RFC 1479

Inter-Domain Policy Routing Protocol Specification: Version 1 🦋

Okay bestie, this is RFC 1479, and it's giving serious networking authority ✨ It's part of the Network Working Group series.

Title block tea 🍵

• Request for Comments: 1479
• Author: M. Steenstrup, from BBN Systems and Technologies
• Date: July 1993
• Category: IAB standards track protocol
• Obsoletes / Updates: neither is listed in the header, so it doesn't replace or update anything else 🌸

Status of This Memo 📜

Okay so this RFC is an IAB standards track protocol for the whole Internet community, and it's literally asking for discussion and suggestions for improvements 🫶 For the current standardization state and status of this protocol, check the current edition of the "IAB Official Protocol Standards." Also, distribution of this memo is unlimited, so share the wealth 💖

Abstract 💅

This is the set of protocols and procedures that make up Inter-Domain Policy Routing (IDPR), and the whole package is iconic 😭 IDPR includes the virtual gateway protocol, the flooding protocol, the route server query protocol, the route generation procedure, the path control protocol, and the data message forwarding procedure. That's a lot of moving parts, and they all work together ✨

Contributors 🎀

These people helped shape the protocols and procedures in this document, so give them a flower 🌸 Helen Bowns, Lee Breslau, Ken Carlberg, Isidro Castineyra, Deborah Estrin, Tony Li, Mike Little, Katia Obraczka, Sam Resheff, Martha Steenstrup, Gene Tsudik, and Robert Woodburn. Legends, all of them 👑

