: 999:65530:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.4.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: 888:0 + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.4.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: 888:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.5.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: 888:0:0 + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.5.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: 888:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.6.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: 777:0 + ext comms: + lrg comms: 777:0:0 + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.6.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: 65530:1, 777:0 + ext comms: + lrg comms: 777:0:0, 999:65530:1 + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.7.0/24, AS_PATH: 101 174, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.8.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.8.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.9.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.1.0.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.2.0.0/17, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.2.0.0/17, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.2.1.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.2.128.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.2.128.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.3.0.0/24, AS_PATH: 101 105, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +102.0.1.0/24, AS_PATH: 101 102, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +103.0.1.0/24, AS_PATH: 101 101 103, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +103.0.2.0/24, AS_PATH: 101 103, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +104.0.1.0/24, AS_PATH: 1 101 104, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +104.0.1.0/24, AS_PATH: 101 104, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +104.1.1.0/24, AS_PATH: 1 101 104, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +104.1.1.0/24, AS_PATH: 101 104, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +11.1.1.0/24, AS_PATH: 1 1011, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +11.3.0.0/16, AS_PATH: 1 1011, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +11.4.1.0/24, AS_PATH: 1 1000, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +222.2.2.0/24, AS_PATH: 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +222.3.3.0/24, AS_PATH: 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.10.0/24, AS_PATH: 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.11.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.12.0/24, AS_PATH: 3 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.13.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.3.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.5.0/24, AS_PATH: 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.6.0/24, AS_PATH: 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.7.0/24, AS_PATH: 3 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.8.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.9.0/24, AS_PATH: 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.10.0/24, AS_PATH: 4 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.6.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.7.1/32, AS_PATH: 4, NEXT_HOP: 192.0.2.66, via 192.0.2.2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.8.0/24, AS_PATH: 4 4 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.9.0/24, AS_PATH: 4 4 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd76p/AS222.txt b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd76p/AS222.txt new file mode 100644 index 00000000..e69de29b diff --git a/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd76p/AS3.txt b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd76p/AS3.txt new file mode 100644 index 00000000..23711ab8 --- /dev/null +++ b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd76p/AS3.txt @@ -0,0 +1,322 @@ +1.0.1.0/24, AS_PATH: 999 1, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +1.0.1.0/24, AS_PATH: 999 1, NEXT_HOP: 192.0.2.12, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 101 + filtered: False () + +1.0.2.0/24, AS_PATH: 999 1, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +1.0.2.0/24, AS_PATH: 999 1, NEXT_HOP: 192.0.2.12, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 101 + filtered: False () + +1.0.3.0/24, AS_PATH: 999 1, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +101.0.1.0/24, AS_PATH: 999 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +101.0.1.0/24, AS_PATH: 999 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.128.1/32, AS_PATH: 999 1 101, NEXT_HOP: 192.0.2.66, via 192.0.2.2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 101 + filtered: False () + +101.0.128.1/32, AS_PATH: 999 2 101, NEXT_HOP: 192.0.2.66, via 192.0.2.2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.2.0/24, AS_PATH: 999 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +101.0.2.0/24, AS_PATH: 999 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.3.0/24, AS_PATH: 999 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +101.0.3.0/24, AS_PATH: 999 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.4.0/24, AS_PATH: 999 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: 888:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +101.0.4.0/24, AS_PATH: 999 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 888:0 + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.5.0/24, AS_PATH: 999 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: 888:0:0 + best: True, LOCAL_PREF: 101 + filtered: False () + +101.0.5.0/24, AS_PATH: 999 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: 888:0:0 + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.6.0/24, AS_PATH: 999 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: 777:0 + ext comms: + lrg comms: 777:0:0 + best: True, LOCAL_PREF: 101 + filtered: False () + +101.0.6.0/24, AS_PATH: 999 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 777:0 + ext comms: + lrg comms: 777:0:0 + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.8.0/24, AS_PATH: 999 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +101.0.8.0/24, AS_PATH: 999 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.2.0.0/17, AS_PATH: 999 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +101.2.0.0/17, AS_PATH: 999 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.2.128.0/24, AS_PATH: 999 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +101.2.128.0/24, AS_PATH: 999 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +103.0.1.0/24, AS_PATH: 999 1 101 103, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: 65535:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +103.0.1.0/24, AS_PATH: 999 2 101 101 103, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +103.0.2.0/24, AS_PATH: 999 1 101 101 103, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +103.0.2.0/24, AS_PATH: 999 2 101 103, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +104.0.1.0/24, AS_PATH: 999 1 101 104, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +104.1.1.0/24, AS_PATH: 999 1 101 104, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +11.1.1.0/24, AS_PATH: 999 1 1011, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +11.3.0.0/16, AS_PATH: 999 1 1011, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +11.4.1.0/24, AS_PATH: 999 1 1000, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +2.0.1.0/24, AS_PATH: 999 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.2.0/24, AS_PATH: 999 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.1/32, AS_PATH: 999 2, NEXT_HOP: 192.0.2.66, via 192.0.2.2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.2/32, AS_PATH: 999 2, NEXT_HOP: 192.0.2.66, via 192.0.2.2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.3/32, AS_PATH: 999 2, NEXT_HOP: 192.0.2.66, via 192.0.2.2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.4.0/24, AS_PATH: 999 2, NEXT_HOP: 192.0.2.22, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +222.2.2.0/24, AS_PATH: 999 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +222.3.3.0/24, AS_PATH: 999 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.10.0/24, AS_PATH: 999 4 4 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.5.0/24, AS_PATH: 999 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.8.0/24, AS_PATH: 999 4 4 4 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.9.0/24, AS_PATH: 999 4 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd76p/AS4.txt b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd76p/AS4.txt new file mode 100644 index 00000000..6bbc453d --- /dev/null +++ b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd76p/AS4.txt @@ -0,0 +1,266 @@ +1.0.1.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +1.0.2.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +1.0.3.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.1.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.128.1/32, AS_PATH: 1 101, NEXT_HOP: 192.0.2.66, via 192.0.2.2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.2.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.3.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.4.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: 888:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.5.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: 888:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.6.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: 777:0 + ext comms: + lrg comms: 777:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.8.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.2.0.0/17, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.2.128.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +103.0.1.0/24, AS_PATH: 2 101 101 103, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +103.0.2.0/24, AS_PATH: 2 101 103, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +104.0.1.0/24, AS_PATH: 1 101 104, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +104.1.1.0/24, AS_PATH: 1 101 104, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +11.1.1.0/24, AS_PATH: 1 1011, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +11.3.0.0/16, AS_PATH: 1 1011, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +11.4.1.0/24, AS_PATH: 1 1000, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.1.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.2.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.1/32, AS_PATH: 2, NEXT_HOP: 192.0.2.66, via 192.0.2.2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.2/32, AS_PATH: 2, NEXT_HOP: 192.0.2.66, via 192.0.2.2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.3/32, AS_PATH: 2, NEXT_HOP: 192.0.2.66, via 192.0.2.2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.4.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.22, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +222.2.2.0/24, AS_PATH: 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +222.3.3.0/24, AS_PATH: 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.10.0/24, AS_PATH: 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.11.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.12.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.13.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.3.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.5.0/24, AS_PATH: 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.6.0/24, AS_PATH: 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.7.0/24, AS_PATH: 3 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.8.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.9.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd76p/rs.txt b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd76p/rs.txt new file mode 100644 index 00000000..d26b2f1b --- /dev/null +++ b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd76p/rs.txt @@ -0,0 +1,847 @@ +0.0.0.0/0, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.31 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (2) + +1.0.1.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +1.0.1.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.12, via 192.0.2.12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +1.0.2.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +1.0.2.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.12, via 192.0.2.12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +1.0.3.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +10.0.0.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (2) + +101.0.1.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.0.1.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.1.0/24, AS_PATH: 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.10.0/24, AS_PATH: 1 101 666, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.0.10.0/24, AS_PATH: 1 101 666, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (15) + +101.0.10.0/24, AS_PATH: 2 101 666, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (15) + +101.0.11.0/24, AS_PATH: 1 101 777, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.0.11.0/24, AS_PATH: 1 101 777, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (15) + +101.0.11.0/24, AS_PATH: 2 101 777, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (15) + +101.0.128.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.0.128.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (14) + +101.0.128.0/24, AS_PATH: 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (14) + +101.0.128.1/32, AS_PATH: 1 101, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: 65535:666 + ext comms: rfc8097-invalid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.0.128.1/32, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: 65530:4, 65535:666 + ext comms: rfc8097-invalid + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.128.1/32, AS_PATH: 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 65530:4, 65535:666 + ext comms: rfc8097-invalid + lrg comms: 999:65530:4 + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.2.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.0.2.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.2.0/24, AS_PATH: 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.3.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.0.3.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.3.0/24, AS_PATH: 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.4.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: 888:0 + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.0.4.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: 888:0 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.4.0/24, AS_PATH: 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 888:0 + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.5.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-not-found + lrg comms: 888:0:0 + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.0.5.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: 888:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.5.0/24, AS_PATH: 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-not-found + lrg comms: 888:0:0 + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.6.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: 777:0 + ext comms: rfc8097-not-found + lrg comms: 777:0:0 + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.0.6.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: 777:0 + ext comms: rfc8097-not-found + lrg comms: 777:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.6.0/24, AS_PATH: 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 777:0 + ext comms: rfc8097-not-found + lrg comms: 777:0:0 + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.7.0/24, AS_PATH: 1 101 174, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.0.7.0/24, AS_PATH: 1 101 174, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (8) + +101.0.7.0/24, AS_PATH: 2 101 174, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (8) + +101.0.8.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.0.8.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.8.0/24, AS_PATH: 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.9.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.0.9.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (14) + +101.0.9.0/24, AS_PATH: 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (14) + +101.1.0.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.1.0.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (12) + +101.1.0.0/24, AS_PATH: 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (12) + +101.2.0.0/17, AS_PATH: 1 101, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.2.0.0/17, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.2.0.0/17, AS_PATH: 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.2.1.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.2.1.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (12) + +101.2.1.0/24, AS_PATH: 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (12) + +101.2.128.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.2.128.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.2.128.0/24, AS_PATH: 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.3.0.0/24, AS_PATH: 1 101 105, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.3.0.0/24, AS_PATH: 1 101 105, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (9) + +101.3.0.0/24, AS_PATH: 2 101 105, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (9) + +102.0.1.0/24, AS_PATH: 1 101 102, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +102.0.1.0/24, AS_PATH: 1 101 102, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (9) + +102.0.1.0/24, AS_PATH: 2 101 102, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (9) + +103.0.1.0/24, AS_PATH: 1 101 103, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: 65535:0 + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +103.0.1.0/24, AS_PATH: 1 101 103, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: 65535:0 + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 5 + filtered: False () + +103.0.1.0/24, AS_PATH: 2 101 101 103, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +103.0.2.0/24, AS_PATH: 1 101 101 103, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +103.0.2.0/24, AS_PATH: 1 101 101 103, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +103.0.2.0/24, AS_PATH: 2 101 103, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +104.0.1.0/24, AS_PATH: 1 101 104, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +104.0.1.0/24, AS_PATH: 1 101 104, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +104.0.1.0/24, AS_PATH: 2 101 104, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (9) + +104.1.1.0/24, AS_PATH: 1 101 104, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +104.1.1.0/24, AS_PATH: 1 101 104, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +104.1.1.0/24, AS_PATH: 2 101 104, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (9) + +11.1.1.0/24, AS_PATH: 1 1011, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +11.1.2.0/24, AS_PATH: 1 1000, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (9) + +11.2.1.0/24, AS_PATH: 1 1011, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (12) + +11.3.0.0/16, AS_PATH: 1 1011, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +11.3.1.0/24, AS_PATH: 1 1011, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (12) + +11.4.1.0/24, AS_PATH: 1 1000, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +128.0.0.0/10, AS_PATH: 1 2 2 2 2 2 2 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (1) + +128.0.0.0/7, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (13) + +128.0.0.0/8, AS_PATH: 2 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: 999:1101:7 + best: True, LOCAL_PREF: 1 + filtered: True (6) + +128.0.0.0/9, AS_PATH: 1 65536 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (7) + +192.0.2.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (3) + +2.0.1.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.2.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.1/32, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 65530:4, 65535:666 + ext comms: rfc8097-not-found + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.2/32, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 65530:4, 65534:0 + ext comms: rfc8097-not-found + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.3/32, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 65530:4 + ext comms: rfc8097-not-found + lrg comms: 65534:0:0, 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.4.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.22, via 192.0.2.21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.5.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.23, via 192.0.2.21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (5) + +222.1.1.0/24, AS_PATH: 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.222 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (14) + +222.2.2.0/24, AS_PATH: 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.222 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +222.3.3.0/24, AS_PATH: 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.222 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.1.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.31 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (11) + +3.0.10.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.31 + std comms: 65521:65521, 65523:1 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.11.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.31 + std comms: 65507:999 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.12.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.31 + std comms: 65509:1, 65523:2 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.13.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.31 + std comms: + ext comms: rfc8097-not-found, soo:65535:65281 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.14.0/24, AS_PATH: 3 174 33, NEXT_HOP: 192.0.2.31, via 192.0.2.31 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (8) + +3.0.2.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.31 + std comms: 0:999, 65501:1 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.3.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.31 + std comms: 0:1 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.4.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.31 + std comms: 0:999 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.5.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.31 + std comms: 65521:65521 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.6.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.31 + std comms: 65522:65522 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.7.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.31 + std comms: 65523:65523 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.8.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.31 + std comms: 65521:1 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.9.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.31 + std comms: 65522:2 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.1.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 0:999, 64532:15 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.10.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: + ext comms: rfc8097-not-found, rt:64537:10, rt:64538:20 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.2.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 0:999, 64532:5 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.3.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 64531:15 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.4.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 64531:5 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.5.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 64531:5, 65501:3 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.6.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 64530:5, 64531:100 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.7.1/32, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 64531:20, 65530:4, 65535:666 + ext comms: rfc8097-not-found + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.8.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 64538:10, 64539:100 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.9.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 64535:20, 64536:5, 65521:65521 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd77p/AS101.txt b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd77p/AS101.txt new file mode 100644 index 00000000..6fcbe9f9 --- /dev/null +++ b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd77p/AS101.txt @@ -0,0 +1,588 @@ +1.0.1.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +1.0.1.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.12, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +1.0.1.0/24, AS_PATH: 2 1, NEXT_HOP: 192.0.2.11, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +1.0.2.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +1.0.2.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.12, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +1.0.2.0/24, AS_PATH: 2 1, NEXT_HOP: 192.0.2.11, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +1.0.3.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.12, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +1.0.3.0/24, AS_PATH: 2 1, NEXT_HOP: 192.0.2.11, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +10.0.0.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +11.1.1.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +11.1.1.0/24, AS_PATH: 2 1 1011, NEXT_HOP: 192.0.2.11, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +11.1.2.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +11.2.1.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +11.3.0.0/16, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +11.3.0.0/16, AS_PATH: 2 1 1011, NEXT_HOP: 192.0.2.11, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +11.3.1.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +11.4.1.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +11.4.1.0/24, AS_PATH: 2 1 1000, NEXT_HOP: 192.0.2.11, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +128.0.0.0/10, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +128.0.0.0/7, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +128.0.0.0/8, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +128.0.0.0/9, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +192.0.2.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.1.0/24, AS_PATH: 1 2, NEXT_HOP: 192.0.2.21, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2.0.1.0/24, AS_PATH: 1 2, NEXT_HOP: 192.0.2.21, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2.0.1.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.2.0/24, AS_PATH: 1 2, NEXT_HOP: 192.0.2.21, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2.0.2.0/24, AS_PATH: 1 2, NEXT_HOP: 192.0.2.21, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2.0.2.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.1/32, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.2/32, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.3/32, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.4.0/24, AS_PATH: 1 2, NEXT_HOP: 192.0.2.22, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2.0.4.0/24, AS_PATH: 1 2, NEXT_HOP: 192.0.2.22, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2.0.4.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.5.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +222.2.2.0/24, AS_PATH: 1 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +222.2.2.0/24, AS_PATH: 1 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +222.2.2.0/24, AS_PATH: 2 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +222.3.3.0/24, AS_PATH: 1 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +222.3.3.0/24, AS_PATH: 1 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +222.3.3.0/24, AS_PATH: 2 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3.0.10.0/24, AS_PATH: 1 3 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3.0.10.0/24, AS_PATH: 1 3 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3.0.10.0/24, AS_PATH: 2 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.12.0/24, AS_PATH: 2 3 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.2.0/24, AS_PATH: 1 3, NEXT_HOP: 192.0.2.31, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.2.0/24, AS_PATH: 1 3, NEXT_HOP: 192.0.2.31, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3.0.3.0/24, AS_PATH: 2 3, NEXT_HOP: 192.0.2.31, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.5.0/24, AS_PATH: 1 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.5.0/24, AS_PATH: 1 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3.0.5.0/24, AS_PATH: 2 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3.0.6.0/24, AS_PATH: 1 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.6.0/24, AS_PATH: 1 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3.0.6.0/24, AS_PATH: 2 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3.0.7.0/24, AS_PATH: 1 3 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.7.0/24, AS_PATH: 1 3 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3.0.7.0/24, AS_PATH: 2 3 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3.0.8.0/24, AS_PATH: 1 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3.0.8.0/24, AS_PATH: 1 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3.0.8.0/24, AS_PATH: 2 3, NEXT_HOP: 192.0.2.31, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.9.0/24, AS_PATH: 1 3, NEXT_HOP: 192.0.2.31, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.9.0/24, AS_PATH: 1 3, NEXT_HOP: 192.0.2.31, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3.0.9.0/24, AS_PATH: 2 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +4.0.1.0/24, AS_PATH: 1 4, NEXT_HOP: 192.0.2.41, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.1.0/24, AS_PATH: 1 4, NEXT_HOP: 192.0.2.41, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +4.0.10.0/24, AS_PATH: 1 4, NEXT_HOP: 192.0.2.41, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.10.0/24, AS_PATH: 1 4, NEXT_HOP: 192.0.2.41, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +4.0.10.0/24, AS_PATH: 2 4 4, NEXT_HOP: 192.0.2.41, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +4.0.2.0/24, AS_PATH: 1 4, NEXT_HOP: 192.0.2.41, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.2.0/24, AS_PATH: 1 4, NEXT_HOP: 192.0.2.41, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +4.0.3.0/24, AS_PATH: 1 4, NEXT_HOP: 192.0.2.41, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.3.0/24, AS_PATH: 1 4, NEXT_HOP: 192.0.2.41, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +4.0.4.0/24, AS_PATH: 1 4, NEXT_HOP: 192.0.2.41, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.4.0/24, AS_PATH: 1 4, NEXT_HOP: 192.0.2.41, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +4.0.5.0/24, AS_PATH: 1 4, NEXT_HOP: 192.0.2.41, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.5.0/24, AS_PATH: 1 4, NEXT_HOP: 192.0.2.41, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +4.0.6.0/24, AS_PATH: 2 4, NEXT_HOP: 192.0.2.41, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.8.0/24, AS_PATH: 1 4, NEXT_HOP: 192.0.2.41, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.8.0/24, AS_PATH: 1 4, NEXT_HOP: 192.0.2.41, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +4.0.8.0/24, AS_PATH: 2 4 4 4, NEXT_HOP: 192.0.2.41, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +4.0.9.0/24, AS_PATH: 1 4 4 4 4, NEXT_HOP: 192.0.2.41, via 192.0.2.11 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +4.0.9.0/24, AS_PATH: 1 4 4 4 4, NEXT_HOP: 192.0.2.41, via 192.0.2.12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +4.0.9.0/24, AS_PATH: 2 4 4 4, NEXT_HOP: 192.0.2.41, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd77p/AS1_1.txt b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd77p/AS1_1.txt new file mode 100644 index 00000000..3a6fd1d4 --- /dev/null +++ b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd77p/AS1_1.txt @@ -0,0 +1,350 @@ +101.0.1.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.10.0/24, AS_PATH: 101 666, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.11.0/24, AS_PATH: 101 777, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.128.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.128.1/32, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: 65535:666 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.2.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: 65530:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.3.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: 999:65530:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.4.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: 888:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.5.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: 888:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.6.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: 65530:1, 777:0 + ext comms: + lrg comms: 777:0:0, 999:65530:1 + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.7.0/24, AS_PATH: 101 174, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.8.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.9.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.1.0.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.2.0.0/17, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.2.1.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.2.128.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.3.0.0/24, AS_PATH: 101 105, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +102.0.1.0/24, AS_PATH: 101 102, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +103.0.1.0/24, AS_PATH: 101 103, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +103.0.2.0/24, AS_PATH: 101 101 103, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +104.0.1.0/24, AS_PATH: 101 104, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +104.1.1.0/24, AS_PATH: 101 104, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.1.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.2.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.1/32, AS_PATH: 2, NEXT_HOP: 192.0.2.66, via 192.0.2.2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.2/32, AS_PATH: 2, NEXT_HOP: 192.0.2.66, via 192.0.2.2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.3/32, AS_PATH: 2, NEXT_HOP: 192.0.2.66, via 192.0.2.2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.4.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.22, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +222.2.2.0/24, AS_PATH: 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +222.3.3.0/24, AS_PATH: 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.10.0/24, AS_PATH: 3 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.11.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.12.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.13.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.2.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.5.0/24, AS_PATH: 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.6.0/24, AS_PATH: 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.7.0/24, AS_PATH: 3 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.8.0/24, AS_PATH: 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.9.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.1.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.10.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.2.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.3.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.4.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.5.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.7.1/32, AS_PATH: 4, NEXT_HOP: 192.0.2.66, via 192.0.2.2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.8.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.9.0/24, AS_PATH: 4 4 4 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd77p/AS1_2.txt b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd77p/AS1_2.txt new file mode 100644 index 00000000..8642e190 --- /dev/null +++ b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd77p/AS1_2.txt @@ -0,0 +1,322 @@ +101.0.1.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.10.0/24, AS_PATH: 101 666, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.11.0/24, AS_PATH: 101 777, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.128.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.128.1/32, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: 65535:666 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.2.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: 65530:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.3.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: 999:65530:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.4.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: 888:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.5.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: 888:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.6.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: 65530:1, 777:0 + ext comms: + lrg comms: 777:0:0, 999:65530:1 + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.7.0/24, AS_PATH: 101 174, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.8.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.9.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.1.0.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.2.0.0/17, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.2.1.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.2.128.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.3.0.0/24, AS_PATH: 101 105, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +102.0.1.0/24, AS_PATH: 101 102, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +103.0.1.0/24, AS_PATH: 101 103, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +103.0.2.0/24, AS_PATH: 101 101 103, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +104.0.1.0/24, AS_PATH: 101 104, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +104.1.1.0/24, AS_PATH: 101 104, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.1.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.2.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.4.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.22, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +222.2.2.0/24, AS_PATH: 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +222.3.3.0/24, AS_PATH: 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.10.0/24, AS_PATH: 3 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.11.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.12.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.13.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.2.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.5.0/24, AS_PATH: 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.6.0/24, AS_PATH: 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.7.0/24, AS_PATH: 3 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.8.0/24, AS_PATH: 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.9.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.1.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.10.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.2.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.3.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.4.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.5.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.8.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.9.0/24, AS_PATH: 4 4 4 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd77p/AS2.txt b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd77p/AS2.txt new file mode 100644 index 00000000..23715fb7 --- /dev/null +++ b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd77p/AS2.txt @@ -0,0 +1,406 @@ +1.0.1.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +1.0.2.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +1.0.3.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.1.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.1.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.10.0/24, AS_PATH: 101 666, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.11.0/24, AS_PATH: 101 777, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.128.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.128.1/32, AS_PATH: 1 101, NEXT_HOP: 192.0.2.66, via 192.0.2.2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.128.1/32, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: 65535:666 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.2.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.2.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: 65530:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.3.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.3.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: 999:65530:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.4.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: 888:0 + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.4.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: 888:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.5.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: 888:0:0 + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.5.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: 888:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.6.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: 777:0 + ext comms: + lrg comms: 777:0:0 + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.6.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: 65530:1, 777:0 + ext comms: + lrg comms: 777:0:0, 999:65530:1 + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.7.0/24, AS_PATH: 101 174, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.8.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.8.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.9.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.1.0.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.2.0.0/17, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.2.0.0/17, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.2.1.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.2.128.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.2.128.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.3.0.0/24, AS_PATH: 101 105, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +102.0.1.0/24, AS_PATH: 101 102, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +103.0.1.0/24, AS_PATH: 101 101 103, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +103.0.2.0/24, AS_PATH: 101 103, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +104.0.1.0/24, AS_PATH: 1 101 104, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +104.0.1.0/24, AS_PATH: 101 104, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +104.1.1.0/24, AS_PATH: 1 101 104, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +104.1.1.0/24, AS_PATH: 101 104, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +11.1.1.0/24, AS_PATH: 1 1011, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +11.3.0.0/16, AS_PATH: 1 1011, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +11.4.1.0/24, AS_PATH: 1 1000, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +222.2.2.0/24, AS_PATH: 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +222.3.3.0/24, AS_PATH: 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.10.0/24, AS_PATH: 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.11.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.12.0/24, AS_PATH: 3 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.13.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.3.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.5.0/24, AS_PATH: 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.6.0/24, AS_PATH: 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.7.0/24, AS_PATH: 3 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.8.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.9.0/24, AS_PATH: 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.10.0/24, AS_PATH: 4 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.6.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.7.1/32, AS_PATH: 4, NEXT_HOP: 192.0.2.66, via 192.0.2.2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.8.0/24, AS_PATH: 4 4 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.9.0/24, AS_PATH: 4 4 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd77p/AS222.txt b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd77p/AS222.txt new file mode 100644 index 00000000..e69de29b diff --git a/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd77p/AS3.txt b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd77p/AS3.txt new file mode 100644 index 00000000..23711ab8 --- /dev/null +++ b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd77p/AS3.txt @@ -0,0 +1,322 @@ +1.0.1.0/24, AS_PATH: 999 1, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +1.0.1.0/24, AS_PATH: 999 1, NEXT_HOP: 192.0.2.12, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 101 + filtered: False () + +1.0.2.0/24, AS_PATH: 999 1, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +1.0.2.0/24, AS_PATH: 999 1, NEXT_HOP: 192.0.2.12, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 101 + filtered: False () + +1.0.3.0/24, AS_PATH: 999 1, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +101.0.1.0/24, AS_PATH: 999 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +101.0.1.0/24, AS_PATH: 999 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.128.1/32, AS_PATH: 999 1 101, NEXT_HOP: 192.0.2.66, via 192.0.2.2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 101 + filtered: False () + +101.0.128.1/32, AS_PATH: 999 2 101, NEXT_HOP: 192.0.2.66, via 192.0.2.2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.2.0/24, AS_PATH: 999 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +101.0.2.0/24, AS_PATH: 999 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.3.0/24, AS_PATH: 999 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +101.0.3.0/24, AS_PATH: 999 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.4.0/24, AS_PATH: 999 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: 888:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +101.0.4.0/24, AS_PATH: 999 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 888:0 + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.5.0/24, AS_PATH: 999 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: 888:0:0 + best: True, LOCAL_PREF: 101 + filtered: False () + +101.0.5.0/24, AS_PATH: 999 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: 888:0:0 + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.6.0/24, AS_PATH: 999 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: 777:0 + ext comms: + lrg comms: 777:0:0 + best: True, LOCAL_PREF: 101 + filtered: False () + +101.0.6.0/24, AS_PATH: 999 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 777:0 + ext comms: + lrg comms: 777:0:0 + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.8.0/24, AS_PATH: 999 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +101.0.8.0/24, AS_PATH: 999 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.2.0.0/17, AS_PATH: 999 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +101.2.0.0/17, AS_PATH: 999 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.2.128.0/24, AS_PATH: 999 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +101.2.128.0/24, AS_PATH: 999 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +103.0.1.0/24, AS_PATH: 999 1 101 103, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: 65535:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +103.0.1.0/24, AS_PATH: 999 2 101 101 103, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +103.0.2.0/24, AS_PATH: 999 1 101 101 103, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +103.0.2.0/24, AS_PATH: 999 2 101 103, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +104.0.1.0/24, AS_PATH: 999 1 101 104, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +104.1.1.0/24, AS_PATH: 999 1 101 104, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +11.1.1.0/24, AS_PATH: 999 1 1011, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +11.3.0.0/16, AS_PATH: 999 1 1011, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +11.4.1.0/24, AS_PATH: 999 1 1000, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +2.0.1.0/24, AS_PATH: 999 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.2.0/24, AS_PATH: 999 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.1/32, AS_PATH: 999 2, NEXT_HOP: 192.0.2.66, via 192.0.2.2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.2/32, AS_PATH: 999 2, NEXT_HOP: 192.0.2.66, via 192.0.2.2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.3/32, AS_PATH: 999 2, NEXT_HOP: 192.0.2.66, via 192.0.2.2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.4.0/24, AS_PATH: 999 2, NEXT_HOP: 192.0.2.22, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +222.2.2.0/24, AS_PATH: 999 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +222.3.3.0/24, AS_PATH: 999 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.10.0/24, AS_PATH: 999 4 4 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.5.0/24, AS_PATH: 999 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.8.0/24, AS_PATH: 999 4 4 4 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.9.0/24, AS_PATH: 999 4 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd77p/AS4.txt b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd77p/AS4.txt new file mode 100644 index 00000000..6bbc453d --- /dev/null +++ b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd77p/AS4.txt @@ -0,0 +1,266 @@ +1.0.1.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +1.0.2.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +1.0.3.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.1.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.128.1/32, AS_PATH: 1 101, NEXT_HOP: 192.0.2.66, via 192.0.2.2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.2.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.3.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.4.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: 888:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.5.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: 888:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.6.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: 777:0 + ext comms: + lrg comms: 777:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.8.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.2.0.0/17, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.2.128.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +103.0.1.0/24, AS_PATH: 2 101 101 103, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +103.0.2.0/24, AS_PATH: 2 101 103, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +104.0.1.0/24, AS_PATH: 1 101 104, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +104.1.1.0/24, AS_PATH: 1 101 104, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +11.1.1.0/24, AS_PATH: 1 1011, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +11.3.0.0/16, AS_PATH: 1 1011, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +11.4.1.0/24, AS_PATH: 1 1000, NEXT_HOP: 192.0.2.11, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.1.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.2.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.1/32, AS_PATH: 2, NEXT_HOP: 192.0.2.66, via 192.0.2.2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.2/32, AS_PATH: 2, NEXT_HOP: 192.0.2.66, via 192.0.2.2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.3/32, AS_PATH: 2, NEXT_HOP: 192.0.2.66, via 192.0.2.2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.4.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.22, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +222.2.2.0/24, AS_PATH: 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +222.3.3.0/24, AS_PATH: 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.10.0/24, AS_PATH: 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.11.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.12.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.13.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.3.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.5.0/24, AS_PATH: 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.6.0/24, AS_PATH: 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.7.0/24, AS_PATH: 3 3 3 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.8.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.9.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd77p/rs.txt b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd77p/rs.txt new file mode 100644 index 00000000..d26b2f1b --- /dev/null +++ b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv4/openbgpd77p/rs.txt @@ -0,0 +1,847 @@ +0.0.0.0/0, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.31 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (2) + +1.0.1.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +1.0.1.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.12, via 192.0.2.12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +1.0.2.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +1.0.2.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.12, via 192.0.2.12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +1.0.3.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +10.0.0.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (2) + +101.0.1.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.0.1.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.1.0/24, AS_PATH: 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.10.0/24, AS_PATH: 1 101 666, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.0.10.0/24, AS_PATH: 1 101 666, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (15) + +101.0.10.0/24, AS_PATH: 2 101 666, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (15) + +101.0.11.0/24, AS_PATH: 1 101 777, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.0.11.0/24, AS_PATH: 1 101 777, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (15) + +101.0.11.0/24, AS_PATH: 2 101 777, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (15) + +101.0.128.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.0.128.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (14) + +101.0.128.0/24, AS_PATH: 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (14) + +101.0.128.1/32, AS_PATH: 1 101, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: 65535:666 + ext comms: rfc8097-invalid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.0.128.1/32, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: 65530:4, 65535:666 + ext comms: rfc8097-invalid + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.128.1/32, AS_PATH: 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 65530:4, 65535:666 + ext comms: rfc8097-invalid + lrg comms: 999:65530:4 + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.2.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.0.2.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.2.0/24, AS_PATH: 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.3.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.0.3.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.3.0/24, AS_PATH: 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.4.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: 888:0 + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.0.4.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: 888:0 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.4.0/24, AS_PATH: 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 888:0 + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.5.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-not-found + lrg comms: 888:0:0 + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.0.5.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: 888:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.5.0/24, AS_PATH: 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-not-found + lrg comms: 888:0:0 + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.6.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: 777:0 + ext comms: rfc8097-not-found + lrg comms: 777:0:0 + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.0.6.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: 777:0 + ext comms: rfc8097-not-found + lrg comms: 777:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.6.0/24, AS_PATH: 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 777:0 + ext comms: rfc8097-not-found + lrg comms: 777:0:0 + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.7.0/24, AS_PATH: 1 101 174, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.0.7.0/24, AS_PATH: 1 101 174, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (8) + +101.0.7.0/24, AS_PATH: 2 101 174, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (8) + +101.0.8.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.0.8.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.8.0/24, AS_PATH: 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.0.9.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.0.9.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (14) + +101.0.9.0/24, AS_PATH: 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (14) + +101.1.0.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.1.0.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (12) + +101.1.0.0/24, AS_PATH: 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (12) + +101.2.0.0/17, AS_PATH: 1 101, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.2.0.0/17, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.2.0.0/17, AS_PATH: 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.2.1.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.2.1.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (12) + +101.2.1.0/24, AS_PATH: 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (12) + +101.2.128.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.2.128.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.2.128.0/24, AS_PATH: 2 101, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +101.3.0.0/24, AS_PATH: 1 101 105, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +101.3.0.0/24, AS_PATH: 1 101 105, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (9) + +101.3.0.0/24, AS_PATH: 2 101 105, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (9) + +102.0.1.0/24, AS_PATH: 1 101 102, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +102.0.1.0/24, AS_PATH: 1 101 102, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (9) + +102.0.1.0/24, AS_PATH: 2 101 102, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (9) + +103.0.1.0/24, AS_PATH: 1 101 103, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: 65535:0 + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +103.0.1.0/24, AS_PATH: 1 101 103, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: 65535:0 + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 5 + filtered: False () + +103.0.1.0/24, AS_PATH: 2 101 101 103, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +103.0.2.0/24, AS_PATH: 1 101 101 103, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +103.0.2.0/24, AS_PATH: 1 101 101 103, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +103.0.2.0/24, AS_PATH: 2 101 103, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +104.0.1.0/24, AS_PATH: 1 101 104, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +104.0.1.0/24, AS_PATH: 1 101 104, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +104.0.1.0/24, AS_PATH: 2 101 104, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (9) + +104.1.1.0/24, AS_PATH: 1 101 104, NEXT_HOP: 192.0.2.101, via 192.0.2.12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +104.1.1.0/24, AS_PATH: 1 101 104, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +104.1.1.0/24, AS_PATH: 2 101 104, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (9) + +11.1.1.0/24, AS_PATH: 1 1011, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +11.1.2.0/24, AS_PATH: 1 1000, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (9) + +11.2.1.0/24, AS_PATH: 1 1011, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (12) + +11.3.0.0/16, AS_PATH: 1 1011, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +11.3.1.0/24, AS_PATH: 1 1011, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (12) + +11.4.1.0/24, AS_PATH: 1 1000, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +128.0.0.0/10, AS_PATH: 1 2 2 2 2 2 2 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (1) + +128.0.0.0/7, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (13) + +128.0.0.0/8, AS_PATH: 2 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: 999:1101:7 + best: True, LOCAL_PREF: 1 + filtered: True (6) + +128.0.0.0/9, AS_PATH: 1 65536 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (7) + +192.0.2.0/24, AS_PATH: 1, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (3) + +2.0.1.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.2.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.1/32, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 65530:4, 65535:666 + ext comms: rfc8097-not-found + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.2/32, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 65530:4, 65534:0 + ext comms: rfc8097-not-found + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.3/32, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 65530:4 + ext comms: rfc8097-not-found + lrg comms: 65534:0:0, 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.4.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.22, via 192.0.2.21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.5.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.23, via 192.0.2.21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (5) + +222.1.1.0/24, AS_PATH: 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.222 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (14) + +222.2.2.0/24, AS_PATH: 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.222 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +222.3.3.0/24, AS_PATH: 222 333, NEXT_HOP: 192.0.2.222, via 192.0.2.222 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.1.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.31 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (11) + +3.0.10.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.31 + std comms: 65521:65521, 65523:1 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.11.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.31 + std comms: 65507:999 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.12.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.31 + std comms: 65509:1, 65523:2 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.13.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.31 + std comms: + ext comms: rfc8097-not-found, soo:65535:65281 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.14.0/24, AS_PATH: 3 174 33, NEXT_HOP: 192.0.2.31, via 192.0.2.31 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (8) + +3.0.2.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.31 + std comms: 0:999, 65501:1 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.3.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.31 + std comms: 0:1 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.4.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.31 + std comms: 0:999 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.5.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.31 + std comms: 65521:65521 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.6.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.31 + std comms: 65522:65522 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.7.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.31 + std comms: 65523:65523 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.8.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.31 + std comms: 65521:1 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.9.0/24, AS_PATH: 3, NEXT_HOP: 192.0.2.31, via 192.0.2.31 + std comms: 65522:2 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.1.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 0:999, 64532:15 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.10.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: + ext comms: rfc8097-not-found, rt:64537:10, rt:64538:20 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.2.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 0:999, 64532:5 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.3.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 64531:15 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.4.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 64531:5 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.5.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 64531:5, 65501:3 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.6.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 64530:5, 64531:100 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.7.1/32, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 64531:20, 65530:4, 65535:666 + ext comms: rfc8097-not-found + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.8.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 64538:10, 64539:100 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.9.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 64535:20, 64536:5, 65521:65521 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd76p/AS101.txt b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd76p/AS101.txt new file mode 100644 index 00000000..022728e9 --- /dev/null +++ b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd76p/AS101.txt @@ -0,0 +1,588 @@ +2001::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2001:db8:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a01:0:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a01:0:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a01:0:1::/48, AS_PATH: 2 1, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a01:0:2::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a01:0:2::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a01:0:2::/48, AS_PATH: 2 1, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a01:0:3::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a01:0:3::/48, AS_PATH: 2 1, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a02:0:1::/48, AS_PATH: 1 2, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a02:0:1::/48, AS_PATH: 1 2, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a02:0:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:2::/48, AS_PATH: 1 2, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a02:0:2::/48, AS_PATH: 1 2, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a02:0:2::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::1/128, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::2/128, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::3/128, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:4::/48, AS_PATH: 1 2, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a02:0:4::/48, AS_PATH: 1 2, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a02:0:4::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:5::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:2::/48, AS_PATH: 1 3, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:2::/48, AS_PATH: 1 3, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:3::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:5::/48, AS_PATH: 1 3 3, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:5::/48, AS_PATH: 1 3 3, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:5::/48, AS_PATH: 2 3 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:6::/48, AS_PATH: 1 3 3 3, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:6::/48, AS_PATH: 1 3 3 3, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:6::/48, AS_PATH: 2 3 3 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:7::/48, AS_PATH: 1 3 3 3 3, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:7::/48, AS_PATH: 1 3 3 3 3, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:7::/48, AS_PATH: 2 3 3 3 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:8::/48, AS_PATH: 1 3 3, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:8::/48, AS_PATH: 1 3 3, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:8::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:9::/48, AS_PATH: 1 3, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:9::/48, AS_PATH: 1 3, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:9::/48, AS_PATH: 2 3 3 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:a::/48, AS_PATH: 1 3 3 3 3, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:a::/48, AS_PATH: 1 3 3 3 3, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:a::/48, AS_PATH: 2 3 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:c::/48, AS_PATH: 2 3 3 3 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:1::/48, AS_PATH: 1 4, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:1::/48, AS_PATH: 1 4, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a04:0:2::/48, AS_PATH: 1 4, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:2::/48, AS_PATH: 1 4, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a04:0:3::/48, AS_PATH: 1 4, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:3::/48, AS_PATH: 1 4, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a04:0:4::/48, AS_PATH: 1 4, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:4::/48, AS_PATH: 1 4, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a04:0:5::/48, AS_PATH: 1 4, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:5::/48, AS_PATH: 1 4, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a04:0:6::/48, AS_PATH: 2 4, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:8::/48, AS_PATH: 1 4, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:8::/48, AS_PATH: 1 4, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a04:0:8::/48, AS_PATH: 2 4 4 4, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a04:0:9::/48, AS_PATH: 1 4 4 4 4, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a04:0:9::/48, AS_PATH: 1 4 4 4 4, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a04:0:9::/48, AS_PATH: 2 4 4 4, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:a::/48, AS_PATH: 1 4, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:a::/48, AS_PATH: 1 4, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a04:0:a::/48, AS_PATH: 2 4 4, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a11:1:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:1:1::/48, AS_PATH: 2 1 1011, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a11:1:2::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:2:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:3:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:3::/32, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:3::/32, AS_PATH: 2 1 1011, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a11:4:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:4:1::/48, AS_PATH: 2 1 1000, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a99:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a99:2::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a99::/16, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a99::/32, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3222:0:2::/48, AS_PATH: 1 222 333, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3222:0:2::/48, AS_PATH: 1 222 333, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3222:0:2::/48, AS_PATH: 2 222 333, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3222:0:3::/48, AS_PATH: 1 222 333, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3222:0:3::/48, AS_PATH: 1 222 333, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3222:0:3::/48, AS_PATH: 2 222 333, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd76p/AS1_1.txt b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd76p/AS1_1.txt new file mode 100644 index 00000000..4db874d8 --- /dev/null +++ b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd76p/AS1_1.txt @@ -0,0 +1,357 @@ +2a02:0:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:2::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::1/128, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::2/128, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::3/128, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:4::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::22, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:2::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:5::/48, AS_PATH: 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:6::/48, AS_PATH: 3 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:7::/48, AS_PATH: 3 3 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:8::/48, AS_PATH: 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:9::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:a::/48, AS_PATH: 3 3 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:b::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:c::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:d::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:1::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:2::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:3::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:4::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:5::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:7::1/128, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:8::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:9::/48, AS_PATH: 4 4 4 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:a::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:10::/48, AS_PATH: 101 666, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:11::/48, AS_PATH: 101 777, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:1::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:2::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 65530:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:3::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: 999:65530:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:4::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 888:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:5::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: 888:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:6::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 65530:1, 777:0 + ext comms: + lrg comms: 777:0:0, 999:65530:1 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:7::/48, AS_PATH: 101 174, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8000::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8000::1/128, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 65535:666 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:9::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:1::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2:4000::/34, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2:8000::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2::/33, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:3:1::/48, AS_PATH: 101 105, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3102:0:1::/48, AS_PATH: 101 102, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3103:0:1::/48, AS_PATH: 101 103, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3103:0:2::/48, AS_PATH: 101 101 103, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3104:0:1::/48, AS_PATH: 101 104, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3104:1:1::/48, AS_PATH: 101 104, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3222:0:2::/48, AS_PATH: 222 333, NEXT_HOP: 2001:db8:1:1::222, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3222:0:3::/48, AS_PATH: 222 333, NEXT_HOP: 2001:db8:1:1::222, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +8000:1::/32, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd76p/AS1_2.txt b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd76p/AS1_2.txt new file mode 100644 index 00000000..5e6299fb --- /dev/null +++ b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd76p/AS1_2.txt @@ -0,0 +1,329 @@ +2a02:0:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:2::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:4::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::22, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:2::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:5::/48, AS_PATH: 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:6::/48, AS_PATH: 3 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:7::/48, AS_PATH: 3 3 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:8::/48, AS_PATH: 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:9::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:a::/48, AS_PATH: 3 3 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:b::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:c::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:d::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:1::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:2::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:3::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:4::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:5::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:8::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:9::/48, AS_PATH: 4 4 4 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:a::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:10::/48, AS_PATH: 101 666, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:11::/48, AS_PATH: 101 777, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:1::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:2::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 65530:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:3::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: 999:65530:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:4::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 888:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:5::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: 888:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:6::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 65530:1, 777:0 + ext comms: + lrg comms: 777:0:0, 999:65530:1 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:7::/48, AS_PATH: 101 174, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8000::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8000::1/128, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 65535:666 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:9::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:1::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2:4000::/34, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2:8000::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2::/33, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:3:1::/48, AS_PATH: 101 105, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3102:0:1::/48, AS_PATH: 101 102, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3103:0:1::/48, AS_PATH: 101 103, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3103:0:2::/48, AS_PATH: 101 101 103, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3104:0:1::/48, AS_PATH: 101 104, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3104:1:1::/48, AS_PATH: 101 104, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3222:0:2::/48, AS_PATH: 222 333, NEXT_HOP: 2001:db8:1:1::222, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3222:0:3::/48, AS_PATH: 222 333, NEXT_HOP: 2001:db8:1:1::222, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +8000:1::/32, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd76p/AS2.txt b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd76p/AS2.txt new file mode 100644 index 00000000..bac1b23a --- /dev/null +++ b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd76p/AS2.txt @@ -0,0 +1,413 @@ +2a01:0:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a01:0:2::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a01:0:3::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:3::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:5::/48, AS_PATH: 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:6::/48, AS_PATH: 3 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:7::/48, AS_PATH: 3 3 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:8::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:9::/48, AS_PATH: 3 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:a::/48, AS_PATH: 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:b::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:c::/48, AS_PATH: 3 3 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:d::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:6::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:7::1/128, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:8::/48, AS_PATH: 4 4 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:9::/48, AS_PATH: 4 4 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:a::/48, AS_PATH: 4 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:1:1::/48, AS_PATH: 1 1011, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:3::/32, AS_PATH: 1 1011, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:4:1::/48, AS_PATH: 1 1000, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:10::/48, AS_PATH: 101 666, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:11::/48, AS_PATH: 101 777, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:1::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:1::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:2::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:2::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 65530:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:3::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:3::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: 999:65530:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:4::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 888:0 + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:4::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 888:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:5::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: 888:0:0 + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:5::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: 888:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:6::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 777:0 + ext comms: + lrg comms: 777:0:0 + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:6::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 65530:1, 777:0 + ext comms: + lrg comms: 777:0:0, 999:65530:1 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:7::/48, AS_PATH: 101 174, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8000::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8000::1/128, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:8000::1/128, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 65535:666 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:8::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:9::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:1::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2:4000::/34, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2:8000::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:2:8000::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2::/33, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:2::/33, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:3:1::/48, AS_PATH: 101 105, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3102:0:1::/48, AS_PATH: 101 102, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3103:0:1::/48, AS_PATH: 101 101 103, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3103:0:2::/48, AS_PATH: 101 103, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3104:0:1::/48, AS_PATH: 1 101 104, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3104:0:1::/48, AS_PATH: 101 104, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3104:1:1::/48, AS_PATH: 1 101 104, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3104:1:1::/48, AS_PATH: 101 104, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3222:0:2::/48, AS_PATH: 222 333, NEXT_HOP: 2001:db8:1:1::222, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3222:0:3::/48, AS_PATH: 222 333, NEXT_HOP: 2001:db8:1:1::222, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +8000:1::/32, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd76p/AS222.txt b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd76p/AS222.txt new file mode 100644 index 00000000..e69de29b diff --git a/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd76p/AS3.txt b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd76p/AS3.txt new file mode 100644 index 00000000..86ea2ff0 --- /dev/null +++ b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd76p/AS3.txt @@ -0,0 +1,322 @@ +2a01:0:1::/48, AS_PATH: 999 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +2a01:0:1::/48, AS_PATH: 999 1, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 101 + filtered: False () + +2a01:0:2::/48, AS_PATH: 999 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +2a01:0:2::/48, AS_PATH: 999 1, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 101 + filtered: False () + +2a01:0:3::/48, AS_PATH: 999 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +2a02:0:1::/48, AS_PATH: 999 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:2::/48, AS_PATH: 999 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::1/128, AS_PATH: 999 2, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::2/128, AS_PATH: 999 2, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::3/128, AS_PATH: 999 2, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:4::/48, AS_PATH: 999 2, NEXT_HOP: 2001:db8:1:1::22, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:5::/48, AS_PATH: 999 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:8::/48, AS_PATH: 999 4 4 4 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:9::/48, AS_PATH: 999 4 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:a::/48, AS_PATH: 999 4 4 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:1:1::/48, AS_PATH: 999 1 1011, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +2a11:3::/32, AS_PATH: 999 1 1011, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +2a11:4:1::/48, AS_PATH: 999 1 1000, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +3101:0:1::/48, AS_PATH: 999 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +3101:0:1::/48, AS_PATH: 999 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:2::/48, AS_PATH: 999 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +3101:0:2::/48, AS_PATH: 999 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:3::/48, AS_PATH: 999 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +3101:0:3::/48, AS_PATH: 999 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:4::/48, AS_PATH: 999 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 888:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +3101:0:4::/48, AS_PATH: 999 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 888:0 + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:5::/48, AS_PATH: 999 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: 888:0:0 + best: True, LOCAL_PREF: 101 + filtered: False () + +3101:0:5::/48, AS_PATH: 999 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: 888:0:0 + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:6::/48, AS_PATH: 999 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 777:0 + ext comms: + lrg comms: 777:0:0 + best: True, LOCAL_PREF: 101 + filtered: False () + +3101:0:6::/48, AS_PATH: 999 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 777:0 + ext comms: + lrg comms: 777:0:0 + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:8000::1/128, AS_PATH: 999 1 101, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 101 + filtered: False () + +3101:0:8000::1/128, AS_PATH: 999 2 101, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:8::/48, AS_PATH: 999 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +3101:0:8::/48, AS_PATH: 999 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:2:8000::/48, AS_PATH: 999 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +3101:2:8000::/48, AS_PATH: 999 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:2::/33, AS_PATH: 999 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +3101:2::/33, AS_PATH: 999 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3103:0:1::/48, AS_PATH: 999 1 101 103, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 65535:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +3103:0:1::/48, AS_PATH: 999 2 101 101 103, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3103:0:2::/48, AS_PATH: 999 1 101 101 103, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +3103:0:2::/48, AS_PATH: 999 2 101 103, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3104:0:1::/48, AS_PATH: 999 1 101 104, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +3104:1:1::/48, AS_PATH: 999 1 101 104, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +3222:0:2::/48, AS_PATH: 999 222 333, NEXT_HOP: 2001:db8:1:1::222, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3222:0:3::/48, AS_PATH: 999 222 333, NEXT_HOP: 2001:db8:1:1::222, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd76p/AS4.txt b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd76p/AS4.txt new file mode 100644 index 00000000..5214013c --- /dev/null +++ b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd76p/AS4.txt @@ -0,0 +1,266 @@ +2a01:0:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a01:0:2::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a01:0:3::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:2::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::1/128, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::2/128, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::3/128, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:4::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::22, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:3::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:5::/48, AS_PATH: 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:6::/48, AS_PATH: 3 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:7::/48, AS_PATH: 3 3 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:8::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:9::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:a::/48, AS_PATH: 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:b::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:c::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:d::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:1:1::/48, AS_PATH: 1 1011, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:3::/32, AS_PATH: 1 1011, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:4:1::/48, AS_PATH: 1 1000, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:1::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:2::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:3::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:4::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 888:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:5::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: 888:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:6::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 777:0 + ext comms: + lrg comms: 777:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8000::1/128, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2:8000::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2::/33, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3103:0:1::/48, AS_PATH: 2 101 101 103, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3103:0:2::/48, AS_PATH: 2 101 103, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3104:0:1::/48, AS_PATH: 1 101 104, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3104:1:1::/48, AS_PATH: 1 101 104, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3222:0:2::/48, AS_PATH: 222 333, NEXT_HOP: 2001:db8:1:1::222, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3222:0:3::/48, AS_PATH: 222 333, NEXT_HOP: 2001:db8:1:1::222, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd76p/rs.txt b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd76p/rs.txt new file mode 100644 index 00000000..14c428e5 --- /dev/null +++ b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd76p/rs.txt @@ -0,0 +1,868 @@ +2001::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (2) + +2001:db8:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (3) + +2a01:0:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a01:0:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a01:0:2::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a01:0:2::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a01:0:3::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:2::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::1/128, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 65530:4, 65535:666 + ext comms: rfc8097-not-found + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::2/128, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 65530:4, 65534:0 + ext comms: rfc8097-not-found + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::3/128, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 65530:4 + ext comms: rfc8097-not-found + lrg comms: 65534:0:0, 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:4::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::22, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:5::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::23, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (5) + +2a03:0:1::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (11) + +2a03:0:2::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 0:999, 65501:1 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:3::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 0:1 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:4::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 0:999 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:5::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 65521:65521 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:6::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 65522:65522 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:7::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 65523:65523 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:8::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 65521:1 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:9::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 65522:2 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:a::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 65521:65521, 65523:1 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:b::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 65507:999 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:c::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 65509:1, 65523:2 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:d::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: + ext comms: rfc8097-not-found, soo:65535:65281 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:e::/48, AS_PATH: 3 174 33, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (8) + +2a04:0:1::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 0:999, 64532:15 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:2::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 0:999, 64532:5 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:3::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 64531:15 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:4::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 64531:5 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:5::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 64531:5, 65501:3 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:6::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 64530:5, 64531:100 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:7::1/128, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 64531:20, 65530:4, 65535:666 + ext comms: rfc8097-not-found + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:8::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 64538:10, 64539:100 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:9::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 64535:20, 64536:5, 65521:65521 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:a::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: + ext comms: rfc8097-not-found, rt:64537:10, rt:64538:20 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:1:1::/48, AS_PATH: 1 1011, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:1:2::/48, AS_PATH: 1 1000, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (9) + +2a11:2:1::/48, AS_PATH: 1 1011, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (12) + +2a11:3:1::/48, AS_PATH: 1 1011, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (12) + +2a11:3::/32, AS_PATH: 1 1011, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:4:1::/48, AS_PATH: 1 1000, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a99:1::/48, AS_PATH: 1 65536 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (7) + +2a99:2::/48, AS_PATH: 1 2 2 2 2 2 2 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (1) + +2a99::/16, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (13) + +2a99::/32, AS_PATH: 2 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: 999:1101:7 + best: True, LOCAL_PREF: 1 + filtered: True (6) + +3101:0:10::/48, AS_PATH: 1 101 666, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:0:10::/48, AS_PATH: 1 101 666, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (15) + +3101:0:10::/48, AS_PATH: 2 101 666, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (15) + +3101:0:11::/48, AS_PATH: 1 101 777, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:0:11::/48, AS_PATH: 1 101 777, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (15) + +3101:0:11::/48, AS_PATH: 2 101 777, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (15) + +3101:0:1::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:0:1::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:1::/48, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:2::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:0:2::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:2::/48, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:3::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:0:3::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:3::/48, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:4::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: 888:0 + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:0:4::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 888:0 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:4::/48, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 888:0 + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:5::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: 888:0:0 + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:0:5::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: 888:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:5::/48, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: 888:0:0 + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:6::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: 777:0 + ext comms: rfc8097-not-found + lrg comms: 777:0:0 + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:0:6::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 777:0 + ext comms: rfc8097-not-found + lrg comms: 777:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:6::/48, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 777:0 + ext comms: rfc8097-not-found + lrg comms: 777:0:0 + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:7::/48, AS_PATH: 1 101 174, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:0:7::/48, AS_PATH: 1 101 174, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (8) + +3101:0:7::/48, AS_PATH: 2 101 174, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (8) + +3101:0:8000::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:0:8000::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (14) + +3101:0:8000::/48, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (14) + +3101:0:8000::1/128, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: 65535:666 + ext comms: rfc8097-invalid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:0:8000::1/128, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 65530:4, 65535:666 + ext comms: rfc8097-invalid + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8000::1/128, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 65530:4, 65535:666 + ext comms: rfc8097-invalid + lrg comms: 999:65530:4 + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:8::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:0:8::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8::/48, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:9::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:0:9::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (14) + +3101:0:9::/48, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (14) + +3101:1::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:1::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (12) + +3101:1::/48, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (12) + +3101:2:4000::/34, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:2:4000::/34, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (12) + +3101:2:4000::/34, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (12) + +3101:2:8000::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:2:8000::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2:8000::/48, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:2::/33, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:2::/33, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2::/33, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:3:1::/48, AS_PATH: 1 101 105, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:3:1::/48, AS_PATH: 1 101 105, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (9) + +3101:3:1::/48, AS_PATH: 2 101 105, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (9) + +3102:0:1::/48, AS_PATH: 1 101 102, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3102:0:1::/48, AS_PATH: 1 101 102, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (9) + +3102:0:1::/48, AS_PATH: 2 101 102, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (9) + +3103:0:1::/48, AS_PATH: 1 101 103, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: 65535:0 + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3103:0:1::/48, AS_PATH: 1 101 103, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 65535:0 + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 5 + filtered: False () + +3103:0:1::/48, AS_PATH: 2 101 101 103, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3103:0:2::/48, AS_PATH: 1 101 101 103, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3103:0:2::/48, AS_PATH: 1 101 101 103, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3103:0:2::/48, AS_PATH: 2 101 103, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3104:0:1::/48, AS_PATH: 1 101 104, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3104:0:1::/48, AS_PATH: 1 101 104, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3104:0:1::/48, AS_PATH: 2 101 104, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (9) + +3104:1:1::/48, AS_PATH: 1 101 104, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3104:1:1::/48, AS_PATH: 1 101 104, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3104:1:1::/48, AS_PATH: 2 101 104, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (9) + +3222:0:1::/48, AS_PATH: 222 333, NEXT_HOP: 2001:db8:1:1::222, via 2001:db8:1:1::222 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (14) + +3222:0:2::/48, AS_PATH: 222 333, NEXT_HOP: 2001:db8:1:1::222, via 2001:db8:1:1::222 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3222:0:3::/48, AS_PATH: 222 333, NEXT_HOP: 2001:db8:1:1::222, via 2001:db8:1:1::222 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +8000:1::/32, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (10) + +8000:1::/32, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (10) + +8000:1::/32, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (10) + +::/0, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (10) + diff --git a/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd77p/AS101.txt b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd77p/AS101.txt new file mode 100644 index 00000000..022728e9 --- /dev/null +++ b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd77p/AS101.txt @@ -0,0 +1,588 @@ +2001::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2001:db8:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a01:0:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a01:0:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a01:0:1::/48, AS_PATH: 2 1, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a01:0:2::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a01:0:2::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a01:0:2::/48, AS_PATH: 2 1, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a01:0:3::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a01:0:3::/48, AS_PATH: 2 1, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a02:0:1::/48, AS_PATH: 1 2, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a02:0:1::/48, AS_PATH: 1 2, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a02:0:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:2::/48, AS_PATH: 1 2, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a02:0:2::/48, AS_PATH: 1 2, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a02:0:2::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::1/128, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::2/128, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::3/128, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:4::/48, AS_PATH: 1 2, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a02:0:4::/48, AS_PATH: 1 2, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a02:0:4::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:5::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:2::/48, AS_PATH: 1 3, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:2::/48, AS_PATH: 1 3, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:3::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:5::/48, AS_PATH: 1 3 3, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:5::/48, AS_PATH: 1 3 3, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:5::/48, AS_PATH: 2 3 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:6::/48, AS_PATH: 1 3 3 3, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:6::/48, AS_PATH: 1 3 3 3, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:6::/48, AS_PATH: 2 3 3 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:7::/48, AS_PATH: 1 3 3 3 3, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:7::/48, AS_PATH: 1 3 3 3 3, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:7::/48, AS_PATH: 2 3 3 3 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:8::/48, AS_PATH: 1 3 3, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:8::/48, AS_PATH: 1 3 3, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:8::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:9::/48, AS_PATH: 1 3, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:9::/48, AS_PATH: 1 3, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:9::/48, AS_PATH: 2 3 3 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:a::/48, AS_PATH: 1 3 3 3 3, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:a::/48, AS_PATH: 1 3 3 3 3, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:a::/48, AS_PATH: 2 3 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:c::/48, AS_PATH: 2 3 3 3 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:1::/48, AS_PATH: 1 4, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:1::/48, AS_PATH: 1 4, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a04:0:2::/48, AS_PATH: 1 4, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:2::/48, AS_PATH: 1 4, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a04:0:3::/48, AS_PATH: 1 4, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:3::/48, AS_PATH: 1 4, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a04:0:4::/48, AS_PATH: 1 4, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:4::/48, AS_PATH: 1 4, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a04:0:5::/48, AS_PATH: 1 4, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:5::/48, AS_PATH: 1 4, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a04:0:6::/48, AS_PATH: 2 4, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:8::/48, AS_PATH: 1 4, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:8::/48, AS_PATH: 1 4, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a04:0:8::/48, AS_PATH: 2 4 4 4, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a04:0:9::/48, AS_PATH: 1 4 4 4 4, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a04:0:9::/48, AS_PATH: 1 4 4 4 4, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a04:0:9::/48, AS_PATH: 2 4 4 4, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:a::/48, AS_PATH: 1 4, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:a::/48, AS_PATH: 1 4, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a04:0:a::/48, AS_PATH: 2 4 4, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a11:1:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:1:1::/48, AS_PATH: 2 1 1011, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a11:1:2::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:2:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:3:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:3::/32, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:3::/32, AS_PATH: 2 1 1011, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a11:4:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:4:1::/48, AS_PATH: 2 1 1000, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a99:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a99:2::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a99::/16, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a99::/32, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3222:0:2::/48, AS_PATH: 1 222 333, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3222:0:2::/48, AS_PATH: 1 222 333, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3222:0:2::/48, AS_PATH: 2 222 333, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3222:0:3::/48, AS_PATH: 1 222 333, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3222:0:3::/48, AS_PATH: 1 222 333, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3222:0:3::/48, AS_PATH: 2 222 333, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd77p/AS1_1.txt b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd77p/AS1_1.txt new file mode 100644 index 00000000..4db874d8 --- /dev/null +++ b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd77p/AS1_1.txt @@ -0,0 +1,357 @@ +2a02:0:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:2::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::1/128, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::2/128, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::3/128, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:4::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::22, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:2::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:5::/48, AS_PATH: 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:6::/48, AS_PATH: 3 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:7::/48, AS_PATH: 3 3 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:8::/48, AS_PATH: 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:9::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:a::/48, AS_PATH: 3 3 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:b::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:c::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:d::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:1::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:2::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:3::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:4::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:5::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:7::1/128, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:8::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:9::/48, AS_PATH: 4 4 4 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:a::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:10::/48, AS_PATH: 101 666, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:11::/48, AS_PATH: 101 777, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:1::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:2::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 65530:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:3::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: 999:65530:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:4::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 888:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:5::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: 888:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:6::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 65530:1, 777:0 + ext comms: + lrg comms: 777:0:0, 999:65530:1 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:7::/48, AS_PATH: 101 174, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8000::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8000::1/128, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 65535:666 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:9::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:1::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2:4000::/34, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2:8000::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2::/33, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:3:1::/48, AS_PATH: 101 105, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3102:0:1::/48, AS_PATH: 101 102, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3103:0:1::/48, AS_PATH: 101 103, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3103:0:2::/48, AS_PATH: 101 101 103, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3104:0:1::/48, AS_PATH: 101 104, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3104:1:1::/48, AS_PATH: 101 104, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3222:0:2::/48, AS_PATH: 222 333, NEXT_HOP: 2001:db8:1:1::222, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3222:0:3::/48, AS_PATH: 222 333, NEXT_HOP: 2001:db8:1:1::222, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +8000:1::/32, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd77p/AS1_2.txt b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd77p/AS1_2.txt new file mode 100644 index 00000000..5e6299fb --- /dev/null +++ b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd77p/AS1_2.txt @@ -0,0 +1,329 @@ +2a02:0:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:2::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:4::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::22, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:2::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:5::/48, AS_PATH: 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:6::/48, AS_PATH: 3 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:7::/48, AS_PATH: 3 3 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:8::/48, AS_PATH: 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:9::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:a::/48, AS_PATH: 3 3 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:b::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:c::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:d::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:1::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:2::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:3::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:4::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:5::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:8::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:9::/48, AS_PATH: 4 4 4 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:a::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:10::/48, AS_PATH: 101 666, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:11::/48, AS_PATH: 101 777, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:1::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:2::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 65530:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:3::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: 999:65530:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:4::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 888:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:5::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: 888:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:6::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 65530:1, 777:0 + ext comms: + lrg comms: 777:0:0, 999:65530:1 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:7::/48, AS_PATH: 101 174, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8000::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8000::1/128, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 65535:666 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:9::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:1::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2:4000::/34, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2:8000::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2::/33, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:3:1::/48, AS_PATH: 101 105, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3102:0:1::/48, AS_PATH: 101 102, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3103:0:1::/48, AS_PATH: 101 103, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3103:0:2::/48, AS_PATH: 101 101 103, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3104:0:1::/48, AS_PATH: 101 104, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3104:1:1::/48, AS_PATH: 101 104, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3222:0:2::/48, AS_PATH: 222 333, NEXT_HOP: 2001:db8:1:1::222, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3222:0:3::/48, AS_PATH: 222 333, NEXT_HOP: 2001:db8:1:1::222, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +8000:1::/32, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd77p/AS2.txt b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd77p/AS2.txt new file mode 100644 index 00000000..bac1b23a --- /dev/null +++ b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd77p/AS2.txt @@ -0,0 +1,413 @@ +2a01:0:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a01:0:2::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a01:0:3::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:3::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:5::/48, AS_PATH: 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:6::/48, AS_PATH: 3 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:7::/48, AS_PATH: 3 3 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:8::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:9::/48, AS_PATH: 3 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:a::/48, AS_PATH: 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:b::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:c::/48, AS_PATH: 3 3 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:d::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:6::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:7::1/128, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:8::/48, AS_PATH: 4 4 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:9::/48, AS_PATH: 4 4 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:a::/48, AS_PATH: 4 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:1:1::/48, AS_PATH: 1 1011, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:3::/32, AS_PATH: 1 1011, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:4:1::/48, AS_PATH: 1 1000, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:10::/48, AS_PATH: 101 666, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:11::/48, AS_PATH: 101 777, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:1::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:1::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:2::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:2::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 65530:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:3::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:3::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: 999:65530:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:4::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 888:0 + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:4::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 888:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:5::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: 888:0:0 + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:5::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: 888:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:6::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 777:0 + ext comms: + lrg comms: 777:0:0 + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:6::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 65530:1, 777:0 + ext comms: + lrg comms: 777:0:0, 999:65530:1 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:7::/48, AS_PATH: 101 174, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8000::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8000::1/128, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:8000::1/128, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 65535:666 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:8::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:9::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:1::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2:4000::/34, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2:8000::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:2:8000::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2::/33, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:2::/33, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:3:1::/48, AS_PATH: 101 105, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3102:0:1::/48, AS_PATH: 101 102, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3103:0:1::/48, AS_PATH: 101 101 103, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3103:0:2::/48, AS_PATH: 101 103, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3104:0:1::/48, AS_PATH: 1 101 104, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3104:0:1::/48, AS_PATH: 101 104, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3104:1:1::/48, AS_PATH: 1 101 104, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3104:1:1::/48, AS_PATH: 101 104, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3222:0:2::/48, AS_PATH: 222 333, NEXT_HOP: 2001:db8:1:1::222, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3222:0:3::/48, AS_PATH: 222 333, NEXT_HOP: 2001:db8:1:1::222, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +8000:1::/32, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd77p/AS222.txt b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd77p/AS222.txt new file mode 100644 index 00000000..e69de29b diff --git a/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd77p/AS3.txt b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd77p/AS3.txt new file mode 100644 index 00000000..86ea2ff0 --- /dev/null +++ b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd77p/AS3.txt @@ -0,0 +1,322 @@ +2a01:0:1::/48, AS_PATH: 999 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +2a01:0:1::/48, AS_PATH: 999 1, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 101 + filtered: False () + +2a01:0:2::/48, AS_PATH: 999 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +2a01:0:2::/48, AS_PATH: 999 1, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 101 + filtered: False () + +2a01:0:3::/48, AS_PATH: 999 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +2a02:0:1::/48, AS_PATH: 999 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:2::/48, AS_PATH: 999 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::1/128, AS_PATH: 999 2, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::2/128, AS_PATH: 999 2, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::3/128, AS_PATH: 999 2, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:4::/48, AS_PATH: 999 2, NEXT_HOP: 2001:db8:1:1::22, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:5::/48, AS_PATH: 999 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:8::/48, AS_PATH: 999 4 4 4 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:9::/48, AS_PATH: 999 4 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:a::/48, AS_PATH: 999 4 4 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:1:1::/48, AS_PATH: 999 1 1011, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +2a11:3::/32, AS_PATH: 999 1 1011, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +2a11:4:1::/48, AS_PATH: 999 1 1000, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +3101:0:1::/48, AS_PATH: 999 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +3101:0:1::/48, AS_PATH: 999 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:2::/48, AS_PATH: 999 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +3101:0:2::/48, AS_PATH: 999 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:3::/48, AS_PATH: 999 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +3101:0:3::/48, AS_PATH: 999 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:4::/48, AS_PATH: 999 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 888:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +3101:0:4::/48, AS_PATH: 999 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 888:0 + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:5::/48, AS_PATH: 999 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: 888:0:0 + best: True, LOCAL_PREF: 101 + filtered: False () + +3101:0:5::/48, AS_PATH: 999 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: 888:0:0 + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:6::/48, AS_PATH: 999 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 777:0 + ext comms: + lrg comms: 777:0:0 + best: True, LOCAL_PREF: 101 + filtered: False () + +3101:0:6::/48, AS_PATH: 999 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 777:0 + ext comms: + lrg comms: 777:0:0 + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:8000::1/128, AS_PATH: 999 1 101, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 101 + filtered: False () + +3101:0:8000::1/128, AS_PATH: 999 2 101, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:8::/48, AS_PATH: 999 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +3101:0:8::/48, AS_PATH: 999 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:2:8000::/48, AS_PATH: 999 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +3101:2:8000::/48, AS_PATH: 999 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:2::/33, AS_PATH: 999 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +3101:2::/33, AS_PATH: 999 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3103:0:1::/48, AS_PATH: 999 1 101 103, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 65535:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +3103:0:1::/48, AS_PATH: 999 2 101 101 103, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3103:0:2::/48, AS_PATH: 999 1 101 101 103, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +3103:0:2::/48, AS_PATH: 999 2 101 103, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3104:0:1::/48, AS_PATH: 999 1 101 104, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +3104:1:1::/48, AS_PATH: 999 1 101 104, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +3222:0:2::/48, AS_PATH: 999 222 333, NEXT_HOP: 2001:db8:1:1::222, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3222:0:3::/48, AS_PATH: 999 222 333, NEXT_HOP: 2001:db8:1:1::222, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd77p/AS4.txt b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd77p/AS4.txt new file mode 100644 index 00000000..5214013c --- /dev/null +++ b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd77p/AS4.txt @@ -0,0 +1,266 @@ +2a01:0:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a01:0:2::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a01:0:3::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:2::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::1/128, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::2/128, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::3/128, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:4::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::22, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:3::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:5::/48, AS_PATH: 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:6::/48, AS_PATH: 3 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:7::/48, AS_PATH: 3 3 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:8::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:9::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:a::/48, AS_PATH: 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:b::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:c::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:d::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:1:1::/48, AS_PATH: 1 1011, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:3::/32, AS_PATH: 1 1011, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:4:1::/48, AS_PATH: 1 1000, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:1::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:2::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:3::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:4::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 888:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:5::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: 888:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:6::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 777:0 + ext comms: + lrg comms: 777:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8000::1/128, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2:8000::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2::/33, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3103:0:1::/48, AS_PATH: 2 101 101 103, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3103:0:2::/48, AS_PATH: 2 101 103, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3104:0:1::/48, AS_PATH: 1 101 104, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3104:1:1::/48, AS_PATH: 1 101 104, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3222:0:2::/48, AS_PATH: 222 333, NEXT_HOP: 2001:db8:1:1::222, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3222:0:3::/48, AS_PATH: 222 333, NEXT_HOP: 2001:db8:1:1::222, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd77p/rs.txt b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd77p/rs.txt new file mode 100644 index 00000000..14c428e5 --- /dev/null +++ b/tests/live_tests/scenarios/global/routes/BasicScenario_OpenBGPDIPv6/openbgpd77p/rs.txt @@ -0,0 +1,868 @@ +2001::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (2) + +2001:db8:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (3) + +2a01:0:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a01:0:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a01:0:2::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a01:0:2::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a01:0:3::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:2::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::1/128, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 65530:4, 65535:666 + ext comms: rfc8097-not-found + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::2/128, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 65530:4, 65534:0 + ext comms: rfc8097-not-found + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::3/128, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 65530:4 + ext comms: rfc8097-not-found + lrg comms: 65534:0:0, 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:4::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::22, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:5::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::23, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (5) + +2a03:0:1::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (11) + +2a03:0:2::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 0:999, 65501:1 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:3::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 0:1 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:4::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 0:999 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:5::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 65521:65521 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:6::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 65522:65522 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:7::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 65523:65523 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:8::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 65521:1 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:9::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 65522:2 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:a::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 65521:65521, 65523:1 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:b::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 65507:999 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:c::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 65509:1, 65523:2 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:d::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: + ext comms: rfc8097-not-found, soo:65535:65281 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:e::/48, AS_PATH: 3 174 33, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (8) + +2a04:0:1::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 0:999, 64532:15 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:2::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 0:999, 64532:5 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:3::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 64531:15 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:4::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 64531:5 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:5::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 64531:5, 65501:3 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:6::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 64530:5, 64531:100 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:7::1/128, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 64531:20, 65530:4, 65535:666 + ext comms: rfc8097-not-found + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:8::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 64538:10, 64539:100 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:9::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 64535:20, 64536:5, 65521:65521 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:a::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: + ext comms: rfc8097-not-found, rt:64537:10, rt:64538:20 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:1:1::/48, AS_PATH: 1 1011, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:1:2::/48, AS_PATH: 1 1000, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (9) + +2a11:2:1::/48, AS_PATH: 1 1011, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (12) + +2a11:3:1::/48, AS_PATH: 1 1011, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (12) + +2a11:3::/32, AS_PATH: 1 1011, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:4:1::/48, AS_PATH: 1 1000, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a99:1::/48, AS_PATH: 1 65536 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (7) + +2a99:2::/48, AS_PATH: 1 2 2 2 2 2 2 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (1) + +2a99::/16, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (13) + +2a99::/32, AS_PATH: 2 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: 999:1101:7 + best: True, LOCAL_PREF: 1 + filtered: True (6) + +3101:0:10::/48, AS_PATH: 1 101 666, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:0:10::/48, AS_PATH: 1 101 666, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (15) + +3101:0:10::/48, AS_PATH: 2 101 666, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (15) + +3101:0:11::/48, AS_PATH: 1 101 777, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:0:11::/48, AS_PATH: 1 101 777, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (15) + +3101:0:11::/48, AS_PATH: 2 101 777, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (15) + +3101:0:1::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:0:1::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:1::/48, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:2::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:0:2::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:2::/48, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:3::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:0:3::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:3::/48, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:4::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: 888:0 + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:0:4::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 888:0 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:4::/48, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 888:0 + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:5::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: 888:0:0 + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:0:5::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: 888:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:5::/48, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: 888:0:0 + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:6::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: 777:0 + ext comms: rfc8097-not-found + lrg comms: 777:0:0 + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:0:6::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 777:0 + ext comms: rfc8097-not-found + lrg comms: 777:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:6::/48, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 777:0 + ext comms: rfc8097-not-found + lrg comms: 777:0:0 + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:7::/48, AS_PATH: 1 101 174, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:0:7::/48, AS_PATH: 1 101 174, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (8) + +3101:0:7::/48, AS_PATH: 2 101 174, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (8) + +3101:0:8000::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:0:8000::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (14) + +3101:0:8000::/48, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (14) + +3101:0:8000::1/128, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: 65535:666 + ext comms: rfc8097-invalid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:0:8000::1/128, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 65530:4, 65535:666 + ext comms: rfc8097-invalid + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8000::1/128, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 65530:4, 65535:666 + ext comms: rfc8097-invalid + lrg comms: 999:65530:4 + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:8::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:0:8::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8::/48, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:9::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:0:9::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (14) + +3101:0:9::/48, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (14) + +3101:1::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:1::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (12) + +3101:1::/48, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (12) + +3101:2:4000::/34, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:2:4000::/34, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (12) + +3101:2:4000::/34, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (12) + +3101:2:8000::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:2:8000::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2:8000::/48, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:2::/33, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:2::/33, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2::/33, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:3:1::/48, AS_PATH: 1 101 105, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3101:3:1::/48, AS_PATH: 1 101 105, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (9) + +3101:3:1::/48, AS_PATH: 2 101 105, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (9) + +3102:0:1::/48, AS_PATH: 1 101 102, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3102:0:1::/48, AS_PATH: 1 101 102, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (9) + +3102:0:1::/48, AS_PATH: 2 101 102, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (9) + +3103:0:1::/48, AS_PATH: 1 101 103, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: 65535:0 + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3103:0:1::/48, AS_PATH: 1 101 103, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 65535:0 + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 5 + filtered: False () + +3103:0:1::/48, AS_PATH: 2 101 101 103, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3103:0:2::/48, AS_PATH: 1 101 101 103, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3103:0:2::/48, AS_PATH: 1 101 101 103, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3103:0:2::/48, AS_PATH: 2 101 103, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3104:0:1::/48, AS_PATH: 1 101 104, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3104:0:1::/48, AS_PATH: 1 101 104, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3104:0:1::/48, AS_PATH: 2 101 104, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (9) + +3104:1:1::/48, AS_PATH: 1 101 104, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (5) + +3104:1:1::/48, AS_PATH: 1 101 104, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3104:1:1::/48, AS_PATH: 2 101 104, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (9) + +3222:0:1::/48, AS_PATH: 222 333, NEXT_HOP: 2001:db8:1:1::222, via 2001:db8:1:1::222 + std comms: + ext comms: rfc8097-invalid + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (14) + +3222:0:2::/48, AS_PATH: 222 333, NEXT_HOP: 2001:db8:1:1::222, via 2001:db8:1:1::222 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3222:0:3::/48, AS_PATH: 222 333, NEXT_HOP: 2001:db8:1:1::222, via 2001:db8:1:1::222 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +8000:1::/32, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (10) + +8000:1::/32, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (10) + +8000:1::/32, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: True (10) + +::/0, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: True (10) + diff --git a/tests/live_tests/scenarios/gshut/configs/GShutScenario_OpenBGPDIPv4/openbgpd76p.conf b/tests/live_tests/scenarios/gshut/configs/GShutScenario_OpenBGPDIPv4/openbgpd76p.conf new file mode 100644 index 00000000..0c8a1432 --- /dev/null +++ b/tests/live_tests/scenarios/gshut/configs/GShutScenario_OpenBGPDIPv4/openbgpd76p.conf @@ -0,0 +1,665 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.11 { + remote-as 1 + + rde evaluate all + + descr "AS1_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::11 { + remote-as 1 + + rde evaluate all + + descr "AS1_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.21 { + remote-as 2 + + rde evaluate all + + descr "AS2_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::21 { + remote-as 2 + + rde evaluate all + + descr "AS2_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + + + + + + + + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +deny quick from group clients max-as-len 32 + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +deny quick from group clients community NO_ADVERTISE + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +deny quick from group clients prefix-set bogons + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS1_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +deny quick from 192.0.2.11 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +deny quick from 192.0.2.11 peer-as != 1 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +deny quick from 192.0.2.11 AS 23456 + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +deny quick from 192.0.2.11 AS 64496 - 131071 + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 192.0.2.11 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +deny quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +deny quick from 2001:db8:1:1::11 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +deny quick from 2001:db8:1:1::11 peer-as != 1 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +deny quick from 2001:db8:1:1::11 AS 23456 + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +deny quick from 2001:db8:1:1::11 AS 64496 - 131071 + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +deny quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48 + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.21 set community NO_ADVERTISE +match from 192.0.2.21 nexthop 192.0.2.21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.21 community NO_ADVERTISE' - reject code: 5 +deny quick from 192.0.2.21 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.21 peer-as != 2' - reject code: 6 +deny quick from 192.0.2.21 peer-as != 2 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.21 AS 23456' - reject code: 7 +deny quick from 192.0.2.21 AS 23456 + +# Reject inbound routes when 'from 192.0.2.21 AS 64496 - 131071' - reject code: 7 +deny quick from 192.0.2.21 AS 64496 - 131071 + +# Reject inbound routes when 'from 192.0.2.21 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 192.0.2.21 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +deny quick from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24 + + + +# Remove internal communities before accepting the route +match from 192.0.2.21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 192.0.2.21 + + + +# --------------------------------------------- +# client AS2_1, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.21 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::21 set community NO_ADVERTISE +match from 2001:db8:1:1::21 nexthop 2001:db8:1:1::21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::21 community NO_ADVERTISE' - reject code: 5 +deny quick from 2001:db8:1:1::21 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::21 peer-as != 2' - reject code: 6 +deny quick from 2001:db8:1:1::21 peer-as != 2 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 23456' - reject code: 7 +deny quick from 2001:db8:1:1::21 AS 23456 + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 64496 - 131071' - reject code: 7 +deny quick from 2001:db8:1:1::21 AS 64496 - 131071 + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 2001:db8:1:1::21 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +deny quick from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48 + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 2001:db8:1:1::21 + + + +# --------------------------------------------- +# client AS2_2, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::21 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes + +# Scrub prepending communities + +match to group clients set community GRACEFUL_SHUTDOWN + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/gshut/configs/GShutScenario_OpenBGPDIPv4/openbgpd77p.conf b/tests/live_tests/scenarios/gshut/configs/GShutScenario_OpenBGPDIPv4/openbgpd77p.conf new file mode 100644 index 00000000..0c8a1432 --- /dev/null +++ b/tests/live_tests/scenarios/gshut/configs/GShutScenario_OpenBGPDIPv4/openbgpd77p.conf @@ -0,0 +1,665 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.11 { + remote-as 1 + + rde evaluate all + + descr "AS1_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::11 { + remote-as 1 + + rde evaluate all + + descr "AS1_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.21 { + remote-as 2 + + rde evaluate all + + descr "AS2_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::21 { + remote-as 2 + + rde evaluate all + + descr "AS2_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + + + + + + + + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +deny quick from group clients max-as-len 32 + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +deny quick from group clients community NO_ADVERTISE + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +deny quick from group clients prefix-set bogons + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS1_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +deny quick from 192.0.2.11 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +deny quick from 192.0.2.11 peer-as != 1 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +deny quick from 192.0.2.11 AS 23456 + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +deny quick from 192.0.2.11 AS 64496 - 131071 + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 192.0.2.11 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +deny quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +deny quick from 2001:db8:1:1::11 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +deny quick from 2001:db8:1:1::11 peer-as != 1 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +deny quick from 2001:db8:1:1::11 AS 23456 + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +deny quick from 2001:db8:1:1::11 AS 64496 - 131071 + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +deny quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48 + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.21 set community NO_ADVERTISE +match from 192.0.2.21 nexthop 192.0.2.21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.21 community NO_ADVERTISE' - reject code: 5 +deny quick from 192.0.2.21 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.21 peer-as != 2' - reject code: 6 +deny quick from 192.0.2.21 peer-as != 2 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.21 AS 23456' - reject code: 7 +deny quick from 192.0.2.21 AS 23456 + +# Reject inbound routes when 'from 192.0.2.21 AS 64496 - 131071' - reject code: 7 +deny quick from 192.0.2.21 AS 64496 - 131071 + +# Reject inbound routes when 'from 192.0.2.21 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 192.0.2.21 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +deny quick from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24 + + + +# Remove internal communities before accepting the route +match from 192.0.2.21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 192.0.2.21 + + + +# --------------------------------------------- +# client AS2_1, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.21 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::21 set community NO_ADVERTISE +match from 2001:db8:1:1::21 nexthop 2001:db8:1:1::21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::21 community NO_ADVERTISE' - reject code: 5 +deny quick from 2001:db8:1:1::21 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::21 peer-as != 2' - reject code: 6 +deny quick from 2001:db8:1:1::21 peer-as != 2 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 23456' - reject code: 7 +deny quick from 2001:db8:1:1::21 AS 23456 + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 64496 - 131071' - reject code: 7 +deny quick from 2001:db8:1:1::21 AS 64496 - 131071 + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 2001:db8:1:1::21 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +deny quick from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48 + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 2001:db8:1:1::21 + + + +# --------------------------------------------- +# client AS2_2, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::21 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes + +# Scrub prepending communities + +match to group clients set community GRACEFUL_SHUTDOWN + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/gshut/routes/GShutScenario_OpenBGPDIPv4/openbgpd77p/AS1.txt b/tests/live_tests/scenarios/gshut/routes/GShutScenario_OpenBGPDIPv4/openbgpd77p/AS1.txt new file mode 100644 index 00000000..6a695ab1 --- /dev/null +++ b/tests/live_tests/scenarios/gshut/routes/GShutScenario_OpenBGPDIPv4/openbgpd77p/AS1.txt @@ -0,0 +1,14 @@ +2a02:2:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 65535:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:2:2::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 65535:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/gshut/routes/GShutScenario_OpenBGPDIPv4/openbgpd77p/AS2.txt b/tests/live_tests/scenarios/gshut/routes/GShutScenario_OpenBGPDIPv4/openbgpd77p/AS2.txt new file mode 100644 index 00000000..4d268b5f --- /dev/null +++ b/tests/live_tests/scenarios/gshut/routes/GShutScenario_OpenBGPDIPv4/openbgpd77p/AS2.txt @@ -0,0 +1,14 @@ +2a02:1:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 65535:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:1:2::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 65535:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/gshut/routes/GShutScenario_OpenBGPDIPv4/openbgpd77p/rs.txt b/tests/live_tests/scenarios/gshut/routes/GShutScenario_OpenBGPDIPv4/openbgpd77p/rs.txt new file mode 100644 index 00000000..3f3e8bb6 --- /dev/null +++ b/tests/live_tests/scenarios/gshut/routes/GShutScenario_OpenBGPDIPv4/openbgpd77p/rs.txt @@ -0,0 +1,28 @@ +2a02:1:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:1:2::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:2:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:2:2::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/max_prefix/configs/MaxPrefixScenario_OpenBGPDIPv4/openbgpd76p.conf b/tests/live_tests/scenarios/max_prefix/configs/MaxPrefixScenario_OpenBGPDIPv4/openbgpd76p.conf new file mode 100644 index 00000000..b5874e6e --- /dev/null +++ b/tests/live_tests/scenarios/max_prefix/configs/MaxPrefixScenario_OpenBGPDIPv4/openbgpd76p.conf @@ -0,0 +1,2263 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.11 { + remote-as 1 + + rde evaluate all + + passive + ttl-security no + max-prefix 4 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::11 { + remote-as 1 + + rde evaluate all + + passive + ttl-security no + max-prefix 4 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.21 { + remote-as 2 + + rde evaluate all + + passive + ttl-security no + max-prefix 3 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::21 { + remote-as 2 + + rde evaluate all + + passive + ttl-security no + max-prefix 3 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.31 { + remote-as 3 + + rde evaluate all + + passive + ttl-security no + max-prefix 2 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::31 { + remote-as 3 + + rde evaluate all + + passive + ttl-security no + max-prefix 2 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.41 { + remote-as 4 + + rde evaluate all + + passive + ttl-security no + max-prefix 6 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::41 { + remote-as 4 + + rde evaluate all + + passive + ttl-security no + max-prefix 6 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + + + + + + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.11 set ext-community rt 65520:1 + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + +match from 192.0.2.21 set ext-community rt 65520:2 + +match from 2001:db8:1:1::21 set ext-community rt 65520:2 + +match from 192.0.2.31 set ext-community rt 65520:3 + +match from 2001:db8:1:1::31 set ext-community rt 65520:3 + +match from 192.0.2.41 set ext-community rt 65520:4 + +match from 2001:db8:1:1::41 set ext-community rt 65520:4 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +allow quick from group clients max-as-len 32 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS1_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + +deny quick to 2001:db8:1:1::11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.21 set community NO_ADVERTISE +match from 192.0.2.21 nexthop 192.0.2.21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.21 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.21 AS 23456' - reject code: 7 +allow quick from 192.0.2.21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.21 set ext-community delete rt 65520:2 + + + +allow quick from 192.0.2.21 + + + +# --------------------------------------------- +# client AS2_1, outbound + +deny quick to 192.0.2.21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.21 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::21 set community NO_ADVERTISE +match from 2001:db8:1:1::21 nexthop 2001:db8:1:1::21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::21 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::21 set ext-community delete rt 65520:2 + + + +allow quick from 2001:db8:1:1::21 + + + +# --------------------------------------------- +# client AS2_2, outbound + +deny quick to 2001:db8:1:1::21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::21 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3_1, inbound + + + +# NEXT_HOP +match from 192.0.2.31 set community NO_ADVERTISE +match from 192.0.2.31 nexthop 192.0.2.31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.31 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.31 AS 23456' - reject code: 7 +allow quick from 192.0.2.31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.31 set ext-community delete rt 65520:3 + + + +allow quick from 192.0.2.31 + + + +# --------------------------------------------- +# client AS3_1, outbound + +deny quick to 192.0.2.31 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.31 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.31 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::31 set community NO_ADVERTISE +match from 2001:db8:1:1::31 nexthop 2001:db8:1:1::31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::31 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::31 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::31 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::31 set ext-community delete rt 65520:3 + + + +allow quick from 2001:db8:1:1::31 + + + +# --------------------------------------------- +# client AS3_2, outbound + +deny quick to 2001:db8:1:1::31 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::31 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::31 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_1, inbound + + + +# NEXT_HOP +match from 192.0.2.41 set community NO_ADVERTISE +match from 192.0.2.41 nexthop 192.0.2.41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.41 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.41 AS 23456' - reject code: 7 +allow quick from 192.0.2.41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.41 set ext-community delete rt 65520:4 + + + +allow quick from 192.0.2.41 + + + +# --------------------------------------------- +# client AS4_1, outbound + +deny quick to 192.0.2.41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.41 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::41 set community NO_ADVERTISE +match from 2001:db8:1:1::41 nexthop 2001:db8:1:1::41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::41 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::41 set ext-community delete rt 65520:4 + + + +allow quick from 2001:db8:1:1::41 + + + +# --------------------------------------------- +# client AS4_2, outbound + +deny quick to 2001:db8:1:1::41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::41 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/max_prefix/configs/MaxPrefixScenario_OpenBGPDIPv4/openbgpd77p.conf b/tests/live_tests/scenarios/max_prefix/configs/MaxPrefixScenario_OpenBGPDIPv4/openbgpd77p.conf new file mode 100644 index 00000000..b5874e6e --- /dev/null +++ b/tests/live_tests/scenarios/max_prefix/configs/MaxPrefixScenario_OpenBGPDIPv4/openbgpd77p.conf @@ -0,0 +1,2263 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.11 { + remote-as 1 + + rde evaluate all + + passive + ttl-security no + max-prefix 4 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::11 { + remote-as 1 + + rde evaluate all + + passive + ttl-security no + max-prefix 4 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.21 { + remote-as 2 + + rde evaluate all + + passive + ttl-security no + max-prefix 3 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::21 { + remote-as 2 + + rde evaluate all + + passive + ttl-security no + max-prefix 3 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.31 { + remote-as 3 + + rde evaluate all + + passive + ttl-security no + max-prefix 2 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::31 { + remote-as 3 + + rde evaluate all + + passive + ttl-security no + max-prefix 2 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.41 { + remote-as 4 + + rde evaluate all + + passive + ttl-security no + max-prefix 6 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::41 { + remote-as 4 + + rde evaluate all + + passive + ttl-security no + max-prefix 6 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + + + + + + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.11 set ext-community rt 65520:1 + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + +match from 192.0.2.21 set ext-community rt 65520:2 + +match from 2001:db8:1:1::21 set ext-community rt 65520:2 + +match from 192.0.2.31 set ext-community rt 65520:3 + +match from 2001:db8:1:1::31 set ext-community rt 65520:3 + +match from 192.0.2.41 set ext-community rt 65520:4 + +match from 2001:db8:1:1::41 set ext-community rt 65520:4 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +allow quick from group clients max-as-len 32 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS1_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + +deny quick to 2001:db8:1:1::11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.21 set community NO_ADVERTISE +match from 192.0.2.21 nexthop 192.0.2.21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.21 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.21 AS 23456' - reject code: 7 +allow quick from 192.0.2.21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.21 set ext-community delete rt 65520:2 + + + +allow quick from 192.0.2.21 + + + +# --------------------------------------------- +# client AS2_1, outbound + +deny quick to 192.0.2.21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.21 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::21 set community NO_ADVERTISE +match from 2001:db8:1:1::21 nexthop 2001:db8:1:1::21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::21 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::21 set ext-community delete rt 65520:2 + + + +allow quick from 2001:db8:1:1::21 + + + +# --------------------------------------------- +# client AS2_2, outbound + +deny quick to 2001:db8:1:1::21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::21 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3_1, inbound + + + +# NEXT_HOP +match from 192.0.2.31 set community NO_ADVERTISE +match from 192.0.2.31 nexthop 192.0.2.31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.31 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.31 AS 23456' - reject code: 7 +allow quick from 192.0.2.31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.31 set ext-community delete rt 65520:3 + + + +allow quick from 192.0.2.31 + + + +# --------------------------------------------- +# client AS3_1, outbound + +deny quick to 192.0.2.31 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.31 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.31 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::31 set community NO_ADVERTISE +match from 2001:db8:1:1::31 nexthop 2001:db8:1:1::31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::31 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::31 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::31 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::31 set ext-community delete rt 65520:3 + + + +allow quick from 2001:db8:1:1::31 + + + +# --------------------------------------------- +# client AS3_2, outbound + +deny quick to 2001:db8:1:1::31 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::31 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::31 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_1, inbound + + + +# NEXT_HOP +match from 192.0.2.41 set community NO_ADVERTISE +match from 192.0.2.41 nexthop 192.0.2.41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.41 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.41 AS 23456' - reject code: 7 +allow quick from 192.0.2.41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.41 set ext-community delete rt 65520:4 + + + +allow quick from 192.0.2.41 + + + +# --------------------------------------------- +# client AS4_1, outbound + +deny quick to 192.0.2.41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.41 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::41 set community NO_ADVERTISE +match from 2001:db8:1:1::41 nexthop 2001:db8:1:1::41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::41 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::41 set ext-community delete rt 65520:4 + + + +allow quick from 2001:db8:1:1::41 + + + +# --------------------------------------------- +# client AS4_2, outbound + +deny quick to 2001:db8:1:1::41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::41 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/max_prefix/configs/MaxPrefixScenario_OpenBGPDIPv6/openbgpd76p.conf b/tests/live_tests/scenarios/max_prefix/configs/MaxPrefixScenario_OpenBGPDIPv6/openbgpd76p.conf new file mode 100644 index 00000000..b5874e6e --- /dev/null +++ b/tests/live_tests/scenarios/max_prefix/configs/MaxPrefixScenario_OpenBGPDIPv6/openbgpd76p.conf @@ -0,0 +1,2263 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.11 { + remote-as 1 + + rde evaluate all + + passive + ttl-security no + max-prefix 4 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::11 { + remote-as 1 + + rde evaluate all + + passive + ttl-security no + max-prefix 4 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.21 { + remote-as 2 + + rde evaluate all + + passive + ttl-security no + max-prefix 3 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::21 { + remote-as 2 + + rde evaluate all + + passive + ttl-security no + max-prefix 3 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.31 { + remote-as 3 + + rde evaluate all + + passive + ttl-security no + max-prefix 2 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::31 { + remote-as 3 + + rde evaluate all + + passive + ttl-security no + max-prefix 2 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.41 { + remote-as 4 + + rde evaluate all + + passive + ttl-security no + max-prefix 6 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::41 { + remote-as 4 + + rde evaluate all + + passive + ttl-security no + max-prefix 6 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + + + + + + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.11 set ext-community rt 65520:1 + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + +match from 192.0.2.21 set ext-community rt 65520:2 + +match from 2001:db8:1:1::21 set ext-community rt 65520:2 + +match from 192.0.2.31 set ext-community rt 65520:3 + +match from 2001:db8:1:1::31 set ext-community rt 65520:3 + +match from 192.0.2.41 set ext-community rt 65520:4 + +match from 2001:db8:1:1::41 set ext-community rt 65520:4 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +allow quick from group clients max-as-len 32 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS1_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + +deny quick to 2001:db8:1:1::11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.21 set community NO_ADVERTISE +match from 192.0.2.21 nexthop 192.0.2.21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.21 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.21 AS 23456' - reject code: 7 +allow quick from 192.0.2.21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.21 set ext-community delete rt 65520:2 + + + +allow quick from 192.0.2.21 + + + +# --------------------------------------------- +# client AS2_1, outbound + +deny quick to 192.0.2.21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.21 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::21 set community NO_ADVERTISE +match from 2001:db8:1:1::21 nexthop 2001:db8:1:1::21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::21 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::21 set ext-community delete rt 65520:2 + + + +allow quick from 2001:db8:1:1::21 + + + +# --------------------------------------------- +# client AS2_2, outbound + +deny quick to 2001:db8:1:1::21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::21 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3_1, inbound + + + +# NEXT_HOP +match from 192.0.2.31 set community NO_ADVERTISE +match from 192.0.2.31 nexthop 192.0.2.31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.31 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.31 AS 23456' - reject code: 7 +allow quick from 192.0.2.31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.31 set ext-community delete rt 65520:3 + + + +allow quick from 192.0.2.31 + + + +# --------------------------------------------- +# client AS3_1, outbound + +deny quick to 192.0.2.31 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.31 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.31 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::31 set community NO_ADVERTISE +match from 2001:db8:1:1::31 nexthop 2001:db8:1:1::31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::31 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::31 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::31 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::31 set ext-community delete rt 65520:3 + + + +allow quick from 2001:db8:1:1::31 + + + +# --------------------------------------------- +# client AS3_2, outbound + +deny quick to 2001:db8:1:1::31 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::31 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::31 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_1, inbound + + + +# NEXT_HOP +match from 192.0.2.41 set community NO_ADVERTISE +match from 192.0.2.41 nexthop 192.0.2.41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.41 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.41 AS 23456' - reject code: 7 +allow quick from 192.0.2.41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.41 set ext-community delete rt 65520:4 + + + +allow quick from 192.0.2.41 + + + +# --------------------------------------------- +# client AS4_1, outbound + +deny quick to 192.0.2.41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.41 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::41 set community NO_ADVERTISE +match from 2001:db8:1:1::41 nexthop 2001:db8:1:1::41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::41 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::41 set ext-community delete rt 65520:4 + + + +allow quick from 2001:db8:1:1::41 + + + +# --------------------------------------------- +# client AS4_2, outbound + +deny quick to 2001:db8:1:1::41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::41 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/max_prefix/configs/MaxPrefixScenario_OpenBGPDIPv6/openbgpd77p.conf b/tests/live_tests/scenarios/max_prefix/configs/MaxPrefixScenario_OpenBGPDIPv6/openbgpd77p.conf new file mode 100644 index 00000000..b5874e6e --- /dev/null +++ b/tests/live_tests/scenarios/max_prefix/configs/MaxPrefixScenario_OpenBGPDIPv6/openbgpd77p.conf @@ -0,0 +1,2263 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.11 { + remote-as 1 + + rde evaluate all + + passive + ttl-security no + max-prefix 4 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::11 { + remote-as 1 + + rde evaluate all + + passive + ttl-security no + max-prefix 4 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.21 { + remote-as 2 + + rde evaluate all + + passive + ttl-security no + max-prefix 3 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::21 { + remote-as 2 + + rde evaluate all + + passive + ttl-security no + max-prefix 3 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.31 { + remote-as 3 + + rde evaluate all + + passive + ttl-security no + max-prefix 2 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::31 { + remote-as 3 + + rde evaluate all + + passive + ttl-security no + max-prefix 2 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.41 { + remote-as 4 + + rde evaluate all + + passive + ttl-security no + max-prefix 6 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::41 { + remote-as 4 + + rde evaluate all + + passive + ttl-security no + max-prefix 6 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + + + + + + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.11 set ext-community rt 65520:1 + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + +match from 192.0.2.21 set ext-community rt 65520:2 + +match from 2001:db8:1:1::21 set ext-community rt 65520:2 + +match from 192.0.2.31 set ext-community rt 65520:3 + +match from 2001:db8:1:1::31 set ext-community rt 65520:3 + +match from 192.0.2.41 set ext-community rt 65520:4 + +match from 2001:db8:1:1::41 set ext-community rt 65520:4 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +allow quick from group clients max-as-len 32 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS1_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + +deny quick to 2001:db8:1:1::11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.21 set community NO_ADVERTISE +match from 192.0.2.21 nexthop 192.0.2.21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.21 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.21 AS 23456' - reject code: 7 +allow quick from 192.0.2.21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.21 set ext-community delete rt 65520:2 + + + +allow quick from 192.0.2.21 + + + +# --------------------------------------------- +# client AS2_1, outbound + +deny quick to 192.0.2.21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.21 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::21 set community NO_ADVERTISE +match from 2001:db8:1:1::21 nexthop 2001:db8:1:1::21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::21 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::21 set ext-community delete rt 65520:2 + + + +allow quick from 2001:db8:1:1::21 + + + +# --------------------------------------------- +# client AS2_2, outbound + +deny quick to 2001:db8:1:1::21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::21 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3_1, inbound + + + +# NEXT_HOP +match from 192.0.2.31 set community NO_ADVERTISE +match from 192.0.2.31 nexthop 192.0.2.31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.31 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.31 AS 23456' - reject code: 7 +allow quick from 192.0.2.31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.31 set ext-community delete rt 65520:3 + + + +allow quick from 192.0.2.31 + + + +# --------------------------------------------- +# client AS3_1, outbound + +deny quick to 192.0.2.31 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.31 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.31 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::31 set community NO_ADVERTISE +match from 2001:db8:1:1::31 nexthop 2001:db8:1:1::31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::31 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::31 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::31 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::31 set ext-community delete rt 65520:3 + + + +allow quick from 2001:db8:1:1::31 + + + +# --------------------------------------------- +# client AS3_2, outbound + +deny quick to 2001:db8:1:1::31 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::31 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::31 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_1, inbound + + + +# NEXT_HOP +match from 192.0.2.41 set community NO_ADVERTISE +match from 192.0.2.41 nexthop 192.0.2.41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.41 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.41 AS 23456' - reject code: 7 +allow quick from 192.0.2.41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.41 set ext-community delete rt 65520:4 + + + +allow quick from 192.0.2.41 + + + +# --------------------------------------------- +# client AS4_1, outbound + +deny quick to 192.0.2.41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.41 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::41 set community NO_ADVERTISE +match from 2001:db8:1:1::41 nexthop 2001:db8:1:1::41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::41 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::41 set ext-community delete rt 65520:4 + + + +allow quick from 2001:db8:1:1::41 + + + +# --------------------------------------------- +# client AS4_2, outbound + +deny quick to 2001:db8:1:1::41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::41 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_BIRD2IPv4/bird2/AS2.txt b/tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_BIRD2IPv4/bird2/AS2.txt index d1c26932..a81a7a2c 100644 --- a/tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_BIRD2IPv4/bird2/AS2.txt +++ b/tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_BIRD2IPv4/bird2/AS2.txt @@ -82,20 +82,6 @@ best: True, LOCAL_PREF: 100 filtered: False () -5.0.1.0/24, AS_PATH: 5, NEXT_HOP: 192.0.2.51, via 192.0.2.2 - std comms: - ext comms: - lrg comms: - best: True, LOCAL_PREF: 100 - filtered: False () - -5.0.2.0/24, AS_PATH: 5, NEXT_HOP: 192.0.2.51, via 192.0.2.2 - std comms: - ext comms: - lrg comms: - best: True, LOCAL_PREF: 100 - filtered: False () - 6.0.1.0/24, AS_PATH: 6, NEXT_HOP: 192.0.2.61, via 192.0.2.2 std comms: ext comms: diff --git a/tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_BIRD2IPv6/bird2/AS1.txt b/tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_BIRD2IPv6/bird2/AS1.txt index d26d5640..3bf882aa 100644 --- a/tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_BIRD2IPv6/bird2/AS1.txt +++ b/tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_BIRD2IPv6/bird2/AS1.txt @@ -75,20 +75,6 @@ best: True, LOCAL_PREF: 100 filtered: False () -2a05:0:1::/48, AS_PATH: 5, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 - std comms: - ext comms: - lrg comms: - best: True, LOCAL_PREF: 100 - filtered: False () - -2a05:0:2::/48, AS_PATH: 5, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 - std comms: - ext comms: - lrg comms: - best: True, LOCAL_PREF: 100 - filtered: False () - 2a06:0:1::/48, AS_PATH: 6, NEXT_HOP: 2001:db8:1:1::61, via 2001:db8:1:1::2 std comms: ext comms: diff --git a/tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_BIRDIPv4/bird16/AS2.txt b/tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_BIRDIPv4/bird16/AS2.txt index d1c26932..a81a7a2c 100644 --- a/tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_BIRDIPv4/bird16/AS2.txt +++ b/tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_BIRDIPv4/bird16/AS2.txt @@ -82,20 +82,6 @@ best: True, LOCAL_PREF: 100 filtered: False () -5.0.1.0/24, AS_PATH: 5, NEXT_HOP: 192.0.2.51, via 192.0.2.2 - std comms: - ext comms: - lrg comms: - best: True, LOCAL_PREF: 100 - filtered: False () - -5.0.2.0/24, AS_PATH: 5, NEXT_HOP: 192.0.2.51, via 192.0.2.2 - std comms: - ext comms: - lrg comms: - best: True, LOCAL_PREF: 100 - filtered: False () - 6.0.1.0/24, AS_PATH: 6, NEXT_HOP: 192.0.2.61, via 192.0.2.2 std comms: ext comms: diff --git a/tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_OpenBGPDIPv4/openbgpd77p/AS1.txt b/tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_OpenBGPDIPv4/openbgpd77p/AS1.txt new file mode 100644 index 00000000..e69de29b diff --git a/tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_OpenBGPDIPv4/openbgpd77p/AS2.txt b/tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_OpenBGPDIPv4/openbgpd77p/AS2.txt new file mode 100644 index 00000000..e69de29b diff --git a/tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_OpenBGPDIPv4/openbgpd77p/AS3.txt b/tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_OpenBGPDIPv4/openbgpd77p/AS3.txt new file mode 100644 index 00000000..e69de29b diff --git a/tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_OpenBGPDIPv4/openbgpd77p/AS4.txt b/tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_OpenBGPDIPv4/openbgpd77p/AS4.txt new file mode 100644 index 00000000..e69de29b diff --git a/tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_OpenBGPDIPv4/openbgpd77p/rs.txt b/tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_OpenBGPDIPv4/openbgpd77p/rs.txt new file mode 100644 index 00000000..e69de29b diff --git a/tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_OpenBGPDIPv6/openbgpd77p/AS1.txt b/tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_OpenBGPDIPv6/openbgpd77p/AS1.txt new file mode 100644 index 00000000..e69de29b diff --git a/tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_OpenBGPDIPv6/openbgpd77p/AS2.txt b/tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_OpenBGPDIPv6/openbgpd77p/AS2.txt new file mode 100644 index 00000000..e69de29b diff --git a/tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_OpenBGPDIPv6/openbgpd77p/AS3.txt b/tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_OpenBGPDIPv6/openbgpd77p/AS3.txt new file mode 100644 index 00000000..e69de29b diff --git a/tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_OpenBGPDIPv6/openbgpd77p/AS4.txt b/tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_OpenBGPDIPv6/openbgpd77p/AS4.txt new file mode 100644 index 00000000..e69de29b diff --git a/tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_OpenBGPDIPv6/openbgpd77p/rs.txt b/tests/live_tests/scenarios/max_prefix/routes/MaxPrefixScenario_OpenBGPDIPv6/openbgpd77p/rs.txt new file mode 100644 index 00000000..e69de29b diff --git a/tests/live_tests/scenarios/path_hiding/configs/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd76p.conf b/tests/live_tests/scenarios/path_hiding/configs/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd76p.conf new file mode 100644 index 00000000..99962116 --- /dev/null +++ b/tests/live_tests/scenarios/path_hiding/configs/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd76p.conf @@ -0,0 +1,2281 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.11 { + remote-as 1 + + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::11 { + remote-as 1 + + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 192.0.2.21 { + remote-as 2 + + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::21 { + remote-as 2 + + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 192.0.2.31 { + remote-as 3 + + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::31 { + remote-as 3 + + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 192.0.2.41 { + remote-as 4 + + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::41 { + remote-as 4 + + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + + + + + + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.11 set ext-community rt 65520:1 + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + +match from 192.0.2.21 set ext-community rt 65520:2 + +match from 2001:db8:1:1::21 set ext-community rt 65520:2 + +match from 192.0.2.31 set ext-community rt 65520:3 + +match from 2001:db8:1:1::31 set ext-community rt 65520:3 + +match from 192.0.2.41 set ext-community rt 65520:4 + +match from 2001:db8:1:1::41 set ext-community rt 65520:4 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +allow quick from group clients max-as-len 32 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS1_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + +# do_not_announce_to_peer +deny quick to 192.0.2.11 community 0:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + +deny quick to 2001:db8:1:1::11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::11 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::11 community 0:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.21 set community NO_ADVERTISE +match from 192.0.2.21 nexthop 192.0.2.21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.21 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.21 AS 23456' - reject code: 7 +allow quick from 192.0.2.21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.21 set ext-community delete rt 65520:2 + + + +allow quick from 192.0.2.21 + + + +# --------------------------------------------- +# client AS2_1, outbound + +deny quick to 192.0.2.21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.21 + +# do_not_announce_to_peer +deny quick to 192.0.2.21 community 0:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::21 set community NO_ADVERTISE +match from 2001:db8:1:1::21 nexthop 2001:db8:1:1::21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::21 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::21 set ext-community delete rt 65520:2 + + + +allow quick from 2001:db8:1:1::21 + + + +# --------------------------------------------- +# client AS2_2, outbound + +deny quick to 2001:db8:1:1::21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::21 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::21 community 0:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3_1, inbound + + + +# NEXT_HOP +match from 192.0.2.31 set community NO_ADVERTISE +match from 192.0.2.31 nexthop 192.0.2.31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.31 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.31 AS 23456' - reject code: 7 +allow quick from 192.0.2.31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.31 set ext-community delete rt 65520:3 + + + +allow quick from 192.0.2.31 + + + +# --------------------------------------------- +# client AS3_1, outbound + +deny quick to 192.0.2.31 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.31 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.31 + +# do_not_announce_to_peer +deny quick to 192.0.2.31 community 0:3 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::31 set community NO_ADVERTISE +match from 2001:db8:1:1::31 nexthop 2001:db8:1:1::31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::31 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::31 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::31 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::31 set ext-community delete rt 65520:3 + + + +allow quick from 2001:db8:1:1::31 + + + +# --------------------------------------------- +# client AS3_2, outbound + +deny quick to 2001:db8:1:1::31 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::31 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::31 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::31 community 0:3 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_1, inbound + + + +# NEXT_HOP +match from 192.0.2.41 set community NO_ADVERTISE +match from 192.0.2.41 nexthop 192.0.2.41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.41 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.41 AS 23456' - reject code: 7 +allow quick from 192.0.2.41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.41 set ext-community delete rt 65520:4 + + + +allow quick from 192.0.2.41 + + + +# --------------------------------------------- +# client AS4_1, outbound + +deny quick to 192.0.2.41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.41 + +# do_not_announce_to_peer +deny quick to 192.0.2.41 community 0:4 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::41 set community NO_ADVERTISE +match from 2001:db8:1:1::41 nexthop 2001:db8:1:1::41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::41 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::41 set ext-community delete rt 65520:4 + + + +allow quick from 2001:db8:1:1::41 + + + +# --------------------------------------------- +# client AS4_2, outbound + +deny quick to 2001:db8:1:1::41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::41 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::41 community 0:4 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes +# do_not_announce_to_peer +match to group clients set community delete 0:* + +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/path_hiding/configs/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd77p.conf b/tests/live_tests/scenarios/path_hiding/configs/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd77p.conf new file mode 100644 index 00000000..99962116 --- /dev/null +++ b/tests/live_tests/scenarios/path_hiding/configs/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd77p.conf @@ -0,0 +1,2281 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.11 { + remote-as 1 + + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::11 { + remote-as 1 + + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 192.0.2.21 { + remote-as 2 + + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::21 { + remote-as 2 + + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 192.0.2.31 { + remote-as 3 + + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::31 { + remote-as 3 + + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 192.0.2.41 { + remote-as 4 + + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::41 { + remote-as 4 + + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + + + + + + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.11 set ext-community rt 65520:1 + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + +match from 192.0.2.21 set ext-community rt 65520:2 + +match from 2001:db8:1:1::21 set ext-community rt 65520:2 + +match from 192.0.2.31 set ext-community rt 65520:3 + +match from 2001:db8:1:1::31 set ext-community rt 65520:3 + +match from 192.0.2.41 set ext-community rt 65520:4 + +match from 2001:db8:1:1::41 set ext-community rt 65520:4 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +allow quick from group clients max-as-len 32 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS1_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + +# do_not_announce_to_peer +deny quick to 192.0.2.11 community 0:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + +deny quick to 2001:db8:1:1::11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::11 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::11 community 0:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.21 set community NO_ADVERTISE +match from 192.0.2.21 nexthop 192.0.2.21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.21 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.21 AS 23456' - reject code: 7 +allow quick from 192.0.2.21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.21 set ext-community delete rt 65520:2 + + + +allow quick from 192.0.2.21 + + + +# --------------------------------------------- +# client AS2_1, outbound + +deny quick to 192.0.2.21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.21 + +# do_not_announce_to_peer +deny quick to 192.0.2.21 community 0:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::21 set community NO_ADVERTISE +match from 2001:db8:1:1::21 nexthop 2001:db8:1:1::21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::21 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::21 set ext-community delete rt 65520:2 + + + +allow quick from 2001:db8:1:1::21 + + + +# --------------------------------------------- +# client AS2_2, outbound + +deny quick to 2001:db8:1:1::21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::21 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::21 community 0:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3_1, inbound + + + +# NEXT_HOP +match from 192.0.2.31 set community NO_ADVERTISE +match from 192.0.2.31 nexthop 192.0.2.31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.31 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.31 AS 23456' - reject code: 7 +allow quick from 192.0.2.31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.31 set ext-community delete rt 65520:3 + + + +allow quick from 192.0.2.31 + + + +# --------------------------------------------- +# client AS3_1, outbound + +deny quick to 192.0.2.31 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.31 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.31 + +# do_not_announce_to_peer +deny quick to 192.0.2.31 community 0:3 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::31 set community NO_ADVERTISE +match from 2001:db8:1:1::31 nexthop 2001:db8:1:1::31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::31 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::31 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::31 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::31 set ext-community delete rt 65520:3 + + + +allow quick from 2001:db8:1:1::31 + + + +# --------------------------------------------- +# client AS3_2, outbound + +deny quick to 2001:db8:1:1::31 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::31 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::31 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::31 community 0:3 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_1, inbound + + + +# NEXT_HOP +match from 192.0.2.41 set community NO_ADVERTISE +match from 192.0.2.41 nexthop 192.0.2.41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.41 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.41 AS 23456' - reject code: 7 +allow quick from 192.0.2.41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.41 set ext-community delete rt 65520:4 + + + +allow quick from 192.0.2.41 + + + +# --------------------------------------------- +# client AS4_1, outbound + +deny quick to 192.0.2.41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.41 + +# do_not_announce_to_peer +deny quick to 192.0.2.41 community 0:4 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::41 set community NO_ADVERTISE +match from 2001:db8:1:1::41 nexthop 2001:db8:1:1::41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::41 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::41 set ext-community delete rt 65520:4 + + + +allow quick from 2001:db8:1:1::41 + + + +# --------------------------------------------- +# client AS4_2, outbound + +deny quick to 2001:db8:1:1::41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::41 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::41 community 0:4 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes +# do_not_announce_to_peer +match to group clients set community delete 0:* + +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/path_hiding/configs/PathHidingScenario_MitigationOff_OpenBGPDIPv6/openbgpd76p.conf b/tests/live_tests/scenarios/path_hiding/configs/PathHidingScenario_MitigationOff_OpenBGPDIPv6/openbgpd76p.conf new file mode 100644 index 00000000..99962116 --- /dev/null +++ b/tests/live_tests/scenarios/path_hiding/configs/PathHidingScenario_MitigationOff_OpenBGPDIPv6/openbgpd76p.conf @@ -0,0 +1,2281 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.11 { + remote-as 1 + + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::11 { + remote-as 1 + + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 192.0.2.21 { + remote-as 2 + + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::21 { + remote-as 2 + + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 192.0.2.31 { + remote-as 3 + + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::31 { + remote-as 3 + + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 192.0.2.41 { + remote-as 4 + + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::41 { + remote-as 4 + + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + + + + + + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.11 set ext-community rt 65520:1 + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + +match from 192.0.2.21 set ext-community rt 65520:2 + +match from 2001:db8:1:1::21 set ext-community rt 65520:2 + +match from 192.0.2.31 set ext-community rt 65520:3 + +match from 2001:db8:1:1::31 set ext-community rt 65520:3 + +match from 192.0.2.41 set ext-community rt 65520:4 + +match from 2001:db8:1:1::41 set ext-community rt 65520:4 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +allow quick from group clients max-as-len 32 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS1_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + +# do_not_announce_to_peer +deny quick to 192.0.2.11 community 0:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + +deny quick to 2001:db8:1:1::11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::11 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::11 community 0:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.21 set community NO_ADVERTISE +match from 192.0.2.21 nexthop 192.0.2.21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.21 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.21 AS 23456' - reject code: 7 +allow quick from 192.0.2.21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.21 set ext-community delete rt 65520:2 + + + +allow quick from 192.0.2.21 + + + +# --------------------------------------------- +# client AS2_1, outbound + +deny quick to 192.0.2.21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.21 + +# do_not_announce_to_peer +deny quick to 192.0.2.21 community 0:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::21 set community NO_ADVERTISE +match from 2001:db8:1:1::21 nexthop 2001:db8:1:1::21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::21 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::21 set ext-community delete rt 65520:2 + + + +allow quick from 2001:db8:1:1::21 + + + +# --------------------------------------------- +# client AS2_2, outbound + +deny quick to 2001:db8:1:1::21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::21 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::21 community 0:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3_1, inbound + + + +# NEXT_HOP +match from 192.0.2.31 set community NO_ADVERTISE +match from 192.0.2.31 nexthop 192.0.2.31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.31 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.31 AS 23456' - reject code: 7 +allow quick from 192.0.2.31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.31 set ext-community delete rt 65520:3 + + + +allow quick from 192.0.2.31 + + + +# --------------------------------------------- +# client AS3_1, outbound + +deny quick to 192.0.2.31 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.31 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.31 + +# do_not_announce_to_peer +deny quick to 192.0.2.31 community 0:3 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::31 set community NO_ADVERTISE +match from 2001:db8:1:1::31 nexthop 2001:db8:1:1::31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::31 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::31 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::31 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::31 set ext-community delete rt 65520:3 + + + +allow quick from 2001:db8:1:1::31 + + + +# --------------------------------------------- +# client AS3_2, outbound + +deny quick to 2001:db8:1:1::31 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::31 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::31 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::31 community 0:3 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_1, inbound + + + +# NEXT_HOP +match from 192.0.2.41 set community NO_ADVERTISE +match from 192.0.2.41 nexthop 192.0.2.41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.41 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.41 AS 23456' - reject code: 7 +allow quick from 192.0.2.41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.41 set ext-community delete rt 65520:4 + + + +allow quick from 192.0.2.41 + + + +# --------------------------------------------- +# client AS4_1, outbound + +deny quick to 192.0.2.41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.41 + +# do_not_announce_to_peer +deny quick to 192.0.2.41 community 0:4 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::41 set community NO_ADVERTISE +match from 2001:db8:1:1::41 nexthop 2001:db8:1:1::41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::41 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::41 set ext-community delete rt 65520:4 + + + +allow quick from 2001:db8:1:1::41 + + + +# --------------------------------------------- +# client AS4_2, outbound + +deny quick to 2001:db8:1:1::41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::41 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::41 community 0:4 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes +# do_not_announce_to_peer +match to group clients set community delete 0:* + +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/path_hiding/configs/PathHidingScenario_MitigationOff_OpenBGPDIPv6/openbgpd77p.conf b/tests/live_tests/scenarios/path_hiding/configs/PathHidingScenario_MitigationOff_OpenBGPDIPv6/openbgpd77p.conf new file mode 100644 index 00000000..99962116 --- /dev/null +++ b/tests/live_tests/scenarios/path_hiding/configs/PathHidingScenario_MitigationOff_OpenBGPDIPv6/openbgpd77p.conf @@ -0,0 +1,2281 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.11 { + remote-as 1 + + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::11 { + remote-as 1 + + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 192.0.2.21 { + remote-as 2 + + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::21 { + remote-as 2 + + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 192.0.2.31 { + remote-as 3 + + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::31 { + remote-as 3 + + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 192.0.2.41 { + remote-as 4 + + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::41 { + remote-as 4 + + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + + + + + + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.11 set ext-community rt 65520:1 + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + +match from 192.0.2.21 set ext-community rt 65520:2 + +match from 2001:db8:1:1::21 set ext-community rt 65520:2 + +match from 192.0.2.31 set ext-community rt 65520:3 + +match from 2001:db8:1:1::31 set ext-community rt 65520:3 + +match from 192.0.2.41 set ext-community rt 65520:4 + +match from 2001:db8:1:1::41 set ext-community rt 65520:4 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +allow quick from group clients max-as-len 32 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS1_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + +# do_not_announce_to_peer +deny quick to 192.0.2.11 community 0:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + +deny quick to 2001:db8:1:1::11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::11 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::11 community 0:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.21 set community NO_ADVERTISE +match from 192.0.2.21 nexthop 192.0.2.21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.21 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.21 AS 23456' - reject code: 7 +allow quick from 192.0.2.21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.21 set ext-community delete rt 65520:2 + + + +allow quick from 192.0.2.21 + + + +# --------------------------------------------- +# client AS2_1, outbound + +deny quick to 192.0.2.21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.21 + +# do_not_announce_to_peer +deny quick to 192.0.2.21 community 0:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::21 set community NO_ADVERTISE +match from 2001:db8:1:1::21 nexthop 2001:db8:1:1::21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::21 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::21 set ext-community delete rt 65520:2 + + + +allow quick from 2001:db8:1:1::21 + + + +# --------------------------------------------- +# client AS2_2, outbound + +deny quick to 2001:db8:1:1::21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::21 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::21 community 0:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3_1, inbound + + + +# NEXT_HOP +match from 192.0.2.31 set community NO_ADVERTISE +match from 192.0.2.31 nexthop 192.0.2.31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.31 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.31 AS 23456' - reject code: 7 +allow quick from 192.0.2.31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.31 set ext-community delete rt 65520:3 + + + +allow quick from 192.0.2.31 + + + +# --------------------------------------------- +# client AS3_1, outbound + +deny quick to 192.0.2.31 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.31 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.31 + +# do_not_announce_to_peer +deny quick to 192.0.2.31 community 0:3 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::31 set community NO_ADVERTISE +match from 2001:db8:1:1::31 nexthop 2001:db8:1:1::31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::31 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::31 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::31 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::31 set ext-community delete rt 65520:3 + + + +allow quick from 2001:db8:1:1::31 + + + +# --------------------------------------------- +# client AS3_2, outbound + +deny quick to 2001:db8:1:1::31 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::31 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::31 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::31 community 0:3 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_1, inbound + + + +# NEXT_HOP +match from 192.0.2.41 set community NO_ADVERTISE +match from 192.0.2.41 nexthop 192.0.2.41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.41 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.41 AS 23456' - reject code: 7 +allow quick from 192.0.2.41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.41 set ext-community delete rt 65520:4 + + + +allow quick from 192.0.2.41 + + + +# --------------------------------------------- +# client AS4_1, outbound + +deny quick to 192.0.2.41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.41 + +# do_not_announce_to_peer +deny quick to 192.0.2.41 community 0:4 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::41 set community NO_ADVERTISE +match from 2001:db8:1:1::41 nexthop 2001:db8:1:1::41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::41 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::41 set ext-community delete rt 65520:4 + + + +allow quick from 2001:db8:1:1::41 + + + +# --------------------------------------------- +# client AS4_2, outbound + +deny quick to 2001:db8:1:1::41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::41 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::41 community 0:4 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes +# do_not_announce_to_peer +match to group clients set community delete 0:* + +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/path_hiding/configs/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd76p.conf b/tests/live_tests/scenarios/path_hiding/configs/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd76p.conf new file mode 100644 index 00000000..7edb7c56 --- /dev/null +++ b/tests/live_tests/scenarios/path_hiding/configs/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd76p.conf @@ -0,0 +1,2290 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.11 { + remote-as 1 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::11 { + remote-as 1 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 192.0.2.21 { + remote-as 2 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::21 { + remote-as 2 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 192.0.2.31 { + remote-as 3 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::31 { + remote-as 3 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 192.0.2.41 { + remote-as 4 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::41 { + remote-as 4 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + + + + + + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.11 set ext-community rt 65520:1 + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + +match from 192.0.2.21 set ext-community rt 65520:2 + +match from 2001:db8:1:1::21 set ext-community rt 65520:2 + +match from 192.0.2.31 set ext-community rt 65520:3 + +match from 2001:db8:1:1::31 set ext-community rt 65520:3 + +match from 192.0.2.41 set ext-community rt 65520:4 + +match from 2001:db8:1:1::41 set ext-community rt 65520:4 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +allow quick from group clients max-as-len 32 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS1_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + +# do_not_announce_to_peer +deny quick to 192.0.2.11 community 0:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + +deny quick to 2001:db8:1:1::11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::11 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::11 community 0:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.21 set community NO_ADVERTISE +match from 192.0.2.21 nexthop 192.0.2.21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.21 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.21 AS 23456' - reject code: 7 +allow quick from 192.0.2.21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.21 set ext-community delete rt 65520:2 + + + +allow quick from 192.0.2.21 + + + +# --------------------------------------------- +# client AS2_1, outbound + +deny quick to 192.0.2.21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.21 + +# do_not_announce_to_peer +deny quick to 192.0.2.21 community 0:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::21 set community NO_ADVERTISE +match from 2001:db8:1:1::21 nexthop 2001:db8:1:1::21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::21 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::21 set ext-community delete rt 65520:2 + + + +allow quick from 2001:db8:1:1::21 + + + +# --------------------------------------------- +# client AS2_2, outbound + +deny quick to 2001:db8:1:1::21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::21 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::21 community 0:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3_1, inbound + + + +# NEXT_HOP +match from 192.0.2.31 set community NO_ADVERTISE +match from 192.0.2.31 nexthop 192.0.2.31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.31 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.31 AS 23456' - reject code: 7 +allow quick from 192.0.2.31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.31 set ext-community delete rt 65520:3 + + + +allow quick from 192.0.2.31 + + + +# --------------------------------------------- +# client AS3_1, outbound + +deny quick to 192.0.2.31 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.31 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.31 + +# do_not_announce_to_peer +deny quick to 192.0.2.31 community 0:3 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::31 set community NO_ADVERTISE +match from 2001:db8:1:1::31 nexthop 2001:db8:1:1::31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::31 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::31 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::31 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::31 set ext-community delete rt 65520:3 + + + +allow quick from 2001:db8:1:1::31 + + + +# --------------------------------------------- +# client AS3_2, outbound + +deny quick to 2001:db8:1:1::31 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::31 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::31 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::31 community 0:3 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_1, inbound + + + +# NEXT_HOP +match from 192.0.2.41 set community NO_ADVERTISE +match from 192.0.2.41 nexthop 192.0.2.41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.41 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.41 AS 23456' - reject code: 7 +allow quick from 192.0.2.41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.41 set ext-community delete rt 65520:4 + + + +allow quick from 192.0.2.41 + + + +# --------------------------------------------- +# client AS4_1, outbound + +deny quick to 192.0.2.41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.41 + +# do_not_announce_to_peer +deny quick to 192.0.2.41 community 0:4 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::41 set community NO_ADVERTISE +match from 2001:db8:1:1::41 nexthop 2001:db8:1:1::41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::41 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::41 set ext-community delete rt 65520:4 + + + +allow quick from 2001:db8:1:1::41 + + + +# --------------------------------------------- +# client AS4_2, outbound + +deny quick to 2001:db8:1:1::41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::41 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::41 community 0:4 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes +# do_not_announce_to_peer +match to group clients set community delete 0:* + +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/path_hiding/configs/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd77p.conf b/tests/live_tests/scenarios/path_hiding/configs/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd77p.conf new file mode 100644 index 00000000..7edb7c56 --- /dev/null +++ b/tests/live_tests/scenarios/path_hiding/configs/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd77p.conf @@ -0,0 +1,2290 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.11 { + remote-as 1 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::11 { + remote-as 1 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 192.0.2.21 { + remote-as 2 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::21 { + remote-as 2 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 192.0.2.31 { + remote-as 3 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::31 { + remote-as 3 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 192.0.2.41 { + remote-as 4 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::41 { + remote-as 4 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + + + + + + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.11 set ext-community rt 65520:1 + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + +match from 192.0.2.21 set ext-community rt 65520:2 + +match from 2001:db8:1:1::21 set ext-community rt 65520:2 + +match from 192.0.2.31 set ext-community rt 65520:3 + +match from 2001:db8:1:1::31 set ext-community rt 65520:3 + +match from 192.0.2.41 set ext-community rt 65520:4 + +match from 2001:db8:1:1::41 set ext-community rt 65520:4 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +allow quick from group clients max-as-len 32 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS1_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + +# do_not_announce_to_peer +deny quick to 192.0.2.11 community 0:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + +deny quick to 2001:db8:1:1::11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::11 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::11 community 0:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.21 set community NO_ADVERTISE +match from 192.0.2.21 nexthop 192.0.2.21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.21 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.21 AS 23456' - reject code: 7 +allow quick from 192.0.2.21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.21 set ext-community delete rt 65520:2 + + + +allow quick from 192.0.2.21 + + + +# --------------------------------------------- +# client AS2_1, outbound + +deny quick to 192.0.2.21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.21 + +# do_not_announce_to_peer +deny quick to 192.0.2.21 community 0:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::21 set community NO_ADVERTISE +match from 2001:db8:1:1::21 nexthop 2001:db8:1:1::21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::21 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::21 set ext-community delete rt 65520:2 + + + +allow quick from 2001:db8:1:1::21 + + + +# --------------------------------------------- +# client AS2_2, outbound + +deny quick to 2001:db8:1:1::21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::21 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::21 community 0:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3_1, inbound + + + +# NEXT_HOP +match from 192.0.2.31 set community NO_ADVERTISE +match from 192.0.2.31 nexthop 192.0.2.31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.31 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.31 AS 23456' - reject code: 7 +allow quick from 192.0.2.31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.31 set ext-community delete rt 65520:3 + + + +allow quick from 192.0.2.31 + + + +# --------------------------------------------- +# client AS3_1, outbound + +deny quick to 192.0.2.31 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.31 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.31 + +# do_not_announce_to_peer +deny quick to 192.0.2.31 community 0:3 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::31 set community NO_ADVERTISE +match from 2001:db8:1:1::31 nexthop 2001:db8:1:1::31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::31 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::31 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::31 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::31 set ext-community delete rt 65520:3 + + + +allow quick from 2001:db8:1:1::31 + + + +# --------------------------------------------- +# client AS3_2, outbound + +deny quick to 2001:db8:1:1::31 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::31 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::31 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::31 community 0:3 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_1, inbound + + + +# NEXT_HOP +match from 192.0.2.41 set community NO_ADVERTISE +match from 192.0.2.41 nexthop 192.0.2.41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.41 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.41 AS 23456' - reject code: 7 +allow quick from 192.0.2.41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.41 set ext-community delete rt 65520:4 + + + +allow quick from 192.0.2.41 + + + +# --------------------------------------------- +# client AS4_1, outbound + +deny quick to 192.0.2.41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.41 + +# do_not_announce_to_peer +deny quick to 192.0.2.41 community 0:4 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::41 set community NO_ADVERTISE +match from 2001:db8:1:1::41 nexthop 2001:db8:1:1::41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::41 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::41 set ext-community delete rt 65520:4 + + + +allow quick from 2001:db8:1:1::41 + + + +# --------------------------------------------- +# client AS4_2, outbound + +deny quick to 2001:db8:1:1::41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::41 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::41 community 0:4 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes +# do_not_announce_to_peer +match to group clients set community delete 0:* + +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/path_hiding/configs/PathHidingScenario_MitigationOn_OpenBGPDIPv6/openbgpd76p.conf b/tests/live_tests/scenarios/path_hiding/configs/PathHidingScenario_MitigationOn_OpenBGPDIPv6/openbgpd76p.conf new file mode 100644 index 00000000..7edb7c56 --- /dev/null +++ b/tests/live_tests/scenarios/path_hiding/configs/PathHidingScenario_MitigationOn_OpenBGPDIPv6/openbgpd76p.conf @@ -0,0 +1,2290 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.11 { + remote-as 1 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::11 { + remote-as 1 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 192.0.2.21 { + remote-as 2 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::21 { + remote-as 2 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 192.0.2.31 { + remote-as 3 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::31 { + remote-as 3 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 192.0.2.41 { + remote-as 4 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::41 { + remote-as 4 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + + + + + + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.11 set ext-community rt 65520:1 + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + +match from 192.0.2.21 set ext-community rt 65520:2 + +match from 2001:db8:1:1::21 set ext-community rt 65520:2 + +match from 192.0.2.31 set ext-community rt 65520:3 + +match from 2001:db8:1:1::31 set ext-community rt 65520:3 + +match from 192.0.2.41 set ext-community rt 65520:4 + +match from 2001:db8:1:1::41 set ext-community rt 65520:4 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +allow quick from group clients max-as-len 32 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS1_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + +# do_not_announce_to_peer +deny quick to 192.0.2.11 community 0:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + +deny quick to 2001:db8:1:1::11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::11 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::11 community 0:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.21 set community NO_ADVERTISE +match from 192.0.2.21 nexthop 192.0.2.21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.21 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.21 AS 23456' - reject code: 7 +allow quick from 192.0.2.21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.21 set ext-community delete rt 65520:2 + + + +allow quick from 192.0.2.21 + + + +# --------------------------------------------- +# client AS2_1, outbound + +deny quick to 192.0.2.21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.21 + +# do_not_announce_to_peer +deny quick to 192.0.2.21 community 0:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::21 set community NO_ADVERTISE +match from 2001:db8:1:1::21 nexthop 2001:db8:1:1::21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::21 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::21 set ext-community delete rt 65520:2 + + + +allow quick from 2001:db8:1:1::21 + + + +# --------------------------------------------- +# client AS2_2, outbound + +deny quick to 2001:db8:1:1::21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::21 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::21 community 0:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3_1, inbound + + + +# NEXT_HOP +match from 192.0.2.31 set community NO_ADVERTISE +match from 192.0.2.31 nexthop 192.0.2.31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.31 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.31 AS 23456' - reject code: 7 +allow quick from 192.0.2.31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.31 set ext-community delete rt 65520:3 + + + +allow quick from 192.0.2.31 + + + +# --------------------------------------------- +# client AS3_1, outbound + +deny quick to 192.0.2.31 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.31 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.31 + +# do_not_announce_to_peer +deny quick to 192.0.2.31 community 0:3 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::31 set community NO_ADVERTISE +match from 2001:db8:1:1::31 nexthop 2001:db8:1:1::31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::31 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::31 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::31 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::31 set ext-community delete rt 65520:3 + + + +allow quick from 2001:db8:1:1::31 + + + +# --------------------------------------------- +# client AS3_2, outbound + +deny quick to 2001:db8:1:1::31 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::31 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::31 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::31 community 0:3 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_1, inbound + + + +# NEXT_HOP +match from 192.0.2.41 set community NO_ADVERTISE +match from 192.0.2.41 nexthop 192.0.2.41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.41 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.41 AS 23456' - reject code: 7 +allow quick from 192.0.2.41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.41 set ext-community delete rt 65520:4 + + + +allow quick from 192.0.2.41 + + + +# --------------------------------------------- +# client AS4_1, outbound + +deny quick to 192.0.2.41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.41 + +# do_not_announce_to_peer +deny quick to 192.0.2.41 community 0:4 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::41 set community NO_ADVERTISE +match from 2001:db8:1:1::41 nexthop 2001:db8:1:1::41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::41 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::41 set ext-community delete rt 65520:4 + + + +allow quick from 2001:db8:1:1::41 + + + +# --------------------------------------------- +# client AS4_2, outbound + +deny quick to 2001:db8:1:1::41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::41 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::41 community 0:4 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes +# do_not_announce_to_peer +match to group clients set community delete 0:* + +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/path_hiding/configs/PathHidingScenario_MitigationOn_OpenBGPDIPv6/openbgpd77p.conf b/tests/live_tests/scenarios/path_hiding/configs/PathHidingScenario_MitigationOn_OpenBGPDIPv6/openbgpd77p.conf new file mode 100644 index 00000000..7edb7c56 --- /dev/null +++ b/tests/live_tests/scenarios/path_hiding/configs/PathHidingScenario_MitigationOn_OpenBGPDIPv6/openbgpd77p.conf @@ -0,0 +1,2290 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.11 { + remote-as 1 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::11 { + remote-as 1 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 192.0.2.21 { + remote-as 2 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::21 { + remote-as 2 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 192.0.2.31 { + remote-as 3 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::31 { + remote-as 3 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 192.0.2.41 { + remote-as 4 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::41 { + remote-as 4 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + + + + + + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.11 set ext-community rt 65520:1 + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + +match from 192.0.2.21 set ext-community rt 65520:2 + +match from 2001:db8:1:1::21 set ext-community rt 65520:2 + +match from 192.0.2.31 set ext-community rt 65520:3 + +match from 2001:db8:1:1::31 set ext-community rt 65520:3 + +match from 192.0.2.41 set ext-community rt 65520:4 + +match from 2001:db8:1:1::41 set ext-community rt 65520:4 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +allow quick from group clients max-as-len 32 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS1_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + +# do_not_announce_to_peer +deny quick to 192.0.2.11 community 0:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + +deny quick to 2001:db8:1:1::11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::11 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::11 community 0:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.21 set community NO_ADVERTISE +match from 192.0.2.21 nexthop 192.0.2.21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.21 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.21 AS 23456' - reject code: 7 +allow quick from 192.0.2.21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.21 set ext-community delete rt 65520:2 + + + +allow quick from 192.0.2.21 + + + +# --------------------------------------------- +# client AS2_1, outbound + +deny quick to 192.0.2.21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.21 + +# do_not_announce_to_peer +deny quick to 192.0.2.21 community 0:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::21 set community NO_ADVERTISE +match from 2001:db8:1:1::21 nexthop 2001:db8:1:1::21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::21 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::21 set ext-community delete rt 65520:2 + + + +allow quick from 2001:db8:1:1::21 + + + +# --------------------------------------------- +# client AS2_2, outbound + +deny quick to 2001:db8:1:1::21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::21 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::21 community 0:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3_1, inbound + + + +# NEXT_HOP +match from 192.0.2.31 set community NO_ADVERTISE +match from 192.0.2.31 nexthop 192.0.2.31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.31 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.31 AS 23456' - reject code: 7 +allow quick from 192.0.2.31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.31 set ext-community delete rt 65520:3 + + + +allow quick from 192.0.2.31 + + + +# --------------------------------------------- +# client AS3_1, outbound + +deny quick to 192.0.2.31 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.31 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.31 + +# do_not_announce_to_peer +deny quick to 192.0.2.31 community 0:3 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::31 set community NO_ADVERTISE +match from 2001:db8:1:1::31 nexthop 2001:db8:1:1::31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::31 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::31 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::31 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::31 set ext-community delete rt 65520:3 + + + +allow quick from 2001:db8:1:1::31 + + + +# --------------------------------------------- +# client AS3_2, outbound + +deny quick to 2001:db8:1:1::31 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::31 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::31 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::31 community 0:3 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_1, inbound + + + +# NEXT_HOP +match from 192.0.2.41 set community NO_ADVERTISE +match from 192.0.2.41 nexthop 192.0.2.41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.41 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.41 AS 23456' - reject code: 7 +allow quick from 192.0.2.41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.41 set ext-community delete rt 65520:4 + + + +allow quick from 192.0.2.41 + + + +# --------------------------------------------- +# client AS4_1, outbound + +deny quick to 192.0.2.41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.41 + +# do_not_announce_to_peer +deny quick to 192.0.2.41 community 0:4 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::41 set community NO_ADVERTISE +match from 2001:db8:1:1::41 nexthop 2001:db8:1:1::41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::41 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::41 set ext-community delete rt 65520:4 + + + +allow quick from 2001:db8:1:1::41 + + + +# --------------------------------------------- +# client AS4_2, outbound + +deny quick to 2001:db8:1:1::41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::41 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::41 community 0:4 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes +# do_not_announce_to_peer +match to group clients set community delete 0:* + +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd76p/AS1.