Skip to content

Changelog

All notable changes to RAVEN are recorded here.

Unreleased

Added

  • RTR anomaly detection: adaptive median/MAD-based detector for RTR sync telemetry (interval, duration, VRP/ASPA churn) with per-cache rolling baselines, hard-trip and correlated-trip classification.
  • Restart-safe baseline persistence via --anomaly-snapshot on raven rtr monitor — anomaly detector windows survive process restarts.
  • raven rtr seed-baseline command to seed a detector baseline from historical NDJSON telemetry, avoiding the ~25-hour warm-up window on every fresh deployment.
  • New Prometheus metrics: raven_rtr_anomaly_total, raven_rtr_anomaly_last_timestamp.
  • lab/04-rtr-anomaly.sh Containerlab demo scenario for live RTR anomaly detection (bulk SLURM ROA injection, serial-based confirmation).

Fixed

  • RTR anomaly detector no longer evaluates or contaminates its baseline with full (non-incremental) RTR syncs, which previously produced a false-positive high-severity anomaly on every raven rtr monitor startup.
  • Upstream ASPA verification (internal/validation/aspa) now checks the first hop of the AS_PATH — whether the immediate peer AS lists the monitoring router's own AS as an authorised provider. This check previously stopped one hop short, so a real route-propagation misconfiguration over a peering session without a matching ASPA provider entry resolved as ASPA:Unknown instead of ASPA:Invalid. Single-AS-path routes, previously short-circuited to Unknown with no check at all, are now actually evaluated.
  • Adds LocalASN to Route, learned per BMP session from the Peer Up message's Sent OPEN (RFC 6793 four-octet AS capability preferred when present) via new parseOpenLocalASN() in internal/bmp/parser.go. No config changes needed.

Changed

  • Any direct BGP session where the peer's ASPA record does not list the local AS as a provider now shows path-suspect for every prefix received over that session — not just customer-originated misannouncements, but connected-link and infrastructure prefixes too. This is correct per draft-ietf-sidrops-aspa-verification, not a regression; see Security Postures.

v0.3.3 (2026-07-02)

Added

  • RTR session telemetry: structured per-sync event capture (VRP/ASPA announced/withdrawn deltas, sync duration, interval between serial advances, sync type full vs incremental) wired into the RTR client at four points: session connect, EndOfData, PDUCacheReset, and PDUErrorReport. Events written as NDJSON and mirrored on a buffered channel for downstream consumers.
  • raven rtr monitor command: standalone RTR cache observer for baseline data collection and diagnostics. Config-file-free (flags only: --cache, --log-file, --transport, --prometheus). Graceful shutdown with bounded 70s grace period. Optional Prometheus endpoint. Useful for characterising normal RTR behaviour before deploying full RAVEN.
  • tls-min-version config option for RTR and BMP TLS transports. Accepts 1.2 or 1.3; defaults to TLS 1.2 minimum. Addresses operator transport security requirements (Orange/AS3215).

Fixed

  • RTR client: 65s read deadline with benign-timeout handling prevents shutdown from blocking indefinitely on idle caches while avoiding spurious reconnects on healthy sessions.
  • RTR client: proto version reset to configured starting version on each reconnect, preventing permanent version downgrade caused by transient errors during cache startup.
  • Telemetry event channel drained in standalone rtr monitor mode to prevent buffer fill and drop warnings during sustained reconnect loops.

Changed

  • Grafana: BGP Peers panel filtered to IPv4-only peers, height increased to accommodate IPv6 peer additions.

v0.3.2 (2026-06-16)

Fixed

  • Demo lab: all docker exec calls in demo-master.sh now use sudo (silent injection failures occurred when run without root)
  • Demo lab: setup() now injects LEAK-PREFIX prefix-list into running FRR containers via vtysh post-deploy; Containerlab mounts frr.conf but FRR does not reload on redeploy, causing the leak scenario to fail on cold start
  • Demo lab: Routinator 0.15.1 changed CLI syntax; --config flag must now be passed as a global flag before the subcommand (routinator -c ~/.routinator.conf server) not after it
  • Grafana: BGP Peers panel filtered to IPv4-only peers and panel height increased (IPv6 peer additions doubled tile count, causing overflow)

v0.3.1 (2026-06-08)

Added

  • IPv6 route monitoring via BMP (MP_REACH_NLRI / MP_UNREACH_NLRI parsing)
  • IPv6 ROV validation
  • IPv6 origin hijack scenario in demo lab (./demo-master.sh hijack6)
  • TLS support for BMP listener and RTR client; skip TCP buffer tuning (SetReadBuffer/SetWriteBuffer) for TLS connections (WSL2 compatibility)

