policy, fib: blackhole routing for routes with the BLACKHOLE community

Before this change, a route carrying the BLACKHOLE community (65535:666,
RFC 7999) from an EBGP neighbor was always rejected with the reason
"blackhole request", and nothing discarded traffic. A customer under a
denial-of-service attack had no way to ask this router to drop traffic
to an address.

This change adds `accept_blackholes` to the import policy. When it is
set, a route with the BLACKHOLE community is accepted if:

* its prefix is a single address, a /32 or a /128 (otherwise it is
  rejected with the new reason "blackhole for more than one address");
  the `max_ipv4_prefix_length` and `max_ipv6_prefix_length` limits do
  not apply, as RFC 7999 section 3.2 recommends;
* the address is inside a prefix the neighbor may announce, if
  `prefixes` is configured, regardless of the entry's `max_length`
  (new `PrefixSet::covers`); without a prefix list, an address inside
  the local AS's own prefixes is rejected as before ("prefix is our
  own");
* the AS path, origin and RPKI checks that apply to every route pass.

The next hop of an accepted blackhole route is not checked for
third-party addresses and is not resolved, because traffic is never
forwarded to it. The route takes part in best path selection as usual;
a host route is normally the active route for its address.

The kernel task installs the active route as a kernel blackhole route
(`RTN_BLACKHOLE`, shown by `ip route` as `blackhole PREFIX proto bgp`).
Blackhole routes left by an earlier run are adopted at startup like
other routes of ours. The route is advertised to other neighbors as the
export policy and export limits permit, with the community intact, so a
provider that honors BLACKHOLE can discard the traffic upstream.

Implementation:

* `plan::Target` becomes an enum: `Via { gateway, interface }` or
  `Discard`. `plan::resolve` takes a `blackhole` flag and returns
  `Discard` for such routes without looking at the next hop (the
  own-network check still applies). No nexthop object is made for a
  discard target.
* `AttrSet::is_blackhole` reads the community off the stored attribute
  bytes, like `next_hop` and `as_path`, so the kernel task, the
  revalidator and the RPKI revalidation can ask it of every route.
* `ImportPolicy::is_blackhole_request` and `check_blackhole_prefix`
  carry the import side; the import flow (`routes.rs`) computes once per
  UPDATE whether its routes are an accepted blackhole request and skips
  the next hop checks for them.
* `Status::blackholes` and the `blackholes` field of `/api/kernel` count
  the installed blackhole routes; the status page shows the count next
  to the installed routes.

Not covered: a prefix this router originates with the BLACKHOLE
community is advertised but not installed as a blackhole route. The
documentation says to add a kernel blackhole route by hand for that
case.

Documentation: the "Blackhole Routes" section of the import policy
guide replaces "Blackhole Requests", the kernel guide gains a "Blackhole
Routes" section, the configuration reference describes
`accept_blackholes`, the HTTP API reference describes `blackholes`, and
the RFC 7999 rows of the standards reference are updated.

Testing: unit tests for the attribute check, the prefix checks and the
plan; integration tests that a blackhole request is refused by default
and, with `accept_blackholes`, taken for one address inside the peer's
space and refused otherwise, with the recorded reasons; a kernel test
that a blackhole request becomes a kernel blackhole route whatever its
next hop, is removed on withdrawal and is adopted after a restart. The
existing kernel tests, the interoperability lab and the workspace tests
pass.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

crates/fib/src/kernel.rs

@@ -24,7 +24,8 @@ use tracing::{debug, info, warn};
 
 use crate::interfaces::Interfaces;
 use crate::netlink::{
-    self, Change, Dump, KIND_UNICAST, Message, PROTOCOL_BGP, Route, decode, group,
+    self, Change, Dump, KIND_BLACKHOLE, KIND_UNICAST, KIND_UNSPEC, Message, PROTOCOL_BGP, Route,
+    decode, group,
 };
 use crate::plan::{
     HashMap as FastHashMap, Neighbor, Op, Plan, Target, Unresolved, resolve_next_hop,
@@ -444,6 +445,8 @@ enum News {
         prefix: IpPrefix,
         peer: PeerIndex,
         next_hop: Option<NlriNextHop>,
+        /// Whether the route asks for its packets to be dropped.
+        blackhole: bool,
     },
     Withdrawn(IpPrefix),
     Synced,
@@ -539,7 +542,7 @@ impl Task {
                         && let (Some(gateway), Some(interface)) =
                             (nexthop.gateway, nexthop.interface)
                     {
-                        by_id.insert(nexthop.id, Target { gateway, interface });
+                        by_id.insert(nexthop.id, Target::Via { gateway, interface });
                     }
                 }
             })
@@ -642,8 +645,9 @@ impl Task {
                     nexthops.get(&id).copied()
                 }
                 (None, Some(gateway), Some(interface)) if route.kind == KIND_UNICAST => {
-                    Some(Target { gateway, interface })
+                    Some(Target::Via { gateway, interface })
                 }
+                (None, None, _) if route.kind == KIND_BLACKHOLE => Some(Target::Discard),
                 _ => None,
             };
             self.plan.adopt(route.prefix, target, keep);
@@ -661,6 +665,9 @@ impl Task {
         if let Some(id) = known.get(&target) {
             return Ok(Ok(*id));
         }
+        let Target::Via { gateway, interface } = target else {
+            unreachable!("a route that discards names no nexthop object");
+        };
         // One at a time, and waited for: there is one for each neighbor,
         // not for each route, and a route must not name one that is not
         // there yet.
@@ -669,7 +676,7 @@ impl Task {
             .control
             .ask(
                 |out, sequence| {
-                    netlink::nexthop_request(out, sequence, &target.gateway, target.interface);
+                    netlink::nexthop_request(out, sequence, &gateway, interface);
                 },
                 |message| {
                     if let Message::Nexthop {
@@ -684,7 +691,7 @@ impl Task {
             .await?;
         Ok(match (errno, made) {
             (0, Some(id)) => {
-                debug!(id, gateway = %target.gateway, "Made a nexthop object");
+                debug!(id, %gateway, "Made a nexthop object");
                 self.owned.insert(id);
                 if let Some(known) = &mut self.nexthops {
                     known.insert(target, id);
@@ -711,16 +718,29 @@ impl Task {
             kind: KIND_UNICAST,
         };
         let change = match op {
-            Op::Remove { .. } => Change::Remove,
+            // Whatever kind of route of ours there is for the prefix: the
+            // kernel removes a route of the kind asked for only, and a
+            // blackhole is not a unicast route.
+            Op::Remove { .. } => {
+                route.kind = KIND_UNSPEC;
+                Change::Remove
+            }
+            Op::Install {
+                target: Target::Discard,
+                ..
+            } => {
+                route.kind = KIND_BLACKHOLE;
+                Change::Replace
+            }
             Op::Install { target, .. } => {
                 if self.nexthops.is_some() {
                     match self.nexthop(*target).await? {
                         Ok(id) => route.nexthop = Some(id),
                         Err(errno) => return Ok(Err(errno)),
                     }
-                } else {
-                    route.gateway = Some(target.gateway);
-                    route.interface = Some(target.interface);
+                } else if let Target::Via { gateway, interface } = target {
+                    route.gateway = Some(*gateway);
+                    route.interface = Some(*interface);
                 }
                 Change::Replace
             }
@@ -789,14 +809,20 @@ impl Task {
         }
         let error = io::Error::from_raw_os_error(errno);
         let what = match op {
-            Op::Install { prefix, target } => format!(
-                "install {prefix} via {} on {}",
-                target.gateway,
-                self.topology.interfaces.link(target.interface).map_or_else(
-                    || format!("interface {}", target.interface),
+            Op::Install {
+                prefix,
+                target: Target::Via { gateway, interface },
+            } => format!(
+                "install {prefix} via {gateway} on {}",
+                self.topology.interfaces.link(*interface).map_or_else(
+                    || format!("interface {interface}"),
                     |link| link.name.clone()
                 )
             ),
+            Op::Install {
+                prefix,
+                target: Target::Discard,
+            } => format!("install a blackhole for {prefix}"),
             Op::Remove { prefix } => format!("remove {prefix}"),
         };
         // Counted always, said out loud once in a while: a table's worth
@@ -836,6 +862,7 @@ impl Task {
                     prefix,
                     peer,
                     next_hop: attrs.next_hop(),
+                    blackhole: attrs.is_blackhole(),
                 },
                 Event::Withdrawn { prefix } => News::Withdrawn(prefix),
                 // Not given to a follower of the best routes.
@@ -858,6 +885,7 @@ impl Task {
                     prefix,
                     peer,
                     next_hop,
+                    blackhole,
                 } => {
                     // Whose link a link-local next hop is on is asked only
                     // where there is one.
@@ -877,6 +905,8 @@ impl Task {
                     // next hop: it is about the prefix.
                     let target = if topology.interfaces.has_network_around(&prefix) {
                         Err(Unresolved::OwnNetwork)
+                    } else if blackhole {
+                        Ok(Target::Discard)
                     } else {
                         *self
                             .resolved
@@ -1075,6 +1105,7 @@ impl Task {
             status.synced = self.synced;
             status.installed = self.plan.installed();
             status.kept = if self.keeping { self.plan.kept() } else { 0 };
+            status.blackholes = self.plan.blackholes();
             status.refused = self.plan.refused();
             status.unresolved = self
                 .plan

