bgpkit_parser/parser/bgp/attributes/

mod.rs

mod attr_01_origin;
mod attr_02_17_as_path;
mod attr_03_next_hop;
mod attr_04_med;
mod attr_05_local_pref;
mod attr_07_18_aggregator;
mod attr_08_communities;
mod attr_09_originator;
mod attr_10_13_cluster;
mod attr_14_15_nlri;
mod attr_16_25_extended_communities;
mod attr_23_tunnel_encap;
mod attr_24_traffic_engineering;
mod attr_26_aigp;
mod attr_29_linkstate;
mod attr_32_large_communities;
mod attr_35_otc;
mod attr_36_domain_path;
mod attr_37_sfp;
mod attr_38_bfd_discriminator;
mod attr_40_bgp_prefix_sid;
mod attr_41_bier;

use bytes::{Buf, BufMut, Bytes, BytesMut};
use log::{debug, warn};
use std::net::IpAddr;

use crate::models::*;

use crate::encoder::sink::{with_u16_len, with_u8_len};
use crate::error::{BgpValidationWarning, EncodingError, ParserError};
use crate::parser::bgp::attributes::attr_01_origin::{encode_origin, parse_origin};
use crate::parser::bgp::attributes::attr_02_17_as_path::encode_as_path;
pub(crate) use crate::parser::bgp::attributes::attr_02_17_as_path::parse_as_path;
use crate::parser::bgp::attributes::attr_03_next_hop::{encode_next_hop, parse_next_hop};
use crate::parser::bgp::attributes::attr_04_med::{encode_med, parse_med};
use crate::parser::bgp::attributes::attr_05_local_pref::{encode_local_pref, parse_local_pref};
use crate::parser::bgp::attributes::attr_07_18_aggregator::{encode_aggregator, parse_aggregator};
use crate::parser::bgp::attributes::attr_08_communities::{
    encode_regular_communities, parse_regular_communities,
};
use crate::parser::bgp::attributes::attr_09_originator::{
    encode_originator_id, parse_originator_id,
};
use crate::parser::bgp::attributes::attr_10_13_cluster::{encode_clusters, parse_clusters};
use crate::parser::bgp::attributes::attr_14_15_nlri::encode_nlri;
pub(crate) use crate::parser::bgp::attributes::attr_14_15_nlri::parse_nlri;
use crate::parser::bgp::attributes::attr_16_25_extended_communities::{
    encode_extended_communities, encode_ipv6_extended_communities, parse_extended_community,
    parse_ipv6_extended_community,
};
use crate::parser::bgp::attributes::attr_23_tunnel_encap::{
    encode_tunnel_encapsulation_attribute, parse_tunnel_encapsulation_attribute,
};
use crate::parser::bgp::attributes::attr_24_traffic_engineering::{
    encode_traffic_engineering, parse_traffic_engineering,
};
use crate::parser::bgp::attributes::attr_26_aigp::{encode_aigp, parse_aigp};
use crate::parser::bgp::attributes::attr_29_linkstate::{
    encode_link_state_attribute, parse_link_state_attribute,
};
use crate::parser::bgp::attributes::attr_32_large_communities::{
    encode_large_communities, parse_large_communities,
};
use crate::parser::bgp::attributes::attr_35_otc::{
    encode_only_to_customer, parse_only_to_customer,
};
use crate::parser::bgp::attributes::attr_36_domain_path::{encode_domain_path, parse_domain_path};
use crate::parser::bgp::attributes::attr_37_sfp::{encode_sfp, parse_sfp};
use crate::parser::bgp::attributes::attr_38_bfd_discriminator::{
    encode_bfd_discriminator, parse_bfd_discriminator,
};
use crate::parser::bgp::attributes::attr_40_bgp_prefix_sid::{
    encode_bgp_prefix_sid, parse_bgp_prefix_sid,
};
use crate::parser::bgp::attributes::attr_41_bier::{encode_bier, parse_bier};
use crate::parser::ReadUtils;

/// Validate attribute flags according to RFC 4271 and RFC 7606
fn validate_attribute_flags(
    attr_type: AttrType,
    flags: AttrFlags,
    warnings: &mut Vec<BgpValidationWarning>,
) {
    let expected_flags = match attr_type {
        // Well-known mandatory attributes
        AttrType::ORIGIN | AttrType::AS_PATH | AttrType::NEXT_HOP => AttrFlags::TRANSITIVE,
        // Well-known discretionary attributes
        AttrType::ATOMIC_AGGREGATE => AttrFlags::TRANSITIVE,
        // Optional non-transitive attributes
        AttrType::MULTI_EXIT_DISCRIMINATOR
        | AttrType::ORIGINATOR_ID
        | AttrType::CLUSTER_LIST
        | AttrType::MP_REACHABLE_NLRI
        | AttrType::MP_UNREACHABLE_NLRI
        | AttrType::TRAFFIC_ENGINEERING => AttrFlags::OPTIONAL,
        // Optional transitive attributes
        AttrType::AGGREGATOR
        | AttrType::AS4_AGGREGATOR
        | AttrType::AS4_PATH
        | AttrType::COMMUNITIES
        | AttrType::EXTENDED_COMMUNITIES
        | AttrType::IPV6_ADDRESS_SPECIFIC_EXTENDED_COMMUNITIES
        | AttrType::LARGE_COMMUNITIES
        | AttrType::ONLY_TO_CUSTOMER
        | AttrType::BGP_DOMAIN_PATH => AttrFlags::OPTIONAL | AttrFlags::TRANSITIVE,
        // LOCAL_PREFERENCE is well-known mandatory for IBGP
        AttrType::LOCAL_PREFERENCE => AttrFlags::TRANSITIVE,
        // Unknown or development attributes
        _ => return, // Don't validate unknown attributes
    };

    // Check if flags match expected (ignoring EXTENDED and PARTIAL flags for this check)
    let relevant_flags = flags & (AttrFlags::OPTIONAL | AttrFlags::TRANSITIVE);
    if relevant_flags != expected_flags {
        warnings.push(BgpValidationWarning::AttributeFlagsError {
            attr_type,
            expected_flags: expected_flags.bits(),
            actual_flags: relevant_flags.bits(),
        });
    }

