Hi Martin, thanks for the pointer, however it does not make much sense to implement this directly in aspa_check() since it should not be performed in all cases (e.g. on a route server). Operators do have to perform the check in filters, like you proposed, if they want full ASPA validation. You are correct that this should be mentioned in the documentation and we will do so. Thanks again and happy routing, David David Petera (he/him) | BIRD Tech Support | CZ.NIC, z.s.p.o. On 5/5/26 10:15, Martin Tonusoo wrote:

Hi.

According the current ASPA draft the AS_PATH should be categorized as invalid if it's empty, contains an AS_SET or most recently added AS in the AS_PATH does not match the neighbor AS except if the AS performing the ASPA check is a route-server client. aspa_check() in nest/rt-table.c returns ASPA_INVALID for empty AS_PATH and for AS_PATH containing AS_SET. However, the enforce-first-as check is not performed.

I briefly tried to understand how such check could be added to aspa_check() in nest/rt-table.c, but there does not seem to be a simple and clean solution. However, I could be wrong here. It's trivial to get the leftmost AS number with as_path_get_first(), but the filter module does not seem to have access to peer AS number and doesn't know whether it's a route-server client.

As a workaround, one could use a function in filters and pass this information as function arguments, e.g:

function bgp_in(int peer_as; bool route_server_client) -> bool {

if ! route_server_client && bgp_path.first != peer_as then reject "Invalid left-most ASN ", bgp_path.first, ". Reject ", net;

...

};

.. but perhaps it's at least worth documenting it in "BIRD User's Guide" that the aspa_check_downstream(), aspa_check_upstream() and aspa_check() do not enforce first AS check. Especially as the "enforce first as" option under BGP configuration is off by default.

I tested on BIRD 3.2.1.

Martin