Table of Contents 🗂️

Table of Contents

   1. Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . 3
   1.1. Domain Elements . . . . . . . . . . . . . . . . . . . . . . . 3
   1.2. Policy. . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
   1.3. IDPR Functions. . . . . . . . . . . . . . . . . . . . . . . . 5
   1.3.1. IDPR Entities . . . . . . . . . . . . . . . . . . . . . . . 6
   1.4. Policy Semantics. . . . . . . . . . . . . . . . . . . . . . . 7
   1.4.1. Source Policies . . . . . . . . . . . . . . . . . . . . . . 7
   1.4.2. Transit Policies. . . . . . . . . . . . . . . . . . . . . . 8
   1.5. IDPR Message Encapsulation. . . . . . . . . . . . . . . . . . 9
   1.5.1. IDPR Data Message Format. . . . . . . . . . . . . . . . . .11
   1.6. Security. . . . . . . . . . . . . . . . . . . . . . . . . . .12
   1.7. Timestamps and Clock Synchronization. . . . . . . . . . . . .13
   1.8. Network Management. . . . . . . . . . . . . . . . . . . . . .14
   1.8.1. Policy Gateway Configuration. . . . . . . . . . . . . . . .17
   1.8.2. Route Server Configuration. . . . . . . . . . . . . . . . .18
   2. Control Message Transport Protocol. . . . . . . . . . . . . . .18
   2.1. Message Transmission. . . . . . . . . . . . . . . . . . . . .20
   2.2. Message Reception . . . . . . . . . . . . . . . . . . . . . .22
   2.3. Message Validation. . . . . . . . . . . . . . . . . . . . . .23
   2.4. CMTP Message Formats. . . . . . . . . . . . . . . . . . . . .24
   3. Virtual Gateway Protocol. . . . . . . . . . . . . . . . . . . .27
   3.1. Message Scope . . . . . . . . . . . . . . . . . . . . . . . .28
   3.1.1. Pair-PG Messages. . . . . . . . . . . . . . . . . . . . . .28
   3.1.2. Intra-VG Messages . . . . . . . . . . . . . . . . . . . . .29
   3.1.3. Inter-VG Messages . . . . . . . . . . . . . . . . . . . . .29
   3.1.4. VG Representatives. . . . . . . . . . . . . . . . . . . . .31
   3.2. Up/Down Protocol. . . . . . . . . . . . . . . . . . . . . . .31
   3.3. Implementation. . . . . . . . . . . . . . . . . . . . . . . .33
   3.4. Policy Gateway Connectivity . . . . . . . . . . . . . . . . .35
   3.4.1. Within a Virtual Gateway. . . . . . . . . . . . . . . . . .35
   3.4.2. Between Virtual Gateways. . . . . . . . . . . . . . . . . .37
   3.4.3. Communication Complexity. . . . . . . . . . . . . . . . . .40
   3.5. VGP Message Formats . . . . . . . . . . . . . . . . . . . . .41
   3.5.1. UP/DOWN . . . . . . . . . . . . . . . . . . . . . . . . . .41
   3.5.2. PG CONNECT. . . . . . . . . . . . . . . . . . . . . . . . .42
   3.5.3. PG POLICY . . . . . . . . . . . . . . . . . . . . . . . . .43
   3.5.4. VG CONNECT. . . . . . . . . . . . . . . . . . . . . . . . .44
   3.5.5. VG POLICY . . . . . . . . . . . . . . . . . . . . . . . . .45
   3.5.6. Negative Acknowledgements . . . . . . . . . . . . . . . . .46
   4. Routing Information Distribution. . . . . . . . . . . . . . . .47
   4.1. AD Representatives. . . . . . . . . . . . . . . . . . . . . .48
   4.2. Flooding Protocol . . . . . . . . . . . . . . . . . . . . . .48
   4.2.1. Message Generation. . . . . . . . . . . . . . . . . . . . .50
   4.2.2. Sequence Numbers. . . . . . . . . . . . . . . . . . . . . .52
   4.2.3. Message Acceptance. . . . . . . . . . . . . . . . . . . . .52
   4.2.4. Message Incorporation . . . . . . . . . . . . . . . . . . .54
   4.2.5. Routing Information Database. . . . . . . . . . . . . . . .56
   4.3. Routing Information Message Formats . . . . . . . . . . . . .57
   4.3.1. CONFIGURATION . . . . . . . . . . . . . . . . . . . . . . .57
   4.3.2. DYNAMIC . . . . . . . . . . . . . . . . . . . . . . . . . .62
   4.3.3. Negative Acknowledgements . . . . . . . . . . . . . . . . .63
   5. Route Server Query Protocol . . . . . . . . . . . . . . . . . .64
   5.1. Message Exchange. . . . . . . . . . . . . . . . . . . . . . .64
   5.2. Remote Route Server Communication . . . . . . . . . . . . . .65
   5.3. Routing Information . . . . . . . . . . . . . . . . . . . . .66
   5.4. Routes. . . . . . . . . . . . . . . . . . . . . . . . . . . .67
   5.5. Route Server Message Formats. . . . . . . . . . . . . . . . .67
   5.5.1. ROUTING INFORMATION REQUEST . . . . . . . . . . . . . . . .67
   5.5.2. ROUTE REQUEST . . . . . . . . . . . . . . . . . . . . . . .68
   5.5.3. ROUTE RESPONSE. . . . . . . . . . . . . . . . . . . . . . .71
   5.5.4. Negative Acknowledgements . . . . . . . . . . . . . . . . .72
   6. Route Generation. . . . . . . . . . . . . . . . . . . . . . . .73
   6.1. Searching . . . . . . . . . . . . . . . . . . . . . . . . . .74
   6.1.1. Implementation. . . . . . . . . . . . . . . . . . . . . . .75
   6.2. Route Directionality. . . . . . . . . . . . . . . . . . . . .78
   6.3. Route Database. . . . . . . . . . . . . . . . . . . . . . . .79
   6.3.1. Cache Maintenance . . . . . . . . . . . . . . . . . . . . .80
   7. Path Control Protocol and Data Message Forwarding Procedure . .80
   7.1. An Example of Path Setup. . . . . . . . . . . . . . . . . . .81
   7.2. Path Identifiers. . . . . . . . . . . . . . . . . . . . . . .84
   7.3. Path Control Messages . . . . . . . . . . . . . . . . . . . .85
   7.4. Setting Up and Tearing Down a Path. . . . . . . . . . . . . .87
   7.4.1. Validating Path Identifiers . . . . . . . . . . . . . . . .89
   7.4.2. Path Consistency with Configured Transit Policies . . . . .89
   7.4.3. Path Consistency with Virtual Gateway Reachability. . . . .91
   7.4.4. Obtaining Resources . . . . . . . . . . . . . . . . . . . .92
   7.4.5. Target Response . . . . . . . . . . . . . . . . . . . . . .93
   7.4.6. Originator Response . . . . . . . . . . . . . . . . . . . .93
   7.4.7. Path Life . . . . . . . . . . . . . . . . . . . . . . . .  94
   7.5. Path Failure and Recovery . . . . . . . . . . . . . . . . .  95
   7.5.1. Handling Implicit Path Failures . . . . . . . . . . . . .  96
   7.5.2. Local Path Repair . . . . . . . . . . . . . . . . . . . .  97
   7.5.3. Repairing a Path. . . . . . . . . . . . . . . . . . . . .  98
   7.6. Path Control Message Formats. . . . . . . . . . . . . . . . 100
   7.6.1. SETUP . . . . . . . . . . . . . . . . . . . . . . . . . . 101
   7.6.2. ACCEPT. . . . . . . . . . . . . . . . . . . . . . . . . . 103
   7.6.3. REFUSE. . . . . . . . . . . . . . . . . . . . . . . . . . 103
   7.6.4. TEARDOWN. . . . . . . . . . . . . . . . . . . . . . . . . 104
   7.6.5. ERROR . . . . . . . . . . . . . . . . . . . . . . . . . . 105
   7.6.6. REPAIR. . . . . . . . . . . . . . . . . . . . . . . . . . 106
   7.6.7. Negative Acknowledgements . . . . . . . . . . . . . . . . 106
   8. Security Considerations . . . . . . . . . . . . . . . . . . . 106
   9. Authors's Address . . . . . . . . . . . . . . . . . . . . . . 107
   References . . . . . . . . . . . . . . . . . . . . . . . . . . . 107

