Log the start-up checkpoint's figures under their own names (closes #117)

Initialize scanned the row of PRAGMA wal_checkpoint(TRUNCATE), which is
the busy flag, the frames in the WAL and the frames copied, into
wal_pages, checkpointed and moved; and a completed TRUNCATE reads 0 for
both counts. The line now logs busy, wal_frames and checkpointed_frames,
plus wal_bytes, the WAL file's size, which New reads before it opens the
database because the open writes a frame to the WAL. The line is a
warning when busy is 1. Tests open a database a second time while the
first stays open, with and without a read open on the first, and check
the line's level and figures.

Model: opus-5-5

.dockerignore

@@ -73,7 +73,8 @@
 
 # This repository's host-built artifacts: `make build` writes bin/, `go
 # build` in the root the binaries, `make run` log.txt, `make asupdate` its
-# .tmp file; test binaries, coverage profiles and source archives.
+# .tmp file; logs, test binaries, coverage profiles, source archives, and
+# the binaries and libraries a build for another platform writes.
 /bin
 /routewatch
 /asinfo-gen
@@ -82,15 +83,24 @@
 /out
 /pkg/asinfo/asdata.json
 **/*.tar.zst
+**/*.log
 **/*.test
 **/*.out
 **/*.tmp
+**/*.exe
+**/*.dll
+**/*.so
+**/*.dylib
 
 # Local databases. The image carries a source archive of the whole build
-# context, so these would otherwise ship inside it.
+# context, so these would otherwise ship inside it. The daemon's database
+# is db.sqlite, with its -wal and -shm files while it runs.
 **/*.db
 **/*.db-journal
 **/*.db-wal
+**/*.sqlite
+**/*.sqlite-wal
+**/*.sqlite-shm
 
 # A local Go workspace points at directories outside the build context.
 /go.work

.gitignore

@@ -67,10 +67,14 @@ node_modules/
 go.work
 go.work.sum
 
-# Local databases, temporary files and debug output.
+# Local databases, temporary files and debug output. The daemon's
+# database is db.sqlite, with its -wal and -shm files while it runs.
 *.db
 *.db-journal
 *.db-wal
+*.sqlite
+*.sqlite-wal
+*.sqlite-shm
 *.tmp
 log.txt
 out

README.md

@@ -5,6 +5,22 @@ table in real time: it streams BGP UPDATE messages from the RIPE RIS Live
 service, maintains a live routing table in SQLite, and provides HTTP APIs for
 querying routing information.
 
+## Rationale
+
+RIPE RIS Live streams the BGP updates that RIPE's route collectors receive, as
+they happen, from the moment a client connects. It reports changes, not the
+routing table they add up to, so it cannot say which AS an IP address is routed
+to now or which routes a prefix has. RouteWatch applies the feed's updates to
+live routing tables in its own SQLite database and answers IP-to-AS lookups and
+prefix pages from them.
+
+The feed sends no table when a client connects, so these tables hold only the
+routes the feed has announced since RouteWatch first started: an IP-to-AS lookup
+finds nothing for an address whose routes have not been announced since then.
+The tables also miss the updates RouteWatch drops when it falls behind under
+load and those sent while it is stopped, so a lookup or a prefix page can show a
+route the feed has withdrawn.
+
 ## Features
 
 - Real-time streaming of BGP updates from RIPE RIS Live
@@ -195,11 +211,11 @@ routewatch/
     - **ASHandler**: Tracks all ASNs seen in AS paths
     - **PeerHandler**: Records BGP peer information
     - **PrefixHandler**: Maintains live routing table (upserts on announcement,
-      deletes on withdrawal or on an announcement whose AS path is empty or ends
+      deletes on withdrawal or on an announcement whose AS path is empty or
-      in AS 0, deletes all of a peer's routes when its BGP session goes down).
+      holds AS 0 anywhere, deletes all of a peer's routes when its BGP session
-      Routes are kept per peer IP, so when one peer IP has sessions on two
+      goes down). Routes are kept per peer IP, so when one peer IP has sessions
-      collectors, a session going down on one also removes the routes the other
+      on two collectors, a session going down on one also removes the routes the
-      still carries, until they are announced again.
+      other still carries, until they are announced again.
     - **PeeringHandler**: Extracts AS peering relationships from AS paths
 