crates/fib/src/lib.rs

@@ -139,6 +139,9 @@ pub struct Status {
     /// How many of them are kept from an earlier run though the routing
     /// table does not have them (yet); see [`FibConfig::stale_time`].
     pub kept: usize,
+    /// How many of them are blackhole routes, which drop the packets for
+    /// their prefix.
+    pub blackholes: usize,
     /// Prefixes whose best route is not in the kernel because its next
     /// hop is not usable, by why.
     pub unresolved: Vec<(&'static str, usize)>,

crates/fib/src/netlink.rs

@@ -23,7 +23,11 @@ pub const TABLE_MAIN: u32 = 254;
 
 /// A route that forwards to a gateway or out of an interface
 /// (`RTN_UNICAST`), as opposed to one that drops, say.
+/// `RTN_UNSPEC`: in a request to remove a route, a route of any kind.
+pub const KIND_UNSPEC: u8 = 0;
 pub const KIND_UNICAST: u8 = 1;
+/// `RTN_BLACKHOLE`: a route that discards the packets for its prefix.
+pub const KIND_BLACKHOLE: u8 = 6;
 
 const HEADER_LEN: usize = 16;
 

crates/fib/src/plan.rs

@@ -18,10 +18,16 @@ pub(crate) type HashSet<K> = std::collections::HashSet<K, foldhash::fast::Random
 
 /// Where the kernel is to send packets for a prefix.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
-pub struct Target {
-    pub gateway: IpAddr,
-    /// The index of the interface the gateway is on.
-    pub interface: u32,
+pub enum Target {
+    /// To a gateway, out of an interface.
+    Via {
+        gateway: IpAddr,
+        /// The index of the interface the gateway is on.
+        interface: u32,
+    },
+    /// Nowhere: the packets are dropped. For a route that asks for that
+    /// with the BLACKHOLE community (RFC 7999).
+    Discard,
 }
 
 /// Why a route's next hop is not something the kernel can be given.
@@ -105,7 +111,9 @@ impl From<IpAddr> for Neighbor {
 }
 
 /// Works out where the kernel is to send packets for a route to `prefix`
-/// with the next hop `next_hop`, learned from `peer`.
+/// with the next hop `next_hop`, learned from `peer`. `blackhole` says
+/// the route asks for its packets to be dropped (the BLACKHOLE community,
+/// RFC 7999): then they go nowhere, and the next hop is not looked at.
 ///
 /// A next hop that is a neighbor on one of our interfaces is where the
 /// packets go. One that is not is looked up in the kernel's own routes,
@@ -118,10 +126,14 @@ pub fn resolve(
     prefix: &IpPrefix,
     next_hop: Option<&NlriNextHop>,
     peer: Option<Neighbor>,
+    blackhole: bool,
 ) -> Result<Target, Unresolved> {
     if topology.interfaces.has_network_around(prefix) {
         return Err(Unresolved::OwnNetwork);
     }
+    if blackhole {
+        return Ok(Target::Discard);
+    }
     resolve_next_hop(topology, prefix.address_family(), next_hop, peer)
 }
 
@@ -168,7 +180,7 @@ fn through_routes(
     if routes == IpVersion::Ipv6 && gateway.is_ipv4() {
         return Err(Unresolved::NoRoute);
     }
-    Ok(Target { gateway, interface })
+    Ok(Target::Via { gateway, interface })
 }
 
 /// The part of [`resolve`] that is the same for every route of IP version
@@ -198,7 +210,7 @@ pub fn resolve_next_hop(
             return Err(Unresolved::Ourselves);
         }
         match interfaces.connected(gateway) {
-            Some(connected) => Ok(Target {
+            Some(connected) => Ok(Target::Via {
                 gateway,
                 interface: connected.interface,
             }),
@@ -226,7 +238,7 @@ pub fn resolve_next_hop(
         {
             return Err(Unresolved::Ourselves);
         }
-        Ok(Target {
+        Ok(Target::Via {
             gateway: gateway.into(),
             interface,
         })
@@ -313,6 +325,14 @@ impl Plan {
         self.installed.len()
     }
 