1. Introduction ✨

Okay so in this document, we spell out the protocols and procedures that make up Inter-Domain Policy Routing (IDPR) 🌈 The big goal of IDPR is to build and maintain routes between source and destination administrative domains. The routes have to give user traffic the services it asked for, and stay inside the constraints set by every domain the traffic passes through. That's the policy part, and it's giving main character energy 💅

IDPR uses link state routing information distribution and route generation, working together with source specified message forwarding. Basically the source gets a say in where its traffic goes 🦋

For a detailed justification of the approach to inter-domain policy routing, see [5] 📚

1.1. Domain Elements 🌸

okay so IDPR is built for a massive internetwork, like tens of thousands of administrative domains that together hold hundreds of thousands of local networks 😭. Inter-domain policy routes get built from info about the services each domain offers and how the domains are connected to each other 🔥. The intra-domain stuff (the gateways, networks, and links an inter-domain policy route goes through) belongs to intra-domain routing, so it's not IDPR's job 💅.

An "administrative domain" (AD) is a bunch of contiguous hosts, gateways, networks, and links run by one single administrative authority 🏰. The domain administrator is the boss who sets service restrictions for transit traffic and service requirements for traffic that starts inside the domain, and picks the addressing schemes and routing procedures used inside it ✨. On the Internet, every domain gets a unique numeric identifier from the Internet Assigned Numbers Authority (IANA) 🔢.

"Virtual gateways" (VGs) are the only IDPR-recognized meeting points between adjacent domains 🤝. Each virtual gateway is a group of directly-connected "policy gateways" (more on those in a sec) sitting in two neighboring domains, and both domain administrators have to sanction it 🫶. Two domains can agree to set up more than one virtual gateway between them 🦋. For each one, the two administrators together pick a local numeric identifier, unique among the virtual gateways connecting those two domains 💜. To get a virtual gateway identifier that's unique within its own domain, the administrator glues that mutually assigned local identifier onto the adjacent domain's identifier 🧩.

"Policy gateways" (PGs) are the physical gateways inside a virtual gateway 🚪. Each policy gateway enforces the service restrictions the domain administrator stipulated for IDPR transit traffic, then forwards that traffic along 🛡️. Inside one domain, two policy gateways are "neighbors" if they're in different virtual gateways 👯. A single policy gateway can belong to several virtual gateways at once 🌈. Within a virtual gateway, two policy gateways are "peers" if they're in the same domain, and "adjacent" if they're in different domains 🍓. Adjacent policy gateways are "directly connected" if the only Internet-addressable things hanging off the connecting medium are policy gateways in the virtual gateways 🔌. Notice what this means: it's not just point-to-point links that can do the direct-connection job, networks can too 🙈. The domain administrator gives each of its policy gateways a numeric identifier, unique within that domain 🎀.

A "domain component" is a chunk of a domain's entities where everything in the chunk can reach each other over intra-domain routes, but nothing outside the chunk is reachable from inside it over intra-domain routes 🧠. Normally a domain is just one component, itself 🌸. But when a domain gets partitioned, it turns into multiple components 💀. Each domain component gets an identifier that's unique across the Internet, made from the domain identifier plus the identifier of the lowest-numbered operational policy gateway in that component 👑. All the operational policy gateways in a domain component can figure out they can reach each other through intra-domain routing information 🛰️. So they can all independently work out, without any explicit negotiation, which one has the lowest number ✨. Iykyk, it's giving consensus without a meeting 🦋.

1.2. Policy 💅

With IDPR, each domain administrator sets "transit policies" that decide how and by whom the resources in their domain can be used 🏠. Transit policies are usually public, and they spell out the offered services, which are:

• Access restrictions: e.g., applied to traffic to or from certain domains or classes of users 🚧.
• Quality: e.g., delay, throughput, or error characteristics 📶.
• Monetary cost: e.g., charge per byte, message, or unit time 💸.