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd76p/AS1.txt new file mode 100644 index 00000000..7fe4a1b3 --- /dev/null +++ b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd76p/AS1.txt @@ -0,0 +1,7 @@ +101.0.1.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd76p/AS101.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd76p/AS101.txt new file mode 100644 index 00000000..e69de29b diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd76p/AS2.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd76p/AS2.txt new file mode 100644 index 00000000..dd7e5651 --- /dev/null +++ b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd76p/AS2.txt @@ -0,0 +1,7 @@ +101.0.1.0/24, AS_PATH: 101 101 101 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd76p/AS3.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd76p/AS3.txt new file mode 100644 index 00000000..e69de29b diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd76p/AS4.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd76p/AS4.txt new file mode 100644 index 00000000..16373410 --- /dev/null +++ b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd76p/AS4.txt @@ -0,0 +1,7 @@ +101.0.1.0/24, AS_PATH: 2 101 101 101 101, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd76p/rs.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd76p/rs.txt new file mode 100644 index 00000000..12d72bc0 --- /dev/null +++ b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd76p/rs.txt @@ -0,0 +1,14 @@ +101.0.1.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: 0:3, 0:4 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.1.0/24, AS_PATH: 2 101 101 101 101, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd77p/AS1.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd77p/AS1.txt new file mode 100644 index 00000000..7fe4a1b3 --- /dev/null +++ b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd77p/AS1.txt @@ -0,0 +1,7 @@ +101.0.1.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd77p/AS101.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd77p/AS101.txt new file mode 100644 index 00000000..e69de29b diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd77p/AS2.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd77p/AS2.txt new file mode 100644 index 00000000..dd7e5651 --- /dev/null +++ b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd77p/AS2.txt @@ -0,0 +1,7 @@ +101.0.1.0/24, AS_PATH: 101 101 101 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd77p/AS3.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd77p/AS3.txt new file mode 100644 index 00000000..e69de29b diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd77p/AS4.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd77p/AS4.txt new file mode 100644 index 00000000..16373410 --- /dev/null +++ b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd77p/AS4.txt @@ -0,0 +1,7 @@ +101.0.1.0/24, AS_PATH: 2 101 101 101 101, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd77p/rs.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd77p/rs.txt new file mode 100644 index 00000000..12d72bc0 --- /dev/null +++ b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv4/openbgpd77p/rs.txt @@ -0,0 +1,14 @@ +101.0.1.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: 0:3, 0:4 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +101.0.1.0/24, AS_PATH: 2 101 101 101 101, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv6/openbgpd77p/AS1.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv6/openbgpd77p/AS1.txt new file mode 100644 index 00000000..61c455e4 --- /dev/null +++ b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv6/openbgpd77p/AS1.txt @@ -0,0 +1,7 @@ +2a01:1:1::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv6/openbgpd77p/AS101.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv6/openbgpd77p/AS101.txt new file mode 100644 index 00000000..e69de29b diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv6/openbgpd77p/AS2.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv6/openbgpd77p/AS2.txt new file mode 100644 index 00000000..d2dd2ccd --- /dev/null +++ b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv6/openbgpd77p/AS2.txt @@ -0,0 +1,7 @@ +2a01:1:1::/48, AS_PATH: 101 101 101 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv6/openbgpd77p/AS3.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv6/openbgpd77p/AS3.txt new file mode 100644 index 00000000..e69de29b diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv6/openbgpd77p/AS4.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv6/openbgpd77p/AS4.txt new file mode 100644 index 00000000..430ef778 --- /dev/null +++ b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv6/openbgpd77p/AS4.txt @@ -0,0 +1,7 @@ +2a01:1:1::/48, AS_PATH: 2 101 101 101 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv6/openbgpd77p/rs.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv6/openbgpd77p/rs.txt new file mode 100644 index 00000000..a3d81fe6 --- /dev/null +++ b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOff_OpenBGPDIPv6/openbgpd77p/rs.txt @@ -0,0 +1,14 @@ +2a01:1:1::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 0:3, 0:4 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a01:1:1::/48, AS_PATH: 2 101 101 101 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd76p/AS1.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd76p/AS1.txt new file mode 100644 index 00000000..7fe4a1b3 --- /dev/null +++ b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd76p/AS1.txt @@ -0,0 +1,7 @@ +101.0.1.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd76p/AS101.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd76p/AS101.txt new file mode 100644 index 00000000..e69de29b diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd76p/AS2.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd76p/AS2.txt new file mode 100644 index 00000000..e69de29b diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd76p/AS3.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd76p/AS3.txt new file mode 100644 index 00000000..e69de29b diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd76p/AS4.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd76p/AS4.txt new file mode 100644 index 00000000..16373410 --- /dev/null +++ b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd76p/AS4.txt @@ -0,0 +1,7 @@ +101.0.1.0/24, AS_PATH: 2 101 101 101 101, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd76p/rs.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd76p/rs.txt new file mode 100644 index 00000000..1b00af92 --- /dev/null +++ b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd76p/rs.txt @@ -0,0 +1,7 @@ +101.0.1.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: 0:3, 0:4 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd77p/AS1.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd77p/AS1.txt new file mode 100644 index 00000000..7fe4a1b3 --- /dev/null +++ b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd77p/AS1.txt @@ -0,0 +1,7 @@ +101.0.1.0/24, AS_PATH: 101, NEXT_HOP: 192.0.2.101, via 192.0.2.101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd77p/AS101.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd77p/AS101.txt new file mode 100644 index 00000000..e69de29b diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd77p/AS2.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd77p/AS2.txt new file mode 100644 index 00000000..e69de29b diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd77p/AS3.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd77p/AS3.txt new file mode 100644 index 00000000..e69de29b diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd77p/AS4.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd77p/AS4.txt new file mode 100644 index 00000000..16373410 --- /dev/null +++ b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd77p/AS4.txt @@ -0,0 +1,7 @@ +101.0.1.0/24, AS_PATH: 2 101 101 101 101, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd77p/rs.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd77p/rs.txt new file mode 100644 index 00000000..1b00af92 --- /dev/null +++ b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv4/openbgpd77p/rs.txt @@ -0,0 +1,7 @@ +101.0.1.0/24, AS_PATH: 1 101, NEXT_HOP: 192.0.2.11, via 192.0.2.11 + std comms: 0:3, 0:4 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv6/openbgpd77p/AS1.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv6/openbgpd77p/AS1.txt new file mode 100644 index 00000000..61c455e4 --- /dev/null +++ b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv6/openbgpd77p/AS1.txt @@ -0,0 +1,7 @@ +2a01:1:1::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv6/openbgpd77p/AS101.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv6/openbgpd77p/AS101.txt new file mode 100644 index 00000000..e69de29b diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv6/openbgpd77p/AS2.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv6/openbgpd77p/AS2.txt new file mode 100644 index 00000000..e69de29b diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv6/openbgpd77p/AS3.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv6/openbgpd77p/AS3.txt new file mode 100644 index 00000000..e69de29b diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv6/openbgpd77p/AS4.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv6/openbgpd77p/AS4.txt new file mode 100644 index 00000000..430ef778 --- /dev/null +++ b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv6/openbgpd77p/AS4.txt @@ -0,0 +1,7 @@ +2a01:1:1::/48, AS_PATH: 2 101 101 101 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv6/openbgpd77p/rs.txt b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv6/openbgpd77p/rs.txt new file mode 100644 index 00000000..819f293a --- /dev/null +++ b/tests/live_tests/scenarios/path_hiding/routes/PathHidingScenario_MitigationOn_OpenBGPDIPv6/openbgpd77p/rs.txt @@ -0,0 +1,7 @@ +2a01:1:1::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 0:3, 0:4 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenarioOpenBGPD_IPv4/openbgpd68.conf b/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenarioOpenBGPD_IPv4/openbgpd68.conf index 4690e27f..aa468449 100644 --- a/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenarioOpenBGPD_IPv4/openbgpd68.conf +++ b/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenarioOpenBGPD_IPv4/openbgpd68.conf @@ -185,7 +185,7 @@ prefix-set "bogons" { # never via route-servers ASNs as-set "neverviarouteserver" { - 92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338 + 2914, 3491 } # ===================================================================================== diff --git a/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenarioOpenBGPD_IPv4/openbgpd70.conf b/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenarioOpenBGPD_IPv4/openbgpd70.conf index ae22c859..85c3af41 100644 --- a/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenarioOpenBGPD_IPv4/openbgpd70.conf +++ b/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenarioOpenBGPD_IPv4/openbgpd70.conf @@ -189,7 +189,7 @@ prefix-set "bogons" { # never via route-servers ASNs as-set "neverviarouteserver" { - 92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338 + 2914, 3491 } # ===================================================================================== diff --git a/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenarioOpenBGPD_IPv4/openbgpd76p.conf b/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenarioOpenBGPD_IPv4/openbgpd76p.conf new file mode 100644 index 00000000..def3fa0e --- /dev/null +++ b/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenarioOpenBGPD_IPv4/openbgpd76p.conf @@ -0,0 +1,4015 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + +# AS3333, used by client AS3333_1 +as-set "AS_SET_AS3333_asns" { + 3333 +} +prefix-set "AS_SET_AS3333_prefixes" { + 2001:67c:2e8::/48 prefixlen 48 - 128 +} + +# AS10745, used by client AS10745_1, client AS10745_2 +as-set "AS_SET_AS10745_asns" { + 10745 +} +prefix-set "AS_SET_AS10745_prefixes" { + 2001:500:4::/48 prefixlen 48 - 128 +} + +# AS-RIPENCC, used by client AS3333_1 +# no origin ASNs found for AS_RIPENCC +# no prefixes found for AS_RIPENCC + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + # RTT: 224 ms (normalized value: 224) + neighbor 192.0.2.22 { + remote-as 10745 + + rde evaluate all + + passive + ttl-security yes + max-prefix 121 restart 30 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + # RTT: 226 ms (normalized value: 226) + neighbor 2001:db8:1:1::22 { + remote-as 10745 + + rde evaluate all + + passive + ttl-security yes + max-prefix 13915 restart 30 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } + + # RTT: 114 ms (normalized value: 114) + neighbor 192.0.2.11 { + remote-as 3333 + + rde evaluate all + + passive + ttl-security yes + max-prefix 150 restart 30 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + +prefix-set "global_black_list_pref" { + 192.0.2.0/24 prefixlen 24 - 32 + 2001:db8:1:1::/64 prefixlen 64 - 128 + +} + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + +# never via route-servers ASNs +as-set "neverviarouteserver" { + 2914, 3491 +} + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# origin_not_present_in_as_set +match from group clients set community delete 65530:0 +match from group clients set large-community delete 999:65530:0 + +# origin_present_in_as_set +match from group clients set community delete 65530:1 +match from group clients set large-community delete 999:65530:1 + +# prefix_validated_via_arin_whois_db_dump +match from group clients set community delete 65530:4 +match from group clients set large-community delete 999:65530:4 + +# prefix_validated_via_rpki_roas +match from group clients set community delete 65530:2 +match from group clients set large-community delete 999:65530:2 + +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + +# route_validated_via_white_list +match from group clients set community delete 65530:3 +match from group clients set large-community delete 999:65530:3 + +# from_europe +match from group clients set community delete 65534:1 +match from group clients set ext-community delete rt 65534:1 +match from group clients set large-community delete 999:65534:1 + +# from_usa +match from group clients set community delete 65534:2 +match from group clients set ext-community delete rt 65534:2 +match from group clients set large-community delete 999:65534:2 + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + +# --------------------------------------------------------- +# ROAs source + + +roa-set { + 193.0.0.0/21 source-as 3333 + 193.0.24.0/22 maxlen 26 source-as 3333 + 193.0.10.0/23 source-as 3333 + 193.0.12.0/23 source-as 3333 + 193.0.14.0/23 source-as 25152 + 193.0.18.0/23 source-as 3333 + 193.0.20.0/23 source-as 3333 + 193.0.22.0/23 source-as 3333 + 193.0.14.0/24 source-as 25152 + 193.0.24.0/24 source-as 3333 + 2001:7fd::/32 source-as 25152 + 2001:610:240::/42 source-as 3333 + 2001:67c:2e8::/48 source-as 3333 + 2001:7fd::/48 source-as 25152 + +} + + + +# --------------------------------------------------------- +# RPKI-based Origin Validation + + +# Add $INTCOMM_RPKI_UNKNOWN, $INTCOMM_RPKI_INVALID and $INTCOMM_RPKI_VALID +# ext community on the basis of ovs. +match from group clients ovs not-found set { + ext-community $INTCOMM_RPKI_UNKNOWN + ext-community ovs not-found + +} +match from group clients ovs valid set { + ext-community $INTCOMM_RPKI_VALID + ext-community ovs valid + +} +match from group clients ovs invalid set { + ext-community $INTCOMM_RPKI_INVALID + ext-community ovs invalid + +} + + + +# --------------------------------------------------------- +# RPKI ROAs used as route objects. + +# Add the $INTCOMM_PREF_OK_ROA ext community to routes whose +# origin ASN has a ROA for the announced prefix. +# It will be used later during IRRDB validation in +# case the origin ASN is authorized by a client's +# AS-SET but the prefix is not. + +# Since RPKI-based Origin Validation is already performed above, +# use the origin validation state to identify valid routes. +match from group clients ovs valid set ext-community $INTCOMM_PREF_OK_ROA + + +# ARIN Whois records used for preifx validation +# --------------------------------------------- + +# Add the $INTCOMM_PREF_OK_ARINDB ext community to routes whose +# origin ASN has an ARIN Whois record for the announced prefix. +# It will be used later during IRRDB validation in +# case the origin ASN is authorized by a client's +# AS-SET but the prefix is not. +origin-set "ARINDB" { +192.136.136.0/24 prefixlen 24 - 32 source-as 10745 +192.149.252.0/24 prefixlen 24 - 32 source-as 10745 +199.43.0.0/24 prefixlen 24 - 32 source-as 10745 +2001:500:110::/48 prefixlen 48 - 128 source-as 10745 +2001:500:4::/48 prefixlen 48 - 128 source-as 10745 +} +match from group clients origin-set ARINDB set ext-community $INTCOMM_PREF_OK_ARINDB + + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.22 set ext-community rt 65520:10745 + +match from 2001:db8:1:1::22 set ext-community rt 65520:10745 + +match from 192.0.2.11 set ext-community rt 65520:3333 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +allow quick from group clients max-as-len 32 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: global blacklist +# Reject inbound routes when 'from group clients prefix-set global_black_list_pref' - reject code: 3 +allow quick from group clients prefix-set global_black_list_pref set { + localpref 1 + community 65520:0 + community 65520:3 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS10745_1, inbound + + +# Attach custom BGP communities +# from_usa +match from 192.0.2.22 set community 65534:2 +match from 192.0.2.22 set ext-community rt 65534:2 +match from 192.0.2.22 set large-community 999:65534:2 + +# NEXT_HOP +match from 192.0.2.22 set community NO_ADVERTISE +match from 192.0.2.22 nexthop 192.0.2.22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.22 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.22 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.22 peer-as != 10745' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.22 peer-as != 10745 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.22 AS 23456' - reject code: 7 +allow quick from 192.0.2.22 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.22 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.22 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.22 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.22 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.22 AS { 174, 701, 1299, 2914, 3257, 3320, 3356, 5511, 6453, 6461, 6762, 6830, 7018, 12956 }' - reject code: 8 +allow quick from 192.0.2.22 AS { 174, 701, 1299, 2914, 3257, 3320, 3356, 5511, 6453, 6461, 6762, 6830, 7018, 12956 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.22 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.22 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +match from 192.0.2.22 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS10745_1, AS10745: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.22 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.22 source-as as-set AS_SET_AS10745_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS10745 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.22 ext-community $INTCOMM_ORIGIN_KO set community 65530:0 +match from 192.0.2.22 ext-community $INTCOMM_ORIGIN_KO set large-community 999:65530:0 +# adding present_in_as_set community to authorized routes +match from 192.0.2.22 ext-community $INTCOMM_ORIGIN_OK set community 65530:1 +match from 192.0.2.22 ext-community $INTCOMM_ORIGIN_OK set large-community 999:65530:1 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS10745_1, AS10745: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.22 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.22 prefix-set AS_SET_AS10745_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS10745 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.22 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 65530:2 +match from 192.0.2.22 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:65530:2 + +match from 192.0.2.22 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.22 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 65530:4 +match from 192.0.2.22 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:65530:4 + +match from 192.0.2.22 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 192.0.2.22 set ext-community delete rt 65520:10745 + + +# Remove internal communities before accepting the route +match from 192.0.2.22 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.22 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.22 large-community 999:666:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +allow quick from 192.0.2.22 community BLACKHOLE +allow quick from 192.0.2.22 community 65534:0 +allow quick from 192.0.2.22 large-community 999:666:0 + + +match from 192.0.2.22 set ext-community rt 65520:10745 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.22 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.22 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.22 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.22 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.22 community GRACEFUL_SHUTDOWN set localpref 0 + +# Remove internal communities before accepting the route +match from 192.0.2.22 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.22 set ext-community delete rt 65520:10745 + + + +allow quick from 192.0.2.22 + + + +# --------------------------------------------- +# client AS10745_1, outbound + +deny quick to 192.0.2.22 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 192.0.2.22 community 65534:0 set community BLACKHOLE +match to 192.0.2.22 large-community 999:666:0 set community BLACKHOLE + +match to 192.0.2.22 community BLACKHOLE set community NO_EXPORT +match to 192.0.2.22 community BLACKHOLE set nexthop 192.0.2.66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.22 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.22 community 65507:999 set community NO_EXPORT +match to 192.0.2.22 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.22 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.22 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.22 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.22 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.22 community 65509:10745 set community NO_EXPORT +match to 192.0.2.22 ext-community rt 65509:10745 set community NO_EXPORT +match to 192.0.2.22 large-community 999:65509:10745 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.22 community 65510:10745 set community NO_ADVERTISE +match to 192.0.2.22 ext-community rt 65510:10745 set community NO_ADVERTISE +match to 192.0.2.22 large-community 999:65510:10745 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.22 + +# do_not_announce_to_any +deny to 192.0.2.22 community 0:999 +deny to 192.0.2.22 ext-community rt 0:999 +deny to 192.0.2.22 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.22 community 0:10745 +deny quick to 192.0.2.22 ext-community rt 0:10745 +deny quick to 192.0.2.22 large-community 999:0:10745 + +# do_not_announce_to_peers_with_rtt_lower_than 500 ms +deny to 192.0.2.22 community 64511:500 +deny to 192.0.2.22 ext-community rt 64511:500 +deny to 192.0.2.22 large-community 999:64511:500 + + +# announce_to_peers_with_rtt_lower_than 500 ms +allow to 192.0.2.22 community 64513:500 +allow to 192.0.2.22 ext-community rt 64513:500 +allow to 192.0.2.22 large-community 999:64513:500 + + +# do_not_announce_to_peers_with_rtt_higher_than 5 ms +deny to 192.0.2.22 community 64512:5 +deny to 192.0.2.22 ext-community rt 64512:5 +deny to 192.0.2.22 large-community 999:64512:5 + + +# do_not_announce_to_peers_with_rtt_higher_than 10 ms +deny to 192.0.2.22 community 64512:10 +deny to 192.0.2.22 ext-community rt 64512:10 +deny to 192.0.2.22 large-community 999:64512:10 + + +# do_not_announce_to_peers_with_rtt_higher_than 15 ms +deny to 192.0.2.22 community 64512:15 +deny to 192.0.2.22 ext-community rt 64512:15 +deny to 192.0.2.22 large-community 999:64512:15 + + +# do_not_announce_to_peers_with_rtt_higher_than 20 ms +deny to 192.0.2.22 community 64512:20 +deny to 192.0.2.22 ext-community rt 64512:20 +deny to 192.0.2.22 large-community 999:64512:20 + + +# do_not_announce_to_peers_with_rtt_higher_than 30 ms +deny to 192.0.2.22 community 64512:30 +deny to 192.0.2.22 ext-community rt 64512:30 +deny to 192.0.2.22 large-community 999:64512:30 + + +# do_not_announce_to_peers_with_rtt_higher_than 50 ms +deny to 192.0.2.22 community 64512:50 +deny to 192.0.2.22 ext-community rt 64512:50 +deny to 192.0.2.22 large-community 999:64512:50 + + +# do_not_announce_to_peers_with_rtt_higher_than 100 ms +deny to 192.0.2.22 community 64512:100 +deny to 192.0.2.22 ext-community rt 64512:100 +deny to 192.0.2.22 large-community 999:64512:100 + + +# do_not_announce_to_peers_with_rtt_higher_than 200 ms +deny to 192.0.2.22 community 64512:200 +deny to 192.0.2.22 ext-community rt 64512:200 +deny to 192.0.2.22 large-community 999:64512:200 + + +# announce_to_peers_with_rtt_higher_than 5 ms +allow to 192.0.2.22 community 64514:5 +allow to 192.0.2.22 ext-community rt 64514:5 +allow to 192.0.2.22 large-community 999:64514:5 + + +# announce_to_peers_with_rtt_higher_than 10 ms +allow to 192.0.2.22 community 64514:10 +allow to 192.0.2.22 ext-community rt 64514:10 +allow to 192.0.2.22 large-community 999:64514:10 + + +# announce_to_peers_with_rtt_higher_than 15 ms +allow to 192.0.2.22 community 64514:15 +allow to 192.0.2.22 ext-community rt 64514:15 +allow to 192.0.2.22 large-community 999:64514:15 + + +# announce_to_peers_with_rtt_higher_than 20 ms +allow to 192.0.2.22 community 64514:20 +allow to 192.0.2.22 ext-community rt 64514:20 +allow to 192.0.2.22 large-community 999:64514:20 + + +# announce_to_peers_with_rtt_higher_than 30 ms +allow to 192.0.2.22 community 64514:30 +allow to 192.0.2.22 ext-community rt 64514:30 +allow to 192.0.2.22 large-community 999:64514:30 + + +# announce_to_peers_with_rtt_higher_than 50 ms +allow to 192.0.2.22 community 64514:50 +allow to 192.0.2.22 ext-community rt 64514:50 +allow to 192.0.2.22 large-community 999:64514:50 + + +# announce_to_peers_with_rtt_higher_than 100 ms +allow to 192.0.2.22 community 64514:100 +allow to 192.0.2.22 ext-community rt 64514:100 +allow to 192.0.2.22 large-community 999:64514:100 + + +# announce_to_peers_with_rtt_higher_than 200 ms +allow to 192.0.2.22 community 64514:200 +allow to 192.0.2.22 ext-community rt 64514:200 +allow to 192.0.2.22 large-community 999:64514:200 + + +# announce_to_peer +allow to 192.0.2.22 community 999:10745 +allow to 192.0.2.22 ext-community rt 999:10745 +allow to 192.0.2.22 large-community 999:999:10745 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.22 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS10745; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65504:10745 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65504:10745 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65504:10745 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS10745; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65505:10745 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65505:10745 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65505:10745 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS10745; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65506:10745 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65506:10745 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65506:10745 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64515:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64515:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64515:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64516:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64516:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64516:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64517:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64517:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64517:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65501:999 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65501:999 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65501:999 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65502:999 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65502:999 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65502:999 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65503:999 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65503:999 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65503:999 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS10745_2, inbound + + +# Attach custom BGP communities +# from_usa +match from 2001:db8:1:1::22 set community 65534:2 +match from 2001:db8:1:1::22 set ext-community rt 65534:2 +match from 2001:db8:1:1::22 set large-community 999:65534:2 + +# NEXT_HOP +match from 2001:db8:1:1::22 set community NO_ADVERTISE +match from 2001:db8:1:1::22 nexthop 2001:db8:1:1::22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::22 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::22 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::22 peer-as != 10745' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::22 peer-as != 10745 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::22 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::22 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::22 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::22 AS { 174, 701, 1299, 2914, 3257, 3320, 3356, 5511, 6453, 6461, 6762, 6830, 7018, 12956 }' - reject code: 8 +allow quick from 2001:db8:1:1::22 AS { 174, 701, 1299, 2914, 3257, 3320, 3356, 5511, 6453, 6461, 6762, 6830, 7018, 12956 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::22 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::22 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +match from 2001:db8:1:1::22 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS10745_2, AS10745: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::22 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::22 source-as as-set AS_SET_AS10745_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS10745 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::22 ext-community $INTCOMM_ORIGIN_KO set community 65530:0 +match from 2001:db8:1:1::22 ext-community $INTCOMM_ORIGIN_KO set large-community 999:65530:0 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::22 ext-community $INTCOMM_ORIGIN_OK set community 65530:1 +match from 2001:db8:1:1::22 ext-community $INTCOMM_ORIGIN_OK set large-community 999:65530:1 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS10745_2, AS10745: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::22 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::22 prefix-set AS_SET_AS10745_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS10745 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::22 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 65530:2 +match from 2001:db8:1:1::22 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:65530:2 + +match from 2001:db8:1:1::22 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::22 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 65530:4 +match from 2001:db8:1:1::22 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:65530:4 + +match from 2001:db8:1:1::22 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 2001:db8:1:1::22 set ext-community delete rt 65520:10745 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::22 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::22 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::22 large-community 999:666:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +allow quick from 2001:db8:1:1::22 community BLACKHOLE +allow quick from 2001:db8:1:1::22 community 65534:0 +allow quick from 2001:db8:1:1::22 large-community 999:666:0 + + +match from 2001:db8:1:1::22 set ext-community rt 65520:10745 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::22 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::22 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::22 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::22 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::22 community GRACEFUL_SHUTDOWN set localpref 0 + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::22 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::22 set ext-community delete rt 65520:10745 + + + +allow quick from 2001:db8:1:1::22 + + + +# --------------------------------------------- +# client AS10745_2, outbound + +deny quick to 2001:db8:1:1::22 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 2001:db8:1:1::22 community 65534:0 set community BLACKHOLE +match to 2001:db8:1:1::22 large-community 999:666:0 set community BLACKHOLE + +match to 2001:db8:1:1::22 community BLACKHOLE set community NO_EXPORT +match to 2001:db8:1:1::22 community BLACKHOLE set nexthop 2001:db8:1:1::66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::22 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::22 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::22 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::22 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::22 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::22 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::22 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::22 community 65509:10745 set community NO_EXPORT +match to 2001:db8:1:1::22 ext-community rt 65509:10745 set community NO_EXPORT +match to 2001:db8:1:1::22 large-community 999:65509:10745 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::22 community 65510:10745 set community NO_ADVERTISE +match to 2001:db8:1:1::22 ext-community rt 65510:10745 set community NO_ADVERTISE +match to 2001:db8:1:1::22 large-community 999:65510:10745 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::22 + +# do_not_announce_to_any +deny to 2001:db8:1:1::22 community 0:999 +deny to 2001:db8:1:1::22 ext-community rt 0:999 +deny to 2001:db8:1:1::22 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::22 community 0:10745 +deny quick to 2001:db8:1:1::22 ext-community rt 0:10745 +deny quick to 2001:db8:1:1::22 large-community 999:0:10745 + +# do_not_announce_to_peers_with_rtt_lower_than 500 ms +deny to 2001:db8:1:1::22 community 64511:500 +deny to 2001:db8:1:1::22 ext-community rt 64511:500 +deny to 2001:db8:1:1::22 large-community 999:64511:500 + + +# announce_to_peers_with_rtt_lower_than 500 ms +allow to 2001:db8:1:1::22 community 64513:500 +allow to 2001:db8:1:1::22 ext-community rt 64513:500 +allow to 2001:db8:1:1::22 large-community 999:64513:500 + + +# do_not_announce_to_peers_with_rtt_higher_than 5 ms +deny to 2001:db8:1:1::22 community 64512:5 +deny to 2001:db8:1:1::22 ext-community rt 64512:5 +deny to 2001:db8:1:1::22 large-community 999:64512:5 + + +# do_not_announce_to_peers_with_rtt_higher_than 10 ms +deny to 2001:db8:1:1::22 community 64512:10 +deny to 2001:db8:1:1::22 ext-community rt 64512:10 +deny to 2001:db8:1:1::22 large-community 999:64512:10 + + +# do_not_announce_to_peers_with_rtt_higher_than 15 ms +deny to 2001:db8:1:1::22 community 64512:15 +deny to 2001:db8:1:1::22 ext-community rt 64512:15 +deny to 2001:db8:1:1::22 large-community 999:64512:15 + + +# do_not_announce_to_peers_with_rtt_higher_than 20 ms +deny to 2001:db8:1:1::22 community 64512:20 +deny to 2001:db8:1:1::22 ext-community rt 64512:20 +deny to 2001:db8:1:1::22 large-community 999:64512:20 + + +# do_not_announce_to_peers_with_rtt_higher_than 30 ms +deny to 2001:db8:1:1::22 community 64512:30 +deny to 2001:db8:1:1::22 ext-community rt 64512:30 +deny to 2001:db8:1:1::22 large-community 999:64512:30 + + +# do_not_announce_to_peers_with_rtt_higher_than 50 ms +deny to 2001:db8:1:1::22 community 64512:50 +deny to 2001:db8:1:1::22 ext-community rt 64512:50 +deny to 2001:db8:1:1::22 large-community 999:64512:50 + + +# do_not_announce_to_peers_with_rtt_higher_than 100 ms +deny to 2001:db8:1:1::22 community 64512:100 +deny to 2001:db8:1:1::22 ext-community rt 64512:100 +deny to 2001:db8:1:1::22 large-community 999:64512:100 + + +# do_not_announce_to_peers_with_rtt_higher_than 200 ms +deny to 2001:db8:1:1::22 community 64512:200 +deny to 2001:db8:1:1::22 ext-community rt 64512:200 +deny to 2001:db8:1:1::22 large-community 999:64512:200 + + +# announce_to_peers_with_rtt_higher_than 5 ms +allow to 2001:db8:1:1::22 community 64514:5 +allow to 2001:db8:1:1::22 ext-community rt 64514:5 +allow to 2001:db8:1:1::22 large-community 999:64514:5 + + +# announce_to_peers_with_rtt_higher_than 10 ms +allow to 2001:db8:1:1::22 community 64514:10 +allow to 2001:db8:1:1::22 ext-community rt 64514:10 +allow to 2001:db8:1:1::22 large-community 999:64514:10 + + +# announce_to_peers_with_rtt_higher_than 15 ms +allow to 2001:db8:1:1::22 community 64514:15 +allow to 2001:db8:1:1::22 ext-community rt 64514:15 +allow to 2001:db8:1:1::22 large-community 999:64514:15 + + +# announce_to_peers_with_rtt_higher_than 20 ms +allow to 2001:db8:1:1::22 community 64514:20 +allow to 2001:db8:1:1::22 ext-community rt 64514:20 +allow to 2001:db8:1:1::22 large-community 999:64514:20 + + +# announce_to_peers_with_rtt_higher_than 30 ms +allow to 2001:db8:1:1::22 community 64514:30 +allow to 2001:db8:1:1::22 ext-community rt 64514:30 +allow to 2001:db8:1:1::22 large-community 999:64514:30 + + +# announce_to_peers_with_rtt_higher_than 50 ms +allow to 2001:db8:1:1::22 community 64514:50 +allow to 2001:db8:1:1::22 ext-community rt 64514:50 +allow to 2001:db8:1:1::22 large-community 999:64514:50 + + +# announce_to_peers_with_rtt_higher_than 100 ms +allow to 2001:db8:1:1::22 community 64514:100 +allow to 2001:db8:1:1::22 ext-community rt 64514:100 +allow to 2001:db8:1:1::22 large-community 999:64514:100 + + +# announce_to_peers_with_rtt_higher_than 200 ms +allow to 2001:db8:1:1::22 community 64514:200 +allow to 2001:db8:1:1::22 ext-community rt 64514:200 +allow to 2001:db8:1:1::22 large-community 999:64514:200 + + +# announce_to_peer +allow to 2001:db8:1:1::22 community 999:10745 +allow to 2001:db8:1:1::22 ext-community rt 999:10745 +allow to 2001:db8:1:1::22 large-community 999:999:10745 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::22 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS10745; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65504:10745 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65504:10745 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65504:10745 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS10745; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65505:10745 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65505:10745 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65505:10745 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS10745; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65506:10745 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65506:10745 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65506:10745 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64515:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64515:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64515:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64516:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64516:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64516:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64517:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64517:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64517:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65501:999 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65501:999 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65501:999 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65502:999 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65502:999 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65502:999 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65503:999 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65503:999 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65503:999 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS3333_1, inbound + + +# Attach custom BGP communities +# from_europe +match from 192.0.2.11 set community 65534:1 +match from 192.0.2.11 set ext-community rt 65534:1 +match from 192.0.2.11 set large-community 999:65534:1 + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 3333' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 3333 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.11 AS { 174, 701, 1299, 2914, 3257, 3320, 3356, 5511, 6453, 6461, 6762, 6830, 7018, 12956 }' - reject code: 8 +allow quick from 192.0.2.11 AS { 174, 701, 1299, 2914, 3257, 3320, 3356, 5511, 6453, 6461, 6762, 6830, 7018, 12956 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.11 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.11 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +match from 192.0.2.11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS3333_1, AS3333: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.11 source-as as-set AS_SET_AS3333_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS3333 +# AS-SET AS_RIPENCC referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_KO set community 65530:0 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_KO set large-community 999:65530:0 +# adding present_in_as_set community to authorized routes +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK set community 65530:1 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK set large-community 999:65530:1 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS3333_1, AS3333: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.11 prefix-set AS_SET_AS3333_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS3333 +# AS-SET AS_RIPENCC referenced but empty. + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 65530:2 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:65530:2 + +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 65530:4 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:65530:4 + +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 192.0.2.11 set ext-community delete rt 65520:3333 + + +# Remove internal communities before accepting the route +match from 192.0.2.11 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.11 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.11 large-community 999:666:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +allow quick from 192.0.2.11 community BLACKHOLE +allow quick from 192.0.2.11 community 65534:0 +allow quick from 192.0.2.11 large-community 999:666:0 + + +match from 192.0.2.11 set ext-community rt 65520:3333 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.11 community GRACEFUL_SHUTDOWN set localpref 0 + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:3333 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS3333_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 192.0.2.11 community 65534:0 set community BLACKHOLE +match to 192.0.2.11 large-community 999:666:0 set community BLACKHOLE + +match to 192.0.2.11 community BLACKHOLE set community NO_EXPORT +match to 192.0.2.11 community BLACKHOLE set nexthop 192.0.2.66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.11 community 65507:999 set community NO_EXPORT +match to 192.0.2.11 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.11 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.11 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.11 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.11 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.11 community 65509:3333 set community NO_EXPORT +match to 192.0.2.11 ext-community rt 65509:3333 set community NO_EXPORT +match to 192.0.2.11 large-community 999:65509:3333 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.11 community 65510:3333 set community NO_ADVERTISE +match to 192.0.2.11 ext-community rt 65510:3333 set community NO_ADVERTISE +match to 192.0.2.11 large-community 999:65510:3333 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.11 + +# do_not_announce_to_any +deny to 192.0.2.11 community 0:999 +deny to 192.0.2.11 ext-community rt 0:999 +deny to 192.0.2.11 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.11 community 0:3333 +deny quick to 192.0.2.11 ext-community rt 0:3333 +deny quick to 192.0.2.11 large-community 999:0:3333 + +# do_not_announce_to_peers_with_rtt_lower_than 200 ms +deny to 192.0.2.11 community 64511:200 +deny to 192.0.2.11 ext-community rt 64511:200 +deny to 192.0.2.11 large-community 999:64511:200 + + +# do_not_announce_to_peers_with_rtt_lower_than 500 ms +deny to 192.0.2.11 community 64511:500 +deny to 192.0.2.11 ext-community rt 64511:500 +deny to 192.0.2.11 large-community 999:64511:500 + + +# announce_to_peers_with_rtt_lower_than 200 ms +allow to 192.0.2.11 community 64513:200 +allow to 192.0.2.11 ext-community rt 64513:200 +allow to 192.0.2.11 large-community 999:64513:200 + + +# announce_to_peers_with_rtt_lower_than 500 ms +allow to 192.0.2.11 community 64513:500 +allow to 192.0.2.11 ext-community rt 64513:500 +allow to 192.0.2.11 large-community 999:64513:500 + + +# do_not_announce_to_peers_with_rtt_higher_than 5 ms +deny to 192.0.2.11 community 64512:5 +deny to 192.0.2.11 ext-community rt 64512:5 +deny to 192.0.2.11 large-community 999:64512:5 + + +# do_not_announce_to_peers_with_rtt_higher_than 10 ms +deny to 192.0.2.11 community 64512:10 +deny to 192.0.2.11 ext-community rt 64512:10 +deny to 192.0.2.11 large-community 999:64512:10 + + +# do_not_announce_to_peers_with_rtt_higher_than 15 ms +deny to 192.0.2.11 community 64512:15 +deny to 192.0.2.11 ext-community rt 64512:15 +deny to 192.0.2.11 large-community 999:64512:15 + + +# do_not_announce_to_peers_with_rtt_higher_than 20 ms +deny to 192.0.2.11 community 64512:20 +deny to 192.0.2.11 ext-community rt 64512:20 +deny to 192.0.2.11 large-community 999:64512:20 + + +# do_not_announce_to_peers_with_rtt_higher_than 30 ms +deny to 192.0.2.11 community 64512:30 +deny to 192.0.2.11 ext-community rt 64512:30 +deny to 192.0.2.11 large-community 999:64512:30 + + +# do_not_announce_to_peers_with_rtt_higher_than 50 ms +deny to 192.0.2.11 community 64512:50 +deny to 192.0.2.11 ext-community rt 64512:50 +deny to 192.0.2.11 large-community 999:64512:50 + + +# do_not_announce_to_peers_with_rtt_higher_than 100 ms +deny to 192.0.2.11 community 64512:100 +deny to 192.0.2.11 ext-community rt 64512:100 +deny to 192.0.2.11 large-community 999:64512:100 + + +# announce_to_peers_with_rtt_higher_than 5 ms +allow to 192.0.2.11 community 64514:5 +allow to 192.0.2.11 ext-community rt 64514:5 +allow to 192.0.2.11 large-community 999:64514:5 + + +# announce_to_peers_with_rtt_higher_than 10 ms +allow to 192.0.2.11 community 64514:10 +allow to 192.0.2.11 ext-community rt 64514:10 +allow to 192.0.2.11 large-community 999:64514:10 + + +# announce_to_peers_with_rtt_higher_than 15 ms +allow to 192.0.2.11 community 64514:15 +allow to 192.0.2.11 ext-community rt 64514:15 +allow to 192.0.2.11 large-community 999:64514:15 + + +# announce_to_peers_with_rtt_higher_than 20 ms +allow to 192.0.2.11 community 64514:20 +allow to 192.0.2.11 ext-community rt 64514:20 +allow to 192.0.2.11 large-community 999:64514:20 + + +# announce_to_peers_with_rtt_higher_than 30 ms +allow to 192.0.2.11 community 64514:30 +allow to 192.0.2.11 ext-community rt 64514:30 +allow to 192.0.2.11 large-community 999:64514:30 + + +# announce_to_peers_with_rtt_higher_than 50 ms +allow to 192.0.2.11 community 64514:50 +allow to 192.0.2.11 ext-community rt 64514:50 +allow to 192.0.2.11 large-community 999:64514:50 + + +# announce_to_peers_with_rtt_higher_than 100 ms +allow to 192.0.2.11 community 64514:100 +allow to 192.0.2.11 ext-community rt 64514:100 +allow to 192.0.2.11 large-community 999:64514:100 + + +# announce_to_peer +allow to 192.0.2.11 community 999:3333 +allow to 192.0.2.11 ext-community rt 999:3333 +allow to 192.0.2.11 large-community 999:999:3333 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS3333; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65504:3333 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65504:3333 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65504:3333 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS3333; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65505:3333 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65505:3333 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65505:3333 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS3333; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65506:3333 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65506:3333 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65506:3333 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64515:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64515:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64515:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64516:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64516:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64516:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64517:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64517:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64517:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64515:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64515:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64515:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64516:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64516:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64516:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64517:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64517:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64517:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65501:999 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65501:999 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65501:999 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65502:999 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65502:999 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65502:999 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65503:999 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65503:999 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65503:999 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + + + +# Scrub communities from outbound routes +# add_noadvertise_to_any +match to group clients set community delete 65508:999 +match to group clients set ext-community delete rt 65508:999 +match to group clients set large-community delete 999:65508:999 + +# add_noadvertise_to_peer +match to group clients set community delete 65510:* +match to group clients set ext-community delete rt 65510:* +match to group clients set large-community delete 999:65510:* + +# add_noexport_to_any +match to group clients set community delete 65507:999 +match to group clients set ext-community delete rt 65507:999 +match to group clients set large-community delete 999:65507:999 + +# add_noexport_to_peer +match to group clients set community delete 65509:* +match to group clients set ext-community delete rt 65509:* +match to group clients set large-community delete 999:65509:* + +# announce_to_peer +match to group clients set community delete 999:* +match to group clients set ext-community delete rt 999:* +match to group clients set large-community delete 999:999:* + +# announce_to_peers_with_rtt_higher_than +match to group clients set community delete 64514:* +match to group clients set ext-community delete rt 64514:* +match to group clients set large-community delete 999:64514:* + +# announce_to_peers_with_rtt_lower_than +match to group clients set community delete 64513:* +match to group clients set ext-community delete rt 64513:* +match to group clients set large-community delete 999:64513:* + +# blackholing +match to group clients set community delete 65534:0 +match to group clients set large-community delete 999:666:0 + +# do_not_announce_to_any +match to group clients set community delete 0:999 +match to group clients set ext-community delete rt 0:999 +match to group clients set large-community delete 999:0:999 + +# do_not_announce_to_peer +match to group clients set community delete 0:* +match to group clients set ext-community delete rt 0:* +match to group clients set large-community delete 999:0:* + +# do_not_announce_to_peers_with_rtt_higher_than +match to group clients set community delete 64512:* +match to group clients set ext-community delete rt 64512:* +match to group clients set large-community delete 999:64512:* + +# do_not_announce_to_peers_with_rtt_lower_than +match to group clients set community delete 64511:* +match to group clients set ext-community delete rt 64511:* +match to group clients set large-community delete 999:64511:* + +# prepend_once_to_any +match to group clients set community delete 65501:999 +match to group clients set ext-community delete rt 65501:999 +match to group clients set large-community delete 999:65501:999 + +# prepend_once_to_peer +match to group clients set community delete 65504:* +match to group clients set ext-community delete rt 65504:* +match to group clients set large-community delete 999:65504:* + +# prepend_once_to_peers_with_rtt_higher_than +match to group clients set community delete 64518:* +match to group clients set ext-community delete rt 64518:* +match to group clients set large-community delete 999:64518:* + +# prepend_once_to_peers_with_rtt_lower_than +match to group clients set community delete 64515:* +match to group clients set ext-community delete rt 64515:* +match to group clients set large-community delete 999:64515:* + +# prepend_thrice_to_any +match to group clients set community delete 65503:999 +match to group clients set ext-community delete rt 65503:999 +match to group clients set large-community delete 999:65503:999 + +# prepend_thrice_to_peer +match to group clients set community delete 65506:* +match to group clients set ext-community delete rt 65506:* +match to group clients set large-community delete 999:65506:* + +# prepend_thrice_to_peers_with_rtt_higher_than +match to group clients set community delete 64520:* +match to group clients set ext-community delete rt 64520:* +match to group clients set large-community delete 999:64520:* + +# prepend_thrice_to_peers_with_rtt_lower_than +match to group clients set community delete 64517:* +match to group clients set ext-community delete rt 64517:* +match to group clients set large-community delete 999:64517:* + +# prepend_twice_to_any +match to group clients set community delete 65502:999 +match to group clients set ext-community delete rt 65502:999 +match to group clients set large-community delete 999:65502:999 + +# prepend_twice_to_peer +match to group clients set community delete 65505:* +match to group clients set ext-community delete rt 65505:* +match to group clients set large-community delete 999:65505:* + +# prepend_twice_to_peers_with_rtt_higher_than +match to group clients set community delete 64519:* +match to group clients set ext-community delete rt 64519:* +match to group clients set large-community delete 999:64519:* + +# prepend_twice_to_peers_with_rtt_lower_than +match to group clients set community delete 64516:* +match to group clients set ext-community delete rt 64516:* +match to group clients set large-community delete 999:64516:* + +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities +match to group clients set { + community delete 65501:999 + ext-community delete rt 65501:999 + large-community delete 999:65501:999 + +} +match to group clients set { + community delete 65504:* + ext-community delete rt 65504:* + large-community delete 999:65504:* + +} +match to group clients set { + community delete 64518:* + ext-community delete rt 64518:* + large-community delete 999:64518:* + +} +match to group clients set { + community delete 64515:* + ext-community delete rt 64515:* + large-community delete 999:64515:* + +} +match to group clients set { + community delete 65503:999 + ext-community delete rt 65503:999 + large-community delete 999:65503:999 + +} +match to group clients set { + community delete 65506:* + ext-community delete rt 65506:* + large-community delete 999:65506:* + +} +match to group clients set { + community delete 64520:* + ext-community delete rt 64520:* + large-community delete 999:64520:* + +} +match to group clients set { + community delete 64517:* + ext-community delete rt 64517:* + large-community delete 999:64517:* + +} +match to group clients set { + community delete 65502:999 + ext-community delete rt 65502:999 + large-community delete 999:65502:999 + +} +match to group clients set { + community delete 65505:* + ext-community delete rt 65505:* + large-community delete 999:65505:* + +} +match to group clients set { + community delete 64519:* + ext-community delete rt 64519:* + large-community delete 999:64519:* + +} +match to group clients set { + community delete 64516:* + ext-community delete rt 64516:* + large-community delete 999:64516:* + +} + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenarioOpenBGPD_IPv4/openbgpd77p.conf b/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenarioOpenBGPD_IPv4/openbgpd77p.conf new file mode 100644 index 00000000..def3fa0e --- /dev/null +++ b/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenarioOpenBGPD_IPv4/openbgpd77p.conf @@ -0,0 +1,4015 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + +# AS3333, used by client AS3333_1 +as-set "AS_SET_AS3333_asns" { + 3333 +} +prefix-set "AS_SET_AS3333_prefixes" { + 2001:67c:2e8::/48 prefixlen 48 - 128 +} + +# AS10745, used by client AS10745_1, client AS10745_2 +as-set "AS_SET_AS10745_asns" { + 10745 +} +prefix-set "AS_SET_AS10745_prefixes" { + 2001:500:4::/48 prefixlen 48 - 128 +} + +# AS-RIPENCC, used by client AS3333_1 +# no origin ASNs found for AS_RIPENCC +# no prefixes found for AS_RIPENCC + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + # RTT: 224 ms (normalized value: 224) + neighbor 192.0.2.22 { + remote-as 10745 + + rde evaluate all + + passive + ttl-security yes + max-prefix 121 restart 30 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + # RTT: 226 ms (normalized value: 226) + neighbor 2001:db8:1:1::22 { + remote-as 10745 + + rde evaluate all + + passive + ttl-security yes + max-prefix 13915 restart 30 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } + + # RTT: 114 ms (normalized value: 114) + neighbor 192.0.2.11 { + remote-as 3333 + + rde evaluate all + + passive + ttl-security yes + max-prefix 150 restart 30 + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + +prefix-set "global_black_list_pref" { + 192.0.2.0/24 prefixlen 24 - 32 + 2001:db8:1:1::/64 prefixlen 64 - 128 + +} + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + +# never via route-servers ASNs +as-set "neverviarouteserver" { + 2914, 3491 +} + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# origin_not_present_in_as_set +match from group clients set community delete 65530:0 +match from group clients set large-community delete 999:65530:0 + +# origin_present_in_as_set +match from group clients set community delete 65530:1 +match from group clients set large-community delete 999:65530:1 + +# prefix_validated_via_arin_whois_db_dump +match from group clients set community delete 65530:4 +match from group clients set large-community delete 999:65530:4 + +# prefix_validated_via_rpki_roas +match from group clients set community delete 65530:2 +match from group clients set large-community delete 999:65530:2 + +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + +# route_validated_via_white_list +match from group clients set community delete 65530:3 +match from group clients set large-community delete 999:65530:3 + +# from_europe +match from group clients set community delete 65534:1 +match from group clients set ext-community delete rt 65534:1 +match from group clients set large-community delete 999:65534:1 + +# from_usa +match from group clients set community delete 65534:2 +match from group clients set ext-community delete rt 65534:2 +match from group clients set large-community delete 999:65534:2 + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + +# --------------------------------------------------------- +# ROAs source + + +roa-set { + 193.0.0.0/21 source-as 3333 + 193.0.24.0/22 maxlen 26 source-as 3333 + 193.0.10.0/23 source-as 3333 + 193.0.12.0/23 source-as 3333 + 193.0.14.0/23 source-as 25152 + 193.0.18.0/23 source-as 3333 + 193.0.20.0/23 source-as 3333 + 193.0.22.0/23 source-as 3333 + 193.0.14.0/24 source-as 25152 + 193.0.24.0/24 source-as 3333 + 2001:7fd::/32 source-as 25152 + 2001:610:240::/42 source-as 3333 + 2001:67c:2e8::/48 source-as 3333 + 2001:7fd::/48 source-as 25152 + +} + + + +# --------------------------------------------------------- +# RPKI-based Origin Validation + + +# Add $INTCOMM_RPKI_UNKNOWN, $INTCOMM_RPKI_INVALID and $INTCOMM_RPKI_VALID +# ext community on the basis of ovs. +match from group clients ovs not-found set { + ext-community $INTCOMM_RPKI_UNKNOWN + ext-community ovs not-found + +} +match from group clients ovs valid set { + ext-community $INTCOMM_RPKI_VALID + ext-community ovs valid + +} +match from group clients ovs invalid set { + ext-community $INTCOMM_RPKI_INVALID + ext-community ovs invalid + +} + + + +# --------------------------------------------------------- +# RPKI ROAs used as route objects. + +# Add the $INTCOMM_PREF_OK_ROA ext community to routes whose +# origin ASN has a ROA for the announced prefix. +# It will be used later during IRRDB validation in +# case the origin ASN is authorized by a client's +# AS-SET but the prefix is not. + +# Since RPKI-based Origin Validation is already performed above, +# use the origin validation state to identify valid routes. +match from group clients ovs valid set ext-community $INTCOMM_PREF_OK_ROA + + +# ARIN Whois records used for preifx validation +# --------------------------------------------- + +# Add the $INTCOMM_PREF_OK_ARINDB ext community to routes whose +# origin ASN has an ARIN Whois record for the announced prefix. +# It will be used later during IRRDB validation in +# case the origin ASN is authorized by a client's +# AS-SET but the prefix is not. +origin-set "ARINDB" { +192.136.136.0/24 prefixlen 24 - 32 source-as 10745 +192.149.252.0/24 prefixlen 24 - 32 source-as 10745 +199.43.0.0/24 prefixlen 24 - 32 source-as 10745 +2001:500:110::/48 prefixlen 48 - 128 source-as 10745 +2001:500:4::/48 prefixlen 48 - 128 source-as 10745 +} +match from group clients origin-set ARINDB set ext-community $INTCOMM_PREF_OK_ARINDB + + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.22 set ext-community rt 65520:10745 + +match from 2001:db8:1:1::22 set ext-community rt 65520:10745 + +match from 192.0.2.11 set ext-community rt 65520:3333 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +allow quick from group clients max-as-len 32 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: global blacklist +# Reject inbound routes when 'from group clients prefix-set global_black_list_pref' - reject code: 3 +allow quick from group clients prefix-set global_black_list_pref set { + localpref 1 + community 65520:0 + community 65520:3 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS10745_1, inbound + + +# Attach custom BGP communities +# from_usa +match from 192.0.2.22 set community 65534:2 +match from 192.0.2.22 set ext-community rt 65534:2 +match from 192.0.2.22 set large-community 999:65534:2 + +# NEXT_HOP +match from 192.0.2.22 set community NO_ADVERTISE +match from 192.0.2.22 nexthop 192.0.2.22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.22 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.22 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.22 peer-as != 10745' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.22 peer-as != 10745 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.22 AS 23456' - reject code: 7 +allow quick from 192.0.2.22 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.22 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.22 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.22 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.22 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.22 AS { 174, 701, 1299, 2914, 3257, 3320, 3356, 5511, 6453, 6461, 6762, 6830, 7018, 12956 }' - reject code: 8 +allow quick from 192.0.2.22 AS { 174, 701, 1299, 2914, 3257, 3320, 3356, 5511, 6453, 6461, 6762, 6830, 7018, 12956 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.22 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.22 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +match from 192.0.2.22 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS10745_1, AS10745: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.22 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.22 source-as as-set AS_SET_AS10745_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS10745 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.22 ext-community $INTCOMM_ORIGIN_KO set community 65530:0 +match from 192.0.2.22 ext-community $INTCOMM_ORIGIN_KO set large-community 999:65530:0 +# adding present_in_as_set community to authorized routes +match from 192.0.2.22 ext-community $INTCOMM_ORIGIN_OK set community 65530:1 +match from 192.0.2.22 ext-community $INTCOMM_ORIGIN_OK set large-community 999:65530:1 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS10745_1, AS10745: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.22 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.22 prefix-set AS_SET_AS10745_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS10745 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.22 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 65530:2 +match from 192.0.2.22 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:65530:2 + +match from 192.0.2.22 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.22 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 65530:4 +match from 192.0.2.22 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:65530:4 + +match from 192.0.2.22 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 192.0.2.22 set ext-community delete rt 65520:10745 + + +# Remove internal communities before accepting the route +match from 192.0.2.22 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.22 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.22 large-community 999:666:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +allow quick from 192.0.2.22 community BLACKHOLE +allow quick from 192.0.2.22 community 65534:0 +allow quick from 192.0.2.22 large-community 999:666:0 + + +match from 192.0.2.22 set ext-community rt 65520:10745 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.22 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.22 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.22 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.22 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.22 community GRACEFUL_SHUTDOWN set localpref 0 + +# Remove internal communities before accepting the route +match from 192.0.2.22 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.22 set ext-community delete rt 65520:10745 + + + +allow quick from 192.0.2.22 + + + +# --------------------------------------------- +# client AS10745_1, outbound + +deny quick to 192.0.2.22 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 192.0.2.22 community 65534:0 set community BLACKHOLE +match to 192.0.2.22 large-community 999:666:0 set community BLACKHOLE + +match to 192.0.2.22 community BLACKHOLE set community NO_EXPORT +match to 192.0.2.22 community BLACKHOLE set nexthop 192.0.2.66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.22 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.22 community 65507:999 set community NO_EXPORT +match to 192.0.2.22 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.22 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.22 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.22 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.22 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.22 community 65509:10745 set community NO_EXPORT +match to 192.0.2.22 ext-community rt 65509:10745 set community NO_EXPORT +match to 192.0.2.22 large-community 999:65509:10745 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.22 community 65510:10745 set community NO_ADVERTISE +match to 192.0.2.22 ext-community rt 65510:10745 set community NO_ADVERTISE +match to 192.0.2.22 large-community 999:65510:10745 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.22 + +# do_not_announce_to_any +deny to 192.0.2.22 community 0:999 +deny to 192.0.2.22 ext-community rt 0:999 +deny to 192.0.2.22 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.22 community 0:10745 +deny quick to 192.0.2.22 ext-community rt 0:10745 +deny quick to 192.0.2.22 large-community 999:0:10745 + +# do_not_announce_to_peers_with_rtt_lower_than 500 ms +deny to 192.0.2.22 community 64511:500 +deny to 192.0.2.22 ext-community rt 64511:500 +deny to 192.0.2.22 large-community 999:64511:500 + + +# announce_to_peers_with_rtt_lower_than 500 ms +allow to 192.0.2.22 community 64513:500 +allow to 192.0.2.22 ext-community rt 64513:500 +allow to 192.0.2.22 large-community 999:64513:500 + + +# do_not_announce_to_peers_with_rtt_higher_than 5 ms +deny to 192.0.2.22 community 64512:5 +deny to 192.0.2.22 ext-community rt 64512:5 +deny to 192.0.2.22 large-community 999:64512:5 + + +# do_not_announce_to_peers_with_rtt_higher_than 10 ms +deny to 192.0.2.22 community 64512:10 +deny to 192.0.2.22 ext-community rt 64512:10 +deny to 192.0.2.22 large-community 999:64512:10 + + +# do_not_announce_to_peers_with_rtt_higher_than 15 ms +deny to 192.0.2.22 community 64512:15 +deny to 192.0.2.22 ext-community rt 64512:15 +deny to 192.0.2.22 large-community 999:64512:15 + + +# do_not_announce_to_peers_with_rtt_higher_than 20 ms +deny to 192.0.2.22 community 64512:20 +deny to 192.0.2.22 ext-community rt 64512:20 +deny to 192.0.2.22 large-community 999:64512:20 + + +# do_not_announce_to_peers_with_rtt_higher_than 30 ms +deny to 192.0.2.22 community 64512:30 +deny to 192.0.2.22 ext-community rt 64512:30 +deny to 192.0.2.22 large-community 999:64512:30 + + +# do_not_announce_to_peers_with_rtt_higher_than 50 ms +deny to 192.0.2.22 community 64512:50 +deny to 192.0.2.22 ext-community rt 64512:50 +deny to 192.0.2.22 large-community 999:64512:50 + + +# do_not_announce_to_peers_with_rtt_higher_than 100 ms +deny to 192.0.2.22 community 64512:100 +deny to 192.0.2.22 ext-community rt 64512:100 +deny to 192.0.2.22 large-community 999:64512:100 + + +# do_not_announce_to_peers_with_rtt_higher_than 200 ms +deny to 192.0.2.22 community 64512:200 +deny to 192.0.2.22 ext-community rt 64512:200 +deny to 192.0.2.22 large-community 999:64512:200 + + +# announce_to_peers_with_rtt_higher_than 5 ms +allow to 192.0.2.22 community 64514:5 +allow to 192.0.2.22 ext-community rt 64514:5 +allow to 192.0.2.22 large-community 999:64514:5 + + +# announce_to_peers_with_rtt_higher_than 10 ms +allow to 192.0.2.22 community 64514:10 +allow to 192.0.2.22 ext-community rt 64514:10 +allow to 192.0.2.22 large-community 999:64514:10 + + +# announce_to_peers_with_rtt_higher_than 15 ms +allow to 192.0.2.22 community 64514:15 +allow to 192.0.2.22 ext-community rt 64514:15 +allow to 192.0.2.22 large-community 999:64514:15 + + +# announce_to_peers_with_rtt_higher_than 20 ms +allow to 192.0.2.22 community 64514:20 +allow to 192.0.2.22 ext-community rt 64514:20 +allow to 192.0.2.22 large-community 999:64514:20 + + +# announce_to_peers_with_rtt_higher_than 30 ms +allow to 192.0.2.22 community 64514:30 +allow to 192.0.2.22 ext-community rt 64514:30 +allow to 192.0.2.22 large-community 999:64514:30 + + +# announce_to_peers_with_rtt_higher_than 50 ms +allow to 192.0.2.22 community 64514:50 +allow to 192.0.2.22 ext-community rt 64514:50 +allow to 192.0.2.22 large-community 999:64514:50 + + +# announce_to_peers_with_rtt_higher_than 100 ms +allow to 192.0.2.22 community 64514:100 +allow to 192.0.2.22 ext-community rt 64514:100 +allow to 192.0.2.22 large-community 999:64514:100 + + +# announce_to_peers_with_rtt_higher_than 200 ms +allow to 192.0.2.22 community 64514:200 +allow to 192.0.2.22 ext-community rt 64514:200 +allow to 192.0.2.22 large-community 999:64514:200 + + +# announce_to_peer +allow to 192.0.2.22 community 999:10745 +allow to 192.0.2.22 ext-community rt 999:10745 +allow to 192.0.2.22 large-community 999:999:10745 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.22 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS10745; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65504:10745 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65504:10745 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65504:10745 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS10745; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65505:10745 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65505:10745 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65505:10745 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS10745; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65506:10745 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65506:10745 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65506:10745 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64515:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64515:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64515:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64516:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64516:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64516:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64517:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64517:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64517:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65501:999 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65501:999 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65501:999 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65502:999 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65502:999 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65502:999 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65503:999 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65503:999 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65503:999 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS10745_2, inbound + + +# Attach custom BGP communities +# from_usa +match from 2001:db8:1:1::22 set community 65534:2 +match from 2001:db8:1:1::22 set ext-community rt 65534:2 +match from 2001:db8:1:1::22 set large-community 999:65534:2 + +# NEXT_HOP +match from 2001:db8:1:1::22 set community NO_ADVERTISE +match from 2001:db8:1:1::22 nexthop 2001:db8:1:1::22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::22 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::22 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::22 peer-as != 10745' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::22 peer-as != 10745 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::22 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::22 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::22 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::22 AS { 174, 701, 1299, 2914, 3257, 3320, 3356, 5511, 6453, 6461, 6762, 6830, 7018, 12956 }' - reject code: 8 +allow quick from 2001:db8:1:1::22 AS { 174, 701, 1299, 2914, 3257, 3320, 3356, 5511, 6453, 6461, 6762, 6830, 7018, 12956 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::22 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::22 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +match from 2001:db8:1:1::22 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS10745_2, AS10745: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::22 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::22 source-as as-set AS_SET_AS10745_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS10745 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::22 ext-community $INTCOMM_ORIGIN_KO set community 65530:0 +match from 2001:db8:1:1::22 ext-community $INTCOMM_ORIGIN_KO set large-community 999:65530:0 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::22 ext-community $INTCOMM_ORIGIN_OK set community 65530:1 +match from 2001:db8:1:1::22 ext-community $INTCOMM_ORIGIN_OK set large-community 999:65530:1 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS10745_2, AS10745: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::22 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::22 prefix-set AS_SET_AS10745_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS10745 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::22 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 65530:2 +match from 2001:db8:1:1::22 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:65530:2 + +match from 2001:db8:1:1::22 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::22 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 65530:4 +match from 2001:db8:1:1::22 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:65530:4 + +match from 2001:db8:1:1::22 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::22 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 2001:db8:1:1::22 set ext-community delete rt 65520:10745 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::22 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::22 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::22 large-community 999:666:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +allow quick from 2001:db8:1:1::22 community BLACKHOLE +allow quick from 2001:db8:1:1::22 community 65534:0 +allow quick from 2001:db8:1:1::22 large-community 999:666:0 + + +match from 2001:db8:1:1::22 set ext-community rt 65520:10745 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::22 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::22 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::22 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::22 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::22 community GRACEFUL_SHUTDOWN set localpref 0 + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::22 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::22 set ext-community delete rt 65520:10745 + + + +allow quick from 2001:db8:1:1::22 + + + +# --------------------------------------------- +# client AS10745_2, outbound + +deny quick to 2001:db8:1:1::22 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 2001:db8:1:1::22 community 65534:0 set community BLACKHOLE +match to 2001:db8:1:1::22 large-community 999:666:0 set community BLACKHOLE + +match to 2001:db8:1:1::22 community BLACKHOLE set community NO_EXPORT +match to 2001:db8:1:1::22 community BLACKHOLE set nexthop 2001:db8:1:1::66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::22 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::22 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::22 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::22 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::22 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::22 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::22 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::22 community 65509:10745 set community NO_EXPORT +match to 2001:db8:1:1::22 ext-community rt 65509:10745 set community NO_EXPORT +match to 2001:db8:1:1::22 large-community 999:65509:10745 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::22 community 65510:10745 set community NO_ADVERTISE +match to 2001:db8:1:1::22 ext-community rt 65510:10745 set community NO_ADVERTISE +match to 2001:db8:1:1::22 large-community 999:65510:10745 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::22 + +# do_not_announce_to_any +deny to 2001:db8:1:1::22 community 0:999 +deny to 2001:db8:1:1::22 ext-community rt 0:999 +deny to 2001:db8:1:1::22 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::22 community 0:10745 +deny quick to 2001:db8:1:1::22 ext-community rt 0:10745 +deny quick to 2001:db8:1:1::22 large-community 999:0:10745 + +# do_not_announce_to_peers_with_rtt_lower_than 500 ms +deny to 2001:db8:1:1::22 community 64511:500 +deny to 2001:db8:1:1::22 ext-community rt 64511:500 +deny to 2001:db8:1:1::22 large-community 999:64511:500 + + +# announce_to_peers_with_rtt_lower_than 500 ms +allow to 2001:db8:1:1::22 community 64513:500 +allow to 2001:db8:1:1::22 ext-community rt 64513:500 +allow to 2001:db8:1:1::22 large-community 999:64513:500 + + +# do_not_announce_to_peers_with_rtt_higher_than 5 ms +deny to 2001:db8:1:1::22 community 64512:5 +deny to 2001:db8:1:1::22 ext-community rt 64512:5 +deny to 2001:db8:1:1::22 large-community 999:64512:5 + + +# do_not_announce_to_peers_with_rtt_higher_than 10 ms +deny to 2001:db8:1:1::22 community 64512:10 +deny to 2001:db8:1:1::22 ext-community rt 64512:10 +deny to 2001:db8:1:1::22 large-community 999:64512:10 + + +# do_not_announce_to_peers_with_rtt_higher_than 15 ms +deny to 2001:db8:1:1::22 community 64512:15 +deny to 2001:db8:1:1::22 ext-community rt 64512:15 +deny to 2001:db8:1:1::22 large-community 999:64512:15 + + +# do_not_announce_to_peers_with_rtt_higher_than 20 ms +deny to 2001:db8:1:1::22 community 64512:20 +deny to 2001:db8:1:1::22 ext-community rt 64512:20 +deny to 2001:db8:1:1::22 large-community 999:64512:20 + + +# do_not_announce_to_peers_with_rtt_higher_than 30 ms +deny to 2001:db8:1:1::22 community 64512:30 +deny to 2001:db8:1:1::22 ext-community rt 64512:30 +deny to 2001:db8:1:1::22 large-community 999:64512:30 + + +# do_not_announce_to_peers_with_rtt_higher_than 50 ms +deny to 2001:db8:1:1::22 community 64512:50 +deny to 2001:db8:1:1::22 ext-community rt 64512:50 +deny to 2001:db8:1:1::22 large-community 999:64512:50 + + +# do_not_announce_to_peers_with_rtt_higher_than 100 ms +deny to 2001:db8:1:1::22 community 64512:100 +deny to 2001:db8:1:1::22 ext-community rt 64512:100 +deny to 2001:db8:1:1::22 large-community 999:64512:100 + + +# do_not_announce_to_peers_with_rtt_higher_than 200 ms +deny to 2001:db8:1:1::22 community 64512:200 +deny to 2001:db8:1:1::22 ext-community rt 64512:200 +deny to 2001:db8:1:1::22 large-community 999:64512:200 + + +# announce_to_peers_with_rtt_higher_than 5 ms +allow to 2001:db8:1:1::22 community 64514:5 +allow to 2001:db8:1:1::22 ext-community rt 64514:5 +allow to 2001:db8:1:1::22 large-community 999:64514:5 + + +# announce_to_peers_with_rtt_higher_than 10 ms +allow to 2001:db8:1:1::22 community 64514:10 +allow to 2001:db8:1:1::22 ext-community rt 64514:10 +allow to 2001:db8:1:1::22 large-community 999:64514:10 + + +# announce_to_peers_with_rtt_higher_than 15 ms +allow to 2001:db8:1:1::22 community 64514:15 +allow to 2001:db8:1:1::22 ext-community rt 64514:15 +allow to 2001:db8:1:1::22 large-community 999:64514:15 + + +# announce_to_peers_with_rtt_higher_than 20 ms +allow to 2001:db8:1:1::22 community 64514:20 +allow to 2001:db8:1:1::22 ext-community rt 64514:20 +allow to 2001:db8:1:1::22 large-community 999:64514:20 + + +# announce_to_peers_with_rtt_higher_than 30 ms +allow to 2001:db8:1:1::22 community 64514:30 +allow to 2001:db8:1:1::22 ext-community rt 64514:30 +allow to 2001:db8:1:1::22 large-community 999:64514:30 + + +# announce_to_peers_with_rtt_higher_than 50 ms +allow to 2001:db8:1:1::22 community 64514:50 +allow to 2001:db8:1:1::22 ext-community rt 64514:50 +allow to 2001:db8:1:1::22 large-community 999:64514:50 + + +# announce_to_peers_with_rtt_higher_than 100 ms +allow to 2001:db8:1:1::22 community 64514:100 +allow to 2001:db8:1:1::22 ext-community rt 64514:100 +allow to 2001:db8:1:1::22 large-community 999:64514:100 + + +# announce_to_peers_with_rtt_higher_than 200 ms +allow to 2001:db8:1:1::22 community 64514:200 +allow to 2001:db8:1:1::22 ext-community rt 64514:200 +allow to 2001:db8:1:1::22 large-community 999:64514:200 + + +# announce_to_peer +allow to 2001:db8:1:1::22 community 999:10745 +allow to 2001:db8:1:1::22 ext-community rt 999:10745 +allow to 2001:db8:1:1::22 large-community 999:999:10745 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::22 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS10745; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65504:10745 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65504:10745 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65504:10745 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS10745; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65505:10745 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65505:10745 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65505:10745 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS10745; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65506:10745 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65506:10745 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65506:10745 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64515:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64515:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64515:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64516:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64516:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64516:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64517:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64517:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64517:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65501:999 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65501:999 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65501:999 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65502:999 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65502:999 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65502:999 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65503:999 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65503:999 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::22 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65503:999 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS3333_1, inbound + + +# Attach custom BGP communities +# from_europe +match from 192.0.2.11 set community 65534:1 +match from 192.0.2.11 set ext-community rt 65534:1 +match from 192.0.2.11 set large-community 999:65534:1 + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 3333' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 3333 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.11 AS { 174, 701, 1299, 2914, 3257, 3320, 3356, 5511, 6453, 6461, 6762, 6830, 7018, 12956 }' - reject code: 8 +allow quick from 192.0.2.11 AS { 174, 701, 1299, 2914, 3257, 3320, 3356, 5511, 6453, 6461, 6762, 6830, 7018, 12956 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.11 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.11 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +match from 192.0.2.11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS3333_1, AS3333: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.11 source-as as-set AS_SET_AS3333_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS3333 +# AS-SET AS_RIPENCC referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_KO set community 65530:0 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_KO set large-community 999:65530:0 +# adding present_in_as_set community to authorized routes +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK set community 65530:1 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK set large-community 999:65530:1 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS3333_1, AS3333: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.11 prefix-set AS_SET_AS3333_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS3333 +# AS-SET AS_RIPENCC referenced but empty. + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 65530:2 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:65530:2 + +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 65530:4 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:65530:4 + +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 192.0.2.11 set ext-community delete rt 65520:3333 + + +# Remove internal communities before accepting the route +match from 192.0.2.11 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.11 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.11 large-community 999:666:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +allow quick from 192.0.2.11 community BLACKHOLE +allow quick from 192.0.2.11 community 65534:0 +allow quick from 192.0.2.11 large-community 999:666:0 + + +match from 192.0.2.11 set ext-community rt 65520:3333 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.11 community GRACEFUL_SHUTDOWN set localpref 0 + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:3333 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS3333_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 192.0.2.11 community 65534:0 set community BLACKHOLE +match to 192.0.2.11 large-community 999:666:0 set community BLACKHOLE + +match to 192.0.2.11 community BLACKHOLE set community NO_EXPORT +match to 192.0.2.11 community BLACKHOLE set nexthop 192.0.2.66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.11 community 65507:999 set community NO_EXPORT +match to 192.0.2.11 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.11 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.11 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.11 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.11 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.11 community 65509:3333 set community NO_EXPORT +match to 192.0.2.11 ext-community rt 65509:3333 set community NO_EXPORT +match to 192.0.2.11 large-community 999:65509:3333 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.11 community 65510:3333 set community NO_ADVERTISE +match to 192.0.2.11 ext-community rt 65510:3333 set community NO_ADVERTISE +match to 192.0.2.11 large-community 999:65510:3333 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.11 + +# do_not_announce_to_any +deny to 192.0.2.11 community 0:999 +deny to 192.0.2.11 ext-community rt 0:999 +deny to 192.0.2.11 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.11 community 0:3333 +deny quick to 192.0.2.11 ext-community rt 0:3333 +deny quick to 192.0.2.11 large-community 999:0:3333 + +# do_not_announce_to_peers_with_rtt_lower_than 200 ms +deny to 192.0.2.11 community 64511:200 +deny to 192.0.2.11 ext-community rt 64511:200 +deny to 192.0.2.11 large-community 999:64511:200 + + +# do_not_announce_to_peers_with_rtt_lower_than 500 ms +deny to 192.0.2.11 community 64511:500 +deny to 192.0.2.11 ext-community rt 64511:500 +deny to 192.0.2.11 large-community 999:64511:500 + + +# announce_to_peers_with_rtt_lower_than 200 ms +allow to 192.0.2.11 community 64513:200 +allow to 192.0.2.11 ext-community rt 64513:200 +allow to 192.0.2.11 large-community 999:64513:200 + + +# announce_to_peers_with_rtt_lower_than 500 ms +allow to 192.0.2.11 community 64513:500 +allow to 192.0.2.11 ext-community rt 64513:500 +allow to 192.0.2.11 large-community 999:64513:500 + + +# do_not_announce_to_peers_with_rtt_higher_than 5 ms +deny to 192.0.2.11 community 64512:5 +deny to 192.0.2.11 ext-community rt 64512:5 +deny to 192.0.2.11 large-community 999:64512:5 + + +# do_not_announce_to_peers_with_rtt_higher_than 10 ms +deny to 192.0.2.11 community 64512:10 +deny to 192.0.2.11 ext-community rt 64512:10 +deny to 192.0.2.11 large-community 999:64512:10 + + +# do_not_announce_to_peers_with_rtt_higher_than 15 ms +deny to 192.0.2.11 community 64512:15 +deny to 192.0.2.11 ext-community rt 64512:15 +deny to 192.0.2.11 large-community 999:64512:15 + + +# do_not_announce_to_peers_with_rtt_higher_than 20 ms +deny to 192.0.2.11 community 64512:20 +deny to 192.0.2.11 ext-community rt 64512:20 +deny to 192.0.2.11 large-community 999:64512:20 + + +# do_not_announce_to_peers_with_rtt_higher_than 30 ms +deny to 192.0.2.11 community 64512:30 +deny to 192.0.2.11 ext-community rt 64512:30 +deny to 192.0.2.11 large-community 999:64512:30 + + +# do_not_announce_to_peers_with_rtt_higher_than 50 ms +deny to 192.0.2.11 community 64512:50 +deny to 192.0.2.11 ext-community rt 64512:50 +deny to 192.0.2.11 large-community 999:64512:50 + + +# do_not_announce_to_peers_with_rtt_higher_than 100 ms +deny to 192.0.2.11 community 64512:100 +deny to 192.0.2.11 ext-community rt 64512:100 +deny to 192.0.2.11 large-community 999:64512:100 + + +# announce_to_peers_with_rtt_higher_than 5 ms +allow to 192.0.2.11 community 64514:5 +allow to 192.0.2.11 ext-community rt 64514:5 +allow to 192.0.2.11 large-community 999:64514:5 + + +# announce_to_peers_with_rtt_higher_than 10 ms +allow to 192.0.2.11 community 64514:10 +allow to 192.0.2.11 ext-community rt 64514:10 +allow to 192.0.2.11 large-community 999:64514:10 + + +# announce_to_peers_with_rtt_higher_than 15 ms +allow to 192.0.2.11 community 64514:15 +allow to 192.0.2.11 ext-community rt 64514:15 +allow to 192.0.2.11 large-community 999:64514:15 + + +# announce_to_peers_with_rtt_higher_than 20 ms +allow to 192.0.2.11 community 64514:20 +allow to 192.0.2.11 ext-community rt 64514:20 +allow to 192.0.2.11 large-community 999:64514:20 + + +# announce_to_peers_with_rtt_higher_than 30 ms +allow to 192.0.2.11 community 64514:30 +allow to 192.0.2.11 ext-community rt 64514:30 +allow to 192.0.2.11 large-community 999:64514:30 + + +# announce_to_peers_with_rtt_higher_than 50 ms +allow to 192.0.2.11 community 64514:50 +allow to 192.0.2.11 ext-community rt 64514:50 +allow to 192.0.2.11 large-community 999:64514:50 + + +# announce_to_peers_with_rtt_higher_than 100 ms +allow to 192.0.2.11 community 64514:100 +allow to 192.0.2.11 ext-community rt 64514:100 +allow to 192.0.2.11 large-community 999:64514:100 + + +# announce_to_peer +allow to 192.0.2.11 community 999:3333 +allow to 192.0.2.11 ext-community rt 999:3333 +allow to 192.0.2.11 large-community 999:999:3333 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS3333; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65504:3333 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65504:3333 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65504:3333 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS3333; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65505:3333 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65505:3333 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65505:3333 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS3333; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65506:3333 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65506:3333 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65506:3333 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:100 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:100 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 100 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:100 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:50 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:50 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 50 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:50 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:30 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:30 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 30 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:30 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:20 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:20 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 20 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:20 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:15 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:15 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 15 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:15 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:10 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:10 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 10 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:10 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64518:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64518:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64518:5 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64519:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64519:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64519:5 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_higher_than 5 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64520:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64520:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64520:5 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64515:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64515:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64515:200 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64516:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64516:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64516:200 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 200 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64517:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64517:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64517:200 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_once_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64515:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64515:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64515:500 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_twice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64516:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64516:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64516:500 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + +# prepend_thrice_to_peers_with_rtt_lower_than 500 ms; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 64517:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 64517:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:64517:500 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65501:999 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65501:999 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65501:999 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65502:999 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65502:999 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65502:999 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65503:999 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65503:999 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65503:999 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + + + +# Scrub communities from outbound routes +# add_noadvertise_to_any +match to group clients set community delete 65508:999 +match to group clients set ext-community delete rt 65508:999 +match to group clients set large-community delete 999:65508:999 + +# add_noadvertise_to_peer +match to group clients set community delete 65510:* +match to group clients set ext-community delete rt 65510:* +match to group clients set large-community delete 999:65510:* + +# add_noexport_to_any +match to group clients set community delete 65507:999 +match to group clients set ext-community delete rt 65507:999 +match to group clients set large-community delete 999:65507:999 + +# add_noexport_to_peer +match to group clients set community delete 65509:* +match to group clients set ext-community delete rt 65509:* +match to group clients set large-community delete 999:65509:* + +# announce_to_peer +match to group clients set community delete 999:* +match to group clients set ext-community delete rt 999:* +match to group clients set large-community delete 999:999:* + +# announce_to_peers_with_rtt_higher_than +match to group clients set community delete 64514:* +match to group clients set ext-community delete rt 64514:* +match to group clients set large-community delete 999:64514:* + +# announce_to_peers_with_rtt_lower_than +match to group clients set community delete 64513:* +match to group clients set ext-community delete rt 64513:* +match to group clients set large-community delete 999:64513:* + +# blackholing +match to group clients set community delete 65534:0 +match to group clients set large-community delete 999:666:0 + +# do_not_announce_to_any +match to group clients set community delete 0:999 +match to group clients set ext-community delete rt 0:999 +match to group clients set large-community delete 999:0:999 + +# do_not_announce_to_peer +match to group clients set community delete 0:* +match to group clients set ext-community delete rt 0:* +match to group clients set large-community delete 999:0:* + +# do_not_announce_to_peers_with_rtt_higher_than +match to group clients set community delete 64512:* +match to group clients set ext-community delete rt 64512:* +match to group clients set large-community delete 999:64512:* + +# do_not_announce_to_peers_with_rtt_lower_than +match to group clients set community delete 64511:* +match to group clients set ext-community delete rt 64511:* +match to group clients set large-community delete 999:64511:* + +# prepend_once_to_any +match to group clients set community delete 65501:999 +match to group clients set ext-community delete rt 65501:999 +match to group clients set large-community delete 999:65501:999 + +# prepend_once_to_peer +match to group clients set community delete 65504:* +match to group clients set ext-community delete rt 65504:* +match to group clients set large-community delete 999:65504:* + +# prepend_once_to_peers_with_rtt_higher_than +match to group clients set community delete 64518:* +match to group clients set ext-community delete rt 64518:* +match to group clients set large-community delete 999:64518:* + +# prepend_once_to_peers_with_rtt_lower_than +match to group clients set community delete 64515:* +match to