    // Check partial flag constraint
    if flags.contains(AttrFlags::PARTIAL) {
        match attr_type {
            // Partial bit MUST be 0 for well-known attributes and optional non-transitive
            AttrType::ORIGIN
            | AttrType::AS_PATH
            | AttrType::NEXT_HOP
            | AttrType::LOCAL_PREFERENCE
            | AttrType::ATOMIC_AGGREGATE
            | AttrType::MULTI_EXIT_DISCRIMINATOR
            | AttrType::ORIGINATOR_ID
            | AttrType::CLUSTER_LIST
            | AttrType::MP_REACHABLE_NLRI
            | AttrType::MP_UNREACHABLE_NLRI
            | AttrType::TRAFFIC_ENGINEERING => {
                warnings.push(BgpValidationWarning::AttributeFlagsError {
                    attr_type,
                    expected_flags: expected_flags.bits(),
                    actual_flags: flags.bits(),
                });
            }
            _ => {} // Partial is OK for optional transitive attributes
        }
    }
}

fn is_raw_retained_attr(attr_type: AttrType) -> bool {
    matches!(
        attr_type,
        AttrType::RESERVED
            | AttrType::PMSI_TUNNEL
            | AttrType::PE_DISTINGUISHER_LABELS
            | AttrType::BGPSEC_PATH
            | AttrType::ATTR_SET
    )
}

/// Check if an attribute type is well-known mandatory
fn is_well_known_mandatory(attr_type: AttrType) -> bool {
    matches!(
        attr_type,
        AttrType::ORIGIN | AttrType::AS_PATH | AttrType::NEXT_HOP | AttrType::LOCAL_PREFERENCE
    )
}

pub(crate) struct AttributeValidationState {
    warnings: Vec<BgpValidationWarning>,
    attr_mask: [u64; 4],
}

impl AttributeValidationState {
    pub(crate) fn new() -> Self {
        Self {
            warnings: Vec::new(),
            attr_mask: [0; 4],
        }
    }

    fn has_raw_attr(&self, attr: u8) -> bool {
        (self.attr_mask[(attr / 64) as usize] & (1u64 << (attr % 64))) != 0
    }

    pub(crate) fn has_attr(&self, attr_type: AttrType) -> bool {
        self.has_raw_attr(u8::from(attr_type))
    }

    fn set_attr(&mut self, attr: u8) {
        self.attr_mask[(attr / 64) as usize] |= 1u64 << (attr % 64);
    }

    pub(crate) fn observe_header(
        &mut self,
        raw_attr_type: u8,
        attr_type: AttrType,
        flags: AttrFlags,
        length: usize,
    ) -> bool {
        if self.has_raw_attr(raw_attr_type) {
            self.warnings
                .push(BgpValidationWarning::DuplicateAttribute { attr_type });
        }
        self.set_attr(raw_attr_type);

        validate_attribute_flags(attr_type, flags, &mut self.warnings);
        validate_attribute_length(attr_type, length, &mut self.warnings);

        flags.contains(AttrFlags::PARTIAL)
    }

    pub(crate) fn observe_parse_error(
        &mut self,
        attr_type: AttrType,
        partial: bool,
        error: &ParserError,
    ) {
        if partial {
            self.warnings
                .push(BgpValidationWarning::PartialAttributeError {
                    attr_type,
                    reason: error.to_string(),
                });
            debug!("PARTIAL attribute error: {}", error);
        } else if is_well_known_mandatory(attr_type) {
            self.warnings
                .push(BgpValidationWarning::MalformedAttributeList {
                    reason: format!(
                        "Well-known mandatory attribute {} parsing failed: {}",
                        u8::from(attr_type),
                        error
                    ),
                });
            debug!(
                "Well-known mandatory attribute parsing failed, treating as withdraw: {}",
                error
            );
        } else {
            self.warnings
                .push(BgpValidationWarning::OptionalAttributeError {
                    attr_type,
                    reason: error.to_string(),
                });
            debug!("Optional attribute error, discarding: {}", error);
        }
    }

    pub(crate) fn check_mandatory_attributes(
        &mut self,
        is_announcement: bool,
        has_standard_nlri: bool,
    ) {
        if !is_announcement {
            return;
        }

        if !self.has_attr(AttrType::ORIGIN) {
            self.warnings
                .push(BgpValidationWarning::MissingWellKnownAttribute {
                    attr_type: AttrType::ORIGIN,
                });
        }

        if !self.has_attr(AttrType::AS_PATH) {
            self.warnings
                .push(BgpValidationWarning::MissingWellKnownAttribute {
                    attr_type: AttrType::AS_PATH,
                });
        }

        let has_mp_reach = self.has_attr(AttrType::MP_REACHABLE_NLRI);
        if (has_standard_nlri || !has_mp_reach) && !self.has_attr(AttrType::NEXT_HOP) {
            self.warnings
                .push(BgpValidationWarning::MissingWellKnownAttribute {
                    attr_type: AttrType::NEXT_HOP,
                });
        }
    }

    pub(crate) fn finish(self) -> (Vec<BgpValidationWarning>, [u64; 4]) {
        (self.warnings, self.attr_mask)
    }
}

/// Validate attribute length constraints
fn validate_attribute_length(
    attr_type: AttrType,
    length: usize,
    warnings: &mut Vec<BgpValidationWarning>,
) {
    let expected_length = match attr_type {
        AttrType::ORIGIN => Some(1),
        AttrType::NEXT_HOP => Some(4), // IPv4 next hop
        AttrType::MULTI_EXIT_DISCRIMINATOR => Some(4),
        AttrType::LOCAL_PREFERENCE => Some(4),
        AttrType::ATOMIC_AGGREGATE => Some(0),
        AttrType::ORIGINATOR_ID => Some(4),
        AttrType::ONLY_TO_CUSTOMER => Some(4),
        // Variable length attributes - no fixed constraint
        AttrType::AS_PATH
        | AttrType::AS4_PATH
        | AttrType::AGGREGATOR
        | AttrType::AS4_AGGREGATOR
        | AttrType::COMMUNITIES
        | AttrType::EXTENDED_COMMUNITIES
        | AttrType::IPV6_ADDRESS_SPECIFIC_EXTENDED_COMMUNITIES
        | AttrType::LARGE_COMMUNITIES
        | AttrType::CLUSTER_LIST
        | AttrType::MP_REACHABLE_NLRI
        | AttrType::MP_UNREACHABLE_NLRI => None,
        _ => None, // Unknown attributes
    };

    if let Some(expected) = expected_length {
        if length != expected {
            warnings.push(BgpValidationWarning::AttributeLengthError {
                attr_type,
                expected_length: Some(expected),
                actual_length: length,
            });
        }
    }
}

/// Whether RFC 10039 §4 allows the D-PATH attribute on routes of this family: IPVPN, which is
/// IPv4 or IPv6 with SAFI 128, and EVPN, which is AFI 25 with SAFI 70.
fn is_domain_path_family(afi: u16, safi: u8) -> bool {
    matches!((afi, safi), (1 | 2, 128) | (25, 70))
}

/// The AFI/SAFI header an MP_REACH_NLRI attribute value starts with, when it is long enough to
/// carry one. The header identifies the family even when the rest did not decode.
fn mp_reach_family(bytes: &[u8]) -> Option<(u16, u8)> {
    match bytes.len() >= 3 {
        true => Some((u16::from_be_bytes([bytes[0], bytes[1]]), bytes[2])),
        false => None,
    }
}