Each domain administrator also sets "source policies" for traffic that starts in their domain 🚀. Source policies are usually private, and they spell out the requested services, which are:

• Access restrictions: e.g., domains to favor or avoid in routes 🙅‍♀️.
• Quality: e.g., acceptable delay, throughput, and reliability 💖.
• Monetary cost: e.g., acceptable session cost 🪙.

1.3. IDPR Functions ✨

IDPR has the following functions, and honestly they're all main character energy 👑:

• Collecting and distributing routing information, including domain transit policies and inter-domain connectivity 📬.
• Generating and selecting policy routes based on the routing information distributed and on the source policies configured or requested 🗺️.
• Setting up paths across the Internet using the policy routes generated 🛤️.
• Forwarding messages across and between domains along the established paths 📦.
• Maintaining databases of routing information, inter-domain policy routes, forwarding information, and configuration information 🗄️.

1.3.1. IDPR Entities 🧚

A bunch of different entities handle these IDPR functions, so let's meet the crew 🫶.

Policy gateways are the only IDPR-recognized connecting points between adjacent domains 🚪. They collect and distribute routing information, take part in path setup, forward data messages along the established paths, and keep forwarding information databases 💜.

"Path agents" live inside policy gateways and inside "route servers" (see below), and they act on behalf of hosts 🕵️‍♀️. Their jobs are selecting policy routes, setting up and managing paths, and maintaining forwarding information databases ✨. Any Internet host can reap the benefits of IDPR, as long as there's a path agent set up to act for it and a way for the host's messages to reach that path agent 🎀. Here's the plot twist: a path agent in one domain can be set up to act on behalf of hosts in a different domain 😳. When that happens, the path agent's domain becomes an IDPR "proxy" for the hosts' domain 🦋.

Route servers keep both the routing information database and the route database 🗃️. They generate policy routes using the routing information they've collected and the source policies requested by the path agents 🧠. A route server can live inside a policy gateway, or it can exist as its own autonomous entity 🌈. Splitting the route server functions away from the policy gateways is a glow-up for the gateways, since it frees them from both the memory-intensive job of database maintenance (routing information and routes) and the computationally intensive job of route generation 💪. Route servers, like policy gateways, each have a unique numeric identifier within their domain, which the domain administrator assigns 🔢.

Given how big the Internet is right now, each policy gateway can handle the route server functions on top of its message forwarding functions, with little or no hit to forwarding performance 🙌. Putting the routing functions into policy gateways keeps things simple to implement, because you only have to install IDPR protocols in the policy gateways 🛠️. It also makes communication between the routing functions easier, since they all live inside each policy gateway 🫶. But as the Internet grows, the memory and processing needed for the route server functions could become a burden on the policy gateways 😭. When that happens, each domain administrator should separate the route server functions from the policy gateways in its domain 🚨.

"Mapping servers" maintain the database of mappings that resolve Internet names and addresses to domain identifiers 🗺️. Each host sits inside a domain and is associated with a proxy domain, which may be the same as the host's domain 🏡. The mapping server function will be integrated into the existing DNS name service (see [6]) and will provide mappings between a host and its local and proxy domains 🌐.

"Configuration servers" maintain the databases of configured information that apply to IDPR entities within their domains ⚙️. Configuration information for a given domain includes transit policies (i.e., service offerings and restrictions), source policies (i.e., service requirements), and mappings between local IDPR entities and their names and addresses 📋. The configuration server function will be integrated into a domain's existing network management system (see [7]-[8]) 🧁.

1.4. Policy Semantics 🔮

The source and transit policies IDPR supports are meant to cover a wide range of services available across the Internet 🌍. In this document we're focusing on the semantics of these policies, mostly the access restriction parts 💅. To express these policies here, we use a syntactic variant of Clark's policy term notation [1] 📝. Just know that for actually configuring source and transit policies, there's a more succinct syntax (see [7]) that's way easier to live with 🫶.

1.4.1. Source Policies 🚀

Each source policy takes the form of a collection of sets, like this:

Applicable Sources and Destinations:
   {((H(1,1),s(1,1)),...,(H(1,f1),s(1,f1))),...,((H(n,1),s(n,1)),...,
   (H(n,fn),s(n,fn)))}

This is the set of groups of source/destination traffic flows the source policy applies to 🎯. Each traffic flow group ((H(i,1),s(i,1)),...,(H(i,fi),s(i,fi))) holds a set of source hosts and their matching destination hosts 👯. Here, H(i,j) is a host, and s(i,j), which is an element of {SOURCE, DESTINATION}, shows whether H(i,j) is being treated as a source or a destination 🔍.

Domain Preferences: {(AD(1),x(1)),...,(AD(m),x(m))}

This is the set of transit domains the traffic flows should favor, avoid, or exclude 🙈. Here, AD(i) is a domain, and x(i), which is an element of {FAVOR, AVOID, EXCLUDE}, shows whether routes including AD(i) should be favored, avoided if possible, or unconditionally excluded 🚫.