group clients set ext-community delete rt 64515:* +match to group clients set large-community delete 999:64515:* + +# prepend_thrice_to_any +match to group clients set community delete 65503:999 +match to group clients set ext-community delete rt 65503:999 +match to group clients set large-community delete 999:65503:999 + +# prepend_thrice_to_peer +match to group clients set community delete 65506:* +match to group clients set ext-community delete rt 65506:* +match to group clients set large-community delete 999:65506:* + +# prepend_thrice_to_peers_with_rtt_higher_than +match to group clients set community delete 64520:* +match to group clients set ext-community delete rt 64520:* +match to group clients set large-community delete 999:64520:* + +# prepend_thrice_to_peers_with_rtt_lower_than +match to group clients set community delete 64517:* +match to group clients set ext-community delete rt 64517:* +match to group clients set large-community delete 999:64517:* + +# prepend_twice_to_any +match to group clients set community delete 65502:999 +match to group clients set ext-community delete rt 65502:999 +match to group clients set large-community delete 999:65502:999 + +# prepend_twice_to_peer +match to group clients set community delete 65505:* +match to group clients set ext-community delete rt 65505:* +match to group clients set large-community delete 999:65505:* + +# prepend_twice_to_peers_with_rtt_higher_than +match to group clients set community delete 64519:* +match to group clients set ext-community delete rt 64519:* +match to group clients set large-community delete 999:64519:* + +# prepend_twice_to_peers_with_rtt_lower_than +match to group clients set community delete 64516:* +match to group clients set ext-community delete rt 64516:* +match to group clients set large-community delete 999:64516:* + +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities +match to group clients set { + community delete 65501:999 + ext-community delete rt 65501:999 + large-community delete 999:65501:999 + +} +match to group clients set { + community delete 65504:* + ext-community delete rt 65504:* + large-community delete 999:65504:* + +} +match to group clients set { + community delete 64518:* + ext-community delete rt 64518:* + large-community delete 999:64518:* + +} +match to group clients set { + community delete 64515:* + ext-community delete rt 64515:* + large-community delete 999:64515:* + +} +match to group clients set { + community delete 65503:999 + ext-community delete rt 65503:999 + large-community delete 999:65503:999 + +} +match to group clients set { + community delete 65506:* + ext-community delete rt 65506:* + large-community delete 999:65506:* + +} +match to group clients set { + community delete 64520:* + ext-community delete rt 64520:* + large-community delete 999:64520:* + +} +match to group clients set { + community delete 64517:* + ext-community delete rt 64517:* + large-community delete 999:64517:* + +} +match to group clients set { + community delete 65502:999 + ext-community delete rt 65502:999 + large-community delete 999:65502:999 + +} +match to group clients set { + community delete 65505:* + ext-community delete rt 65505:* + large-community delete 999:65505:* + +} +match to group clients set { + community delete 64519:* + ext-community delete rt 64519:* + large-community delete 999:64519:* + +} +match to group clients set { + community delete 64516:* + ext-community delete rt 64516:* + large-community delete 999:64516:* + +} + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenarioOpenBGPD_IPv6/openbgpd68.conf b/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenarioOpenBGPD_IPv6/openbgpd68.conf index fb56d9e6..b416aa96 100644 --- a/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenarioOpenBGPD_IPv6/openbgpd68.conf +++ b/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenarioOpenBGPD_IPv6/openbgpd68.conf @@ -185,7 +185,7 @@ prefix-set "bogons" { # never via route-servers ASNs as-set "neverviarouteserver" { - 92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338 + 2914, 3491 } # ===================================================================================== diff --git a/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenarioOpenBGPD_IPv6/openbgpd70.conf b/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenarioOpenBGPD_IPv6/openbgpd70.conf index 1ee7a311..97f2d27a 100644 --- a/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenarioOpenBGPD_IPv6/openbgpd70.conf +++ b/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenarioOpenBGPD_IPv6/openbgpd70.conf @@ -189,7 +189,7 @@ prefix-set "bogons" { # never via route-servers ASNs as-set "neverviarouteserver" { - 92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338 + 2914, 3491 } # ===================================================================================== diff --git a/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenario_BIRD2IPv4/bird2.conf b/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenario_BIRD2IPv4/bird2.conf index c97c4229..fbce6a8d 100644 --- a/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenario_BIRD2IPv4/bird2.conf +++ b/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenario_BIRD2IPv4/bird2.conf @@ -79,10 +79,10 @@ define AS_SET_AS10745_prefixes_4 = [ # ARIN Whois database records define ARIN_Whois_db_AS10745_4 = [ - 192.136.136.0/24{24,32}, 192.149.252.0/24{24,32}, 199.43.0.0/24{24,32} + 192.136.136.0/24{24,32}, 199.43.0.0/24{24,32}, 192.149.252.0/24{24,32} ]; define ARIN_Whois_db_AS10745_6 = [ - 2001:500:110::/48{48,128}, 2001:500:4::/48{48,128} + 2001:500:4::/48{48,128}, 2001:500:110::/48{48,128} ]; @@ -1916,7 +1916,7 @@ filter receive_from_AS10745_1 { # AS_PATH: never via route-servers ASNs - if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338] then + if bgp_path ~ [2914, 3491] then reject "AS_PATH [", bgp_path ,"] contains never via route-servers ASN - REJECTING ", net; @@ -2141,7 +2141,7 @@ filter receive_from_AS10745_2 { # AS_PATH: never via route-servers ASNs - if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338] then + if bgp_path ~ [2914, 3491] then reject "AS_PATH [", bgp_path ,"] contains never via route-servers ASN - REJECTING ", net; @@ -2374,7 +2374,7 @@ filter receive_from_AS3333_1 { # AS_PATH: never via route-servers ASNs - if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338] then + if bgp_path ~ [2914, 3491] then reject "AS_PATH [", bgp_path ,"] contains never via route-servers ASN - REJECTING ", net; diff --git a/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenario_BIRD2IPv6/bird2.conf b/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenario_BIRD2IPv6/bird2.conf index bcc452ef..d1491374 100644 --- a/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenario_BIRD2IPv6/bird2.conf +++ b/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenario_BIRD2IPv6/bird2.conf @@ -79,10 +79,10 @@ define AS_SET_AS10745_prefixes_6 = [ # ARIN Whois database records define ARIN_Whois_db_AS10745_4 = [ - 192.136.136.0/24{24,32}, 192.149.252.0/24{24,32}, 199.43.0.0/24{24,32} + 192.136.136.0/24{24,32}, 199.43.0.0/24{24,32}, 192.149.252.0/24{24,32} ]; define ARIN_Whois_db_AS10745_6 = [ - 2001:500:110::/48{48,128}, 2001:500:4::/48{48,128} + 2001:500:4::/48{48,128}, 2001:500:110::/48{48,128} ]; @@ -1914,7 +1914,7 @@ filter receive_from_AS10745_1 { # AS_PATH: never via route-servers ASNs - if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338] then + if bgp_path ~ [2914, 3491] then reject "AS_PATH [", bgp_path ,"] contains never via route-servers ASN - REJECTING ", net; @@ -2141,7 +2141,7 @@ filter receive_from_AS10745_2 { # AS_PATH: never via route-servers ASNs - if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338] then + if bgp_path ~ [2914, 3491] then reject "AS_PATH [", bgp_path ,"] contains never via route-servers ASN - REJECTING ", net; @@ -2372,7 +2372,7 @@ filter receive_from_AS3333_1 { # AS_PATH: never via route-servers ASNs - if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338] then + if bgp_path ~ [2914, 3491] then reject "AS_PATH [", bgp_path ,"] contains never via route-servers ASN - REJECTING ", net; diff --git a/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenario_BIRDIPv4/bird16.conf b/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenario_BIRDIPv4/bird16.conf index 48940a04..f5c3ff6f 100644 --- a/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenario_BIRDIPv4/bird16.conf +++ b/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenario_BIRDIPv4/bird16.conf @@ -65,7 +65,7 @@ define AS_SET_AS10745_prefixes_4 = [ # ARIN Whois database records define ARIN_Whois_db_AS10745_4 = [ - 199.43.0.0/24{24,32}, 192.136.136.0/24{24,32}, 192.149.252.0/24{24,32} + 192.136.136.0/24{24,32}, 192.149.252.0/24{24,32}, 199.43.0.0/24{24,32} ]; @@ -1745,7 +1745,7 @@ filter receive_from_AS10745_1 { # AS_PATH: never via route-servers ASNs - if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338] then + if bgp_path ~ [2914, 3491] then reject "AS_PATH [", bgp_path ,"] contains never via route-servers ASN - REJECTING ", net; @@ -1963,7 +1963,7 @@ filter receive_from_AS3333_1 { # AS_PATH: never via route-servers ASNs - if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338] then + if bgp_path ~ [2914, 3491] then reject "AS_PATH [", bgp_path ,"] contains never via route-servers ASN - REJECTING ", net; diff --git a/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenario_BIRDIPv6/bird16.conf b/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenario_BIRDIPv6/bird16.conf index bf14fcf8..f383ad04 100644 --- a/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenario_BIRDIPv6/bird16.conf +++ b/tests/live_tests/scenarios/rich_example/configs/RichConfigExampleScenario_BIRDIPv6/bird16.conf @@ -45,7 +45,7 @@ define AS_SET_AS10745_prefixes_6 = [ # ARIN Whois database records define ARIN_Whois_db_AS10745_6 = [ - 2001:500:110::/48{48,128}, 2001:500:4::/48{48,128} + 2001:500:4::/48{48,128}, 2001:500:110::/48{48,128} ]; @@ -1772,7 +1772,7 @@ filter receive_from_AS10745_2 { # AS_PATH: never via route-servers ASNs - if bgp_path ~ [92, 174, 278, 680, 714, 1273, 1299, 1955, 2152, 2914, 3257, 3265, 3292, 3320, 3491, 3630, 3754, 5391, 5432, 5511, 6079, 6730, 6805, 6830, 6908, 7155, 7843, 7862, 8075, 8365, 8455, 8607, 8943, 9908, 10013, 11164, 11260, 11290, 11670, 12322, 12353, 12822, 13030, 13032, 14295, 15692, 16509, 17012, 18520, 19237, 20115, 20161, 21396, 23888, 23961, 24282, 24800, 27947, 29169, 30967, 30983, 31764, 33983, 34108, 34209, 34587, 35836, 35900, 36165, 36459, 37271, 37529, 38713, 39326, 39651, 40029, 40063, 43470, 46450, 47377, 47583, 48237, 48265, 48408, 49127, 49910, 49922, 51530, 51630, 53859, 54295, 55244, 57433, 57468, 57866, 58768, 60412, 60757, 61756, 62164, 62567, 62623, 63290, 131398, 131996, 132563, 132829, 132996, 133317, 134022, 135706, 135848, 136106, 136874, 137207, 137610, 138023, 138769, 138953, 139667, 140287, 141091, 141120, 141134, 141140, 141411, 141856, 141892, 142164, 142348, 142369, 146846, 146958, 147059, 149296, 149663, 149826, 201978, 202561, 202793, 206275, 207353, 207484, 208425, 209699, 210030, 210715, 212512, 212539, 212623, 212706, 212953, 213202, 262191, 262888, 263258, 263686, 263801, 263856, 264424, 265337, 265630, 267214, 267442, 267561, 268091, 269156, 269190, 269367, 269512, 269654, 269906, 270407, 270544, 270781, 270828, 271053, 271172, 271200, 272018, 272124, 327732, 328445, 328572, 328582, 328959, 393573, 393684, 396304, 396477, 398203, 399338] then + if bgp_path ~ [2914, 3491] then reject "AS_PATH [", bgp_path ,"] contains never via route-servers ASN - REJECTING ", net; diff --git a/tests/live_tests/scenarios/rich_example/routes/RichConfigExampleScenarioOpenBGPD_IPv4/openbgpd77p/rs.txt b/tests/live_tests/scenarios/rich_example/routes/RichConfigExampleScenarioOpenBGPD_IPv4/openbgpd77p/rs.txt new file mode 100644 index 00000000..e69de29b diff --git a/tests/live_tests/scenarios/rpki_bov_comms/configs/RPKICustomBOVCommunitiesScenario_OpenBGPDPortableLatest_IPv4/openbgpd76p.conf b/tests/live_tests/scenarios/rpki_bov_comms/configs/RPKICustomBOVCommunitiesScenario_OpenBGPDPortableLatest_IPv4/openbgpd76p.conf new file mode 100644 index 00000000..ca5f2e31 --- /dev/null +++ b/tests/live_tests/scenarios/rpki_bov_comms/configs/RPKICustomBOVCommunitiesScenario_OpenBGPDPortableLatest_IPv4/openbgpd76p.conf @@ -0,0 +1,1186 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.11 { + remote-as 1 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::11 { + remote-as 1 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.22 { + remote-as 2 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::22 { + remote-as 2 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.33 { + remote-as 3 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::33 { + remote-as 3 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.44 { + remote-as 4 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::44 { + remote-as 4 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# rpki_bgp_origin_validation_invalid +match from group clients set community delete 64512:2 + +# rpki_bgp_origin_validation_unknown +match from group clients set community delete 64512:3 + +# rpki_bgp_origin_validation_valid +match from group clients set community delete 64512:1 + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + +# --------------------------------------------------------- +# ROAs source + + +roa-set { + 2.0.128.0/20 maxlen 23 source-as 101 + 3.0.128.0/20 maxlen 23 source-as 103 + 2.0.8.0/24 source-as 101 + 2.0.9.0/24 source-as 102 + 3.0.8.0/24 source-as 103 + 3.0.9.0/24 source-as 102 + 3002:0:8000::/33 maxlen 34 source-as 101 + 3003:0:8000::/33 maxlen 34 source-as 103 + 3002:0:8::/48 source-as 101 + 3002:0:9::/48 source-as 102 + 3003:0:8::/48 source-as 103 + 3003:0:9::/48 source-as 102 + +} + + + +# --------------------------------------------------------- +# RPKI-based Origin Validation + + +# Add $INTCOMM_RPKI_UNKNOWN, $INTCOMM_RPKI_INVALID and $INTCOMM_RPKI_VALID +# ext community on the basis of ovs. +match from group clients ovs not-found set { + ext-community $INTCOMM_RPKI_UNKNOWN + ext-community ovs not-found + community 64512:3 +} +match from group clients ovs valid set { + ext-community $INTCOMM_RPKI_VALID + ext-community ovs valid + community 64512:1 +} +match from group clients ovs invalid set { + ext-community $INTCOMM_RPKI_INVALID + ext-community ovs invalid + community 64512:2 +} + + + + + + + + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +deny quick from group clients max-as-len 32 + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +deny quick from group clients community NO_ADVERTISE + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +deny quick from group clients prefix-set bogons + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS1_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +deny quick from 192.0.2.11 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +deny quick from 192.0.2.11 peer-as != 1 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +deny quick from 192.0.2.11 AS 23456 + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +deny quick from 192.0.2.11 AS 64496 - 131071 + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 192.0.2.11 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +deny quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +deny quick from 2001:db8:1:1::11 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +deny quick from 2001:db8:1:1::11 peer-as != 1 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +deny quick from 2001:db8:1:1::11 AS 23456 + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +deny quick from 2001:db8:1:1::11 AS 64496 - 131071 + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +deny quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48 + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::11 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::11 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.22 set community NO_ADVERTISE +match from 192.0.2.22 nexthop 192.0.2.22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.22 community NO_ADVERTISE' - reject code: 5 +deny quick from 192.0.2.22 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.22 peer-as != 2' - reject code: 6 +deny quick from 192.0.2.22 peer-as != 2 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.22 AS 23456' - reject code: 7 +deny quick from 192.0.2.22 AS 23456 + +# Reject inbound routes when 'from 192.0.2.22 AS 64496 - 131071' - reject code: 7 +deny quick from 192.0.2.22 AS 64496 - 131071 + +# Reject inbound routes when 'from 192.0.2.22 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 192.0.2.22 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.22 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +deny quick from 192.0.2.22 prefix 0.0.0.0/0 prefixlen 8 >< 24 + + + +# Remove internal communities before accepting the route +match from 192.0.2.22 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 192.0.2.22 + + + +# --------------------------------------------- +# client AS2_1, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.22 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.22 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.22 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.22 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::22 set community NO_ADVERTISE +match from 2001:db8:1:1::22 nexthop 2001:db8:1:1::22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::22 community NO_ADVERTISE' - reject code: 5 +deny quick from 2001:db8:1:1::22 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::22 peer-as != 2' - reject code: 6 +deny quick from 2001:db8:1:1::22 peer-as != 2 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 23456' - reject code: 7 +deny quick from 2001:db8:1:1::22 AS 23456 + +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 64496 - 131071' - reject code: 7 +deny quick from 2001:db8:1:1::22 AS 64496 - 131071 + +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 2001:db8:1:1::22 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::22 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +deny quick from 2001:db8:1:1::22 prefix ::/0 prefixlen 12 >< 48 + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::22 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 2001:db8:1:1::22 + + + +# --------------------------------------------- +# client AS2_2, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::22 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::22 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::22 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::22 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3_1, inbound + + + +# NEXT_HOP +match from 192.0.2.33 set community NO_ADVERTISE +match from 192.0.2.33 nexthop 192.0.2.33 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.33 community NO_ADVERTISE' - reject code: 5 +deny quick from 192.0.2.33 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.33 peer-as != 3' - reject code: 6 +deny quick from 192.0.2.33 peer-as != 3 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.33 AS 23456' - reject code: 7 +deny quick from 192.0.2.33 AS 23456 + +# Reject inbound routes when 'from 192.0.2.33 AS 64496 - 131071' - reject code: 7 +deny quick from 192.0.2.33 AS 64496 - 131071 + +# Reject inbound routes when 'from 192.0.2.33 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 192.0.2.33 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.33 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +deny quick from 192.0.2.33 prefix 0.0.0.0/0 prefixlen 8 >< 24 + + + +# Remove internal communities before accepting the route +match from 192.0.2.33 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 192.0.2.33 + + + +# --------------------------------------------- +# client AS3_1, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.33 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.33 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.33 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.33 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::33 set community NO_ADVERTISE +match from 2001:db8:1:1::33 nexthop 2001:db8:1:1::33 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::33 community NO_ADVERTISE' - reject code: 5 +deny quick from 2001:db8:1:1::33 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::33 peer-as != 3' - reject code: 6 +deny quick from 2001:db8:1:1::33 peer-as != 3 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::33 AS 23456' - reject code: 7 +deny quick from 2001:db8:1:1::33 AS 23456 + +# Reject inbound routes when 'from 2001:db8:1:1::33 AS 64496 - 131071' - reject code: 7 +deny quick from 2001:db8:1:1::33 AS 64496 - 131071 + +# Reject inbound routes when 'from 2001:db8:1:1::33 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 2001:db8:1:1::33 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::33 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +deny quick from 2001:db8:1:1::33 prefix ::/0 prefixlen 12 >< 48 + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::33 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 2001:db8:1:1::33 + + + +# --------------------------------------------- +# client AS3_2, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::33 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::33 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::33 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::33 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_1, inbound + + + +# NEXT_HOP +match from 192.0.2.44 set community NO_ADVERTISE +match from 192.0.2.44 nexthop 192.0.2.44 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.44 community NO_ADVERTISE' - reject code: 5 +deny quick from 192.0.2.44 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.44 peer-as != 4' - reject code: 6 +deny quick from 192.0.2.44 peer-as != 4 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.44 AS 23456' - reject code: 7 +deny quick from 192.0.2.44 AS 23456 + +# Reject inbound routes when 'from 192.0.2.44 AS 64496 - 131071' - reject code: 7 +deny quick from 192.0.2.44 AS 64496 - 131071 + +# Reject inbound routes when 'from 192.0.2.44 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 192.0.2.44 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.44 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +deny quick from 192.0.2.44 prefix 0.0.0.0/0 prefixlen 8 >< 24 + + + +# Remove internal communities before accepting the route +match from 192.0.2.44 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 192.0.2.44 + + + +# --------------------------------------------- +# client AS4_1, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.44 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.44 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.44 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.44 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::44 set community NO_ADVERTISE +match from 2001:db8:1:1::44 nexthop 2001:db8:1:1::44 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::44 community NO_ADVERTISE' - reject code: 5 +deny quick from 2001:db8:1:1::44 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::44 peer-as != 4' - reject code: 6 +deny quick from 2001:db8:1:1::44 peer-as != 4 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::44 AS 23456' - reject code: 7 +deny quick from 2001:db8:1:1::44 AS 23456 + +# Reject inbound routes when 'from 2001:db8:1:1::44 AS 64496 - 131071' - reject code: 7 +deny quick from 2001:db8:1:1::44 AS 64496 - 131071 + +# Reject inbound routes when 'from 2001:db8:1:1::44 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 2001:db8:1:1::44 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::44 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +deny quick from 2001:db8:1:1::44 prefix ::/0 prefixlen 12 >< 48 + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::44 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 2001:db8:1:1::44 + + + +# --------------------------------------------- +# client AS4_2, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::44 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::44 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::44 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::44 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes +# rpki_bgp_origin_validation_invalid +match to group clients set community delete 64512:2 + +# rpki_bgp_origin_validation_unknown +match to group clients set community delete 64512:3 + +# rpki_bgp_origin_validation_valid +match to group clients set community delete 64512:1 + + +# Scrub prepending communities + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/rpki_bov_comms/configs/RPKICustomBOVCommunitiesScenario_OpenBGPDPortableLatest_IPv4/openbgpd77p.conf b/tests/live_tests/scenarios/rpki_bov_comms/configs/RPKICustomBOVCommunitiesScenario_OpenBGPDPortableLatest_IPv4/openbgpd77p.conf new file mode 100644 index 00000000..ca5f2e31 --- /dev/null +++ b/tests/live_tests/scenarios/rpki_bov_comms/configs/RPKICustomBOVCommunitiesScenario_OpenBGPDPortableLatest_IPv4/openbgpd77p.conf @@ -0,0 +1,1186 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.11 { + remote-as 1 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::11 { + remote-as 1 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.22 { + remote-as 2 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::22 { + remote-as 2 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.33 { + remote-as 3 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::33 { + remote-as 3 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.44 { + remote-as 4 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::44 { + remote-as 4 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# rpki_bgp_origin_validation_invalid +match from group clients set community delete 64512:2 + +# rpki_bgp_origin_validation_unknown +match from group clients set community delete 64512:3 + +# rpki_bgp_origin_validation_valid +match from group clients set community delete 64512:1 + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + +# --------------------------------------------------------- +# ROAs source + + +roa-set { + 2.0.128.0/20 maxlen 23 source-as 101 + 3.0.128.0/20 maxlen 23 source-as 103 + 2.0.8.0/24 source-as 101 + 2.0.9.0/24 source-as 102 + 3.0.8.0/24 source-as 103 + 3.0.9.0/24 source-as 102 + 3002:0:8000::/33 maxlen 34 source-as 101 + 3003:0:8000::/33 maxlen 34 source-as 103 + 3002:0:8::/48 source-as 101 + 3002:0:9::/48 source-as 102 + 3003:0:8::/48 source-as 103 + 3003:0:9::/48 source-as 102 + +} + + + +# --------------------------------------------------------- +# RPKI-based Origin Validation + + +# Add $INTCOMM_RPKI_UNKNOWN, $INTCOMM_RPKI_INVALID and $INTCOMM_RPKI_VALID +# ext community on the basis of ovs. +match from group clients ovs not-found set { + ext-community $INTCOMM_RPKI_UNKNOWN + ext-community ovs not-found + community 64512:3 +} +match from group clients ovs valid set { + ext-community $INTCOMM_RPKI_VALID + ext-community ovs valid + community 64512:1 +} +match from group clients ovs invalid set { + ext-community $INTCOMM_RPKI_INVALID + ext-community ovs invalid + community 64512:2 +} + + + + + + + + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +deny quick from group clients max-as-len 32 + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +deny quick from group clients community NO_ADVERTISE + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +deny quick from group clients prefix-set bogons + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS1_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +deny quick from 192.0.2.11 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +deny quick from 192.0.2.11 peer-as != 1 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +deny quick from 192.0.2.11 AS 23456 + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +deny quick from 192.0.2.11 AS 64496 - 131071 + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 192.0.2.11 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +deny quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +deny quick from 2001:db8:1:1::11 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +deny quick from 2001:db8:1:1::11 peer-as != 1 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +deny quick from 2001:db8:1:1::11 AS 23456 + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +deny quick from 2001:db8:1:1::11 AS 64496 - 131071 + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +deny quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48 + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::11 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::11 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.22 set community NO_ADVERTISE +match from 192.0.2.22 nexthop 192.0.2.22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.22 community NO_ADVERTISE' - reject code: 5 +deny quick from 192.0.2.22 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.22 peer-as != 2' - reject code: 6 +deny quick from 192.0.2.22 peer-as != 2 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.22 AS 23456' - reject code: 7 +deny quick from 192.0.2.22 AS 23456 + +# Reject inbound routes when 'from 192.0.2.22 AS 64496 - 131071' - reject code: 7 +deny quick from 192.0.2.22 AS 64496 - 131071 + +# Reject inbound routes when 'from 192.0.2.22 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 192.0.2.22 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.22 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +deny quick from 192.0.2.22 prefix 0.0.0.0/0 prefixlen 8 >< 24 + + + +# Remove internal communities before accepting the route +match from 192.0.2.22 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 192.0.2.22 + + + +# --------------------------------------------- +# client AS2_1, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.22 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.22 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.22 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.22 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::22 set community NO_ADVERTISE +match from 2001:db8:1:1::22 nexthop 2001:db8:1:1::22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::22 community NO_ADVERTISE' - reject code: 5 +deny quick from 2001:db8:1:1::22 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::22 peer-as != 2' - reject code: 6 +deny quick from 2001:db8:1:1::22 peer-as != 2 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 23456' - reject code: 7 +deny quick from 2001:db8:1:1::22 AS 23456 + +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 64496 - 131071' - reject code: 7 +deny quick from 2001:db8:1:1::22 AS 64496 - 131071 + +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 2001:db8:1:1::22 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::22 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +deny quick from 2001:db8:1:1::22 prefix ::/0 prefixlen 12 >< 48 + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::22 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 2001:db8:1:1::22 + + + +# --------------------------------------------- +# client AS2_2, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::22 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::22 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::22 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::22 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3_1, inbound + + + +# NEXT_HOP +match from 192.0.2.33 set community NO_ADVERTISE +match from 192.0.2.33 nexthop 192.0.2.33 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.33 community NO_ADVERTISE' - reject code: 5 +deny quick from 192.0.2.33 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.33 peer-as != 3' - reject code: 6 +deny quick from 192.0.2.33 peer-as != 3 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.33 AS 23456' - reject code: 7 +deny quick from 192.0.2.33 AS 23456 + +# Reject inbound routes when 'from 192.0.2.33 AS 64496 - 131071' - reject code: 7 +deny quick from 192.0.2.33 AS 64496 - 131071 + +# Reject inbound routes when 'from 192.0.2.33 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 192.0.2.33 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.33 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +deny quick from 192.0.2.33 prefix 0.0.0.0/0 prefixlen 8 >< 24 + + + +# Remove internal communities before accepting the route +match from 192.0.2.33 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 192.0.2.33 + + + +# --------------------------------------------- +# client AS3_1, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.33 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.33 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.33 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.33 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::33 set community NO_ADVERTISE +match from 2001:db8:1:1::33 nexthop 2001:db8:1:1::33 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::33 community NO_ADVERTISE' - reject code: 5 +deny quick from 2001:db8:1:1::33 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::33 peer-as != 3' - reject code: 6 +deny quick from 2001:db8:1:1::33 peer-as != 3 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::33 AS 23456' - reject code: 7 +deny quick from 2001:db8:1:1::33 AS 23456 + +# Reject inbound routes when 'from 2001:db8:1:1::33 AS 64496 - 131071' - reject code: 7 +deny quick from 2001:db8:1:1::33 AS 64496 - 131071 + +# Reject inbound routes when 'from 2001:db8:1:1::33 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 2001:db8:1:1::33 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::33 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +deny quick from 2001:db8:1:1::33 prefix ::/0 prefixlen 12 >< 48 + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::33 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 2001:db8:1:1::33 + + + +# --------------------------------------------- +# client AS3_2, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::33 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::33 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::33 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::33 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_1, inbound + + + +# NEXT_HOP +match from 192.0.2.44 set community NO_ADVERTISE +match from 192.0.2.44 nexthop 192.0.2.44 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.44 community NO_ADVERTISE' - reject code: 5 +deny quick from 192.0.2.44 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.44 peer-as != 4' - reject code: 6 +deny quick from 192.0.2.44 peer-as != 4 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.44 AS 23456' - reject code: 7 +deny quick from 192.0.2.44 AS 23456 + +# Reject inbound routes when 'from 192.0.2.44 AS 64496 - 131071' - reject code: 7 +deny quick from 192.0.2.44 AS 64496 - 131071 + +# Reject inbound routes when 'from 192.0.2.44 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 192.0.2.44 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.44 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +deny quick from 192.0.2.44 prefix 0.0.0.0/0 prefixlen 8 >< 24 + + + +# Remove internal communities before accepting the route +match from 192.0.2.44 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 192.0.2.44 + + + +# --------------------------------------------- +# client AS4_1, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.44 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.44 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.44 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.44 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::44 set community NO_ADVERTISE +match from 2001:db8:1:1::44 nexthop 2001:db8:1:1::44 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::44 community NO_ADVERTISE' - reject code: 5 +deny quick from 2001:db8:1:1::44 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::44 peer-as != 4' - reject code: 6 +deny quick from 2001:db8:1:1::44 peer-as != 4 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::44 AS 23456' - reject code: 7 +deny quick from 2001:db8:1:1::44 AS 23456 + +# Reject inbound routes when 'from 2001:db8:1:1::44 AS 64496 - 131071' - reject code: 7 +deny quick from 2001:db8:1:1::44 AS 64496 - 131071 + +# Reject inbound routes when 'from 2001:db8:1:1::44 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 2001:db8:1:1::44 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::44 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +deny quick from 2001:db8:1:1::44 prefix ::/0 prefixlen 12 >< 48 + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::44 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 2001:db8:1:1::44 + + + +# --------------------------------------------- +# client AS4_2, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::44 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::44 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::44 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::44 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes +# rpki_bgp_origin_validation_invalid +match to group clients set community delete 64512:2 + +# rpki_bgp_origin_validation_unknown +match to group clients set community delete 64512:3 + +# rpki_bgp_origin_validation_valid +match to group clients set community delete 64512:1 + + +# Scrub prepending communities + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/rpki_bov_comms/configs/RPKICustomBOVCommunitiesScenario_OpenBGPDPortableLatest_IPv6/openbgpd76p.conf b/tests/live_tests/scenarios/rpki_bov_comms/configs/RPKICustomBOVCommunitiesScenario_OpenBGPDPortableLatest_IPv6/openbgpd76p.conf new file mode 100644 index 00000000..ca5f2e31 --- /dev/null +++ b/tests/live_tests/scenarios/rpki_bov_comms/configs/RPKICustomBOVCommunitiesScenario_OpenBGPDPortableLatest_IPv6/openbgpd76p.conf @@ -0,0 +1,1186 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.11 { + remote-as 1 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::11 { + remote-as 1 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.22 { + remote-as 2 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::22 { + remote-as 2 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.33 { + remote-as 3 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::33 { + remote-as 3 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.44 { + remote-as 4 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::44 { + remote-as 4 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# rpki_bgp_origin_validation_invalid +match from group clients set community delete 64512:2 + +# rpki_bgp_origin_validation_unknown +match from group clients set community delete 64512:3 + +# rpki_bgp_origin_validation_valid +match from group clients set community delete 64512:1 + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + +# --------------------------------------------------------- +# ROAs source + + +roa-set { + 2.0.128.0/20 maxlen 23 source-as 101 + 3.0.128.0/20 maxlen 23 source-as 103 + 2.0.8.0/24 source-as 101 + 2.0.9.0/24 source-as 102 + 3.0.8.0/24 source-as 103 + 3.0.9.0/24 source-as 102 + 3002:0:8000::/33 maxlen 34 source-as 101 + 3003:0:8000::/33 maxlen 34 source-as 103 + 3002:0:8::/48 source-as 101 + 3002:0:9::/48 source-as 102 + 3003:0:8::/48 source-as 103 + 3003:0:9::/48 source-as 102 + +} + + + +# --------------------------------------------------------- +# RPKI-based Origin Validation + + +# Add $INTCOMM_RPKI_UNKNOWN, $INTCOMM_RPKI_INVALID and $INTCOMM_RPKI_VALID +# ext community on the basis of ovs. +match from group clients ovs not-found set { + ext-community $INTCOMM_RPKI_UNKNOWN + ext-community ovs not-found + community 64512:3 +} +match from group clients ovs valid set { + ext-community $INTCOMM_RPKI_VALID + ext-community ovs valid + community 64512:1 +} +match from group clients ovs invalid set { + ext-community $INTCOMM_RPKI_INVALID + ext-community ovs invalid + community 64512:2 +} + + + + + + + + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +deny quick from group clients max-as-len 32 + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +deny quick from group clients community NO_ADVERTISE + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +deny quick from group clients prefix-set bogons + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS1_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +deny quick from 192.0.2.11 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +deny quick from 192.0.2.11 peer-as != 1 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +deny quick from 192.0.2.11 AS 23456 + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +deny quick from 192.0.2.11 AS 64496 - 131071 + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 192.0.2.11 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +deny quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +deny quick from 2001:db8:1:1::11 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +deny quick from 2001:db8:1:1::11 peer-as != 1 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +deny quick from 2001:db8:1:1::11 AS 23456 + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +deny quick from 2001:db8:1:1::11 AS 64496 - 131071 + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +deny quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48 + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::11 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::11 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.22 set community NO_ADVERTISE +match from 192.0.2.22 nexthop 192.0.2.22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.22 community NO_ADVERTISE' - reject code: 5 +deny quick from 192.0.2.22 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.22 peer-as != 2' - reject code: 6 +deny quick from 192.0.2.22 peer-as != 2 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.22 AS 23456' - reject code: 7 +deny quick from 192.0.2.22 AS 23456 + +# Reject inbound routes when 'from 192.0.2.22 AS 64496 - 131071' - reject code: 7 +deny quick from 192.0.2.22 AS 64496 - 131071 + +# Reject inbound routes when 'from 192.0.2.22 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 192.0.2.22 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.22 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +deny quick from 192.0.2.22 prefix 0.0.0.0/0 prefixlen 8 >< 24 + + + +# Remove internal communities before accepting the route +match from 192.0.2.22 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 192.0.2.22 + + + +# --------------------------------------------- +# client AS2_1, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.22 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.22 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.22 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.22 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::22 set community NO_ADVERTISE +match from 2001:db8:1:1::22 nexthop 2001:db8:1:1::22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::22 community NO_ADVERTISE' - reject code: 5 +deny quick from 2001:db8:1:1::22 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::22 peer-as != 2' - reject code: 6 +deny quick from 2001:db8:1:1::22 peer-as != 2 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 23456' - reject code: 7 +deny quick from 2001:db8:1:1::22 AS 23456 + +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 64496 - 131071' - reject code: 7 +deny quick from 2001:db8:1:1::22 AS 64496 - 131071 + +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 2001:db8:1:1::22 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::22 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +deny quick from 2001:db8:1:1::22 prefix ::/0 prefixlen 12 >< 48 + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::22 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 2001:db8:1:1::22 + + + +# --------------------------------------------- +# client AS2_2, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::22 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::22 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::22 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::22 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3_1, inbound + + + +# NEXT_HOP +match from 192.0.2.33 set community NO_ADVERTISE +match from 192.0.2.33 nexthop 192.0.2.33 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.33 community NO_ADVERTISE' - reject code: 5 +deny quick from 192.0.2.33 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.33 peer-as != 3' - reject code: 6 +deny quick from 192.0.2.33 peer-as != 3 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.33 AS 23456' - reject code: 7 +deny quick from 192.0.2.33 AS 23456 + +# Reject inbound routes when 'from 192.0.2.33 AS 64496 - 131071' - reject code: 7 +deny quick from 192.0.2.33 AS 64496 - 131071 + +# Reject inbound routes when 'from 192.0.2.33 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 192.0.2.33 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.33 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +deny quick from 192.0.2.33 prefix 0.0.0.0/0 prefixlen 8 >< 24 + + + +# Remove internal communities before accepting the route +match from 192.0.2.33 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 192.0.2.33 + + + +# --------------------------------------------- +# client AS3_1, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.33 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.33 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.33 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.33 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::33 set community NO_ADVERTISE +match from 2001:db8:1:1::33 nexthop 2001:db8:1:1::33 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::33 community NO_ADVERTISE' - reject code: 5 +deny quick from 2001:db8:1:1::33 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::33 peer-as != 3' - reject code: 6 +deny quick from 2001:db8:1:1::33 peer-as != 3 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::33 AS 23456' - reject code: 7 +deny quick from 2001:db8:1:1::33 AS 23456 + +# Reject inbound routes when 'from 2001:db8:1:1::33 AS 64496 - 131071' - reject code: 7 +deny quick from 2001:db8:1:1::33 AS 64496 - 131071 + +# Reject inbound routes when 'from 2001:db8:1:1::33 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 2001:db8:1:1::33 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::33 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +deny quick from 2001:db8:1:1::33 prefix ::/0 prefixlen 12 >< 48 + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::33 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 2001:db8:1:1::33 + + + +# --------------------------------------------- +# client AS3_2, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::33 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::33 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::33 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::33 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_1, inbound + + + +# NEXT_HOP +match from 192.0.2.44 set community NO_ADVERTISE +match from 192.0.2.44 nexthop 192.0.2.44 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.44 community NO_ADVERTISE' - reject code: 5 +deny quick from 192.0.2.44 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.44 peer-as != 4' - reject code: 6 +deny quick from 192.0.2.44 peer-as != 4 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.44 AS 23456' - reject code: 7 +deny quick from 192.0.2.44 AS 23456 + +# Reject inbound routes when 'from 192.0.2.44 AS 64496 - 131071' - reject code: 7 +deny quick from 192.0.2.44 AS 64496 - 131071 + +# Reject inbound routes when 'from 192.0.2.44 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 192.0.2.44 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.44 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +deny quick from 192.0.2.44 prefix 0.0.0.0/0 prefixlen 8 >< 24 + + + +# Remove internal communities before accepting the route +match from 192.0.2.44 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 192.0.2.44 + + + +# --------------------------------------------- +# client AS4_1, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.44 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.44 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.44 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.44 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::44 set community NO_ADVERTISE +match from 2001:db8:1:1::44 nexthop 2001:db8:1:1::44 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::44 community NO_ADVERTISE' - reject code: 5 +deny quick from 2001:db8:1:1::44 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::44 peer-as != 4' - reject code: 6 +deny quick from 2001:db8:1:1::44 peer-as != 4 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::44 AS 23456' - reject code: 7 +deny quick from 2001:db8:1:1::44 AS 23456 + +# Reject inbound routes when 'from 2001:db8:1:1::44 AS 64496 - 131071' - reject code: 7 +deny quick from 2001:db8:1:1::44 AS 64496 - 131071 + +# Reject inbound routes when 'from 2001:db8:1:1::44 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 2001:db8:1:1::44 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::44 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +deny quick from 2001:db8:1:1::44 prefix ::/0 prefixlen 12 >< 48 + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::44 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 2001:db8:1:1::44 + + + +# --------------------------------------------- +# client AS4_2, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::44 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::44 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::44 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::44 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes +# rpki_bgp_origin_validation_invalid +match to group clients set community delete 64512:2 + +# rpki_bgp_origin_validation_unknown +match to group clients set community delete 64512:3 + +# rpki_bgp_origin_validation_valid +match to group clients set community delete 64512:1 + + +# Scrub prepending communities + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/rpki_bov_comms/configs/RPKICustomBOVCommunitiesScenario_OpenBGPDPortableLatest_IPv6/openbgpd77p.conf b/tests/live_tests/scenarios/rpki_bov_comms/configs/RPKICustomBOVCommunitiesScenario_OpenBGPDPortableLatest_IPv6/openbgpd77p.conf new file mode 100644 index 00000000..ca5f2e31 --- /dev/null +++ b/tests/live_tests/scenarios/rpki_bov_comms/configs/RPKICustomBOVCommunitiesScenario_OpenBGPDPortableLatest_IPv6/openbgpd77p.conf @@ -0,0 +1,1186 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.11 { + remote-as 1 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::11 { + remote-as 1 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.22 { + remote-as 2 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::22 { + remote-as 2 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.33 { + remote-as 3 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::33 { + remote-as 3 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.44 { + remote-as 4 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::44 { + remote-as 4 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# rpki_bgp_origin_validation_invalid +match from group clients set community delete 64512:2 + +# rpki_bgp_origin_validation_unknown +match from group clients set community delete 64512:3 + +# rpki_bgp_origin_validation_valid +match from group clients set community delete 64512:1 + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + +# --------------------------------------------------------- +# ROAs source + + +roa-set { + 2.0.128.0/20 maxlen 23 source-as 101 + 3.0.128.0/20 maxlen 23 source-as 103 + 2.0.8.0/24 source-as 101 + 2.0.9.0/24 source-as 102 + 3.0.8.0/24 source-as 103 + 3.0.9.0/24 source-as 102 + 3002:0:8000::/33 maxlen 34 source-as 101 + 3003:0:8000::/33 maxlen 34 source-as 103 + 3002:0:8::/48 source-as 101 + 3002:0:9::/48 source-as 102 + 3003:0:8::/48 source-as 103 + 3003:0:9::/48 source-as 102 + +} + + + +# --------------------------------------------------------- +# RPKI-based Origin Validation + + +# Add $INTCOMM_RPKI_UNKNOWN, $INTCOMM_RPKI_INVALID and $INTCOMM_RPKI_VALID +# ext community on the basis of ovs. +match from group clients ovs not-found set { + ext-community $INTCOMM_RPKI_UNKNOWN + ext-community ovs not-found + community 64512:3 +} +match from group clients ovs valid set { + ext-community $INTCOMM_RPKI_VALID + ext-community ovs valid + community 64512:1 +} +match from group clients ovs invalid set { + ext-community $INTCOMM_RPKI_INVALID + ext-community ovs invalid + community 64512:2 +} + + + + + + + + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +deny quick from group clients max-as-len 32 + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +deny quick from group clients community NO_ADVERTISE + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +deny quick from group clients prefix-set bogons + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS1_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +deny quick from 192.0.2.11 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +deny quick from 192.0.2.11 peer-as != 1 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +deny quick from 192.0.2.11 AS 23456 + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +deny quick from 192.0.2.11 AS 64496 - 131071 + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 192.0.2.11 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +deny quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +deny quick from 2001:db8:1:1::11 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +deny quick from 2001:db8:1:1::11 peer-as != 1 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +deny quick from 2001:db8:1:1::11 AS 23456 + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +deny quick from 2001:db8:1:1::11 AS 64496 - 131071 + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +deny quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48 + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::11 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::11 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.22 set community NO_ADVERTISE +match from 192.0.2.22 nexthop 192.0.2.22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.22 community NO_ADVERTISE' - reject code: 5 +deny quick from 192.0.2.22 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.22 peer-as != 2' - reject code: 6 +deny quick from 192.0.2.22 peer-as != 2 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.22 AS 23456' - reject code: 7 +deny quick from 192.0.2.22 AS 23456 + +# Reject inbound routes when 'from 192.0.2.22 AS 64496 - 131071' - reject code: 7 +deny quick from 192.0.2.22 AS 64496 - 131071 + +# Reject inbound routes when 'from 192.0.2.22 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 192.0.2.22 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.22 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +deny quick from 192.0.2.22 prefix 0.0.0.0/0 prefixlen 8 >< 24 + + + +# Remove internal communities before accepting the route +match from 192.0.2.22 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 192.0.2.22 + + + +# --------------------------------------------- +# client AS2_1, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.22 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.22 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.22 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.22 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::22 set community NO_ADVERTISE +match from 2001:db8:1:1::22 nexthop 2001:db8:1:1::22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::22 community NO_ADVERTISE' - reject code: 5 +deny quick from 2001:db8:1:1::22 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::22 peer-as != 2' - reject code: 6 +deny quick from 2001:db8:1:1::22 peer-as != 2 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 23456' - reject code: 7 +deny quick from 2001:db8:1:1::22 AS 23456 + +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 64496 - 131071' - reject code: 7 +deny quick from 2001:db8:1:1::22 AS 64496 - 131071 + +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 2001:db8:1:1::22 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::22 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +deny quick from 2001:db8:1:1::22 prefix ::/0 prefixlen 12 >< 48 + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::22 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 2001:db8:1:1::22 + + + +# --------------------------------------------- +# client AS2_2, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::22 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::22 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::22 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::22 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3_1, inbound + + + +# NEXT_HOP +match from 192.0.2.33 set community NO_ADVERTISE +match from 192.0.2.33 nexthop 192.0.2.33 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.33 community NO_ADVERTISE' - reject code: 5 +deny quick from 192.0.2.33 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.33 peer-as != 3' - reject code: 6 +deny quick from 192.0.2.33 peer-as != 3 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.33 AS 23456' - reject code: 7 +deny quick from 192.0.2.33 AS 23456 + +# Reject inbound routes when 'from 192.0.2.33 AS 64496 - 131071' - reject code: 7 +deny quick from 192.0.2.33 AS 64496 - 131071 + +# Reject inbound routes when 'from 192.0.2.33 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 192.0.2.33 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.33 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +deny quick from 192.0.2.33 prefix 0.0.0.0/0 prefixlen 8 >< 24 + + + +# Remove internal communities before accepting the route +match from 192.0.2.33 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 192.0.2.33 + + + +# --------------------------------------------- +# client AS3_1, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.33 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.33 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.33 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.33 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::33 set community NO_ADVERTISE +match from 2001:db8:1:1::33 nexthop 2001:db8:1:1::33 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::33 community NO_ADVERTISE' - reject code: 5 +deny quick from 2001:db8:1:1::33 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::33 peer-as != 3' - reject code: 6 +deny quick from 2001:db8:1:1::33 peer-as != 3 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::33 AS 23456' - reject code: 7 +deny quick from 2001:db8:1:1::33 AS 23456 + +# Reject inbound routes when 'from 2001:db8:1:1::33 AS 64496 - 131071' - reject code: 7 +deny quick from 2001:db8:1:1::33 AS 64496 - 131071 + +# Reject inbound routes when 'from 2001:db8:1:1::33 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 2001:db8:1:1::33 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::33 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +deny quick from 2001:db8:1:1::33 prefix ::/0 prefixlen 12 >< 48 + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::33 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 2001:db8:1:1::33 + + + +# --------------------------------------------- +# client AS3_2, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::33 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::33 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::33 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::33 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_1, inbound + + + +# NEXT_HOP +match from 192.0.2.44 set community NO_ADVERTISE +match from 192.0.2.44 nexthop 192.0.2.44 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.44 community NO_ADVERTISE' - reject code: 5 +deny quick from 192.0.2.44 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.44 peer-as != 4' - reject code: 6 +deny quick from 192.0.2.44 peer-as != 4 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.44 AS 23456' - reject code: 7 +deny quick from 192.0.2.44 AS 23456 + +# Reject inbound routes when 'from 192.0.2.44 AS 64496 - 131071' - reject code: 7 +deny quick from 192.0.2.44 AS 64496 - 131071 + +# Reject inbound routes when 'from 192.0.2.44 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 192.0.2.44 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.44 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +deny quick from 192.0.2.44 prefix 0.0.0.0/0 prefixlen 8 >< 24 + + + +# Remove internal communities before accepting the route +match from 192.0.2.44 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 192.0.2.44 + + + +# --------------------------------------------- +# client AS4_1, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.44 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.44 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.44 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.44 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::44 set community NO_ADVERTISE +match from 2001:db8:1:1::44 nexthop 2001:db8:1:1::44 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::44 community NO_ADVERTISE' - reject code: 5 +deny quick from 2001:db8:1:1::44 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::44 peer-as != 4' - reject code: 6 +deny quick from 2001:db8:1:1::44 peer-as != 4 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::44 AS 23456' - reject code: 7 +deny quick from 2001:db8:1:1::44 AS 23456 + +# Reject inbound routes when 'from 2001:db8:1:1::44 AS 64496 - 131071' - reject code: 7 +deny quick from 2001:db8:1:1::44 AS 64496 - 131071 + +# Reject inbound routes when 'from 2001:db8:1:1::44 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 2001:db8:1:1::44 AS 4200000000 - 4294967295 + + + + + + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::44 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +deny quick from 2001:db8:1:1::44 prefix ::/0 prefixlen 12 >< 48 + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::44 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 2001:db8:1:1::44 + + + +# --------------------------------------------- +# client AS4_2, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::44 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::44 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::44 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::44 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes +# rpki_bgp_origin_validation_invalid +match to group clients set community delete 64512:2 + +# rpki_bgp_origin_validation_unknown +match to group clients set community delete 64512:3 + +# rpki_bgp_origin_validation_valid +match to group clients set community delete 64512:1 + + +# Scrub prepending communities + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/rpki_rtr_example/configs/RPKIRTRScenario_OpenBGPDIPv4/openbgpd76p.conf b/tests/live_tests/scenarios/rpki_rtr_example/configs/RPKIRTRScenario_OpenBGPDIPv4/openbgpd76p.conf new file mode 100644 index 00000000..62594272 --- /dev/null +++ b/tests/live_tests/scenarios/rpki_rtr_example/configs/RPKIRTRScenario_OpenBGPDIPv4/openbgpd76p.conf @@ -0,0 +1,802 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + +# AS3333, used by client AS3333_1 +# no origin ASNs found for AS3333 +# no prefixes found for AS3333 + +# AS10745, used by client AS10745_1, client AS10745_2 +# no origin ASNs found for AS10745 +# no prefixes found for AS10745 + +# AS1, used by client AS1_1 +# no origin ASNs found for AS1 +# no prefixes found for AS1 + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.22 { + remote-as 10745 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::22 { + remote-as 10745 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.111 { + remote-as 1 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 192.0.2.11 { + remote-as 3333 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + +# --------------------------------------------------------- +# ROAs source + + +include "/etc/bgpd/rpki_rtr_config.local" + + + +# --------------------------------------------------------- +# RPKI-based Origin Validation + + +# Add $INTCOMM_RPKI_UNKNOWN, $INTCOMM_RPKI_INVALID and $INTCOMM_RPKI_VALID +# ext community on the basis of ovs. +match from group clients ovs not-found set { + ext-community $INTCOMM_RPKI_UNKNOWN + ext-community ovs not-found + +} +match from group clients ovs valid set { + ext-community $INTCOMM_RPKI_VALID + ext-community ovs valid + +} +match from group clients ovs invalid set { + ext-community $INTCOMM_RPKI_INVALID + ext-community ovs invalid + +} + + + + + + + + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +deny quick from group clients max-as-len 32 + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +deny quick from group clients community NO_ADVERTISE + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +deny quick from group clients prefix-set bogons + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS10745_1, inbound + + + +# NEXT_HOP +match from 192.0.2.22 set community NO_ADVERTISE +match from 192.0.2.22 nexthop 192.0.2.22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.22 community NO_ADVERTISE' - reject code: 5 +deny quick from 192.0.2.22 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.22 peer-as != 10745' - reject code: 6 +deny quick from 192.0.2.22 peer-as != 10745 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.22 AS 23456' - reject code: 7 +deny quick from 192.0.2.22 AS 23456 + +# Reject inbound routes when 'from 192.0.2.22 AS 64496 - 131071' - reject code: 7 +deny quick from 192.0.2.22 AS 64496 - 131071 + +# Reject inbound routes when 'from 192.0.2.22 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 192.0.2.22 AS 4200000000 - 4294967295 + + + + + +match from 192.0.2.22 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS10745_1, AS10745: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.22 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS10745 referenced but empty. + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS10745_1, AS10745: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.22 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS10745 referenced but empty. + + + + + + + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.22 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +deny quick from 192.0.2.22 ext-community $INTCOMM_RPKI_INVALID + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.22 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +deny quick from 192.0.2.22 prefix 0.0.0.0/0 prefixlen 8 >< 24 + + + +# Remove internal communities before accepting the route +match from 192.0.2.22 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 192.0.2.22 + + + +# --------------------------------------------- +# client AS10745_1, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.22 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.22 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.22 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.22 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS10745_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::22 set community NO_ADVERTISE +match from 2001:db8:1:1::22 nexthop 2001:db8:1:1::22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::22 community NO_ADVERTISE' - reject code: 5 +deny quick from 2001:db8:1:1::22 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::22 peer-as != 10745' - reject code: 6 +deny quick from 2001:db8:1:1::22 peer-as != 10745 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 23456' - reject code: 7 +deny quick from 2001:db8:1:1::22 AS 23456 + +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 64496 - 131071' - reject code: 7 +deny quick from 2001:db8:1:1::22 AS 64496 - 131071 + +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 2001:db8:1:1::22 AS 4200000000 - 4294967295 + + + + + +match from 2001:db8:1:1::22 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS10745_2, AS10745: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::22 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS10745 referenced but empty. + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS10745_2, AS10745: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::22 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS10745 referenced but empty. + + + + + + + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::22 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +deny quick from 2001:db8:1:1::22 ext-community $INTCOMM_RPKI_INVALID + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::22 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +deny quick from 2001:db8:1:1::22 prefix ::/0 prefixlen 12 >< 48 + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::22 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 2001:db8:1:1::22 + + + +# --------------------------------------------- +# client AS10745_2, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::22 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::22 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::22 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::22 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_1, inbound + + + +# NEXT_HOP +match from 192.0.2.111 set community NO_ADVERTISE +match from 192.0.2.111 nexthop 192.0.2.111 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.111 community NO_ADVERTISE' - reject code: 5 +deny quick from 192.0.2.111 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.111 peer-as != 1' - reject code: 6 +deny quick from 192.0.2.111 peer-as != 1 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.111 AS 23456' - reject code: 7 +deny quick from 192.0.2.111 AS 23456 + +# Reject inbound routes when 'from 192.0.2.111 AS 64496 - 131071' - reject code: 7 +deny quick from 192.0.2.111 AS 64496 - 131071 + +# Reject inbound routes when 'from 192.0.2.111 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 192.0.2.111 AS 4200000000 - 4294967295 + + + + + +match from 192.0.2.111 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_1, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.111 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS1 referenced but empty. + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_1, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.111 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS1 referenced but empty. + + + + + + + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.111 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +deny quick from 192.0.2.111 ext-community $INTCOMM_RPKI_INVALID + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.111 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +deny quick from 192.0.2.111 prefix 0.0.0.0/0 prefixlen 8 >< 24 + + + +# Remove internal communities before accepting the route +match from 192.0.2.111 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 192.0.2.111 + + + +# --------------------------------------------- +# client AS1_1, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.111 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.111 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.111 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.111 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3333_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +deny quick from 192.0.2.11 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 3333' - reject code: 6 +deny quick from 192.0.2.11 peer-as != 3333 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +deny quick from 192.0.2.11 AS 23456 + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +deny quick from 192.0.2.11 AS 64496 - 131071 + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 192.0.2.11 AS 4200000000 - 4294967295 + + + + + +match from 192.0.2.11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS3333_1, AS3333: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS3333 referenced but empty. + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS3333_1, AS3333: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS3333 referenced but empty. + + + + + + + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +deny quick from 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +deny quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS3333_1, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes + +# Scrub prepending communities + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/rpki_rtr_example/configs/RPKIRTRScenario_OpenBGPDIPv4/openbgpd77p.conf b/tests/live_tests/scenarios/rpki_rtr_example/configs/RPKIRTRScenario_OpenBGPDIPv4/openbgpd77p.conf new file mode 100644 index 00000000..62594272 --- /dev/null +++ b/tests/live_tests/scenarios/rpki_rtr_example/configs/RPKIRTRScenario_OpenBGPDIPv4/openbgpd77p.conf @@ -0,0 +1,802 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + +# AS3333, used by client AS3333_1 +# no origin ASNs found for AS3333 +# no prefixes found for AS3333 + +# AS10745, used by client AS10745_1, client AS10745_2 +# no origin ASNs found for AS10745 +# no prefixes found for AS10745 + +# AS1, used by client AS1_1 +# no origin ASNs found for AS1 +# no prefixes found for AS1 + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.22 { + remote-as 10745 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::22 { + remote-as 10745 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.111 { + remote-as 1 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 192.0.2.11 { + remote-as 3333 + + rde evaluate all + + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + +# --------------------------------------------------------- +# ROAs source + + +include "/etc/bgpd/rpki_rtr_config.local" + + + +# --------------------------------------------------------- +# RPKI-based Origin Validation + + +# Add $INTCOMM_RPKI_UNKNOWN, $INTCOMM_RPKI_INVALID and $INTCOMM_RPKI_VALID +# ext community on the basis of ovs. +match from group clients ovs not-found set { + ext-community $INTCOMM_RPKI_UNKNOWN + ext-community ovs not-found + +} +match from group clients ovs valid set { + ext-community $INTCOMM_RPKI_VALID + ext-community ovs valid + +} +match from group clients ovs invalid set { + ext-community $INTCOMM_RPKI_INVALID + ext-community ovs invalid + +} + + + + + + + + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +deny quick from group clients max-as-len 32 + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +deny quick from group clients community NO_ADVERTISE + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +deny quick from group clients prefix-set bogons + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS10745_1, inbound + + + +# NEXT_HOP +match from 192.0.2.22 set community NO_ADVERTISE +match from 192.0.2.22 nexthop 192.0.2.22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.22 community NO_ADVERTISE' - reject code: 5 +deny quick from 192.0.2.22 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.22 peer-as != 10745' - reject code: 6 +deny quick from 192.0.2.22 peer-as != 10745 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.22 AS 23456' - reject code: 7 +deny quick from 192.0.2.22 AS 23456 + +# Reject inbound routes when 'from 192.0.2.22 AS 64496 - 131071' - reject code: 7 +deny quick from 192.0.2.22 AS 64496 - 131071 + +# Reject inbound routes when 'from 192.0.2.22 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 192.0.2.22 AS 4200000000 - 4294967295 + + + + + +match from 192.0.2.22 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS10745_1, AS10745: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.22 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS10745 referenced but empty. + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS10745_1, AS10745: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.22 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS10745 referenced but empty. + + + + + + + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.22 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +deny quick from 192.0.2.22 ext-community $INTCOMM_RPKI_INVALID + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.22 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +deny quick from 192.0.2.22 prefix 0.0.0.0/0 prefixlen 8 >< 24 + + + +# Remove internal communities before accepting the route +match from 192.0.2.22 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 192.0.2.22 + + + +# --------------------------------------------- +# client AS10745_1, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.22 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.22 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.22 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.22 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS10745_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::22 set community NO_ADVERTISE +match from 2001:db8:1:1::22 nexthop 2001:db8:1:1::22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::22 community NO_ADVERTISE' - reject code: 5 +deny quick from 2001:db8:1:1::22 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::22 peer-as != 10745' - reject code: 6 +deny quick from 2001:db8:1:1::22 peer-as != 10745 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 23456' - reject code: 7 +deny quick from 2001:db8:1:1::22 AS 23456 + +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 64496 - 131071' - reject code: 7 +deny quick from 2001:db8:1:1::22 AS 64496 - 131071 + +# Reject inbound routes when 'from 2001:db8:1:1::22 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 2001:db8:1:1::22 AS 4200000000 - 4294967295 + + + + + +match from 2001:db8:1:1::22 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS10745_2, AS10745: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::22 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS10745 referenced but empty. + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS10745_2, AS10745: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::22 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS10745 referenced but empty. + + + + + + + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::22 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +deny quick from 2001:db8:1:1::22 ext-community $INTCOMM_RPKI_INVALID + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::22 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +deny quick from 2001:db8:1:1::22 prefix ::/0 prefixlen 12 >< 48 + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::22 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 2001:db8:1:1::22 + + + +# --------------------------------------------- +# client AS10745_2, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::22 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::22 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::22 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::22 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_1, inbound + + + +# NEXT_HOP +match from 192.0.2.111 set community NO_ADVERTISE +match from 192.0.2.111 nexthop 192.0.2.111 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.111 community NO_ADVERTISE' - reject code: 5 +deny quick from 192.0.2.111 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.111 peer-as != 1' - reject code: 6 +deny quick from 192.0.2.111 peer-as != 1 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.111 AS 23456' - reject code: 7 +deny quick from 192.0.2.111 AS 23456 + +# Reject inbound routes when 'from 192.0.2.111 AS 64496 - 131071' - reject code: 7 +deny quick from 192.0.2.111 AS 64496 - 131071 + +# Reject inbound routes when 'from 192.0.2.111 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 192.0.2.111 AS 4200000000 - 4294967295 + + + + + +match from 192.0.2.111 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_1, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.111 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS1 referenced but empty. + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_1, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.111 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS1 referenced but empty. + + + + + + + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.111 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +deny quick from 192.0.2.111 ext-community $INTCOMM_RPKI_INVALID + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.111 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +deny quick from 192.0.2.111 prefix 0.0.0.0/0 prefixlen 8 >< 24 + + + +# Remove internal communities before accepting the route +match from 192.0.2.111 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 192.0.2.111 + + + +# --------------------------------------------- +# client AS1_1, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.111 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.111 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.111 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.111 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS3333_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +deny quick from 192.0.2.11 community NO_ADVERTISE + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 3333' - reject code: 6 +deny quick from 192.0.2.11 peer-as != 3333 + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +deny quick from 192.0.2.11 AS 23456 + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +deny quick from 192.0.2.11 AS 64496 - 131071 + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +deny quick from 192.0.2.11 AS 4200000000 - 4294967295 + + + + + +match from 192.0.2.11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS3333_1, AS3333: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS3333 referenced but empty. + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS3333_1, AS3333: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS3333 referenced but empty. + + + + + + + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +deny quick from 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +deny quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS3333_1, outbound + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes + +# Scrub prepending communities + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/rpki_rtr_example/routes/RPKIRTRScenario_OpenBGPDIPv4/openbgpd77p/AS1_1.txt b/tests/live_tests/scenarios/rpki_rtr_example/routes/RPKIRTRScenario_OpenBGPDIPv4/openbgpd77p/AS1_1.txt new file mode 100644 index 00000000..e69de29b diff --git a/tests/live_tests/scenarios/rpki_rtr_example/routes/RPKIRTRScenario_OpenBGPDIPv4/openbgpd77p/rs.txt b/tests/live_tests/scenarios/rpki_rtr_example/routes/RPKIRTRScenario_OpenBGPDIPv4/openbgpd77p/rs.txt new file mode 100644 index 00000000..e69de29b diff --git a/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv4/openbgpd76p.conf b/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv4/openbgpd76p.conf new file mode 100644 index 00000000..b896b0a1 --- /dev/null +++ b/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv4/openbgpd76p.conf @@ -0,0 +1,3557 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + +# WHITE_LIST_AS4_1, used by client AS4_1 white list +as-set "AS_SET_WHITE_LIST_AS4_1_asns" { + 41 +} +prefix-set "AS_SET_WHITE_LIST_AS4_1_prefixes" { + 4.2.0.0/16 prefixlen 16 - 32 + 2a04:2::/32 prefixlen 32 - 128 +} + +# AS4, used by client AS4_1, client AS4_2 +# no origin ASNs found for AS4 +# no prefixes found for AS4 + +# WHITE_LIST_AS2_2, used by client AS2_2 white list +as-set "AS_SET_WHITE_LIST_AS2_2_asns" { + 21 +} +prefix-set "AS_SET_WHITE_LIST_AS2_2_prefixes" { + 2.2.0.0/16 prefixlen 16 - 32 + 2a02:2::/32 prefixlen 32 - 128 +} + +# AS-AS5_FROM_PDB, used by client AS5_1, client AS5_2 +# no origin ASNs found for AS_AS5_FROM_PDB +# no prefixes found for AS_AS5_FROM_PDB + +# AS-AS4, used by client AS4_1, client AS4_2 +# no origin ASNs found for AS_AS4 +# no prefixes found for AS_AS4 + +# AS2, used by client AS2_1, client AS2_2 +# no origin ASNs found for AS2 +# no prefixes found for AS2 + +# WHITE_LIST_AS5_2, used by client AS5_2 white list +as-set "AS_SET_WHITE_LIST_AS5_2_asns" { + 51 +} +prefix-set "AS_SET_WHITE_LIST_AS5_2_prefixes" { + 5.2.0.0/16 prefixlen 16 - 32 + 2a05:2::/32 prefixlen 32 - 128 +} + +# AS5, used by client AS5_1, client AS5_2 +# no origin ASNs found for AS5 +# no prefixes found for AS5 + +# AS6, used by client AS6_1, client AS6_2 +# no origin ASNs found for AS6 +# no prefixes found for AS6 + +# WHITE_LIST_AS5_1, used by client AS5_1 white list +as-set "AS_SET_WHITE_LIST_AS5_1_asns" { + 51 +} +prefix-set "AS_SET_WHITE_LIST_AS5_1_prefixes" { + 5.2.0.0/16 prefixlen 16 - 32 + 2a05:2::/32 prefixlen 32 - 128 +} + +# WHITE_LIST_AS2_1, used by client AS2_1 white list +as-set "AS_SET_WHITE_LIST_AS2_1_asns" { + 21 +} +prefix-set "AS_SET_WHITE_LIST_AS2_1_prefixes" { + 2.2.0.0/16 prefixlen 16 - 32 + 2a02:2::/32 prefixlen 32 - 128 +} + +# AS1, used by client AS1_1, client AS1_2 +# no origin ASNs found for AS1 +# no prefixes found for AS1 + +# WHITE_LIST_AS4_2, used by client AS4_2 white list +as-set "AS_SET_WHITE_LIST_AS4_2_asns" { + 41 +} +prefix-set "AS_SET_WHITE_LIST_AS4_2_prefixes" { + 4.2.0.0/16 prefixlen 16 - 32 + 2a04:2::/32 prefixlen 32 - 128 +} + +# AS-AS2, used by client AS2_1, client AS2_2 +# no origin ASNs found for AS_AS2 +# no prefixes found for AS_AS2 + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.11 { + remote-as 1 + + rde evaluate all + + descr "AS1_1 client, no AS-SET" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::11 { + remote-as 1 + + rde evaluate all + + descr "AS1_1 client, no AS-SET" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.21 { + remote-as 2 + + rde evaluate all + + descr "AS2_1 client, AS-SET from AS..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::21 { + remote-as 2 + + rde evaluate all + + descr "AS2_1 client, AS-SET from AS..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.41 { + remote-as 4 + + rde evaluate all + + descr "AS4_1 client, AS-SET configu..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::41 { + remote-as 4 + + rde evaluate all + + descr "AS4_1 client, AS-SET configu..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.51 { + remote-as 5 + + rde evaluate all + + descr "AS5_1 client, AS-SET from Pe..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::51 { + remote-as 5 + + rde evaluate all + + descr "AS5_1 client, AS-SET from Pe..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.61 { + remote-as 6 + + rde evaluate all + + descr "AS6_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::61 { + remote-as 6 + + rde evaluate all + + descr "AS6_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# origin_not_present_in_as_set +match from group clients set community delete 999:64515 +match from group clients set large-community delete 999:0:64515 + +# origin_present_in_as_set +match from group clients set community delete 999:64514 +match from group clients set large-community delete 999:0:64514 + +# prefix_not_present_in_as_set +match from group clients set community delete 999:64513 +match from group clients set large-community delete 999:0:64513 + +# prefix_present_in_as_set +match from group clients set community delete 999:64512 +match from group clients set large-community delete 999:0:64512 + +# prefix_validated_via_arin_whois_db_dump +match from group clients set community delete 999:64518 +match from group clients set large-community delete 999:0:64518 + +# prefix_validated_via_rpki_roas +match from group clients set community delete 999:64516 +match from group clients set large-community delete 999:0:64516 + +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + +# route_validated_via_white_list +match from group clients set community delete 999:64517 +match from group clients set large-community delete 999:0:64517 + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + +# --------------------------------------------------------- +# ROAs source + + +roa-set { + +} + + + + +# --------------------------------------------------------- +# RPKI ROAs used as route objects. + +# Add the $INTCOMM_PREF_OK_ROA ext community to routes whose +# origin ASN has a ROA for the announced prefix. +# It will be used later during IRRDB validation in +# case the origin ASN is authorized by a client's +# AS-SET but the prefix is not. + +match from group clients ovs valid set ext-community $INTCOMM_PREF_OK_ROA + + + + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.11 set ext-community rt 65520:1 + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + +match from 192.0.2.21 set ext-community rt 65520:2 + +match from 2001:db8:1:1::21 set ext-community rt 65520:2 + +match from 192.0.2.41 set ext-community rt 65520:4 + +match from 2001:db8:1:1::41 set ext-community rt 65520:4 + +match from 192.0.2.51 set ext-community rt 65520:5 + +match from 2001:db8:1:1::51 set ext-community rt 65520:5 + +match from 192.0.2.61 set ext-community rt 65520:6 + +match from 2001:db8:1:1::61 set ext-community rt 65520:6 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +allow quick from group clients max-as-len 32 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS1_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 192.0.2.11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_1, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS1 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_1, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS1 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.11 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.11 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.11 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.11 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 2001:db8:1:1::11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_2, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS1 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_2, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS1 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::11 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::11 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::11 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::11 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + +deny quick to 2001:db8:1:1::11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.21 set community NO_ADVERTISE +match from 192.0.2.21 nexthop 192.0.2.21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.21 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.21 AS 23456' - reject code: 7 +allow quick from 192.0.2.21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 192.0.2.21 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS2_1, AS2: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.21 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 192.0.2.21 source-as as-set AS_SET_WHITE_LIST_AS2_1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS2_1 +# AS-SET AS_AS2 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS2_1, AS2: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.21 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 192.0.2.21 prefix-set AS_SET_WHITE_LIST_AS2_1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS2_1 +# AS-SET AS_AS2 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.21 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.21 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.21 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.21 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.21 set ext-community delete rt 65520:2 + + + +allow quick from 192.0.2.21 + + + +# --------------------------------------------- +# client AS2_1, outbound + +deny quick to 192.0.2.21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.21 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::21 set community NO_ADVERTISE +match from 2001:db8:1:1::21 nexthop 2001:db8:1:1::21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::21 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 2001:db8:1:1::21 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS2_2, AS2: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::21 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::21 source-as as-set AS_SET_WHITE_LIST_AS2_2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS2_2 +# AS-SET AS2 referenced but empty. +# AS-SET AS_AS2 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS2_2, AS2: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::21 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::21 prefix-set AS_SET_WHITE_LIST_AS2_2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS2_2 +# AS-SET AS2 referenced but empty. +# AS-SET AS_AS2 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::21 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::21 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::21 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::21 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::21 set ext-community delete rt 65520:2 + + + +allow quick from 2001:db8:1:1::21 + + + +# --------------------------------------------- +# client AS2_2, outbound + +deny quick to 2001:db8:1:1::21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::21 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_1, inbound + + + +# NEXT_HOP +match from 192.0.2.41 set community NO_ADVERTISE +match from 192.0.2.41 nexthop 192.0.2.41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.41 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.41 AS 23456' - reject code: 7 +allow quick from 192.0.2.41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 192.0.2.41 prefix 2a04:4::/32 source-as 44 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 2a04:5::/32 prefixlen 32 - 128 source-as 43 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 2a04:6::/32 prefixlen 32 - 128 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 4.4.0.0/16 source-as 44 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 4.5.0.0/16 prefixlen 16 - 32 source-as 43 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 4.6.0.0/16 prefixlen 16 - 32 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 192.0.2.41 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS4_1, AS4: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.41 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.41 source-as as-set AS_SET_WHITE_LIST_AS4_1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS4_1 +# AS-SET AS4 referenced but empty. +# AS-SET AS_AS4 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS4_1, AS4: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.41 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.41 prefix-set AS_SET_WHITE_LIST_AS4_1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS4_1 +# AS-SET AS4 referenced but empty. +# AS-SET AS_AS4 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.41 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.41 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.41 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.41 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + +# route authorized by a client's white list? +match from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set community 999:64517 +match from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set large-community 999:0:64517 + +match from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.41 set ext-community delete rt 65520:4 + + + +allow quick from 192.0.2.41 + + + +# --------------------------------------------- +# client AS4_1, outbound + +deny quick to 192.0.2.41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.41 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::41 set community NO_ADVERTISE +match from 2001:db8:1:1::41 nexthop 2001:db8:1:1::41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::41 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 2001:db8:1:1::41 prefix 2a04:4::/32 source-as 44 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 2a04:5::/32 prefixlen 32 - 128 source-as 43 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 2a04:6::/32 prefixlen 32 - 128 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 4.4.0.0/16 source-as 44 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 4.5.0.0/16 prefixlen 16 - 32 source-as 43 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 4.6.0.0/16 prefixlen 16 - 32 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 2001:db8:1:1::41 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS4_2, AS4: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::41 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS4 referenced but empty. +# AS-SET AS_AS4 referenced but empty. +match from 2001:db8:1:1::41 source-as as-set AS_SET_WHITE_LIST_AS4_2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS4_2 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS4_2, AS4: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::41 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS4 referenced but empty. +# AS-SET AS_AS4 referenced but empty. +match from 2001:db8:1:1::41 prefix-set AS_SET_WHITE_LIST_AS4_2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS4_2 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::41 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::41 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::41 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::41 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + +# route authorized by a client's white list? +match from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set community 999:64517 +match from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set large-community 999:0:64517 + +match from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::41 set ext-community delete rt 65520:4 + + + +allow quick from 2001:db8:1:1::41 + + + +# --------------------------------------------- +# client AS4_2, outbound + +deny quick to 2001:db8:1:1::41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::41 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS5_1, inbound + + + +# NEXT_HOP +match from 192.0.2.51 set community NO_ADVERTISE +match from 192.0.2.51 nexthop 192.0.2.51 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.51 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.51 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.51 peer-as != 5' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.51 peer-as != 5 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.51 AS 23456' - reject code: 7 +allow quick from 192.0.2.51 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.51 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.51 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.51 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.51 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 192.0.2.51 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS5_1, AS5: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.51 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS_AS5_FROM_PDB referenced but empty. +# AS-SET AS5 referenced but empty. +match from 192.0.2.51 source-as as-set AS_SET_WHITE_LIST_AS5_1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS5_1 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS5_1, AS5: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.51 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS_AS5_FROM_PDB referenced but empty. +# AS-SET AS5 referenced but empty. +match from 192.0.2.51 prefix-set AS_SET_WHITE_LIST_AS5_1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS5_1 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.51 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.51 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.51 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.51 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.51 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.51 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.51 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.51 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.51 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.51 set ext-community delete rt 65520:5 + + + +allow quick from 192.0.2.51 + + + +# --------------------------------------------- +# client AS5_1, outbound + +deny quick to 192.0.2.51 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.51 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.51 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.51 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS5_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::51 set community NO_ADVERTISE +match from 2001:db8:1:1::51 nexthop 2001:db8:1:1::51 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::51 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::51 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::51 peer-as != 5' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::51 peer-as != 5 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::51 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::51 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::51 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::51 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::51 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::51 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 2001:db8:1:1::51 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS5_2, AS5: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::51 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS_AS5_FROM_PDB referenced but empty. +match from 2001:db8:1:1::51 source-as as-set AS_SET_WHITE_LIST_AS5_2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS5_2 +# AS-SET AS5 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS5_2, AS5: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::51 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS_AS5_FROM_PDB referenced but empty. +match from 2001:db8:1:1::51 prefix-set AS_SET_WHITE_LIST_AS5_2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS5_2 +# AS-SET AS5 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::51 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::51 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::51 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::51 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::51 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::51 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::51 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::51 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::51 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::51 set ext-community delete rt 65520:5 + + + +allow quick from 2001:db8:1:1::51 + + + +# --------------------------------------------- +# client AS5_2, outbound + +deny quick to 2001:db8:1:1::51 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::51 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::51 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::51 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS6_1, inbound + + + +# NEXT_HOP +match from 192.0.2.61 set community NO_ADVERTISE +match from 192.0.2.61 nexthop 192.0.2.61 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.61 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.61 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.61 peer-as != 6' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.61 peer-as != 6 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.61 AS 23456' - reject code: 7 +allow quick from 192.0.2.61 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.61 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.61 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.61 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.61 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 192.0.2.61 prefix 2a03:2::/32 prefixlen 32 - 128 source-as 3 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.61 prefix 3.2.0.0/16 prefixlen 16 - 32 source-as 3 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 192.0.2.61 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS6_1, AS6: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.61 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS6 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS6_1, AS6: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.61 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS6 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.61 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.61 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.61 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.61 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + +# route authorized by a client's white list? +match from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set community 999:64517 +match from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set large-community 999:0:64517 + +match from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.61 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.61 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.61 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.61 set ext-community delete rt 65520:6 + + + +allow quick from 192.0.2.61 + + + +# --------------------------------------------- +# client AS6_1, outbound + +deny quick to 192.0.2.61 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.61 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.61 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.61 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS6_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::61 set community NO_ADVERTISE +match from 2001:db8:1:1::61 nexthop 2001:db8:1:1::61 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::61 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::61 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::61 peer-as != 6' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::61 peer-as != 6 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::61 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::61 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::61 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::61 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::61 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::61 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 2001:db8:1:1::61 prefix 2a03:2::/32 prefixlen 32 - 128 source-as 3 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::61 prefix 3.2.0.0/16 prefixlen 16 - 32 source-as 3 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 2001:db8:1:1::61 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS6_2, AS6: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::61 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS6 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS6_2, AS6: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::61 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS6 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::61 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::61 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::61 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::61 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + +# route authorized by a client's white list? +match from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set community 999:64517 +match from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set large-community 999:0:64517 + +match from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::61 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::61 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::61 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::61 set ext-community delete rt 65520:6 + + + +allow quick from 2001:db8:1:1::61 + + + +# --------------------------------------------- +# client AS6_2, outbound + +deny quick to 2001:db8:1:1::61 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::61 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::61 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::61 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv4/openbgpd77p.conf b/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv4/openbgpd77p.conf new file mode 100644 index 00000000..b896b0a1 --- /dev/null +++ b/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv4/openbgpd77p.conf @@ -0,0 +1,3557 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + +# WHITE_LIST_AS4_1, used by client AS4_1 white list +as-set "AS_SET_WHITE_LIST_AS4_1_asns" { + 41 +} +prefix-set "AS_SET_WHITE_LIST_AS4_1_prefixes" { + 4.2.0.0/16 prefixlen 16 - 32 + 2a04:2::/32 prefixlen 32 - 128 +} + +# AS4, used by client AS4_1, client AS4_2 +# no origin ASNs found for AS4 +# no prefixes found for AS4 + +# WHITE_LIST_AS2_2, used by client AS2_2 white list +as-set "AS_SET_WHITE_LIST_AS2_2_asns" { + 21 +} +prefix-set "AS_SET_WHITE_LIST_AS2_2_prefixes" { + 2.2.0.0/16 prefixlen 16 - 32 + 2a02:2::/32 prefixlen 32 - 128 +} + +# AS-AS5_FROM_PDB, used by client AS5_1, client AS5_2 +# no origin ASNs found for AS_AS5_FROM_PDB +# no prefixes found for AS_AS5_FROM_PDB + +# AS-AS4, used by client AS4_1, client AS4_2 +# no origin ASNs found for AS_AS4 +# no prefixes found for AS_AS4 + +# AS2, used by client AS2_1, client AS2_2 +# no origin ASNs found for AS2 +# no prefixes found for AS2 + +# WHITE_LIST_AS5_2, used by client AS5_2 white list +as-set "AS_SET_WHITE_LIST_AS5_2_asns" { + 51 +} +prefix-set "AS_SET_WHITE_LIST_AS5_2_prefixes" { + 5.2.0.0/16 prefixlen 16 - 32 + 2a05:2::/32 prefixlen 32 - 128 +} + +# AS5, used by client AS5_1, client AS5_2 +# no origin ASNs found for AS5 +# no prefixes found for AS5 + +# AS6, used by client AS6_1, client AS6_2 +# no origin ASNs found for AS6 +# no prefixes found for AS6 + +# WHITE_LIST_AS5_1, used by client AS5_1 white list +as-set "AS_SET_WHITE_LIST_AS5_1_asns" { + 51 +} +prefix-set "AS_SET_WHITE_LIST_AS5_1_prefixes" { + 5.2.0.0/16 prefixlen 16 - 32 + 2a05:2::/32 prefixlen 32 - 128 +} + +# WHITE_LIST_AS2_1, used by client AS2_1 white list +as-set "AS_SET_WHITE_LIST_AS2_1_asns" { + 21 +} +prefix-set "AS_SET_WHITE_LIST_AS2_1_prefixes" { + 2.2.0.0/16 prefixlen 16 - 32 + 2a02:2::/32 prefixlen 32 - 128 +} + +# AS1, used by client AS1_1, client AS1_2 +# no origin ASNs found for AS1 +# no prefixes found for AS1 + +# WHITE_LIST_AS4_2, used by client AS4_2 white list +as-set "AS_SET_WHITE_LIST_AS4_2_asns" { + 41 +} +prefix-set "AS_SET_WHITE_LIST_AS4_2_prefixes" { + 4.2.0.0/16 prefixlen 16 - 32 + 2a04:2::/32 prefixlen 32 - 128 +} + +# AS-AS2, used by client AS2_1, client AS2_2 +# no origin ASNs found for AS_AS2 +# no prefixes found for AS_AS2 + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.11 { + remote-as 1 + + rde evaluate all + + descr "AS1_1 client, no AS-SET" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::11 { + remote-as 1 + + rde evaluate all + + descr "AS1_1 client, no AS-SET" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.21 { + remote-as 2 + + rde evaluate all + + descr "AS2_1 client, AS-SET from AS..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::21 { + remote-as 2 + + rde evaluate all + + descr "AS2_1 client, AS-SET from AS..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.41 { + remote-as 4 + + rde evaluate all + + descr "AS4_1 client, AS-SET configu..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::41 { + remote-as 4 + + rde evaluate all + + descr "AS4_1 client, AS-SET configu..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.51 { + remote-as 5 + + rde evaluate all + + descr "AS5_1 client, AS-SET from Pe..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::51 { + remote-as 5 + + rde evaluate all + + descr "AS5_1 client, AS-SET from Pe..