{% from 'macros.j2' import write_roa_set %}
{% from 'macros.j2' import write_roas_action %}
{% from 'macros.j2' import add_communities %}
{% from 'macros.j2' import ins_communities %}

{% if cfg.rpki_roas_needed %}
# ---------------------------------------------------------
# ROAs source

{#
    ROAs are defined only for versions >= 6.4; for all the other
    cases they are just implemented in the legacy way, using
    'write_roas_action' and communities.

    - case 1: 'rtr' is used as the source, so the file containing
      the configuration of the RTR sessions is included.
    - case 2: 'ripe_rpki_validator_url' is configured as the
      source, so ROAs are generated by the Python code and
      statically configured in the configuration file via
      the 'roa-set' statement.
#}
{%   if cfg.rpki_roas.source == "rtr" %}

{{ "rpki_rtr_config"|include_local_file -}}

{%   else %}

roa-set {
{{     write_roa_set(rpki_roas) }}
}

{%   endif %}

{% endif %}

{% if cfg.filtering.rpki_bgp_origin_validation.enabled %}
# ---------------------------------------------------------
# RPKI-based Origin Validation

# Add $INTCOMM_RPKI_UNKNOWN, $INTCOMM_RPKI_INVALID and $INTCOMM_RPKI_VALID
# ext community on the basis of ovs.
match from group clients ovs not-found set {
    ext-community $INTCOMM_RPKI_UNKNOWN
    ext-community ovs not-found
    {{ ins_communities(cfg.communities.rpki_bgp_origin_validation_unknown).strip() }}
}
match from group clients ovs valid set {
    ext-community $INTCOMM_RPKI_VALID
    ext-community ovs valid
    {{ ins_communities(cfg.communities.rpki_bgp_origin_validation_valid).strip() }}
}
match from group clients ovs invalid set {
    ext-community $INTCOMM_RPKI_INVALID
    ext-community ovs invalid
    {{ ins_communities(cfg.communities.rpki_bgp_origin_validation_invalid).strip() }}
}

{% else %}
{%    if cfg.communities.rpki_bgp_origin_validation_not_performed|community_is_set %}
# RPKI-based Origin Validation not performed; adding rpki_bgp_origin_validation_not_performed BGP communities
{{ add_communities("match from group clients", cfg.communities.rpki_bgp_origin_validation_not_performed, "") }}
{%    endif %}
{% endif %}

{% if cfg.filtering.irrdb.use_rpki_roas_as_route_objects.enabled %}
# ---------------------------------------------------------
# RPKI ROAs used as route objects.

# Add the $INTCOMM_PREF_OK_ROA ext community to routes whose
# origin ASN has a ROA for the announced prefix.
# It will be used later during IRRDB validation in
# case the origin ASN is authorized by a client's
# AS-SET but the prefix is not.

{%  if cfg.filtering.rpki_bgp_origin_validation.enabled %}
# Since RPKI-based Origin Validation is already performed above,
# use the origin validation state to identify valid routes.
match from group clients ovs valid set ext-community $INTCOMM_PREF_OK_ROA
{%  else %}
{%      if rpki_roas %}
origin-set "RPKI_ROA" {
{{        write_roa_set(rpki_roas) }}
}
match from group clients origin-set RPKI_ROA set ext-community $INTCOMM_PREF_OK_ROA
{%      else %}
match from group clients ovs valid set ext-community $INTCOMM_PREF_OK_ROA
{%      endif %}
{%  endif %}

{% endif %}