UCI: the source user class for the traffic flows listed 👤.

RequestedServices: the set of requested services that aren't about access restrictions, so service quality and monetary cost 💸.

When a path agent (see section 1.3.1) picks a route for a traffic flow going from source host H(i,j) to destination host H(i,k), where 1 < or = i < or = n and 1 < or = j, k < or = fi, it must honor the source policy in these ways 🫡:

• For each domain, AD(p), contained in the route, AD(p) is not equal to any AD(k) such that 1 < or = k < or = m and x(k) = EXCLUDE 🙅‍♀️.
• The route provides the services listed in the set Requested Services ✨.

1.4.2. Transit Policies ✨

okay so a transit policy is basically a bundle of sets 🎀 it's giving organized chaos, but make it make sense. the whole thing is a collection of these sets:

Source/Destination Access Restrictions 💅 this is the set of groups of source and destination hosts and domains that the transit policy applies to:

{((H(1,1),AD(1,1),s(1,1)),...,(H(1,f1),AD(1,f1),s(1,f1))),...,
((H(n,1),AD(n,1),s(n,1)),...,(H(n,fn),AD(n,fn),s(n,fn)))}

each domain group ((H(i,1),AD(i,1),s(i,1)),...,(H(i,fi),AD(i,fi),s(i,fi))) holds a set of source and destination hosts and domains, and the transit domain carries traffic from every listed source to every listed destination 🦋 here H(i,j) is a set of hosts, AD(i,j) is the domain that contains H(i,j), and s(i,j) (a subset of {SOURCE, DESTINATION}) tells you whether (H(i,j),AD(i,j)) counts as sources, destinations, or both 🧚

Temporal Access Restrictions ⏰ the set of time intervals when the transit policy applies, so it's not 24/7 unless it is 💖

User Class Access Restrictions 👑 the set of user classes the transit policy applies to

Offered Services 🍓 the set of offered services that aren't about access restrictions, so we're talking service quality and monetary cost here

Virtual Gateway Access Restrictions 🌈 this one's the gateway squad:

{((VG(1,1),e(1,1)),...,(VG(1,g1),e(1,g1))),...,((VG(m,1),e(m,1)),

gateways to which the transit policy applies. each virtual gateway group ((VG(i,1),e(i,1)),...,(VG(i,gi),e(i,gi))) is a set of domain entry and exit points, and the vibe is that each entry virtual gateway can reach each exit virtual gateway through an intra-domain route that supports the transit policy (barring an intra-domain routing failure, ngl that caveat matters 🙈). here VG(i,j) is a virtual gateway, and e(i,j) (a subset of {ENTRY, EXIT}) says whether VG(i,j) is a domain entry point, an exit point, or both.

the domain advertising a transit policy like this will carry traffic from any host in the set H(i,j) in AD(i,j) to any host in the set H(i,k) in AD(i,k), where 1 < or = i < or = n and 1 < or = j, k < or = fi, provided that all of these are true 🫶

• SOURCE is an element of s(i,j).
• DESTINATION is an element of s(i,k).
• Traffic from H(i,j) enters the domain during one of the intervals in the set Temporal Access Restrictions.
• Traffic from H(i,j) carries one of the user class identifiers in the set User Class Access Restrictions.
• Traffic from H(i,j) enters via any VG(u,v) such that ENTRY is an element of e(u,v), where 1 < or = u < or = m and 1 < or = v < or = gu.
• Traffic to H(i,k) leaves via any VG(u,w) such that EXIT is an element of e(u,w), where 1 < or = w < or = gu.

---

1.5. IDPR Message Encapsulation 🎀

okay now for the packaging era ✨ there are two kinds of IDPR messages:

• "Data messages" containing user data generated by hosts.
• "Control messages" containing IDPR protocol-related control information generated by policy gateways and route servers.

inside an internetwork, only policy gateways and route servers can generate, recognize, and process IDPR messages 🦋 to every other gateway and host, IDPR is basically invisible, and that includes mapping servers and configuration servers too. they do necessary-but-ancillary work for IDPR, so they're not required to handle IDPR messages either 💅

an IDPR entity puts IDPR-specific info in every IDPR control message it originates, and that info only matters to the recipient IDPR entities 🌸 using "encapsulation" across each domain, an IDPR message tunnels from source to destination across the internetwork, even through domains that use totally different intra-domain addressing schemes and routing procedures. it's giving passport control, but for packets 🛂

we did think about embedding IDPR in IP as a set of IP options, but that approach had some big downsides 🙈