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.61 { + remote-as 6 + + rde evaluate all + + descr "AS6_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::61 { + remote-as 6 + + rde evaluate all + + descr "AS6_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# origin_not_present_in_as_set +match from group clients set community delete 999:64515 +match from group clients set large-community delete 999:0:64515 + +# origin_present_in_as_set +match from group clients set community delete 999:64514 +match from group clients set large-community delete 999:0:64514 + +# prefix_not_present_in_as_set +match from group clients set community delete 999:64513 +match from group clients set large-community delete 999:0:64513 + +# prefix_present_in_as_set +match from group clients set community delete 999:64512 +match from group clients set large-community delete 999:0:64512 + +# prefix_validated_via_arin_whois_db_dump +match from group clients set community delete 999:64518 +match from group clients set large-community delete 999:0:64518 + +# prefix_validated_via_rpki_roas +match from group clients set community delete 999:64516 +match from group clients set large-community delete 999:0:64516 + +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + +# route_validated_via_white_list +match from group clients set community delete 999:64517 +match from group clients set large-community delete 999:0:64517 + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + +# --------------------------------------------------------- +# ROAs source + + +roa-set { + +} + + + + +# --------------------------------------------------------- +# RPKI ROAs used as route objects. + +# Add the $INTCOMM_PREF_OK_ROA ext community to routes whose +# origin ASN has a ROA for the announced prefix. +# It will be used later during IRRDB validation in +# case the origin ASN is authorized by a client's +# AS-SET but the prefix is not. + +match from group clients ovs valid set ext-community $INTCOMM_PREF_OK_ROA + + + + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.11 set ext-community rt 65520:1 + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + +match from 192.0.2.21 set ext-community rt 65520:2 + +match from 2001:db8:1:1::21 set ext-community rt 65520:2 + +match from 192.0.2.41 set ext-community rt 65520:4 + +match from 2001:db8:1:1::41 set ext-community rt 65520:4 + +match from 192.0.2.51 set ext-community rt 65520:5 + +match from 2001:db8:1:1::51 set ext-community rt 65520:5 + +match from 192.0.2.61 set ext-community rt 65520:6 + +match from 2001:db8:1:1::61 set ext-community rt 65520:6 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +allow quick from group clients max-as-len 32 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS1_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 192.0.2.11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_1, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS1 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_1, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS1 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.11 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.11 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.11 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.11 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 2001:db8:1:1::11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_2, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS1 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_2, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS1 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::11 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::11 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::11 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::11 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + +deny quick to 2001:db8:1:1::11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.21 set community NO_ADVERTISE +match from 192.0.2.21 nexthop 192.0.2.21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.21 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.21 AS 23456' - reject code: 7 +allow quick from 192.0.2.21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 192.0.2.21 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS2_1, AS2: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.21 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 192.0.2.21 source-as as-set AS_SET_WHITE_LIST_AS2_1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS2_1 +# AS-SET AS_AS2 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS2_1, AS2: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.21 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 192.0.2.21 prefix-set AS_SET_WHITE_LIST_AS2_1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS2_1 +# AS-SET AS_AS2 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.21 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.21 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.21 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.21 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.21 set ext-community delete rt 65520:2 + + + +allow quick from 192.0.2.21 + + + +# --------------------------------------------- +# client AS2_1, outbound + +deny quick to 192.0.2.21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.21 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::21 set community NO_ADVERTISE +match from 2001:db8:1:1::21 nexthop 2001:db8:1:1::21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::21 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 2001:db8:1:1::21 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS2_2, AS2: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::21 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::21 source-as as-set AS_SET_WHITE_LIST_AS2_2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS2_2 +# AS-SET AS2 referenced but empty. +# AS-SET AS_AS2 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS2_2, AS2: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::21 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::21 prefix-set AS_SET_WHITE_LIST_AS2_2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS2_2 +# AS-SET AS2 referenced but empty. +# AS-SET AS_AS2 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::21 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::21 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::21 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::21 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::21 set ext-community delete rt 65520:2 + + + +allow quick from 2001:db8:1:1::21 + + + +# --------------------------------------------- +# client AS2_2, outbound + +deny quick to 2001:db8:1:1::21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::21 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_1, inbound + + + +# NEXT_HOP +match from 192.0.2.41 set community NO_ADVERTISE +match from 192.0.2.41 nexthop 192.0.2.41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.41 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.41 AS 23456' - reject code: 7 +allow quick from 192.0.2.41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 192.0.2.41 prefix 2a04:4::/32 source-as 44 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 2a04:5::/32 prefixlen 32 - 128 source-as 43 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 2a04:6::/32 prefixlen 32 - 128 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 4.4.0.0/16 source-as 44 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 4.5.0.0/16 prefixlen 16 - 32 source-as 43 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 4.6.0.0/16 prefixlen 16 - 32 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 192.0.2.41 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS4_1, AS4: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.41 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.41 source-as as-set AS_SET_WHITE_LIST_AS4_1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS4_1 +# AS-SET AS4 referenced but empty. +# AS-SET AS_AS4 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS4_1, AS4: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.41 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.41 prefix-set AS_SET_WHITE_LIST_AS4_1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS4_1 +# AS-SET AS4 referenced but empty. +# AS-SET AS_AS4 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.41 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.41 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.41 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.41 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + +# route authorized by a client's white list? +match from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set community 999:64517 +match from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set large-community 999:0:64517 + +match from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.41 set ext-community delete rt 65520:4 + + + +allow quick from 192.0.2.41 + + + +# --------------------------------------------- +# client AS4_1, outbound + +deny quick to 192.0.2.41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.41 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::41 set community NO_ADVERTISE +match from 2001:db8:1:1::41 nexthop 2001:db8:1:1::41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::41 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 2001:db8:1:1::41 prefix 2a04:4::/32 source-as 44 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 2a04:5::/32 prefixlen 32 - 128 source-as 43 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 2a04:6::/32 prefixlen 32 - 128 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 4.4.0.0/16 source-as 44 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 4.5.0.0/16 prefixlen 16 - 32 source-as 43 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 4.6.0.0/16 prefixlen 16 - 32 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 2001:db8:1:1::41 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS4_2, AS4: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::41 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS4 referenced but empty. +# AS-SET AS_AS4 referenced but empty. +match from 2001:db8:1:1::41 source-as as-set AS_SET_WHITE_LIST_AS4_2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS4_2 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS4_2, AS4: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::41 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS4 referenced but empty. +# AS-SET AS_AS4 referenced but empty. +match from 2001:db8:1:1::41 prefix-set AS_SET_WHITE_LIST_AS4_2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS4_2 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::41 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::41 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::41 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::41 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + +# route authorized by a client's white list? +match from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set community 999:64517 +match from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set large-community 999:0:64517 + +match from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::41 set ext-community delete rt 65520:4 + + + +allow quick from 2001:db8:1:1::41 + + + +# --------------------------------------------- +# client AS4_2, outbound + +deny quick to 2001:db8:1:1::41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::41 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS5_1, inbound + + + +# NEXT_HOP +match from 192.0.2.51 set community NO_ADVERTISE +match from 192.0.2.51 nexthop 192.0.2.51 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.51 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.51 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.51 peer-as != 5' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.51 peer-as != 5 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.51 AS 23456' - reject code: 7 +allow quick from 192.0.2.51 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.51 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.51 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.51 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.51 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 192.0.2.51 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS5_1, AS5: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.51 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS_AS5_FROM_PDB referenced but empty. +# AS-SET AS5 referenced but empty. +match from 192.0.2.51 source-as as-set AS_SET_WHITE_LIST_AS5_1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS5_1 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS5_1, AS5: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.51 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS_AS5_FROM_PDB referenced but empty. +# AS-SET AS5 referenced but empty. +match from 192.0.2.51 prefix-set AS_SET_WHITE_LIST_AS5_1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS5_1 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.51 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.51 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.51 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.51 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.51 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.51 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.51 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.51 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.51 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.51 set ext-community delete rt 65520:5 + + + +allow quick from 192.0.2.51 + + + +# --------------------------------------------- +# client AS5_1, outbound + +deny quick to 192.0.2.51 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.51 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.51 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.51 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS5_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::51 set community NO_ADVERTISE +match from 2001:db8:1:1::51 nexthop 2001:db8:1:1::51 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::51 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::51 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::51 peer-as != 5' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::51 peer-as != 5 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::51 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::51 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::51 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::51 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::51 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::51 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 2001:db8:1:1::51 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS5_2, AS5: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::51 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS_AS5_FROM_PDB referenced but empty. +match from 2001:db8:1:1::51 source-as as-set AS_SET_WHITE_LIST_AS5_2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS5_2 +# AS-SET AS5 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS5_2, AS5: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::51 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS_AS5_FROM_PDB referenced but empty. +match from 2001:db8:1:1::51 prefix-set AS_SET_WHITE_LIST_AS5_2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS5_2 +# AS-SET AS5 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::51 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::51 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::51 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::51 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::51 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::51 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::51 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::51 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::51 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::51 set ext-community delete rt 65520:5 + + + +allow quick from 2001:db8:1:1::51 + + + +# --------------------------------------------- +# client AS5_2, outbound + +deny quick to 2001:db8:1:1::51 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::51 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::51 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::51 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS6_1, inbound + + + +# NEXT_HOP +match from 192.0.2.61 set community NO_ADVERTISE +match from 192.0.2.61 nexthop 192.0.2.61 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.61 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.61 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.61 peer-as != 6' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.61 peer-as != 6 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.61 AS 23456' - reject code: 7 +allow quick from 192.0.2.61 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.61 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.61 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.61 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.61 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 192.0.2.61 prefix 2a03:2::/32 prefixlen 32 - 128 source-as 3 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.61 prefix 3.2.0.0/16 prefixlen 16 - 32 source-as 3 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 192.0.2.61 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS6_1, AS6: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.61 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS6 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS6_1, AS6: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.61 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS6 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.61 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.61 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.61 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.61 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + +# route authorized by a client's white list? +match from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set community 999:64517 +match from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set large-community 999:0:64517 + +match from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.61 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.61 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.61 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.61 set ext-community delete rt 65520:6 + + + +allow quick from 192.0.2.61 + + + +# --------------------------------------------- +# client AS6_1, outbound + +deny quick to 192.0.2.61 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.61 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.61 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.61 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS6_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::61 set community NO_ADVERTISE +match from 2001:db8:1:1::61 nexthop 2001:db8:1:1::61 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::61 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::61 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::61 peer-as != 6' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::61 peer-as != 6 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::61 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::61 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::61 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::61 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::61 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::61 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 2001:db8:1:1::61 prefix 2a03:2::/32 prefixlen 32 - 128 source-as 3 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::61 prefix 3.2.0.0/16 prefixlen 16 - 32 source-as 3 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 2001:db8:1:1::61 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS6_2, AS6: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::61 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS6 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS6_2, AS6: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::61 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS6 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::61 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::61 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::61 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::61 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + +# route authorized by a client's white list? +match from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set community 999:64517 +match from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set large-community 999:0:64517 + +match from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::61 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::61 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::61 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::61 set ext-community delete rt 65520:6 + + + +allow quick from 2001:db8:1:1::61 + + + +# --------------------------------------------- +# client AS6_2, outbound + +deny quick to 2001:db8:1:1::61 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::61 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::61 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::61 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv6/openbgpd76p.conf b/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv6/openbgpd76p.conf new file mode 100644 index 00000000..b896b0a1 --- /dev/null +++ b/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv6/openbgpd76p.conf @@ -0,0 +1,3557 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + +# WHITE_LIST_AS4_1, used by client AS4_1 white list +as-set "AS_SET_WHITE_LIST_AS4_1_asns" { + 41 +} +prefix-set "AS_SET_WHITE_LIST_AS4_1_prefixes" { + 4.2.0.0/16 prefixlen 16 - 32 + 2a04:2::/32 prefixlen 32 - 128 +} + +# AS4, used by client AS4_1, client AS4_2 +# no origin ASNs found for AS4 +# no prefixes found for AS4 + +# WHITE_LIST_AS2_2, used by client AS2_2 white list +as-set "AS_SET_WHITE_LIST_AS2_2_asns" { + 21 +} +prefix-set "AS_SET_WHITE_LIST_AS2_2_prefixes" { + 2.2.0.0/16 prefixlen 16 - 32 + 2a02:2::/32 prefixlen 32 - 128 +} + +# AS-AS5_FROM_PDB, used by client AS5_1, client AS5_2 +# no origin ASNs found for AS_AS5_FROM_PDB +# no prefixes found for AS_AS5_FROM_PDB + +# AS-AS4, used by client AS4_1, client AS4_2 +# no origin ASNs found for AS_AS4 +# no prefixes found for AS_AS4 + +# AS2, used by client AS2_1, client AS2_2 +# no origin ASNs found for AS2 +# no prefixes found for AS2 + +# WHITE_LIST_AS5_2, used by client AS5_2 white list +as-set "AS_SET_WHITE_LIST_AS5_2_asns" { + 51 +} +prefix-set "AS_SET_WHITE_LIST_AS5_2_prefixes" { + 5.2.0.0/16 prefixlen 16 - 32 + 2a05:2::/32 prefixlen 32 - 128 +} + +# AS5, used by client AS5_1, client AS5_2 +# no origin ASNs found for AS5 +# no prefixes found for AS5 + +# AS6, used by client AS6_1, client AS6_2 +# no origin ASNs found for AS6 +# no prefixes found for AS6 + +# WHITE_LIST_AS5_1, used by client AS5_1 white list +as-set "AS_SET_WHITE_LIST_AS5_1_asns" { + 51 +} +prefix-set "AS_SET_WHITE_LIST_AS5_1_prefixes" { + 5.2.0.0/16 prefixlen 16 - 32 + 2a05:2::/32 prefixlen 32 - 128 +} + +# WHITE_LIST_AS2_1, used by client AS2_1 white list +as-set "AS_SET_WHITE_LIST_AS2_1_asns" { + 21 +} +prefix-set "AS_SET_WHITE_LIST_AS2_1_prefixes" { + 2.2.0.0/16 prefixlen 16 - 32 + 2a02:2::/32 prefixlen 32 - 128 +} + +# AS1, used by client AS1_1, client AS1_2 +# no origin ASNs found for AS1 +# no prefixes found for AS1 + +# WHITE_LIST_AS4_2, used by client AS4_2 white list +as-set "AS_SET_WHITE_LIST_AS4_2_asns" { + 41 +} +prefix-set "AS_SET_WHITE_LIST_AS4_2_prefixes" { + 4.2.0.0/16 prefixlen 16 - 32 + 2a04:2::/32 prefixlen 32 - 128 +} + +# AS-AS2, used by client AS2_1, client AS2_2 +# no origin ASNs found for AS_AS2 +# no prefixes found for AS_AS2 + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.11 { + remote-as 1 + + rde evaluate all + + descr "AS1_1 client, no AS-SET" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::11 { + remote-as 1 + + rde evaluate all + + descr "AS1_1 client, no AS-SET" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.21 { + remote-as 2 + + rde evaluate all + + descr "AS2_1 client, AS-SET from AS..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::21 { + remote-as 2 + + rde evaluate all + + descr "AS2_1 client, AS-SET from AS..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.41 { + remote-as 4 + + rde evaluate all + + descr "AS4_1 client, AS-SET configu..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::41 { + remote-as 4 + + rde evaluate all + + descr "AS4_1 client, AS-SET configu..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.51 { + remote-as 5 + + rde evaluate all + + descr "AS5_1 client, AS-SET from Pe..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::51 { + remote-as 5 + + rde evaluate all + + descr "AS5_1 client, AS-SET from Pe..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.61 { + remote-as 6 + + rde evaluate all + + descr "AS6_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::61 { + remote-as 6 + + rde evaluate all + + descr "AS6_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# origin_not_present_in_as_set +match from group clients set community delete 999:64515 +match from group clients set large-community delete 999:0:64515 + +# origin_present_in_as_set +match from group clients set community delete 999:64514 +match from group clients set large-community delete 999:0:64514 + +# prefix_not_present_in_as_set +match from group clients set community delete 999:64513 +match from group clients set large-community delete 999:0:64513 + +# prefix_present_in_as_set +match from group clients set community delete 999:64512 +match from group clients set large-community delete 999:0:64512 + +# prefix_validated_via_arin_whois_db_dump +match from group clients set community delete 999:64518 +match from group clients set large-community delete 999:0:64518 + +# prefix_validated_via_rpki_roas +match from group clients set community delete 999:64516 +match from group clients set large-community delete 999:0:64516 + +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + +# route_validated_via_white_list +match from group clients set community delete 999:64517 +match from group clients set large-community delete 999:0:64517 + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + +# --------------------------------------------------------- +# ROAs source + + +roa-set { + +} + + + + +# --------------------------------------------------------- +# RPKI ROAs used as route objects. + +# Add the $INTCOMM_PREF_OK_ROA ext community to routes whose +# origin ASN has a ROA for the announced prefix. +# It will be used later during IRRDB validation in +# case the origin ASN is authorized by a client's +# AS-SET but the prefix is not. + +match from group clients ovs valid set ext-community $INTCOMM_PREF_OK_ROA + + + + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.11 set ext-community rt 65520:1 + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + +match from 192.0.2.21 set ext-community rt 65520:2 + +match from 2001:db8:1:1::21 set ext-community rt 65520:2 + +match from 192.0.2.41 set ext-community rt 65520:4 + +match from 2001:db8:1:1::41 set ext-community rt 65520:4 + +match from 192.0.2.51 set ext-community rt 65520:5 + +match from 2001:db8:1:1::51 set ext-community rt 65520:5 + +match from 192.0.2.61 set ext-community rt 65520:6 + +match from 2001:db8:1:1::61 set ext-community rt 65520:6 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +allow quick from group clients max-as-len 32 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS1_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 192.0.2.11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_1, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS1 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_1, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS1 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.11 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.11 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.11 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.11 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 2001:db8:1:1::11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_2, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS1 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_2, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS1 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::11 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::11 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::11 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::11 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + +deny quick to 2001:db8:1:1::11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.21 set community NO_ADVERTISE +match from 192.0.2.21 nexthop 192.0.2.21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.21 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.21 AS 23456' - reject code: 7 +allow quick from 192.0.2.21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 192.0.2.21 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS2_1, AS2: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.21 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 192.0.2.21 source-as as-set AS_SET_WHITE_LIST_AS2_1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS2_1 +# AS-SET AS_AS2 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS2_1, AS2: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.21 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 192.0.2.21 prefix-set AS_SET_WHITE_LIST_AS2_1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS2_1 +# AS-SET AS_AS2 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.21 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.21 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.21 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.21 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.21 set ext-community delete rt 65520:2 + + + +allow quick from 192.0.2.21 + + + +# --------------------------------------------- +# client AS2_1, outbound + +deny quick to 192.0.2.21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.21 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::21 set community NO_ADVERTISE +match from 2001:db8:1:1::21 nexthop 2001:db8:1:1::21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::21 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 2001:db8:1:1::21 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS2_2, AS2: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::21 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::21 source-as as-set AS_SET_WHITE_LIST_AS2_2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS2_2 +# AS-SET AS2 referenced but empty. +# AS-SET AS_AS2 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS2_2, AS2: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::21 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::21 prefix-set AS_SET_WHITE_LIST_AS2_2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS2_2 +# AS-SET AS2 referenced but empty. +# AS-SET AS_AS2 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::21 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::21 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::21 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::21 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::21 set ext-community delete rt 65520:2 + + + +allow quick from 2001:db8:1:1::21 + + + +# --------------------------------------------- +# client AS2_2, outbound + +deny quick to 2001:db8:1:1::21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::21 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_1, inbound + + + +# NEXT_HOP +match from 192.0.2.41 set community NO_ADVERTISE +match from 192.0.2.41 nexthop 192.0.2.41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.41 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.41 AS 23456' - reject code: 7 +allow quick from 192.0.2.41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 192.0.2.41 prefix 2a04:4::/32 source-as 44 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 2a04:5::/32 prefixlen 32 - 128 source-as 43 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 2a04:6::/32 prefixlen 32 - 128 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 4.4.0.0/16 source-as 44 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 4.5.0.0/16 prefixlen 16 - 32 source-as 43 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 4.6.0.0/16 prefixlen 16 - 32 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 192.0.2.41 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS4_1, AS4: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.41 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.41 source-as as-set AS_SET_WHITE_LIST_AS4_1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS4_1 +# AS-SET AS4 referenced but empty. +# AS-SET AS_AS4 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS4_1, AS4: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.41 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.41 prefix-set AS_SET_WHITE_LIST_AS4_1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS4_1 +# AS-SET AS4 referenced but empty. +# AS-SET AS_AS4 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.41 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.41 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.41 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.41 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + +# route authorized by a client's white list? +match from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set community 999:64517 +match from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set large-community 999:0:64517 + +match from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.41 set ext-community delete rt 65520:4 + + + +allow quick from 192.0.2.41 + + + +# --------------------------------------------- +# client AS4_1, outbound + +deny quick to 192.0.2.41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.41 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::41 set community NO_ADVERTISE +match from 2001:db8:1:1::41 nexthop 2001:db8:1:1::41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::41 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 2001:db8:1:1::41 prefix 2a04:4::/32 source-as 44 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 2a04:5::/32 prefixlen 32 - 128 source-as 43 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 2a04:6::/32 prefixlen 32 - 128 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 4.4.0.0/16 source-as 44 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 4.5.0.0/16 prefixlen 16 - 32 source-as 43 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 4.6.0.0/16 prefixlen 16 - 32 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 2001:db8:1:1::41 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS4_2, AS4: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::41 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS4 referenced but empty. +# AS-SET AS_AS4 referenced but empty. +match from 2001:db8:1:1::41 source-as as-set AS_SET_WHITE_LIST_AS4_2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS4_2 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS4_2, AS4: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::41 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS4 referenced but empty. +# AS-SET AS_AS4 referenced but empty. +match from 2001:db8:1:1::41 prefix-set AS_SET_WHITE_LIST_AS4_2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS4_2 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::41 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::41 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::41 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::41 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + +# route authorized by a client's white list? +match from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set community 999:64517 +match from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set large-community 999:0:64517 + +match from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::41 set ext-community delete rt 65520:4 + + + +allow quick from 2001:db8:1:1::41 + + + +# --------------------------------------------- +# client AS4_2, outbound + +deny quick to 2001:db8:1:1::41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::41 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS5_1, inbound + + + +# NEXT_HOP +match from 192.0.2.51 set community NO_ADVERTISE +match from 192.0.2.51 nexthop 192.0.2.51 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.51 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.51 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.51 peer-as != 5' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.51 peer-as != 5 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.51 AS 23456' - reject code: 7 +allow quick from 192.0.2.51 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.51 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.51 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.51 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.51 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 192.0.2.51 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS5_1, AS5: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.51 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS_AS5_FROM_PDB referenced but empty. +# AS-SET AS5 referenced but empty. +match from 192.0.2.51 source-as as-set AS_SET_WHITE_LIST_AS5_1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS5_1 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS5_1, AS5: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.51 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS_AS5_FROM_PDB referenced but empty. +# AS-SET AS5 referenced but empty. +match from 192.0.2.51 prefix-set AS_SET_WHITE_LIST_AS5_1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS5_1 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.51 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.51 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.51 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.51 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.51 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.51 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.51 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.51 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.51 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.51 set ext-community delete rt 65520:5 + + + +allow quick from 192.0.2.51 + + + +# --------------------------------------------- +# client AS5_1, outbound + +deny quick to 192.0.2.51 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.51 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.51 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.51 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS5_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::51 set community NO_ADVERTISE +match from 2001:db8:1:1::51 nexthop 2001:db8:1:1::51 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::51 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::51 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::51 peer-as != 5' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::51 peer-as != 5 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::51 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::51 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::51 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::51 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::51 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::51 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 2001:db8:1:1::51 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS5_2, AS5: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::51 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS_AS5_FROM_PDB referenced but empty. +match from 2001:db8:1:1::51 source-as as-set AS_SET_WHITE_LIST_AS5_2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS5_2 +# AS-SET AS5 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS5_2, AS5: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::51 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS_AS5_FROM_PDB referenced but empty. +match from 2001:db8:1:1::51 prefix-set AS_SET_WHITE_LIST_AS5_2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS5_2 +# AS-SET AS5 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::51 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::51 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::51 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::51 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::51 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::51 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::51 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::51 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::51 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::51 set ext-community delete rt 65520:5 + + + +allow quick from 2001:db8:1:1::51 + + + +# --------------------------------------------- +# client AS5_2, outbound + +deny quick to 2001:db8:1:1::51 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::51 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::51 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::51 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS6_1, inbound + + + +# NEXT_HOP +match from 192.0.2.61 set community NO_ADVERTISE +match from 192.0.2.61 nexthop 192.0.2.61 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.61 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.61 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.61 peer-as != 6' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.61 peer-as != 6 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.61 AS 23456' - reject code: 7 +allow quick from 192.0.2.61 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.61 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.61 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.61 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.61 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 192.0.2.61 prefix 2a03:2::/32 prefixlen 32 - 128 source-as 3 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.61 prefix 3.2.0.0/16 prefixlen 16 - 32 source-as 3 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 192.0.2.61 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS6_1, AS6: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.61 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS6 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS6_1, AS6: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.61 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS6 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.61 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.61 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.61 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.61 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + +# route authorized by a client's white list? +match from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set community 999:64517 +match from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set large-community 999:0:64517 + +match from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.61 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.61 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.61 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.61 set ext-community delete rt 65520:6 + + + +allow quick from 192.0.2.61 + + + +# --------------------------------------------- +# client AS6_1, outbound + +deny quick to 192.0.2.61 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.61 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.61 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.61 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS6_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::61 set community NO_ADVERTISE +match from 2001:db8:1:1::61 nexthop 2001:db8:1:1::61 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::61 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::61 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::61 peer-as != 6' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::61 peer-as != 6 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::61 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::61 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::61 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::61 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::61 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::61 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 2001:db8:1:1::61 prefix 2a03:2::/32 prefixlen 32 - 128 source-as 3 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::61 prefix 3.2.0.0/16 prefixlen 16 - 32 source-as 3 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 2001:db8:1:1::61 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS6_2, AS6: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::61 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS6 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS6_2, AS6: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::61 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS6 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::61 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::61 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::61 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::61 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + +# route authorized by a client's white list? +match from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set community 999:64517 +match from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set large-community 999:0:64517 + +match from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::61 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::61 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::61 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::61 set ext-community delete rt 65520:6 + + + +allow quick from 2001:db8:1:1::61 + + + +# --------------------------------------------- +# client AS6_2, outbound + +deny quick to 2001:db8:1:1::61 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::61 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::61 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::61 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv6/openbgpd77p.conf b/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv6/openbgpd77p.conf new file mode 100644 index 00000000..b896b0a1 --- /dev/null +++ b/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv6/openbgpd77p.conf @@ -0,0 +1,3557 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + +# WHITE_LIST_AS4_1, used by client AS4_1 white list +as-set "AS_SET_WHITE_LIST_AS4_1_asns" { + 41 +} +prefix-set "AS_SET_WHITE_LIST_AS4_1_prefixes" { + 4.2.0.0/16 prefixlen 16 - 32 + 2a04:2::/32 prefixlen 32 - 128 +} + +# AS4, used by client AS4_1, client AS4_2 +# no origin ASNs found for AS4 +# no prefixes found for AS4 + +# WHITE_LIST_AS2_2, used by client AS2_2 white list +as-set "AS_SET_WHITE_LIST_AS2_2_asns" { + 21 +} +prefix-set "AS_SET_WHITE_LIST_AS2_2_prefixes" { + 2.2.0.0/16 prefixlen 16 - 32 + 2a02:2::/32 prefixlen 32 - 128 +} + +# AS-AS5_FROM_PDB, used by client AS5_1, client AS5_2 +# no origin ASNs found for AS_AS5_FROM_PDB +# no prefixes found for AS_AS5_FROM_PDB + +# AS-AS4, used by client AS4_1, client AS4_2 +# no origin ASNs found for AS_AS4 +# no prefixes found for AS_AS4 + +# AS2, used by client AS2_1, client AS2_2 +# no origin ASNs found for AS2 +# no prefixes found for AS2 + +# WHITE_LIST_AS5_2, used by client AS5_2 white list +as-set "AS_SET_WHITE_LIST_AS5_2_asns" { + 51 +} +prefix-set "AS_SET_WHITE_LIST_AS5_2_prefixes" { + 5.2.0.0/16 prefixlen 16 - 32 + 2a05:2::/32 prefixlen 32 - 128 +} + +# AS5, used by client AS5_1, client AS5_2 +# no origin ASNs found for AS5 +# no prefixes found for AS5 + +# AS6, used by client AS6_1, client AS6_2 +# no origin ASNs found for AS6 +# no prefixes found for AS6 + +# WHITE_LIST_AS5_1, used by client AS5_1 white list +as-set "AS_SET_WHITE_LIST_AS5_1_asns" { + 51 +} +prefix-set "AS_SET_WHITE_LIST_AS5_1_prefixes" { + 5.2.0.0/16 prefixlen 16 - 32 + 2a05:2::/32 prefixlen 32 - 128 +} + +# WHITE_LIST_AS2_1, used by client AS2_1 white list +as-set "AS_SET_WHITE_LIST_AS2_1_asns" { + 21 +} +prefix-set "AS_SET_WHITE_LIST_AS2_1_prefixes" { + 2.2.0.0/16 prefixlen 16 - 32 + 2a02:2::/32 prefixlen 32 - 128 +} + +# AS1, used by client AS1_1, client AS1_2 +# no origin ASNs found for AS1 +# no prefixes found for AS1 + +# WHITE_LIST_AS4_2, used by client AS4_2 white list +as-set "AS_SET_WHITE_LIST_AS4_2_asns" { + 41 +} +prefix-set "AS_SET_WHITE_LIST_AS4_2_prefixes" { + 4.2.0.0/16 prefixlen 16 - 32 + 2a04:2::/32 prefixlen 32 - 128 +} + +# AS-AS2, used by client AS2_1, client AS2_2 +# no origin ASNs found for AS_AS2 +# no prefixes found for AS_AS2 + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.11 { + remote-as 1 + + rde evaluate all + + descr "AS1_1 client, no AS-SET" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::11 { + remote-as 1 + + rde evaluate all + + descr "AS1_1 client, no AS-SET" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.21 { + remote-as 2 + + rde evaluate all + + descr "AS2_1 client, AS-SET from AS..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::21 { + remote-as 2 + + rde evaluate all + + descr "AS2_1 client, AS-SET from AS..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.41 { + remote-as 4 + + rde evaluate all + + descr "AS4_1 client, AS-SET configu..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::41 { + remote-as 4 + + rde evaluate all + + descr "AS4_1 client, AS-SET configu..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.51 { + remote-as 5 + + rde evaluate all + + descr "AS5_1 client, AS-SET from Pe..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::51 { + remote-as 5 + + rde evaluate all + + descr "AS5_1 client, AS-SET from Pe..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.61 { + remote-as 6 + + rde evaluate all + + descr "AS6_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::61 { + remote-as 6 + + rde evaluate all + + descr "AS6_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# origin_not_present_in_as_set +match from group clients set community delete 999:64515 +match from group clients set large-community delete 999:0:64515 + +# origin_present_in_as_set +match from group clients set community delete 999:64514 +match from group clients set large-community delete 999:0:64514 + +# prefix_not_present_in_as_set +match from group clients set community delete 999:64513 +match from group clients set large-community delete 999:0:64513 + +# prefix_present_in_as_set +match from group clients set community delete 999:64512 +match from group clients set large-community delete 999:0:64512 + +# prefix_validated_via_arin_whois_db_dump +match from group clients set community delete 999:64518 +match from group clients set large-community delete 999:0:64518 + +# prefix_validated_via_rpki_roas +match from group clients set community delete 999:64516 +match from group clients set large-community delete 999:0:64516 + +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + +# route_validated_via_white_list +match from group clients set community delete 999:64517 +match from group clients set large-community delete 999:0:64517 + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + +# --------------------------------------------------------- +# ROAs source + + +roa-set { + +} + + + + +# --------------------------------------------------------- +# RPKI ROAs used as route objects. + +# Add the $INTCOMM_PREF_OK_ROA ext community to routes whose +# origin ASN has a ROA for the announced prefix. +# It will be used later during IRRDB validation in +# case the origin ASN is authorized by a client's +# AS-SET but the prefix is not. + +match from group clients ovs valid set ext-community $INTCOMM_PREF_OK_ROA + + + + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.11 set ext-community rt 65520:1 + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + +match from 192.0.2.21 set ext-community rt 65520:2 + +match from 2001:db8:1:1::21 set ext-community rt 65520:2 + +match from 192.0.2.41 set ext-community rt 65520:4 + +match from 2001:db8:1:1::41 set ext-community rt 65520:4 + +match from 192.0.2.51 set ext-community rt 65520:5 + +match from 2001:db8:1:1::51 set ext-community rt 65520:5 + +match from 192.0.2.61 set ext-community rt 65520:6 + +match from 2001:db8:1:1::61 set ext-community rt 65520:6 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +allow quick from group clients max-as-len 32 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS1_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 192.0.2.11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_1, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS1 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_1, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS1 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.11 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.11 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.11 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.11 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 2001:db8:1:1::11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_2, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS1 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_2, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS1 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::11 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::11 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::11 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::11 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + +deny quick to 2001:db8:1:1::11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.21 set community NO_ADVERTISE +match from 192.0.2.21 nexthop 192.0.2.21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.21 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.21 AS 23456' - reject code: 7 +allow quick from 192.0.2.21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 192.0.2.21 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS2_1, AS2: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.21 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 192.0.2.21 source-as as-set AS_SET_WHITE_LIST_AS2_1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS2_1 +# AS-SET AS_AS2 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS2_1, AS2: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.21 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 192.0.2.21 prefix-set AS_SET_WHITE_LIST_AS2_1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS2_1 +# AS-SET AS_AS2 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.21 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.21 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.21 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.21 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.21 set ext-community delete rt 65520:2 + + + +allow quick from 192.0.2.21 + + + +# --------------------------------------------- +# client AS2_1, outbound + +deny quick to 192.0.2.21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.21 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::21 set community NO_ADVERTISE +match from 2001:db8:1:1::21 nexthop 2001:db8:1:1::21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::21 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 2001:db8:1:1::21 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS2_2, AS2: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::21 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::21 source-as as-set AS_SET_WHITE_LIST_AS2_2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS2_2 +# AS-SET AS2 referenced but empty. +# AS-SET AS_AS2 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS2_2, AS2: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::21 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::21 prefix-set AS_SET_WHITE_LIST_AS2_2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS2_2 +# AS-SET AS2 referenced but empty. +# AS-SET AS_AS2 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::21 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::21 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::21 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::21 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::21 set ext-community delete rt 65520:2 + + + +allow quick from 2001:db8:1:1::21 + + + +# --------------------------------------------- +# client AS2_2, outbound + +deny quick to 2001:db8:1:1::21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::21 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_1, inbound + + + +# NEXT_HOP +match from 192.0.2.41 set community NO_ADVERTISE +match from 192.0.2.41 nexthop 192.0.2.41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.41 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.41 AS 23456' - reject code: 7 +allow quick from 192.0.2.41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 192.0.2.41 prefix 2a04:4::/32 source-as 44 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 2a04:5::/32 prefixlen 32 - 128 source-as 43 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 2a04:6::/32 prefixlen 32 - 128 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 4.4.0.0/16 source-as 44 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 4.5.0.0/16 prefixlen 16 - 32 source-as 43 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 4.6.0.0/16 prefixlen 16 - 32 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 192.0.2.41 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS4_1, AS4: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.41 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.41 source-as as-set AS_SET_WHITE_LIST_AS4_1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS4_1 +# AS-SET AS4 referenced but empty. +# AS-SET AS_AS4 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS4_1, AS4: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.41 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.41 prefix-set AS_SET_WHITE_LIST_AS4_1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS4_1 +# AS-SET AS4 referenced but empty. +# AS-SET AS_AS4 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.41 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.41 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.41 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.41 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + +# route authorized by a client's white list? +match from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set community 999:64517 +match from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set large-community 999:0:64517 + +match from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.41 set ext-community delete rt 65520:4 + + + +allow quick from 192.0.2.41 + + + +# --------------------------------------------- +# client AS4_1, outbound + +deny quick to 192.0.2.41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.41 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::41 set community NO_ADVERTISE +match from 2001:db8:1:1::41 nexthop 2001:db8:1:1::41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::41 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 2001:db8:1:1::41 prefix 2a04:4::/32 source-as 44 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 2a04:5::/32 prefixlen 32 - 128 source-as 43 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 2a04:6::/32 prefixlen 32 - 128 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 4.4.0.0/16 source-as 44 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 4.5.0.0/16 prefixlen 16 - 32 source-as 43 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 4.6.0.0/16 prefixlen 16 - 32 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 2001:db8:1:1::41 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS4_2, AS4: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::41 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS4 referenced but empty. +# AS-SET AS_AS4 referenced but empty. +match from 2001:db8:1:1::41 source-as as-set AS_SET_WHITE_LIST_AS4_2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS4_2 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS4_2, AS4: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::41 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS4 referenced but empty. +# AS-SET AS_AS4 referenced but empty. +match from 2001:db8:1:1::41 prefix-set AS_SET_WHITE_LIST_AS4_2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS4_2 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::41 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::41 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::41 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::41 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + +# route authorized by a client's white list? +match from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set community 999:64517 +match from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set large-community 999:0:64517 + +match from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::41 set ext-community delete rt 65520:4 + + + +allow quick from 2001:db8:1:1::41 + + + +# --------------------------------------------- +# client AS4_2, outbound + +deny quick to 2001:db8:1:1::41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::41 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS5_1, inbound + + + +# NEXT_HOP +match from 192.0.2.51 set community NO_ADVERTISE +match from 192.0.2.51 nexthop 192.0.2.51 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.51 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.51 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.51 peer-as != 5' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.51 peer-as != 5 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.51 AS 23456' - reject code: 7 +allow quick from 192.0.2.51 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.51 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.51 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.51 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.51 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 192.0.2.51 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS5_1, AS5: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.51 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS_AS5_FROM_PDB referenced but empty. +# AS-SET AS5 referenced but empty. +match from 192.0.2.51 source-as as-set AS_SET_WHITE_LIST_AS5_1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS5_1 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS5_1, AS5: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.51 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS_AS5_FROM_PDB referenced but empty. +# AS-SET AS5 referenced but empty. +match from 192.0.2.51 prefix-set AS_SET_WHITE_LIST_AS5_1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS5_1 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.51 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.51 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.51 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.51 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.51 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.51 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.51 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.51 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.51 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.51 set ext-community delete rt 65520:5 + + + +allow quick from 192.0.2.51 + + + +# --------------------------------------------- +# client AS5_1, outbound + +deny quick to 192.0.2.51 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.51 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.51 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.51 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS5_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::51 set community NO_ADVERTISE +match from 2001:db8:1:1::51 nexthop 2001:db8:1:1::51 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::51 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::51 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::51 peer-as != 5' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::51 peer-as != 5 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::51 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::51 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::51 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::51 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::51 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::51 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 2001:db8:1:1::51 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS5_2, AS5: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::51 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS_AS5_FROM_PDB referenced but empty. +match from 2001:db8:1:1::51 source-as as-set AS_SET_WHITE_LIST_AS5_2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS5_2 +# AS-SET AS5 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS5_2, AS5: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::51 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS_AS5_FROM_PDB referenced but empty. +match from 2001:db8:1:1::51 prefix-set AS_SET_WHITE_LIST_AS5_2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS5_2 +# AS-SET AS5 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::51 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::51 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::51 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::51 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::51 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::51 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::51 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::51 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::51 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::51 set ext-community delete rt 65520:5 + + + +allow quick from 2001:db8:1:1::51 + + + +# --------------------------------------------- +# client AS5_2, outbound + +deny quick to 2001:db8:1:1::51 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::51 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::51 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::51 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS6_1, inbound + + + +# NEXT_HOP +match from 192.0.2.61 set community NO_ADVERTISE +match from 192.0.2.61 nexthop 192.0.2.61 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.61 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.61 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.61 peer-as != 6' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.61 peer-as != 6 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.61 AS 23456' - reject code: 7 +allow quick from 192.0.2.61 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.61 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.61 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.61 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.61 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 192.0.2.61 prefix 2a03:2::/32 prefixlen 32 - 128 source-as 3 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.61 prefix 3.2.0.0/16 prefixlen 16 - 32 source-as 3 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 192.0.2.61 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS6_1, AS6: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.61 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS6 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS6_1, AS6: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.61 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS6 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.61 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.61 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.61 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.61 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + +# route authorized by a client's white list? +match from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set community 999:64517 +match from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set large-community 999:0:64517 + +match from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.61 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.61 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.61 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.61 set ext-community delete rt 65520:6 + + + +allow quick from 192.0.2.61 + + + +# --------------------------------------------- +# client AS6_1, outbound + +deny quick to 192.0.2.61 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.61 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.61 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.61 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS6_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::61 set community NO_ADVERTISE +match from 2001:db8:1:1::61 nexthop 2001:db8:1:1::61 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::61 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::61 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::61 peer-as != 6' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::61 peer-as != 6 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::61 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::61 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::61 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::61 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::61 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::61 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 2001:db8:1:1::61 prefix 2a03:2::/32 prefixlen 32 - 128 source-as 3 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::61 prefix 3.2.0.0/16 prefixlen 16 - 32 source-as 3 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 2001:db8:1:1::61 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS6_2, AS6: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::61 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS6 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS6_2, AS6: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::61 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS6 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::61 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::61 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::61 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::61 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + +# route authorized by a client's white list? +match from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set community 999:64517 +match from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set large-community 999:0:64517 + +match from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::61 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::61 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::61 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::61 set ext-community delete rt 65520:6 + + + +allow quick from 2001:db8:1:1::61 + + + +# --------------------------------------------- +# client AS6_2, outbound + +deny quick to 2001:db8:1:1::61 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::61 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::61 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::61 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_WithAS_SETs_BIRD2IPv6/bird2.conf b/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_WithAS_SETs_BIRD2IPv6/bird2.conf index 992ee7cd..00fca2e9 100644 --- a/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_WithAS_SETs_BIRD2IPv6/bird2.conf +++ b/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_WithAS_SETs_BIRD2IPv6/bird2.conf @@ -193,16 +193,16 @@ define AS_SET_AS_AS2_prefixes_6 = [ # ARIN Whois database records define ARIN_Whois_db_AS2_4 = [ - 2.6.0.0/16{16,32}, 2.7.0.0/16{16,32}, 2.0.5.0/24{24,32} + 2.7.0.0/16{16,32}, 2.6.0.0/16{16,32}, 2.0.5.0/24{24,32} ]; define ARIN_Whois_db_AS2_6 = [ - 2a02:0:5::/48{48,128}, 2a02:7::/32{32,128}, 2a02:6::/32{32,128} + 2a02:6::/32{32,128}, 2a02:0:5::/48{48,128}, 2a02:7::/32{32,128} ]; define ARIN_Whois_db_AS3_4 = [ 3.3.0.0/16{16,32}, 3.2.0.0/16{16,32} ]; define ARIN_Whois_db_AS3_6 = [ - 2a03:2::/32{32,128}, 2a03:3::/32{32,128} + 2a03:3::/32{32,128}, 2a03:2::/32{32,128} ]; define ARIN_Whois_db_AS6_4 = [ 6.0.1.0/24{24,32} diff --git a/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_WithAS_SETs_BIRDIPv4/bird16.conf b/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_WithAS_SETs_BIRDIPv4/bird16.conf index fec2cfd8..95c4d947 100644 --- a/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_WithAS_SETs_BIRDIPv4/bird16.conf +++ b/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_WithAS_SETs_BIRDIPv4/bird16.conf @@ -126,10 +126,10 @@ define AS_SET_AS_AS2_prefixes_4 = [ # ARIN Whois database records define ARIN_Whois_db_AS2_4 = [ - 2.7.0.0/16{16,32}, 2.0.5.0/24{24,32}, 2.6.0.0/16{16,32} + 2.0.5.0/24{24,32}, 2.6.0.0/16{16,32}, 2.7.0.0/16{16,32} ]; define ARIN_Whois_db_AS3_4 = [ - 3.2.0.0/16{16,32}, 3.3.0.0/16{16,32} + 3.3.0.0/16{16,32}, 3.2.0.0/16{16,32} ]; define ARIN_Whois_db_AS6_4 = [ 6.0.1.0/24{24,32} diff --git a/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_WithAS_SETs_BIRDIPv6/bird16.conf b/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_WithAS_SETs_BIRDIPv6/bird16.conf index a820f223..4f578b82 100644 --- a/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_WithAS_SETs_BIRDIPv6/bird16.conf +++ b/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_WithAS_SETs_BIRDIPv6/bird16.conf @@ -126,10 +126,10 @@ define AS_SET_AS_AS2_prefixes_6 = [ # ARIN Whois database records define ARIN_Whois_db_AS2_6 = [ - 2a02:7::/32{32,128}, 2a02:6::/32{32,128}, 2a02:0:5::/48{48,128} + 2a02:6::/32{32,128}, 2a02:0:5::/48{48,128}, 2a02:7::/32{32,128} ]; define ARIN_Whois_db_AS3_6 = [ - 2a03:2::/32{32,128}, 2a03:3::/32{32,128} + 2a03:3::/32{32,128}, 2a03:2::/32{32,128} ]; define ARIN_Whois_db_AS6_6 = [ 2a06:0:1::/48{48,128} diff --git a/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_WithAS_SETs_BIRDsIPv4/bird2.conf b/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_WithAS_SETs_BIRDsIPv4/bird2.conf index bf38538e..81929d79 100644 --- a/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_WithAS_SETs_BIRDsIPv4/bird2.conf +++ b/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_WithAS_SETs_BIRDsIPv4/bird2.conf @@ -193,16 +193,16 @@ define AS_SET_AS_AS2_prefixes_4 = [ # ARIN Whois database records define ARIN_Whois_db_AS2_4 = [ - 2.6.0.0/16{16,32}, 2.7.0.0/16{16,32}, 2.0.5.0/24{24,32} + 2.7.0.0/16{16,32}, 2.6.0.0/16{16,32}, 2.0.5.0/24{24,32} ]; define ARIN_Whois_db_AS2_6 = [ - 2a02:0:5::/48{48,128}, 2a02:7::/32{32,128}, 2a02:6::/32{32,128} + 2a02:6::/32{32,128}, 2a02:0:5::/48{48,128}, 2a02:7::/32{32,128} ]; define ARIN_Whois_db_AS3_4 = [ 3.3.0.0/16{16,32}, 3.2.0.0/16{16,32} ]; define ARIN_Whois_db_AS3_6 = [ - 2a03:2::/32{32,128}, 2a03:3::/32{32,128} + 2a03:3::/32{32,128}, 2a03:2::/32{32,128} ]; define ARIN_Whois_db_AS6_4 = [ 6.0.1.0/24{24,32} diff --git a/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_WithAS_SETs_OpenBGPDIPv4/openbgpd76p.conf b/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_WithAS_SETs_OpenBGPDIPv4/openbgpd76p.conf new file mode 100644 index 00000000..bd34f331 --- /dev/null +++ b/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_WithAS_SETs_OpenBGPDIPv4/openbgpd76p.conf @@ -0,0 +1,3741 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + +# WHITE_LIST_AS4_1, used by client AS4_1 white list +as-set "AS_SET_WHITE_LIST_AS4_1_asns" { + 41 +} +prefix-set "AS_SET_WHITE_LIST_AS4_1_prefixes" { + 4.2.0.0/16 prefixlen 16 - 32 + 2a04:2::/32 prefixlen 32 - 128 +} + +# AS4, used by client AS4_1, client AS4_2 +# no origin ASNs found for AS4 +# no prefixes found for AS4 + +# WHITE_LIST_AS2_2, used by client AS2_2 white list +as-set "AS_SET_WHITE_LIST_AS2_2_asns" { + 21 +} +prefix-set "AS_SET_WHITE_LIST_AS2_2_prefixes" { + 2.2.0.0/16 prefixlen 16 - 32 + 2a02:2::/32 prefixlen 32 - 128 +} + +# AS-AS5_FROM_PDB, used by client AS5_1, client AS5_2 +as-set "AS_SET_AS_AS5_FROM_PDB_asns" { + 5 +} +prefix-set "AS_SET_AS_AS5_FROM_PDB_prefixes" { + 5.0.0.0/16 prefixlen 16 - 32 +} + +# AS-AS4, used by client AS4_1, client AS4_2 +as-set "AS_SET_AS_AS4_asns" { + 4 +} +prefix-set "AS_SET_AS_AS4_prefixes" { + 4.0.0.0/16 prefixlen 16 - 32 +} + +# AS2, used by client AS2_1, client AS2_2 +# no origin ASNs found for AS2 +# no prefixes found for AS2 + +# WHITE_LIST_AS5_2, used by client AS5_2 white list +as-set "AS_SET_WHITE_LIST_AS5_2_asns" { + 51 +} +prefix-set "AS_SET_WHITE_LIST_AS5_2_prefixes" { + 5.2.0.0/16 prefixlen 16 - 32 + 2a05:2::/32 prefixlen 32 - 128 +} + +# AS5, used by client AS5_1, client AS5_2 +# no origin ASNs found for AS5 +# no prefixes found for AS5 + +# AS6, used by client AS6_1, client AS6_2 +as-set "AS_SET_AS6_asns" { + 3 6 +} +prefix-set "AS_SET_AS6_prefixes" { + 6.0.0.0/16 prefixlen 16 - 32 +} + +# WHITE_LIST_AS5_1, used by client AS5_1 white list +as-set "AS_SET_WHITE_LIST_AS5_1_asns" { + 51 +} +prefix-set "AS_SET_WHITE_LIST_AS5_1_prefixes" { + 5.2.0.0/16 prefixlen 16 - 32 + 2a05:2::/32 prefixlen 32 - 128 +} + +# WHITE_LIST_AS2_1, used by client AS2_1 white list +as-set "AS_SET_WHITE_LIST_AS2_1_asns" { + 21 +} +prefix-set "AS_SET_WHITE_LIST_AS2_1_prefixes" { + 2.2.0.0/16 prefixlen 16 - 32 + 2a02:2::/32 prefixlen 32 - 128 +} + +# AS1, used by client AS1_1, client AS1_2 +as-set "AS_SET_AS1_asns" { + 1 +} +prefix-set "AS_SET_AS1_prefixes" { + 1.0.0.0/16 prefixlen 16 - 32 +} + +# WHITE_LIST_AS4_2, used by client AS4_2 white list +as-set "AS_SET_WHITE_LIST_AS4_2_asns" { + 41 +} +prefix-set "AS_SET_WHITE_LIST_AS4_2_prefixes" { + 4.2.0.0/16 prefixlen 16 - 32 + 2a04:2::/32 prefixlen 32 - 128 +} + +# AS-AS2, used by client AS2_1, client AS2_2 +as-set "AS_SET_AS_AS2_asns" { + 2 +} +prefix-set "AS_SET_AS_AS2_prefixes" { + 2.0.0.0/16 prefixlen 16 - 32 +} + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.11 { + remote-as 1 + + rde evaluate all + + descr "AS1_1 client, no AS-SET" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::11 { + remote-as 1 + + rde evaluate all + + descr "AS1_1 client, no AS-SET" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.21 { + remote-as 2 + + rde evaluate all + + descr "AS2_1 client, AS-SET from AS..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::21 { + remote-as 2 + + rde evaluate all + + descr "AS2_1 client, AS-SET from AS..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.41 { + remote-as 4 + + rde evaluate all + + descr "AS4_1 client, AS-SET configu..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::41 { + remote-as 4 + + rde evaluate all + + descr "AS4_1 client, AS-SET configu..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.51 { + remote-as 5 + + rde evaluate all + + descr "AS5_1 client, AS-SET from Pe..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::51 { + remote-as 5 + + rde evaluate all + + descr "AS5_1 client, AS-SET from Pe..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.61 { + remote-as 6 + + rde evaluate all + + descr "AS6_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::61 { + remote-as 6 + + rde evaluate all + + descr "AS6_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# origin_not_present_in_as_set +match from group clients set community delete 999:64515 +match from group clients set large-community delete 999:0:64515 + +# origin_present_in_as_set +match from group clients set community delete 999:64514 +match from group clients set large-community delete 999:0:64514 + +# prefix_not_present_in_as_set +match from group clients set community delete 999:64513 +match from group clients set large-community delete 999:0:64513 + +# prefix_present_in_as_set +match from group clients set community delete 999:64512 +match from group clients set large-community delete 999:0:64512 + +# prefix_validated_via_arin_whois_db_dump +match from group clients set community delete 999:64518 +match from group clients set large-community delete 999:0:64518 + +# prefix_validated_via_rpki_roas +match from group clients set community delete 999:64516 +match from group clients set large-community delete 999:0:64516 + +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + +# route_validated_via_white_list +match from group clients set community delete 999:64517 +match from group clients set large-community delete 999:0:64517 + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + +# --------------------------------------------------------- +# ROAs source + + +roa-set { + 2.4.0.0/16 source-as 2 + 2.5.0.0/16 source-as 2 + 2.7.0.0/16 source-as 2 + 3.1.0.0/16 source-as 3 + 3.3.0.0/16 source-as 3 + 2.0.4.0/24 source-as 2 + 6.0.1.0/24 source-as 6 + 2a02:4::/32 source-as 2 + 2a02:5::/32 source-as 2 + 2a02:7::/32 source-as 2 + 2a03:1::/32 source-as 3 + 2a03:3::/32 source-as 3 + 2a02:0:4::/48 source-as 2 + 2a06:0:1::/48 source-as 6 + +} + + + + +# --------------------------------------------------------- +# RPKI ROAs used as route objects. + +# Add the $INTCOMM_PREF_OK_ROA ext community to routes whose +# origin ASN has a ROA for the announced prefix. +# It will be used later during IRRDB validation in +# case the origin ASN is authorized by a client's +# AS-SET but the prefix is not. + +origin-set "RPKI_ROA" { + 2.4.0.0/16 source-as 2 + 2.5.0.0/16 source-as 2 + 2.7.0.0/16 source-as 2 + 3.1.0.0/16 source-as 3 + 3.3.0.0/16 source-as 3 + 2.0.4.0/24 source-as 2 + 6.0.1.0/24 source-as 6 + 2a02:4::/32 source-as 2 + 2a02:5::/32 source-as 2 + 2a02:7::/32 source-as 2 + 2a03:1::/32 source-as 3 + 2a03:3::/32 source-as 3 + 2a02:0:4::/48 source-as 2 + 2a06:0:1::/48 source-as 6 + +} +match from group clients origin-set RPKI_ROA set ext-community $INTCOMM_PREF_OK_ROA + + +# ARIN Whois records used for preifx validation +# --------------------------------------------- + +# Add the $INTCOMM_PREF_OK_ARINDB ext community to routes whose +# origin ASN has an ARIN Whois record for the announced prefix. +# It will be used later during IRRDB validation in +# case the origin ASN is authorized by a client's +# AS-SET but the prefix is not. +origin-set "ARINDB" { +2.0.5.0/24 prefixlen 24 - 32 source-as 2 +2.6.0.0/16 prefixlen 16 - 32 source-as 2 +2.7.0.0/16 prefixlen 16 - 32 source-as 2 +2a02:0:5::/48 prefixlen 48 - 128 source-as 2 +2a02:6::/32 prefixlen 32 - 128 source-as 2 +2a02:7::/32 prefixlen 32 - 128 source-as 2 +2a03:2::/32 prefixlen 32 - 128 source-as 3 +2a03:3::/32 prefixlen 32 - 128 source-as 3 +3.2.0.0/16 prefixlen 16 - 32 source-as 3 +3.3.0.0/16 prefixlen 16 - 32 source-as 3 +2a06:0:1::/48 prefixlen 48 - 128 source-as 6 +6.0.1.0/24 prefixlen 24 - 32 source-as 6 +} +match from group clients origin-set ARINDB set ext-community $INTCOMM_PREF_OK_ARINDB + + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.11 set ext-community rt 65520:1 + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + +match from 192.0.2.21 set ext-community rt 65520:2 + +match from 2001:db8:1:1::21 set ext-community rt 65520:2 + +match from 192.0.2.41 set ext-community rt 65520:4 + +match from 2001:db8:1:1::41 set ext-community rt 65520:4 + +match from 192.0.2.51 set ext-community rt 65520:5 + +match from 2001:db8:1:1::51 set ext-community rt 65520:5 + +match from 192.0.2.61 set ext-community rt 65520:6 + +match from 2001:db8:1:1::61 set ext-community rt 65520:6 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +allow quick from group clients max-as-len 32 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS1_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 192.0.2.11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_1, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.11 source-as as-set AS_SET_AS1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS1 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_1, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.11 prefix-set AS_SET_AS1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS1 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.11 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.11 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.11 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.11 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 2001:db8:1:1::11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_2, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::11 source-as as-set AS_SET_AS1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS1 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_2, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::11 prefix-set AS_SET_AS1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS1 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::11 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::11 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::11 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::11 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + +deny quick to 2001:db8:1:1::11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.21 set community NO_ADVERTISE +match from 192.0.2.21 nexthop 192.0.2.21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.21 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.21 AS 23456' - reject code: 7 +allow quick from 192.0.2.21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 192.0.2.21 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS2_1, AS2: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.21 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 192.0.2.21 source-as as-set AS_SET_WHITE_LIST_AS2_1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS2_1 +match from 192.0.2.21 source-as as-set AS_SET_AS_AS2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS2 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS2_1, AS2: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.21 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 192.0.2.21 prefix-set AS_SET_WHITE_LIST_AS2_1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS2_1 +match from 192.0.2.21 prefix-set AS_SET_AS_AS2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS2 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.21 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.21 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.21 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.21 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.21 set ext-community delete rt 65520:2 + + + +allow quick from 192.0.2.21 + + + +# --------------------------------------------- +# client AS2_1, outbound + +deny quick to 192.0.2.21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.21 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::21 set community NO_ADVERTISE +match from 2001:db8:1:1::21 nexthop 2001:db8:1:1::21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::21 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 2001:db8:1:1::21 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS2_2, AS2: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::21 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::21 source-as as-set AS_SET_WHITE_LIST_AS2_2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS2_2 +# AS-SET AS2 referenced but empty. +match from 2001:db8:1:1::21 source-as as-set AS_SET_AS_AS2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS2 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS2_2, AS2: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::21 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::21 prefix-set AS_SET_WHITE_LIST_AS2_2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS2_2 +# AS-SET AS2 referenced but empty. +match from 2001:db8:1:1::21 prefix-set AS_SET_AS_AS2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS2 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::21 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::21 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::21 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::21 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::21 set ext-community delete rt 65520:2 + + + +allow quick from 2001:db8:1:1::21 + + + +# --------------------------------------------- +# client AS2_2, outbound + +deny quick to 2001:db8:1:1::21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::21 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_1, inbound + + + +# NEXT_HOP +match from 192.0.2.41 set community NO_ADVERTISE +match from 192.0.2.41 nexthop 192.0.2.41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.41 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.41 AS 23456' - reject code: 7 +allow quick from 192.0.2.41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 192.0.2.41 prefix 2a04:4::/32 source-as 44 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 2a04:5::/32 prefixlen 32 - 128 source-as 43 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 2a04:6::/32 prefixlen 32 - 128 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 4.4.0.0/16 source-as 44 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 4.5.0.0/16 prefixlen 16 - 32 source-as 43 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 4.6.0.0/16 prefixlen 16 - 32 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 192.0.2.41 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS4_1, AS4: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.41 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.41 source-as as-set AS_SET_WHITE_LIST_AS4_1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS4_1 +# AS-SET AS4 referenced but empty. +match from 192.0.2.41 source-as as-set AS_SET_AS_AS4_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS4 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS4_1, AS4: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.41 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.41 prefix-set AS_SET_WHITE_LIST_AS4_1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS4_1 +# AS-SET AS4 referenced but empty. +match from 192.0.2.41 prefix-set AS_SET_AS_AS4_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS4 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.41 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.41 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.41 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.41 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + +# route authorized by a client's white list? +match from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set community 999:64517 +match from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set large-community 999:0:64517 + +match from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.41 set ext-community delete rt 65520:4 + + + +allow quick from 192.0.2.41 + + + +# --------------------------------------------- +# client AS4_1, outbound + +deny quick to 192.0.2.41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.41 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::41 set community NO_ADVERTISE +match from 2001:db8:1:1::41 nexthop 2001:db8:1:1::41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::41 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 2001:db8:1:1::41 prefix 2a04:4::/32 source-as 44 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 2a04:5::/32 prefixlen 32 - 128 source-as 43 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 2a04:6::/32 prefixlen 32 - 128 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 4.4.0.0/16 source-as 44 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 4.5.0.0/16 prefixlen 16 - 32 source-as 43 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 4.6.0.0/16 prefixlen 16 - 32 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 2001:db8:1:1::41 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS4_2, AS4: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::41 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS4 referenced but empty. +match from 2001:db8:1:1::41 source-as as-set AS_SET_AS_AS4_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS4 +match from 2001:db8:1:1::41 source-as as-set AS_SET_WHITE_LIST_AS4_2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS4_2 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS4_2, AS4: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::41 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS4 referenced but empty. +match from 2001:db8:1:1::41 prefix-set AS_SET_AS_AS4_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS4 +match from 2001:db8:1:1::41 prefix-set AS_SET_WHITE_LIST_AS4_2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS4_2 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::41 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::41 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::41 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::41 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + +# route authorized by a client's white list? +match from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set community 999:64517 +match from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set large-community 999:0:64517 + +match from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::41 set ext-community delete rt 65520:4 + + + +allow quick from 2001:db8:1:1::41 + + + +# --------------------------------------------- +# client AS4_2, outbound + +deny quick to 2001:db8:1:1::41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::41 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS5_1, inbound + + + +# NEXT_HOP +match from 192.0.2.51 set community NO_ADVERTISE +match from 192.0.2.51 nexthop 192.0.2.51 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.51 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.51 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.51 peer-as != 5' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.51 peer-as != 5 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.51 AS 23456' - reject code: 7 +allow quick from 192.0.2.51 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.51 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.51 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.51 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.51 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 192.0.2.51 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS5_1, AS5: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.51 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.51 source-as as-set AS_SET_AS_AS5_FROM_PDB_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS5_FROM_PDB +# AS-SET AS5 referenced but empty. +match from 192.0.2.51 source-as as-set AS_SET_WHITE_LIST_AS5_1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS5_1 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS5_1, AS5: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.51 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.51 prefix-set AS_SET_AS_AS5_FROM_PDB_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS5_FROM_PDB +# AS-SET AS5 referenced but empty. +match from 192.0.2.51 prefix-set AS_SET_WHITE_LIST_AS5_1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS5_1 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.51 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.51 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.51 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.51 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.51 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.51 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.51 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.51 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.51 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.51 set ext-community delete rt 65520:5 + + + +allow quick from 192.0.2.51 + + + +# --------------------------------------------- +# client AS5_1, outbound + +deny quick to 192.0.2.51 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.51 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.51 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.51 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS5_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::51 set community NO_ADVERTISE +match from 2001:db8:1:1::51 nexthop 2001:db8:1:1::51 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::51 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::51 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::51 peer-as != 5' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::51 peer-as != 5 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::51 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::51 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::51 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::51 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::51 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::51 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 2001:db8:1:1::51 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS5_2, AS5: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::51 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::51 source-as as-set AS_SET_AS_AS5_FROM_PDB_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS5_FROM_PDB +match from 2001:db8:1:1::51 source-as as-set AS_SET_WHITE_LIST_AS5_2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS5_2 +# AS-SET AS5 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS5_2, AS5: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::51 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::51 prefix-set AS_SET_AS_AS5_FROM_PDB_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS5_FROM_PDB +match from 2001:db8:1:1::51 prefix-set AS_SET_WHITE_LIST_AS5_2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS5_2 +# AS-SET AS5 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::51 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::51 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::51 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::51 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::51 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::51 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::51 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::51 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::51 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::51 set ext-community delete rt 65520:5 + + + +allow quick from 2001:db8:1:1::51 + + + +# --------------------------------------------- +# client AS5_2, outbound + +deny quick to 2001:db8:1:1::51 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::51 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::51 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::51 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS6_1, inbound + + + +# NEXT_HOP +match from 192.0.2.61 set community NO_ADVERTISE +match from 192.0.2.61 nexthop 192.0.2.61 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.61 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.61 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.61 peer-as != 6' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.61 peer-as != 6 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.61 AS 23456' - reject code: 7 +allow quick from 192.0.2.61 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.61 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.61 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.61 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.61 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 192.0.2.61 prefix 2a03:2::/32 prefixlen 32 - 128 source-as 3 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.61 prefix 3.2.0.0/16 prefixlen 16 - 32 source-as 3 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 192.0.2.61 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS6_1, AS6: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.61 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.61 source-as as-set AS_SET_AS6_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS6 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS6_1, AS6: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.61 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.61 prefix-set AS_SET_AS6_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS6 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.61 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.61 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.61 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.61 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + +# route authorized by a client's white list? +match from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set community 999:64517 +match from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set large-community 999:0:64517 + +match from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.61 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.61 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.61 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.61 set ext-community delete rt 65520:6 + + + +allow quick from 192.0.2.61 + + + +# --------------------------------------------- +# client AS6_1, outbound + +deny quick to 192.0.2.61 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.61 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.61 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.61 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS6_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::61 set community NO_ADVERTISE +match from 2001:db8:1:1::61 nexthop 2001:db8:1:1::61 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::61 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::61 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::61 peer-as != 6' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::61 peer-as != 6 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::61 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::61 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::61 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::61 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::61 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::61 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 2001:db8:1:1::61 prefix 2a03:2::/32 prefixlen 32 - 128 source-as 3 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::61 prefix 3.2.0.0/16 prefixlen 16 - 32 source-as 3 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 2001:db8:1:1::61 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS6_2, AS6: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::61 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::61 source-as as-set AS_SET_AS6_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS6 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS6_2, AS6: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::61 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::61 prefix-set AS_SET_AS6_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS6 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::61 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::61 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::61 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::61 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + +# route authorized by a client's white list? +match from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set community 999:64517 +match from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set large-community 999:0:64517 + +match from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::61 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::61 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::61 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::61 set ext-community delete rt 65520:6 + + + +allow quick from 2001:db8:1:1::61 + + + +# --------------------------------------------- +# client AS6_2, outbound + +deny quick to 2001:db8:1:1::61 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::61 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::61 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::61 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_WithAS_SETs_OpenBGPDIPv4/openbgpd77p.conf b/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_WithAS_SETs_OpenBGPDIPv4/openbgpd77p.conf new file mode 100644 index 00000000..bd34f331 --- /dev/null +++ b/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_WithAS_SETs_OpenBGPDIPv4/openbgpd77p.conf @@ -0,0 +1,3741 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + +# WHITE_LIST_AS4_1, used by client AS4_1 white list +as-set "AS_SET_WHITE_LIST_AS4_1_asns" { + 41 +} +prefix-set "AS_SET_WHITE_LIST_AS4_1_prefixes" { + 4.2.0.0/16 prefixlen 16 - 32 + 2a04:2::/32 prefixlen 32 - 128 +} + +# AS4, used by client AS4_1, client AS4_2 +# no origin ASNs found for AS4 +# no prefixes found for AS4 + +# WHITE_LIST_AS2_2, used by client AS2_2 white list +as-set "AS_SET_WHITE_LIST_AS2_2_asns" { + 21 +} +prefix-set "AS_SET_WHITE_LIST_AS2_2_prefixes" { + 2.2.0.0/16 prefixlen 16 - 32 + 2a02:2::/32 prefixlen 32 - 128 +} + +# AS-AS5_FROM_PDB, used by client AS5_1, client AS5_2 +as-set "AS_SET_AS_AS5_FROM_PDB_asns" { + 5 +} +prefix-set "AS_SET_AS_AS5_FROM_PDB_prefixes" { + 5.0.0.0/16 prefixlen 16 - 32 +} + +# AS-AS4, used by client AS4_1, client AS4_2 +as-set "AS_SET_AS_AS4_asns" { + 4 +} +prefix-set "AS_SET_AS_AS4_prefixes" { + 4.0.0.0/16 prefixlen 16 - 32 +} + +# AS2, used by client AS2_1, client AS2_2 +# no origin ASNs found for AS2 +# no prefixes found for AS2 + +# WHITE_LIST_AS5_2, used by client AS5_2 white list +as-set "AS_SET_WHITE_LIST_AS5_2_asns" { + 51 +} +prefix-set "AS_SET_WHITE_LIST_AS5_2_prefixes" { + 5.2.0.0/16 prefixlen 16 - 32 + 2a05:2::/32 prefixlen 32 - 128 +} + +# AS5, used by client AS5_1, client AS5_2 +# no origin ASNs found for AS5 +# no prefixes found for AS5 + +# AS6, used by client AS6_1, client AS6_2 +as-set "AS_SET_AS6_asns" { + 3 6 +} +prefix-set "AS_SET_AS6_prefixes" { + 6.0.0.0/16 prefixlen 16 - 32 +} + +# WHITE_LIST_AS5_1, used by client AS5_1 white list +as-set "AS_SET_WHITE_LIST_AS5_1_asns" { + 51 +} +prefix-set "AS_SET_WHITE_LIST_AS5_1_prefixes" { + 5.2.0.0/16 prefixlen 16 - 32 + 2a05:2::/32 prefixlen 32 - 128 +} + +# WHITE_LIST_AS2_1, used by client AS2_1 white list +as-set "AS_SET_WHITE_LIST_AS2_1_asns" { + 21 +} +prefix-set "AS_SET_WHITE_LIST_AS2_1_prefixes" { + 2.2.0.0/16 prefixlen 16 - 32 + 2a02:2::/32 prefixlen 32 - 128 +} + +# AS1, used by client AS1_1, client AS1_2 +as-set "AS_SET_AS1_asns" { + 1 +} +prefix-set "AS_SET_AS1_prefixes" { + 1.0.0.0/16 prefixlen 16 - 32 +} + +# WHITE_LIST_AS4_2, used by client AS4_2 white list +as-set "AS_SET_WHITE_LIST_AS4_2_asns" { + 41 +} +prefix-set "AS_SET_WHITE_LIST_AS4_2_prefixes" { + 4.2.0.0/16 prefixlen 16 - 32 + 2a04:2::/32 prefixlen 32 - 128 +} + +# AS-AS2, used by client AS2_1, client AS2_2 +as-set "AS_SET_AS_AS2_asns" { + 2 +} +prefix-set "AS_SET_AS_AS2_prefixes" { + 2.0.0.0/16 prefixlen 16 - 32 +} + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.11 { + remote-as 1 + + rde evaluate all + + descr "AS1_1 client, no AS-SET" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::11 { + remote-as 1 + + rde evaluate all + + descr "AS1_1 client, no AS-SET" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.21 { + remote-as 2 + + rde evaluate all + + descr "AS2_1 client, AS-SET from AS..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::21 { + remote-as 2 + + rde evaluate all + + descr "AS2_1 client, AS-SET from AS..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.41 { + remote-as 4 + + rde evaluate all + + descr "AS4_1 client, AS-SET configu..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::41 { + remote-as 4 + + rde evaluate all + + descr "AS4_1 client, AS-SET configu..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.51 { + remote-as 5 + + rde evaluate all + + descr "AS5_1 client, AS-SET from Pe..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::51 { + remote-as 5 + + rde evaluate all + + descr "AS5_1 client, AS-SET from Pe..