+    /// How many of the routes the kernel has drop their packets.
+    pub fn blackholes(&self) -> usize {
+        self.installed
+            .values()
+            .filter(|entry| entry.target == Some(Target::Discard))
+            .count()
+    }
+
     /// How many prefixes have a best route that could not be given to the
     /// kernel for want of a usable next hop.
     pub fn unresolved(&self) -> usize {
@@ -507,7 +527,7 @@ mod tests {
     }
 
     fn target(gateway: &str, interface: u32) -> Target {
-        Target {
+        Target::Via {
             gateway: gateway.parse().unwrap(),
             interface,
         }
@@ -575,16 +595,16 @@ mod tests {
         let v6_hop = |s: &str| NlriNextHop::Ipv6(s.parse().unwrap());
 
         assert_eq!(
-            resolve(&interfaces, &v4, Some(&v4_hop("192.0.2.2")), peer),
+            resolve(&interfaces, &v4, Some(&v4_hop("192.0.2.2")), peer, false),
             Ok(target("192.0.2.2", 2))
         );
         // A neighbor other than the peer: a route server's routes.
         assert_eq!(
-            resolve(&interfaces, &v4, Some(&v4_hop("198.51.100.9")), peer),
+            resolve(&interfaces, &v4, Some(&v4_hop("198.51.100.9")), peer, false),
             Ok(target("198.51.100.9", 3))
         );
         assert_eq!(
-            resolve(&interfaces, &v6, Some(&v6_hop("2001:db8::2")), peer),
+            resolve(&interfaces, &v6, Some(&v6_hop("2001:db8::2")), peer, false),
             Ok(target("2001:db8::2", 2))
         );
         for (hop, why) in [
@@ -592,10 +612,13 @@ mod tests {
             (Some(v4_hop("192.0.2.1")), Unresolved::Ourselves),
             (None, Unresolved::Missing),
         ] {
-            assert_eq!(resolve(&interfaces, &v4, hop.as_ref(), peer), Err(why));
+            assert_eq!(
+                resolve(&interfaces, &v4, hop.as_ref(), peer, false),
+                Err(why)
+            );
         }
         assert_eq!(
-            resolve(&interfaces, &v6, Some(&v4_hop("192.0.2.2")), peer),
+            resolve(&interfaces, &v6, Some(&v4_hop("192.0.2.2")), peer, false),
             Err(Unresolved::OtherFamily)
         );
         // A route for part of a network we are on is not for the kernel,
@@ -612,7 +635,7 @@ mod tests {
                 IpVersion::Ipv6 => v6_hop("2001:db8::2"),
             };
             assert_eq!(
-                resolve(&interfaces, &ours, Some(&hop), peer),
+                resolve(&interfaces, &ours, Some(&hop), peer, false),
                 Err(Unresolved::OwnNetwork),
                 "{ours}"
             );
@@ -622,14 +645,15 @@ mod tests {
                 &interfaces,
                 &prefix("192.0.0.0/22"),
                 Some(&v4_hop("192.0.2.2")),
-                peer
+                peer,
+                false
             ),
             Ok(target("192.0.2.2", 2))
         );
         // An IPv4 route by way of an IPv6 neighbor: a link with only IPv6
         // addresses (RFC 8950).
         assert_eq!(
-            resolve(&interfaces, &v4, Some(&v6_hop("2001:db8::2")), peer),
+            resolve(&interfaces, &v4, Some(&v6_hop("2001:db8::2")), peer, false),
             Ok(target("2001:db8::2", 2))
         );
         assert_eq!(
@@ -641,6 +665,7 @@ mod tests {
                     link_local: "fe80::2".parse().unwrap(),
                 }),
                 Some(neighbor("2001:db8::2")),
+                false
             ),
             Ok(target("fe80::2", 2))
         );
@@ -658,26 +683,44 @@ mod tests {
         };
         // The global address is a neighbor: it is used.
         assert_eq!(
-            resolve(&interfaces, &v6, Some(&both("2001:db8::2")), peer),
+            resolve(&interfaces, &v6, Some(&both("2001:db8::2")), peer, false),
             Ok(target("2001:db8::2", 2))
         );
         // It is not: the link-local one, on the interface the peer is on.
         assert_eq!(
-            resolve(&interfaces, &v6, Some(&both("2001:db8:ffff::2")), peer),
+            resolve(
+                &interfaces,
+                &v6,
+                Some(&both("2001:db8:ffff::2")),
+                peer,
+                false
+            ),
             Ok(target("fe80::2", 2))
         );
         assert_eq!(
-            resolve(&interfaces, &v6, Some(&NlriNextHop::Ipv6(link_local)), peer),
+            resolve(
+                &interfaces,
+                &v6,
+                Some(&NlriNextHop::Ipv6(link_local)),
+                peer,
+                false
+            ),
             Ok(target("fe80::2", 2))
         );
         // A peer that is not a neighbor says nothing about the link.
         let far = Some(neighbor("2001:db8:ffff::9"));
         assert_eq!(
-            resolve(&interfaces, &v6, Some(&NlriNextHop::Ipv6(link_local)), far),
+            resolve(
+                &interfaces,
+                &v6,
+                Some(&NlriNextHop::Ipv6(link_local)),
+                far,
+                false
+            ),
             Err(Unresolved::NoRoute)
         );
         assert_eq!(
-            resolve(&interfaces, &v6, Some(&both("2001:db8::1")), peer),
+            resolve(&interfaces, &v6, Some(&both("2001:db8::1")), peer, false),
             Err(Unresolved::Ourselves)
         );
     }
@@ -722,7 +765,7 @@ mod tests {
             for interface in [2, 3] {
                 for route in [&v4, &v6] {
                     assert_eq!(
-                        resolve(&interfaces, route, Some(&next_hop), on(interface)),
+                        resolve(&interfaces, route, Some(&next_hop), on(interface), false),
                         Ok(target("fe80::2", interface)),
                         "{next_hop:?} on {interface}"
                     );
@@ -730,24 +773,24 @@ mod tests {
             }
             // An interface that is not there, or is down.
             assert_eq!(
-                resolve(&interfaces, &v6, Some(&next_hop), on(9)),
+                resolve(&interfaces, &v6, Some(&next_hop), on(9), false),
                 Err(Unresolved::NoRoute)
             );
         }
         // Our own address on that link, which on another is a neighbor's.
         let ours = NlriNextHop::Ipv6("fe80::a".parse().unwrap());
         assert_eq!(
-            resolve(&interfaces, &v6, Some(&ours), on(2)),
+            resolve(&interfaces, &v6, Some(&ours), on(2), false),
             Err(Unresolved::Ourselves)
         );
         assert_eq!(
-            resolve(&interfaces, &v6, Some(&ours), on(3)),
+            resolve(&interfaces, &v6, Some(&ours), on(3), false),
             Ok(target("fe80::a", 3))
         );
         // A global next hop on such a session is looked up as any other.
         let global = NlriNextHop::Ipv6("2001:db8::2".parse().unwrap());
         assert_eq!(
-            resolve(&interfaces, &v6, Some(&global), on(3)),
+            resolve(&interfaces, &v6, Some(&global), on(3), false),
             Ok(target("2001:db8::2", 2))
         );
     }
@@ -767,7 +810,7 @@ mod tests {
 