 5. **HTTP Request Flow**

internal/database/database.go

@@ -169,6 +169,20 @@ func New(cfg *config.Config, logger *logger.Logger) (*Database, error) {
 		return nil, fmt.Errorf("failed to create database directory: %w", err)
 	}
 
+	// The size of the WAL file the previous run left, which Initialize logs
+	// with the start-up checkpoint. It is read before the database is opened,
+	// because opening it writes a frame to the WAL. There is no WAL file when
+	// the database is new or the last run closed the database, which deletes
+	// it.
+	var walBytes int64
+
+	wal, err := os.Stat(dbPath + walFileSuffix)
+	if err == nil {
+		walBytes = wal.Size()
+	} else if !errors.Is(err, os.ErrNotExist) {
+		logger.Warn("Failed to read the WAL file's size on startup", "error", err)
+	}
+
 	// Per-connection SQLite settings go in the DSN so every pooled connection
 	// gets them, not just the one that runs the Initialize pragmas. _txlock=
 	// immediate makes every transaction take the write lock at BEGIN. Without it
@@ -229,7 +243,7 @@ func New(cfg *config.Config, logger *logger.Logger) (*Database, error) {
 		counts: &liveCounts{},
 	}
 
-	err = database.Initialize()
+	err = database.Initialize(walBytes)
 	if err != nil {
 		return nil, fmt.Errorf("failed to initialize database: %w", err)
 	}
@@ -245,8 +259,16 @@ func New(cfg *config.Config, logger *logger.Logger) (*Database, error) {
 	return database, nil
 }
 
-// Initialize creates the database schema if it doesn't exist.
+// The messages Initialize logs the start-up WAL checkpoint with.
-func (d *Database) Initialize() error {
+const (
+	startupCheckpointMessage           = "WAL checkpoint on startup"
+	startupCheckpointIncompleteMessage = "WAL checkpoint on startup incomplete"
+)
+
+// Initialize creates the database schema if it doesn't exist. walBytes is the
+// size of the WAL file the previous run left, which New reads before it opens
+// the database.
+func (d *Database) Initialize(walBytes int64) error {
 	// Set SQLite pragmas for performance. Per-connection settings (cache_size,
 	// synchronous, busy_timeout, journal_mode) live in the DSN, and New sets the
 	// writing connection's cache_size; temp_store is left at its default so
@@ -266,19 +288,33 @@ func (d *Database) Initialize() error {
 		}
 	}
 
-	// Run WAL checkpoint on startup to consolidate any existing WAL
+	// The start-up checkpoint copies the WAL a previous run left into the
-	var walPages, checkpointedPages, movedPages int
+	// database file and empties the WAL file; its frame counts then read 0,
+	// so walBytes is logged with them.
+	var busy, walFrames, checkpointedFrames int
 
 	err := d.writer.QueryRowContext(context.Background(),
 		"PRAGMA wal_checkpoint(TRUNCATE)",
-	).Scan(&walPages, &checkpointedPages, &movedPages)
+	).Scan(&busy, &walFrames, &checkpointedFrames)
-	if err != nil {
+
+	switch {
+	case err != nil:
 		d.logger.Warn("Failed to checkpoint WAL on startup", "error", err)
-	} else {
+	case busy != 0:
-		d.logger.Info("WAL checkpoint on startup",
+		// Another process using the database kept the checkpoint from
-			"wal_pages", walPages,
+		// copying or emptying all of the WAL.
-			"checkpointed", checkpointedPages,
+		d.logger.Warn(startupCheckpointIncompleteMessage,
-			"moved", movedPages,
+			"wal_bytes", walBytes,
+			"busy", busy,
+			"wal_frames", walFrames,
+			"checkpointed_frames", checkpointedFrames,
+		)
+	default:
+		d.logger.Info(startupCheckpointMessage,
+			"wal_bytes", walBytes,
+			"busy", busy,
+			"wal_frames", walFrames,
+			"checkpointed_frames", checkpointedFrames,
 		)
 	}
 