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.61 { + remote-as 6 + + rde evaluate all + + descr "AS6_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::61 { + remote-as 6 + + rde evaluate all + + descr "AS6_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# origin_not_present_in_as_set +match from group clients set community delete 999:64515 +match from group clients set large-community delete 999:0:64515 + +# origin_present_in_as_set +match from group clients set community delete 999:64514 +match from group clients set large-community delete 999:0:64514 + +# prefix_not_present_in_as_set +match from group clients set community delete 999:64513 +match from group clients set large-community delete 999:0:64513 + +# prefix_present_in_as_set +match from group clients set community delete 999:64512 +match from group clients set large-community delete 999:0:64512 + +# prefix_validated_via_arin_whois_db_dump +match from group clients set community delete 999:64518 +match from group clients set large-community delete 999:0:64518 + +# prefix_validated_via_rpki_roas +match from group clients set community delete 999:64516 +match from group clients set large-community delete 999:0:64516 + +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + +# route_validated_via_white_list +match from group clients set community delete 999:64517 +match from group clients set large-community delete 999:0:64517 + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + +# --------------------------------------------------------- +# ROAs source + + +roa-set { + 2.4.0.0/16 source-as 2 + 2.5.0.0/16 source-as 2 + 2.7.0.0/16 source-as 2 + 3.1.0.0/16 source-as 3 + 3.3.0.0/16 source-as 3 + 2.0.4.0/24 source-as 2 + 6.0.1.0/24 source-as 6 + 2a02:4::/32 source-as 2 + 2a02:5::/32 source-as 2 + 2a02:7::/32 source-as 2 + 2a03:1::/32 source-as 3 + 2a03:3::/32 source-as 3 + 2a02:0:4::/48 source-as 2 + 2a06:0:1::/48 source-as 6 + +} + + + + +# --------------------------------------------------------- +# RPKI ROAs used as route objects. + +# Add the $INTCOMM_PREF_OK_ROA ext community to routes whose +# origin ASN has a ROA for the announced prefix. +# It will be used later during IRRDB validation in +# case the origin ASN is authorized by a client's +# AS-SET but the prefix is not. + +origin-set "RPKI_ROA" { + 2.4.0.0/16 source-as 2 + 2.5.0.0/16 source-as 2 + 2.7.0.0/16 source-as 2 + 3.1.0.0/16 source-as 3 + 3.3.0.0/16 source-as 3 + 2.0.4.0/24 source-as 2 + 6.0.1.0/24 source-as 6 + 2a02:4::/32 source-as 2 + 2a02:5::/32 source-as 2 + 2a02:7::/32 source-as 2 + 2a03:1::/32 source-as 3 + 2a03:3::/32 source-as 3 + 2a02:0:4::/48 source-as 2 + 2a06:0:1::/48 source-as 6 + +} +match from group clients origin-set RPKI_ROA set ext-community $INTCOMM_PREF_OK_ROA + + +# ARIN Whois records used for preifx validation +# --------------------------------------------- + +# Add the $INTCOMM_PREF_OK_ARINDB ext community to routes whose +# origin ASN has an ARIN Whois record for the announced prefix. +# It will be used later during IRRDB validation in +# case the origin ASN is authorized by a client's +# AS-SET but the prefix is not. +origin-set "ARINDB" { +2.0.5.0/24 prefixlen 24 - 32 source-as 2 +2.6.0.0/16 prefixlen 16 - 32 source-as 2 +2.7.0.0/16 prefixlen 16 - 32 source-as 2 +2a02:0:5::/48 prefixlen 48 - 128 source-as 2 +2a02:6::/32 prefixlen 32 - 128 source-as 2 +2a02:7::/32 prefixlen 32 - 128 source-as 2 +2a03:2::/32 prefixlen 32 - 128 source-as 3 +2a03:3::/32 prefixlen 32 - 128 source-as 3 +3.2.0.0/16 prefixlen 16 - 32 source-as 3 +3.3.0.0/16 prefixlen 16 - 32 source-as 3 +2a06:0:1::/48 prefixlen 48 - 128 source-as 6 +6.0.1.0/24 prefixlen 24 - 32 source-as 6 +} +match from group clients origin-set ARINDB set ext-community $INTCOMM_PREF_OK_ARINDB + + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.11 set ext-community rt 65520:1 + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + +match from 192.0.2.21 set ext-community rt 65520:2 + +match from 2001:db8:1:1::21 set ext-community rt 65520:2 + +match from 192.0.2.41 set ext-community rt 65520:4 + +match from 2001:db8:1:1::41 set ext-community rt 65520:4 + +match from 192.0.2.51 set ext-community rt 65520:5 + +match from 2001:db8:1:1::51 set ext-community rt 65520:5 + +match from 192.0.2.61 set ext-community rt 65520:6 + +match from 2001:db8:1:1::61 set ext-community rt 65520:6 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +allow quick from group clients max-as-len 32 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS1_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 192.0.2.11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_1, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.11 source-as as-set AS_SET_AS1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS1 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_1, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.11 prefix-set AS_SET_AS1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS1 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.11 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.11 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.11 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.11 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 2001:db8:1:1::11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_2, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::11 source-as as-set AS_SET_AS1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS1 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_2, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::11 prefix-set AS_SET_AS1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS1 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::11 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::11 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::11 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::11 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + +deny quick to 2001:db8:1:1::11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.21 set community NO_ADVERTISE +match from 192.0.2.21 nexthop 192.0.2.21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.21 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.21 AS 23456' - reject code: 7 +allow quick from 192.0.2.21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 192.0.2.21 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS2_1, AS2: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.21 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 192.0.2.21 source-as as-set AS_SET_WHITE_LIST_AS2_1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS2_1 +match from 192.0.2.21 source-as as-set AS_SET_AS_AS2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS2 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS2_1, AS2: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.21 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 192.0.2.21 prefix-set AS_SET_WHITE_LIST_AS2_1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS2_1 +match from 192.0.2.21 prefix-set AS_SET_AS_AS2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS2 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.21 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.21 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.21 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.21 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.21 set ext-community delete rt 65520:2 + + + +allow quick from 192.0.2.21 + + + +# --------------------------------------------- +# client AS2_1, outbound + +deny quick to 192.0.2.21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.21 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::21 set community NO_ADVERTISE +match from 2001:db8:1:1::21 nexthop 2001:db8:1:1::21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::21 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 2001:db8:1:1::21 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS2_2, AS2: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::21 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::21 source-as as-set AS_SET_WHITE_LIST_AS2_2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS2_2 +# AS-SET AS2 referenced but empty. +match from 2001:db8:1:1::21 source-as as-set AS_SET_AS_AS2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS2 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS2_2, AS2: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::21 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::21 prefix-set AS_SET_WHITE_LIST_AS2_2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS2_2 +# AS-SET AS2 referenced but empty. +match from 2001:db8:1:1::21 prefix-set AS_SET_AS_AS2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS2 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::21 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::21 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::21 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::21 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::21 set ext-community delete rt 65520:2 + + + +allow quick from 2001:db8:1:1::21 + + + +# --------------------------------------------- +# client AS2_2, outbound + +deny quick to 2001:db8:1:1::21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::21 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_1, inbound + + + +# NEXT_HOP +match from 192.0.2.41 set community NO_ADVERTISE +match from 192.0.2.41 nexthop 192.0.2.41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.41 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.41 AS 23456' - reject code: 7 +allow quick from 192.0.2.41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 192.0.2.41 prefix 2a04:4::/32 source-as 44 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 2a04:5::/32 prefixlen 32 - 128 source-as 43 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 2a04:6::/32 prefixlen 32 - 128 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 4.4.0.0/16 source-as 44 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 4.5.0.0/16 prefixlen 16 - 32 source-as 43 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 4.6.0.0/16 prefixlen 16 - 32 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 192.0.2.41 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS4_1, AS4: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.41 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.41 source-as as-set AS_SET_WHITE_LIST_AS4_1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS4_1 +# AS-SET AS4 referenced but empty. +match from 192.0.2.41 source-as as-set AS_SET_AS_AS4_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS4 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS4_1, AS4: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.41 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.41 prefix-set AS_SET_WHITE_LIST_AS4_1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS4_1 +# AS-SET AS4 referenced but empty. +match from 192.0.2.41 prefix-set AS_SET_AS_AS4_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS4 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.41 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.41 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.41 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.41 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + +# route authorized by a client's white list? +match from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set community 999:64517 +match from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set large-community 999:0:64517 + +match from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.41 set ext-community delete rt 65520:4 + + + +allow quick from 192.0.2.41 + + + +# --------------------------------------------- +# client AS4_1, outbound + +deny quick to 192.0.2.41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.41 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::41 set community NO_ADVERTISE +match from 2001:db8:1:1::41 nexthop 2001:db8:1:1::41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::41 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 2001:db8:1:1::41 prefix 2a04:4::/32 source-as 44 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 2a04:5::/32 prefixlen 32 - 128 source-as 43 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 2a04:6::/32 prefixlen 32 - 128 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 4.4.0.0/16 source-as 44 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 4.5.0.0/16 prefixlen 16 - 32 source-as 43 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 4.6.0.0/16 prefixlen 16 - 32 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 2001:db8:1:1::41 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS4_2, AS4: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::41 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS4 referenced but empty. +match from 2001:db8:1:1::41 source-as as-set AS_SET_AS_AS4_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS4 +match from 2001:db8:1:1::41 source-as as-set AS_SET_WHITE_LIST_AS4_2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS4_2 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS4_2, AS4: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::41 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS4 referenced but empty. +match from 2001:db8:1:1::41 prefix-set AS_SET_AS_AS4_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS4 +match from 2001:db8:1:1::41 prefix-set AS_SET_WHITE_LIST_AS4_2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS4_2 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::41 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::41 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::41 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::41 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + +# route authorized by a client's white list? +match from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set community 999:64517 +match from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set large-community 999:0:64517 + +match from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::41 set ext-community delete rt 65520:4 + + + +allow quick from 2001:db8:1:1::41 + + + +# --------------------------------------------- +# client AS4_2, outbound + +deny quick to 2001:db8:1:1::41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::41 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS5_1, inbound + + + +# NEXT_HOP +match from 192.0.2.51 set community NO_ADVERTISE +match from 192.0.2.51 nexthop 192.0.2.51 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.51 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.51 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.51 peer-as != 5' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.51 peer-as != 5 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.51 AS 23456' - reject code: 7 +allow quick from 192.0.2.51 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.51 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.51 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.51 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.51 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 192.0.2.51 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS5_1, AS5: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.51 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.51 source-as as-set AS_SET_AS_AS5_FROM_PDB_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS5_FROM_PDB +# AS-SET AS5 referenced but empty. +match from 192.0.2.51 source-as as-set AS_SET_WHITE_LIST_AS5_1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS5_1 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS5_1, AS5: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.51 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.51 prefix-set AS_SET_AS_AS5_FROM_PDB_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS5_FROM_PDB +# AS-SET AS5 referenced but empty. +match from 192.0.2.51 prefix-set AS_SET_WHITE_LIST_AS5_1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS5_1 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.51 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.51 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.51 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.51 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.51 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.51 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.51 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.51 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.51 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.51 set ext-community delete rt 65520:5 + + + +allow quick from 192.0.2.51 + + + +# --------------------------------------------- +# client AS5_1, outbound + +deny quick to 192.0.2.51 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.51 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.51 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.51 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS5_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::51 set community NO_ADVERTISE +match from 2001:db8:1:1::51 nexthop 2001:db8:1:1::51 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::51 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::51 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::51 peer-as != 5' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::51 peer-as != 5 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::51 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::51 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::51 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::51 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::51 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::51 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 2001:db8:1:1::51 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS5_2, AS5: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::51 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::51 source-as as-set AS_SET_AS_AS5_FROM_PDB_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS5_FROM_PDB +match from 2001:db8:1:1::51 source-as as-set AS_SET_WHITE_LIST_AS5_2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS5_2 +# AS-SET AS5 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS5_2, AS5: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::51 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::51 prefix-set AS_SET_AS_AS5_FROM_PDB_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS5_FROM_PDB +match from 2001:db8:1:1::51 prefix-set AS_SET_WHITE_LIST_AS5_2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS5_2 +# AS-SET AS5 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::51 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::51 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::51 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::51 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::51 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::51 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::51 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::51 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::51 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::51 set ext-community delete rt 65520:5 + + + +allow quick from 2001:db8:1:1::51 + + + +# --------------------------------------------- +# client AS5_2, outbound + +deny quick to 2001:db8:1:1::51 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::51 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::51 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::51 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS6_1, inbound + + + +# NEXT_HOP +match from 192.0.2.61 set community NO_ADVERTISE +match from 192.0.2.61 nexthop 192.0.2.61 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.61 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.61 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.61 peer-as != 6' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.61 peer-as != 6 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.61 AS 23456' - reject code: 7 +allow quick from 192.0.2.61 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.61 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.61 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.61 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.61 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 192.0.2.61 prefix 2a03:2::/32 prefixlen 32 - 128 source-as 3 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.61 prefix 3.2.0.0/16 prefixlen 16 - 32 source-as 3 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 192.0.2.61 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS6_1, AS6: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.61 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.61 source-as as-set AS_SET_AS6_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS6 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS6_1, AS6: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.61 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.61 prefix-set AS_SET_AS6_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS6 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.61 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.61 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.61 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.61 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + +# route authorized by a client's white list? +match from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set community 999:64517 +match from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set large-community 999:0:64517 + +match from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.61 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.61 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.61 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.61 set ext-community delete rt 65520:6 + + + +allow quick from 192.0.2.61 + + + +# --------------------------------------------- +# client AS6_1, outbound + +deny quick to 192.0.2.61 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.61 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.61 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.61 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS6_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::61 set community NO_ADVERTISE +match from 2001:db8:1:1::61 nexthop 2001:db8:1:1::61 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::61 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::61 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::61 peer-as != 6' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::61 peer-as != 6 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::61 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::61 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::61 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::61 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::61 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::61 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 2001:db8:1:1::61 prefix 2a03:2::/32 prefixlen 32 - 128 source-as 3 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::61 prefix 3.2.0.0/16 prefixlen 16 - 32 source-as 3 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 2001:db8:1:1::61 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS6_2, AS6: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::61 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::61 source-as as-set AS_SET_AS6_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS6 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS6_2, AS6: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::61 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::61 prefix-set AS_SET_AS6_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS6 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::61 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::61 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::61 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::61 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + +# route authorized by a client's white list? +match from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set community 999:64517 +match from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set large-community 999:0:64517 + +match from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::61 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::61 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::61 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::61 set ext-community delete rt 65520:6 + + + +allow quick from 2001:db8:1:1::61 + + + +# --------------------------------------------- +# client AS6_2, outbound + +deny quick to 2001:db8:1:1::61 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::61 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::61 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::61 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_WithAS_SETs_OpenBGPDIPv6/openbgpd76p.conf b/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_WithAS_SETs_OpenBGPDIPv6/openbgpd76p.conf new file mode 100644 index 00000000..ecab7e3e --- /dev/null +++ b/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_WithAS_SETs_OpenBGPDIPv6/openbgpd76p.conf @@ -0,0 +1,3741 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + +# WHITE_LIST_AS4_1, used by client AS4_1 white list +as-set "AS_SET_WHITE_LIST_AS4_1_asns" { + 41 +} +prefix-set "AS_SET_WHITE_LIST_AS4_1_prefixes" { + 4.2.0.0/16 prefixlen 16 - 32 + 2a04:2::/32 prefixlen 32 - 128 +} + +# AS4, used by client AS4_1, client AS4_2 +# no origin ASNs found for AS4 +# no prefixes found for AS4 + +# WHITE_LIST_AS2_2, used by client AS2_2 white list +as-set "AS_SET_WHITE_LIST_AS2_2_asns" { + 21 +} +prefix-set "AS_SET_WHITE_LIST_AS2_2_prefixes" { + 2.2.0.0/16 prefixlen 16 - 32 + 2a02:2::/32 prefixlen 32 - 128 +} + +# AS-AS5_FROM_PDB, used by client AS5_1, client AS5_2 +as-set "AS_SET_AS_AS5_FROM_PDB_asns" { + 5 +} +prefix-set "AS_SET_AS_AS5_FROM_PDB_prefixes" { + 2a05::/32 prefixlen 32 - 128 +} + +# AS-AS4, used by client AS4_1, client AS4_2 +as-set "AS_SET_AS_AS4_asns" { + 4 +} +prefix-set "AS_SET_AS_AS4_prefixes" { + 2a04::/32 prefixlen 32 - 128 +} + +# AS2, used by client AS2_1, client AS2_2 +# no origin ASNs found for AS2 +# no prefixes found for AS2 + +# WHITE_LIST_AS5_2, used by client AS5_2 white list +as-set "AS_SET_WHITE_LIST_AS5_2_asns" { + 51 +} +prefix-set "AS_SET_WHITE_LIST_AS5_2_prefixes" { + 5.2.0.0/16 prefixlen 16 - 32 + 2a05:2::/32 prefixlen 32 - 128 +} + +# AS5, used by client AS5_1, client AS5_2 +# no origin ASNs found for AS5 +# no prefixes found for AS5 + +# AS6, used by client AS6_1, client AS6_2 +as-set "AS_SET_AS6_asns" { + 3 6 +} +prefix-set "AS_SET_AS6_prefixes" { + 2a06::/32 prefixlen 32 - 128 +} + +# WHITE_LIST_AS5_1, used by client AS5_1 white list +as-set "AS_SET_WHITE_LIST_AS5_1_asns" { + 51 +} +prefix-set "AS_SET_WHITE_LIST_AS5_1_prefixes" { + 5.2.0.0/16 prefixlen 16 - 32 + 2a05:2::/32 prefixlen 32 - 128 +} + +# WHITE_LIST_AS2_1, used by client AS2_1 white list +as-set "AS_SET_WHITE_LIST_AS2_1_asns" { + 21 +} +prefix-set "AS_SET_WHITE_LIST_AS2_1_prefixes" { + 2.2.0.0/16 prefixlen 16 - 32 + 2a02:2::/32 prefixlen 32 - 128 +} + +# AS1, used by client AS1_1, client AS1_2 +as-set "AS_SET_AS1_asns" { + 1 +} +prefix-set "AS_SET_AS1_prefixes" { + 2a01::/32 prefixlen 32 - 128 +} + +# WHITE_LIST_AS4_2, used by client AS4_2 white list +as-set "AS_SET_WHITE_LIST_AS4_2_asns" { + 41 +} +prefix-set "AS_SET_WHITE_LIST_AS4_2_prefixes" { + 4.2.0.0/16 prefixlen 16 - 32 + 2a04:2::/32 prefixlen 32 - 128 +} + +# AS-AS2, used by client AS2_1, client AS2_2 +as-set "AS_SET_AS_AS2_asns" { + 2 +} +prefix-set "AS_SET_AS_AS2_prefixes" { + 2a02::/32 prefixlen 32 - 128 +} + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.11 { + remote-as 1 + + rde evaluate all + + descr "AS1_1 client, no AS-SET" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::11 { + remote-as 1 + + rde evaluate all + + descr "AS1_1 client, no AS-SET" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.21 { + remote-as 2 + + rde evaluate all + + descr "AS2_1 client, AS-SET from AS..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::21 { + remote-as 2 + + rde evaluate all + + descr "AS2_1 client, AS-SET from AS..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.41 { + remote-as 4 + + rde evaluate all + + descr "AS4_1 client, AS-SET configu..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::41 { + remote-as 4 + + rde evaluate all + + descr "AS4_1 client, AS-SET configu..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.51 { + remote-as 5 + + rde evaluate all + + descr "AS5_1 client, AS-SET from Pe..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::51 { + remote-as 5 + + rde evaluate all + + descr "AS5_1 client, AS-SET from Pe..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.61 { + remote-as 6 + + rde evaluate all + + descr "AS6_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::61 { + remote-as 6 + + rde evaluate all + + descr "AS6_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# origin_not_present_in_as_set +match from group clients set community delete 999:64515 +match from group clients set large-community delete 999:0:64515 + +# origin_present_in_as_set +match from group clients set community delete 999:64514 +match from group clients set large-community delete 999:0:64514 + +# prefix_not_present_in_as_set +match from group clients set community delete 999:64513 +match from group clients set large-community delete 999:0:64513 + +# prefix_present_in_as_set +match from group clients set community delete 999:64512 +match from group clients set large-community delete 999:0:64512 + +# prefix_validated_via_arin_whois_db_dump +match from group clients set community delete 999:64518 +match from group clients set large-community delete 999:0:64518 + +# prefix_validated_via_rpki_roas +match from group clients set community delete 999:64516 +match from group clients set large-community delete 999:0:64516 + +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + +# route_validated_via_white_list +match from group clients set community delete 999:64517 +match from group clients set large-community delete 999:0:64517 + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + +# --------------------------------------------------------- +# ROAs source + + +roa-set { + 2.4.0.0/16 source-as 2 + 2.5.0.0/16 source-as 2 + 2.7.0.0/16 source-as 2 + 3.1.0.0/16 source-as 3 + 3.3.0.0/16 source-as 3 + 2.0.4.0/24 source-as 2 + 6.0.1.0/24 source-as 6 + 2a02:4::/32 source-as 2 + 2a02:5::/32 source-as 2 + 2a02:7::/32 source-as 2 + 2a03:1::/32 source-as 3 + 2a03:3::/32 source-as 3 + 2a02:0:4::/48 source-as 2 + 2a06:0:1::/48 source-as 6 + +} + + + + +# --------------------------------------------------------- +# RPKI ROAs used as route objects. + +# Add the $INTCOMM_PREF_OK_ROA ext community to routes whose +# origin ASN has a ROA for the announced prefix. +# It will be used later during IRRDB validation in +# case the origin ASN is authorized by a client's +# AS-SET but the prefix is not. + +origin-set "RPKI_ROA" { + 2.4.0.0/16 source-as 2 + 2.5.0.0/16 source-as 2 + 2.7.0.0/16 source-as 2 + 3.1.0.0/16 source-as 3 + 3.3.0.0/16 source-as 3 + 2.0.4.0/24 source-as 2 + 6.0.1.0/24 source-as 6 + 2a02:4::/32 source-as 2 + 2a02:5::/32 source-as 2 + 2a02:7::/32 source-as 2 + 2a03:1::/32 source-as 3 + 2a03:3::/32 source-as 3 + 2a02:0:4::/48 source-as 2 + 2a06:0:1::/48 source-as 6 + +} +match from group clients origin-set RPKI_ROA set ext-community $INTCOMM_PREF_OK_ROA + + +# ARIN Whois records used for preifx validation +# --------------------------------------------- + +# Add the $INTCOMM_PREF_OK_ARINDB ext community to routes whose +# origin ASN has an ARIN Whois record for the announced prefix. +# It will be used later during IRRDB validation in +# case the origin ASN is authorized by a client's +# AS-SET but the prefix is not. +origin-set "ARINDB" { +2.0.5.0/24 prefixlen 24 - 32 source-as 2 +2.6.0.0/16 prefixlen 16 - 32 source-as 2 +2.7.0.0/16 prefixlen 16 - 32 source-as 2 +2a02:0:5::/48 prefixlen 48 - 128 source-as 2 +2a02:6::/32 prefixlen 32 - 128 source-as 2 +2a02:7::/32 prefixlen 32 - 128 source-as 2 +2a03:2::/32 prefixlen 32 - 128 source-as 3 +2a03:3::/32 prefixlen 32 - 128 source-as 3 +3.2.0.0/16 prefixlen 16 - 32 source-as 3 +3.3.0.0/16 prefixlen 16 - 32 source-as 3 +2a06:0:1::/48 prefixlen 48 - 128 source-as 6 +6.0.1.0/24 prefixlen 24 - 32 source-as 6 +} +match from group clients origin-set ARINDB set ext-community $INTCOMM_PREF_OK_ARINDB + + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.11 set ext-community rt 65520:1 + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + +match from 192.0.2.21 set ext-community rt 65520:2 + +match from 2001:db8:1:1::21 set ext-community rt 65520:2 + +match from 192.0.2.41 set ext-community rt 65520:4 + +match from 2001:db8:1:1::41 set ext-community rt 65520:4 + +match from 192.0.2.51 set ext-community rt 65520:5 + +match from 2001:db8:1:1::51 set ext-community rt 65520:5 + +match from 192.0.2.61 set ext-community rt 65520:6 + +match from 2001:db8:1:1::61 set ext-community rt 65520:6 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +allow quick from group clients max-as-len 32 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS1_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 192.0.2.11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_1, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.11 source-as as-set AS_SET_AS1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS1 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_1, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.11 prefix-set AS_SET_AS1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS1 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.11 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.11 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.11 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.11 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 2001:db8:1:1::11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_2, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::11 source-as as-set AS_SET_AS1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS1 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_2, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::11 prefix-set AS_SET_AS1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS1 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::11 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::11 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::11 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::11 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + +deny quick to 2001:db8:1:1::11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.21 set community NO_ADVERTISE +match from 192.0.2.21 nexthop 192.0.2.21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.21 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.21 AS 23456' - reject code: 7 +allow quick from 192.0.2.21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 192.0.2.21 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS2_1, AS2: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.21 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 192.0.2.21 source-as as-set AS_SET_WHITE_LIST_AS2_1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS2_1 +match from 192.0.2.21 source-as as-set AS_SET_AS_AS2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS2 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS2_1, AS2: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.21 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 192.0.2.21 prefix-set AS_SET_WHITE_LIST_AS2_1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS2_1 +match from 192.0.2.21 prefix-set AS_SET_AS_AS2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS2 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.21 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.21 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.21 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.21 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.21 set ext-community delete rt 65520:2 + + + +allow quick from 192.0.2.21 + + + +# --------------------------------------------- +# client AS2_1, outbound + +deny quick to 192.0.2.21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.21 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::21 set community NO_ADVERTISE +match from 2001:db8:1:1::21 nexthop 2001:db8:1:1::21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::21 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 2001:db8:1:1::21 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS2_2, AS2: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::21 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::21 source-as as-set AS_SET_WHITE_LIST_AS2_2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS2_2 +# AS-SET AS2 referenced but empty. +match from 2001:db8:1:1::21 source-as as-set AS_SET_AS_AS2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS2 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS2_2, AS2: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::21 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::21 prefix-set AS_SET_WHITE_LIST_AS2_2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS2_2 +# AS-SET AS2 referenced but empty. +match from 2001:db8:1:1::21 prefix-set AS_SET_AS_AS2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS2 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::21 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::21 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::21 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::21 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::21 set ext-community delete rt 65520:2 + + + +allow quick from 2001:db8:1:1::21 + + + +# --------------------------------------------- +# client AS2_2, outbound + +deny quick to 2001:db8:1:1::21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::21 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_1, inbound + + + +# NEXT_HOP +match from 192.0.2.41 set community NO_ADVERTISE +match from 192.0.2.41 nexthop 192.0.2.41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.41 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.41 AS 23456' - reject code: 7 +allow quick from 192.0.2.41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 192.0.2.41 prefix 2a04:4::/32 source-as 44 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 2a04:5::/32 prefixlen 32 - 128 source-as 43 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 2a04:6::/32 prefixlen 32 - 128 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 4.4.0.0/16 source-as 44 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 4.5.0.0/16 prefixlen 16 - 32 source-as 43 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 4.6.0.0/16 prefixlen 16 - 32 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 192.0.2.41 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS4_1, AS4: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.41 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.41 source-as as-set AS_SET_WHITE_LIST_AS4_1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS4_1 +# AS-SET AS4 referenced but empty. +match from 192.0.2.41 source-as as-set AS_SET_AS_AS4_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS4 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS4_1, AS4: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.41 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.41 prefix-set AS_SET_WHITE_LIST_AS4_1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS4_1 +# AS-SET AS4 referenced but empty. +match from 192.0.2.41 prefix-set AS_SET_AS_AS4_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS4 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.41 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.41 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.41 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.41 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + +# route authorized by a client's white list? +match from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set community 999:64517 +match from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set large-community 999:0:64517 + +match from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.41 set ext-community delete rt 65520:4 + + + +allow quick from 192.0.2.41 + + + +# --------------------------------------------- +# client AS4_1, outbound + +deny quick to 192.0.2.41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.41 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::41 set community NO_ADVERTISE +match from 2001:db8:1:1::41 nexthop 2001:db8:1:1::41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::41 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 2001:db8:1:1::41 prefix 2a04:4::/32 source-as 44 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 2a04:5::/32 prefixlen 32 - 128 source-as 43 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 2a04:6::/32 prefixlen 32 - 128 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 4.4.0.0/16 source-as 44 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 4.5.0.0/16 prefixlen 16 - 32 source-as 43 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 4.6.0.0/16 prefixlen 16 - 32 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 2001:db8:1:1::41 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS4_2, AS4: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::41 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS4 referenced but empty. +match from 2001:db8:1:1::41 source-as as-set AS_SET_AS_AS4_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS4 +match from 2001:db8:1:1::41 source-as as-set AS_SET_WHITE_LIST_AS4_2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS4_2 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS4_2, AS4: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::41 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS4 referenced but empty. +match from 2001:db8:1:1::41 prefix-set AS_SET_AS_AS4_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS4 +match from 2001:db8:1:1::41 prefix-set AS_SET_WHITE_LIST_AS4_2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS4_2 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::41 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::41 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::41 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::41 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + +# route authorized by a client's white list? +match from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set community 999:64517 +match from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set large-community 999:0:64517 + +match from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::41 set ext-community delete rt 65520:4 + + + +allow quick from 2001:db8:1:1::41 + + + +# --------------------------------------------- +# client AS4_2, outbound + +deny quick to 2001:db8:1:1::41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::41 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS5_1, inbound + + + +# NEXT_HOP +match from 192.0.2.51 set community NO_ADVERTISE +match from 192.0.2.51 nexthop 192.0.2.51 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.51 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.51 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.51 peer-as != 5' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.51 peer-as != 5 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.51 AS 23456' - reject code: 7 +allow quick from 192.0.2.51 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.51 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.51 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.51 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.51 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 192.0.2.51 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS5_1, AS5: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.51 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.51 source-as as-set AS_SET_AS_AS5_FROM_PDB_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS5_FROM_PDB +# AS-SET AS5 referenced but empty. +match from 192.0.2.51 source-as as-set AS_SET_WHITE_LIST_AS5_1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS5_1 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS5_1, AS5: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.51 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.51 prefix-set AS_SET_AS_AS5_FROM_PDB_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS5_FROM_PDB +# AS-SET AS5 referenced but empty. +match from 192.0.2.51 prefix-set AS_SET_WHITE_LIST_AS5_1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS5_1 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.51 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.51 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.51 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.51 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.51 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.51 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.51 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.51 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.51 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.51 set ext-community delete rt 65520:5 + + + +allow quick from 192.0.2.51 + + + +# --------------------------------------------- +# client AS5_1, outbound + +deny quick to 192.0.2.51 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.51 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.51 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.51 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS5_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::51 set community NO_ADVERTISE +match from 2001:db8:1:1::51 nexthop 2001:db8:1:1::51 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::51 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::51 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::51 peer-as != 5' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::51 peer-as != 5 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::51 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::51 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::51 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::51 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::51 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::51 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 2001:db8:1:1::51 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS5_2, AS5: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::51 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::51 source-as as-set AS_SET_AS_AS5_FROM_PDB_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS5_FROM_PDB +match from 2001:db8:1:1::51 source-as as-set AS_SET_WHITE_LIST_AS5_2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS5_2 +# AS-SET AS5 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS5_2, AS5: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::51 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::51 prefix-set AS_SET_AS_AS5_FROM_PDB_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS5_FROM_PDB +match from 2001:db8:1:1::51 prefix-set AS_SET_WHITE_LIST_AS5_2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS5_2 +# AS-SET AS5 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::51 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::51 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::51 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::51 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::51 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::51 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::51 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::51 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::51 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::51 set ext-community delete rt 65520:5 + + + +allow quick from 2001:db8:1:1::51 + + + +# --------------------------------------------- +# client AS5_2, outbound + +deny quick to 2001:db8:1:1::51 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::51 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::51 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::51 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS6_1, inbound + + + +# NEXT_HOP +match from 192.0.2.61 set community NO_ADVERTISE +match from 192.0.2.61 nexthop 192.0.2.61 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.61 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.61 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.61 peer-as != 6' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.61 peer-as != 6 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.61 AS 23456' - reject code: 7 +allow quick from 192.0.2.61 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.61 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.61 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.61 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.61 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 192.0.2.61 prefix 2a03:2::/32 prefixlen 32 - 128 source-as 3 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.61 prefix 3.2.0.0/16 prefixlen 16 - 32 source-as 3 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 192.0.2.61 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS6_1, AS6: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.61 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.61 source-as as-set AS_SET_AS6_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS6 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS6_1, AS6: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.61 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.61 prefix-set AS_SET_AS6_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS6 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.61 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.61 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.61 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.61 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + +# route authorized by a client's white list? +match from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set community 999:64517 +match from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set large-community 999:0:64517 + +match from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.61 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.61 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.61 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.61 set ext-community delete rt 65520:6 + + + +allow quick from 192.0.2.61 + + + +# --------------------------------------------- +# client AS6_1, outbound + +deny quick to 192.0.2.61 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.61 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.61 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.61 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS6_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::61 set community NO_ADVERTISE +match from 2001:db8:1:1::61 nexthop 2001:db8:1:1::61 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::61 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::61 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::61 peer-as != 6' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::61 peer-as != 6 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::61 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::61 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::61 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::61 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::61 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::61 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 2001:db8:1:1::61 prefix 2a03:2::/32 prefixlen 32 - 128 source-as 3 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::61 prefix 3.2.0.0/16 prefixlen 16 - 32 source-as 3 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 2001:db8:1:1::61 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS6_2, AS6: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::61 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::61 source-as as-set AS_SET_AS6_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS6 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS6_2, AS6: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::61 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::61 prefix-set AS_SET_AS6_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS6 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::61 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::61 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::61 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::61 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + +# route authorized by a client's white list? +match from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set community 999:64517 +match from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set large-community 999:0:64517 + +match from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::61 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::61 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::61 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::61 set ext-community delete rt 65520:6 + + + +allow quick from 2001:db8:1:1::61 + + + +# --------------------------------------------- +# client AS6_2, outbound + +deny quick to 2001:db8:1:1::61 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::61 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::61 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::61 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_WithAS_SETs_OpenBGPDIPv6/openbgpd77p.conf b/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_WithAS_SETs_OpenBGPDIPv6/openbgpd77p.conf new file mode 100644 index 00000000..ecab7e3e --- /dev/null +++ b/tests/live_tests/scenarios/tag_as_set/configs/TagASSetScenario_WithAS_SETs_OpenBGPDIPv6/openbgpd77p.conf @@ -0,0 +1,3741 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + +# WHITE_LIST_AS4_1, used by client AS4_1 white list +as-set "AS_SET_WHITE_LIST_AS4_1_asns" { + 41 +} +prefix-set "AS_SET_WHITE_LIST_AS4_1_prefixes" { + 4.2.0.0/16 prefixlen 16 - 32 + 2a04:2::/32 prefixlen 32 - 128 +} + +# AS4, used by client AS4_1, client AS4_2 +# no origin ASNs found for AS4 +# no prefixes found for AS4 + +# WHITE_LIST_AS2_2, used by client AS2_2 white list +as-set "AS_SET_WHITE_LIST_AS2_2_asns" { + 21 +} +prefix-set "AS_SET_WHITE_LIST_AS2_2_prefixes" { + 2.2.0.0/16 prefixlen 16 - 32 + 2a02:2::/32 prefixlen 32 - 128 +} + +# AS-AS5_FROM_PDB, used by client AS5_1, client AS5_2 +as-set "AS_SET_AS_AS5_FROM_PDB_asns" { + 5 +} +prefix-set "AS_SET_AS_AS5_FROM_PDB_prefixes" { + 2a05::/32 prefixlen 32 - 128 +} + +# AS-AS4, used by client AS4_1, client AS4_2 +as-set "AS_SET_AS_AS4_asns" { + 4 +} +prefix-set "AS_SET_AS_AS4_prefixes" { + 2a04::/32 prefixlen 32 - 128 +} + +# AS2, used by client AS2_1, client AS2_2 +# no origin ASNs found for AS2 +# no prefixes found for AS2 + +# WHITE_LIST_AS5_2, used by client AS5_2 white list +as-set "AS_SET_WHITE_LIST_AS5_2_asns" { + 51 +} +prefix-set "AS_SET_WHITE_LIST_AS5_2_prefixes" { + 5.2.0.0/16 prefixlen 16 - 32 + 2a05:2::/32 prefixlen 32 - 128 +} + +# AS5, used by client AS5_1, client AS5_2 +# no origin ASNs found for AS5 +# no prefixes found for AS5 + +# AS6, used by client AS6_1, client AS6_2 +as-set "AS_SET_AS6_asns" { + 3 6 +} +prefix-set "AS_SET_AS6_prefixes" { + 2a06::/32 prefixlen 32 - 128 +} + +# WHITE_LIST_AS5_1, used by client AS5_1 white list +as-set "AS_SET_WHITE_LIST_AS5_1_asns" { + 51 +} +prefix-set "AS_SET_WHITE_LIST_AS5_1_prefixes" { + 5.2.0.0/16 prefixlen 16 - 32 + 2a05:2::/32 prefixlen 32 - 128 +} + +# WHITE_LIST_AS2_1, used by client AS2_1 white list +as-set "AS_SET_WHITE_LIST_AS2_1_asns" { + 21 +} +prefix-set "AS_SET_WHITE_LIST_AS2_1_prefixes" { + 2.2.0.0/16 prefixlen 16 - 32 + 2a02:2::/32 prefixlen 32 - 128 +} + +# AS1, used by client AS1_1, client AS1_2 +as-set "AS_SET_AS1_asns" { + 1 +} +prefix-set "AS_SET_AS1_prefixes" { + 2a01::/32 prefixlen 32 - 128 +} + +# WHITE_LIST_AS4_2, used by client AS4_2 white list +as-set "AS_SET_WHITE_LIST_AS4_2_asns" { + 41 +} +prefix-set "AS_SET_WHITE_LIST_AS4_2_prefixes" { + 4.2.0.0/16 prefixlen 16 - 32 + 2a04:2::/32 prefixlen 32 - 128 +} + +# AS-AS2, used by client AS2_1, client AS2_2 +as-set "AS_SET_AS_AS2_asns" { + 2 +} +prefix-set "AS_SET_AS_AS2_prefixes" { + 2a02::/32 prefixlen 32 - 128 +} + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.11 { + remote-as 1 + + rde evaluate all + + descr "AS1_1 client, no AS-SET" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::11 { + remote-as 1 + + rde evaluate all + + descr "AS1_1 client, no AS-SET" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.21 { + remote-as 2 + + rde evaluate all + + descr "AS2_1 client, AS-SET from AS..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::21 { + remote-as 2 + + rde evaluate all + + descr "AS2_1 client, AS-SET from AS..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.41 { + remote-as 4 + + rde evaluate all + + descr "AS4_1 client, AS-SET configu..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::41 { + remote-as 4 + + rde evaluate all + + descr "AS4_1 client, AS-SET configu..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.51 { + remote-as 5 + + rde evaluate all + + descr "AS5_1 client, AS-SET from Pe..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::51 { + remote-as 5 + + rde evaluate all + + descr "AS5_1 client, AS-SET from Pe..." + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.61 { + remote-as 6 + + rde evaluate all + + descr "AS6_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::61 { + remote-as 6 + + rde evaluate all + + descr "AS6_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } +} + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# origin_not_present_in_as_set +match from group clients set community delete 999:64515 +match from group clients set large-community delete 999:0:64515 + +# origin_present_in_as_set +match from group clients set community delete 999:64514 +match from group clients set large-community delete 999:0:64514 + +# prefix_not_present_in_as_set +match from group clients set community delete 999:64513 +match from group clients set large-community delete 999:0:64513 + +# prefix_present_in_as_set +match from group clients set community delete 999:64512 +match from group clients set large-community delete 999:0:64512 + +# prefix_validated_via_arin_whois_db_dump +match from group clients set community delete 999:64518 +match from group clients set large-community delete 999:0:64518 + +# prefix_validated_via_rpki_roas +match from group clients set community delete 999:64516 +match from group clients set large-community delete 999:0:64516 + +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + +# route_validated_via_white_list +match from group clients set community delete 999:64517 +match from group clients set large-community delete 999:0:64517 + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + +# --------------------------------------------------------- +# ROAs source + + +roa-set { + 2.4.0.0/16 source-as 2 + 2.5.0.0/16 source-as 2 + 2.7.0.0/16 source-as 2 + 3.1.0.0/16 source-as 3 + 3.3.0.0/16 source-as 3 + 2.0.4.0/24 source-as 2 + 6.0.1.0/24 source-as 6 + 2a02:4::/32 source-as 2 + 2a02:5::/32 source-as 2 + 2a02:7::/32 source-as 2 + 2a03:1::/32 source-as 3 + 2a03:3::/32 source-as 3 + 2a02:0:4::/48 source-as 2 + 2a06:0:1::/48 source-as 6 + +} + + + + +# --------------------------------------------------------- +# RPKI ROAs used as route objects. + +# Add the $INTCOMM_PREF_OK_ROA ext community to routes whose +# origin ASN has a ROA for the announced prefix. +# It will be used later during IRRDB validation in +# case the origin ASN is authorized by a client's +# AS-SET but the prefix is not. + +origin-set "RPKI_ROA" { + 2.4.0.0/16 source-as 2 + 2.5.0.0/16 source-as 2 + 2.7.0.0/16 source-as 2 + 3.1.0.0/16 source-as 3 + 3.3.0.0/16 source-as 3 + 2.0.4.0/24 source-as 2 + 6.0.1.0/24 source-as 6 + 2a02:4::/32 source-as 2 + 2a02:5::/32 source-as 2 + 2a02:7::/32 source-as 2 + 2a03:1::/32 source-as 3 + 2a03:3::/32 source-as 3 + 2a02:0:4::/48 source-as 2 + 2a06:0:1::/48 source-as 6 + +} +match from group clients origin-set RPKI_ROA set ext-community $INTCOMM_PREF_OK_ROA + + +# ARIN Whois records used for preifx validation +# --------------------------------------------- + +# Add the $INTCOMM_PREF_OK_ARINDB ext community to routes whose +# origin ASN has an ARIN Whois record for the announced prefix. +# It will be used later during IRRDB validation in +# case the origin ASN is authorized by a client's +# AS-SET but the prefix is not. +origin-set "ARINDB" { +2.0.5.0/24 prefixlen 24 - 32 source-as 2 +2.6.0.0/16 prefixlen 16 - 32 source-as 2 +2.7.0.0/16 prefixlen 16 - 32 source-as 2 +2a02:0:5::/48 prefixlen 48 - 128 source-as 2 +2a02:6::/32 prefixlen 32 - 128 source-as 2 +2a02:7::/32 prefixlen 32 - 128 source-as 2 +2a03:2::/32 prefixlen 32 - 128 source-as 3 +2a03:3::/32 prefixlen 32 - 128 source-as 3 +3.2.0.0/16 prefixlen 16 - 32 source-as 3 +3.3.0.0/16 prefixlen 16 - 32 source-as 3 +2a06:0:1::/48 prefixlen 48 - 128 source-as 6 +6.0.1.0/24 prefixlen 24 - 32 source-as 6 +} +match from group clients origin-set ARINDB set ext-community $INTCOMM_PREF_OK_ARINDB + + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.11 set ext-community rt 65520:1 + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + +match from 192.0.2.21 set ext-community rt 65520:2 + +match from 2001:db8:1:1::21 set ext-community rt 65520:2 + +match from 192.0.2.41 set ext-community rt 65520:4 + +match from 2001:db8:1:1::41 set ext-community rt 65520:4 + +match from 192.0.2.51 set ext-community rt 65520:5 + +match from 2001:db8:1:1::51 set ext-community rt 65520:5 + +match from 192.0.2.61 set ext-community rt 65520:6 + +match from 2001:db8:1:1::61 set ext-community rt 65520:6 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 32' - reject code: 1 +allow quick from group clients max-as-len 32 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS1_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 192.0.2.11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_1, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.11 source-as as-set AS_SET_AS1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS1 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_1, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.11 prefix-set AS_SET_AS1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS1 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.11 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.11 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.11 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.11 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS1_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 2001:db8:1:1::11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_2, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::11 source-as as-set AS_SET_AS1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS1 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_2, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::11 prefix-set AS_SET_AS1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS1 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::11 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::11 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::11 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::11 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + +deny quick to 2001:db8:1:1::11 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::11 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::11 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.21 set community NO_ADVERTISE +match from 192.0.2.21 nexthop 192.0.2.21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.21 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.21 AS 23456' - reject code: 7 +allow quick from 192.0.2.21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 192.0.2.21 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS2_1, AS2: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.21 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 192.0.2.21 source-as as-set AS_SET_WHITE_LIST_AS2_1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS2_1 +match from 192.0.2.21 source-as as-set AS_SET_AS_AS2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS2 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS2_1, AS2: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.21 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 192.0.2.21 prefix-set AS_SET_WHITE_LIST_AS2_1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS2_1 +match from 192.0.2.21 prefix-set AS_SET_AS_AS2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS2 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.21 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.21 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.21 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.21 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.21 set ext-community delete rt 65520:2 + + + +allow quick from 192.0.2.21 + + + +# --------------------------------------------- +# client AS2_1, outbound + +deny quick to 192.0.2.21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.21 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::21 set community NO_ADVERTISE +match from 2001:db8:1:1::21 nexthop 2001:db8:1:1::21 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::21 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 2001:db8:1:1::21 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS2_2, AS2: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::21 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::21 source-as as-set AS_SET_WHITE_LIST_AS2_2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS2_2 +# AS-SET AS2 referenced but empty. +match from 2001:db8:1:1::21 source-as as-set AS_SET_AS_AS2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS2 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS2_2, AS2: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::21 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::21 prefix-set AS_SET_WHITE_LIST_AS2_2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS2_2 +# AS-SET AS2 referenced but empty. +match from 2001:db8:1:1::21 prefix-set AS_SET_AS_AS2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS2 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::21 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::21 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::21 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::21 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::21 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::21 set ext-community delete rt 65520:2 + + + +allow quick from 2001:db8:1:1::21 + + + +# --------------------------------------------- +# client AS2_2, outbound + +deny quick to 2001:db8:1:1::21 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::21 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::21 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_1, inbound + + + +# NEXT_HOP +match from 192.0.2.41 set community NO_ADVERTISE +match from 192.0.2.41 nexthop 192.0.2.41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.41 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.41 AS 23456' - reject code: 7 +allow quick from 192.0.2.41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 192.0.2.41 prefix 2a04:4::/32 source-as 44 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 2a04:5::/32 prefixlen 32 - 128 source-as 43 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 2a04:6::/32 prefixlen 32 - 128 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 4.4.0.0/16 source-as 44 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 4.5.0.0/16 prefixlen 16 - 32 source-as 43 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.41 prefix 4.6.0.0/16 prefixlen 16 - 32 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 192.0.2.41 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS4_1, AS4: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.41 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.41 source-as as-set AS_SET_WHITE_LIST_AS4_1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS4_1 +# AS-SET AS4 referenced but empty. +match from 192.0.2.41 source-as as-set AS_SET_AS_AS4_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS4 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS4_1, AS4: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.41 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.41 prefix-set AS_SET_WHITE_LIST_AS4_1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS4_1 +# AS-SET AS4 referenced but empty. +match from 192.0.2.41 prefix-set AS_SET_AS_AS4_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS4 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.41 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.41 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.41 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.41 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 192.0.2.41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + +# route authorized by a client's white list? +match from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set community 999:64517 +match from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set large-community 999:0:64517 + +match from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.41 set ext-community delete rt 65520:4 + + + +allow quick from 192.0.2.41 + + + +# --------------------------------------------- +# client AS4_1, outbound + +deny quick to 192.0.2.41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.41 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS4_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::41 set community NO_ADVERTISE +match from 2001:db8:1:1::41 nexthop 2001:db8:1:1::41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::41 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 2001:db8:1:1::41 prefix 2a04:4::/32 source-as 44 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 2a04:5::/32 prefixlen 32 - 128 source-as 43 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 2a04:6::/32 prefixlen 32 - 128 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 4.4.0.0/16 source-as 44 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 4.5.0.0/16 prefixlen 16 - 32 source-as 43 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::41 prefix 4.6.0.0/16 prefixlen 16 - 32 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 2001:db8:1:1::41 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS4_2, AS4: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::41 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS4 referenced but empty. +match from 2001:db8:1:1::41 source-as as-set AS_SET_AS_AS4_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS4 +match from 2001:db8:1:1::41 source-as as-set AS_SET_WHITE_LIST_AS4_2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS4_2 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS4_2, AS4: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::41 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS4 referenced but empty. +match from 2001:db8:1:1::41 prefix-set AS_SET_AS_AS4_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS4 +match from 2001:db8:1:1::41 prefix-set AS_SET_WHITE_LIST_AS4_2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS4_2 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::41 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::41 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::41 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::41 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 2001:db8:1:1::41 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + +# route authorized by a client's white list? +match from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set community 999:64517 +match from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set large-community 999:0:64517 + +match from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::41 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::41 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::41 set ext-community delete rt 65520:4 + + + +allow quick from 2001:db8:1:1::41 + + + +# --------------------------------------------- +# client AS4_2, outbound + +deny quick to 2001:db8:1:1::41 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::41 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::41 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS5_1, inbound + + + +# NEXT_HOP +match from 192.0.2.51 set community NO_ADVERTISE +match from 192.0.2.51 nexthop 192.0.2.51 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.51 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.51 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.51 peer-as != 5' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.51 peer-as != 5 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.51 AS 23456' - reject code: 7 +allow quick from 192.0.2.51 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.51 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.51 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.51 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.51 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 192.0.2.51 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS5_1, AS5: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.51 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.51 source-as as-set AS_SET_AS_AS5_FROM_PDB_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS5_FROM_PDB +# AS-SET AS5 referenced but empty. +match from 192.0.2.51 source-as as-set AS_SET_WHITE_LIST_AS5_1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS5_1 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS5_1, AS5: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.51 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.51 prefix-set AS_SET_AS_AS5_FROM_PDB_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS5_FROM_PDB +# AS-SET AS5 referenced but empty. +match from 192.0.2.51 prefix-set AS_SET_WHITE_LIST_AS5_1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS5_1 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.51 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.51 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.51 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.51 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 192.0.2.51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.51 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.51 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.51 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.51 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.51 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.51 set ext-community delete rt 65520:5 + + + +allow quick from 192.0.2.51 + + + +# --------------------------------------------- +# client AS5_1, outbound + +deny quick to 192.0.2.51 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.51 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.51 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.51 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS5_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::51 set community NO_ADVERTISE +match from 2001:db8:1:1::51 nexthop 2001:db8:1:1::51 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::51 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::51 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::51 peer-as != 5' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::51 peer-as != 5 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::51 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::51 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::51 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::51 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::51 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::51 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +match from 2001:db8:1:1::51 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS5_2, AS5: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::51 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::51 source-as as-set AS_SET_AS_AS5_FROM_PDB_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS5_FROM_PDB +match from 2001:db8:1:1::51 source-as as-set AS_SET_WHITE_LIST_AS5_2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS5_2 +# AS-SET AS5 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS5_2, AS5: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::51 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::51 prefix-set AS_SET_AS_AS5_FROM_PDB_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS5_FROM_PDB +match from 2001:db8:1:1::51 prefix-set AS_SET_WHITE_LIST_AS5_2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS5_2 +# AS-SET AS5 referenced but empty. +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::51 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::51 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::51 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::51 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 2001:db8:1:1::51 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::51 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::51 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::51 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::51 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::51 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::51 set ext-community delete rt 65520:5 + + + +allow quick from 2001:db8:1:1::51 + + + +# --------------------------------------------- +# client AS5_2, outbound + +deny quick to 2001:db8:1:1::51 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::51 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::51 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::51 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS6_1, inbound + + + +# NEXT_HOP +match from 192.0.2.61 set community NO_ADVERTISE +match from 192.0.2.61 nexthop 192.0.2.61 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.61 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.61 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.61 peer-as != 6' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.61 peer-as != 6 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.61 AS 23456' - reject code: 7 +allow quick from 192.0.2.61 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.61 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.61 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.61 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.61 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 192.0.2.61 prefix 2a03:2::/32 prefixlen 32 - 128 source-as 3 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.61 prefix 3.2.0.0/16 prefixlen 16 - 32 source-as 3 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 192.0.2.61 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS6_1, AS6: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.61 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.61 source-as as-set AS_SET_AS6_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS6 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS6_1, AS6: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.61 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.61 prefix-set AS_SET_AS6_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS6 +# adding not_present_in_as_set community to unauthorized routes +match from 192.0.2.61 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 192.0.2.61 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 192.0.2.61 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 192.0.2.61 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 192.0.2.61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + +# route authorized by a client's white list? +match from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set community 999:64517 +match from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set large-community 999:0:64517 + +match from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.61 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.61 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 192.0.2.61 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.61 set ext-community delete rt 65520:6 + + + +allow quick from 192.0.2.61 + + + +# --------------------------------------------- +# client AS6_1, outbound + +deny quick to 192.0.2.61 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 192.0.2.61 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 192.0.2.61 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.61 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + +# --------------------------------------------- +# client AS6_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::61 set community NO_ADVERTISE +match from 2001:db8:1:1::61 nexthop 2001:db8:1:1::61 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::61 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::61 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::61 peer-as != 6' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::61 peer-as != 6 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::61 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::61 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::61 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::61 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::61 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::61 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 2001:db8:1:1::61 prefix 2a03:2::/32 prefixlen 32 - 128 source-as 3 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::61 prefix 3.2.0.0/16 prefixlen 16 - 32 source-as 3 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 2001:db8:1:1::61 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS6_2, AS6: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::61 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::61 source-as as-set AS_SET_AS6_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS6 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_KO set community 999:64515 +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_KO set large-community 999:0:64515 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK set community 999:64514 +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK set large-community 999:0:64514 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS6_2, AS6: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::61 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::61 prefix-set AS_SET_AS6_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS6 +# adding not_present_in_as_set community to unauthorized routes +match from 2001:db8:1:1::61 ext-community $INTCOMM_PREFIX_KO set community 999:64513 +match from 2001:db8:1:1::61 ext-community $INTCOMM_PREFIX_KO set large-community 999:0:64513 +# adding present_in_as_set community to authorized routes +match from 2001:db8:1:1::61 ext-community $INTCOMM_PREFIX_OK set community 999:64512 +match from 2001:db8:1:1::61 ext-community $INTCOMM_PREFIX_OK set large-community 999:0:64512 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set community 999:64516 +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set large-community 999:0:64516 + +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + +# routes tagged with $INTCOMM_PREF_OK_ARINDB community have the prefix validated by an ARIN Whois record; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set community 999:64518 +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set large-community 999:0:64518 + +match from 2001:db8:1:1::61 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ARINDB set ext-community delete $INTCOMM_IRR_REJECT + + +# route authorized by a client's white list? +match from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set community 999:64517 +match from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set large-community 999:0:64517 + +match from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::61 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::61 prefix ::/0 prefixlen 12 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::61 prefix ::/0 prefixlen 12 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::61 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::61 set ext-community delete rt 65520:6 + + + +allow quick from 2001:db8:1:1::61 + + + +# --------------------------------------------- +# client AS6_2, outbound + +deny quick to 2001:db8:1:1::61 community 65520:0 + + + +# Blackhole request? +# No blackhole filtering policy given +deny quick to 2001:db8:1:1::61 community BLACKHOLE + + + +# NO_EXPORT and NO_ADVERTISE communities + +# BGP control communities +allow to 2001:db8:1:1::61 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::61 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + + + + + + + +# Scrub communities from outbound routes +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + diff --git a/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv4/openbgpd77p/AS1.txt b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv4/openbgpd77p/AS1.txt new file mode 100644 index 00000000..a8837f73 --- /dev/null +++ b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv4/openbgpd77p/AS1.txt @@ -0,0 +1,168 @@ +2.0.1.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.2.0/24, AS_PATH: 2 3, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.0/24, AS_PATH: 2 21, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.4.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.5.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.1.0.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.2.1.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.2.2.0/24, AS_PATH: 2 3, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.2.3.0/24, AS_PATH: 2 21, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.3.1.0/24, AS_PATH: 2 21, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.5.0.0/16, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.6.0.0/16, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.7.0.0/16, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.1.0/24, AS_PATH: 2 3, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +3.2.1.0/24, AS_PATH: 6 3, NEXT_HOP: 192.0.2.61, via 192.0.2.2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.3.0/24, AS_PATH: 4 41, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.2.3.0/24, AS_PATH: 4 41, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.3.1.0/24, AS_PATH: 4 41, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.4.0.0/16, AS_PATH: 4 44, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.5.1.0/24, AS_PATH: 4 43, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.6.1.0/24, AS_PATH: 4 45, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.2.1.0/24, AS_PATH: 5, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.2.2.0/24, AS_PATH: 5 3, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.2.3.0/24, AS_PATH: 5 51, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv4/openbgpd77p/AS2.txt b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv4/openbgpd77p/AS2.txt new file mode 100644 index 00000000..e63496cd --- /dev/null +++ b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv4/openbgpd77p/AS2.txt @@ -0,0 +1,70 @@ +3.2.1.0/24, AS_PATH: 6 3, NEXT_HOP: 192.0.2.61, via 192.0.2.2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.3.0/24, AS_PATH: 4 41, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.2.3.0/24, AS_PATH: 4 41, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.3.1.0/24, AS_PATH: 4 41, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.4.0.0/16, AS_PATH: 4 44, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.5.1.0/24, AS_PATH: 4 43, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.6.1.0/24, AS_PATH: 4 45, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.2.1.0/24, AS_PATH: 5, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.2.2.0/24, AS_PATH: 5 3, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.2.3.0/24, AS_PATH: 5 51, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv4/openbgpd77p/AS4.txt b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv4/openbgpd77p/AS4.txt new file mode 100644 index 00000000..16590df8 --- /dev/null +++ b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv4/openbgpd77p/AS4.txt @@ -0,0 +1,126 @@ +2.0.1.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.2.0/24, AS_PATH: 2 3, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.0/24, AS_PATH: 2 21, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.0/24, AS_PATH: 2 3, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: False, LOCAL_PREF: 100 + filtered: False () + +2.0.4.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.5.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.1.0.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.2.1.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.2.2.0/24, AS_PATH: 2 3, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.2.3.0/24, AS_PATH: 2 21, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.3.1.0/24, AS_PATH: 2 21, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.5.0.0/16, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.6.0.0/16, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.7.0.0/16, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +3.2.1.0/24, AS_PATH: 6 3, NEXT_HOP: 192.0.2.61, via 192.0.2.2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.2.1.0/24, AS_PATH: 5, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.2.2.0/24, AS_PATH: 5 3, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.2.3.0/24, AS_PATH: 5 51, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv4/openbgpd77p/AS5.txt b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv4/openbgpd77p/AS5.txt new file mode 100644 index 00000000..2e9887a9 --- /dev/null +++ b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv4/openbgpd77p/AS5.txt @@ -0,0 +1,147 @@ +2.0.1.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.2.0/24, AS_PATH: 2 3, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.0/24, AS_PATH: 2 21, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.0/24, AS_PATH: 2 3, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: False, LOCAL_PREF: 100 + filtered: False () + +2.0.4.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.5.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.1.0.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.2.1.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.2.2.0/24, AS_PATH: 2 3, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.2.3.0/24, AS_PATH: 2 21, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.3.1.0/24, AS_PATH: 2 21, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.5.0.0/16, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.6.0.0/16, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.7.0.0/16, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +3.2.1.0/24, AS_PATH: 6 3, NEXT_HOP: 192.0.2.61, via 192.0.2.2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.3.0/24, AS_PATH: 4 41, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.2.3.0/24, AS_PATH: 4 41, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.3.1.0/24, AS_PATH: 4 41, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.4.0.0/16, AS_PATH: 4 44, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.5.1.0/24, AS_PATH: 4 43, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.6.1.0/24, AS_PATH: 4 45, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv4/openbgpd77p/AS6.txt b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv4/openbgpd77p/AS6.txt new file mode 100644 index 00000000..6460e7ee --- /dev/null +++ b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv4/openbgpd77p/AS6.txt @@ -0,0 +1,161 @@ +2.0.1.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.2.0/24, AS_PATH: 2 3, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.0/24, AS_PATH: 2 21, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.4.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.5.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.1.0.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.2.1.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.2.2.0/24, AS_PATH: 2 3, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.2.3.0/24, AS_PATH: 2 21, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.3.1.0/24, AS_PATH: 2 21, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.5.0.0/16, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.6.0.0/16, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.7.0.0/16, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.1.0/24, AS_PATH: 2 3, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.3.0/24, AS_PATH: 4 41, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.2.3.0/24, AS_PATH: 4 41, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.3.1.0/24, AS_PATH: 4 41, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.4.0.0/16, AS_PATH: 4 44, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.5.1.0/24, AS_PATH: 4 43, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.6.1.0/24, AS_PATH: 4 45, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.2.1.0/24, AS_PATH: 5, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.2.2.0/24, AS_PATH: 5 3, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.2.3.0/24, AS_PATH: 5 51, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv4/openbgpd77p/rs.txt b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv4/openbgpd77p/rs.txt new file mode 100644 index 00000000..176237ed --- /dev/null +++ b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv4/openbgpd77p/rs.txt @@ -0,0 +1,294 @@ +2.0.1.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.2.0/24, AS_PATH: 2 3, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.0/24, AS_PATH: 2 21, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.4.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.5.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.1.0.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.2.1.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.2.2.0/24, AS_PATH: 2 3, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.2.3.0/24, AS_PATH: 2 21, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.3.1.0/24, AS_PATH: 2 21, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.4.0.0/16, AS_PATH: 6 2, NEXT_HOP: 192.0.2.61, via 192.0.2.61 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (9) + +2.5.0.0/16, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.6.0.0/16, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.7.0.0/16, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.1.0/24, AS_PATH: 2 3, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.1.0/24, AS_PATH: 4 3, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: False, LOCAL_PREF: 1 + filtered: True (9) + +3.0.1.0/24, AS_PATH: 5 3, NEXT_HOP: 192.0.2.51, via 192.0.2.51 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: False, LOCAL_PREF: 1 + filtered: True (12) + +3.1.0.0/16, AS_PATH: 6 3, NEXT_HOP: 192.0.2.61, via 192.0.2.61 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (9) + +3.2.1.0/24, AS_PATH: 6 3, NEXT_HOP: 192.0.2.61, via 192.0.2.61 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +3.3.0.0/16, AS_PATH: 6 3, NEXT_HOP: 192.0.2.61, via 192.0.2.61 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (9) + +4.0.1.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (9) + +4.0.2.0/24, AS_PATH: 4 3, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (9) + +4.0.3.0/24, AS_PATH: 4 41, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.1.0.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (9) + +4.2.1.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (9) + +4.2.2.0/24, AS_PATH: 4 3, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (9) + +4.2.3.0/24, AS_PATH: 4 41, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.3.1.0/24, AS_PATH: 4 41, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.4.0.0/16, AS_PATH: 4 44, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.4.1.0/24, AS_PATH: 4 44, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (9) + +4.5.1.0/24, AS_PATH: 4 43, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.5.2.0/24, AS_PATH: 4 45, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (9) + +4.6.1.0/24, AS_PATH: 4 45, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.0.1.0/24, AS_PATH: 5, NEXT_HOP: 192.0.2.51, via 192.0.2.51 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (12) + +5.0.2.0/24, AS_PATH: 5 3, NEXT_HOP: 192.0.2.51, via 192.0.2.51 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (12) + +5.0.3.0/24, AS_PATH: 5 51, NEXT_HOP: 192.0.2.51, via 192.0.2.51 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 1 + filtered: True (12) + +5.1.0.0/24, AS_PATH: 5, NEXT_HOP: 192.0.2.51, via 192.0.2.51 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (12) + +5.2.1.0/24, AS_PATH: 5, NEXT_HOP: 192.0.2.51, via 192.0.2.51 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.2.2.0/24, AS_PATH: 5 3, NEXT_HOP: 192.0.2.51, via 192.0.2.51 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.2.3.0/24, AS_PATH: 5 51, NEXT_HOP: 192.0.2.51, via 192.0.2.51 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.3.1.0/24, AS_PATH: 5 51, NEXT_HOP: 192.0.2.51, via 192.0.2.51 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 1 + filtered: True (12) + +6.0.1.0/24, AS_PATH: 6, NEXT_HOP: 192.0.2.61, via 192.0.2.61 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (9) + diff --git a/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv6/openbgpd77p/AS1.txt b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv6/openbgpd77p/AS1.txt new file mode 100644 index 00000000..49691e25 --- /dev/null +++ b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv6/openbgpd77p/AS1.txt @@ -0,0 +1,168 @@ +2a02:0:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:2::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::/48, AS_PATH: 2 21, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:4::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:5::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:2:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:2:2::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:2:3::/48, AS_PATH: 2 21, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:3:1::/48, AS_PATH: 2 21, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:5::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:6::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:7::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:1::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:2:1::/48, AS_PATH: 6 3, NEXT_HOP: 2001:db8:1:1::61, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:3::/48, AS_PATH: 4 41, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:2:3::/48, AS_PATH: 4 41, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:3:1::/48, AS_PATH: 4 41, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:4::/32, AS_PATH: 4 44, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:5:1::/48, AS_PATH: 4 43, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:6:1::/48, AS_PATH: 4 45, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:2:1::/48, AS_PATH: 5, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:2:2::/48, AS_PATH: 5 3, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:2:3::/48, AS_PATH: 5 51, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv6/openbgpd77p/AS2.txt b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv6/openbgpd77p/AS2.txt new file mode 100644 index 00000000..caf2fb62 --- /dev/null +++ b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv6/openbgpd77p/AS2.txt @@ -0,0 +1,70 @@ +2a03:2:1::/48, AS_PATH: 6 3, NEXT_HOP: 2001:db8:1:1::61, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:3::/48, AS_PATH: 4 41, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:2:3::/48, AS_PATH: 4 41, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:3:1::/48, AS_PATH: 4 41, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:4::/32, AS_PATH: 4 44, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:5:1::/48, AS_PATH: 4 43, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:6:1::/48, AS_PATH: 4 45, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:2:1::/48, AS_PATH: 5, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:2:2::/48, AS_PATH: 5 3, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:2:3::/48, AS_PATH: 5 51, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv6/openbgpd77p/AS4.txt b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv6/openbgpd77p/AS4.txt new file mode 100644 index 00000000..3d1aa72a --- /dev/null +++ b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv6/openbgpd77p/AS4.txt @@ -0,0 +1,126 @@ +2a02:0:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:2::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::/48, AS_PATH: 2 21, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:4::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:5::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:2:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:2:2::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:2:3::/48, AS_PATH: 2 21, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:3:1::/48, AS_PATH: 2 21, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:5::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:6::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:7::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:2:1::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:2:1::/48, AS_PATH: 6 3, NEXT_HOP: 2001:db8:1:1::61, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:2:1::/48, AS_PATH: 5, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:2:2::/48, AS_PATH: 5 3, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:2:3::/48, AS_PATH: 5 51, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv6/openbgpd77p/AS5.txt b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv6/openbgpd77p/AS5.txt new file mode 100644 index 00000000..e09d4eda --- /dev/null +++ b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv6/openbgpd77p/AS5.txt @@ -0,0 +1,147 @@ +2a02:0:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:2::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::/48, AS_PATH: 2 21, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:4::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:5::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:2:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:2:2::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:2:3::/48, AS_PATH: 2 21, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:3:1::/48, AS_PATH: 2 21, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:5::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:6::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:7::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:2:1::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:2:1::/48, AS_PATH: 6 3, NEXT_HOP: 2001:db8:1:1::61, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:3::/48, AS_PATH: 4 41, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:2:3::/48, AS_PATH: 4 41, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:3:1::/48, AS_PATH: 4 41, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:4::/32, AS_PATH: 4 44, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:5:1::/48, AS_PATH: 4 43, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:6:1::/48, AS_PATH: 4 45, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv6/openbgpd77p/AS6.txt b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv6/openbgpd77p/AS6.txt new file mode 100644 index 00000000..186e7a62 --- /dev/null +++ b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv6/openbgpd77p/AS6.txt @@ -0,0 +1,161 @@ +2a02:0:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:2::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::/48, AS_PATH: 2 21, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:4::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:5::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:2:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:2:2::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:2:3::/48, AS_PATH: 2 21, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:3:1::/48, AS_PATH: 2 21, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:5::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:6::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:7::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:1::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:3::/48, AS_PATH: 4 41, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:2:3::/48, AS_PATH: 4 41, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:3:1::/48, AS_PATH: 4 41, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:4::/32, AS_PATH: 4 44, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:5:1::/48, AS_PATH: 4 43, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:6:1::/48, AS_PATH: 4 45, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:2:1::/48, AS_PATH: 5, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:2:2::/48, AS_PATH: 5 3, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:2:3::/48, AS_PATH: 5 51, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv6/openbgpd77p/rs.txt b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv6/openbgpd77p/rs.txt new file mode 100644 index 00000000..cd89e49a --- /dev/null +++ b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_EmptyAS_SETs_OpenBGPDIPv6/openbgpd77p/rs.txt @@ -0,0 +1,294 @@ +2a02:0:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:2::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::/48, AS_PATH: 2 21, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:4::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:5::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:2:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:2:2::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:2:3::/48, AS_PATH: 2 21, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:3:1::/48, AS_PATH: 2 21, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:4::/32, AS_PATH: 6 2, NEXT_HOP: 2001:db8:1:1::61, via 2001:db8:1:1::61 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (9) + +2a02:5::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:6::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:7::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:1::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:1::/48, AS_PATH: 4 3, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: False, LOCAL_PREF: 1 + filtered: True (9) + +2a03:0:1::/48, AS_PATH: 5 3, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::51 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: False, LOCAL_PREF: 1 + filtered: True (12) + +2a03:1::/32, AS_PATH: 6 3, NEXT_HOP: 2001:db8:1:1::61, via 2001:db8:1:1::61 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (9) + +2a03:2:1::/48, AS_PATH: 6 3, NEXT_HOP: 2001:db8:1:1::61, via 2001:db8:1:1::61 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:3::/32, AS_PATH: 6 3, NEXT_HOP: 2001:db8:1:1::61, via 2001:db8:1:1::61 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (9) + +2a04:0:1::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (9) + +2a04:0:2::/48, AS_PATH: 4 3, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (9) + +2a04:0:3::/48, AS_PATH: 4 41, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:1::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (9) + +2a04:2:1::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (9) + +2a04:2:2::/48, AS_PATH: 4 3, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (9) + +2a04:2:3::/48, AS_PATH: 4 41, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:3:1::/48, AS_PATH: 4 41, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:4:1::/48, AS_PATH: 4 44, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (9) + +2a04:4::/32, AS_PATH: 4 44, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:5:1::/48, AS_PATH: 4 43, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:5:2::/48, AS_PATH: 4 45, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (9) + +2a04:6:1::/48, AS_PATH: 4 45, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:0:1::/48, AS_PATH: 5, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::51 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (12) + +2a05:0:2::/48, AS_PATH: 5 3, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::51 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (12) + +2a05:0:3::/48, AS_PATH: 5 51, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::51 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 1 + filtered: True (12) + +2a05:1::/48, AS_PATH: 5, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::51 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (12) + +2a05:2:1::/48, AS_PATH: 5, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::51 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:2:2::/48, AS_PATH: 5 3, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::51 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:2:3::/48, AS_PATH: 5 51, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::51 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:3:1::/48, AS_PATH: 5 51, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::51 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 1 + filtered: True (12) + +2a06:0:1::/48, AS_PATH: 6, NEXT_HOP: 2001:db8:1:1::61, via 2001:db8:1:1::61 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (9) + diff --git a/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv4/openbgpd77p/AS1.txt b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv4/openbgpd77p/AS1.txt new file mode 100644 index 00000000..37ae5299 --- /dev/null +++ b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv4/openbgpd77p/AS1.txt @@ -0,0 +1,231 @@ +2.0.1.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.2.0/24, AS_PATH: 2 3, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.0/24, AS_PATH: 2 21, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.4.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64514, 999:64516 + ext comms: + lrg comms: 999:0:64512, 999:0:64514, 999:0:64516 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.5.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64514, 999:64518 + ext comms: + lrg comms: 999:0:64512, 999:0:64514, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.1.0.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.2.1.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.2.2.0/24, AS_PATH: 2 3, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.2.3.0/24, AS_PATH: 2 21, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.3.1.0/24, AS_PATH: 2 21, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.5.0.0/16, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64514, 999:64516 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.6.0.0/16, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64514, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.7.0.0/16, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64514, 999:64516, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.1.0/24, AS_PATH: 2 3, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +3.1.0.0/16, AS_PATH: 6 3, NEXT_HOP: 192.0.2.61, via 192.0.2.2 + std comms: 999:64513, 999:64514, 999:64516 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516 + best: True, LOCAL_PREF: 100 + filtered: False () + +3.2.1.0/24, AS_PATH: 6 3, NEXT_HOP: 192.0.2.61, via 192.0.2.2 + std comms: 999:64513, 999:64514, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +3.3.0.0/16, AS_PATH: 6 3, NEXT_HOP: 192.0.2.61, via 192.0.2.2 + std comms: 999:64513, 999:64514, 999:64516, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.1.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.3.0/24, AS_PATH: 4 41, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.1.0.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.2.1.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.2.3.0/24, AS_PATH: 4 41, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.3.1.0/24, AS_PATH: 4 41, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.4.0.0/16, AS_PATH: 4 44, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.5.1.0/24, AS_PATH: 4 43, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.6.1.0/24, AS_PATH: 4 45, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.0.1.0/24, AS_PATH: 5, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.0.2.0/24, AS_PATH: 5 3, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.0.3.0/24, AS_PATH: 5 51, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.2.1.0/24, AS_PATH: 5, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.2.2.0/24, AS_PATH: 5 3, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.2.3.0/24, AS_PATH: 5 51, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +6.0.1.0/24, AS_PATH: 6, NEXT_HOP: 192.0.2.61, via 192.0.2.2 + std comms: 999:64512, 999:64514, 999:64516, 999:64518 + ext comms: + lrg comms: 999:0:64512, 999:0:64514, 999:0:64516, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv4/openbgpd77p/AS2.txt b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv4/openbgpd77p/AS2.txt new file mode 100644 index 00000000..fd45026e --- /dev/null +++ b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv4/openbgpd77p/AS2.txt @@ -0,0 +1,133 @@ +3.1.0.0/16, AS_PATH: 6 3, NEXT_HOP: 192.0.2.61, via 192.0.2.2 + std comms: 999:64513, 999:64514, 999:64516 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516 + best: True, LOCAL_PREF: 100 + filtered: False () + +3.2.1.0/24, AS_PATH: 6 3, NEXT_HOP: 192.0.2.61, via 192.0.2.2 + std comms: 999:64513, 999:64514, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +3.3.0.0/16, AS_PATH: 6 3, NEXT_HOP: 192.0.2.61, via 192.0.2.2 + std comms: 999:64513, 999:64514, 999:64516, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.1.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.3.0/24, AS_PATH: 4 41, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.1.0.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.2.1.