         // Nothing says the way.
         assert_eq!(
-            resolve(&topology, &v4, Some(&far), peer),
+            resolve(&topology, &v4, Some(&far), peer, false),
             Err(Unresolved::NoRoute)
         );
         // The default route does not count unless asked for.
@@ -776,12 +819,12 @@ mod tests {
             kernel_route("0.0.0.0/0", Some("192.0.2.254"), Some(2)),
         );
         assert_eq!(
-            resolve(&topology, &v4, Some(&far), peer),
+            resolve(&topology, &v4, Some(&far), peer, false),
             Err(Unresolved::OnlyDefault)
         );
         topology.via_default = true;
         assert_eq!(
-            resolve(&topology, &v4, Some(&far), peer),
+            resolve(&topology, &v4, Some(&far), peer, false),
             Ok(target("192.0.2.254", 2))
         );
         topology.via_default = false;
@@ -791,7 +834,7 @@ mod tests {
             kernel_route("10.9.0.0/16", Some("198.51.100.9"), Some(3)),
         );
         assert_eq!(
-            resolve(&topology, &v4, Some(&far), peer),
+            resolve(&topology, &v4, Some(&far), peer, false),
             Ok(target("198.51.100.9", 3))
         );
         // A more specific route onto an interface, as a tunnel's is: the
@@ -806,7 +849,7 @@ mod tests {
         });
         with_route(&mut topology, kernel_route("10.9.9.0/24", None, Some(7)));
         assert_eq!(
-            resolve(&topology, &v4, Some(&far), peer),
+            resolve(&topology, &v4, Some(&far), peer, false),
             Ok(target("10.9.9.9", 7))
         );
         // The tunnel goes down: the kernel keeps such routes, we do not
@@ -820,7 +863,7 @@ mod tests {
             },
         });
         assert_eq!(
-            resolve(&topology, &v4, Some(&far), peer),
+            resolve(&topology, &v4, Some(&far), peer, false),
             Err(Unresolved::NoRoute)
         );
         // A route that names a nexthop object goes where the object says.
@@ -832,7 +875,7 @@ mod tests {
             },
         );
         assert_eq!(
-            resolve(&topology, &v4, Some(&far), peer),
+            resolve(&topology, &v4, Some(&far), peer, false),
             Err(Unresolved::NoRoute),
             "an object the kernel has not told of"
         );
@@ -846,7 +889,7 @@ mod tests {
             },
         });
         assert_eq!(
-            resolve(&topology, &v4, Some(&far), peer),
+            resolve(&topology, &v4, Some(&far), peer, false),
             Ok(target("192.0.2.77", 2))
         );
         // A route that discards packets is a way to nowhere.
@@ -858,7 +901,7 @@ mod tests {
             },
         );
         assert_eq!(
-            resolve(&topology, &v4, Some(&far), peer),
+            resolve(&topology, &v4, Some(&far), peer, false),
             Err(Unresolved::Discarded)
         );
         // Routes of BGP's never say the way, be the prefix ever so long.
@@ -878,7 +921,7 @@ mod tests {
             kernel_route("2001:db8:9::/48", Some("198.51.100.9"), Some(3)),
         );
         assert_eq!(
-            resolve(&topology, &v6, Some(&v6_hop("2001:db8:9::9")), peer),
+            resolve(&topology, &v6, Some(&v6_hop("2001:db8:9::9")), peer, false),
             Err(Unresolved::NoRoute)
         );
         with_route(
@@ -886,11 +929,11 @@ mod tests {
             kernel_route("2001:db8:9::/48", Some("2001:db8::9"), Some(2)),
         );
         assert_eq!(
-            resolve(&topology, &v6, Some(&v6_hop("2001:db8:9::9")), peer),
+            resolve(&topology, &v6, Some(&v6_hop("2001:db8:9::9")), peer, false),
             Ok(target("2001:db8::9", 2))
         );
         assert_eq!(
-            resolve(&topology, &v4, Some(&v6_hop("2001:db8:9::9")), peer),
+            resolve(&topology, &v4, Some(&v6_hop("2001:db8:9::9")), peer, false),
             Ok(target("2001:db8::9", 2))
         );
         // A neighbor is a neighbor, whatever the routes say.
@@ -899,11 +942,51 @@ mod tests {
             kernel_route("192.0.2.2/32", Some("198.51.100.9"), Some(3)),
         );
         assert_eq!(
-            resolve(&topology, &v4, Some(&v4_hop("192.0.2.2")), peer),
+            resolve(&topology, &v4, Some(&v4_hop("192.0.2.2")), peer, false),
             Ok(target("192.0.2.2", 2))
         );
     }
 
+    /// A route that asks for its packets to be dropped goes nowhere,
+    /// whatever its next hop; one for a network of ours does not.
+    #[test]
+    fn a_blackhole_route_resolves_to_nowhere() {
+        let topology = interfaces();
+        let far = NlriNextHop::Ipv4("10.9.9.9".parse().unwrap());
+        let peer = Some(neighbor("192.0.2.2"));
+        assert_eq!(
+            resolve(
+                &topology,
+                &prefix("203.0.113.9/32"),
+                Some(&far),
+                peer,
+                false
+            ),
+            Err(Unresolved::NoRoute)
+        );
+        assert_eq!(
+            resolve(&topology, &prefix("203.0.113.9/32"), Some(&far), peer, true),
+            Ok(Target::Discard)
+        );
+        assert_eq!(
+            resolve(&topology, &prefix("203.0.113.9/32"), None, peer, true),
+            Ok(Target::Discard)
+        );
+        assert_eq!(
+            resolve(&topology, &prefix("192.0.2.9/32"), Some(&far), peer, true),
+            Err(Unresolved::OwnNetwork)
+        );
+        let mut plan = Plan::default();
+        assert_eq!(
+            plan.best(prefix("203.0.113.9/32"), Ok(Target::Discard)),
+            Some(Op::Install {
+                prefix: prefix("203.0.113.9/32"),
+                target: Target::Discard
+            })
+        );
+        assert_eq!((plan.installed(), plan.blackholes()), (1, 1));
+    }
+
     #[test]
     fn the_kernel_is_asked_only_for_what_changes() {
         let mut plan = Plan::default();
@@ -1087,7 +1170,7 @@ mod tests {
         #[test]
         fn the_kernel_ends_up_with_the_best_routes_that_resolve(
             left_behind in proptest::collection::vec((0u8..16, 0u8..3), 0..6),
-            steps in proptest::collection::vec(any_step(), 0..60),
+            steps in proptest::collection::vec(any_step(), 0..60)
         ) {
             let p = |n: u8| IpPrefix::new(IpVersion::Ipv4, [10, n, 0, 0], 16).unwrap();
             let t = |n: u8| target(&format!("192.0.2.{}", n + 2), 2);

crates/fib/tests/kernel.rs

@@ -15,8 +15,8 @@ use std::time::{Duration, Instant};
 
 use bgp_fib::{Fib, FibConfig, FibError};
 use bgp_packet::message::{
-    AsPathAttribute, MultiExitDiscPathAttribute, NextHopPathAttribute, NlriNextHop,
-    OriginPathAttribute, PathAttribute,
+    AsPathAttribute, CommunitiesPathAttribute, MultiExitDiscPathAttribute, NextHopPathAttribute,
+    NlriNextHop, OriginPathAttribute, PathAttribute,
 };
 use bgp_primitives::ip_prefix::IpPrefix;
 use bgp_rib::table::{AttrSet, PeerIndex, PeerInfo, RibTable};
@@ -499,6 +499,65 @@ async fn a_far_next_hop_goes_the_way_the_kernels_routes_say() {
     machine.kernel_becomes(&[]);
 }
 