/// The route families a D-PATH-carrying message carries, as far as the caller can tell.
#[derive(Debug, Clone, Copy, Default)]
struct DomainPathFamilies {
    /// Family the caller already knows, e.g. a RIB entry from its record header.
    declared: Option<(u16, u8)>,
    /// Family of the routes an MP_REACH_NLRI announces, decoded or read off its header.
    announced: Option<(u16, u8)>,
    /// Classic IPv4 unicast NLRI, which the UPDATE parser adds once it has parsed them.
    classic_ipv4: bool,
}

impl DomainPathFamilies {
    /// The families visible in an attribute set on its own, before any NLRI is parsed. An
    /// MP_UNREACH_NLRI announces nothing, so it says nothing about the family here. An
    /// MP_REACH_NLRI whose NLRI did not decode still identifies its family through the AFI/SAFI
    /// header it starts with, which is enough to judge it.
    fn from_attributes(attributes: &[Attribute], declared: Option<(u16, u8)>) -> Self {
        let announced = attributes
            .iter()
            .find_map(|attribute| match &attribute.value {
                AttributeValue::MpReachNlri(nlri) => Some((nlri.afi as u16, nlri.safi as u8)),
                _ => None,
            })
            .or_else(|| {
                attributes
                    .iter()
                    .find_map(|attribute| match &attribute.value {
                        AttributeValue::Raw(raw) | AttributeValue::Unknown(raw)
                            if raw.code == u8::from(AttrType::MP_REACHABLE_NLRI) =>
                        {
                            mp_reach_family(&raw.bytes)
                        }
                        _ => None,
                    })
            });

        DomainPathFamilies {
            declared,
            announced,
            classic_ipv4: false,
        }
    }

    /// Describe a carried family that RFC 10039 §4 does not allow D-PATH on, if there is one.
    ///
    /// The rule is about the routes a message carries, so a decoded announcement decides the
    /// answer and a withdrawal never introduces one. A family this attribute set does not
    /// reveal stays unknown: the UPDATE parser reports classic IPv4 unicast NLRI once it has
    /// parsed them, and a caller that knows the family up front passes it in.
    fn disallowed(&self) -> Option<String> {
        let declared = self
            .declared
            .filter(|(afi, safi)| !is_domain_path_family(*afi, *safi));
        if let Some((afi, safi)) = declared {
            return Some(describe_family(afi, safi, "declared"));
        }

        if let Some((afi, safi)) = self
            .announced
            .filter(|(afi, safi)| !is_domain_path_family(*afi, *safi))
        {
            return Some(describe_family(afi, safi, "announced"));
        }

        if self.classic_ipv4 {
            return Some("classic IPv4 unicast NLRI (AFI 1, SAFI 1)".to_string());
        }

        None
    }
}

fn describe_family(afi: u16, safi: u8, source: &str) -> String {
    match (afi, safi) {
        // a mismatched EVPN SAFI is worth naming, since EVPN is AFI 25 with SAFI 70
        (_, 70) if afi != 25 => {
            format!("{source} AFI {afi} routes with SAFI 70 (EVPN requires AFI 25)")
        }
        _ => format!("{source} AFI {afi} routes with SAFI {safi}"),
    }
}

/// RFC 10039 §4 limits D-PATH to UPDATEs that carry IPVPN or EVPN routes and requires the
/// treat-as-withdraw action for any other family, so report the finding when a carried family
/// is known to be something else.
fn domain_path_family_warning(families: DomainPathFamilies) -> Option<BgpValidationWarning> {
    families.disallowed().map(|family| {
        BgpValidationWarning::OptionalAttributeError {
            attr_type: AttrType::BGP_DOMAIN_PATH,
            reason: format!(
                "D-PATH is only valid on IPVPN (AFI 1/2, SAFI 128) or EVPN (AFI 25, SAFI 70) routes, this UPDATE carries {family}: RFC 10039 §4 requires treat-as-withdraw"
            ),
        }
    })
}

/// Parse BGP attributes given a slice of u8 and some options.
///
/// The `data: &[u8]` contains the entirety of the attributes bytes, therefore the size of
/// the slice is the total byte length of the attributes section of the message.
pub fn parse_attributes(
    mut data: Bytes,
    asn_len: &AsnLength,
    add_path: bool,
    afi: Option<Afi>,
    safi: Option<Safi>,
    prefixes: Option<&[NetworkPrefix]>,
) -> Result<Attributes, ParserError> {
    // Estimate capacity from data size: each attribute is at least 3 bytes
    // (flag + type + length). Cap at 256 to avoid over-allocation for corrupted data.
    let estimated_attrs = (data.remaining() / 3).min(256);
    let mut attributes: Vec<Attribute> = Vec::with_capacity(estimated_attrs.max(8));
    let mut validation = AttributeValidationState::new();
    // A handle on the whole attribute section, so an attribute that fails to parse can be kept
    // raw by re-slicing it, without cloning every attribute's bytes up front.
    let section = data.clone();

    while data.remaining() >= 3 {
        // each attribute is at least 3 bytes: flag(1) + type(1) + length(1)
        // thus the while loop condition is set to be at least 3 bytes to read.

        // has content to read
        let flag = AttrFlags::from_bits_retain(data.read_u8()?);
        let attr_type = data.read_u8()?;
        let attr_length = match flag.contains(AttrFlags::EXTENDED) {
            false => data.read_u8()? as usize,
            true => data.read_u16()? as usize,
        };

        debug!(
            "reading attribute: type -- {:?}, length -- {}",
            attr_type, attr_length
        );

        let attr_type = AttrType::from(attr_type);

        let partial = validation.observe_header(attr_type.into(), attr_type, flag, attr_length);

        let bytes_left = data.remaining();

        if data.remaining() < attr_length {
            warn!(
                "{:?} attribute encodes a length ({}) that is longer than the remaining attribute data ({}). Skipping remaining attribute data for BGP message",
                attr_type, attr_length, bytes_left
            );
            // break and return already parsed attributes
            break;
        }