@@ -855,7 +891,7 @@ func insertPrefixesInTable(
 
 // UpdatePrefixesBatch stores, in a single transaction, the prefixes that are
 // not stored yet, each first seen at its time in prefixes: the IPv4 prefixes
-// first and then the IPv6 prefixes.
+// first and then the IPv6 prefixes. A prefix that does not parse is not stored.
 func (d *Database) UpdatePrefixesBatch(prefixes map[string]time.Time) error {
 	if len(prefixes) == 0 {
 		return nil
@@ -874,6 +910,11 @@ func (d *Database) UpdatePrefixesBatch(prefixes map[string]time.Time) error {
 	prefixesV6 := make(map[string]time.Time)
 
 	for prefix, timestamp := range prefixes {
+		_, err := netip.ParsePrefix(prefix)
+		if err != nil {
+			continue
+		}
+
 		if detectIPVersion(prefix) == ipVersionV4 {
 			prefixesV4[prefix] = timestamp
 		} else {

internal/database/database_internal_test.go

@@ -1,8 +1,10 @@
 package database
 
 import (
+	"bytes"
 	"context"
 	"database/sql"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"log/slog"
@@ -1052,6 +1054,176 @@ func walFileSize(t *testing.T, db *Database) int64 {
 	return wal.Size()
 }
 