+/// A route that asks for its packets to be dropped goes into the kernel
+/// as a blackhole route, whatever its next hop, and comes out again with
+/// the request.
+#[tokio::test(flavor = "multi_thread")]
+#[ignore = "changes the machine's routes; run scripts/kernel-tests.sh"]
+async fn a_blackhole_request_becomes_a_blackhole_route() {
+    let machine = Machine::new(13);
+    let peer = machine.peer(2);
+    // Asked for from a next hop nothing is a neighbor of, and with one
+    // ordinary route beside it to show the two apart.
+    let mut attributes = vec![
+        PathAttribute::Origin(OriginPathAttribute::IGP),
+        AsPathAttribute::from_asns(vec![65002]),
+        PathAttribute::NextHop(NextHopPathAttribute(Ipv4Addr::new(172, 31, 11, 9))),
+        PathAttribute::Communities(CommunitiesPathAttribute(vec![(65002, 1), (0xFFFF, 0x029A)])),
+    ];
+    let blackhole = machine.rib.attrs().intern(&attributes, None).unwrap();
+    attributes.pop();
+    attributes.push(PathAttribute::Communities(CommunitiesPathAttribute(vec![
+        (65002, 1),
+    ])));
+    let plain = machine.rib.attrs().intern(&attributes, None).unwrap();
+    machine.rib.announce(
+        peer,
+        &blackhole,
+        &[prefix("203.0.113.9/32"), prefix("2001:db8:100::9/128")],
+    );
+    machine
+        .rib
+        .announce(peer, &plain, &[prefix("198.18.0.0/15")]);
+    let (fib, task) = machine.start();
+    // The kernel puts an IPv6 blackhole route on lo, and says so.
+    machine.kernel_becomes(&[
+        "blackhole 203.0.113.9 proto bgp metric 20".into(),
+        "blackhole 2001:db8:100::9 dev lo proto bgp metric 20".into(),
+    ]);
+    status_becomes(&fib, "two blackholes, one unresolved", |status| {
+        status.synced
+            && status.installed == 2
+            && status.blackholes == 2
+            && status.unresolved == [("no route to the next hop", 1)]
+    });
+
+    // The request is withdrawn: the blackhole goes.
+    machine.rib.withdraw(peer, &[prefix("203.0.113.9/32")]);
+    machine.kernel_becomes(&["blackhole 2001:db8:100::9 dev lo proto bgp metric 20".into()]);
+
+    // A blackhole left by an earlier run is found and kept like any other.
+    fib.leave().await;
+    task.await.unwrap().unwrap();
+    let (fib, task) = machine.start();
+    status_becomes(&fib, "the blackhole is adopted", |status| {
+        status.synced && status.installed == 1 && status.blackholes == 1
+    });
+    fib.stop().await;
+    task.await.unwrap().unwrap();
+    machine.kernel_becomes(&[]);
+}
+
 /// A table's worth of routes goes in, and comes out, in reasonable time.
 #[tokio::test(flavor = "multi_thread")]
 #[ignore = "changes the machine's routes; run scripts/kernel-tests.sh"]

crates/integration-tests/src/lib.rs

@@ -23,6 +23,7 @@ pub const TIMEOUT: Duration = Duration::from_secs(5);
 pub fn default_policy() -> bgp_server::policy::ImportPolicy {
     bgp_server::policy::ImportPolicy {
         accept_third_party_next_hop: true,
+        accept_blackholes: false,
         ..Default::default()
     }
 }

crates/integration-tests/tests/blackhole.rs

@@ -0,0 +1,141 @@
+//! Blackhole requests (RFC 7999): refused by default, and with
+//! `accept_blackholes` taken for one address inside what the peer may
+//! announce, whatever their next hop.
+
+use std::collections::BTreeSet;
+use std::net::Ipv4Addr;
+use std::time::Duration;
+
+use bgp_integration_tests::announcement::announcement;
+use bgp_integration_tests::test_peer::TestPeer;
+use bgp_integration_tests::test_server::{ServerWithPeer, TestServer};
+use bgp_integration_tests::{default_policy, prefix, wait_until};
+use bgp_server::policy::{ImportPolicy, PrefixSet};
+use eyre::Result;
+
+const LOCAL_ASN: u32 = 1299;
+const PEER_ASN: u32 = 3333;
+const PEER_ID: Ipv4Addr = Ipv4Addr::new(10, 0, 0, 2);
+const BLACKHOLE: (u16, u16) = (0xFFFF, 0x029A);
+
+async fn server_with(import: ImportPolicy) -> Result<ServerWithPeer> {
+    TestServer::with_peer(LOCAL_ASN, PEER_ASN, |c, peer| {
+        c.connect_retry = Duration::from_millis(50);
+        peer.import = import;
+    })
+    .await
+}
+
+/// Waits until the server has taken `taken` routes of the session's and
+/// refused `refused`, and returns the prefixes in its table.
+async fn table_after(server: &TestServer, taken: u64, refused: u64) -> Result<BTreeSet<String>> {
+    let counters = server.registry.list()[0].counters.clone();
+    wait_until("the routes are dealt with", || {
+        (counters.routes(), counters.rejected()) == (taken, refused)
+    })
+    .await
+    .map_err(|_| {
+        eyre::eyre!(
+            "the server took {} routes and refused {}; expected {taken} and {refused}",
+            counters.routes(),
+            counters.rejected()
+        )
+    })?;
+    Ok(server
+        .received_routes()
+        .iter()
+        .map(|route| route.prefix.to_string())
+        .collect())
+}
+
+/// The policy that lets the peer announce 193.0.0.0/21 and nothing
+/// longer than a /24 inside it, as a customer's would.
+fn customer_policy(accept_blackholes: bool) -> ImportPolicy {
+    let mut prefixes = PrefixSet::default();
+    prefixes.allow(prefix("193.0.0.0/21"), 24);
+    ImportPolicy {
+        prefixes: Some(prefixes),
+        accept_blackholes,
+        ..default_policy()
+    }
+}
+
+#[tokio::test]
+async fn test_blackhole_requests_are_refused_unless_accepted() -> Result<()> {
+    let with_peer = server_with(customer_policy(false)).await?;
+    let server = &with_peer.server;
+    let mut peer: TestPeer = server.established(PEER_ASN, PEER_ID).await?;
+    peer.announce(announcement(&["193.0.0.9/32"], &[PEER_ASN]).with_communities(&[BLACKHOLE]))
+        .await?;
+    peer.announce(announcement(&["193.0.0.0/24"], &[PEER_ASN]))
+        .await?;
+    assert_eq!(table_after(server, 1, 1).await?, set(&["193.0.0.0/24"]));
+    let refused = server.rejections.peers();
+    assert_eq!(refused.len(), 1);
+    assert_eq!(
+        refused[0]
+            .1
+            .by_reason()
+            .iter()
+            .map(|(reason, n)| (reason.as_str(), *n))
+            .collect::<Vec<_>>(),
+        [("blackhole request", 1)]
+    );
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_a_blackhole_request_is_taken_for_one_address_in_the_peers_space() -> Result<()> {
+    let with_peer = server_with(customer_policy(true)).await?;
+    let server = &with_peer.server;
+    let mut peer: TestPeer = server.established(PEER_ASN, PEER_ID).await?;
+    // One address inside the peer's prefix, from a next hop that is no
+    // neighbor and would not pass as an ordinary route's.
+    peer.announce(
+        announcement(&["193.0.0.9/32"], &[PEER_ASN])
+            .with_next_hop(Ipv4Addr::new(172, 31, 0, 9))
+            .with_communities(&[BLACKHOLE]),
+    )
+    .await?;
+    // More than one address: not a blackhole request that is taken.
+    peer.announce(announcement(&["193.0.0.0/25"], &[PEER_ASN]).with_communities(&[BLACKHOLE]))
+        .await?;
+    // One address outside the peer's space.
+    peer.announce(announcement(&["193.0.8.9/32"], &[PEER_ASN]).with_communities(&[BLACKHOLE]))
+        .await?;
+    // And an ordinary route, taken as ever.
+    peer.announce(announcement(&["193.0.0.0/24"], &[PEER_ASN]))
+        .await?;
+    assert_eq!(
+        table_after(server, 2, 2).await?,
+        set(&["193.0.0.0/24", "193.0.0.9/32"])
+    );
+    let refused = server.rejections.peers();
+    let mut reasons: Vec<(&str, u64)> = refused[0]
+        .1
+        .by_reason()
+        .iter()
+        .map(|(reason, n)| (reason.as_str(), *n))
+        .collect();
+    reasons.sort();
+    assert_eq!(
+        reasons,
+        [
+            ("blackhole for more than one address", 1),
+            ("prefix not allowed", 1)
+        ]
+    );
+    // The route is in the table with its request on it, for the kernel
+    // and for whoever it goes on to.
+    let routes = server.received_routes();
+    let blackhole = routes
+        .iter()
+        .find(|route| route.prefix == prefix("193.0.0.9/32"))
+        .expect("the blackhole route is in the table");
+    assert!(ImportPolicy::is_blackhole_request(&blackhole.attributes));
+    Ok(())
+}
+
+fn set(prefixes: &[&str]) -> BTreeSet<String> {
+    prefixes.iter().map(|p| p.to_string()).collect()
+}

