Description
When peering externally with a router that shares the same AS Confederation Identifier (AS 65000) but is not a confederation member, GoBGP incorrectly establishes the EBGP session and installs routes. This violates confederation rules requiring the use of the confederation identifier only toward non-members, effectively allowing a same-AS EBGP session that should be rejected.
Steps to Reproduce
- Configure Router2 in GoBGP with confederation ID 65000 and member sub-AS 101; establish EBGP to Router3 as an external peer with remote-as 65000.
- Configure Router3 in GoBGP with AS 65000 but no confederation membership; peer externally with Router2 using remote-as 65000.
- From origin AS 65202, advertise a test prefix to Router2.
- Observe Router3’s RIB: it accepts and installs the route from Router2.
Buggy Behavior
GoBGP allows an EBGP session where the remote-as equals the local confederation ID despite the peer not being a confederation member, and Router3 installs the received route (R3 RIB populated), indicating same-AS EBGP was permitted or confed member-AS was used toward a non-member.
Expected Behavior
The EBGP session should be rejected when the external peer’s AS equals the local confederation ID but the peer is not a confederation member; no routes should be installed from that neighbor.
As per RFC 5065: [4] A member of a BGP confederation MUST use its AS Confederation Identifier in all transactions with peers that are not members of its confederation.
Description
When peering externally with a router that shares the same AS Confederation Identifier (AS 65000) but is not a confederation member, GoBGP incorrectly establishes the EBGP session and installs routes. This violates confederation rules requiring the use of the confederation identifier only toward non-members, effectively allowing a same-AS EBGP session that should be rejected.
Steps to Reproduce
Buggy Behavior
GoBGP allows an EBGP session where the remote-as equals the local confederation ID despite the peer not being a confederation member, and Router3 installs the received route (R3 RIB populated), indicating same-AS EBGP was permitted or confed member-AS was used toward a non-member.
Expected Behavior
The EBGP session should be rejected when the external peer’s AS equals the local confederation ID but the peer is not a confederation member; no routes should be installed from that neighbor.
As per RFC 5065: [4] A member of a BGP confederation MUST use its AS Confederation Identifier in all transactions with peers that are not members of its confederation.