        // we know data has enough bytes to read, so we can split the bytes into a new Bytes object
        data.has_n_remaining(attr_length)?;
        let value_start = section.len() - data.len();
        let mut attr_data = data.split_to(attr_length);
        let raw_code = u8::from(attr_type);

        if let Some(t) = get_deprecated_attr_type(raw_code) {
            debug!("deprecated attribute type: {} - {}", raw_code, t);
            attributes.push(Attribute {
                value: AttributeValue::Deprecated(AttrRaw {
                    code: raw_code,
                    bytes: attr_data,
                }),
                flag,
            });
            continue;
        }

        if matches!(attr_type, AttrType::Unknown(_)) {
            debug!("unknown attribute type: {}", raw_code);
            attributes.push(Attribute {
                value: AttributeValue::Unknown(AttrRaw {
                    code: raw_code,
                    bytes: attr_data,
                }),
                flag,
            });
            continue;
        }

        if is_raw_retained_attr(attr_type) {
            debug!("raw-retained attribute type: {}", raw_code);
            attributes.push(Attribute {
                value: AttributeValue::Raw(AttrRaw {
                    code: raw_code,
                    bytes: attr_data,
                }),
                flag,
            });
            continue;
        }

        let attr = match attr_type {
            AttrType::ORIGIN => parse_origin(attr_data),
            AttrType::AS_PATH => parse_as_path(attr_data, asn_len).map(AttributeValue::AsPath),
            AttrType::NEXT_HOP => parse_next_hop(attr_data, &afi),
            AttrType::MULTI_EXIT_DISCRIMINATOR => parse_med(attr_data),
            AttrType::LOCAL_PREFERENCE => parse_local_pref(attr_data),
            AttrType::ATOMIC_AGGREGATE => Ok(AttributeValue::AtomicAggregate),
            AttrType::AGGREGATOR => parse_aggregator(attr_data, asn_len)
                .map(|(asn, id)| AttributeValue::Aggregator { asn, id }),
            AttrType::ORIGINATOR_ID => parse_originator_id(attr_data),
            AttrType::CLUSTER_LIST => parse_clusters(attr_data),
            AttrType::MP_REACHABLE_NLRI => {
                parse_nlri(attr_data, &afi, &safi, &prefixes, true, add_path)
            }
            AttrType::MP_UNREACHABLE_NLRI => {
                parse_nlri(attr_data, &afi, &safi, &prefixes, false, add_path)
            }
            AttrType::AS4_PATH => {
                parse_as_path(attr_data, &AsnLength::Bits32).map(AttributeValue::As4Path)
            }
            AttrType::AS4_AGGREGATOR => parse_aggregator(attr_data, &AsnLength::Bits32)
                .map(|(asn, id)| AttributeValue::As4Aggregator { asn, id }),

            // communities
            AttrType::COMMUNITIES => parse_regular_communities(attr_data),
            AttrType::LARGE_COMMUNITIES => parse_large_communities(attr_data),
            AttrType::EXTENDED_COMMUNITIES => parse_extended_community(attr_data),
            AttrType::IPV6_ADDRESS_SPECIFIC_EXTENDED_COMMUNITIES => {
                parse_ipv6_extended_community(attr_data)
            }
            AttrType::DEVELOPMENT => {
                let mut value = vec![];
                for _i in 0..attr_length {
                    value.push(attr_data.read_u8()?);
                }
                Ok(AttributeValue::Development(value))
            }
            AttrType::ONLY_TO_CUSTOMER => parse_only_to_customer(attr_data),
            AttrType::AIGP => parse_aigp(attr_data),
            AttrType::TUNNEL_ENCAPSULATION => parse_tunnel_encapsulation_attribute(attr_data),
            AttrType::TRAFFIC_ENGINEERING => parse_traffic_engineering(attr_data),
            AttrType::BGP_LS_ATTRIBUTE => parse_link_state_attribute(attr_data),
            AttrType::BGP_DOMAIN_PATH => parse_domain_path(attr_data),
            AttrType::SFP_ATTRIBUTE => parse_sfp(attr_data),
            AttrType::BFD_DISCRIMINATOR => parse_bfd_discriminator(attr_data),
            AttrType::BGP_PREFIX_SID => parse_bgp_prefix_sid(attr_data),
            AttrType::BIER => parse_bier(attr_data),
            _ => Err(ParserError::Unsupported(format!(
                "unsupported attribute type: {attr_type:?}"
            ))),
        };

        match attr {
            Ok(value) => {
                assert_eq!(attr_type, value.attr_type());
                attributes.push(Attribute { value, flag });
            }
            Err(e) => {
                validation.observe_parse_error(attr_type, partial, &e);
                attributes.push(Attribute {
                    value: AttributeValue::Raw(AttrRaw {
                        code: raw_code,
                        bytes: section.slice(value_start..value_start + attr_length),
                    }),
                    flag,
                });
                continue;
            }
        };
    }

    let (mut validation_warnings, attr_mask) = validation.finish();
    if attributes
        .iter()
        .any(|attribute| matches!(attribute.value, AttributeValue::DomainPath(_)))
    {
        let declared = afi.zip(safi).map(|(afi, safi)| (afi as u16, safi as u8));
        let families = DomainPathFamilies::from_attributes(&attributes, declared);
        if let Some(warning) = domain_path_family_warning(families) {
            validation_warnings.push(warning);
        }
    }

    Ok(Attributes {
        inner: attributes,
        validation_warnings,
        attr_mask,
    })
}

impl Attribute {
    /// Append the wire representation of this attribute to `buf`.
    ///
    /// The length-field width follows the attribute's EXTENDED_LENGTH flag; a
    /// value that does not fit the resulting field yields
    /// [`EncodingError::ValueTooLarge`] instead of being truncated.
    pub fn encode_to(&self, asn_len: AsnLength, buf: &mut BytesMut) -> Result<(), EncodingError> {
        buf.put_u8(self.flag.bits());
        buf.put_u8(self.value.attr_code());