crates/rib/src/table/attrs.rs

@@ -209,6 +209,23 @@ impl AttrSet {
         plain
     }
 
+    /// Whether the route carries the BLACKHOLE community (RFC 7999), which
+    /// asks for the packets to its prefix to be dropped. Read off the
+    /// stored bytes without building anything else, for those who ask it
+    /// of every route.
+    pub fn is_blackhole(&self) -> bool {
+        const BLACKHOLE: [u8; 4] = [0xFF, 0xFF, 0x02, 0x9A];
+        let mut wire = &*self.wire;
+        while let Ok((attribute, rest)) = split_attribute(wire) {
+            if attribute.type_code == attr_type::COMMUNITIES {
+                let (communities, _) = attribute.value.as_chunks::<4>();
+                return communities.contains(&BLACKHOLE);
+            }
+            wire = rest;
+        }
+        false
+    }
+
     /// Puts the AS numbers of the route's path in `out`, in place of what
     /// was there: in the order of the path, the neighbor's first and the
     /// origin's last, sets and all. Returns whether the path has a set in
@@ -595,6 +612,28 @@ mod tests {
         assert!(path.is_empty());
     }
 
+    /// The BLACKHOLE community is read off the stored bytes.
+    #[test]
+    fn a_blackhole_request_is_told_from_the_bytes() {
+        let store = AttrStore::new();
+        let with = |communities: Vec<(u16, u16)>| {
+            let mut attributes = attributes(vec![3333]);
+            attributes.retain(|attribute| !matches!(attribute, PathAttribute::Communities(_)));
+            attributes.push(PathAttribute::Communities(CommunitiesPathAttribute(
+                communities,
+            )));
+            store.intern(&attributes, None).unwrap()
+        };
+        assert!(with(vec![(3333, 100), (0xFFFF, 0x029A)]).is_blackhole());
+        assert!(!with(vec![(3333, 666), (0xFFFF, 0xFF01)]).is_blackhole());
+        assert!(
+            !store
+                .intern(&attributes(vec![3333]), None)
+                .unwrap()
+                .is_blackhole()
+        );
+    }
+
     /// Two of the same attribute are not a set: its readers could each
     /// take a different one.
     #[test]

crates/server/proto/config.proto

@@ -572,6 +572,18 @@ message ImportPolicy {
   // looked at. A rule sees the route as the statements above leave it:
   // with our communities taken off and ours put on.
   repeated ImportRule rules = 20;
+
+  // By default a route with the BLACKHOLE community (65535:666, RFC
+  // 7999), which asks for the traffic to its prefix to be dropped, is
+  // refused ("blackhole request"). True takes such a route if it is for
+  // one address (a /32 or /128), whatever the longest prefix taken
+  // otherwise, and inside what the peer may announce; its next hop is
+  // not looked at. The traffic to the address is then dropped by this
+  // router (a blackhole route in the kernel), and the route goes on to
+  // the peers the export policy sends it to, community and all, for them
+  // to do the same. For a customer under attack, and for a route server
+  // whose blackhole routes are to be honoured.
+  bool accept_blackholes = 21;
 }
 
 // What is done to the routes with some communities, or for some prefixes:

crates/server/src/config.rs

@@ -642,6 +642,7 @@ fn parse_import(import: &proto::ImportPolicy) -> Result<ImportPolicy, ImportProb
         accept_aspa_invalid: import.accept_aspa_invalid,
         accept_as_sets: import.accept_as_sets,
         accept_third_party_next_hop: import.accept_third_party_next_hop,
+        accept_blackholes: import.accept_blackholes,
         own_prefixes: Arc::default(),
         originated: Arc::default(),
         accept_control_communities: import.accept_control_communities,

crates/server/src/policy.rs

@@ -91,6 +91,9 @@ pub struct ImportPolicy {
     /// who never asked for it. A route server's routes always have its
     /// clients as next hops, and are taken either way.
     pub accept_third_party_next_hop: bool,
+    /// Take routes with the BLACKHOLE community for single addresses, and
+    /// have the kernel drop the traffic to them (RFC 7999).
+    pub accept_blackholes: bool,
     /// The prefixes this router originates. Those, and what is inside
     /// them, are ours and not taken from another network, unless
     /// `prefixes` says in so many words that this peer may announce them:
@@ -196,6 +199,7 @@ impl Default for ImportPolicy {
             accept_aspa_invalid: false,
             accept_as_sets: false,
             accept_third_party_next_hop: false,
+            accept_blackholes: false,
             own_prefixes: Arc::default(),
             originated: Arc::default(),
             accept_control_communities: false,
@@ -224,6 +228,7 @@ impl ImportPolicy {
             accept_aspa_invalid: true,
             accept_as_sets: true,
             accept_third_party_next_hop: true,
+            accept_blackholes: false,
             ..Self::default()
         }
     }
@@ -336,10 +341,14 @@ pub enum Rejection {
     /// The path has an AS_SET in it (RFC 9774).
     AsSet,
     /// The route asks for the traffic to its prefix to be dropped: it has
-    /// the BLACKHOLE community (RFC 7999). Such requests are not acted on,
-    /// and the route is not taken as an ordinary one either, which would
-    /// send the traffic to wherever its next hop drops it.
+    /// the BLACKHOLE community (RFC 7999), and the policy does not take
+    /// such requests (`accept_blackholes`). The route is not taken as an
+    /// ordinary one either, which would send the traffic to wherever its
+    /// next hop drops it.
     Blackhole,
+    /// A blackhole request for more than one address: only a /32 or a
+    /// /128 is taken as one.
+    BlackholeNotHost,
     /// The next hop is no address packets could be sent to, or is our
     /// own, or is an IPv6 address for an IPv4 route on a session that did
     /// not agree to that (RFC 8950).
@@ -371,7 +380,7 @@ impl Rejection {
         )
     }
 
