fix(blackwalld): don't block arming on placeholder RTBH next-hop when a community is set (#273) #274

Merged

vxfemboy merged 1 commit from fix/rtbh-placeholder-nexthop-273 into main

2026-08-04 04:51:36 +00:00

vxfemboy commented

2026-08-04 04:08:00 +00:00

Owner

Closes #273.

The arm-time placeholder-next-hop check (68eb669, 2026-07-31) predates the community→RTD_BLACKHOLE import fix (c49e31b, 2026-08-01) by 12 commits and still encodes the pre-fix assumption — that a resolvable next-hop is required for BIRD to produce a real blackhole. Since c49e31b, blackwall's generated BIRD import filter converts an RFC 7999 community-tagged host route directly to dest = RTD_BLACKHOLE, so the next-hop need not resolve at all. Deploying the #265/#266/#270 binary to the live AS214806 container (config unchanged, next-hop-v4=192.0.2.1 next-hop-v6=100::1 — deliberately placeholder because c49e31b made a real discard unnecessary) tripped the stale check and downgraded it from ARMED (M1) to a shadow crash-loop.

Fix

Replace the unconditional hard error with RtbhPolicy::next_hop_verdict():

next-hop	community configured?	verdict
placeholder (RFC 5737/3849/6666)	yes (default `[(65535,666)]`)	warn + arm
placeholder	no	hard block (unchanged)
real	either	Ok (unchanged)

With a community set, the community path makes the next-hop irrelevant — but blackwalld can't see the router's config to confirm the import filter is in place, so it warns (naming blackwalld bird-config/c49e31b) rather than blocks. With no community, next-hop resolution is the only mechanism and a placeholder is still a hard block.

The live workaround (real-but-unused .67 next-hops) becomes unnecessary after this — a placeholder next-hop arms with a warning.

Tests

next_hop_verdict is a pure method with a unit test in blackwall-core covering all three verdicts (community/no-community × placeholder/real).

Closes #273. The arm-time placeholder-next-hop check (`68eb669`, 2026-07-31) predates the community→`RTD_BLACKHOLE` import fix (`c49e31b`, 2026-08-01) by 12 commits and still encodes the pre-fix assumption — that a resolvable next-hop is required for BIRD to produce a real blackhole. Since `c49e31b`, blackwall's generated BIRD import filter converts an RFC 7999 community-tagged host route directly to `dest = RTD_BLACKHOLE`, so the next-hop need not resolve at all. Deploying the #265/#266/#270 binary to the live AS214806 container (config unchanged, `next-hop-v4=192.0.2.1 next-hop-v6=100::1` — deliberately placeholder *because* c49e31b made a real discard unnecessary) tripped the stale check and downgraded it from ARMED (M1) to a shadow crash-loop. ### Fix Replace the unconditional hard error with `RtbhPolicy::next_hop_verdict()`: | next-hop | community configured? | verdict | |----------|----------------------|---------| | placeholder (RFC 5737/3849/6666) | yes (default `[(65535,666)]`) | **warn + arm** | | placeholder | no | **hard block** (unchanged) | | real | either | Ok (unchanged) | With a community set, the community path makes the next-hop irrelevant — but blackwalld can't see the router's config to confirm the import filter is in place, so it warns (naming `blackwalld bird-config`/c49e31b) rather than blocks. With no community, next-hop resolution is the only mechanism and a placeholder is still a hard block. The live workaround (real-but-unused `.67` next-hops) becomes unnecessary after this — a placeholder next-hop arms with a warning. ### Tests `next_hop_verdict` is a pure method with a unit test in `blackwall-core` covering all three verdicts (community/no-community × placeholder/real).

vxfemboy added 1 commit

2026-08-04 04:08:00 +00:00

fix(blackwalld): don't block arming on a placeholder RTBH next-hop when a community is set (#273 )

CI / check (pull_request) Successful in 10m43s

Details

CI / lab (pull_request) Failing after 8m22s

Details

facea8c12c

The arm-time placeholder-next-hop check (68eb669) predates the
community-to-RTD_BLACKHOLE import fix (c49e31b) by 12 commits and encodes
its pre-fix assumption: that a resolvable next-hop is required for BIRD to
turn the route into a real blackhole. Since c49e31b, blackwall's generated
BIRD import filter converts an RFC 7999 community-tagged host route directly
to dest = RTD_BLACKHOLE, so the next-hop need not resolve at all. The stale
check rejected the (deliberately placeholder) live AS214806 config on a
binary update, downgrading the container from ARMED to a shadow crash-loop.

Replace the unconditional hard error with RtbhPolicy::next_hop_verdict:
- placeholder next-hop + a blackhole community configured (the default
  [(65535,666)]): warn and arm — the community path makes the next-hop
  irrelevant, but blackwalld can't see the router config to confirm the
  import filter, so it warns rather than blocks.
- placeholder next-hop + NO community: still a hard block (next-hop
  resolution is then the only path to a real discard).
- real next-hop: Ok as before.

next_hop_verdict is a pure method unit-tested in blackwall-core.