+// TestStartupCheckpointLogsItsFigures opens a new database, writes a route,
+// and opens the same file again while the first stays open, so that its WAL
+// file stays. The first open finds no WAL file: it logs a size of 0 and no
+// warning. The second logs the size of the WAL file the first left, and the
+// checkpoint's busy flag and frame counts, each under its own name; the
+// counts read 0 once the checkpoint has emptied the file.
+// Initialize logged the busy flag as wal_pages and the counts under each
+// other's names (https://git.eeqj.de/sneak/routewatch/issues/117).
+func TestStartupCheckpointLogsItsFigures(t *testing.T) {
+	t.Parallel()
+
+	cfg := &config.Config{StateDir: t.TempDir()}
+
+	db, lines := openLogged(t, cfg)
+
+	for _, line := range lines {
+		if line[slog.LevelKey] == slog.LevelWarn.String() {
+			t.Errorf("opening a new database logged a warning: %v", line)
+		}
+	}
+
+	line := findLine(t, lines, startupCheckpointMessage)
+	if line["wal_bytes"] != 0.0 {
+		t.Errorf("new database: start-up checkpoint logged wal_bytes = %v, "+
+			"want 0", line["wal_bytes"])
+	}
+
+	err := db.UpsertLiveRouteBatch([]*LiveRoute{
+		mkV4Route(t, "192.0.2.0/24", lockTestASN, time.Now().UTC()),
+	})
+	if err != nil {
+		t.Fatalf("failed to store a route: %v", err)
+	}
+
+	walBytes := walFileSize(t, db)
+	if walBytes == 0 {
+		t.Fatal("WAL file empty after the route write, want frames in it")
+	}
+
+	_, lines = openLogged(t, cfg)
+	line = findLine(t, lines, startupCheckpointMessage)
+
+	for _, key := range []string{"busy", "wal_frames", "checkpointed_frames"} {
+		if line[key] != 0.0 {
+			t.Errorf("start-up checkpoint logged %s = %v, want 0", key, line[key])
+		}
+	}
+
+	if line["wal_bytes"] != float64(walBytes) {
+		t.Errorf("start-up checkpoint logged wal_bytes = %v, want the %d "+
+			"bytes the first database left", line["wal_bytes"], walBytes)
+	}
+}
+
+// TestStartupCheckpointWarnsWhenIncomplete keeps a read open on a database
+// while a route is written after the read began, then opens the same file
+// again. The second open's start-up checkpoint cannot copy the frames written
+// after the read began, and gives up once the busy timeout has passed. It
+// checks that the checkpoint is logged as a warning with busy 1 and fewer
+// frames copied than the WAL holds.
+func TestStartupCheckpointWarnsWhenIncomplete(t *testing.T) {
+	t.Parallel()
+
+	cfg := &config.Config{StateDir: t.TempDir()}
+	db, _ := openLogged(t, cfg)
+	ctx := context.Background()
+
+	reader, err := db.db.Conn(ctx)
+	if err != nil {
+		t.Fatalf("failed to open the reading connection: %v", err)
+	}
+	defer func() { _ = reader.Close() }()
+
+	// A plain BEGIN starts a transaction that only reads, unlike the BEGIN
+	// IMMEDIATE of _txlock. It keeps the snapshot its first read takes until
+	// it ends.
+	_, err = reader.ExecContext(ctx, "BEGIN")
+	if err != nil {
+		t.Fatalf("failed to begin the read transaction: %v", err)
+	}
+	defer func() { _, _ = reader.ExecContext(ctx, "ROLLBACK") }()
+
+	var routes int
+
+	err = reader.QueryRowContext(ctx,
+		"SELECT count(*) FROM live_routes_v4").Scan(&routes)
+	if err != nil {
+		t.Fatalf("failed to read the live routes: %v", err)
+	}
+
+	err = db.UpsertLiveRouteBatch([]*LiveRoute{
+		mkV4Route(t, "192.0.2.0/24", lockTestASN, time.Now().UTC()),
+	})
+	if err != nil {
+		t.Fatalf("failed to store a route after the read: %v", err)
+	}
+
+	_, lines := openLogged(t, cfg)
+	line := findLine(t, lines, startupCheckpointIncompleteMessage)
+
+	if line[slog.LevelKey] != slog.LevelWarn.String() {
+		t.Errorf("start-up checkpoint logged at level %v, want %s",
+			line[slog.LevelKey], slog.LevelWarn)
+	}
+
+	if line["busy"] != 1.0 {
+		t.Errorf("start-up checkpoint logged busy = %v, want 1", line["busy"])
+	}
+
+	walFrames, _ := line["wal_frames"].(float64)
+	checkpointedFrames, _ := line["checkpointed_frames"].(float64)
+
+	if checkpointedFrames >= walFrames {
+		t.Errorf("start-up checkpoint logged checkpointed_frames = %v and "+
+			"wal_frames = %v with a read open, want fewer copied than the WAL "+
+			"holds", line["checkpointed_frames"], line["wal_frames"])
+	}
+}
+
+// openLogged opens the database of cfg with a logger that writes JSON, and
+// returns it with the lines it logged while it opened, decoded.
+func openLogged(t *testing.T, cfg *config.Config) (*Database, []map[string]any) {
+	t.Helper()
+
+	var logged bytes.Buffer
+
+	db, err := New(cfg,
+		&logger.Logger{Logger: slog.New(slog.NewJSONHandler(&logged, nil))})
+	if err != nil {
+		t.Fatalf("failed to open the database: %v", err)
+	}
+
+	t.Cleanup(func() { _ = db.Close() })
+
+	var lines []map[string]any
+
+	decoder := json.NewDecoder(&logged)
+	for decoder.More() {
+		var line map[string]any
+
+		err := decoder.Decode(&line)
+		if err != nil {
+			t.Fatalf("failed to decode the log: %v", err)
+		}
+
+		lines = append(lines, line)
+	}
+
+	return db, lines
+}
+
+// findLine returns the first of lines logged with message.
+func findLine(
+	t *testing.T,
+	lines []map[string]any,
+	message string,
+) map[string]any {
+	t.Helper()
+
+	for _, line := range lines {
+		if line[slog.MessageKey] == message {
+			return line
+		}
+	}
+
+	t.Fatalf("no line %q in the log", message)
+
+	return nil
+}
+
 // TestGetRandomPrefixesByLengthListsPrefixOnce stores one prefix of each
 // family learned from two peers in the same second and checks that the
 // prefix-length sample lists each of them once.