-    pub const ALL: [Self; 20] = [
+    pub const ALL: [Self; 21] = [
         Self::BogonPrefix,
         Self::TooShort,
         Self::TooSpecific,
@@ -386,6 +395,7 @@ impl Rejection {
         Self::Leak,
         Self::AsSet,
         Self::Blackhole,
+        Self::BlackholeNotHost,
         Self::NextHopUnusable,
         Self::NextHopNotPeer,
         Self::OwnPrefix,
@@ -415,6 +425,7 @@ impl Rejection {
             Self::Leak => "route leak (Only to Customer)",
             Self::AsSet => "AS_SET in path",
             Self::Blackhole => "blackhole request",
+            Self::BlackholeNotHost => "blackhole for more than one address",
             Self::NextHopUnusable => "next hop unusable",
             Self::NextHopNotPeer => "next hop is not the peer",
             Self::OwnPrefix => "prefix is our own",
@@ -568,11 +579,7 @@ impl ImportPolicy {
         if facts.has_local_asn {
             return Err(Rejection::OwnAs);
         }
-        let blackhole = attributes.iter().any(|attribute| {
-            matches!(attribute, PathAttribute::Communities(communities)
-                if communities.0.contains(&BLACKHOLE))
-        });
-        if blackhole {
+        if !self.accept_blackholes && Self::is_blackhole_request(attributes) {
             return Err(Rejection::Blackhole);
         }
         // RFC 9234 §5, ingress, 1 and 2. A route that is only to go to
@@ -651,6 +658,35 @@ impl ImportPolicy {
         }
     }
 
+    /// Whether the routes with these attributes ask for the traffic to
+    /// them to be dropped: the BLACKHOLE community (RFC 7999).
+    pub fn is_blackhole_request(attributes: &[PathAttribute]) -> bool {
+        attributes.iter().any(|attribute| {
+            matches!(attribute, PathAttribute::Communities(communities)
+                if communities.0.contains(&BLACKHOLE))
+        })
+    }
+
+    /// Judges the prefix of a blackhole request that the policy takes
+    /// (`accept_blackholes`): one address, and inside what the peer may
+    /// announce. The longest prefix taken otherwise does not apply, nor
+    /// does the longest allowed inside a listed prefix: a request is for
+    /// one address by its nature.
+    pub fn check_blackhole_prefix(&self, prefix: &IpPrefix) -> Result<(), Rejection> {
+        if prefix.length() != prefix.address_family().bits() {
+            return Err(Rejection::BlackholeNotHost);
+        }
+        if !self.accept_bogons && is_bogon_prefix(prefix) {
+            return Err(Rejection::BogonPrefix);
+        }
+        match &self.prefixes {
+            Some(allowed) if !allowed.covers(prefix) => Err(Rejection::PrefixNotAllowed),
+            Some(_) => Ok(()),
+            None if self.own_prefixes.covers(prefix) => Err(Rejection::OwnPrefix),
+            None => Ok(()),
+        }
+    }
+
     /// Judges the next hop of routes of IP version `routes`.
     ///
     /// It has to be an address packets can be sent to and not our own
@@ -882,6 +918,15 @@ impl PrefixSet {
         self.entries.is_empty()
     }
 
+    /// Whether `prefix` is inside some entry, whatever length the entry
+    /// allows inside it.
+    pub fn covers(&self, prefix: &IpPrefix) -> bool {
+        self.lengths[Self::version_index(prefix)]
+            .iter()
+            .take_while(|length| **length <= prefix.length())
+            .any(|length| self.entries.contains_key(&prefix.shortened(*length)))
+    }
+
     /// Whether `prefix` is allowed by some entry.
     pub fn allows(&self, prefix: &IpPrefix) -> bool {
         // An entry that covers it is the prefix cut to the entry's length,
@@ -1362,6 +1407,62 @@ mod tests {
         assert_eq!(lenient.check_path(&with_set, &EXTERNAL), Ok(None));
     }
 
+    /// With accept_blackholes, a request to drop traffic is taken for one
+    /// address inside what the peer may announce, however long a prefix
+    /// the policy takes otherwise; and for nothing else.
+    #[test]
+    fn a_blackhole_request_is_taken_for_one_address_where_allowed() {
+        let mut attributes = path(&[3333, 2121]);
+        attributes.push(PathAttribute::Communities(CommunitiesPathAttribute(vec![
+            (0xFFFF, 0x029A),
+        ])));
+        assert!(ImportPolicy::is_blackhole_request(&attributes));
+        assert!(!ImportPolicy::is_blackhole_request(&path(&[3333])));
+        let mut policy = ImportPolicy {
+            accept_blackholes: true,
+            ..ImportPolicy::default()
+        };
+        // The path passes as any other's would.
+        assert_eq!(policy.check_path(&attributes, &EXTERNAL), Ok(Some(2121)));
+
+        // Without a prefix list: any one routable address but ours.
+        let check = |policy: &ImportPolicy, p: &str| policy.check_blackhole_prefix(&prefix(p));
+        assert_eq!(check(&policy, "193.0.0.9/32"), Ok(()));
+        assert_eq!(check(&policy, "2001:67c:2e8::9/128"), Ok(()));
+        assert_eq!(
+            check(&policy, "193.0.0.0/24"),
+            Err(Rejection::BlackholeNotHost)
+        );
+        assert_eq!(
+            check(&policy, "2001:67c:2e8::/64"),
+            Err(Rejection::BlackholeNotHost)
+        );
+        assert_eq!(
+            check(&policy, "10.0.0.1/32"),
+            Err(Rejection::BogonPrefix),
+            "a bogon is a bogon, one address or not"
+        );
+        let mut ours = PrefixSet::default();
+        ours.allow(prefix("193.0.0.0/21"), 24);
+        policy.own_prefixes = Arc::new(ours);
+        assert_eq!(check(&policy, "193.0.0.9/32"), Err(Rejection::OwnPrefix));
+
+        // With one: inside a listed prefix, whatever length the list
+        // allows inside it, and ours or not.
+        let mut allowed = PrefixSet::default();
+        allowed.allow(prefix("193.0.0.0/21"), 24);
+        policy.prefixes = Some(allowed);
+        assert_eq!(check(&policy, "193.0.0.9/32"), Ok(()));
+        assert_eq!(
+            check(&policy, "193.0.8.9/32"),
+            Err(Rejection::PrefixNotAllowed)
+        );
+        assert_eq!(
+            Rejection::BlackholeNotHost.as_str(),
+            "blackhole for more than one address"
+        );
+    }
+
     /// A request to drop traffic is neither acted on nor taken as an
     /// ordinary route, whose next hop would drop the traffic all the same.
     /// It is told apart from a prefix that is merely too long, which is

crates/server/src/reach.rs

@@ -49,9 +49,22 @@ pub(crate) struct NextHops<'a> {
 
 impl NextHops<'_> {
     /// Whether the kernel can be given a route for `prefix` by way of
-    /// `next_hop`.
-    pub(crate) fn reaches(&self, prefix: &IpPrefix, next_hop: Option<&NlriNextHop>) -> bool {
-        resolve(self.topology, prefix, next_hop, Some(self.neighbor)).is_ok()
+    /// `next_hop`; or, for a route that asks for its packets to be
+    /// dropped (`blackhole`), as a route to nowhere.
+    pub(crate) fn reaches(
+        &self,
+        prefix: &IpPrefix,
+        next_hop: Option<&NlriNextHop>,
+        blackhole: bool,
+    ) -> bool {
+        resolve(
+            self.topology,
+            prefix,
+            next_hop,
+            Some(self.neighbor),
+            blackhole,
+        )
+        .is_ok()
     }
 