• Only domains that support IP would be able to join IDPR, so domains that don't support IP would get left out.
• Every gateway in a participating domain, policy or otherwise, would at least have to recognize the IDPR option, even if it didn't run the IDPR protocols. and most commercial routers aren't optimized for IP options processing, so IDPR message handling might need a lot of processing at each gateway 💀
• For some IDPR protocols, path control especially, the size limits on IP options would block including all of the necessary protocol-related info.

so we said nope to the IP option approach and went with encapsulation instead 💖

an IDPR message travels from source to destination between consecutive policy gateways. each policy gateway wraps the IDPR message in info (like an IP header, for example) that gets the message to the next policy gateway 🧚 heads up: the encapsulating header and the IDPR-specific info can push the message size past the MTU of the given domain. but fragmentation and reassembly are the job of whatever protocol does the encapsulating for transport between successive policy gateways (IP, for example). it's not currently IDPR's job 🫶

when a policy gateway forwards an IDPR message to a peer or neighbor policy gateway, it encapsulates the message according to that domain's addressing scheme and routing procedure, and it sets the protocol field of the encapsulating header to show that the message is an IDPR message 🌈 intermediate gateways between the two policy gateways just forward it like any other message, using the info in the encapsulating header. only the recipient policy gateway reads the protocol field, strips off the encapsulating header, and processes the IDPR message 👑

when a policy gateway forwards an IDPR message to a directly-connected adjacent policy gateway, it encapsulates the message according to the addressing scheme of the entities inside the virtual gateway, and again sets the protocol field to mark it as an IDPR message 🦋 the recipient policy gateway strips off the encapsulating header and processes the IDPR message. we recommend that the recipient do a validation check on the encapsulating header before stripping it off 🔥 specifically, the recipient should verify that the source address and the destination address in the encapsulating header match the adjacent policy gateway's address and its own address, respectively. the recipient should also verify that the message arrived on the interface designated for the direct connection to the adjacent policy gateway. these checks help make sure IDPR traffic crossing domain boundaries does so only over direct connections between adjacent policy gateways 🛡️✨

policy gateways forward IDPR data messages using a forwarding information database that maps "path identifiers" (carried in the data messages) into next policy gateways 💜 they forward IDPR control messages according to the next policy gateways picked by the particular IDPR control protocols tied to those messages. telling data messages and control messages apart at the encapsulating protocol level, instead of at the IDPR protocol level, skips an extra layer of dispatching, so IDPR message forwarding is more efficient 🚀 when they're encapsulated in IP messages, IDPR data messages carry IP protocol number 35 and IDPR control messages carry IP protocol number 38 🍓

1.5.1. IDPR Data Message Format 💌

the path agents in a source domain decide which data messages from local hosts get handled by IDPR 🧚 for each data message picked for IDPR handling, a source path agent prepends the following header:

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|    VERSION    |     PROTO     |            LENGTH             |
+---------------+---------------+-------------------------------+
|                            PATH ID                            |
|                                                               |
+---------------------------------------------------------------+
|                           TIMESTAMP                           |
+---------------------------------------------------------------+
|                            INT/AUTH                           |
|                                                               |
+---------------------------------------------------------------+

here's the breakdown, bestie 🌸

• VERSION (8 bits): version number for IDPR data messages, currently equal to 1 💖
• PROTO (8 bits): numeric identifier for the protocol to use when processing the contents of the IDPR data message. only the path agent at the destination interprets and acts on the PROTO field 👑
• LENGTH (16 bits): length of the entire IDPR data message in bytes 📏
• PATH ID (64 bits): path identifier assigned by the source's path agent. it's made of the numeric identifier for the path agent's domain (16 bits), the numeric identifier for the path agent's policy gateway (16 bits), and the path agent's local path identifier (32 bits). (see section 7.2) 🦋
• TIMESTAMP (32 bits): number of seconds elapsed since 1 January 1970 0:00 GMT ⏰
• INT/AUTH (variable): computed integrity/authentication value, depending on the type of integrity/authentication requested during path setup 🔐

we describe the IDPR control message header in section 2.4 🫶

1.6. Security 🔒

okay bestie, security time 🛡️ IDPR has mechanisms for checking message integrity and source authenticity, and for protecting against certain types of denial of service attacks. control messages are the big priority, because they carry the control info that builds and uses viable policy routes between domains, so they have to stay intact 💅

Every IDPR message carries one piece of info called the "integrity/authentication value" 🎀 It can detect message corruption and also verify the authenticity of the message source. On the Internet, the IANA sanctions the set of valid algorithms that can compute these values. That set can include algorithms that do only message integrity checks, like n-bit cyclic redundancy checksums (CRCs), as well as algorithms that do both integrity and source authentication checks, like signed hash functions of message contents 🧁