        let write_value = |b: &mut BytesMut| -> Result<(), EncodingError> {
            match &self.value {
                AttributeValue::Origin(v) => b.put_slice(&encode_origin(v)),
                // AS_PATH segment width follows the session's AS number length.
                AttributeValue::AsPath(path) => {
                    encode_as_path(path, asn_len, b)?;
                }
                // AS4_PATH segments are 4-octet by definition (RFC 6793 §4.2),
                // independent of the session's AS number length.
                AttributeValue::As4Path(path) => {
                    encode_as_path(path, AsnLength::Bits32, b)?;
                }
                AttributeValue::NextHop(v) => b.put_slice(&encode_next_hop(v)),
                AttributeValue::MultiExitDiscriminator(v) => b.put_slice(&encode_med(*v)),
                AttributeValue::LocalPreference(v) => b.put_slice(&encode_local_pref(*v)),
                AttributeValue::OnlyToCustomer(v) => {
                    b.put_slice(&encode_only_to_customer(v.into()))
                }
                AttributeValue::AtomicAggregate => {}
                AttributeValue::Aggregator { asn, id } => {
                    b.put_slice(&encode_aggregator(asn, &IpAddr::from(*id), asn_len)?)
                }
                AttributeValue::As4Aggregator { asn, id } => b.put_slice(&encode_aggregator(
                    asn,
                    &IpAddr::from(*id),
                    AsnLength::Bits32,
                )?),
                AttributeValue::Communities(v) => b.put_slice(&encode_regular_communities(v)),
                AttributeValue::ExtendedCommunities(v) => {
                    b.put_slice(&encode_extended_communities(v))
                }
                AttributeValue::LargeCommunities(v) => b.put_slice(&encode_large_communities(v)),
                AttributeValue::Ipv6AddressSpecificExtendedCommunities(v) => {
                    b.put_slice(&encode_ipv6_extended_communities(v))
                }
                AttributeValue::OriginatorId(v) => {
                    b.put_slice(&encode_originator_id(&IpAddr::from(*v)))
                }
                AttributeValue::Clusters(v) => b.put_slice(&encode_clusters(v)),
                AttributeValue::MpReachNlri(v) => {
                    // Infer ADD-PATH from presence of path_id in any labeled prefix
                    let add_path = v
                        .labeled_prefixes
                        .as_ref()
                        .is_some_and(|prefixes| prefixes.iter().any(|p| p.path_id.is_some()));
                    encode_nlri(v, true, add_path, b)?;
                }
                AttributeValue::MpUnreachNlri(v) => {
                    // Withdrawals don't use ADD-PATH encoding per RFC 8277
                    encode_nlri(v, false, false, b)?;
                }
                AttributeValue::LinkState(v) => encode_link_state_attribute(v, b)?,
                AttributeValue::TunnelEncapsulation(v) => {
                    encode_tunnel_encapsulation_attribute(v, b)?
                }
                AttributeValue::TrafficEngineering(v) => encode_traffic_engineering(v, b)?,
                AttributeValue::DomainPath(v) => encode_domain_path(v, b)?,
                AttributeValue::BfdDiscriminator(v) => encode_bfd_discriminator(v, b)?,
                AttributeValue::BgpPrefixSid(v) => encode_bgp_prefix_sid(v, b)?,
                AttributeValue::Bier(v) => encode_bier(v, b)?,
                AttributeValue::Sfp(v) => encode_sfp(v, b)?,
                AttributeValue::Development(v) => b.put_slice(v),
                AttributeValue::Raw(v) => b.put_slice(&v.bytes),
                AttributeValue::Deprecated(v) => b.put_slice(&v.bytes),
                AttributeValue::Unknown(v) => b.put_slice(&v.bytes),
                AttributeValue::Aigp(v) => b.put_slice(&encode_aigp(v)),
                AttributeValue::AttrSet(_v) => {
                    return Err(EncodingError::unencodable(
                        "ATTR_SET attribute",
                        "encoding not implemented",
                    ));
                }
            }
            Ok(())
        };

        match self.is_extended() {
            false => with_u8_len(buf, "BGP attribute value length", write_value),
            true => with_u16_len(buf, "BGP attribute value length (extended)", write_value),
        }
    }

    /// Encode this attribute into a fresh buffer.
    pub fn encode(&self, asn_len: AsnLength) -> Result<Bytes, EncodingError> {
        let mut buf = BytesMut::new();
        self.encode_to(asn_len, &mut buf)?;
        Ok(buf.freeze())
    }
}

impl Attributes {
    /// Append the wire representation of all attributes to `buf`.
    pub fn encode_to(&self, asn_len: AsnLength, buf: &mut BytesMut) -> Result<(), EncodingError> {
        for attr in &self.inner {
            attr.encode_to(asn_len, buf)?;
        }
        Ok(())
    }

    /// Encode all attributes into a fresh buffer.
    pub fn encode(&self, asn_len: AsnLength) -> Result<Bytes, EncodingError> {
        let mut buf = BytesMut::new();
        self.encode_to(asn_len, &mut buf)?;
        Ok(buf.freeze())
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_unknwon_attribute_type() {
        let data = Bytes::from(vec![0x40, 0xFE, 0x00]);
        let asn_len = AsnLength::Bits16;
        let add_path = false;
        let afi = None;
        let safi = None;
        let prefixes = None;
        let attributes = parse_attributes(data, &asn_len, add_path, afi, safi, prefixes);
        assert!(attributes.is_ok());
        let attributes = attributes.unwrap();
        assert_eq!(attributes.inner.len(), 1);
        assert_eq!(
            attributes.inner[0].value.attr_type(),
            AttrType::Unknown(254)
        );
    }

    #[test]
    fn test_rfc7606_attribute_flags_error() {
        // Create an ORIGIN attribute with wrong flags (should be transitive, not optional)
        let data = Bytes::from(vec![0x80, 0x01, 0x01, 0x00]); // Optional flag set incorrectly
        let asn_len = AsnLength::Bits16;
        let add_path = false;
        let afi = None;
        let safi = None;
        let prefixes = None;

        let attributes = parse_attributes(data, &asn_len, add_path, afi, safi, prefixes).unwrap();

        // Should have validation warning for incorrect flags
        assert!(attributes.has_validation_warnings());
        let warnings = attributes.validation_warnings();
        // Will have attribute flags error + missing mandatory attributes
        assert!(!warnings.is_empty());

        match &warnings[0] {
            BgpValidationWarning::AttributeFlagsError { attr_type, .. } => {
                assert_eq!(*attr_type, AttrType::ORIGIN);
            }
            _ => panic!("Expected AttributeFlagsError warning"),
        }
    }

    #[test]
    fn test_rfc7606_missing_mandatory_attribute() {
        // Attributes with only LOCAL_PREF (missing ORIGIN, AS_PATH, NEXT_HOP)
        let data = Bytes::from(vec![
            0x40, 0x05, 0x04, 0x00, 0x00, 0x00, 0x64, // LOCAL_PREF = 100
        ]);
        let asn_len = AsnLength::Bits16;
        let add_path = false;
        let afi = None;
        let safi = None;
        let prefixes = None;

        let mut attributes =
            parse_attributes(data, &asn_len, add_path, afi, safi, prefixes).unwrap();
        // Manually trigger mandatory check as an announcement with standard NLRI
        attributes.check_mandatory_attributes(true, true);

        // Should have warnings for missing mandatory attributes
        assert!(attributes.has_validation_warnings());
        let warnings = attributes.validation_warnings();
        // LOCAL_PREF is not a withdrawal, so ORIGIN, AS_PATH, NEXT_HOP are required
        assert_eq!(warnings.len(), 3); // ORIGIN, AS_PATH, NEXT_HOP

        for warning in warnings {
            match warning {
                BgpValidationWarning::MissingWellKnownAttribute { attr_type } => {
                    assert!(matches!(
                        attr_type,
                        AttrType::ORIGIN | AttrType::AS_PATH | AttrType::NEXT_HOP
                    ));
                }
                _ => panic!("Expected MissingWellKnownAttribute warning"),
            }
        }
    }