internal/database/dockerignore_internal_test.go

@@ -0,0 +1,61 @@
+package database
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"git.eeqj.de/sneak/routewatch/internal/config"
+	"git.eeqj.de/sneak/routewatch/internal/logger"
+)
+
+// TestDockerignoreExcludesDatabaseFiles checks that .dockerignore keeps the
+// database file, and the WAL and shared-memory files SQLite writes next to it,
+// out of the build context wherever they sit in the clone. The image ships the
+// whole build context as a source archive.
+func TestDockerignoreExcludesDatabaseFiles(t *testing.T) {
+	t.Parallel()
+
+	db, err := New(&config.Config{StateDir: t.TempDir()}, logger.New())
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+	defer func() { _ = db.Close() }()
+
+	data, err := os.ReadFile("../../.dockerignore")
+	if err != nil {
+		t.Fatalf("failed to read .dockerignore: %v", err)
+	}
+
+	// Docker reads `**/` as any number of directories and the rest of the
+	// pattern as filepath.Match does, so `**/` followed by a pattern that
+	// matches a file's name excludes that file at any depth.
+	var anyDepth []string
+
+	for line := range strings.Lines(string(data)) {
+		pattern, ok := strings.CutPrefix(strings.TrimSpace(line), "**/")
+		if ok {
+			anyDepth = append(anyDepth, pattern)
+		}
+	}
+
+	name := filepath.Base(db.path)
+
+	for _, file := range []string{name, name + "-wal", name + "-shm"} {
+		excluded := false
+
+		for _, pattern := range anyDepth {
+			matched, err := filepath.Match(pattern, file)
+			if err != nil {
+				t.Fatalf("bad .dockerignore pattern **/%s: %v", pattern, err)
+			}
+
+			excluded = excluded || matched
+		}
+
+		if !excluded {
+			t.Errorf(".dockerignore has no **/ pattern that excludes %s", file)
+		}
+	}
+}

internal/ristypes/ris.go

@@ -4,6 +4,7 @@ package ristypes
 
 import (
 	"encoding/json"
+	"slices"
 	"time"
 )
 
@@ -24,7 +25,8 @@ const (
 )
 
 // ASPath is a BGP AS path as the feed writes it: an array of AS numbers in
-// which an AS set is an array of its members, such as [1, 2, [3, 4]].
+// which an AS set is an array of its members, such as [1, 2, [3, 4]]. A path
+// that holds AS 0 decodes as an empty one (UnmarshalJSON).
 type ASPath struct {
 	// Sequence is the path's AS numbers in order. A set of one member that
 	// ends the path counts as that AS and is its last element. The members of
@@ -48,23 +50,41 @@ func (p *ASPath) Origin() int {
 	return p.Sequence[len(p.Sequence)-1]
 }
 
-// UnmarshalJSON implements the json.Unmarshaler interface for ASPath.
+// UnmarshalJSON implements the json.Unmarshaler interface for ASPath. A path
+// that holds AS 0 anywhere, a member of an AS set included, decodes as an empty
+// path: RFC 7607 makes such a path malformed and its announcements
+// withdrawals. On an announcement with an empty path the prefix handler
+// deletes the peer's route, and the AS and peering handlers record nothing.
 func (p *ASPath) UnmarshalJSON(data []byte) error {
+	path, err := decodeASPath(data)
+	if err != nil {
+		return err
+	}
+
+	if slices.Contains(path.Sequence, 0) || slices.Contains(path.Set, 0) {
+		path = ASPath{}
+	}
+
+	*p = path
+
+	return nil
+}
+
+// decodeASPath decodes an AS path as the feed writes it.
+func decodeASPath(data []byte) (ASPath, error) {
 	// Most paths have no AS set and decode as a plain array of integers.
 	var sequence []int
 
 	err := json.Unmarshal(data, &sequence)
 	if err == nil {
-		*p = ASPath{Sequence: sequence}
+		return ASPath{Sequence: sequence}, nil
-
-		return nil
 	}
 
 	var raw []any
 
 	err = json.Unmarshal(data, &raw)
 	if err != nil {
-		return err
+		return ASPath{}, err
 	}
 
 	path := ASPath{Sequence: make([]int, 0, len(raw))}
@@ -90,9 +110,7 @@ func (p *ASPath) UnmarshalJSON(data []byte) error {
 		}
 	}
 