Fixed

  • Demo lab: lacnic scenario 4 route leak used inline LEAK-INJECT route-map with wrong prepend ASN (AS64496 → ROV:Invalid); replaced with permanent ROUTE-LEAK route-map (prepend AS1199 → ROV:Valid, ASPA:Invalid, posture:path-suspect as intended)
  • Demo lab: leak and hijack6 vtysh commands converted to heredoc syntax (docker exec ... bash -c "vtysh << 'VTYSH' ... VTYSH") to fix silent failures caused by leading spaces in -c arguments
  • Demo lab: leak scenario prefix corrected to 193.0.0.0/21 (AS3333 / RIPE NCC); SLURM ASPA assertion added for AS3333 with provider AS1103 (excluding AS65000 to trigger path-suspect)

Changed

  • Demo lab internet router ASN changed from AS2121 to AS64496 to avoid spurious path-suspect at baseline caused by real-world RPKI/ASPA records for AS2121

v0.3.0 (2026-05-26)

Added

  • Event Engine: configurable triggers on posture changes (ROV state change, new route with specific posture, RTR cache failure) with webhook HTTP POST and file log actions
  • Flowspec lifecycle management: detect origin-invalid route → generate Flowspec rule → inject via GoBGP → monitor → expire after configurable TTL. Dry-run mode and approval webhook supported.
  • raven audit — full security posture report for a router: per-peer posture breakdown, ROV/ASPA coverage, recommendations. Outputs table, JSON, or markdown.
  • raven check stealthy — detect stealthy BGP hijacks by comparing BMP control-plane view against data-plane forwarding via probes
  • Warm-start persistence: snapshot route table and RPKI caches to disk on shutdown, restore on startup
  • OpenTelemetry OTLP metrics export alongside Prometheus
  • RTR-over-TLS: configure transport: tls and optional CA cert under any RTR cache entry
  • BMP listener TLS: optional TLS termination on the BMP listener with mutual TLS support
  • Event Engine ASN triggers: asn and protected_asn trigger types (contributed by Orange/AS3215)

Fixed

  • RTR rtr-version config field now correctly wired through to the client (was previously ignored)
  • TCP socket buffer tuning skipped for TLS connections (prevented TLS sessions from establishing on some platforms)

v0.2.0 (2026-05-18)

Added

  • ASPA path verification per draft-ietf-sidrops-aspa-verification-24
  • Combined security posture matrix: Secured / Origin-Only / Path-Suspect / Path-Only / Unverified / Origin-Invalid
  • ASPA store populated via RTR v2 ASPA PDUs; re-validation on ASPA store updates via dirty-set propagation
  • raven aspa — show ASPA records for an ASN
  • raven aspa recommend — suggest ASPA objects based on observed paths
  • raven what-if — simulate impact of reject-invalid or ASPA enforcement
  • raven watch — stream live validation state changes
  • Prometheus posture metrics reflect full ROV × ASPA matrix

v0.1.0 (2026-04-15)

Initial public release — Phase 1 (Foundation) complete.

BMP Ingest

  • Embedded BMP receiver (RFC 7854) on configurable TCP port (default: 11019)
  • Parses BGP UPDATE messages from BMP Route Monitoring PDUs
  • Supports Adj-RIB-In Pre-Policy, Post-Policy, and Loc-RIB
  • Per-session lifecycle management (Initiation, Peer Up/Down, Termination)

RPKI / RTR Client

  • RTR v1 (RFC 8210) and RTR v2 (draft-ietf-sidrops-8210bis) client
  • VRP store for Route Origin Validation
  • Multi-cache support with preference ordering and automatic failover
  • Re-validation on RPKI cache updates via dirty-set propagation

Validation Engine

  • Route Origin Validation (ROV) per RFC 6811: Valid / Invalid / NotFound

CLI

  • raven serve — start daemon
  • raven status — BMP peer and RTR cache health
  • raven peers — list BMP peers
  • raven routes — query route table with filters (prefix, origin-asn, peer, posture)
  • raven validate — one-shot prefix validation

Observability

  • Prometheus metrics endpoint (default: 9595)
  • Pre-built Grafana dashboards (Security Posture Overview, Per-Peer Deep Dive)

Demo Lab

  • Containerlab topology: internet AS64496 → upstream AS65000 → edge AS65001
  • Scripted demo scenarios: origin hijack, route leak