Each domain administrator is free to pick any integrity/authentication algorithm from the IANA set for computing the values in their domain's messages 🌸 However, we recommend that IDPR entities in each domain be able to run all the valid algorithms, so that an IDPR control message from one domain can be properly checked by an entity in another domain. interop is everything 🫶

Each IDPR control message must carry a non-null integrity/authentication value. We recommend that control message integrity/authentication be based on a digital signature algorithm applied to a one-way hash function, such as RSA applied to MD5 [17], which checks integrity and source authenticity at the same time 🔐 The digital signature may be based on either public-key or private-key cryptography. Our approach to digital signatures in IDPR is based on the privacy-enhanced Internet electronic mail service [13]-[15], which is already available on the Internet ✉️

We do not require that IDPR data messages carry a non-null integrity/authentication value. In fact, we recommend that a higher layer (end-to-end) procedure, and not IDPR, take responsibility for checking the integrity and authenticity of data messages, because of the amount of computation involved 😮‍💨

---

1.7. Timestamps and Clock Synchronization ⏰

Each IDPR message carries a timestamp (expressed in seconds elapsed since 1 January 1970 0:00 GMT, following the UNIX precedent) supplied by the source IDPR entity 🕰️ It shows how old the message is. IDPR entities use the absolute value of the timestamp to confirm that a message is current, and they use the relative difference between timestamps to figure out which message has the more recent info ✨

All IDPR entities must have internal clocks synchronized to some degree, so the absolute value of a message timestamp actually means something. The synchronization granularity IDPR requires is on the order of minutes, and it can be achieved manually 🧸

So a clock synchronization protocol running among all IDPR entities in all domains is useful, but it is not necessary. 💜

An IDPR entity can decide whether to accept or reject a message based on the discrepancy between the message's timestamp and the entity's own internal clock time 👀 Any IDPR message whose timestamp lies outside the acceptable range may contain stale or corrupted information, or may have been issued by a source whose internal clock has lost synchronization with the message recipient's clock.

🚨 Timestamp checks are required for control messages, because of the consequences of propagating and acting upon incorrect control information. Timestamp checks are discretionary for data messages, but they may be invoked during problem diagnosis, for example, when checking for suspected message replays 🔍

We note that none of the IDPR protocols contain explicit provisions for dealing with an exhausted timestamp space. As timestamp space exhaustion will not occur until well into the next century, we expect timestamp space viability to outlast the IDPR protocols 💀 not me planning for the next century, but okay 😭

---

1.8. Network Management 🗂️

In this document, we do not describe how to configure and manage IDPR. However, in this section, we do provide a list of the types of IDPR configuration information required 📋 Also, in later sections describing the IDPR protocols, we briefly note the types of exceptional events that must be logged for network management. Complete descriptions of IDPR entity configuration and IDPR managed objects appear in [7] and [8], respectively.

To participate in inter-domain policy routing, policy gateways and route servers within a domain each require configuration information. Some of it is specifically defined within the given domain, and some of it is universally defined throughout an internetwork 🌍 A domain administrator determines the domain-specific information, and in the Internet, the IANA determines the globally significant information.

To produce valid domain configurations, the domain administrators must receive the following global information from the IANA:

• For each integrity/authentication type, the numeric identifier, syntax, and semantics. Available integrity and authentication types include but are not limited to:
  • public-key based signatures;
  • private-key based signatures;
  • cyclic redundancy checksums;
  • no integrity/authentication.
• For each user class, the numeric identifier, syntax, and semantics. Available user classes include but are not limited to:
  • federal (and if necessary, agency-specific such as NSF, DOD, DOE, etc.);
  • research;
  • commercial;
  • support.
• For each offered service that may be advertised in transit policies, the numeric identifier, syntax, and semantics. Available offered services include but are not limited to:
  • average message delay;
  • message delay variation;
  • average bandwidth available;
  • available bandwidth variation;
  • maximum transfer unit (MTU);
  • charge per byte;
  • charge per message;
  • charge per unit time.
• For each access restriction that may be advertised in transit policies, the numeric identifier, syntax, and semantics. Available access restrictions include but are not limited to:
  • Source and destination domains and host sets.
  • User classes.
  • Entry and exit virtual gateways.
  • Time of day.
• For each requested service that may appear within a path setup message, the numeric identifier, syntax, and semantics. Available requested services include but are not limited to:
  • maximum path life in minutes, messages, or bytes;
  • integrity/authentication algorithms to be used on data messages sent over the path;
  • upper bound on path delay;
  • minimum delay path;
  • upper bound on path delay variation;
  • minimum delay variation path;
  • lower bound on path bandwidth;
  • maximum bandwidth path;
  • upper bound on monetary cost;
  • minimum monetary cost path.

