bug in NormalExpression evaluation with MPPRFX Objects

[Timo Koehler]

Hi Hagen,
I may give some answers based on my recent work in RtConfig.

 > recently I triggered a bug in the NormalExpression evaluation process of
 > RtConfig and peval. Starting RtConfig with the following command
 > 
 >     RtConfig -cisco_use_prefix_lists -cisco_empty_lists -h whois.ripe.net -protocol ripe
 > 
 > and then typing in
 > 
 >     RtConfig> NOT AS25152
 > 
 > leads to an empty prefix set:
 > 
 > Warning: filter "NOT AS25152" matches ANY/NOT ANY
 > !
 > no ip prefix-list pl100
 > ip prefix-list pl100 deny 0.0.0.0/0 le 32
 > 
 > But AS25152 is resolved to a relatively small route-set. Thus its complement
 > cannot be "NOT ANY"!
 > 
 > The bug shows up when a "NOT" is involved and we observed it in many regular
 > expressions.  
 > 
 > After some tests I found out that this seems to happen only in those cases
 > where RPSL objects are negated registering ipv4 as well as ipv6 prefixes.

I can not reproduce it but I wonder if the NormalTerm
which was supposed to include a ipv4 and ipv6 prfx_set
did actually have valid data for both. Since the
ipv6 part is missing in your output there must still be
_universal=1 in the ipv6_prfx_set. I guess root was 0x0. Maybe
you can you verify it.

 > 
 > Has anyone triggered this bug too?
 > 
 > When trailing the NormalExpression evaluation process in classes
 > NormalExpression, NormalTerm, FilterOfPrefix, SetOfPrefix, etc I found two
 > weird flags:
 > 
 >   "singleton_flag" from NormalExpression and
 >   "_universal" from SetOfPrefix and SetOfIPv6Prefix respectively.
 > 
 > I could not find any documentation for these flags nor do I have a clear idea
 > what was/is/should be the intention behind them.

singleton_flag is used as an index to the one out of the five
available filters, in case this nt has only one filter.  A
nice explanation can be found at the end of NE.cc I think. 

If there is a NOT term in the expression then at ne init, for
all nt's, _universal is set to one and singleton_flag = -1 in
become_universal(). The call stack is:
evaluate()
do_not()
become_universal()

If a filter is actually used then _universal is set to null.
 
The singleton_flag is used for example in cases where the
RtConfig output depends on the existence of a single
filter. 

For example if there is a single prfx_set or a single
ipv6_prfx_set then at evaluate() for AFIFilter, by calling
restrict() the multicast range is included in the unicast
range at the end of the filter. I came across this one when
looking at how NOT is resolved. This is a nice use case for
the singleton_flag. 

HTH,
 Timo