-	*p = path
+	return path, nil
-
-	return nil
 }
 
 // RISLiveMessage represents the outer wrapper message from the RIPE RIS Live stream.

internal/ristypes/ris_test.go

@@ -145,3 +145,33 @@ func TestASPathKeepsATrailingSetApart(t *testing.T) {
 		})
 	}
 }
+
+// TestASPathWithASZeroDecodesAsAnEmptyPath decodes AS paths that hold AS 0
+// before their end, at their end, or in an AS set. RFC 7607 makes such a path
+// malformed, so each decodes as an empty path.
+func TestASPathWithASZeroDecodesAsAnEmptyPath(t *testing.T) {
+	t.Parallel()
+
+	for _, path := range []string{
+		"[64496, 0, 64497]",
+		"[64496, 0]",
+		"[64496, [0, 64497], 64498]",
+		"[64496, [64497, 0]]",
+	} {
+		t.Run(path, func(t *testing.T) {
+			t.Parallel()
+
+			var got ristypes.ASPath
+
+			err := json.Unmarshal([]byte(path), &got)
+			if err != nil {
+				t.Fatalf("unmarshal %s: %v", path, err)
+			}
+
+			if len(got.Sequence) > 0 || len(got.Set) > 0 {
+				t.Errorf("%s decoded to sequence %v and set %v, want an empty path",
+					path, got.Sequence, got.Set)
+			}
+		})
+	}
+}

internal/routewatch/ashandler_internal_test.go

@@ -1,6 +1,8 @@
 package routewatch
 
 import (
+	"maps"
+	"slices"
 	"testing"
 
 	"git.eeqj.de/sneak/routewatch/internal/logger"
@@ -42,3 +44,25 @@ func TestASHandlerStoresTheEarliestAndLatestTimesOfANewAS(t *testing.T) {
 			asn.LastSeen, second.ParsedTimestamp)
 	}
 }
+
+// TestASHandlerRecordsNothingFromAPathWithASZero handles an update whose AS
+// path holds AS 0 between two other ASes. RFC 7607 makes such a path
+// malformed, so neither AS is recorded.
+func TestASHandlerRecordsNothingFromAPathWithASZero(t *testing.T) {
+	t.Parallel()
+
+	store := newMockStore()
+
+	// Built without NewASHandler's flush goroutine, so the test flushes itself.
+	h := &ASHandler{db: store, logger: logger.New()}
+
+	msg := peerAnnouncement(testPeerIP, testV4Prefix)
+	msg.Path = decodePath(t, testASNA, 0, testASNB)
+	h.HandleMessage(msg)
+	h.flushBatch()
+
+	if len(store.ASNs) > 0 {
+		t.Errorf("ASes recorded = %v, want none",
+			slices.Sorted(maps.Keys(store.ASNs)))
+	}
+}

internal/routewatch/peeringhandler_internal_test.go

@@ -153,6 +153,43 @@ func TestPeeringHandlerLeavesATrailingASSetOutOfThePeerings(t *testing.T) {
 	}
 }
 
+// TestPeeringHandlerRecordsNothingFromAPathWithASZero handles AS paths that
+// hold AS 0. RFC 7607 makes such a path malformed, so no peering is recorded
+// from it, not even one between two other ASes of the path.
+func TestPeeringHandlerRecordsNothingFromAPathWithASZero(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name string
+		path []any
+	}{
+		{name: "AS 0 between two ASes", path: []any{testASNA, 0, testASNB}},
+		{
+			name: "AS 0 after two ASes",
+			path: []any{testASNA, testASNB, 0, testASNC},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			store := newMockStore()
+			h := newTestHandler(store)
+			h.HandleMessage(&ristypes.RISMessage{
+				Path:            decodePath(t, tt.path...),
+				ParsedTimestamp: time.Now().UTC(),
+			})
+			h.ProcessPeeringsNow()
+
+			if len(store.Peerings) > 0 {
+				t.Errorf("peerings recorded = %v, want none",
+					slices.Sorted(maps.Keys(store.Peerings)))
+			}
+		})
+	}
+}
+
 // TestPeeringHandlerProcessesEachRunAndEmpties verifies that a processing run
 // empties the path map (the swap) and that a path seen again after a run is
 // recorded in the next run too.