    #[test]
    fn test_mp_reach_no_next_hop() {
        // Attributes with MP_REACH_NLRI (missing ORIGIN, AS_PATH)
        // MP_REACH_NLRI is type 14 (0x0E).
        // We just need a dummy MP_REACH_NLRI.
        let data = Bytes::from(vec![
            0x80, 0x0E, 0x06, 0x00, 0x01, 0x01, // AFI=1, SAFI=1
            0x00, // Next Hop Len = 0 (invalid for parsing, but enough to trigger logic)
            0x00, // Reserved
            0x00, // NLRI
        ]);
        let asn_len = AsnLength::Bits16;
        let add_path = false;
        let afi = None;
        let safi = None;
        let prefixes = None;

        let mut attributes =
            parse_attributes(data, &asn_len, add_path, afi, safi, prefixes).unwrap();
        // Manually trigger mandatory check as an announcement but NO standard NLRI (MP only)
        attributes.check_mandatory_attributes(true, false);

        // Should NOT have NEXT_HOP warning because MP_REACH_NLRI is present and has_standard_nlri is false
        let warnings = attributes.validation_warnings();
        let has_next_hop_warning = warnings.iter().any(|w| {
            matches!(
                w,
                BgpValidationWarning::MissingWellKnownAttribute {
                    attr_type: AttrType::NEXT_HOP
                }
            )
        });
        assert!(!has_next_hop_warning);
    }

    #[test]
    fn test_pure_withdrawal_no_warnings() {
        // Empty attributes - pure withdrawal
        let data = Bytes::from(vec![]);
        let asn_len = AsnLength::Bits16;
        let add_path = false;
        let afi = None;
        let safi = None;
        let prefixes = None;

        let mut attributes =
            parse_attributes(data, &asn_len, add_path, afi, safi, prefixes).unwrap();
        // Manually trigger mandatory check as a withdrawal
        attributes.check_mandatory_attributes(false, false);

        // Should have NO warnings
        assert!(!attributes.has_validation_warnings());

        // Attributes with only MP_UNREACH_NLRI - pure withdrawal
        let data = Bytes::from(vec![
            0x80, 0x0F, 0x03, 0x00, 0x01, 0x01, // AFI=1, SAFI=1
        ]);
        let mut attributes =
            parse_attributes(data, &asn_len, add_path, afi, safi, prefixes).unwrap();
        attributes.check_mandatory_attributes(false, false);
        assert!(!attributes.has_validation_warnings());
    }

    #[test]
    fn test_rfc7606_duplicate_attribute() {
        // Create two ORIGIN attributes
        let data = Bytes::from(vec![
            0x40, 0x01, 0x01, 0x00, // First ORIGIN attribute
            0x40, 0x01, 0x01, 0x01, // Second ORIGIN attribute (duplicate)
        ]);
        let asn_len = AsnLength::Bits16;
        let add_path = false;
        let afi = None;
        let safi = None;
        let prefixes = None;

        let attributes = parse_attributes(data, &asn_len, add_path, afi, safi, prefixes).unwrap();

        // Should have warning for duplicate attribute
        assert!(attributes.has_validation_warnings());
        let warnings = attributes.validation_warnings();

        // Should have at least one duplicate attribute warning
        let has_duplicate_warning = warnings
            .iter()
            .any(|w| matches!(w, BgpValidationWarning::DuplicateAttribute { .. }));
        assert!(has_duplicate_warning);
    }

    #[test]
    fn test_attribute_type_boundaries() {
        let asn_len = AsnLength::Bits16;
        let add_path = false;
        let afi = None;
        let safi = None;
        let prefixes = None;

        // Required attributes for valid BGP message
        const REQUIRED_ATTRS: &[u8] = &[
            0x40, 0x01, 0x01, 0x00, // origin
            0x40, 0x02, 0x00, // as_path
            0x40, 0x03, 0x04, 0x01, 0x02, 0x03, 0x04, // next_hop
        ];

        // Test highest (development) attribute type
        let mut data = REQUIRED_ATTRS.to_vec();
        data.extend_from_slice(&[0x40, 0xFF, 0x01, 0x00]); // development
        let data = Bytes::from(data);

        let attributes = parse_attributes(data, &asn_len, add_path, afi, safi, prefixes).unwrap();

        assert!(attributes.has_attr(AttrType::DEVELOPMENT));
        assert!(!attributes.has_validation_warnings());

        // Test lowest (reserved) attribute type
        let mut data = REQUIRED_ATTRS.to_vec();
        data.extend_from_slice(&[0x40, 0x00, 0x01, 0x01]); // reserved
        let data = Bytes::from(data);

        let attributes = parse_attributes(data, &asn_len, add_path, afi, safi, prefixes).unwrap();

        assert!(attributes.inner.iter().any(|attr| {
            matches!(
                &attr.value,
                AttributeValue::Raw(raw)
                    if raw.code == u8::from(AttrType::RESERVED)
                        && raw.bytes == Bytes::from_static(&[0x01])
            )
        }));
        assert!(!attributes.validation_warnings.iter().any(|vw| {
            matches!(vw, BgpValidationWarning::OptionalAttributeError { attr_type, reason:_ } if *attr_type == AttrType::RESERVED)
        }));
    }

    #[test]
    fn test_raw_retention_for_known_unsupported_attribute() {
        let data = Bytes::from(vec![0x80, 0x16, 0x03, 0xaa, 0xbb, 0xcc]); // PMSI_TUNNEL
        let attributes =
            parse_attributes(data, &AsnLength::Bits16, false, None, None, None).unwrap();

        assert_eq!(attributes.inner.len(), 1);
        match &attributes.inner[0].value {
            AttributeValue::Raw(raw) => {
                assert_eq!(raw.code, 22);
                assert_eq!(raw.attr_type(), AttrType::PMSI_TUNNEL);
                assert_eq!(raw.bytes, Bytes::from_static(&[0xaa, 0xbb, 0xcc]));
            }
            value => panic!("expected Raw, got {value:?}"),
        }
        assert_eq!(
            attributes.encode(AsnLength::Bits16).unwrap(),
            Bytes::from_static(&[0x80, 0x16, 0x03, 0xaa, 0xbb, 0xcc])
        );
    }

    #[test]
    fn test_deprecated_code_13_retained_as_deprecated() {
        let data = Bytes::from(vec![0x80, 0x0d, 0x04, 0x01, 0x02, 0x03, 0x04]);
        let attributes =
            parse_attributes(data, &AsnLength::Bits16, false, None, None, None).unwrap();

        assert_eq!(attributes.inner.len(), 1);
        match &attributes.inner[0].value {
            AttributeValue::Deprecated(raw) => {
                assert_eq!(raw.code, 13);
                assert_eq!(raw.attr_type(), AttrType::Unknown(13));
                assert_eq!(raw.bytes, Bytes::from_static(&[0x01, 0x02, 0x03, 0x04]));
            }
            value => panic!("expected Deprecated, got {value:?}"),
        }
        assert_eq!(
            attributes.encode(AsnLength::Bits16).unwrap(),
            Bytes::from_static(&[0x80, 0x0d, 0x04, 0x01, 0x02, 0x03, 0x04])
        );
    }

