C2b-2: FlowSpec auto-mitigation wiring (persistence + config + CLI + daemon) #90

New issue

Closed

opened 2026-07-03 15:10:36 +00:00 by vxfemboy · 0 comments

vxfemboy commented

2026-07-03 15:10:36 +00:00

(Migrated from github.com)

Complete sub-project C2b by making the C2b-1 auto-mitigation core durable and operable, mirroring the C1c RTBH control plane:

Persistence (blackwall-state): 0005_flowspec migration (flowspec_rules active mirror + flowspec_requests intent log), Store methods, and impl FlowSpecJournal for Store. Rules re-announce on restart.
Config (blackwall-config/blackwall-core): a flowspec directive → FlowSpecPolicy (reuses the rtbh peer + prefixes; rejected without an rtbh block).
CLI (blackwalld): flowspec add/remove/list mirroring rtbh.
Daemon wiring: blackwalld flow runs a FlowSpecManager task alongside RtbhManager off the shared iBGP session, fed by the SelectorSink.

Spec: 2026-07-03-blackwall-c2b-flowspec-automitigation-design.md. Follows C2b-1 (#87).

Complete sub-project C2b by making the C2b-1 auto-mitigation core durable and operable, mirroring the C1c RTBH control plane: - **Persistence** (`blackwall-state`): `0005_flowspec` migration (`flowspec_rules` active mirror + `flowspec_requests` intent log), Store methods, and `impl FlowSpecJournal for Store`. Rules re-announce on restart. - **Config** (`blackwall-config`/`blackwall-core`): a `flowspec` directive → `FlowSpecPolicy` (reuses the `rtbh` peer + prefixes; rejected without an `rtbh` block). - **CLI** (`blackwalld`): `flowspec add/remove/list` mirroring `rtbh`. - **Daemon wiring**: `blackwalld flow` runs a `FlowSpecManager` task alongside `RtbhManager` off the shared iBGP session, fed by the `SelectorSink`. Spec: `2026-07-03-blackwall-c2b-flowspec-automitigation-design.md`. Follows C2b-1 (#87).