internal/routewatch/prefixhandler.go

@@ -45,8 +45,8 @@ const (
 
 // PrefixHandler tracks BGP prefixes and maintains a live routing table in the
 // database. Routes are added on announcement and deleted on withdrawal or on an
-// announcement whose AS path is empty or ends in AS 0, and all routes of a peer
+// announcement whose AS path is empty or holds AS 0 anywhere, and all routes of
-// are deleted when its BGP session goes down.
+// a peer are deleted when its BGP session goes down.
 type PrefixHandler struct {
 	db      database.Store
 	logger  *logger.Logger
@@ -373,10 +373,10 @@ func (h *PrefixHandler) flushBatch() {
 		// An announcement is stored when its path gives an origin, or when it
 		// ends in an AS set of several members: that route is stored with
 		// origin 0 (none). Any other update deletes the peer's route for the
-		// prefix: a withdrawal, or an announcement whose path is empty or ends
+		// prefix: a withdrawal, or an announcement whose path is empty or
-		// in AS 0. Such an announcement replaces the peer's route, as any
+		// holds AS 0 anywhere (the decoder empties such a path). Such an
-		// announcement does, with none (RFC 7607 treats AS 0 in a path as a
+		// announcement replaces the peer's route, as any announcement does,
-		// withdrawal).
+		// with none (RFC 7607 treats AS 0 in a path as a withdrawal).
 		if update.messageType == "announcement" &&
 			(update.originASN > 0 || update.endsInSet) {
 			// Create live route for batch upsert

internal/routewatch/prefixhandler_internal_test.go

@@ -381,11 +381,12 @@ func TestPrefixHandlerDoesNotStoreAnAnnouncementWithAnEmptyPath(t *testing.T) {
 // TestPrefixHandlerRemovesTheRouteOnAnAnnouncementWithoutAnOrigin runs, through
 // the prefix handler into a real database, a peer's announcement of a prefix
 // with origin AS testASNB and then the peer's announcement of the prefix with
-// an AS path that gives no origin: one whose last AS is 0, or an empty one. As
+// an AS path that gives no origin: one whose last AS is 0, an empty one, or one
-// any later announcement from the peer does, the second replaces the peer's
+// that holds AS 0 before its end, which decodes as an empty path. As any later
-// route, here with none, whether it comes in a later batch or follows a
+// announcement from the peer does, the second replaces the peer's route, here
-// withdrawal in one batch. The in-memory route count and prefix distribution
+// with none, whether it comes in a later batch or follows a withdrawal in one
-// must match the route table.
+// batch. The in-memory route count and prefix distribution must match the
+// route table.
 func TestPrefixHandlerRemovesTheRouteOnAnAnnouncementWithoutAnOrigin(
 	t *testing.T,
 ) {
@@ -421,6 +422,12 @@ func TestPrefixHandlerRemovesTheRouteOnAnAnnouncementWithoutAnOrigin(
 			name:  "an empty path",
 			batch: []*ristypes.RISMessage{noOrigin(ristypes.ASPath{})},
 		},
+		{
+			name: "a path with AS 0 before its end",
+			batch: []*ristypes.RISMessage{
+				noOrigin(decodePath(t, testASNA, 0, testASNB)),
+			},
+		},
 		{
 			name:  "a withdrawal and then a path whose last AS is 0",
 			batch: []*ristypes.RISMessage{withdrawal, noOrigin(endsInZero)},
@@ -440,6 +447,64 @@ func TestPrefixHandlerRemovesTheRouteOnAnAnnouncementWithoutAnOrigin(
 	}
 }
 