    #[test]
    fn test_malformed_typed_attribute_falls_back_to_raw() {
        let data = Bytes::from(vec![0x40, 0x03, 0x03, 0x01, 0x02, 0x03]); // NEXT_HOP length must be 4
        let attributes =
            parse_attributes(data, &AsnLength::Bits16, false, None, None, None).unwrap();

        assert!(attributes.has_validation_warnings());
        match &attributes.inner[0].value {
            AttributeValue::Raw(raw) => {
                assert_eq!(raw.code, 3);
                assert_eq!(raw.attr_type(), AttrType::NEXT_HOP);
                assert_eq!(raw.bytes, Bytes::from_static(&[0x01, 0x02, 0x03]));
            }
            value => panic!("expected Raw fallback, got {value:?}"),
        }
        assert_eq!(
            attributes.encode(AsnLength::Bits16).unwrap(),
            Bytes::from_static(&[0x40, 0x03, 0x03, 0x01, 0x02, 0x03])
        );
    }

    #[test]
    fn test_malformed_attribute_after_others_keeps_its_own_bytes() {
        let data = Bytes::from(
            [
                // ORIGIN IGP
                &[0x40, 0x01, 0x01, 0x00][..],
                // NEXT_HOP with an extended length of 3 (must be 4)
                &[0x50, 0x03, 0x00, 0x03, 0x0a, 0x0b, 0x0c],
                // MED 7
                &[0x80, 0x04, 0x04, 0x00, 0x00, 0x00, 0x07],
            ]
            .concat(),
        );
        let attributes =
            parse_attributes(data, &AsnLength::Bits16, false, None, None, None).unwrap();

        assert_eq!(attributes.inner.len(), 3);
        assert_eq!(
            attributes.inner[0].value,
            AttributeValue::Origin(Origin::IGP)
        );
        match &attributes.inner[1].value {
            AttributeValue::Raw(raw) => {
                assert_eq!(raw.code, 3);
                assert_eq!(raw.bytes, Bytes::from_static(&[0x0a, 0x0b, 0x0c]));
            }
            value => panic!("expected Raw fallback, got {value:?}"),
        }
        assert_eq!(
            attributes.inner[2].value,
            AttributeValue::MultiExitDiscriminator(7)
        );
    }

    #[test]
    fn test_all_raw_retained_attribute_codes_parse_and_round_trip() {
        let raw_codes = [0, 22, 24, 27, 33, 128];

        for code in raw_codes {
            let wire = vec![0xc0, code, 0x02, 0xaa, 0xbb];
            let attributes = parse_attributes(
                Bytes::from(wire.clone()),
                &AsnLength::Bits16,
                false,
                None,
                None,
                None,
            )
            .unwrap();
            assert_eq!(attributes.inner.len(), 1, "code {code}");
            match &attributes.inner[0].value {
                AttributeValue::Raw(raw) => {
                    assert_eq!(raw.code, code);
                    assert_eq!(raw.bytes, Bytes::from_static(&[0xaa, 0xbb]));
                }
                value => panic!("expected Raw for code {code}, got {value:?}"),
            }
            assert!(attributes.has_attr(AttrType::from(code)), "code {code}");
            assert_eq!(
                attributes.encode(AsnLength::Bits16).unwrap(),
                Bytes::from(wire)
            );
        }
    }

    #[test]
    fn test_unassigned_attribute_code_retained_as_unknown() {
        let wire = vec![0xc0, 0x7f, 0x02, 0xaa, 0xbb];
        let attributes = parse_attributes(
            Bytes::from(wire.clone()),
            &AsnLength::Bits16,
            false,
            None,
            None,
            None,
        )
        .unwrap();

        assert_eq!(attributes.inner.len(), 1);
        match &attributes.inner[0].value {
            AttributeValue::Unknown(raw) => {
                assert_eq!(raw.code, 0x7f);
                assert_eq!(raw.attr_type(), AttrType::Unknown(0x7f));
                assert_eq!(raw.bytes, Bytes::from_static(&[0xaa, 0xbb]));
            }
            value => panic!("expected Unknown, got {value:?}"),
        }
        assert!(attributes.has_attr(AttrType::Unknown(0x7f)));
        assert_eq!(
            attributes.encode(AsnLength::Bits16).unwrap(),
            Bytes::from(wire)
        );
    }

    #[test]
    fn test_structured_tlv_attributes_parse_and_round_trip() {
        let cases = [
            (
                vec![0xc0, 0x26, 0x05, 0x01, 0x01, 0x02, 0x03, 0x04],
                "BFD Discriminator",
            ),
            (
                vec![0xc0, 0x28, 0x05, 0x7f, 0x00, 0x02, 0xaa, 0xbb],
                "BGP Prefix-SID",
            ),
            (
                vec![0xc0, 0x29, 0x06, 0x12, 0x34, 0x00, 0x02, 0xde, 0xad],
                "BIER",
            ),
            (vec![0xc0, 0x25, 0x05, 0x7f, 0x00, 0x02, 0xde, 0xad], "SFP"),
            (
                vec![
                    0xc0, 0x24, 0x0f, // BGP Domain Path, 15-octet value
                    0x02, // segment: 2 domains
                    0x00, 0x00, 0x00, 0x0A, 0x00, 0x02, 0x80, // ASN 10 / 2 / 128
                    0x00, 0x00, 0x00, 0x0B, 0x00, 0x03, 0x46, // ASN 11 / 3 / 70
                ],
                "BGP Domain Path",
            ),
        ];

        for (wire, name) in cases {
            let data = Bytes::from(wire.clone());
            let attributes =
                parse_attributes(data, &AsnLength::Bits16, false, None, None, None).unwrap();
            assert_eq!(attributes.inner.len(), 1, "{name}");
            match (name, &attributes.inner[0].value) {
                ("BFD Discriminator", AttributeValue::BfdDiscriminator(_))
                | ("BGP Prefix-SID", AttributeValue::BgpPrefixSid(_))
                | ("BIER", AttributeValue::Bier(_))
                | ("SFP", AttributeValue::Sfp(_))
                | ("BGP Domain Path", AttributeValue::DomainPath(_)) => {}
                (_, value) => panic!("unexpected value for {name}: {value:?}"),
            }
            assert_eq!(
                attributes.encode(AsnLength::Bits16).unwrap(),
                Bytes::from(wire),
                "{name}"
            );
        }
    }

    #[test]
    fn test_rfc7606_attribute_length_error() {
        // Create an ORIGIN attribute with wrong length (should be 1 byte, not 2)
        let data = Bytes::from(vec![0x40, 0x01, 0x02, 0x00, 0x01]);
        let asn_len = AsnLength::Bits16;
        let add_path = false;
        let afi = None;
        let safi = None;
        let prefixes = None;

        let attributes = parse_attributes(data, &asn_len, add_path, afi, safi, prefixes).unwrap();

