v0.23.0

Security hardening release: all parsers are now fuzzed, and several remotely triggerable crashes and RPKI/ASPA bypasses are fixed. Upgrading is strongly recommended for anyone parsing BGP from untrusted peers or public feeds (RIS Live, RouteViews).

Security fixes

• Remote crashes on malformed input: a truncated FlowSpec NLRI (nlri) and an OPEN with a FQDN capability lacking the domain length (caps) panicked the process - any peer, or for collector feeds any RIS/RouteViews peer, could crash it. As defense in depth, msg.Parse now turns a parser panic into an error (~1 ns/msg).
• AS4_PATH spoofing: Update.AsPath() merged AS4_PATH even on 4-byte AS sessions, where RFC 6793 says to ignore it, so a peer could make ROV, ASPA, and filters see a different origin than the router. New Aspath.As2 field; paths read from JSON never merge AS4_PATH.
• Capability negotiation race: UPDATEs right behind the session-establishing KEEPALIVE were parsed with pre-negotiation capabilities (eg. no ADD-PATH), and dropped or misparsed into different prefixes. The pipe now waits for the negotiation (up to 1 s).
• RPKI fails closed: rpki.Cache.Parse returns an error instead of publishing an empty VRP/ASPA set, eg. from an HTML error page.
• Bounded memory: MRT records are capped at 16 MiB (mrt.MAXLEN), BMP messages at 1 MiB (bmp.MAXLEN).
• RTR: ASPA announcements without providers are ignored (they would act as an AS0 ASPA, invalidating all paths through that AS).
• filter: dangling &&, ||, !, empty community values, and some malformed timestamps panicked; now they are parse errors.

Correctness

• AS_PATH segments longer than 255 ASNs are split on Marshal; AS_SETs longer than 255 are rejected by FromJSON
• IPv6 FlowSpec prefix offsets: fixed the Marshal length and the Unmarshal carry bits
• ExtNH capability: fixed an off-by-one when chunking more than 42 tuples
• JSON round trips: unassigned AFI/SAFI (AFI(n)) and unknown FlowSpec components (FlowType(n)) now parse back; NaN/Inf traffic rates are quoted (were invalid JSON)
• ASPA: rpki.VerifyPath is tested against all 25 examples published with draft-ietf-sidrops-aspa-verification-29
• RPKI parsing logs the first invalid entry and a total, not one warning per entry

New

• NOTIFY decoding: Msg.Notify(), Msg.NotifyText() (RFC 9003 shutdown communication), msg.NotifyName(), JSON objects, and pipe.EVENT_NOTIFY
• Msg.DropJSON(): refresh the JSON after tag changes, without re-marshaling the wire bytes
• afi.ParseAFI() and afi.ParseSAFI()
• Fuzz targets for all parsers (wire, JSON round trip, OPEN/capabilities, MRT, BMP, ExaBGP, filters, RTR, RPKI); seeds and past crashers run as regular tests: go test ./msg -run XXX -fuzz FuzzMsgWire

Performance

• Sparse Attrs: msg.Msg shrinks from 9112 to 440 bytes
• Zero-allocation parse and JSON paths, faster JSON timestamps and attribute names
• io.Copy from a pipe.Line now uses the batched Line.Read

Breaking changes

• Update.AsPath() ignores AS4_PATH unless AS_PATH was 2-byte on the wire
• mrt.MAXLEN is 16 MiB (was 4 GiB): longer records are errors
• pipe.Line.WriteTo was removed
• filter: dangling &&, ||, ! are parse errors
• rpki.Cache.Parse returns an error on data without any VRP or ASPA record

What's Changed

• Security hardening, fuzzing, NOTIFY decoding, leaner messages by @pforemski in #27

Full Changelog: v0.22.1...v0.23.0