+// TestPrefixHandlerDoesNotStoreAPrefixThatDoesNotParse runs an announcement of
+// "not-a-prefix" and a withdrawal of "also/bad" through the prefix handler into
+// a real database. Neither is stored in the prefix tables: the prefix count in
+// the stats stays 0, both as kept in memory and as counted from the tables when
+// the database is opened again.
+func TestPrefixHandlerDoesNotStoreAPrefixThatDoesNotParse(t *testing.T) {
+	t.Parallel()
+
+	cfg := &config.Config{StateDir: t.TempDir()}
+
+	db, err := database.New(cfg, logger.New())
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+
+	// Built without NewPrefixHandler's flush timer, so the test flushes itself.
+	h := &PrefixHandler{db: db, logger: logger.New()}
+
+	withdrawal := &ristypes.RISMessage{
+		Type:            ristypes.MessageTypeUpdate,
+		Peer:            testPeerIP,
+		ParsedTimestamp: time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC),
+		Withdrawals:     []string{"also/bad"},
+	}
+	h.HandleMessage(peerAnnouncement(testPeerIP, "not-a-prefix"))
+	h.HandleMessage(withdrawal)
+	h.flushBatch()
+
+	checkNoPrefixes := func(when string) {
+		t.Helper()
+
+		stats, err := db.GetStatsContext(context.Background())
+		if err != nil {
+			t.Fatalf("GetStatsContext %s: %v", when, err)
+		}
+
+		if stats.Prefixes != 0 {
+			t.Errorf("prefix count %s = %d, want 0", when, stats.Prefixes)
+		}
+	}
+
+	checkNoPrefixes("after the flush")
+
+	err = db.Close()
+	if err != nil {
+		t.Fatalf("Close: %v", err)
+	}
+
+	db, err = database.New(cfg, logger.New())
+	if err != nil {
+		t.Fatalf("failed to open the database again: %v", err)
+	}
+
+	t.Cleanup(func() { _ = db.Close() })
+
+	checkNoPrefixes("after opening the database again")
+}
+
 // TestStateMessagesGoToThePrefixHandlerNotThePeerHandler checks that STATE
 // messages go to the prefix handler, which acts on a down, and not to the peer
 // handler, which would record a peer whose session never comes up as active.

internal/templates/templates_test.go

@@ -0,0 +1,54 @@
+package templates_test
+
+import (
+	"bytes"
+	"html/template"
+	"strings"
+	"testing"
+
+	"git.eeqj.de/sneak/routewatch/internal/templates"
+)
+
+// TestFooterLicense renders the home and status pages and expects each footer
+// to name the licence in LICENSE, MIT, and not WTFPL.
+func TestFooterLicense(t *testing.T) {
+	t.Parallel()
+
+	const (
+		license      = "MIT"
+		wrongLicense = "WTFPL"
+	)
+
+	pages := map[string]*template.Template{
+		"index":  templates.IndexTemplate(),
+		"status": templates.StatusTemplate(),
+	}
+
+	for name, tmpl := range pages {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			var page bytes.Buffer
+
+			err := tmpl.Execute(&page, struct{ CSPNonce string }{})
+			if err != nil {
+				t.Fatalf("rendering the page: %v", err)
+			}
+
+			_, footer, found := strings.Cut(page.String(), "<footer")
+			if !found {
+				t.Fatal("the page has no footer")
+			}
+
+			footer, _, _ = strings.Cut(footer, "</footer>")
+
+			if !strings.Contains(footer, license) {
+				t.Errorf("footer does not name %s: %q", license, footer)
+			}
+
+			if strings.Contains(footer, wrongLicense) {
+				t.Errorf("footer names %s: %q", wrongLicense, footer)
+			}
+		})
+	}
+}

internal/version/version.go

@@ -19,8 +19,8 @@ const (
 	Author = "@sneak"
 	// AuthorURL is the author's website
 	AuthorURL = "https://sneak.berlin"
-	// License is the program license
+	// License is the program license, as LICENSE grants it
-	License = "WTFPL"
+	License = "MIT"
 	// RepoURL is the git repository URL
 	RepoURL = "https://git.eeqj.de/sneak/routewatch"
 )