{% from 'macros.j2' import write_roa_set %}
{% from 'macros.j2' import write_roas_action %}

{% if cfg.rpki_roas_needed %}
# ---------------------------------------------------------
# ROAs source

{#
    ROAs are defined only for versions >= 6.4; for all the other
    cases they are just implemented in the legacy way, using
    'write_roas_action' and communities.

    - case 1: version is >= 6.9 and 'rtr' is used as the source,
      so the file containing the configuration of the RTR sessions
      is included.
    - case 2: either version is < 6.9 or 'ripe_rpki_validator_url'
      is configured as the source, so ROAs are generated by the
      Python code and statically configured in the configuration
      file via the 'roa-set' statement.
#}
{%   if "6.9"|target_version_ge and
       cfg.rpki_roas.source == "rtr" %}

{{ "rpki_rtr_config"|include_local_file -}}

{%   elif "6.4"|target_version_ge %}

roa-set {
{{     write_roa_set(rpki_roas) }}
}

{%   else %}

# ROAs are not defined in the configuration file via
# RTR or roa-set because these features are supported only
# on more recent versions. Origin Validation and other features
# are implemented using regular 'match' filters and BGP
# communities, in a way that mimics Origin Validation.

{%   endif %}

{% endif %}

{% if cfg.filtering.rpki_bgp_origin_validation.enabled %}
# ---------------------------------------------------------
# RPKI-based Origin Validation

{%   if "6.4"|target_version_ge %}

# Add $INTCOMM_RPKI_UNKNOWN, $INTCOMM_RPKI_INVALID and $INTCOMM_RPKI_VALID
# ext community on the basis of ovs.
match from group clients ovs not-found set { ext-community $INTCOMM_RPKI_UNKNOWN ext-community ovs not-found }
match from group clients ovs valid set { ext-community $INTCOMM_RPKI_VALID ext-community ovs valid }
match from group clients ovs invalid set { ext-community $INTCOMM_RPKI_INVALID ext-community ovs invalid }

{%   else %}

# 1. Add $INTCOMM_RPKI_UNKNOWN ext community to all the routes.
# 2. Add $INTCOMM_RPKI_INVALID ext community to all those routes
#    whose prefix is covered by a ROA. Here, the aggregated address
#    space made up by all the ROAs prefixes is used.
# 3. Add $INTCOMM_RPKI_VALID ext community to and remove the
#    $INTCOMM_RPKI_INVALID ext community from the routes whose
#    prefix matches a ROA (both prefix and origin ASN).
match from group clients set ext-community $INTCOMM_RPKI_UNKNOWN
{%      for prefix in rpki_roas_covered_space %}
match from group clients prefix {{ prefix }} or-longer set ext-community $INTCOMM_RPKI_INVALID
{%      endfor %}
{{  write_roas_action(rpki_roas, "set ext-community $INTCOMM_RPKI_VALID") }}
match from group clients ext-community $INTCOMM_RPKI_VALID set { ext-community delete $INTCOMM_RPKI_UNKNOWN ext-community delete $INTCOMM_RPKI_INVALID }
match from group clients ext-community $INTCOMM_RPKI_INVALID set ext-community delete $INTCOMM_RPKI_UNKNOWN

{%   endif %}

{% endif %}

{% if cfg.filtering.irrdb.use_rpki_roas_as_route_objects.enabled %}
# ---------------------------------------------------------
# RPKI ROAs used as route objects.

# Add the $INTCOMM_PREF_OK_ROA ext community to routes whose
# origin ASN has a ROA for the announced prefix.
# It will be used later during IRRDB validation in
# case the origin ASN is authorized by a client's
# AS-SET but the prefix is not.

{%  if cfg.filtering.rpki_bgp_origin_validation.enabled %}
{%      if "6.4"|target_version_ge %}
# Since RPKI-based Origin Validation is already performed above,
# use the origin validation state to identify valid routes.
match from group clients ovs valid set ext-community $INTCOMM_PREF_OK_ROA
{%      else %}
# Since RPKI-based Origin Validation is already performed above,
# use the $INTCOMM_RPKI_VALID ext community to identify valid routes.
match from group clients ext-community $INTCOMM_RPKI_VALID set ext-community $INTCOMM_PREF_OK_ROA
{%      endif %}
{%  else %}
{%      if rpki_roas %}
{%          if "6.4"|target_version_ge %}
origin-set "RPKI_ROA" {
{{        write_roa_set(rpki_roas) }}
}
match from group clients origin-set RPKI_ROA set ext-community $INTCOMM_PREF_OK_ROA
{%          else %}
{{              write_roas_action(rpki_roas, "set ext-community $INTCOMM_PREF_OK_ROA") }}
{%          endif %}
{%      else %}
{%          if "6.9"|target_version_ge %}
match from group clients ovs valid set ext-community $INTCOMM_PREF_OK_ROA
{%          endif %}
{%      endif %}
{%  endif %}

{% endif %}
