function is_self_net() {
  return net ~ [172.20.170.192/27+];
}

function is_valid_network() {
  return net ~ [
    172.20.0.0/14{21,29}, # dn42
    172.20.0.0/24{28,32}, # dn42 Anycast
    172.21.0.0/24{28,32}, # dn42 Anycast
    172.22.0.0/24{28,32}, # dn42 Anycast
    172.23.0.0/24{28,32}, # dn42 Anycast
    172.31.0.0/16+,       # ChaosVPN
    10.100.0.0/14+,       # ChaosVPN
    10.0.0.0/8{15,24}     # Freifunk.net
  ];
}

roa table dn42_roa {
    include "/var/lib/bird/bird_roa_dn42.conf";
};

function check_roa() {
  if (roa_check(dn42_roa, net, bgp_path.last) = ROA_INVALID) then {
    print "[dn42] ROA check failed for ", net, " ASN ", bgp_path.last;
    return false;
  }
  return true;
}

function import_filter_networks() {
  if is_valid_network() && !is_self_net() then {
    return true;
  }
  return false;
}

function dn42peer_import_policy() {
  if(!check_roa()) then return false;
  if(!import_filter_networks()) then return false;
}