     /// The two halves of [`NextHops::reaches`], for an UPDATE's worth of
@@ -180,10 +193,22 @@ fn now_unreachable(
         if topology.interfaces.has_network_around(&route.prefix) {
             return true;
         }
+        // A blackhole resolves whatever its next hop: nothing of it can
+        // have become unreachable.
+        if route.attrs.is_blackhole() {
+            return false;
+        }
         let next_hop = route.attrs.next_hop();
         let key = (next_hop, route.prefix.address_family(), route.peer);
         !*resolved.borrow_mut().entry(key).or_insert_with(|| {
-            resolve(topology, &route.prefix, next_hop.as_ref(), Some(*neighbor)).is_ok()
+            resolve(
+                topology,
+                &route.prefix,
+                next_hop.as_ref(),
+                Some(*neighbor),
+                false,
+            )
+            .is_ok()
         })
     });
     let mut by_peer: HashMap<PeerIndex, Vec<Nlri>> = HashMap::new();

crates/server/src/routes.rs

@@ -129,6 +129,8 @@ pub(crate) fn apply(
         as_path: OnceCell::new(),
         refused_attributes: OnceCell::new(),
         mark: only_to_customer_mark(import, update),
+        blackhole: import.policy.accept_blackholes
+            && ImportPolicy::is_blackhole_request(&update.path_attributes),
         changed: OnceCell::new(),
         rules_holding: OnceCell::new(),
     };
@@ -176,6 +178,10 @@ struct Applying<'a> {
     /// What the policy makes of the path, and the AS the routes originate
     /// from if it passes.
     path_verdict: Result<Option<u32>, Rejection>,
+    /// Whether the routes ask for their traffic to be dropped, and the
+    /// policy takes such requests: then the next hop is nothing to them,
+    /// and the prefix is judged as a request's.
+    blackhole: bool,
     /// Whether the ASPAs find the path invalid: asked only if a route
     /// gets as far as that mattering.
     path_invalid: OnceCell<bool>,
@@ -235,12 +241,14 @@ impl Applying<'_> {
                 return Ok(());
             }
         };
-        // Asked once for all of them: they have the one next hop.
-        let near = self
-            .import
-            .checks
-            .next_hops
-            .is_none_or(|next_hops| next_hops.next_hop_is_near(family, &used_next_hop));
+        // Asked once for all of them: they have the one next hop. For a
+        // blackhole it is not asked at all: the packets go nowhere.
+        let near = self.blackhole
+            || self
+                .import
+                .checks
+                .next_hops
+                .is_none_or(|next_hops| next_hops.next_hop_is_near(family, &used_next_hop));
         // Nearly always every route is taken, and then nothing is copied.
         let mut accepted = Cow::Borrowed(nlri);
         let mut invalid = Vec::new();
@@ -374,9 +382,13 @@ impl Applying<'_> {
             .copied()
             .or_else(in_attributes)
             .ok_or(Rejection::NextHopUnusable)?;
-        self.import
-            .policy
-            .check_next_hop(&next_hop, routes, &self.import.from)?;
+        // The traffic to a blackholed prefix goes nowhere: where the next
+        // hop would have taken it does not matter.
+        if !self.blackhole {
+            self.import
+                .policy
+                .check_next_hop(&next_hop, routes, &self.import.from)?;
+        }
         Ok((origin, next_hop))
     }
 
@@ -385,7 +397,11 @@ impl Applying<'_> {
     /// comes before what may pass.
     fn judge(&self, route: &Nlri, origin: Option<u32>, near: bool) -> Result<(), Rejection> {
         let import = self.import;
-        import.policy.check_prefix(&route.prefix)?;
+        if self.blackhole {
+            import.policy.check_blackhole_prefix(&route.prefix)?;
+        } else {
+            import.policy.check_prefix(&route.prefix)?;
+        }
         let origin_invalid = import
             .checks
             .vrps

crates/server/src/rpki.rs

@@ -162,7 +162,7 @@ impl<'a> Checks<'a> {
             if next_hops.is_own_network(prefix) {
                 return Some(Rejection::OwnNetwork);
             }
-            if !next_hops.reaches(prefix, attrs.next_hop().as_ref()) {
+            if !next_hops.reaches(prefix, attrs.next_hop().as_ref(), attrs.is_blackhole()) {
                 return Some(Rejection::NextHopUnreachable);
             }
         }

crates/web/src/api.rs

@@ -1111,6 +1111,9 @@ pub struct KernelView {
     /// How many of them are kept from before the daemon started though no
     /// peer has announced them again; they go when `stale_seconds` is up.
     pub kept: usize,
+    /// How many of them are blackhole routes, which drop the packets for
+    /// their prefix (RFC 7999).
+    pub blackholes: usize,
     /// Prefixes whose best route is not in the kernel because its next hop
     /// cannot be used, by why.
     pub unresolved: BTreeMap<&'static str, usize>,
@@ -1144,6 +1147,7 @@ pub async fn kernel(State(state): State<AppState>) -> Json<KernelView> {
         synced: status.synced,
         installed: status.installed,
         kept: status.kept,
+        blackholes: status.blackholes,
         unresolved: status.unresolved.into_iter().collect(),
         refused: status.refused,
         errors: status.errors,

crates/web/static/statusz.html

@@ -782,7 +782,7 @@ from <select id="lookup-peer"><option value="">any peer</option></select>
     const unresolved = Object.entries(k.unresolved).map(([why, n]) => `${fmtCount(n)} ${esc(why)}`).join(', ');
     const summary = '<table class="data kv">' +
       row('state', `<span class="${k.synced ? 'green' : 'amber'}">${k.synced ? 'in step' : 'catching up'}</span> with the routing table`) +
-      row('routes installed', `<b>${fmtCount(k.installed)}</b>`) +
+      row('routes installed', `<b>${fmtCount(k.installed)}</b>${k.blackholes ? ` <span class="dim">of which ${fmtCount(k.blackholes)} ${k.blackholes === 1 ? 'is a blackhole' : 'are blackholes'}, dropping the packets for their prefix</span>` : ''}`) +
       row('installed as', `<span class="mono">table ${k.table} metric ${k.metric} proto bgp</span>`) +
       (k.kept ? row('kept from before the restart', `<span class="amber">${fmtCount(k.kept)}</span>, not announced again yet`) : '') +
       (unresolved ? row('not installed', `<span class="amber">${unresolved}</span>`) : '') +