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.2.3.0/24, AS_PATH: 4 41, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.3.1.0/24, AS_PATH: 4 41, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.4.0.0/16, AS_PATH: 4 44, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.5.1.0/24, AS_PATH: 4 43, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.6.1.0/24, AS_PATH: 4 45, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.0.1.0/24, AS_PATH: 5, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.0.2.0/24, AS_PATH: 5 3, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.0.3.0/24, AS_PATH: 5 51, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.2.1.0/24, AS_PATH: 5, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.2.2.0/24, AS_PATH: 5 3, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.2.3.0/24, AS_PATH: 5 51, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +6.0.1.0/24, AS_PATH: 6, NEXT_HOP: 192.0.2.61, via 192.0.2.2 + std comms: 999:64512, 999:64514, 999:64516, 999:64518 + ext comms: + lrg comms: 999:0:64512, 999:0:64514, 999:0:64516, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv4/openbgpd77p/AS4.txt b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv4/openbgpd77p/AS4.txt new file mode 100644 index 00000000..90a0ec35 --- /dev/null +++ b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv4/openbgpd77p/AS4.txt @@ -0,0 +1,168 @@ +2.0.1.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.2.0/24, AS_PATH: 2 3, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.0/24, AS_PATH: 2 21, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.0/24, AS_PATH: 2 3, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: False, LOCAL_PREF: 100 + filtered: False () + +2.0.4.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64514, 999:64516 + ext comms: + lrg comms: 999:0:64512, 999:0:64514, 999:0:64516 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.5.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64514, 999:64518 + ext comms: + lrg comms: 999:0:64512, 999:0:64514, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.1.0.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.2.1.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.2.2.0/24, AS_PATH: 2 3, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.2.3.0/24, AS_PATH: 2 21, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.3.1.0/24, AS_PATH: 2 21, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.5.0.0/16, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64514, 999:64516 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.6.0.0/16, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64514, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.7.0.0/16, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64514, 999:64516, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +3.1.0.0/16, AS_PATH: 6 3, NEXT_HOP: 192.0.2.61, via 192.0.2.2 + std comms: 999:64513, 999:64514, 999:64516 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516 + best: True, LOCAL_PREF: 100 + filtered: False () + +3.2.1.0/24, AS_PATH: 6 3, NEXT_HOP: 192.0.2.61, via 192.0.2.2 + std comms: 999:64513, 999:64514, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +3.3.0.0/16, AS_PATH: 6 3, NEXT_HOP: 192.0.2.61, via 192.0.2.2 + std comms: 999:64513, 999:64514, 999:64516, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.0.1.0/24, AS_PATH: 5, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.0.2.0/24, AS_PATH: 5 3, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.0.3.0/24, AS_PATH: 5 51, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.2.1.0/24, AS_PATH: 5, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.2.2.0/24, AS_PATH: 5 3, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.2.3.0/24, AS_PATH: 5 51, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +6.0.1.0/24, AS_PATH: 6, NEXT_HOP: 192.0.2.61, via 192.0.2.2 + std comms: 999:64512, 999:64514, 999:64516, 999:64518 + ext comms: + lrg comms: 999:0:64512, 999:0:64514, 999:0:64516, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv4/openbgpd77p/AS5.txt b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv4/openbgpd77p/AS5.txt new file mode 100644 index 00000000..8d6a5ff6 --- /dev/null +++ b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv4/openbgpd77p/AS5.txt @@ -0,0 +1,189 @@ +2.0.1.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.2.0/24, AS_PATH: 2 3, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.0/24, AS_PATH: 2 21, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.0/24, AS_PATH: 2 3, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: False, LOCAL_PREF: 100 + filtered: False () + +2.0.4.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64514, 999:64516 + ext comms: + lrg comms: 999:0:64512, 999:0:64514, 999:0:64516 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.5.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64514, 999:64518 + ext comms: + lrg comms: 999:0:64512, 999:0:64514, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.1.0.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.2.1.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.2.2.0/24, AS_PATH: 2 3, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.2.3.0/24, AS_PATH: 2 21, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.3.1.0/24, AS_PATH: 2 21, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.5.0.0/16, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64514, 999:64516 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.6.0.0/16, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64514, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.7.0.0/16, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64514, 999:64516, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +3.1.0.0/16, AS_PATH: 6 3, NEXT_HOP: 192.0.2.61, via 192.0.2.2 + std comms: 999:64513, 999:64514, 999:64516 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516 + best: True, LOCAL_PREF: 100 + filtered: False () + +3.2.1.0/24, AS_PATH: 6 3, NEXT_HOP: 192.0.2.61, via 192.0.2.2 + std comms: 999:64513, 999:64514, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +3.3.0.0/16, AS_PATH: 6 3, NEXT_HOP: 192.0.2.61, via 192.0.2.2 + std comms: 999:64513, 999:64514, 999:64516, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.1.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.3.0/24, AS_PATH: 4 41, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.1.0.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.2.1.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.2.3.0/24, AS_PATH: 4 41, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.3.1.0/24, AS_PATH: 4 41, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.4.0.0/16, AS_PATH: 4 44, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.5.1.0/24, AS_PATH: 4 43, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.6.1.0/24, AS_PATH: 4 45, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +6.0.1.0/24, AS_PATH: 6, NEXT_HOP: 192.0.2.61, via 192.0.2.2 + std comms: 999:64512, 999:64514, 999:64516, 999:64518 + ext comms: + lrg comms: 999:0:64512, 999:0:64514, 999:0:64516, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv4/openbgpd77p/AS6.txt b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv4/openbgpd77p/AS6.txt new file mode 100644 index 00000000..64d1581a --- /dev/null +++ b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv4/openbgpd77p/AS6.txt @@ -0,0 +1,203 @@ +2.0.1.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.2.0/24, AS_PATH: 2 3, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.0/24, AS_PATH: 2 21, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.4.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64514, 999:64516 + ext comms: + lrg comms: 999:0:64512, 999:0:64514, 999:0:64516 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.5.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64514, 999:64518 + ext comms: + lrg comms: 999:0:64512, 999:0:64514, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.1.0.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.2.1.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.2.2.0/24, AS_PATH: 2 3, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.2.3.0/24, AS_PATH: 2 21, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.3.1.0/24, AS_PATH: 2 21, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.5.0.0/16, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64514, 999:64516 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.6.0.0/16, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64514, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.7.0.0/16, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64514, 999:64516, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.1.0/24, AS_PATH: 2 3, NEXT_HOP: 192.0.2.21, via 192.0.2.2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.1.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.3.0/24, AS_PATH: 4 41, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.1.0.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.2.1.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.2.3.0/24, AS_PATH: 4 41, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.3.1.0/24, AS_PATH: 4 41, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.4.0.0/16, AS_PATH: 4 44, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.5.1.0/24, AS_PATH: 4 43, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.6.1.0/24, AS_PATH: 4 45, NEXT_HOP: 192.0.2.41, via 192.0.2.2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.0.1.0/24, AS_PATH: 5, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.0.2.0/24, AS_PATH: 5 3, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.0.3.0/24, AS_PATH: 5 51, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.2.1.0/24, AS_PATH: 5, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.2.2.0/24, AS_PATH: 5 3, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.2.3.0/24, AS_PATH: 5 51, NEXT_HOP: 192.0.2.51, via 192.0.2.2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv4/openbgpd77p/rs.txt b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv4/openbgpd77p/rs.txt new file mode 100644 index 00000000..a776c298 --- /dev/null +++ b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv4/openbgpd77p/rs.txt @@ -0,0 +1,294 @@ +2.0.1.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.2.0/24, AS_PATH: 2 3, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.3.0/24, AS_PATH: 2 21, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.4.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 999:64512, 999:64514, 999:64516 + ext comms: + lrg comms: 999:0:64512, 999:0:64514, 999:0:64516 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.0.5.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 999:64512, 999:64514, 999:64518 + ext comms: + lrg comms: 999:0:64512, 999:0:64514, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.1.0.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.2.1.0/24, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.2.2.0/24, AS_PATH: 2 3, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.2.3.0/24, AS_PATH: 2 21, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.3.1.0/24, AS_PATH: 2 21, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.4.0.0/16, AS_PATH: 6 2, NEXT_HOP: 192.0.2.61, via 192.0.2.61 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (9) + +2.5.0.0/16, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 999:64513, 999:64514, 999:64516 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.6.0.0/16, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 999:64513, 999:64514, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2.7.0.0/16, AS_PATH: 2, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 999:64513, 999:64514, 999:64516, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.1.0/24, AS_PATH: 2 3, NEXT_HOP: 192.0.2.21, via 192.0.2.21 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +3.0.1.0/24, AS_PATH: 4 3, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: False, LOCAL_PREF: 1 + filtered: True (9) + +3.0.1.0/24, AS_PATH: 5 3, NEXT_HOP: 192.0.2.51, via 192.0.2.51 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: False, LOCAL_PREF: 1 + filtered: True (12) + +3.1.0.0/16, AS_PATH: 6 3, NEXT_HOP: 192.0.2.61, via 192.0.2.61 + std comms: 999:64513, 999:64514, 999:64516 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516 + best: True, LOCAL_PREF: 100 + filtered: False () + +3.2.1.0/24, AS_PATH: 6 3, NEXT_HOP: 192.0.2.61, via 192.0.2.61 + std comms: 999:64513, 999:64514, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +3.3.0.0/16, AS_PATH: 6 3, NEXT_HOP: 192.0.2.61, via 192.0.2.61 + std comms: 999:64513, 999:64514, 999:64516, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.1.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.0.2.0/24, AS_PATH: 4 3, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (9) + +4.0.3.0/24, AS_PATH: 4 41, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.1.0.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.2.1.0/24, AS_PATH: 4, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.2.2.0/24, AS_PATH: 4 3, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (9) + +4.2.3.0/24, AS_PATH: 4 41, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.3.1.0/24, AS_PATH: 4 41, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.4.0.0/16, AS_PATH: 4 44, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.4.1.0/24, AS_PATH: 4 44, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (9) + +4.5.1.0/24, AS_PATH: 4 43, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +4.5.2.0/24, AS_PATH: 4 45, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (9) + +4.6.1.0/24, AS_PATH: 4 45, NEXT_HOP: 192.0.2.41, via 192.0.2.41 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.0.1.0/24, AS_PATH: 5, NEXT_HOP: 192.0.2.51, via 192.0.2.51 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.0.2.0/24, AS_PATH: 5 3, NEXT_HOP: 192.0.2.51, via 192.0.2.51 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.0.3.0/24, AS_PATH: 5 51, NEXT_HOP: 192.0.2.51, via 192.0.2.51 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.1.0.0/24, AS_PATH: 5, NEXT_HOP: 192.0.2.51, via 192.0.2.51 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 1 + filtered: True (12) + +5.2.1.0/24, AS_PATH: 5, NEXT_HOP: 192.0.2.51, via 192.0.2.51 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.2.2.0/24, AS_PATH: 5 3, NEXT_HOP: 192.0.2.51, via 192.0.2.51 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.2.3.0/24, AS_PATH: 5 51, NEXT_HOP: 192.0.2.51, via 192.0.2.51 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +5.3.1.0/24, AS_PATH: 5 51, NEXT_HOP: 192.0.2.51, via 192.0.2.51 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 1 + filtered: True (12) + +6.0.1.0/24, AS_PATH: 6, NEXT_HOP: 192.0.2.61, via 192.0.2.61 + std comms: 999:64512, 999:64514, 999:64516, 999:64518 + ext comms: + lrg comms: 999:0:64512, 999:0:64514, 999:0:64516, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv6/openbgpd77p/AS1.txt b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv6/openbgpd77p/AS1.txt new file mode 100644 index 00000000..b4c388d5 --- /dev/null +++ b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv6/openbgpd77p/AS1.txt @@ -0,0 +1,231 @@ +2a02:0:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:2::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::/48, AS_PATH: 2 21, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:4::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514, 999:64516 + ext comms: + lrg comms: 999:0:64512, 999:0:64514, 999:0:64516 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:5::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514, 999:64518 + ext comms: + lrg comms: 999:0:64512, 999:0:64514, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:2:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:2:2::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:2:3::/48, AS_PATH: 2 21, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:3:1::/48, AS_PATH: 2 21, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:5::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514, 999:64516 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:6::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:7::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514, 999:64516, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:1::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:1::/32, AS_PATH: 6 3, NEXT_HOP: 2001:db8:1:1::61, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514, 999:64516 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:2:1::/48, AS_PATH: 6 3, NEXT_HOP: 2001:db8:1:1::61, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:3::/32, AS_PATH: 6 3, NEXT_HOP: 2001:db8:1:1::61, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514, 999:64516, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:1::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:3::/48, AS_PATH: 4 41, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:1::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:2:1::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:2:3::/48, AS_PATH: 4 41, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:3:1::/48, AS_PATH: 4 41, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:4::/32, AS_PATH: 4 44, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:5:1::/48, AS_PATH: 4 43, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:6:1::/48, AS_PATH: 4 45, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:0:1::/48, AS_PATH: 5, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:0:2::/48, AS_PATH: 5 3, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:0:3::/48, AS_PATH: 5 51, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:2:1::/48, AS_PATH: 5, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:2:2::/48, AS_PATH: 5 3, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:2:3::/48, AS_PATH: 5 51, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a06:0:1::/48, AS_PATH: 6, NEXT_HOP: 2001:db8:1:1::61, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514, 999:64516, 999:64518 + ext comms: + lrg comms: 999:0:64512, 999:0:64514, 999:0:64516, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv6/openbgpd77p/AS2.txt b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv6/openbgpd77p/AS2.txt new file mode 100644 index 00000000..75c453dd --- /dev/null +++ b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv6/openbgpd77p/AS2.txt @@ -0,0 +1,133 @@ +2a03:1::/32, AS_PATH: 6 3, NEXT_HOP: 2001:db8:1:1::61, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514, 999:64516 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:2:1::/48, AS_PATH: 6 3, NEXT_HOP: 2001:db8:1:1::61, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:3::/32, AS_PATH: 6 3, NEXT_HOP: 2001:db8:1:1::61, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514, 999:64516, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:1::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:3::/48, AS_PATH: 4 41, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:1::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:2:1::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:2:3::/48, AS_PATH: 4 41, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:3:1::/48, AS_PATH: 4 41, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:4::/32, AS_PATH: 4 44, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:5:1::/48, AS_PATH: 4 43, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:6:1::/48, AS_PATH: 4 45, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:0:1::/48, AS_PATH: 5, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:0:2::/48, AS_PATH: 5 3, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:0:3::/48, AS_PATH: 5 51, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:2:1::/48, AS_PATH: 5, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:2:2::/48, AS_PATH: 5 3, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:2:3::/48, AS_PATH: 5 51, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a06:0:1::/48, AS_PATH: 6, NEXT_HOP: 2001:db8:1:1::61, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514, 999:64516, 999:64518 + ext comms: + lrg comms: 999:0:64512, 999:0:64514, 999:0:64516, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv6/openbgpd77p/AS4.txt b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv6/openbgpd77p/AS4.txt new file mode 100644 index 00000000..d3c83f17 --- /dev/null +++ b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv6/openbgpd77p/AS4.txt @@ -0,0 +1,168 @@ +2a02:0:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:2::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::/48, AS_PATH: 2 21, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:4::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514, 999:64516 + ext comms: + lrg comms: 999:0:64512, 999:0:64514, 999:0:64516 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:5::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514, 999:64518 + ext comms: + lrg comms: 999:0:64512, 999:0:64514, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:2:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:2:2::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:2:3::/48, AS_PATH: 2 21, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:3:1::/48, AS_PATH: 2 21, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:5::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514, 999:64516 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:6::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:7::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514, 999:64516, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:1::/32, AS_PATH: 6 3, NEXT_HOP: 2001:db8:1:1::61, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514, 999:64516 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:2:1::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:2:1::/48, AS_PATH: 6 3, NEXT_HOP: 2001:db8:1:1::61, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:3::/32, AS_PATH: 6 3, NEXT_HOP: 2001:db8:1:1::61, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514, 999:64516, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:0:1::/48, AS_PATH: 5, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:0:2::/48, AS_PATH: 5 3, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:0:3::/48, AS_PATH: 5 51, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:2:1::/48, AS_PATH: 5, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:2:2::/48, AS_PATH: 5 3, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:2:3::/48, AS_PATH: 5 51, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a06:0:1::/48, AS_PATH: 6, NEXT_HOP: 2001:db8:1:1::61, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514, 999:64516, 999:64518 + ext comms: + lrg comms: 999:0:64512, 999:0:64514, 999:0:64516, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv6/openbgpd77p/AS5.txt b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv6/openbgpd77p/AS5.txt new file mode 100644 index 00000000..7578bd1a --- /dev/null +++ b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv6/openbgpd77p/AS5.txt @@ -0,0 +1,189 @@ +2a02:0:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:2::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::/48, AS_PATH: 2 21, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:4::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514, 999:64516 + ext comms: + lrg comms: 999:0:64512, 999:0:64514, 999:0:64516 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:5::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514, 999:64518 + ext comms: + lrg comms: 999:0:64512, 999:0:64514, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:2:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:2:2::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:2:3::/48, AS_PATH: 2 21, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:3:1::/48, AS_PATH: 2 21, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:5::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514, 999:64516 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:6::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:7::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514, 999:64516, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:1::/32, AS_PATH: 6 3, NEXT_HOP: 2001:db8:1:1::61, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514, 999:64516 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:2:1::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:2:1::/48, AS_PATH: 6 3, NEXT_HOP: 2001:db8:1:1::61, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:3::/32, AS_PATH: 6 3, NEXT_HOP: 2001:db8:1:1::61, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514, 999:64516, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:1::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:3::/48, AS_PATH: 4 41, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:1::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:2:1::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:2:3::/48, AS_PATH: 4 41, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:3:1::/48, AS_PATH: 4 41, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:4::/32, AS_PATH: 4 44, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:5:1::/48, AS_PATH: 4 43, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:6:1::/48, AS_PATH: 4 45, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a06:0:1::/48, AS_PATH: 6, NEXT_HOP: 2001:db8:1:1::61, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514, 999:64516, 999:64518 + ext comms: + lrg comms: 999:0:64512, 999:0:64514, 999:0:64516, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv6/openbgpd77p/AS6.txt b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv6/openbgpd77p/AS6.txt new file mode 100644 index 00000000..d185074c --- /dev/null +++ b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv6/openbgpd77p/AS6.txt @@ -0,0 +1,203 @@ +2a02:0:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:2::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::/48, AS_PATH: 2 21, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:4::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514, 999:64516 + ext comms: + lrg comms: 999:0:64512, 999:0:64514, 999:0:64516 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:5::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514, 999:64518 + ext comms: + lrg comms: 999:0:64512, 999:0:64514, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:2:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:2:2::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:2:3::/48, AS_PATH: 2 21, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:3:1::/48, AS_PATH: 2 21, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:5::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514, 999:64516 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:6::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:7::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514, 999:64516, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:1::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:1::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:3::/48, AS_PATH: 4 41, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:1::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:2:1::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:2:3::/48, AS_PATH: 4 41, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:3:1::/48, AS_PATH: 4 41, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:4::/32, AS_PATH: 4 44, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:5:1::/48, AS_PATH: 4 43, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:6:1::/48, AS_PATH: 4 45, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::2 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:0:1::/48, AS_PATH: 5, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:0:2::/48, AS_PATH: 5 3, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:0:3::/48, AS_PATH: 5 51, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:2:1::/48, AS_PATH: 5, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:2:2::/48, AS_PATH: 5 3, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:2:3::/48, AS_PATH: 5 51, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::2 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv6/openbgpd77p/rs.txt b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv6/openbgpd77p/rs.txt new file mode 100644 index 00000000..17b4fb3e --- /dev/null +++ b/tests/live_tests/scenarios/tag_as_set/routes/TagASSetScenario_WithAS_SETs_OpenBGPDIPv6/openbgpd77p/rs.txt @@ -0,0 +1,294 @@ +2a02:0:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:2::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::/48, AS_PATH: 2 21, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:4::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 999:64512, 999:64514, 999:64516 + ext comms: + lrg comms: 999:0:64512, 999:0:64514, 999:0:64516 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:5::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 999:64512, 999:64514, 999:64518 + ext comms: + lrg comms: 999:0:64512, 999:0:64514, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:2:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:2:2::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:2:3::/48, AS_PATH: 2 21, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:3:1::/48, AS_PATH: 2 21, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:4::/32, AS_PATH: 6 2, NEXT_HOP: 2001:db8:1:1::61, via 2001:db8:1:1::61 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (9) + +2a02:5::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 999:64513, 999:64514, 999:64516 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:6::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 999:64513, 999:64514, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:7::/32, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 999:64513, 999:64514, 999:64516, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:1::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:1::/48, AS_PATH: 4 3, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: False, LOCAL_PREF: 1 + filtered: True (9) + +2a03:0:1::/48, AS_PATH: 5 3, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::51 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: False, LOCAL_PREF: 1 + filtered: True (12) + +2a03:1::/32, AS_PATH: 6 3, NEXT_HOP: 2001:db8:1:1::61, via 2001:db8:1:1::61 + std comms: 999:64513, 999:64514, 999:64516 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:2:1::/48, AS_PATH: 6 3, NEXT_HOP: 2001:db8:1:1::61, via 2001:db8:1:1::61 + std comms: 999:64513, 999:64514, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:3::/32, AS_PATH: 6 3, NEXT_HOP: 2001:db8:1:1::61, via 2001:db8:1:1::61 + std comms: 999:64513, 999:64514, 999:64516, 999:64518 + ext comms: + lrg comms: 999:0:64513, 999:0:64514, 999:0:64516, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:1::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:0:2::/48, AS_PATH: 4 3, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (9) + +2a04:0:3::/48, AS_PATH: 4 41, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:1::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:2:1::/48, AS_PATH: 4, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:2:2::/48, AS_PATH: 4 3, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (9) + +2a04:2:3::/48, AS_PATH: 4 41, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:3:1::/48, AS_PATH: 4 41, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:4:1::/48, AS_PATH: 4 44, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (9) + +2a04:4::/32, AS_PATH: 4 44, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:5:1::/48, AS_PATH: 4 43, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a04:5:2::/48, AS_PATH: 4 45, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 999:64513, 999:64515 + ext comms: + lrg comms: 999:0:64513, 999:0:64515 + best: True, LOCAL_PREF: 1 + filtered: True (9) + +2a04:6:1::/48, AS_PATH: 4 45, NEXT_HOP: 2001:db8:1:1::41, via 2001:db8:1:1::41 + std comms: 999:64513, 999:64515, 999:64517 + ext comms: + lrg comms: 999:0:64513, 999:0:64515, 999:0:64517 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:0:1::/48, AS_PATH: 5, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::51 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:0:2::/48, AS_PATH: 5 3, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::51 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:0:3::/48, AS_PATH: 5 51, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::51 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:1::/48, AS_PATH: 5, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::51 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 1 + filtered: True (12) + +2a05:2:1::/48, AS_PATH: 5, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::51 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:2:2::/48, AS_PATH: 5 3, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::51 + std comms: 999:64512, 999:64515 + ext comms: + lrg comms: 999:0:64512, 999:0:64515 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:2:3::/48, AS_PATH: 5 51, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::51 + std comms: 999:64512, 999:64514 + ext comms: + lrg comms: 999:0:64512, 999:0:64514 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a05:3:1::/48, AS_PATH: 5 51, NEXT_HOP: 2001:db8:1:1::51, via 2001:db8:1:1::51 + std comms: 999:64513, 999:64514 + ext comms: + lrg comms: 999:0:64513, 999:0:64514 + best: True, LOCAL_PREF: 1 + filtered: True (12) + +2a06:0:1::/48, AS_PATH: 6, NEXT_HOP: 2001:db8:1:1::61, via 2001:db8:1:1::61 + std comms: 999:64512, 999:64514, 999:64516, 999:64518 + ext comms: + lrg comms: 999:0:64512, 999:0:64514, 999:0:64516, 999:0:64518 + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/tag_reject_policy/configs/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd76p.conf b/tests/live_tests/scenarios/tag_reject_policy/configs/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd76p.conf new file mode 100644 index 00000000..c2cb47fc --- /dev/null +++ b/tests/live_tests/scenarios/tag_reject_policy/configs/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd76p.conf @@ -0,0 +1,7608 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + +# AS222, used by client AS222_1, client AS222_2 +# no origin ASNs found for AS222 +# no prefixes found for AS222 + +# AS2, used by client AS2_1, client AS2_2 +# no origin ASNs found for AS2 +# no prefixes found for AS2 + +# AS-AS1, AS-AS1_CUSTOMERS, used by client AS1_1, client AS1_2, client AS1_3, client AS1_4 +as-set "AS_SET_AS_AS1_AS_AS1_CUSTOMERS_asns" { + 1 101 +} +prefix-set "AS_SET_AS_AS1_AS_AS1_CUSTOMERS_prefixes" { + 2a01::/32 prefixlen 32 - 128 + 2a99::/16 prefixlen 16 - 128 + 3101::/32 prefixlen 32 - 128 +} + +# AS-AS2, AS-AS2_CUSTOMERS, used by client AS2_1, client AS2_2 +as-set "AS_SET_AS_AS2_AS_AS2_CUSTOMERS_asns" { + 2 101 +} +prefix-set "AS_SET_AS_AS2_AS_AS2_CUSTOMERS_prefixes" { + 2a02::/32 prefixlen 32 - 128 + 3101::/32 prefixlen 32 - 128 +} + +# WHITE_LIST_AS1_2, used by client AS1_2 white list +as-set "AS_SET_WHITE_LIST_AS1_2_asns" { + 1011 +} +prefix-set "AS_SET_WHITE_LIST_AS1_2_prefixes" { + 11.1.0.0/16 prefixlen 16 - 32 + 2a11:1::/32 prefixlen 32 - 128 +} + +# AS-AS222, used by client AS222_1, client AS222_2 +# no origin ASNs found for AS_AS222 +# no prefixes found for AS_AS222 + +# AS1, used by client AS1_1, client AS1_2, client AS1_3, client AS1_4 +# no origin ASNs found for AS1 +# no prefixes found for AS1 + +# WHITE_LIST_AS1_1, used by client AS1_1 white list +as-set "AS_SET_WHITE_LIST_AS1_1_asns" { + 1011 +} +prefix-set "AS_SET_WHITE_LIST_AS1_1_prefixes" { + 11.1.0.0/16 prefixlen 16 - 32 + 2a11:1::/32 prefixlen 32 - 128 +} + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.11 { + remote-as 1 + + rde evaluate all + + descr "AS1_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::11 { + remote-as 1 + + rde evaluate all + + descr "AS1_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.12 { + remote-as 1 + + rde evaluate all + + descr "AS1_2 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::12 { + remote-as 1 + + rde evaluate all + + descr "AS1_2 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.222 { + remote-as 222 + + rde evaluate all + + descr "AS222_1 client" + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::222 { + remote-as 222 + + rde evaluate all + + descr "AS222_1 client" + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.21 { + remote-as 2 + + rde evaluate all + + descr "AS2_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::21 { + remote-as 2 + + rde evaluate all + + descr "AS2_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.31 { + remote-as 3 + + rde evaluate all + + descr "AS3_1 client" + ttl-security no + transparent-as no + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::31 { + remote-as 3 + + rde evaluate all + + descr "AS3_1 client" + ttl-security no + transparent-as no + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 192.0.2.41 { + remote-as 4 + + rde evaluate all + + descr "AS4_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::41 { + remote-as 4 + + rde evaluate all + + descr "AS4_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } +} + +include "/etc/bgpd/post-clients.local" + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + +prefix-set "global_black_list_pref" { + 192.0.2.0/24 prefixlen 24 - 32 + 2001:db8::/32 prefixlen 32 - 128 + +} + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + +# never via route-servers ASNs +as-set "neverviarouteserver" { + 666, 777 +} + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# origin_not_present_in_as_set +match from group clients set community delete 65530:0 +match from group clients set large-community delete 999:65530:0 + +# origin_present_in_as_set +match from group clients set community delete 65530:1 +match from group clients set large-community delete 999:65530:1 + +# prefix_validated_via_arin_whois_db_dump +match from group clients set community delete 65530:3 +match from group clients set large-community delete 999:65530:3 + +# prefix_validated_via_rpki_roas +match from group clients set community delete 65530:2 +match from group clients set large-community delete 999:65530:2 + +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + +# rpki_bgp_origin_validation_not_performed +match from group clients set community delete 65530:4 +match from group clients set large-community delete 999:65530:4 + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + +# --------------------------------------------------------- +# ROAs source + + +roa-set { + 101.3.0.0/16 maxlen 24 source-as 105 expires 4102444799 + 101.2.0.0/17 source-as 101 expires 4102444799 + 101.2.128.0/17 maxlen 24 source-as 101 expires 4102444799 + 101.0.128.0/20 maxlen 23 source-as 101 expires 4102444799 + 101.0.8.0/24 source-as 101 expires 4102444799 + 101.0.9.0/24 source-as 102 expires 4102444799 + 222.1.1.0/24 source-as 333 expires 4102444799 + 3101:3::/32 maxlen 48 source-as 105 expires 4102444799 + 3101:0:8000::/33 maxlen 34 source-as 101 expires 4102444799 + 3101:2:8000::/33 maxlen 48 source-as 101 expires 4102444799 + 3101:2::/33 source-as 101 expires 4102444799 + 3101:0:8::/48 source-as 101 expires 4102444799 + 3101:0:9::/48 source-as 102 expires 4102444799 + 3222:0:1::/48 source-as 333 expires 4102444799 + +} + + + +# --------------------------------------------------------- +# RPKI-based Origin Validation + + +# Add $INTCOMM_RPKI_UNKNOWN, $INTCOMM_RPKI_INVALID and $INTCOMM_RPKI_VALID +# ext community on the basis of ovs. +match from group clients ovs not-found set { + ext-community $INTCOMM_RPKI_UNKNOWN + ext-community ovs not-found + +} +match from group clients ovs valid set { + ext-community $INTCOMM_RPKI_VALID + ext-community ovs valid + +} +match from group clients ovs invalid set { + ext-community $INTCOMM_RPKI_INVALID + ext-community ovs invalid + +} + + + +# --------------------------------------------------------- +# RPKI ROAs used as route objects. + +# Add the $INTCOMM_PREF_OK_ROA ext community to routes whose +# origin ASN has a ROA for the announced prefix. +# It will be used later during IRRDB validation in +# case the origin ASN is authorized by a client's +# AS-SET but the prefix is not. + +# Since RPKI-based Origin Validation is already performed above, +# use the origin validation state to identify valid routes. +match from group clients ovs valid set ext-community $INTCOMM_PREF_OK_ROA + + + + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.11 set ext-community rt 65520:1 + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + +match from 192.0.2.12 set ext-community rt 65520:1 + +match from 2001:db8:1:1::12 set ext-community rt 65520:1 + +match from 192.0.2.222 set ext-community rt 65520:222 + +match from 2001:db8:1:1::222 set ext-community rt 65520:222 + +match from 192.0.2.21 set ext-community rt 65520:2 + +match from 2001:db8:1:1::21 set ext-community rt 65520:2 + +match from 192.0.2.31 set ext-community rt 65520:3 + +match from 2001:db8:1:1::31 set ext-community rt 65520:3 + +match from 192.0.2.41 set ext-community rt 65520:4 + +match from 2001:db8:1:1::41 set ext-community rt 65520:4 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 6' - reject code: 1 +allow quick from group clients max-as-len 6 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: global blacklist +# Reject inbound routes when 'from group clients prefix-set global_black_list_pref' - reject code: 3 +allow quick from group clients prefix-set global_black_list_pref set { + localpref 1 + community 65520:0 + community 65520:3 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS1_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.11 AS { 3, 174 }' - reject code: 8 +allow quick from 192.0.2.11 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.11 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.11 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 192.0.2.11 prefix 11.3.0.0/16 source-as 1011 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.11 prefix 11.4.0.0/16 prefixlen 16 - 32 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.11 prefix 2a11:3::/32 source-as 1011 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.11 prefix 2a11:4::/32 prefixlen 32 - 128 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 192.0.2.11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_1, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.11 source-as as-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. +match from 192.0.2.11 source-as as-set AS_SET_WHITE_LIST_AS1_1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS1_1 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_1, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.11 prefix-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. +match from 192.0.2.11 prefix-set AS_SET_WHITE_LIST_AS1_1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS1_1 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + +# route authorized by a client's white list? +match from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 192.0.2.11 set ext-community delete rt 65520:1 + + +# Remove internal communities before accepting the route +match from 192.0.2.11 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.11 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.11 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.11 community BLACKHOLE set community 65530:4 +match from 192.0.2.11 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.11 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.11 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.11 community BLACKHOLE +allow quick from 192.0.2.11 community 65534:0 +allow quick from 192.0.2.11 large-community 65534:0:0 + + +match from 192.0.2.11 set ext-community rt 65520:1 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.11 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 192.0.2.11 community 65534:0 set community BLACKHOLE +match to 192.0.2.11 large-community 65534:0:0 set community BLACKHOLE + +match to 192.0.2.11 community BLACKHOLE set community NO_EXPORT +match to 192.0.2.11 community BLACKHOLE set nexthop 192.0.2.66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.11 community 65507:999 set community NO_EXPORT +match to 192.0.2.11 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.11 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.11 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.11 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.11 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.11 community 65509:1 set community NO_EXPORT +match to 192.0.2.11 ext-community rt 65509:1 set community NO_EXPORT +match to 192.0.2.11 large-community 999:65509:1 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.11 community 65510:1 set community NO_ADVERTISE +match to 192.0.2.11 ext-community rt 65510:1 set community NO_ADVERTISE +match to 192.0.2.11 large-community 999:65510:1 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.11 + +# do_not_announce_to_any +deny to 192.0.2.11 community 0:999 +deny to 192.0.2.11 ext-community rt 0:999 +deny to 192.0.2.11 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.11 community 0:1 +deny quick to 192.0.2.11 ext-community rt 0:1 +deny quick to 192.0.2.11 large-community 999:0:1 + +# announce_to_peer +allow to 192.0.2.11 community 65501:1 +allow to 192.0.2.11 ext-community rt 65501:1 +allow to 192.0.2.11 large-community 999:65501:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS1_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS { 3, 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::11 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::11 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 2001:db8:1:1::11 prefix 11.3.0.0/16 source-as 1011 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::11 prefix 11.4.0.0/16 prefixlen 16 - 32 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::11 prefix 2a11:3::/32 source-as 1011 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::11 prefix 2a11:4::/32 prefixlen 32 - 128 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 2001:db8:1:1::11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_2, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::11 source-as as-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS1_AS_AS1_CUSTOMERS +match from 2001:db8:1:1::11 source-as as-set AS_SET_WHITE_LIST_AS1_2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS1_2 +# AS-SET AS1 referenced but empty. + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_2, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::11 prefix-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS1_AS_AS1_CUSTOMERS +match from 2001:db8:1:1::11 prefix-set AS_SET_WHITE_LIST_AS1_2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS1_2 +# AS-SET AS1 referenced but empty. + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + +# route authorized by a client's white list? +match from 2001:db8:1:1::11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::11 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::11 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::11 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::11 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::11 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::11 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::11 community BLACKHOLE +allow quick from 2001:db8:1:1::11 community 65534:0 +allow quick from 2001:db8:1:1::11 large-community 65534:0:0 + + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::11 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::11 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::11 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + +deny quick to 2001:db8:1:1::11 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 2001:db8:1:1::11 community 65534:0 set community BLACKHOLE +match to 2001:db8:1:1::11 large-community 65534:0:0 set community BLACKHOLE + +match to 2001:db8:1:1::11 community BLACKHOLE set community NO_EXPORT +match to 2001:db8:1:1::11 community BLACKHOLE set nexthop 2001:db8:1:1::66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::11 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::11 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::11 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::11 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::11 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::11 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::11 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::11 community 65509:1 set community NO_EXPORT +match to 2001:db8:1:1::11 ext-community rt 65509:1 set community NO_EXPORT +match to 2001:db8:1:1::11 large-community 999:65509:1 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::11 community 65510:1 set community NO_ADVERTISE +match to 2001:db8:1:1::11 ext-community rt 65510:1 set community NO_ADVERTISE +match to 2001:db8:1:1::11 large-community 999:65510:1 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::11 + +# do_not_announce_to_any +deny to 2001:db8:1:1::11 community 0:999 +deny to 2001:db8:1:1::11 ext-community rt 0:999 +deny to 2001:db8:1:1::11 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::11 community 0:1 +deny quick to 2001:db8:1:1::11 ext-community rt 0:1 +deny quick to 2001:db8:1:1::11 large-community 999:0:1 + +# announce_to_peer +allow to 2001:db8:1:1::11 community 65501:1 +allow to 2001:db8:1:1::11 ext-community rt 65501:1 +allow to 2001:db8:1:1::11 large-community 999:65501:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS1_3, inbound + + + +# NEXT_HOP +match from 192.0.2.12 set community NO_ADVERTISE +match from 192.0.2.12 nexthop 192.0.2.11 set community delete NO_ADVERTISE +match from 192.0.2.12 nexthop 192.0.2.12 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.12 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.12 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.12 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.12 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.12 AS 23456' - reject code: 7 +allow quick from 192.0.2.12 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.12 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.12 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.12 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.12 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.12 AS { 3, 174 }' - reject code: 8 +allow quick from 192.0.2.12 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.12 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.12 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +match from 192.0.2.12 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_3, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.12 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.12 source-as as-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_3, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.12 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.12 prefix-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.12 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 192.0.2.12 set ext-community delete rt 65520:1 + + +# Remove internal communities before accepting the route +match from 192.0.2.12 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.12 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.12 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.12 community BLACKHOLE set community 65530:4 +match from 192.0.2.12 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.12 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.12 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.12 community BLACKHOLE +allow quick from 192.0.2.12 community 65534:0 +allow quick from 192.0.2.12 large-community 65534:0:0 + + +match from 192.0.2.12 set ext-community rt 65520:1 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.12 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.12 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.12 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.12 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.12 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 192.0.2.12 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.12 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.12 + + + +# --------------------------------------------- +# client AS1_3, outbound + +deny quick to 192.0.2.12 community 65520:0 + + + +# Blackhole request? +# Client not enabled to receive blackhole routes +deny quick to 192.0.2.12 community BLACKHOLE +deny quick to 192.0.2.12 community 65534:0 +deny quick to 192.0.2.12 large-community 65534:0:0 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.12 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.12 community 65507:999 set community NO_EXPORT +match to 192.0.2.12 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.12 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.12 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.12 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.12 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.12 community 65509:1 set community NO_EXPORT +match to 192.0.2.12 ext-community rt 65509:1 set community NO_EXPORT +match to 192.0.2.12 large-community 999:65509:1 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.12 community 65510:1 set community NO_ADVERTISE +match to 192.0.2.12 ext-community rt 65510:1 set community NO_ADVERTISE +match to 192.0.2.12 large-community 999:65510:1 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.12 + +# do_not_announce_to_any +deny to 192.0.2.12 community 0:999 +deny to 192.0.2.12 ext-community rt 0:999 +deny to 192.0.2.12 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.12 community 0:1 +deny quick to 192.0.2.12 ext-community rt 0:1 +deny quick to 192.0.2.12 large-community 999:0:1 + +# announce_to_peer +allow to 192.0.2.12 community 65501:1 +allow to 192.0.2.12 ext-community rt 65501:1 +allow to 192.0.2.12 large-community 999:65501:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.12 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS1_4, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::12 set community NO_ADVERTISE +match from 2001:db8:1:1::12 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +match from 2001:db8:1:1::12 nexthop 2001:db8:1:1::12 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::12 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::12 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::12 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::12 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::12 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::12 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::12 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::12 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::12 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::12 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::12 AS { 3, 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::12 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::12 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::12 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +match from 2001:db8:1:1::12 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_4, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::12 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::12 source-as as-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_4, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::12 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::12 prefix-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::12 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 2001:db8:1:1::12 set ext-community delete rt 65520:1 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::12 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::12 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::12 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::12 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::12 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::12 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::12 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::12 community BLACKHOLE +allow quick from 2001:db8:1:1::12 community 65534:0 +allow quick from 2001:db8:1:1::12 large-community 65534:0:0 + + +match from 2001:db8:1:1::12 set ext-community rt 65520:1 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::12 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::12 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::12 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::12 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::12 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::12 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::12 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::12 + + + +# --------------------------------------------- +# client AS1_4, outbound + +deny quick to 2001:db8:1:1::12 community 65520:0 + + + +# Blackhole request? +# Client not enabled to receive blackhole routes +deny quick to 2001:db8:1:1::12 community BLACKHOLE +deny quick to 2001:db8:1:1::12 community 65534:0 +deny quick to 2001:db8:1:1::12 large-community 65534:0:0 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::12 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::12 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::12 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::12 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::12 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::12 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::12 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::12 community 65509:1 set community NO_EXPORT +match to 2001:db8:1:1::12 ext-community rt 65509:1 set community NO_EXPORT +match to 2001:db8:1:1::12 large-community 999:65509:1 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::12 community 65510:1 set community NO_ADVERTISE +match to 2001:db8:1:1::12 ext-community rt 65510:1 set community NO_ADVERTISE +match to 2001:db8:1:1::12 large-community 999:65510:1 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::12 + +# do_not_announce_to_any +deny to 2001:db8:1:1::12 community 0:999 +deny to 2001:db8:1:1::12 ext-community rt 0:999 +deny to 2001:db8:1:1::12 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::12 community 0:1 +deny quick to 2001:db8:1:1::12 ext-community rt 0:1 +deny quick to 2001:db8:1:1::12 large-community 999:0:1 + +# announce_to_peer +allow to 2001:db8:1:1::12 community 65501:1 +allow to 2001:db8:1:1::12 ext-community rt 65501:1 +allow to 2001:db8:1:1::12 large-community 999:65501:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::12 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS222_1, inbound + + + +# NEXT_HOP +match from 192.0.2.222 set community NO_ADVERTISE +match from 192.0.2.222 nexthop 192.0.2.222 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.222 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.222 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.222 peer-as != 222' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.222 peer-as != 222 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.222 AS 23456' - reject code: 7 +allow quick from 192.0.2.222 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.222 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.222 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.222 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.222 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.222 AS { 3, 174 }' - reject code: 8 +allow quick from 192.0.2.222 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.222 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.222 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 192.0.2.222 prefix 222.1.1.0/24 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.222 prefix 3222:0:1::/48 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 192.0.2.222 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS222_1, AS222: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.222 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS222 referenced but empty. +# AS-SET AS_AS222 referenced but empty. + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS222_1, AS222: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.222 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS222 referenced but empty. +# AS-SET AS_AS222 referenced but empty. + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.222 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + +# route authorized by a client's white list? +match from 192.0.2.222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 192.0.2.222 set ext-community delete rt 65520:222 + + +# Remove internal communities before accepting the route +match from 192.0.2.222 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.222 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.222 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.222 community BLACKHOLE set community 65530:4 +match from 192.0.2.222 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.222 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.222 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.222 community BLACKHOLE +allow quick from 192.0.2.222 community 65534:0 +allow quick from 192.0.2.222 large-community 65534:0:0 + + +match from 192.0.2.222 set ext-community rt 65520:222 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.222 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.222 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.222 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.222 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.222 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 192.0.2.222 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.222 set ext-community delete rt 65520:222 + + + +allow quick from 192.0.2.222 + + + +# --------------------------------------------- +# client AS222_1, outbound + +deny quick to 192.0.2.222 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 192.0.2.222 community 65534:0 set community BLACKHOLE +match to 192.0.2.222 large-community 65534:0:0 set community BLACKHOLE + +match to 192.0.2.222 community BLACKHOLE set community NO_EXPORT +match to 192.0.2.222 community BLACKHOLE set nexthop 192.0.2.66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.222 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.222 community 65507:999 set community NO_EXPORT +match to 192.0.2.222 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.222 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.222 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.222 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.222 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.222 community 65509:222 set community NO_EXPORT +match to 192.0.2.222 ext-community rt 65509:222 set community NO_EXPORT +match to 192.0.2.222 large-community 999:65509:222 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.222 community 65510:222 set community NO_ADVERTISE +match to 192.0.2.222 ext-community rt 65510:222 set community NO_ADVERTISE +match to 192.0.2.222 large-community 999:65510:222 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.222 + +# do_not_announce_to_any +deny to 192.0.2.222 community 0:999 +deny to 192.0.2.222 ext-community rt 0:999 +deny to 192.0.2.222 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.222 community 0:222 +deny quick to 192.0.2.222 ext-community rt 0:222 +deny quick to 192.0.2.222 large-community 999:0:222 + +# announce_to_peer +allow to 192.0.2.222 community 65501:222 +allow to 192.0.2.222 ext-community rt 65501:222 +allow to 192.0.2.222 large-community 999:65501:222 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.222 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS222_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::222 set community NO_ADVERTISE +match from 2001:db8:1:1::222 nexthop 2001:db8:1:1::222 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::222 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::222 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::222 peer-as != 222' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::222 peer-as != 222 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::222 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::222 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::222 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::222 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::222 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::222 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::222 AS { 3, 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::222 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::222 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::222 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 2001:db8:1:1::222 prefix 222.1.1.0/24 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::222 prefix 3222:0:1::/48 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 2001:db8:1:1::222 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS222_2, AS222: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::222 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS222 referenced but empty. +# AS-SET AS_AS222 referenced but empty. + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS222_2, AS222: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::222 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS222 referenced but empty. +# AS-SET AS_AS222 referenced but empty. + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::222 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + +# route authorized by a client's white list? +match from 2001:db8:1:1::222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 2001:db8:1:1::222 set ext-community delete rt 65520:222 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::222 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::222 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::222 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::222 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::222 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::222 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::222 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::222 community BLACKHOLE +allow quick from 2001:db8:1:1::222 community 65534:0 +allow quick from 2001:db8:1:1::222 large-community 65534:0:0 + + +match from 2001:db8:1:1::222 set ext-community rt 65520:222 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::222 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::222 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::222 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::222 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::222 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::222 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::222 set ext-community delete rt 65520:222 + + + +allow quick from 2001:db8:1:1::222 + + + +# --------------------------------------------- +# client AS222_2, outbound + +deny quick to 2001:db8:1:1::222 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 2001:db8:1:1::222 community 65534:0 set community BLACKHOLE +match to 2001:db8:1:1::222 large-community 65534:0:0 set community BLACKHOLE + +match to 2001:db8:1:1::222 community BLACKHOLE set community NO_EXPORT +match to 2001:db8:1:1::222 community BLACKHOLE set nexthop 2001:db8:1:1::66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::222 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::222 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::222 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::222 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::222 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::222 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::222 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::222 community 65509:222 set community NO_EXPORT +match to 2001:db8:1:1::222 ext-community rt 65509:222 set community NO_EXPORT +match to 2001:db8:1:1::222 large-community 999:65509:222 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::222 community 65510:222 set community NO_ADVERTISE +match to 2001:db8:1:1::222 ext-community rt 65510:222 set community NO_ADVERTISE +match to 2001:db8:1:1::222 large-community 999:65510:222 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::222 + +# do_not_announce_to_any +deny to 2001:db8:1:1::222 community 0:999 +deny to 2001:db8:1:1::222 ext-community rt 0:999 +deny to 2001:db8:1:1::222 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::222 community 0:222 +deny quick to 2001:db8:1:1::222 ext-community rt 0:222 +deny quick to 2001:db8:1:1::222 large-community 999:0:222 + +# announce_to_peer +allow to 2001:db8:1:1::222 community 65501:222 +allow to 2001:db8:1:1::222 ext-community rt 65501:222 +allow to 2001:db8:1:1::222 large-community 999:65501:222 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::222 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.21 set community NO_ADVERTISE +match from 192.0.2.21 nexthop 192.0.2.21 set community delete NO_ADVERTISE +match from 192.0.2.21 nexthop 192.0.2.22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.21 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.21 AS 23456' - reject code: 7 +allow quick from 192.0.2.21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.21 AS { 3, 174 }' - reject code: 8 +allow quick from 192.0.2.21 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.21 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.21 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +match from 192.0.2.21 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS2_1, AS2: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.21 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 192.0.2.21 source-as as-set AS_SET_AS_AS2_AS_AS2_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS2_AS_AS2_CUSTOMERS + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS2_1, AS2: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.21 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 192.0.2.21 prefix-set AS_SET_AS_AS2_AS_AS2_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS2_AS_AS2_CUSTOMERS + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 192.0.2.21 set ext-community delete rt 65520:2 + + +# Remove internal communities before accepting the route +match from 192.0.2.21 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.21 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.21 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.21 community BLACKHOLE set community 65530:4 +match from 192.0.2.21 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.21 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.21 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.21 community BLACKHOLE +allow quick from 192.0.2.21 community 65534:0 +allow quick from 192.0.2.21 large-community 65534:0:0 + + +match from 192.0.2.21 set ext-community rt 65520:2 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.21 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.21 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.21 community GRACEFUL_SHUTDOWN set community delete GRACEFUL_SHUTDOWN + +# Remove internal communities before accepting the route +match from 192.0.2.21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.21 set ext-community delete rt 65520:2 + + + +allow quick from 192.0.2.21 + + + +# --------------------------------------------- +# client AS2_1, outbound + +deny quick to 192.0.2.21 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 192.0.2.21 community 65534:0 set community BLACKHOLE +match to 192.0.2.21 large-community 65534:0:0 set community BLACKHOLE + +match to 192.0.2.21 community BLACKHOLE set community NO_EXPORT +match to 192.0.2.21 community BLACKHOLE set nexthop 192.0.2.66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.21 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.21 community 65507:999 set community NO_EXPORT +match to 192.0.2.21 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.21 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.21 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.21 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.21 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.21 community 65509:2 set community NO_EXPORT +match to 192.0.2.21 ext-community rt 65509:2 set community NO_EXPORT +match to 192.0.2.21 large-community 999:65509:2 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.21 community 65510:2 set community NO_ADVERTISE +match to 192.0.2.21 ext-community rt 65510:2 set community NO_ADVERTISE +match to 192.0.2.21 large-community 999:65510:2 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.21 + +# do_not_announce_to_any +deny to 192.0.2.21 community 0:999 +deny to 192.0.2.21 ext-community rt 0:999 +deny to 192.0.2.21 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.21 community 0:2 +deny quick to 192.0.2.21 ext-community rt 0:2 +deny quick to 192.0.2.21 large-community 999:0:2 + +# announce_to_peer +allow to 192.0.2.21 community 65501:2 +allow to 192.0.2.21 ext-community rt 65501:2 +allow to 192.0.2.21 large-community 999:65501:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::21 set community NO_ADVERTISE +match from 2001:db8:1:1::21 nexthop 2001:db8:1:1::21 set community delete NO_ADVERTISE +match from 2001:db8:1:1::21 nexthop 2001:db8:1:1::22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::21 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS { 3, 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::21 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::21 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +match from 2001:db8:1:1::21 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS2_2, AS2: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::21 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 2001:db8:1:1::21 source-as as-set AS_SET_AS_AS2_AS_AS2_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS2_AS_AS2_CUSTOMERS + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS2_2, AS2: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::21 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 2001:db8:1:1::21 prefix-set AS_SET_AS_AS2_AS_AS2_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS2_AS_AS2_CUSTOMERS + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 2001:db8:1:1::21 set ext-community delete rt 65520:2 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::21 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::21 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::21 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::21 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::21 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::21 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::21 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::21 community BLACKHOLE +allow quick from 2001:db8:1:1::21 community 65534:0 +allow quick from 2001:db8:1:1::21 large-community 65534:0:0 + + +match from 2001:db8:1:1::21 set ext-community rt 65520:2 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::21 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::21 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::21 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::21 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::21 community GRACEFUL_SHUTDOWN set community delete GRACEFUL_SHUTDOWN + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::21 set ext-community delete rt 65520:2 + + + +allow quick from 2001:db8:1:1::21 + + + +# --------------------------------------------- +# client AS2_2, outbound + +deny quick to 2001:db8:1:1::21 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 2001:db8:1:1::21 community 65534:0 set community BLACKHOLE +match to 2001:db8:1:1::21 large-community 65534:0:0 set community BLACKHOLE + +match to 2001:db8:1:1::21 community BLACKHOLE set community NO_EXPORT +match to 2001:db8:1:1::21 community BLACKHOLE set nexthop 2001:db8:1:1::66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::21 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::21 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::21 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::21 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::21 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::21 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::21 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::21 community 65509:2 set community NO_EXPORT +match to 2001:db8:1:1::21 ext-community rt 65509:2 set community NO_EXPORT +match to 2001:db8:1:1::21 large-community 999:65509:2 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::21 community 65510:2 set community NO_ADVERTISE +match to 2001:db8:1:1::21 ext-community rt 65510:2 set community NO_ADVERTISE +match to 2001:db8:1:1::21 large-community 999:65510:2 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::21 + +# do_not_announce_to_any +deny to 2001:db8:1:1::21 community 0:999 +deny to 2001:db8:1:1::21 ext-community rt 0:999 +deny to 2001:db8:1:1::21 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::21 community 0:2 +deny quick to 2001:db8:1:1::21 ext-community rt 0:2 +deny quick to 2001:db8:1:1::21 large-community 999:0:2 + +# announce_to_peer +allow to 2001:db8:1:1::21 community 65501:2 +allow to 2001:db8:1:1::21 ext-community rt 65501:2 +allow to 2001:db8:1:1::21 large-community 999:65501:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS3_1, inbound + + + +# NEXT_HOP +match from 192.0.2.31 set community NO_ADVERTISE +match from 192.0.2.31 nexthop 192.0.2.31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.31 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.31 AS 23456' - reject code: 7 +allow quick from 192.0.2.31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.31 AS { 174 }' - reject code: 8 +allow quick from 192.0.2.31 AS { 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.31 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.31 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +# Prefix: client's blacklist +prefix-set "client_AS3_1_black_list_pref_ipv4" { + 3.0.1.0/24 prefixlen 24 - 32 + +} +# Reject inbound routes when 'from 192.0.2.31 prefix-set client_AS3_1_black_list_pref_ipv4' - reject code: 11 +allow quick from 192.0.2.31 prefix-set client_AS3_1_black_list_pref_ipv4 set { + localpref 1 + community 65520:0 + community 65520:11 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Blackhole request? +match from 192.0.2.31 set ext-community delete rt 65520:3 + + +# Remove internal communities before accepting the route +match from 192.0.2.31 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.31 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.31 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.31 community BLACKHOLE set community 65530:4 +match from 192.0.2.31 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.31 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.31 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.31 community BLACKHOLE +allow quick from 192.0.2.31 community 65534:0 +allow quick from 192.0.2.31 large-community 65534:0:0 + + +match from 192.0.2.31 set ext-community rt 65520:3 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.31 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.31 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.31 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 192.0.2.31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.31 set ext-community delete rt 65520:3 + + + +allow quick from 192.0.2.31 + + + +# --------------------------------------------- +# client AS3_1, outbound + +deny quick to 192.0.2.31 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 192.0.2.31 community 65534:0 set community BLACKHOLE +match to 192.0.2.31 large-community 65534:0:0 set community BLACKHOLE + +match to 192.0.2.31 community BLACKHOLE set community NO_EXPORT +match to 192.0.2.31 community BLACKHOLE set nexthop 192.0.2.66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.31 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.31 community 65507:999 set community NO_EXPORT +match to 192.0.2.31 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.31 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.31 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.31 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.31 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.31 community 65509:3 set community NO_EXPORT +match to 192.0.2.31 ext-community rt 65509:3 set community NO_EXPORT +match to 192.0.2.31 large-community 999:65509:3 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.31 community 65510:3 set community NO_ADVERTISE +match to 192.0.2.31 ext-community rt 65510:3 set community NO_ADVERTISE +match to 192.0.2.31 large-community 999:65510:3 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.31 + +# do_not_announce_to_any +deny to 192.0.2.31 community 0:999 +deny to 192.0.2.31 ext-community rt 0:999 +deny to 192.0.2.31 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.31 community 0:3 +deny quick to 192.0.2.31 ext-community rt 0:3 +deny quick to 192.0.2.31 large-community 999:0:3 + +# announce_to_peer +allow to 192.0.2.31 community 65501:3 +allow to 192.0.2.31 ext-community rt 65501:3 +allow to 192.0.2.31 large-community 999:65501:3 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS3_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::31 set community NO_ADVERTISE +match from 2001:db8:1:1::31 nexthop 2001:db8:1:1::31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::31 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::31 AS { 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::31 AS { 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::31 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::31 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +# Prefix: client's blacklist +prefix-set "client_AS3_2_black_list_pref_ipv6" { + 2a03:0:1::/48 prefixlen 48 - 128 + +} +# Reject inbound routes when 'from 2001:db8:1:1::31 prefix-set client_AS3_2_black_list_pref_ipv6' - reject code: 11 +allow quick from 2001:db8:1:1::31 prefix-set client_AS3_2_black_list_pref_ipv6 set { + localpref 1 + community 65520:0 + community 65520:11 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Blackhole request? +match from 2001:db8:1:1::31 set ext-community delete rt 65520:3 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::31 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::31 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::31 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::31 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::31 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::31 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::31 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::31 community BLACKHOLE +allow quick from 2001:db8:1:1::31 community 65534:0 +allow quick from 2001:db8:1:1::31 large-community 65534:0:0 + + +match from 2001:db8:1:1::31 set ext-community rt 65520:3 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::31 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::31 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::31 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::31 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::31 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::31 set ext-community delete rt 65520:3 + + + +allow quick from 2001:db8:1:1::31 + + + +# --------------------------------------------- +# client AS3_2, outbound + +deny quick to 2001:db8:1:1::31 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 2001:db8:1:1::31 community 65534:0 set community BLACKHOLE +match to 2001:db8:1:1::31 large-community 65534:0:0 set community BLACKHOLE + +match to 2001:db8:1:1::31 community BLACKHOLE set community NO_EXPORT +match to 2001:db8:1:1::31 community BLACKHOLE set nexthop 2001:db8:1:1::66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::31 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::31 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::31 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::31 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::31 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::31 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::31 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::31 community 65509:3 set community NO_EXPORT +match to 2001:db8:1:1::31 ext-community rt 65509:3 set community NO_EXPORT +match to 2001:db8:1:1::31 large-community 999:65509:3 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::31 community 65510:3 set community NO_ADVERTISE +match to 2001:db8:1:1::31 ext-community rt 65510:3 set community NO_ADVERTISE +match to 2001:db8:1:1::31 large-community 999:65510:3 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::31 + +# do_not_announce_to_any +deny to 2001:db8:1:1::31 community 0:999 +deny to 2001:db8:1:1::31 ext-community rt 0:999 +deny to 2001:db8:1:1::31 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::31 community 0:3 +deny quick to 2001:db8:1:1::31 ext-community rt 0:3 +deny quick to 2001:db8:1:1::31 large-community 999:0:3 + +# announce_to_peer +allow to 2001:db8:1:1::31 community 65501:3 +allow to 2001:db8:1:1::31 ext-community rt 65501:3 +allow to 2001:db8:1:1::31 large-community 999:65501:3 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS4_1, inbound + + + +# NEXT_HOP +match from 192.0.2.41 set community NO_ADVERTISE +match from 192.0.2.41 nexthop 192.0.2.41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.41 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.41 AS 23456' - reject code: 7 +allow quick from 192.0.2.41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.41 AS { 3, 174 }' - reject code: 8 +allow quick from 192.0.2.41 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.41 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.41 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + +# Blackhole request? +match from 192.0.2.41 set ext-community delete rt 65520:4 + + +# Remove internal communities before accepting the route +match from 192.0.2.41 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.41 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.41 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.41 community BLACKHOLE set community 65530:4 +match from 192.0.2.41 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.41 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.41 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.41 community BLACKHOLE +allow quick from 192.0.2.41 community 65534:0 +allow quick from 192.0.2.41 large-community 65534:0:0 + + +match from 192.0.2.41 set ext-community rt 65520:4 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.41 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.41 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.41 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 192.0.2.41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.41 set ext-community delete rt 65520:4 + + + +allow quick from 192.0.2.41 + + + +# --------------------------------------------- +# client AS4_1, outbound + +deny quick to 192.0.2.41 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 192.0.2.41 community 65534:0 set community BLACKHOLE +match to 192.0.2.41 large-community 65534:0:0 set community BLACKHOLE + +match to 192.0.2.41 community BLACKHOLE set community NO_EXPORT +match to 192.0.2.41 community BLACKHOLE set nexthop 192.0.2.66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.41 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.41 community 65507:999 set community NO_EXPORT +match to 192.0.2.41 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.41 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.41 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.41 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.41 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.41 community 65509:4 set community NO_EXPORT +match to 192.0.2.41 ext-community rt 65509:4 set community NO_EXPORT +match to 192.0.2.41 large-community 999:65509:4 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.41 community 65510:4 set community NO_ADVERTISE +match to 192.0.2.41 ext-community rt 65510:4 set community NO_ADVERTISE +match to 192.0.2.41 large-community 999:65510:4 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.41 + +# do_not_announce_to_any +deny to 192.0.2.41 community 0:999 +deny to 192.0.2.41 ext-community rt 0:999 +deny to 192.0.2.41 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.41 community 0:4 +deny quick to 192.0.2.41 ext-community rt 0:4 +deny quick to 192.0.2.41 large-community 999:0:4 + +# announce_to_peer +allow to 192.0.2.41 community 65501:4 +allow to 192.0.2.41 ext-community rt 65501:4 +allow to 192.0.2.41 large-community 999:65501:4 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS4_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::41 set community NO_ADVERTISE +match from 2001:db8:1:1::41 nexthop 2001:db8:1:1::41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::41 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS { 3, 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::41 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::41 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + +# Blackhole request? +match from 2001:db8:1:1::41 set ext-community delete rt 65520:4 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::41 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::41 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::41 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::41 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::41 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::41 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::41 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::41 community BLACKHOLE +allow quick from 2001:db8:1:1::41 community 65534:0 +allow quick from 2001:db8:1:1::41 large-community 65534:0:0 + + +match from 2001:db8:1:1::41 set ext-community rt 65520:4 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::41 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::41 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::41 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::41 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::41 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::41 set ext-community delete rt 65520:4 + + + +allow quick from 2001:db8:1:1::41 + + + +# --------------------------------------------- +# client AS4_2, outbound + +deny quick to 2001:db8:1:1::41 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 2001:db8:1:1::41 community 65534:0 set community BLACKHOLE +match to 2001:db8:1:1::41 large-community 65534:0:0 set community BLACKHOLE + +match to 2001:db8:1:1::41 community BLACKHOLE set community NO_EXPORT +match to 2001:db8:1:1::41 community BLACKHOLE set nexthop 2001:db8:1:1::66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::41 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::41 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::41 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::41 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::41 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::41 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::41 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::41 community 65509:4 set community NO_EXPORT +match to 2001:db8:1:1::41 ext-community rt 65509:4 set community NO_EXPORT +match to 2001:db8:1:1::41 large-community 999:65509:4 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::41 community 65510:4 set community NO_ADVERTISE +match to 2001:db8:1:1::41 ext-community rt 65510:4 set community NO_ADVERTISE +match to 2001:db8:1:1::41 large-community 999:65510:4 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::41 + +# do_not_announce_to_any +deny to 2001:db8:1:1::41 community 0:999 +deny to 2001:db8:1:1::41 ext-community rt 0:999 +deny to 2001:db8:1:1::41 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::41 community 0:4 +deny quick to 2001:db8:1:1::41 ext-community rt 0:4 +deny quick to 2001:db8:1:1::41 large-community 999:0:4 + +# announce_to_peer +allow to 2001:db8:1:1::41 community 65501:4 +allow to 2001:db8:1:1::41 ext-community rt 65501:4 +allow to 2001:db8:1:1::41 large-community 999:65501:4 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + + + +# Scrub communities from outbound routes +# add_noadvertise_to_any +match to group clients set community delete 65508:999 +match to group clients set ext-community delete rt 65508:999 +match to group clients set large-community delete 999:65508:999 + +# add_noadvertise_to_peer +match to group clients set community delete 65510:* +match to group clients set ext-community delete rt 65510:* +match to group clients set large-community delete 999:65510:* + +# add_noexport_to_any +match to group clients set community delete 65507:999 +match to group clients set ext-community delete rt 65507:999 +match to group clients set large-community delete 999:65507:999 + +# add_noexport_to_peer +match to group clients set community delete 65509:* +match to group clients set ext-community delete rt 65509:* +match to group clients set large-community delete 999:65509:* + +# announce_to_peer +match to group clients set community delete 65501:* +match to group clients set ext-community delete rt 65501:* +match to group clients set large-community delete 999:65501:* + +# announce_to_peers_with_rtt_higher_than +match to group clients set community delete 64533:* +match to group clients set ext-community delete rt 64533:* +match to group clients set large-community delete 999:64533:* + +# announce_to_peers_with_rtt_lower_than +match to group clients set community delete 64532:* +match to group clients set ext-community delete rt 64532:* +match to group clients set large-community delete 999:64532:* + +# blackholing +match to group clients set community delete 65534:0 +match to group clients set large-community delete 65534:0:0 + +# do_not_announce_to_any +match to group clients set community delete 0:999 +match to group clients set ext-community delete rt 0:999 +match to group clients set large-community delete 999:0:999 + +# do_not_announce_to_peer +match to group clients set community delete 0:* +match to group clients set ext-community delete rt 0:* +match to group clients set large-community delete 999:0:* + +# do_not_announce_to_peers_with_rtt_higher_than +match to group clients set community delete 64531:* +match to group clients set ext-community delete rt 64531:* +match to group clients set large-community delete 999:64531:* + +# do_not_announce_to_peers_with_rtt_lower_than +match to group clients set community delete 64530:* +match to group clients set ext-community delete rt 64530:* +match to group clients set large-community delete 999:64530:* + +# prepend_once_to_any +match to group clients set community delete 65521:65521 +match to group clients set ext-community delete rt 65521:65521 +match to group clients set large-community delete 999:65521:65521 + +# prepend_once_to_peer +match to group clients set community delete 65521:* +match to group clients set ext-community delete rt 65521:* +match to group clients set large-community delete 999:65521:* + +# prepend_once_to_peers_with_rtt_higher_than +match to group clients set community delete 64537:* +match to group clients set ext-community delete rt 64537:* +match to group clients set large-community delete 999:64537:* + +# prepend_once_to_peers_with_rtt_lower_than +match to group clients set community delete 64534:* +match to group clients set ext-community delete rt 64534:* +match to group clients set large-community delete 999:64534:* + +# prepend_thrice_to_any +match to group clients set community delete 65523:65523 +match to group clients set ext-community delete rt 65523:65523 +match to group clients set large-community delete 999:65523:65523 + +# prepend_thrice_to_peer +match to group clients set community delete 65523:* +match to group clients set ext-community delete rt 65523:* +match to group clients set large-community delete 999:65523:* + +# prepend_thrice_to_peers_with_rtt_higher_than +match to group clients set community delete 64539:* +match to group clients set ext-community delete rt 64539:* +match to group clients set large-community delete 999:64539:* + +# prepend_thrice_to_peers_with_rtt_lower_than +match to group clients set community delete 64536:* +match to group clients set ext-community delete rt 64536:* +match to group clients set large-community delete 999:64536:* + +# prepend_twice_to_any +match to group clients set community delete 65522:65522 +match to group clients set ext-community delete rt 65522:65522 +match to group clients set large-community delete 999:65522:65522 + +# prepend_twice_to_peer +match to group clients set community delete 65522:* +match to group clients set ext-community delete rt 65522:* +match to group clients set large-community delete 999:65522:* + +# prepend_twice_to_peers_with_rtt_higher_than +match to group clients set community delete 64538:* +match to group clients set ext-community delete rt 64538:* +match to group clients set large-community delete 999:64538:* + +# prepend_twice_to_peers_with_rtt_lower_than +match to group clients set community delete 64535:* +match to group clients set ext-community delete rt 64535:* +match to group clients set large-community delete 999:64535:* + +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities +match to group clients set { + community delete 65521:65521 + ext-community delete rt 65521:65521 + large-community delete 999:65521:65521 + +} +match to group clients set { + community delete 65521:* + ext-community delete rt 65521:* + large-community delete 999:65521:* + +} +match to group clients set { + community delete 64537:* + ext-community delete rt 64537:* + large-community delete 999:64537:* + +} +match to group clients set { + community delete 64534:* + ext-community delete rt 64534:* + large-community delete 999:64534:* + +} +match to group clients set { + community delete 65523:65523 + ext-community delete rt 65523:65523 + large-community delete 999:65523:65523 + +} +match to group clients set { + community delete 65523:* + ext-community delete rt 65523:* + large-community delete 999:65523:* + +} +match to group clients set { + community delete 64539:* + ext-community delete rt 64539:* + large-community delete 999:64539:* + +} +match to group clients set { + community delete 64536:* + ext-community delete rt 64536:* + large-community delete 999:64536:* + +} +match to group clients set { + community delete 65522:65522 + ext-community delete rt 65522:65522 + large-community delete 999:65522:65522 + +} +match to group clients set { + community delete 65522:* + ext-community delete rt 65522:* + large-community delete 999:65522:* + +} +match to group clients set { + community delete 64538:* + ext-community delete rt 64538:* + large-community delete 999:64538:* + +} +match to group clients set { + community delete 64535:* + ext-community delete rt 64535:* + large-community delete 999:64535:* + +} + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +include "/etc/bgpd/post-filters.local" + + diff --git a/tests/live_tests/scenarios/tag_reject_policy/configs/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd77p.conf b/tests/live_tests/scenarios/tag_reject_policy/configs/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd77p.conf new file mode 100644 index 00000000..c2cb47fc --- /dev/null +++ b/tests/live_tests/scenarios/tag_reject_policy/configs/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd77p.conf @@ -0,0 +1,7608 @@ +# built by ARouteServer +AS 999 +router-id 192.0.2.2 + +fib-update no +log updates + +nexthop qualify via default + +rde evaluate all + +INTCOMM_PREF_OK_ROA="soo 65535:1" +INTCOMM_ROUTE_OK_WL="soo 65535:2" +INTCOMM_PREF_OK_ARINDB="soo 65535:3" +INTCOMM_PREF_OK_REGISTROBRDB="soo 65535:12" + +INTCOMM_ORIGIN_OK="soo 65535:4" +INTCOMM_ORIGIN_KO="soo 65535:5" +INTCOMM_PREFIX_OK="soo 65535:6" +INTCOMM_PREFIX_KO="soo 65535:7" +INTCOMM_IRR_REJECT="soo 65535:8" + +INTCOMM_RPKI_UNKNOWN="soo 65535:9" +INTCOMM_RPKI_INVALID="soo 65535:10" +INTCOMM_RPKI_VALID="soo 65535:11" + +INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" + +INTCOMM_NO_EXPORT="soo 65535:65281" +INTCOMM_NO_ADVERTISE="soo 65535:65282" + +# --------------------------------------------------------- +# IRRDB + +# AS222, used by client AS222_1, client AS222_2 +# no origin ASNs found for AS222 +# no prefixes found for AS222 + +# AS2, used by client AS2_1, client AS2_2 +# no origin ASNs found for AS2 +# no prefixes found for AS2 + +# AS-AS1, AS-AS1_CUSTOMERS, used by client AS1_1, client AS1_2, client AS1_3, client AS1_4 +as-set "AS_SET_AS_AS1_AS_AS1_CUSTOMERS_asns" { + 1 101 +} +prefix-set "AS_SET_AS_AS1_AS_AS1_CUSTOMERS_prefixes" { + 2a01::/32 prefixlen 32 - 128 + 2a99::/16 prefixlen 16 - 128 + 3101::/32 prefixlen 32 - 128 +} + +# AS-AS2, AS-AS2_CUSTOMERS, used by client AS2_1, client AS2_2 +as-set "AS_SET_AS_AS2_AS_AS2_CUSTOMERS_asns" { + 2 101 +} +prefix-set "AS_SET_AS_AS2_AS_AS2_CUSTOMERS_prefixes" { + 2a02::/32 prefixlen 32 - 128 + 3101::/32 prefixlen 32 - 128 +} + +# WHITE_LIST_AS1_2, used by client AS1_2 white list +as-set "AS_SET_WHITE_LIST_AS1_2_asns" { + 1011 +} +prefix-set "AS_SET_WHITE_LIST_AS1_2_prefixes" { + 11.1.0.0/16 prefixlen 16 - 32 + 2a11:1::/32 prefixlen 32 - 128 +} + +# AS-AS222, used by client AS222_1, client AS222_2 +# no origin ASNs found for AS_AS222 +# no prefixes found for AS_AS222 + +# AS1, used by client AS1_1, client AS1_2, client AS1_3, client AS1_4 +# no origin ASNs found for AS1 +# no prefixes found for AS1 + +# WHITE_LIST_AS1_1, used by client AS1_1 white list +as-set "AS_SET_WHITE_LIST_AS1_1_asns" { + 1011 +} +prefix-set "AS_SET_WHITE_LIST_AS1_1_prefixes" { + 11.1.0.0/16 prefixlen 16 - 32 + 2a11:1::/32 prefixlen 32 - 128 +} + + + + +# --------------------------------------------------------- +# MEMBERS + +group "clients" { + + neighbor 192.0.2.11 { + remote-as 1 + + rde evaluate all + + descr "AS1_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::11 { + remote-as 1 + + rde evaluate all + + descr "AS1_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.12 { + remote-as 1 + + rde evaluate all + + descr "AS1_2 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::12 { + remote-as 1 + + rde evaluate all + + descr "AS1_2 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.222 { + remote-as 222 + + rde evaluate all + + descr "AS222_1 client" + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::222 { + remote-as 222 + + rde evaluate all + + descr "AS222_1 client" + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.21 { + remote-as 2 + + rde evaluate all + + descr "AS2_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::21 { + remote-as 2 + + rde evaluate all + + descr "AS2_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } + + neighbor 192.0.2.31 { + remote-as 3 + + rde evaluate all + + descr "AS3_1 client" + ttl-security no + transparent-as no + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::31 { + remote-as 3 + + rde evaluate all + + descr "AS3_1 client" + ttl-security no + transparent-as no + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + announce add-path send best plus 5 + + set nexthop no-modify + } + + neighbor 192.0.2.41 { + remote-as 4 + + rde evaluate all + + descr "AS4_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 none + announce IPv4 unicast + + set nexthop no-modify + } + + neighbor 2001:db8:1:1::41 { + remote-as 4 + + rde evaluate all + + descr "AS4_1 client" + passive + ttl-security no + transparent-as yes + enforce neighbor-as no + + announce as-4byte yes + announce IPv6 unicast + announce IPv4 none + + set nexthop no-modify + } +} + +include "/etc/bgpd/post-clients.local" + + + +# --------------------------------------------------------- +# FILTERS + +# NO_ADVERTISE usage notes. +# The NO_ADVERTISE well-know community is used here to handle +# filters that span over multiple steps. At first it is added +# to any route, then it is removed as filters conditions are +# satisfied. Finally, if it is still present, it means that +# the route should be discarded. + + + + +prefix-set "global_black_list_pref" { + 192.0.2.0/24 prefixlen 24 - 32 + 2001:db8::/32 prefixlen 32 - 128 + +} + +prefix-set "bogons" { + 0.0.0.0/0 + 0.0.0.0/8 prefixlen 8 - 32 + 10.0.0.0/8 prefixlen 8 - 32 + 127.0.0.0/8 prefixlen 8 - 32 + 169.254.0.0/16 prefixlen 16 - 32 + 172.16.0.0/12 prefixlen 12 - 32 + 192.0.2.0/24 prefixlen 24 - 32 + 192.88.99.0/24 prefixlen 24 - 32 + 192.168.0.0/16 prefixlen 16 - 32 + 198.18.0.0/15 prefixlen 15 - 32 + 198.51.100.0/24 prefixlen 24 - 32 + 203.0.113.0/24 prefixlen 24 - 32 + 224.0.0.0/3 prefixlen 3 - 32 + 100.64.0.0/10 prefixlen 10 - 32 + ::/0 + ::/8 prefixlen 8 - 128 + 64:ff9b::/96 prefixlen 96 - 128 + 100::/8 prefixlen 8 - 128 + 200::/7 prefixlen 7 - 128 + 400::/6 prefixlen 6 - 128 + 800::/5 prefixlen 5 - 128 + 1000::/4 prefixlen 4 - 128 + 2001::/33 prefixlen 33 - 128 + 2001:0:8000::/33 prefixlen 33 - 128 + 2001:2::/48 prefixlen 48 - 128 + 2001:3::/32 prefixlen 32 - 128 + 2001:10::/28 prefixlen 28 - 128 + 2001:20::/28 prefixlen 28 - 128 + 2001:db8::/32 prefixlen 32 - 128 + 2002::/16 prefixlen 16 - 128 + 3ffe::/16 prefixlen 16 - 128 + 4000::/3 prefixlen 3 - 128 + 5f00::/8 prefixlen 8 - 128 + 6000::/3 prefixlen 3 - 128 + 8000::/3 prefixlen 3 - 128 + a000::/3 prefixlen 3 - 128 + c000::/3 prefixlen 3 - 128 + e000::/4 prefixlen 4 - 128 + f000::/5 prefixlen 5 - 128 + f800::/6 prefixlen 6 - 128 + fc00::/7 prefixlen 7 - 128 + fe80::/10 prefixlen 10 - 128 + fec0::/10 prefixlen 10 - 128 + ff00::/8 prefixlen 8 - 128 + +} + +# never via route-servers ASNs +as-set "neverviarouteserver" { + 666, 777 +} + +# ===================================================================================== +# Global rules. + +# This part of configuration is processed at the beginning of the filters. +# The rules defined in this part are applied to all the clients, and not on a +# client-by-client basis (see the 'match from group clients'), so only global policies +# can be implemented here, that is no client-level configuration are allowed. + + + +# Scrub communities from inbound routes +# origin_not_present_in_as_set +match from group clients set community delete 65530:0 +match from group clients set large-community delete 999:65530:0 + +# origin_present_in_as_set +match from group clients set community delete 65530:1 +match from group clients set large-community delete 999:65530:1 + +# prefix_validated_via_arin_whois_db_dump +match from group clients set community delete 65530:3 +match from group clients set large-community delete 999:65530:3 + +# prefix_validated_via_rpki_roas +match from group clients set community delete 65530:2 +match from group clients set large-community delete 999:65530:2 + +# reject_cause +match from group clients set community delete 65520:* + +# reject_cause_map_6 +match from group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match from group clients set ext-community delete rt 65520:* + +# rpki_bgp_origin_validation_not_performed +match from group clients set community delete 65530:4 +match from group clients set large-community delete 999:65530:4 + + +# Scrub internal communities from inbound routes +match from group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +# The main goal of this block is to enrich routes received from clients by attaching to them +# internal informational communities which are used later by the rest of the filter rules. + +# Internal communities used for RFC1997 well-known communities handling + +# Transform NO_EXPORT into $INTCOMM_NO_EXPORT +match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } + +# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE +match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } + + +# --------------------------------------------------------- +# ROAs source + + +roa-set { + 101.3.0.0/16 maxlen 24 source-as 105 expires 4102444799 + 101.2.0.0/17 source-as 101 expires 4102444799 + 101.2.128.0/17 maxlen 24 source-as 101 expires 4102444799 + 101.0.128.0/20 maxlen 23 source-as 101 expires 4102444799 + 101.0.8.0/24 source-as 101 expires 4102444799 + 101.0.9.0/24 source-as 102 expires 4102444799 + 222.1.1.0/24 source-as 333 expires 4102444799 + 3101:3::/32 maxlen 48 source-as 105 expires 4102444799 + 3101:0:8000::/33 maxlen 34 source-as 101 expires 4102444799 + 3101:2:8000::/33 maxlen 48 source-as 101 expires 4102444799 + 3101:2::/33 source-as 101 expires 4102444799 + 3101:0:8::/48 source-as 101 expires 4102444799 + 3101:0:9::/48 source-as 102 expires 4102444799 + 3222:0:1::/48 source-as 333 expires 4102444799 + +} + + + +# --------------------------------------------------------- +# RPKI-based Origin Validation + + +# Add $INTCOMM_RPKI_UNKNOWN, $INTCOMM_RPKI_INVALID and $INTCOMM_RPKI_VALID +# ext community on the basis of ovs. +match from group clients ovs not-found set { + ext-community $INTCOMM_RPKI_UNKNOWN + ext-community ovs not-found + +} +match from group clients ovs valid set { + ext-community $INTCOMM_RPKI_VALID + ext-community ovs valid + +} +match from group clients ovs invalid set { + ext-community $INTCOMM_RPKI_INVALID + ext-community ovs invalid + +} + + + +# --------------------------------------------------------- +# RPKI ROAs used as route objects. + +# Add the $INTCOMM_PREF_OK_ROA ext community to routes whose +# origin ASN has a ROA for the announced prefix. +# It will be used later during IRRDB validation in +# case the origin ASN is authorized by a client's +# AS-SET but the prefix is not. + +# Since RPKI-based Origin Validation is already performed above, +# use the origin validation state to identify valid routes. +match from group clients ovs valid set ext-community $INTCOMM_PREF_OK_ROA + + + + + + +# Set the 'rejected_route_announced_by' community for all the clients. +# It will be removed later if the route is not invalid +match from 192.0.2.11 set ext-community rt 65520:1 + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + +match from 192.0.2.12 set ext-community rt 65520:1 + +match from 2001:db8:1:1::12 set ext-community rt 65520:1 + +match from 192.0.2.222 set ext-community rt 65520:222 + +match from 2001:db8:1:1::222 set ext-community rt 65520:222 + +match from 192.0.2.21 set ext-community rt 65520:2 + +match from 2001:db8:1:1::21 set ext-community rt 65520:2 + +match from 192.0.2.31 set ext-community rt 65520:3 + +match from 2001:db8:1:1::31 set ext-community rt 65520:3 + +match from 192.0.2.41 set ext-community rt 65520:4 + +match from 2001:db8:1:1::41 set ext-community rt 65520:4 + + + + +# AS_PATH: length +# Reject inbound routes when 'from group clients max-as-len 6' - reject code: 1 +allow quick from group clients max-as-len 6 set { + localpref 1 + community 65520:0 + community 65520:1 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: global blacklist +# Reject inbound routes when 'from group clients prefix-set global_black_list_pref' - reject code: 3 +allow quick from group clients prefix-set global_black_list_pref set { + localpref 1 + community 65520:0 + community 65520:3 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: only IPv6 Global Unicast space allowed +match from group clients inet6 set community NO_ADVERTISE +match from group clients prefix 2000::/3 or-longer set community delete NO_ADVERTISE +# Reject inbound routes when 'from group clients community NO_ADVERTISE' - reject code: 10 +allow quick from group clients community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:10 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: bogon +# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 +allow quick from group clients prefix-set bogons set { + localpref 1 + community 65520:0 + community 65520:2 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# ===================================================================================== +# Per client rules. + + +# --------------------------------------------- +# client AS1_1, inbound + + + +# NEXT_HOP +match from 192.0.2.11 set community NO_ADVERTISE +match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 +allow quick from 192.0.2.11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.11 AS { 3, 174 }' - reject code: 8 +allow quick from 192.0.2.11 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.11 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.11 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 192.0.2.11 prefix 11.3.0.0/16 source-as 1011 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.11 prefix 11.4.0.0/16 prefixlen 16 - 32 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.11 prefix 2a11:3::/32 source-as 1011 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.11 prefix 2a11:4::/32 prefixlen 32 - 128 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 192.0.2.11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_1, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.11 source-as as-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. +match from 192.0.2.11 source-as as-set AS_SET_WHITE_LIST_AS1_1_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS1_1 + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_1, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.11 prefix-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. +match from 192.0.2.11 prefix-set AS_SET_WHITE_LIST_AS1_1_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS1_1 + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + +# route authorized by a client's white list? +match from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 192.0.2.11 set ext-community delete rt 65520:1 + + +# Remove internal communities before accepting the route +match from 192.0.2.11 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.11 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.11 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.11 community BLACKHOLE set community 65530:4 +match from 192.0.2.11 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.11 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.11 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.11 community BLACKHOLE +allow quick from 192.0.2.11 community 65534:0 +allow quick from 192.0.2.11 large-community 65534:0:0 + + +match from 192.0.2.11 set ext-community rt 65520:1 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.11 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 192.0.2.11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.11 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.11 + + + +# --------------------------------------------- +# client AS1_1, outbound + +deny quick to 192.0.2.11 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 192.0.2.11 community 65534:0 set community BLACKHOLE +match to 192.0.2.11 large-community 65534:0:0 set community BLACKHOLE + +match to 192.0.2.11 community BLACKHOLE set community NO_EXPORT +match to 192.0.2.11 community BLACKHOLE set nexthop 192.0.2.66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.11 community 65507:999 set community NO_EXPORT +match to 192.0.2.11 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.11 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.11 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.11 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.11 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.11 community 65509:1 set community NO_EXPORT +match to 192.0.2.11 ext-community rt 65509:1 set community NO_EXPORT +match to 192.0.2.11 large-community 999:65509:1 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.11 community 65510:1 set community NO_ADVERTISE +match to 192.0.2.11 ext-community rt 65510:1 set community NO_ADVERTISE +match to 192.0.2.11 large-community 999:65510:1 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.11 + +# do_not_announce_to_any +deny to 192.0.2.11 community 0:999 +deny to 192.0.2.11 ext-community rt 0:999 +deny to 192.0.2.11 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.11 community 0:1 +deny quick to 192.0.2.11 ext-community rt 0:1 +deny quick to 192.0.2.11 large-community 999:0:1 + +# announce_to_peer +allow to 192.0.2.11 community 65501:1 +allow to 192.0.2.11 ext-community rt 65501:1 +allow to 192.0.2.11 large-community 999:65501:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS1_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::11 set community NO_ADVERTISE +match from 2001:db8:1:1::11 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::11 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::11 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::11 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::11 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::11 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS { 3, 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::11 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::11 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::11 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 2001:db8:1:1::11 prefix 11.3.0.0/16 source-as 1011 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::11 prefix 11.4.0.0/16 prefixlen 16 - 32 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::11 prefix 2a11:3::/32 source-as 1011 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::11 prefix 2a11:4::/32 prefixlen 32 - 128 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 2001:db8:1:1::11 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_2, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::11 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::11 source-as as-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS1_AS_AS1_CUSTOMERS +match from 2001:db8:1:1::11 source-as as-set AS_SET_WHITE_LIST_AS1_2_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # WHITE_LIST_AS1_2 +# AS-SET AS1 referenced but empty. + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_2, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::11 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::11 prefix-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS1_AS_AS1_CUSTOMERS +match from 2001:db8:1:1::11 prefix-set AS_SET_WHITE_LIST_AS1_2_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # WHITE_LIST_AS1_2 +# AS-SET AS1 referenced but empty. + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + +# route authorized by a client's white list? +match from 2001:db8:1:1::11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::11 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::11 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::11 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::11 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::11 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::11 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::11 community BLACKHOLE +allow quick from 2001:db8:1:1::11 community 65534:0 +allow quick from 2001:db8:1:1::11 large-community 65534:0:0 + + +match from 2001:db8:1:1::11 set ext-community rt 65520:1 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::11 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::11 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::11 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::11 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::11 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::11 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::11 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::11 + + + +# --------------------------------------------- +# client AS1_2, outbound + +deny quick to 2001:db8:1:1::11 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 2001:db8:1:1::11 community 65534:0 set community BLACKHOLE +match to 2001:db8:1:1::11 large-community 65534:0:0 set community BLACKHOLE + +match to 2001:db8:1:1::11 community BLACKHOLE set community NO_EXPORT +match to 2001:db8:1:1::11 community BLACKHOLE set nexthop 2001:db8:1:1::66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::11 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::11 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::11 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::11 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::11 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::11 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::11 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::11 community 65509:1 set community NO_EXPORT +match to 2001:db8:1:1::11 ext-community rt 65509:1 set community NO_EXPORT +match to 2001:db8:1:1::11 large-community 999:65509:1 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::11 community 65510:1 set community NO_ADVERTISE +match to 2001:db8:1:1::11 ext-community rt 65510:1 set community NO_ADVERTISE +match to 2001:db8:1:1::11 large-community 999:65510:1 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::11 + +# do_not_announce_to_any +deny to 2001:db8:1:1::11 community 0:999 +deny to 2001:db8:1:1::11 ext-community rt 0:999 +deny to 2001:db8:1:1::11 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::11 community 0:1 +deny quick to 2001:db8:1:1::11 ext-community rt 0:1 +deny quick to 2001:db8:1:1::11 large-community 999:0:1 + +# announce_to_peer +allow to 2001:db8:1:1::11 community 65501:1 +allow to 2001:db8:1:1::11 ext-community rt 65501:1 +allow to 2001:db8:1:1::11 large-community 999:65501:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS1_3, inbound + + + +# NEXT_HOP +match from 192.0.2.12 set community NO_ADVERTISE +match from 192.0.2.12 nexthop 192.0.2.11 set community delete NO_ADVERTISE +match from 192.0.2.12 nexthop 192.0.2.12 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.12 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.12 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.12 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.12 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.12 AS 23456' - reject code: 7 +allow quick from 192.0.2.12 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.12 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.12 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.12 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.12 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.12 AS { 3, 174 }' - reject code: 8 +allow quick from 192.0.2.12 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.12 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.12 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +match from 192.0.2.12 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_3, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.12 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.12 source-as as-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_3, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.12 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 192.0.2.12 prefix-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.12 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 192.0.2.12 set ext-community delete rt 65520:1 + + +# Remove internal communities before accepting the route +match from 192.0.2.12 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.12 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.12 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.12 community BLACKHOLE set community 65530:4 +match from 192.0.2.12 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.12 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.12 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.12 community BLACKHOLE +allow quick from 192.0.2.12 community 65534:0 +allow quick from 192.0.2.12 large-community 65534:0:0 + + +match from 192.0.2.12 set ext-community rt 65520:1 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.12 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.12 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.12 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.12 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.12 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 192.0.2.12 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.12 set ext-community delete rt 65520:1 + + + +allow quick from 192.0.2.12 + + + +# --------------------------------------------- +# client AS1_3, outbound + +deny quick to 192.0.2.12 community 65520:0 + + + +# Blackhole request? +# Client not enabled to receive blackhole routes +deny quick to 192.0.2.12 community BLACKHOLE +deny quick to 192.0.2.12 community 65534:0 +deny quick to 192.0.2.12 large-community 65534:0:0 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.12 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.12 community 65507:999 set community NO_EXPORT +match to 192.0.2.12 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.12 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.12 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.12 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.12 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.12 community 65509:1 set community NO_EXPORT +match to 192.0.2.12 ext-community rt 65509:1 set community NO_EXPORT +match to 192.0.2.12 large-community 999:65509:1 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.12 community 65510:1 set community NO_ADVERTISE +match to 192.0.2.12 ext-community rt 65510:1 set community NO_ADVERTISE +match to 192.0.2.12 large-community 999:65510:1 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.12 + +# do_not_announce_to_any +deny to 192.0.2.12 community 0:999 +deny to 192.0.2.12 ext-community rt 0:999 +deny to 192.0.2.12 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.12 community 0:1 +deny quick to 192.0.2.12 ext-community rt 0:1 +deny quick to 192.0.2.12 large-community 999:0:1 + +# announce_to_peer +allow to 192.0.2.12 community 65501:1 +allow to 192.0.2.12 ext-community rt 65501:1 +allow to 192.0.2.12 large-community 999:65501:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.12 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS1_4, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::12 set community NO_ADVERTISE +match from 2001:db8:1:1::12 nexthop 2001:db8:1:1::11 set community delete NO_ADVERTISE +match from 2001:db8:1:1::12 nexthop 2001:db8:1:1::12 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::12 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::12 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::12 peer-as != 1' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::12 peer-as != 1 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::12 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::12 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::12 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::12 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::12 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::12 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::12 AS { 3, 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::12 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::12 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::12 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +match from 2001:db8:1:1::12 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS1_4, AS1: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::12 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::12 source-as as-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS1_4, AS1: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::12 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +match from 2001:db8:1:1::12 prefix-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS1_AS_AS1_CUSTOMERS +# AS-SET AS1 referenced but empty. + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::12 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::12 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 2001:db8:1:1::12 set ext-community delete rt 65520:1 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::12 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::12 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::12 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::12 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::12 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::12 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::12 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::12 community BLACKHOLE +allow quick from 2001:db8:1:1::12 community 65534:0 +allow quick from 2001:db8:1:1::12 large-community 65534:0:0 + + +match from 2001:db8:1:1::12 set ext-community rt 65520:1 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::12 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::12 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::12 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::12 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::12 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::12 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::12 set ext-community delete rt 65520:1 + + + +allow quick from 2001:db8:1:1::12 + + + +# --------------------------------------------- +# client AS1_4, outbound + +deny quick to 2001:db8:1:1::12 community 65520:0 + + + +# Blackhole request? +# Client not enabled to receive blackhole routes +deny quick to 2001:db8:1:1::12 community BLACKHOLE +deny quick to 2001:db8:1:1::12 community 65534:0 +deny quick to 2001:db8:1:1::12 large-community 65534:0:0 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::12 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::12 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::12 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::12 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::12 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::12 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::12 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::12 community 65509:1 set community NO_EXPORT +match to 2001:db8:1:1::12 ext-community rt 65509:1 set community NO_EXPORT +match to 2001:db8:1:1::12 large-community 999:65509:1 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::12 community 65510:1 set community NO_ADVERTISE +match to 2001:db8:1:1::12 ext-community rt 65510:1 set community NO_ADVERTISE +match to 2001:db8:1:1::12 large-community 999:65510:1 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::12 + +# do_not_announce_to_any +deny to 2001:db8:1:1::12 community 0:999 +deny to 2001:db8:1:1::12 ext-community rt 0:999 +deny to 2001:db8:1:1::12 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::12 community 0:1 +deny quick to 2001:db8:1:1::12 ext-community rt 0:1 +deny quick to 2001:db8:1:1::12 large-community 999:0:1 + +# announce_to_peer +allow to 2001:db8:1:1::12 community 65501:1 +allow to 2001:db8:1:1::12 ext-community rt 65501:1 +allow to 2001:db8:1:1::12 large-community 999:65501:1 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::12 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:1 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:1 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:1 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::12 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS222_1, inbound + + + +# NEXT_HOP +match from 192.0.2.222 set community NO_ADVERTISE +match from 192.0.2.222 nexthop 192.0.2.222 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.222 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.222 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.222 peer-as != 222' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.222 peer-as != 222 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.222 AS 23456' - reject code: 7 +allow quick from 192.0.2.222 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.222 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.222 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.222 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.222 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.222 AS { 3, 174 }' - reject code: 8 +allow quick from 192.0.2.222 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.222 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.222 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 192.0.2.222 prefix 222.1.1.0/24 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 192.0.2.222 prefix 3222:0:1::/48 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 192.0.2.222 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS222_1, AS222: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.222 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS222 referenced but empty. +# AS-SET AS_AS222 referenced but empty. + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS222_1, AS222: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.222 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS222 referenced but empty. +# AS-SET AS_AS222 referenced but empty. + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.222 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + +# route authorized by a client's white list? +match from 192.0.2.222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 192.0.2.222 set ext-community delete rt 65520:222 + + +# Remove internal communities before accepting the route +match from 192.0.2.222 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.222 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.222 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.222 community BLACKHOLE set community 65530:4 +match from 192.0.2.222 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.222 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.222 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.222 community BLACKHOLE +allow quick from 192.0.2.222 community 65534:0 +allow quick from 192.0.2.222 large-community 65534:0:0 + + +match from 192.0.2.222 set ext-community rt 65520:222 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.222 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.222 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.222 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.222 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.222 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 192.0.2.222 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.222 set ext-community delete rt 65520:222 + + + +allow quick from 192.0.2.222 + + + +# --------------------------------------------- +# client AS222_1, outbound + +deny quick to 192.0.2.222 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 192.0.2.222 community 65534:0 set community BLACKHOLE +match to 192.0.2.222 large-community 65534:0:0 set community BLACKHOLE + +match to 192.0.2.222 community BLACKHOLE set community NO_EXPORT +match to 192.0.2.222 community BLACKHOLE set nexthop 192.0.2.66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.222 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.222 community 65507:999 set community NO_EXPORT +match to 192.0.2.222 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.222 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.222 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.222 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.222 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.222 community 65509:222 set community NO_EXPORT +match to 192.0.2.222 ext-community rt 65509:222 set community NO_EXPORT +match to 192.0.2.222 large-community 999:65509:222 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.222 community 65510:222 set community NO_ADVERTISE +match to 192.0.2.222 ext-community rt 65510:222 set community NO_ADVERTISE +match to 192.0.2.222 large-community 999:65510:222 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.222 + +# do_not_announce_to_any +deny to 192.0.2.222 community 0:999 +deny to 192.0.2.222 ext-community rt 0:999 +deny to 192.0.2.222 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.222 community 0:222 +deny quick to 192.0.2.222 ext-community rt 0:222 +deny quick to 192.0.2.222 large-community 999:0:222 + +# announce_to_peer +allow to 192.0.2.222 community 65501:222 +allow to 192.0.2.222 ext-community rt 65501:222 +allow to 192.0.2.222 large-community 999:65501:222 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.222 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS222_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::222 set community NO_ADVERTISE +match from 2001:db8:1:1::222 nexthop 2001:db8:1:1::222 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::222 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::222 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::222 peer-as != 222' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::222 peer-as != 222 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::222 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::222 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::222 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::222 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::222 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::222 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::222 AS { 3, 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::222 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::222 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::222 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# client's white list +# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which +# are validated by a client's white list entry. +# It will be used later during IRRDB validation in +# case the route is not authorized by a client's +# AS-SET. +match from 2001:db8:1:1::222 prefix 222.1.1.0/24 set ext-community $INTCOMM_ROUTE_OK_WL # None +match from 2001:db8:1:1::222 prefix 3222:0:1::/48 set ext-community $INTCOMM_ROUTE_OK_WL # None + +match from 2001:db8:1:1::222 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS222_2, AS222: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::222 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS222 referenced but empty. +# AS-SET AS_AS222 referenced but empty. + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS222_2, AS222: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::222 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS222 referenced but empty. +# AS-SET AS_AS222 referenced but empty. + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::222 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + +# route authorized by a client's white list? +match from 2001:db8:1:1::222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::222 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 2001:db8:1:1::222 set ext-community delete rt 65520:222 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::222 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::222 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::222 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::222 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::222 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::222 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::222 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::222 community BLACKHOLE +allow quick from 2001:db8:1:1::222 community 65534:0 +allow quick from 2001:db8:1:1::222 large-community 65534:0:0 + + +match from 2001:db8:1:1::222 set ext-community rt 65520:222 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::222 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::222 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::222 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::222 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::222 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::222 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::222 set ext-community delete rt 65520:222 + + + +allow quick from 2001:db8:1:1::222 + + + +# --------------------------------------------- +# client AS222_2, outbound + +deny quick to 2001:db8:1:1::222 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 2001:db8:1:1::222 community 65534:0 set community BLACKHOLE +match to 2001:db8:1:1::222 large-community 65534:0:0 set community BLACKHOLE + +match to 2001:db8:1:1::222 community BLACKHOLE set community NO_EXPORT +match to 2001:db8:1:1::222 community BLACKHOLE set nexthop 2001:db8:1:1::66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::222 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::222 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::222 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::222 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::222 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::222 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::222 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::222 community 65509:222 set community NO_EXPORT +match to 2001:db8:1:1::222 ext-community rt 65509:222 set community NO_EXPORT +match to 2001:db8:1:1::222 large-community 999:65509:222 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::222 community 65510:222 set community NO_ADVERTISE +match to 2001:db8:1:1::222 ext-community rt 65510:222 set community NO_ADVERTISE +match to 2001:db8:1:1::222 large-community 999:65510:222 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::222 + +# do_not_announce_to_any +deny to 2001:db8:1:1::222 community 0:999 +deny to 2001:db8:1:1::222 ext-community rt 0:999 +deny to 2001:db8:1:1::222 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::222 community 0:222 +deny quick to 2001:db8:1:1::222 ext-community rt 0:222 +deny quick to 2001:db8:1:1::222 large-community 999:0:222 + +# announce_to_peer +allow to 2001:db8:1:1::222 community 65501:222 +allow to 2001:db8:1:1::222 ext-community rt 65501:222 +allow to 2001:db8:1:1::222 large-community 999:65501:222 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::222 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:222 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:222 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS222; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:222 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::222 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS2_1, inbound + + + +# NEXT_HOP +match from 192.0.2.21 set community NO_ADVERTISE +match from 192.0.2.21 nexthop 192.0.2.21 set community delete NO_ADVERTISE +match from 192.0.2.21 nexthop 192.0.2.22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.21 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.21 AS 23456' - reject code: 7 +allow quick from 192.0.2.21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.21 AS { 3, 174 }' - reject code: 8 +allow quick from 192.0.2.21 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.21 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.21 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +match from 192.0.2.21 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS2_1, AS2: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.21 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 192.0.2.21 source-as as-set AS_SET_AS_AS2_AS_AS2_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS2_AS_AS2_CUSTOMERS + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS2_1, AS2: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 192.0.2.21 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 192.0.2.21 prefix-set AS_SET_AS_AS2_AS_AS2_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS2_AS_AS2_CUSTOMERS + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + + +# enforcing: origin ASN +# Reject inbound routes when 'from 192.0.2.21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 192.0.2.21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 192.0.2.21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 192.0.2.21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 192.0.2.21 set ext-community delete rt 65520:2 + + +# Remove internal communities before accepting the route +match from 192.0.2.21 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.21 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.21 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.21 community BLACKHOLE set community 65530:4 +match from 192.0.2.21 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.21 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.21 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.21 community BLACKHOLE +allow quick from 192.0.2.21 community 65534:0 +allow quick from 192.0.2.21 large-community 65534:0:0 + + +match from 192.0.2.21 set ext-community rt 65520:2 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.21 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.21 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.21 community GRACEFUL_SHUTDOWN set community delete GRACEFUL_SHUTDOWN + +# Remove internal communities before accepting the route +match from 192.0.2.21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.21 set ext-community delete rt 65520:2 + + + +allow quick from 192.0.2.21 + + + +# --------------------------------------------- +# client AS2_1, outbound + +deny quick to 192.0.2.21 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 192.0.2.21 community 65534:0 set community BLACKHOLE +match to 192.0.2.21 large-community 65534:0:0 set community BLACKHOLE + +match to 192.0.2.21 community BLACKHOLE set community NO_EXPORT +match to 192.0.2.21 community BLACKHOLE set nexthop 192.0.2.66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.21 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.21 community 65507:999 set community NO_EXPORT +match to 192.0.2.21 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.21 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.21 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.21 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.21 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.21 community 65509:2 set community NO_EXPORT +match to 192.0.2.21 ext-community rt 65509:2 set community NO_EXPORT +match to 192.0.2.21 large-community 999:65509:2 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.21 community 65510:2 set community NO_ADVERTISE +match to 192.0.2.21 ext-community rt 65510:2 set community NO_ADVERTISE +match to 192.0.2.21 large-community 999:65510:2 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.21 + +# do_not_announce_to_any +deny to 192.0.2.21 community 0:999 +deny to 192.0.2.21 ext-community rt 0:999 +deny to 192.0.2.21 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.21 community 0:2 +deny quick to 192.0.2.21 ext-community rt 0:2 +deny quick to 192.0.2.21 large-community 999:0:2 + +# announce_to_peer +allow to 192.0.2.21 community 65501:2 +allow to 192.0.2.21 ext-community rt 65501:2 +allow to 192.0.2.21 large-community 999:65501:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS2_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::21 set community NO_ADVERTISE +match from 2001:db8:1:1::21 nexthop 2001:db8:1:1::21 set community delete NO_ADVERTISE +match from 2001:db8:1:1::21 nexthop 2001:db8:1:1::22 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::21 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::21 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::21 peer-as != 2' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::21 peer-as != 2 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::21 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::21 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS { 3, 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::21 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::21 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::21 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + +match from 2001:db8:1:1::21 set ext-community $INTCOMM_IRR_REJECT + +# AS_PATH: check origin via AS-SET +# IRRDB filters for AS2_2, AS2: asns +# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::21 set ext-community $INTCOMM_ORIGIN_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 2001:db8:1:1::21 source-as as-set AS_SET_AS_AS2_AS_AS2_CUSTOMERS_asns set { + ext-community delete $INTCOMM_ORIGIN_KO + ext-community $INTCOMM_ORIGIN_OK +} # AS_AS2_AS_AS2_CUSTOMERS + + +# Prefix: check prefix via AS-SET +# IRRDB filters for AS2_2, AS2: prefixes +# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object +match from 2001:db8:1:1::21 set ext-community $INTCOMM_PREFIX_KO +# verifying if object is authorized by AS-SETs +# AS-SET AS2 referenced but empty. +match from 2001:db8:1:1::21 prefix-set AS_SET_AS_AS2_AS_AS2_CUSTOMERS_prefixes set { + ext-community delete $INTCOMM_PREFIX_KO + ext-community $INTCOMM_PREFIX_OK +} # AS_AS2_AS_AS2_CUSTOMERS + + +# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) +match from 2001:db8:1:1::21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT + + + + +# enforcing: origin ASN +# Reject inbound routes when 'from 2001:db8:1:1::21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 +allow quick from 2001:db8:1:1::21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { + localpref 1 + community 65520:0 + community 65520:9 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# enforcing: prefix +# Reject inbound routes when 'from 2001:db8:1:1::21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 +allow quick from 2001:db8:1:1::21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { + localpref 1 + community 65520:0 + community 65520:12 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Blackhole request? +match from 2001:db8:1:1::21 set ext-community delete rt 65520:2 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::21 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::21 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::21 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::21 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::21 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::21 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::21 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::21 community BLACKHOLE +allow quick from 2001:db8:1:1::21 community 65534:0 +allow quick from 2001:db8:1:1::21 large-community 65534:0:0 + + +match from 2001:db8:1:1::21 set ext-community rt 65520:2 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::21 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::21 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::21 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::21 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::21 community GRACEFUL_SHUTDOWN set community delete GRACEFUL_SHUTDOWN + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::21 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::21 set ext-community delete rt 65520:2 + + + +allow quick from 2001:db8:1:1::21 + + + +# --------------------------------------------- +# client AS2_2, outbound + +deny quick to 2001:db8:1:1::21 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 2001:db8:1:1::21 community 65534:0 set community BLACKHOLE +match to 2001:db8:1:1::21 large-community 65534:0:0 set community BLACKHOLE + +match to 2001:db8:1:1::21 community BLACKHOLE set community NO_EXPORT +match to 2001:db8:1:1::21 community BLACKHOLE set nexthop 2001:db8:1:1::66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::21 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::21 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::21 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::21 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::21 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::21 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::21 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::21 community 65509:2 set community NO_EXPORT +match to 2001:db8:1:1::21 ext-community rt 65509:2 set community NO_EXPORT +match to 2001:db8:1:1::21 large-community 999:65509:2 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::21 community 65510:2 set community NO_ADVERTISE +match to 2001:db8:1:1::21 ext-community rt 65510:2 set community NO_ADVERTISE +match to 2001:db8:1:1::21 large-community 999:65510:2 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::21 + +# do_not_announce_to_any +deny to 2001:db8:1:1::21 community 0:999 +deny to 2001:db8:1:1::21 ext-community rt 0:999 +deny to 2001:db8:1:1::21 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::21 community 0:2 +deny quick to 2001:db8:1:1::21 ext-community rt 0:2 +deny quick to 2001:db8:1:1::21 large-community 999:0:2 + +# announce_to_peer +allow to 2001:db8:1:1::21 community 65501:2 +allow to 2001:db8:1:1::21 ext-community rt 65501:2 +allow to 2001:db8:1:1::21 large-community 999:65501:2 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:2 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:2 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:2 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS3_1, inbound + + + +# NEXT_HOP +match from 192.0.2.31 set community NO_ADVERTISE +match from 192.0.2.31 nexthop 192.0.2.31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.31 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.31 AS 23456' - reject code: 7 +allow quick from 192.0.2.31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.31 AS { 174 }' - reject code: 8 +allow quick from 192.0.2.31 AS { 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.31 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.31 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +# Prefix: client's blacklist +prefix-set "client_AS3_1_black_list_pref_ipv4" { + 3.0.1.0/24 prefixlen 24 - 32 + +} +# Reject inbound routes when 'from 192.0.2.31 prefix-set client_AS3_1_black_list_pref_ipv4' - reject code: 11 +allow quick from 192.0.2.31 prefix-set client_AS3_1_black_list_pref_ipv4 set { + localpref 1 + community 65520:0 + community 65520:11 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Blackhole request? +match from 192.0.2.31 set ext-community delete rt 65520:3 + + +# Remove internal communities before accepting the route +match from 192.0.2.31 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.31 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.31 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.31 community BLACKHOLE set community 65530:4 +match from 192.0.2.31 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.31 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.31 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.31 community BLACKHOLE +allow quick from 192.0.2.31 community 65534:0 +allow quick from 192.0.2.31 large-community 65534:0:0 + + +match from 192.0.2.31 set ext-community rt 65520:3 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.31 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.31 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.31 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 192.0.2.31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.31 set ext-community delete rt 65520:3 + + + +allow quick from 192.0.2.31 + + + +# --------------------------------------------- +# client AS3_1, outbound + +deny quick to 192.0.2.31 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 192.0.2.31 community 65534:0 set community BLACKHOLE +match to 192.0.2.31 large-community 65534:0:0 set community BLACKHOLE + +match to 192.0.2.31 community BLACKHOLE set community NO_EXPORT +match to 192.0.2.31 community BLACKHOLE set nexthop 192.0.2.66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.31 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.31 community 65507:999 set community NO_EXPORT +match to 192.0.2.31 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.31 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.31 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.31 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.31 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.31 community 65509:3 set community NO_EXPORT +match to 192.0.2.31 ext-community rt 65509:3 set community NO_EXPORT +match to 192.0.2.31 large-community 999:65509:3 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.31 community 65510:3 set community NO_ADVERTISE +match to 192.0.2.31 ext-community rt 65510:3 set community NO_ADVERTISE +match to 192.0.2.31 large-community 999:65510:3 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.31 + +# do_not_announce_to_any +deny to 192.0.2.31 community 0:999 +deny to 192.0.2.31 ext-community rt 0:999 +deny to 192.0.2.31 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.31 community 0:3 +deny quick to 192.0.2.31 ext-community rt 0:3 +deny quick to 192.0.2.31 large-community 999:0:3 + +# announce_to_peer +allow to 192.0.2.31 community 65501:3 +allow to 192.0.2.31 ext-community rt 65501:3 +allow to 192.0.2.31 large-community 999:65501:3 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS3_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::31 set community NO_ADVERTISE +match from 2001:db8:1:1::31 nexthop 2001:db8:1:1::31 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::31 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::31 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::31 peer-as != 3' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::31 peer-as != 3 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::31 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::31 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::31 AS { 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::31 AS { 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::31 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::31 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + +# Prefix: client's blacklist +prefix-set "client_AS3_2_black_list_pref_ipv6" { + 2a03:0:1::/48 prefixlen 48 - 128 + +} +# Reject inbound routes when 'from 2001:db8:1:1::31 prefix-set client_AS3_2_black_list_pref_ipv6' - reject code: 11 +allow quick from 2001:db8:1:1::31 prefix-set client_AS3_2_black_list_pref_ipv6 set { + localpref 1 + community 65520:0 + community 65520:11 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + +# Blackhole request? +match from 2001:db8:1:1::31 set ext-community delete rt 65520:3 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::31 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::31 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::31 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::31 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::31 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::31 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::31 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::31 community BLACKHOLE +allow quick from 2001:db8:1:1::31 community 65534:0 +allow quick from 2001:db8:1:1::31 large-community 65534:0:0 + + +match from 2001:db8:1:1::31 set ext-community rt 65520:3 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::31 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::31 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::31 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::31 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::31 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::31 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::31 set ext-community delete rt 65520:3 + + + +allow quick from 2001:db8:1:1::31 + + + +# --------------------------------------------- +# client AS3_2, outbound + +deny quick to 2001:db8:1:1::31 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 2001:db8:1:1::31 community 65534:0 set community BLACKHOLE +match to 2001:db8:1:1::31 large-community 65534:0:0 set community BLACKHOLE + +match to 2001:db8:1:1::31 community BLACKHOLE set community NO_EXPORT +match to 2001:db8:1:1::31 community BLACKHOLE set nexthop 2001:db8:1:1::66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::31 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::31 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::31 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::31 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::31 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::31 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::31 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::31 community 65509:3 set community NO_EXPORT +match to 2001:db8:1:1::31 ext-community rt 65509:3 set community NO_EXPORT +match to 2001:db8:1:1::31 large-community 999:65509:3 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::31 community 65510:3 set community NO_ADVERTISE +match to 2001:db8:1:1::31 ext-community rt 65510:3 set community NO_ADVERTISE +match to 2001:db8:1:1::31 large-community 999:65510:3 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::31 + +# do_not_announce_to_any +deny to 2001:db8:1:1::31 community 0:999 +deny to 2001:db8:1:1::31 ext-community rt 0:999 +deny to 2001:db8:1:1::31 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::31 community 0:3 +deny quick to 2001:db8:1:1::31 ext-community rt 0:3 +deny quick to 2001:db8:1:1::31 large-community 999:0:3 + +# announce_to_peer +allow to 2001:db8:1:1::31 community 65501:3 +allow to 2001:db8:1:1::31 ext-community rt 65501:3 +allow to 2001:db8:1:1::31 large-community 999:65501:3 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:3 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:3 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:3 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS4_1, inbound + + + +# NEXT_HOP +match from 192.0.2.41 set community NO_ADVERTISE +match from 192.0.2.41 nexthop 192.0.2.41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 192.0.2.41 community NO_ADVERTISE' - reject code: 5 +allow quick from 192.0.2.41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 192.0.2.41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 192.0.2.41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 192.0.2.41 AS 23456' - reject code: 7 +allow quick from 192.0.2.41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 64496 - 131071' - reject code: 7 +allow quick from 192.0.2.41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 192.0.2.41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 192.0.2.41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 192.0.2.41 AS { 3, 174 }' - reject code: 8 +allow quick from 192.0.2.41 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 192.0.2.41 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 192.0.2.41 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + +# Blackhole request? +match from 192.0.2.41 set ext-community delete rt 65520:4 + + +# Remove internal communities before accepting the route +match from 192.0.2.41 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.41 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 192.0.2.41 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 192.0.2.41 community BLACKHOLE set community 65530:4 +match from 192.0.2.41 community BLACKHOLE set large-community 999:65530:4 + +match from 192.0.2.41 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 192.0.2.41 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 192.0.2.41 community BLACKHOLE +allow quick from 192.0.2.41 community 65534:0 +allow quick from 192.0.2.41 large-community 65534:0:0 + + +match from 192.0.2.41 set ext-community rt 65520:4 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 192.0.2.41 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 192.0.2.41 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 +allow quick from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 192.0.2.41 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 192.0.2.41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 192.0.2.41 set ext-community delete rt 65520:4 + + + +allow quick from 192.0.2.41 + + + +# --------------------------------------------- +# client AS4_1, outbound + +deny quick to 192.0.2.41 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 192.0.2.41 community 65534:0 set community BLACKHOLE +match to 192.0.2.41 large-community 65534:0:0 set community BLACKHOLE + +match to 192.0.2.41 community BLACKHOLE set community NO_EXPORT +match to 192.0.2.41 community BLACKHOLE set nexthop 192.0.2.66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 192.0.2.41 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 192.0.2.41 community 65507:999 set community NO_EXPORT +match to 192.0.2.41 ext-community rt 65507:999 set community NO_EXPORT +match to 192.0.2.41 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 192.0.2.41 community 65508:999 set community NO_ADVERTISE +match to 192.0.2.41 ext-community rt 65508:999 set community NO_ADVERTISE +match to 192.0.2.41 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 192.0.2.41 community 65509:4 set community NO_EXPORT +match to 192.0.2.41 ext-community rt 65509:4 set community NO_EXPORT +match to 192.0.2.41 large-community 999:65509:4 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 192.0.2.41 community 65510:4 set community NO_ADVERTISE +match to 192.0.2.41 ext-community rt 65510:4 set community NO_ADVERTISE +match to 192.0.2.41 large-community 999:65510:4 set community NO_ADVERTISE + + +# BGP control communities +allow to 192.0.2.41 + +# do_not_announce_to_any +deny to 192.0.2.41 community 0:999 +deny to 192.0.2.41 ext-community rt 0:999 +deny to 192.0.2.41 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 192.0.2.41 community 0:4 +deny quick to 192.0.2.41 ext-community rt 0:4 +deny quick to 192.0.2.41 large-community 999:0:4 + +# announce_to_peer +allow to 192.0.2.41 community 65501:4 +allow to 192.0.2.41 ext-community rt 65501:4 +allow to 192.0.2.41 large-community 999:65501:4 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 192.0.2.41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# --------------------------------------------- +# client AS4_2, inbound + + + +# NEXT_HOP +match from 2001:db8:1:1::41 set community NO_ADVERTISE +match from 2001:db8:1:1::41 nexthop 2001:db8:1:1::41 set community delete NO_ADVERTISE +# Reject inbound routes when 'from 2001:db8:1:1::41 community NO_ADVERTISE' - reject code: 5 +allow quick from 2001:db8:1:1::41 community NO_ADVERTISE set { + localpref 1 + community 65520:0 + community 65520:5 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: left-most ASN +# Reject inbound routes when 'from 2001:db8:1:1::41 peer-as != 4' - reject code: 6 +# community from reject_cause_map +allow quick from 2001:db8:1:1::41 peer-as != 4 set { + localpref 1 + community 65520:0 + community 65520:6 + large-community 999:1101:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: invalid ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 23456' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 23456 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 64496 - 131071' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 64496 - 131071 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +# Reject inbound routes when 'from 2001:db8:1:1::41 AS 4200000000 - 4294967295' - reject code: 7 +allow quick from 2001:db8:1:1::41 AS 4200000000 - 4294967295 set { + localpref 1 + community 65520:0 + community 65520:7 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: transit-free ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS { 3, 174 }' - reject code: 8 +allow quick from 2001:db8:1:1::41 AS { 3, 174 } set { + localpref 1 + community 65520:0 + community 65520:8 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# AS_PATH: never via route-servers ASNs +# Reject inbound routes when 'from 2001:db8:1:1::41 AS as-set neverviarouteserver' - reject code: 15 +allow quick from 2001:db8:1:1::41 AS as-set neverviarouteserver set { + localpref 1 + community 65520:0 + community 65520:15 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + + + + + + + +# Blackhole request? +match from 2001:db8:1:1::41 set ext-community delete rt 65520:4 + + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::41 community BLACKHOLE set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::41 community 65534:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} +allow from 2001:db8:1:1::41 large-community 65534:0:0 set { + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Add the rpki_bgp_origin_validation_not_performed community +match from 2001:db8:1:1::41 community BLACKHOLE set community 65530:4 +match from 2001:db8:1:1::41 community BLACKHOLE set large-community 999:65530:4 + +match from 2001:db8:1:1::41 community 65534:0 set { community 65530:4 large-community 999:65530:4} +match from 2001:db8:1:1::41 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} + + +allow quick from 2001:db8:1:1::41 community BLACKHOLE +allow quick from 2001:db8:1:1::41 community 65534:0 +allow quick from 2001:db8:1:1::41 large-community 65534:0:0 + + +match from 2001:db8:1:1::41 set ext-community rt 65520:4 + + +# RPKI-based Origin Validation +# Reject inbound routes when 'from 2001:db8:1:1::41 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 +allow quick from 2001:db8:1:1::41 ext-community $INTCOMM_RPKI_INVALID set { + localpref 1 + community 65520:0 + community 65520:14 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Prefix: length +# Reject inbound routes when 'from 2001:db8:1:1::41 prefix ::/0 prefixlen 17 >< 48' - reject code: 13 +allow quick from 2001:db8:1:1::41 prefix ::/0 prefixlen 17 >< 48 set { + localpref 1 + community 65520:0 + community 65520:13 + community delete NO_ADVERTISE + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + + +# Graceful shutdown +match from 2001:db8:1:1::41 community GRACEFUL_SHUTDOWN set localpref 5 + +# Remove internal communities before accepting the route +match from 2001:db8:1:1::41 set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +match from 2001:db8:1:1::41 set ext-community delete rt 65520:4 + + + +allow quick from 2001:db8:1:1::41 + + + +# --------------------------------------------- +# client AS4_2, outbound + +deny quick to 2001:db8:1:1::41 community 65520:0 + + + +# Blackhole request? +# Configured policy: rewrite-next-hop +match to 2001:db8:1:1::41 community 65534:0 set community BLACKHOLE +match to 2001:db8:1:1::41 large-community 65534:0:0 set community BLACKHOLE + +match to 2001:db8:1:1::41 community BLACKHOLE set community NO_EXPORT +match to 2001:db8:1:1::41 community BLACKHOLE set nexthop 2001:db8:1:1::66 + + +# RPKI-based Origin Validation +# Do not announce INVALID to clients +deny quick to 2001:db8:1:1::41 ext-community $INTCOMM_RPKI_INVALID + +# NO_EXPORT and NO_ADVERTISE communities +# add_noexport_to_any +match to 2001:db8:1:1::41 community 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::41 ext-community rt 65507:999 set community NO_EXPORT +match to 2001:db8:1:1::41 large-community 999:65507:999 set community NO_EXPORT + +# add_noadvertise_to_any +match to 2001:db8:1:1::41 community 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::41 ext-community rt 65508:999 set community NO_ADVERTISE +match to 2001:db8:1:1::41 large-community 999:65508:999 set community NO_ADVERTISE + +# add_noexport_to_peer +match to 2001:db8:1:1::41 community 65509:4 set community NO_EXPORT +match to 2001:db8:1:1::41 ext-community rt 65509:4 set community NO_EXPORT +match to 2001:db8:1:1::41 large-community 999:65509:4 set community NO_EXPORT + +# add_noadvertise_to_peer +match to 2001:db8:1:1::41 community 65510:4 set community NO_ADVERTISE +match to 2001:db8:1:1::41 ext-community rt 65510:4 set community NO_ADVERTISE +match to 2001:db8:1:1::41 large-community 999:65510:4 set community NO_ADVERTISE + + +# BGP control communities +allow to 2001:db8:1:1::41 + +# do_not_announce_to_any +deny to 2001:db8:1:1::41 community 0:999 +deny to 2001:db8:1:1::41 ext-community rt 0:999 +deny to 2001:db8:1:1::41 large-community 999:0:999 + +# do_not_announce_to_peer +deny quick to 2001:db8:1:1::41 community 0:4 +deny quick to 2001:db8:1:1::41 ext-community rt 0:4 +deny quick to 2001:db8:1:1::41 large-community 999:0:4 + +# announce_to_peer +allow to 2001:db8:1:1::41 community 65501:4 +allow to 2001:db8:1:1::41 ext-community rt 65501:4 +allow to 2001:db8:1:1::41 large-community 999:65501:4 + + +# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities +# for prepending can be processed. As soon as one prepending action is performed, +# this internal community is removed, so that further actions are not processed. +match to 2001:db8:1:1::41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS + +# prepend_once_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:4 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:4 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:4 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + +# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { + prepend-neighbor 1 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { + prepend-neighbor 2 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + +# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} +match to 2001:db8:1:1::41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { + prepend-neighbor 3 + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS +} + + + + + +# Scrub communities from outbound routes +# add_noadvertise_to_any +match to group clients set community delete 65508:999 +match to group clients set ext-community delete rt 65508:999 +match to group clients set large-community delete 999:65508:999 + +# add_noadvertise_to_peer +match to group clients set community delete 65510:* +match to group clients set ext-community delete rt 65510:* +match to group clients set large-community delete 999:65510:* + +# add_noexport_to_any +match to group clients set community delete 65507:999 +match to group clients set ext-community delete rt 65507:999 +match to group clients set large-community delete 999:65507:999 + +# add_noexport_to_peer +match to group clients set community delete 65509:* +match to group clients set ext-community delete rt 65509:* +match to group clients set large-community delete 999:65509:* + +# announce_to_peer +match to group clients set community delete 65501:* +match to group clients set ext-community delete rt 65501:* +match to group clients set large-community delete 999:65501:* + +# announce_to_peers_with_rtt_higher_than +match to group clients set community delete 64533:* +match to group clients set ext-community delete rt 64533:* +match to group clients set large-community delete 999:64533:* + +# announce_to_peers_with_rtt_lower_than +match to group clients set community delete 64532:* +match to group clients set ext-community delete rt 64532:* +match to group clients set large-community delete 999:64532:* + +# blackholing +match to group clients set community delete 65534:0 +match to group clients set large-community delete 65534:0:0 + +# do_not_announce_to_any +match to group clients set community delete 0:999 +match to group clients set ext-community delete rt 0:999 +match to group clients set large-community delete 999:0:999 + +# do_not_announce_to_peer +match to group clients set community delete 0:* +match to group clients set ext-community delete rt 0:* +match to group clients set large-community delete 999:0:* + +# do_not_announce_to_peers_with_rtt_higher_than +match to group clients set community delete 64531:* +match to group clients set ext-community delete rt 64531:* +match to group clients set large-community delete 999:64531:* + +# do_not_announce_to_peers_with_rtt_lower_than +match to group clients set community delete 64530:* +match to group clients set ext-community delete rt 64530:* +match to group clients set large-community delete 999:64530:* + +# prepend_once_to_any +match to group clients set community delete 65521:65521 +match to group clients set ext-community delete rt 65521:65521 +match to group clients set large-community delete 999:65521:65521 + +# prepend_once_to_peer +match to group clients set community delete 65521:* +match to group clients set ext-community delete rt 65521:* +match to group clients set large-community delete 999:65521:* + +# prepend_once_to_peers_with_rtt_higher_than +match to group clients set community delete 64537:* +match to group clients set ext-community delete rt 64537:* +match to group clients set large-community delete 999:64537:* + +# prepend_once_to_peers_with_rtt_lower_than +match to group clients set community delete 64534:* +match to group clients set ext-community delete rt 64534:* +match to group clients set large-community delete 999:64534:* + +# prepend_thrice_to_any +match to group clients set community delete 65523:65523 +match to group clients set ext-community delete rt 65523:65523 +match to group clients set large-community delete 999:65523:65523 + +# prepend_thrice_to_peer +match to group clients set community delete 65523:* +match to group clients set ext-community delete rt 65523:* +match to group clients set large-community delete 999:65523:* + +# prepend_thrice_to_peers_with_rtt_higher_than +match to group clients set community delete 64539:* +match to group clients set ext-community delete rt 64539:* +match to group clients set large-community delete 999:64539:* + +# prepend_thrice_to_peers_with_rtt_lower_than +match to group clients set community delete 64536:* +match to group clients set ext-community delete rt 64536:* +match to group clients set large-community delete 999:64536:* + +# prepend_twice_to_any +match to group clients set community delete 65522:65522 +match to group clients set ext-community delete rt 65522:65522 +match to group clients set large-community delete 999:65522:65522 + +# prepend_twice_to_peer +match to group clients set community delete 65522:* +match to group clients set ext-community delete rt 65522:* +match to group clients set large-community delete 999:65522:* + +# prepend_twice_to_peers_with_rtt_higher_than +match to group clients set community delete 64538:* +match to group clients set ext-community delete rt 64538:* +match to group clients set large-community delete 999:64538:* + +# prepend_twice_to_peers_with_rtt_lower_than +match to group clients set community delete 64535:* +match to group clients set ext-community delete rt 64535:* +match to group clients set large-community delete 999:64535:* + +# reject_cause +match to group clients set community delete 65520:* + +# reject_cause_map_6 +match to group clients set large-community delete 999:1101:7 + +# rejected_route_announced_by +match to group clients set ext-community delete rt 65520:* + + +# Scrub prepending communities +match to group clients set { + community delete 65521:65521 + ext-community delete rt 65521:65521 + large-community delete 999:65521:65521 + +} +match to group clients set { + community delete 65521:* + ext-community delete rt 65521:* + large-community delete 999:65521:* + +} +match to group clients set { + community delete 64537:* + ext-community delete rt 64537:* + large-community delete 999:64537:* + +} +match to group clients set { + community delete 64534:* + ext-community delete rt 64534:* + large-community delete 999:64534:* + +} +match to group clients set { + community delete 65523:65523 + ext-community delete rt 65523:65523 + large-community delete 999:65523:65523 + +} +match to group clients set { + community delete 65523:* + ext-community delete rt 65523:* + large-community delete 999:65523:* + +} +match to group clients set { + community delete 64539:* + ext-community delete rt 64539:* + large-community delete 999:64539:* + +} +match to group clients set { + community delete 64536:* + ext-community delete rt 64536:* + large-community delete 999:64536:* + +} +match to group clients set { + community delete 65522:65522 + ext-community delete rt 65522:65522 + large-community delete 999:65522:65522 + +} +match to group clients set { + community delete 65522:* + ext-community delete rt 65522:* + large-community delete 999:65522:* + +} +match to group clients set { + community delete 64538:* + ext-community delete rt 64538:* + large-community delete 999:64538:* + +} +match to group clients set { + community delete 64535:* + ext-community delete rt 64535:* + large-community delete 999:64535:* + +} + + +# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy +match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT +match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE + +# Remove internal communities before announcing the route +match to group clients set { + ext-community delete $INTCOMM_PREF_OK_ROA + ext-community delete $INTCOMM_ROUTE_OK_WL + ext-community delete $INTCOMM_PREF_OK_ARINDB + ext-community delete $INTCOMM_PREF_OK_REGISTROBRDB + ext-community delete $INTCOMM_ORIGIN_OK + ext-community delete $INTCOMM_ORIGIN_KO + ext-community delete $INTCOMM_PREFIX_OK + ext-community delete $INTCOMM_PREFIX_KO + ext-community delete $INTCOMM_IRR_REJECT + ext-community delete $INTCOMM_RPKI_UNKNOWN + ext-community delete $INTCOMM_RPKI_INVALID + ext-community delete $INTCOMM_RPKI_VALID + ext-community delete $INTCOMM_NO_EXPORT + ext-community delete $INTCOMM_NO_ADVERTISE + ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS + +} + +include "/etc/bgpd/post-filters.local" + + diff --git a/tests/live_tests/scenarios/tag_reject_policy/routes/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd77p/AS101.txt b/tests/live_tests/scenarios/tag_reject_policy/routes/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd77p/AS101.txt new file mode 100644 index 00000000..33ec3bbb --- /dev/null +++ b/tests/live_tests/scenarios/tag_reject_policy/routes/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd77p/AS101.txt @@ -0,0 +1,406 @@ +2001::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2001:db8:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a01:0:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a01:0:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a01:0:1::/48, AS_PATH: 2 1, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a01:0:2::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a01:0:2::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a01:0:2::/48, AS_PATH: 2 1, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a01:0:3::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a01:0:3::/48, AS_PATH: 2 1, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a02:0:1::/48, AS_PATH: 1 2, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a02:0:1::/48, AS_PATH: 1 2, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a02:0:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:2::/48, AS_PATH: 1 2, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a02:0:2::/48, AS_PATH: 1 2, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a02:0:2::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::1/128, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::2/128, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::3/128, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:4::/48, AS_PATH: 1 2, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a02:0:4::/48, AS_PATH: 1 2, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a02:0:4::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:5::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:2::/48, AS_PATH: 1 3, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:2::/48, AS_PATH: 1 3, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:3::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:5::/48, AS_PATH: 1 3 3, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:5::/48, AS_PATH: 1 3 3, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:5::/48, AS_PATH: 2 3 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:6::/48, AS_PATH: 1 3 3 3, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:6::/48, AS_PATH: 1 3 3 3, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:6::/48, AS_PATH: 2 3 3 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:7::/48, AS_PATH: 1 3 3 3 3, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:7::/48, AS_PATH: 1 3 3 3 3, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:7::/48, AS_PATH: 2 3 3 3 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:8::/48, AS_PATH: 1 3 3, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:8::/48, AS_PATH: 1 3 3, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:8::/48, AS_PATH: 2 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:9::/48, AS_PATH: 1 3, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:9::/48, AS_PATH: 1 3, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:9::/48, AS_PATH: 2 3 3 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:a::/48, AS_PATH: 1 3 3 3 3, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:a::/48, AS_PATH: 1 3 3 3 3, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a03:0:a::/48, AS_PATH: 2 3 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:c::/48, AS_PATH: 2 3 3 3 3, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:1:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:1:1::/48, AS_PATH: 2 1 1011, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a11:1:2::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:2:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:3:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:3::/32, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:3::/32, AS_PATH: 2 1 1011, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a11:4:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:4:1::/48, AS_PATH: 2 1 1000, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a99:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a99:2::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a99::/16, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a99::/32, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/tag_reject_policy/routes/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd77p/AS1_1.txt b/tests/live_tests/scenarios/tag_reject_policy/routes/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd77p/AS1_1.txt new file mode 100644 index 00000000..5a4a4b4c --- /dev/null +++ b/tests/live_tests/scenarios/tag_reject_policy/routes/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd77p/AS1_1.txt @@ -0,0 +1,280 @@ +2a02:0:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:2::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::1/128, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::2/128, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::3/128, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:4::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::22, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:2::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:5::/48, AS_PATH: 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:6::/48, AS_PATH: 3 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:7::/48, AS_PATH: 3 3 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:8::/48, AS_PATH: 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:9::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:a::/48, AS_PATH: 3 3 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:b::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:c::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:d::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:10::/48, AS_PATH: 101 666, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:11::/48, AS_PATH: 101 777, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:1::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:2::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 65530:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:3::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: 999:65530:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:4::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 888:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:5::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: 888:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:6::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 65530:1, 777:0 + ext comms: + lrg comms: 777:0:0, 999:65530:1 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:7::/48, AS_PATH: 101 174, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8000::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8000::1/128, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 65535:666 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:9::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:1::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2:4000::/34, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2:8000::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2::/33, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:3:1::/48, AS_PATH: 101 105, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3102:0:1::/48, AS_PATH: 101 102, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3103:0:1::/48, AS_PATH: 101 103, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3103:0:2::/48, AS_PATH: 101 101 103, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3104:0:1::/48, AS_PATH: 101 104, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3104:1:1::/48, AS_PATH: 101 104, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +8000:1::/32, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/tag_reject_policy/routes/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd77p/AS1_2.txt b/tests/live_tests/scenarios/tag_reject_policy/routes/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd77p/AS1_2.txt new file mode 100644 index 00000000..86b7ea6c --- /dev/null +++ b/tests/live_tests/scenarios/tag_reject_policy/routes/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd77p/AS1_2.txt @@ -0,0 +1,259 @@ +2a02:0:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:2::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:4::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::22, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:2::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:5::/48, AS_PATH: 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:6::/48, AS_PATH: 3 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:7::/48, AS_PATH: 3 3 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:8::/48, AS_PATH: 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:9::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:a::/48, AS_PATH: 3 3 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:b::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:c::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:d::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:10::/48, AS_PATH: 101 666, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:11::/48, AS_PATH: 101 777, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:1::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:2::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 65530:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:3::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: 999:65530:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:4::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 888:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:5::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: 888:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:6::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 65530:1, 777:0 + ext comms: + lrg comms: 777:0:0, 999:65530:1 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:7::/48, AS_PATH: 101 174, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8000::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8000::1/128, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 65535:666 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:9::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:1::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2:4000::/34, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2:8000::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2::/33, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:3:1::/48, AS_PATH: 101 105, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3102:0:1::/48, AS_PATH: 101 102, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3103:0:1::/48, AS_PATH: 101 103, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3103:0:2::/48, AS_PATH: 101 101 103, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3104:0:1::/48, AS_PATH: 101 104, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3104:1:1::/48, AS_PATH: 101 104, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +8000:1::/32, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/tag_reject_policy/routes/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd77p/AS2.txt b/tests/live_tests/scenarios/tag_reject_policy/routes/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd77p/AS2.txt new file mode 100644 index 00000000..aafa6dae --- /dev/null +++ b/tests/live_tests/scenarios/tag_reject_policy/routes/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd77p/AS2.txt @@ -0,0 +1,350 @@ +2a01:0:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a01:0:2::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a01:0:3::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:3::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:5::/48, AS_PATH: 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:6::/48, AS_PATH: 3 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:7::/48, AS_PATH: 3 3 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:8::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:9::/48, AS_PATH: 3 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:a::/48, AS_PATH: 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:b::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:c::/48, AS_PATH: 3 3 3 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:d::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: 65535:65281 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:1:1::/48, AS_PATH: 1 1011, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:3::/32, AS_PATH: 1 1011, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:4:1::/48, AS_PATH: 1 1000, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:10::/48, AS_PATH: 101 666, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:11::/48, AS_PATH: 101 777, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:1::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:1::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:2::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:2::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 65530:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:3::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:3::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: 999:65530:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:4::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 888:0 + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:4::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 888:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:5::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: 888:0:0 + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:5::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: 888:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:6::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 777:0 + ext comms: + lrg comms: 777:0:0 + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:6::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 65530:1, 777:0 + ext comms: + lrg comms: 777:0:0, 999:65530:1 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:7::/48, AS_PATH: 101 174, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8000::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8000::1/128, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:8000::1/128, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: 65535:666 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:8::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:9::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:1::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2:4000::/34, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2:8000::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:2:8000::/48, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2::/33, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:2::/33, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:3:1::/48, AS_PATH: 101 105, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3102:0:1::/48, AS_PATH: 101 102, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3103:0:1::/48, AS_PATH: 101 101 103, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3103:0:2::/48, AS_PATH: 101 103, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3104:0:1::/48, AS_PATH: 101 104, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3104:1:1::/48, AS_PATH: 101 104, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +8000:1::/32, AS_PATH: 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::101 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/tag_reject_policy/routes/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd77p/AS3.txt b/tests/live_tests/scenarios/tag_reject_policy/routes/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd77p/AS3.txt new file mode 100644 index 00000000..43cf4811 --- /dev/null +++ b/tests/live_tests/scenarios/tag_reject_policy/routes/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd77p/AS3.txt @@ -0,0 +1,238 @@ +2a01:0:1::/48, AS_PATH: 999 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +2a01:0:1::/48, AS_PATH: 999 1, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 101 + filtered: False () + +2a01:0:2::/48, AS_PATH: 999 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +2a01:0:2::/48, AS_PATH: 999 1, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 101 + filtered: False () + +2a01:0:3::/48, AS_PATH: 999 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +2a02:0:1::/48, AS_PATH: 999 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:2::/48, AS_PATH: 999 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::1/128, AS_PATH: 999 2, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::2/128, AS_PATH: 999 2, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::3/128, AS_PATH: 999 2, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:4::/48, AS_PATH: 999 2, NEXT_HOP: 2001:db8:1:1::22, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:1:1::/48, AS_PATH: 999 1 1011, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +2a11:3::/32, AS_PATH: 999 1 1011, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +2a11:4:1::/48, AS_PATH: 999 1 1000, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +3101:0:1::/48, AS_PATH: 999 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +3101:0:1::/48, AS_PATH: 999 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:2::/48, AS_PATH: 999 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +3101:0:2::/48, AS_PATH: 999 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:3::/48, AS_PATH: 999 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +3101:0:3::/48, AS_PATH: 999 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:4::/48, AS_PATH: 999 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 888:0 + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +3101:0:4::/48, AS_PATH: 999 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 888:0 + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:5::/48, AS_PATH: 999 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: 888:0:0 + best: True, LOCAL_PREF: 101 + filtered: False () + +3101:0:5::/48, AS_PATH: 999 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: 888:0:0 + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:6::/48, AS_PATH: 999 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 777:0 + ext comms: + lrg comms: 777:0:0 + best: True, LOCAL_PREF: 101 + filtered: False () + +3101:0:6::/48, AS_PATH: 999 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 777:0 + ext comms: + lrg comms: 777:0:0 + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:8000::1/128, AS_PATH: 999 1 101, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 101 + filtered: False () + +3101:0:8000::1/128, AS_PATH: 999 2 101, NEXT_HOP: 2001:db8:1:1::66, via 2001:db8:1:1::2 + std comms: 65530:4, 65535:65281, 65535:666 + ext comms: + lrg comms: 999:65530:4 + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:8::/48, AS_PATH: 999 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +3101:0:8::/48, AS_PATH: 999 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:2:8000::/48, AS_PATH: 999 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +3101:2:8000::/48, AS_PATH: 999 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:2::/33, AS_PATH: 999 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: True, LOCAL_PREF: 101 + filtered: False () + +3101:2::/33, AS_PATH: 999 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: + ext comms: + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/tag_reject_policy/routes/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd77p/rc.txt b/tests/live_tests/scenarios/tag_reject_policy/routes/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd77p/rc.txt new file mode 100644 index 00000000..df8ece37 --- /dev/null +++ b/tests/live_tests/scenarios/tag_reject_policy/routes/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd77p/rc.txt @@ -0,0 +1,259 @@ +2001::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:2 + ext comms: rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2001:db8:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:3 + ext comms: rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:5::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::23, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:5 + ext comms: rt:65520:2 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:1::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:11 + ext comms: rt:65520:3 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:e::/48, AS_PATH: 3 174 33, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:8 + ext comms: rt:65520:3 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:1:2::/48, AS_PATH: 1 1000, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:9 + ext comms: rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:2:1::/48, AS_PATH: 1 1011, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:12 + ext comms: rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:3:1::/48, AS_PATH: 1 1011, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:12 + ext comms: rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a99:1::/48, AS_PATH: 1 65536 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:7 + ext comms: rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a99:2::/48, AS_PATH: 1 2 2 2 2 2 2 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:1 + ext comms: rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a99::/16, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:13 + ext comms: rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a99::/32, AS_PATH: 2 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:6 + ext comms: rt:65520:1 + lrg comms: 999:1101:7 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:10::/48, AS_PATH: 1 101 666, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:15 + ext comms: rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:11::/48, AS_PATH: 1 101 777, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:15 + ext comms: rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:1::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:5 + ext comms: rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:2::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:5 + ext comms: rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:3::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:5 + ext comms: rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:4::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:5, 888:0 + ext comms: rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:5::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:5 + ext comms: rt:65520:1 + lrg comms: 888:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:6::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:5, 777:0 + ext comms: rt:65520:1 + lrg comms: 777:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:7::/48, AS_PATH: 1 101 174, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:8 + ext comms: rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8000::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:14 + ext comms: rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8000::1/128, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:5, 65535:666 + ext comms: rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:5 + ext comms: rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:9::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:14 + ext comms: rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:1::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:12 + ext comms: rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2:4000::/34, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:12 + ext comms: rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2:8000::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:5 + ext comms: rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2::/33, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:5 + ext comms: rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:3:1::/48, AS_PATH: 1 101 105, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:9 + ext comms: rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3102:0:1::/48, AS_PATH: 1 101 102, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:9 + ext comms: rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3103:0:1::/48, AS_PATH: 1 101 103, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:9, 65535:0 + ext comms: rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3103:0:2::/48, AS_PATH: 2 101 103, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:9, 65535:0 + ext comms: rt:65520:2 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3104:0:1::/48, AS_PATH: 1 101 104, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:9 + ext comms: rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3104:1:1::/48, AS_PATH: 1 101 104, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:9 + ext comms: rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +8000:1::/32, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:10 + ext comms: rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +::/0, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::2 + std comms: 65520:0, 65520:10 + ext comms: rt:65520:3 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + diff --git a/tests/live_tests/scenarios/tag_reject_policy/routes/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd77p/rs.txt b/tests/live_tests/scenarios/tag_reject_policy/routes/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd77p/rs.txt new file mode 100644 index 00000000..a5b956f1 --- /dev/null +++ b/tests/live_tests/scenarios/tag_reject_policy/routes/TagRejectPolicyScenario_OpenBGPDIPv4/openbgpd77p/rs.txt @@ -0,0 +1,777 @@ +2001::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 65520:0, 65520:2 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: False () + +2001:db8:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 65520:0, 65520:3 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: False () + +2a01:0:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a01:0:1::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a01:0:2::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a01:0:2::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::12, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +2a01:0:3::/48, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::12 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:1::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:2::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::1/128, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 65530:4, 65535:666 + ext comms: rfc8097-not-found + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::2/128, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 65530:4, 65534:0 + ext comms: rfc8097-not-found + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:3::3/128, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 65530:4 + ext comms: rfc8097-not-found + lrg comms: 65534:0:0, 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:4::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::22, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a02:0:5::/48, AS_PATH: 2, NEXT_HOP: 2001:db8:1:1::23, via 2001:db8:1:1::21 + std comms: 65520:0, 65520:5 + ext comms: rfc8097-not-found, rt:65520:2 + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: False () + +2a03:0:1::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 65520:0, 65520:11 + ext comms: rfc8097-not-found, rt:65520:3 + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: False () + +2a03:0:2::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 0:999, 65501:1 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:3::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 0:1 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:4::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 0:999 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:5::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 65521:65521 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:6::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 65522:65522 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:7::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 65523:65523 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:8::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 65521:1 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:9::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 65522:2 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:a::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 65521:65521, 65523:1 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:b::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 65507:999 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:c::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 65509:1, 65523:2 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:d::/48, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: + ext comms: rfc8097-not-found, soo:65535:65281 + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a03:0:e::/48, AS_PATH: 3 174 33, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 65520:0, 65520:8 + ext comms: rfc8097-not-found, rt:65520:3 + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: False () + +2a11:1:1::/48, AS_PATH: 1 1011, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:1:2::/48, AS_PATH: 1 1000, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 65520:0, 65520:9 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: False () + +2a11:2:1::/48, AS_PATH: 1 1011, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 65520:0, 65520:12 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: False () + +2a11:3:1::/48, AS_PATH: 1 1011, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 65520:0, 65520:12 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: False () + +2a11:3::/32, AS_PATH: 1 1011, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a11:4:1::/48, AS_PATH: 1 1000, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +2a99:1::/48, AS_PATH: 1 65536 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 65520:0, 65520:7 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: False () + +2a99:2::/48, AS_PATH: 1 2 2 2 2 2 2 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 65520:0, 65520:1 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: False () + +2a99::/16, AS_PATH: 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 65520:0, 65520:13 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: False () + +2a99::/32, AS_PATH: 2 1, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 65520:0, 65520:6 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: 999:1101:7 + best: True, LOCAL_PREF: 1 + filtered: False () + +3101:0:10::/48, AS_PATH: 1 101 666, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: 65520:0, 65520:5 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +3101:0:10::/48, AS_PATH: 1 101 666, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 65520:0, 65520:15 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: False () + +3101:0:10::/48, AS_PATH: 2 101 666, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 65520:0, 65520:15 + ext comms: rfc8097-not-found, rt:65520:2 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +3101:0:11::/48, AS_PATH: 1 101 777, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: 65520:0, 65520:5 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +3101:0:11::/48, AS_PATH: 1 101 777, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 65520:0, 65520:15 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: False () + +3101:0:11::/48, AS_PATH: 2 101 777, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 65520:0, 65520:15 + ext comms: rfc8097-not-found, rt:65520:2 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +3101:0:1::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: 65520:0, 65520:5 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +3101:0:1::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:1::/48, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:2::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: 65520:0, 65520:5 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +3101:0:2::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:2::/48, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:3::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: 65520:0, 65520:5 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +3101:0:3::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:3::/48, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:4::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: 65520:0, 65520:5, 888:0 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +3101:0:4::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 888:0 + ext comms: rfc8097-not-found + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:4::/48, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 888:0 + ext comms: rfc8097-not-found + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:5::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: 65520:0, 65520:5 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: 888:0:0 + best: False, LOCAL_PREF: 1 + filtered: False () + +3101:0:5::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-not-found + lrg comms: 888:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:5::/48, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-not-found + lrg comms: 888:0:0 + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:6::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: 65520:0, 65520:5, 777:0 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: 777:0:0 + best: False, LOCAL_PREF: 1 + filtered: False () + +3101:0:6::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 777:0 + ext comms: rfc8097-not-found + lrg comms: 777:0:0 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:6::/48, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 777:0 + ext comms: rfc8097-not-found + lrg comms: 777:0:0 + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:7::/48, AS_PATH: 1 101 174, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: 65520:0, 65520:5 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +3101:0:7::/48, AS_PATH: 1 101 174, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 65520:0, 65520:8 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: False () + +3101:0:7::/48, AS_PATH: 2 101 174, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 65520:0, 65520:8 + ext comms: rfc8097-not-found, rt:65520:2 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +3101:0:8000::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: 65520:0, 65520:5 + ext comms: rfc8097-invalid, rt:65520:1 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +3101:0:8000::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 65520:0, 65520:14 + ext comms: rfc8097-invalid, rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: False () + +3101:0:8000::/48, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 65520:0, 65520:14 + ext comms: rfc8097-invalid, rt:65520:2 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +3101:0:8000::1/128, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: 65520:0, 65520:5, 65535:666 + ext comms: rfc8097-invalid, rt:65520:1 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +3101:0:8000::1/128, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 65530:4, 65535:666 + ext comms: rfc8097-invalid + lrg comms: 999:65530:4 + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8000::1/128, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 65530:4, 65535:666 + ext comms: rfc8097-invalid + lrg comms: 999:65530:4 + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:8::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: 65520:0, 65520:5 + ext comms: rfc8097-valid, rt:65520:1 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +3101:0:8::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:0:8::/48, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:0:9::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: 65520:0, 65520:5 + ext comms: rfc8097-invalid, rt:65520:1 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +3101:0:9::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 65520:0, 65520:14 + ext comms: rfc8097-invalid, rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: False () + +3101:0:9::/48, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 65520:0, 65520:14 + ext comms: rfc8097-invalid, rt:65520:2 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +3101:1::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: 65520:0, 65520:5 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +3101:1::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 65520:0, 65520:12 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: False () + +3101:1::/48, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 65520:0, 65520:12 + ext comms: rfc8097-not-found, rt:65520:2 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +3101:2:4000::/34, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: 65520:0, 65520:5 + ext comms: rfc8097-invalid, rt:65520:1 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +3101:2:4000::/34, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 65520:0, 65520:12 + ext comms: rfc8097-invalid, rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: False () + +3101:2:4000::/34, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 65520:0, 65520:12 + ext comms: rfc8097-invalid, rt:65520:2 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +3101:2:8000::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: 65520:0, 65520:5 + ext comms: rfc8097-valid, rt:65520:1 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +3101:2:8000::/48, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2:8000::/48, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:2::/33, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: 65520:0, 65520:5 + ext comms: rfc8097-valid, rt:65520:1 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +3101:2::/33, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: True, LOCAL_PREF: 100 + filtered: False () + +3101:2::/33, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: + ext comms: rfc8097-valid + lrg comms: + best: False, LOCAL_PREF: 100 + filtered: False () + +3101:3:1::/48, AS_PATH: 1 101 105, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: 65520:0, 65520:5 + ext comms: rfc8097-valid, rt:65520:1 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +3101:3:1::/48, AS_PATH: 1 101 105, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 65520:0, 65520:9 + ext comms: rfc8097-valid, rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: False () + +3101:3:1::/48, AS_PATH: 2 101 105, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 65520:0, 65520:9 + ext comms: rfc8097-valid, rt:65520:2 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +3102:0:1::/48, AS_PATH: 1 101 102, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: 65520:0, 65520:5 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +3102:0:1::/48, AS_PATH: 1 101 102, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 65520:0, 65520:9 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: False () + +3102:0:1::/48, AS_PATH: 2 101 102, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 65520:0, 65520:9 + ext comms: rfc8097-not-found, rt:65520:2 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +3103:0:1::/48, AS_PATH: 1 101 103, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: 65520:0, 65520:5, 65535:0 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +3103:0:1::/48, AS_PATH: 1 101 103, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 65520:0, 65520:9, 65535:0 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: False () + +3103:0:1::/48, AS_PATH: 2 101 101 103, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 65520:0, 65520:9 + ext comms: rfc8097-not-found, rt:65520:2 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +3103:0:2::/48, AS_PATH: 1 101 101 103, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: 65520:0, 65520:5 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +3103:0:2::/48, AS_PATH: 1 101 101 103, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 65520:0, 65520:9 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +3103:0:2::/48, AS_PATH: 2 101 103, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 65520:0, 65520:9, 65535:0 + ext comms: rfc8097-not-found, rt:65520:2 + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: False () + +3104:0:1::/48, AS_PATH: 1 101 104, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: 65520:0, 65520:5 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +3104:0:1::/48, AS_PATH: 1 101 104, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 65520:0, 65520:9 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: False () + +3104:0:1::/48, AS_PATH: 2 101 104, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 65520:0, 65520:9 + ext comms: rfc8097-not-found, rt:65520:2 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +3104:1:1::/48, AS_PATH: 1 101 104, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: 65520:0, 65520:5 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +3104:1:1::/48, AS_PATH: 1 101 104, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 65520:0, 65520:9 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: False () + +3104:1:1::/48, AS_PATH: 2 101 104, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 65520:0, 65520:9 + ext comms: rfc8097-not-found, rt:65520:2 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +8000:1::/32, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::101, via 2001:db8:1:1::12 + std comms: 65520:0, 65520:10 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +8000:1::/32, AS_PATH: 1 101, NEXT_HOP: 2001:db8:1:1::11, via 2001:db8:1:1::11 + std comms: 65520:0, 65520:10 + ext comms: rfc8097-not-found, rt:65520:1 + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: False () + +8000:1::/32, AS_PATH: 2 101, NEXT_HOP: 2001:db8:1:1::21, via 2001:db8:1:1::21 + std comms: 65520:0, 65520:10 + ext comms: rfc8097-not-found, rt:65520:2 + lrg comms: + best: False, LOCAL_PREF: 1 + filtered: False () + +::/0, AS_PATH: 3, NEXT_HOP: 2001:db8:1:1::31, via 2001:db8:1:1::31 + std comms: 65520:0, 65520:10 + ext comms: rfc8097-not-found, rt:65520:3 + lrg comms: + best: True, LOCAL_PREF: 1 + filtered: False () +