v0.23.0

Faster and safer: bgpipe moves to bgpfix v0.23.0, gets secure defaults for every network-facing stage, and adds route policy actions, readiness checks, and config files. Upgrading is strongly recommended, especially if bgpipe talks to untrusted peers or consumes public feeds (RIS Live, RouteViews).

Performance

• ~1.5x faster end-to-end: MRT to JSON at ~1M messages/s on one box (860k UPDATEs in 0.85 s, was 1.29 s), with 35% less CPU
• bgpfix v0.23.0: UPDATE parsing in ~175 ns with zero allocations (was ~345 ns), parse + JSON in ~445 ns (was ~815 ns), and msg.Msg shrinks from 9112 to 440 bytes
• Buffered output: write, stdout, exec, and pipe flush when idle instead of one syscall per message - a RIB (2.07M messages) to JSON went from 6.2 s to 1.7 s wall time, and from 7.4 s to 1.4 s system time
• Truly transparent tagging: rov, aspa, and tag no longer re-encode every UPDATE just to update tags - unmodified messages keep their original wire bytes

Security

• Remote crash fixes (bgpfix): a malformed FlowSpec NLRI or FQDN capability - from a peer, or from any RIS Live / RouteViews peer - could crash bgpipe; parser panics are now errors
• AS4_PATH spoofing (bgpfix): ROV and ASPA could see a different origin than the router behind bgpipe
• Capability race (bgpfix): UPDATEs right after the session came up were parsed without the negotiated capabilities (eg. ADD-PATH), and dropped or misread
• websocket --listen requires --auth (or an explicit --open): before, anyone could read the feed and inject UPDATEs into a live session
• Slow clients can't stall a session: each websocket server client gets its own queue and a write deadline, and is disconnected when it falls behind
• listen --peer allow-list (CSV of IPs and prefixes): no more "whoever connects first becomes the peer"
• RPKI over HTTPS by default: Cloudflare's rpki-client export (with ASPA) instead of plaintext RTR; bgpipe warns about unencrypted RPKI sources across the Internet
• ASPA: --role is required (auto lets the validated peer choose its own procedure, now documented), an empty AS_PATH is INVALID per draft-29, and the logic is tested against all 25 examples published with the draft
• No session resets from edits: update turns an UPDATE that grew past the negotiated maximum size into a withdrawal
• Secrets: --md5 accepts $ENV or a file; --auth / --http-auth take user:pass, $ENV, or a file path
• Robustness: read URLs time out on dead servers, exec no longer stalls on long stderr lines, and write-only stages ignore client input (was a nil dereference)

New

• Route policy in update: --prepend, --prepend-first, --strip-private, --del-com / --del-com-large patterns, --set-med / --drop-med, --set-localpref, --set-origin, --drop-attr
• Config files: bgpipe -f edge.conf - CLI syntax, # comments, one stage per line (docs)
• /ready readiness endpoint: 200 once the session is established and RPKI data loaded (docs)
• Exit codes: 0 ok, 1 runtime error, 2 configuration error, 3 killed by --kill - eg. RestartPreventExitStatus=2 in systemd
• NOTIFY messages are logged by default, with decoded code, subcode, and JSON
• --explain shows which stages parse messages and which are copy taps; no ANSI colors when not a terminal (NO_COLOR honored)
• Fixed: websocket, exec, and pipe with --write or --read in the middle of a pipeline
• Docs: new examples (edge firewall in a config file, route policy, NOC tap), every documented command checked with bgpipe -n

Breaking changes

• websocket --listen needs --auth or --open
• aspa needs --role
• the default --rpki is https://rpki.cloudflare.com/rpki.json (was plaintext RTR rtr.rpki.cloudflare.com:8282)
• --auth / --http-auth: a value without a colon is read as a file path
• ASPA: announcements with an empty AS_PATH are INVALID
• configuration errors exit with code 2 (was 1)

What's Changed

• Faster and safer: bgpfix v0.23.0, secure defaults, route policy, config files by @pforemski in #41

Full Changelog: v0.22.1...v0.23.0