        // Should have warning for incorrect attribute length
        assert!(attributes.has_validation_warnings());
        let warnings = attributes.validation_warnings();

        let has_length_warning = warnings
            .iter()
            .any(|w| matches!(w, BgpValidationWarning::AttributeLengthError { .. }));
        assert!(has_length_warning);
    }

    #[test]
    fn test_rfc7606_no_session_reset() {
        // Test that parsing continues even with multiple errors
        let data = Bytes::from(vec![
            0x80, 0x01, 0x02, 0x00, 0x01, // Wrong flags and length for ORIGIN
            0x40, 0x01, 0x01, 0x00, // Duplicate ORIGIN
            0x40, 0xFF, 0x01, 0x00, // Unknown attribute
        ]);
        let asn_len = AsnLength::Bits16;
        let add_path = false;
        let afi = None;
        let safi = None;
        let prefixes = None;

        // Should not panic or return error - RFC 7606 requires continued parsing
        let result = parse_attributes(data, &asn_len, add_path, afi, safi, prefixes);
        assert!(result.is_ok());

        let attributes = result.unwrap();
        assert!(attributes.has_validation_warnings());

        // Should have multiple warnings but parsing should continue
        let warnings = attributes.validation_warnings();
        assert!(!warnings.is_empty());
    }

    #[test]
    fn test_encode_as_path_attribute_type_selection() {
        // Regression test for issue #329: an AS_PATH built for a 4-octet
        // session must encode as attribute type 2 with 4-octet segments, not
        // as AS4_PATH (type 17).
        let attrs = Attributes::from_iter(vec![AttributeValue::AsPath(AsPath::from_sequence([
            400644,
        ]))]);
        let buf = attrs.encode(AsnLength::Bits32).unwrap();
        assert_eq!(buf[1], 2, "attribute type must be AS_PATH (2)");
        // segment header (type 2, count 1) + one 4-octet ASN
        assert_eq!(&buf[3..], &[0x02, 0x01, 0x00, 0x06, 0x1D, 0x04]);

        // AS4_PATH always encodes as type 17 with 4-octet segments, even on a
        // 2-octet session (RFC 6793 §4.2).
        let attrs = Attributes::from_iter(vec![AttributeValue::As4Path(AsPath::from_sequence([
            400644,
        ]))]);
        let buf = attrs.encode(AsnLength::Bits16).unwrap();
        assert_eq!(buf[1], 17, "attribute type must be AS4_PATH (17)");
        assert_eq!(&buf[3..], &[0x02, 0x01, 0x00, 0x06, 0x1D, 0x04]);
    }

    #[test]
    fn test_encode_as_path_on_2octet_session() {
        let attrs = Attributes::from_iter(vec![AttributeValue::AsPath(AsPath::from_sequence([
            64496, 64497,
        ]))]);
        let buf = attrs.encode(AsnLength::Bits16).unwrap();
        assert_eq!(buf[1], 2);
        // segment header (type 2, count 2) + two 2-octet ASNs
        assert_eq!(&buf[3..], &[0x02, 0x02, 0xFB, 0xF0, 0xFB, 0xF1]);
    }

    #[test]
    fn test_encode_as_path_rejects_4octet_asn_on_2octet_session() {
        // A 4-octet AS number that does not fit a 2-octet segment must be an
        // encoding error, not a silent truncation to its low 16 bits.
        let attrs = Attributes::from_iter(vec![AttributeValue::AsPath(AsPath::from_sequence([
            400644,
        ]))]);
        let err = attrs.encode(AsnLength::Bits16).unwrap_err();
        assert_eq!(
            err,
            EncodingError::ValueTooLarge {
                field: "2-octet AS number in AS_PATH segment",
                actual: 400644,
                max: 65535,
            }
        );
    }

    #[test]
    fn test_encode_aggregator_attribute_type_selection() {
        let attrs = Attributes::from_iter(vec![AttributeValue::As4Aggregator {
            asn: Asn::new_32bit(400644),
            id: std::net::Ipv4Addr::new(192, 0, 2, 1),
        }]);
        let buf = attrs.encode(AsnLength::Bits16).unwrap();
        assert_eq!(buf[1], 18, "attribute type must be AS4_AGGREGATOR (18)");
        assert_eq!(
            buf.len(),
            3 + 8,
            "value must be a 4-octet ASN plus an IPv4 id"
        );
    }

    #[test]
    fn test_encode_aggregator_width_follows_session_not_asn_flag() {
        // A 4-octet-flagged Asn holding a value that fits 16 bits must encode
        // as 2 octets on a 2-octet session: the session width decides, not the
        // Asn's internal flag.
        let attrs = Attributes::from_iter(vec![AttributeValue::Aggregator {
            asn: Asn::new_32bit(258),
            id: std::net::Ipv4Addr::new(10, 0, 0, 1),
        }]);
        let buf = attrs.encode(AsnLength::Bits16).unwrap();
        assert_eq!(buf[1], 7, "attribute type must be AGGREGATOR (7)");
        assert_eq!(buf.len(), 3 + 6);
        assert_eq!(&buf[3..], &[0x01, 0x02, 10, 0, 0, 1]);
    }

    #[test]
    fn test_parse_attributes_maps_as4_wire_types() {
        // AS4_PATH (type 17): optional transitive flag 0xC0, one AS_SEQUENCE
        // segment with the 4-octet ASN 400644.
        let data = Bytes::from(vec![0xC0, 17, 6, 0x02, 0x01, 0x00, 0x06, 0x1D, 0x04]);
        let attributes = parse_attributes(data, &AsnLength::Bits16, false, None, None, None)
            .expect("AS4_PATH must parse");
        match attributes.get_attr(AttrType::AS4_PATH).unwrap().value {
            AttributeValue::As4Path(path) => assert_eq!(
                path.to_u32_vec_opt(false).unwrap(),
                vec![400644],
                "AS4_PATH segments must parse as 4-octet regardless of session length"
            ),
            other => panic!("expected As4Path variant, got {other:?}"),
        }

        // AS4_AGGREGATOR (type 18): 4-octet ASN plus an IPv4 id.
        let data = Bytes::from(vec![0xC0, 18, 8, 0x00, 0x06, 0x1D, 0x04, 192, 0, 2, 1]);
        let attributes = parse_attributes(data, &AsnLength::Bits16, false, None, None, None)
            .expect("AS4_AGGREGATOR must parse");
        match attributes.get_attr(AttrType::AS4_AGGREGATOR).unwrap().value {
            AttributeValue::As4Aggregator { asn, .. } => {
                assert_eq!(asn, Asn::new_32bit(400644))
            }
            other => panic!("expected As4Aggregator variant, got {other:?}"),
        }
    }
}