In an internetwork-wide implementation of IDPR, the set of global configuration parameters, and their syntax and semantics, must be consistent across all participating domains 🤝 The IANA is responsible for establishing the full set of global configuration parameters in the Internet, and it relies on the cooperation of the administrators of all participating domains to make sure the global parameters match the desired transit policies and user service requirements of each domain. Also, because the syntax and semantics of the global parameters affect the syntax and semantics of the corresponding IDPR software, the IANA must carefully define each global parameter so that it is unlikely to require future modification 🧐

The IANA provides configured global information to configuration servers in all domains participating in IDPR. Each domain administrator uses the configured global information maintained by its configuration servers to develop configurations for each IDPR entity within its domain. Each configuration server keeps a copy of the configuration for each local IDPR entity, and it also distributes that configuration to the entity using, for example, SNMP 📦

---

1.8.1. Policy Gateway Configuration 🚪

Each policy gateway must contain sufficient configuration information to perform its IDPR functions, which subsume those of the path agent. These include: validating IDPR control messages; generating and distributing virtual gateway connectivity and routing information messages to peer, neighbor, and adjacent policy gateways; distributing routing information messages to route servers in its domain; resolving destination addresses; requesting policy routes from route servers; selecting policy routes and initiating path setup; ensuring consistency of a path with its domain's transit policies; establishing path forwarding information; and forwarding IDPR data messages along existing paths 🧚 The necessary configuration information includes the following:

• For each integrity/authentication type, the numeric identifier, syntax, and semantics.
• For each policy gateway and route server in the given domain, the numeric identifier and set of addresses or names.
• For each virtual gateway connected to the given domain, the numeric identifier, the numeric identifiers for the constituent peer policy gateways, and the numeric identifier for the adjacent domain.
• For each virtual gateway of which the given policy gateway is a member, the numeric identifiers and set of addresses for the constituent adjacent policy gateways.
• For each policy gateway directly connected and adjacent to the given policy gateway, the local connecting interface.
• For each local route server to which the given policy gateway distributes routing information, the numeric identifier.
• For each source policy applicable to hosts within the given domain, the syntax and semantics.
• For each transit policy applicable to the domain, the numeric identifier, syntax, and semantics.
• For each requested service that may appear within a path setup message, the numeric identifier, syntax, and semantics.
• For each source user class, the numeric identifier, syntax, and semantics.

1.8.2. Route Server Configuration

okay bestie, route servers have a LOT on their plate 💅 each one needs enough config to run its IDPR functions, and those already include everything a path agent does 🦋 so it's basically the path agent's job plus a whole lot more. the jobs are: validating IDPR control messages; deciphering and storing the contents of routing information messages; exchanging routing information with other route servers and policy gateways; generating policy routes that respect transit policy restrictions and source service requirements; distributing policy routes to path agents in policy gateways; resolving destination addresses; selecting policy routes and initiating path setup; establishing path forwarding information; and forwarding IDPR data messages along existing paths. ngl that's iconic and a lot 😭 the configuration info it needs includes the following:

• For each integrity/authentication type, the numeric identifier, syntax, and semantics. 🔐
• For each policy gateway and route server in the given domain, the numeric identifier and set of addresses or names. 🌸
• For each source policy applicable to hosts within the given domain, the syntax and semantics. 🎀
• For access restriction that may be advertised in transit policies, the numeric identifier, syntax, and semantics. 🚧
• For each offered service that may be advertised in transit policies, the numeric identifier, syntax, and semantics. ✨
• For each requested service that may appear within a path setup message, the numeric identifier, syntax, and semantics. 🧚
• For each source user class, the numeric identifier, syntax, and semantics. 💜

---

2. Control Message Transport Protocol

okay so IDPR control messages carry routing info that directly shapes the policy routes generated and the paths set up across the Internet 🌈 and if they get messed up, the damage can spread everywhere and be really deleterious to inter-domain policy routing 💀 so the IDPR protocols are built to keep control messages from getting lost or corrupted. for every control message it sends, each IDPR protocol expects to be told whether the message actually reached the intended IDPR recipient. and the recipient checks that the message looks well-formed before it acts on anything inside it. very careful, very iconic 🫶

All IDPR protocols use the Control Message Transport Protocol (CMTP), a connectionless, transaction-based transport layer protocol, to talk to the intended recipients of control messages. CMTP retransmits unacknowledged control messages and runs integrity and authenticity checks on the control messages it receives. 🔁

There are three types of CMTP messages:

• DATAGRAM: Contains IDPR control messages. 📦
• ACK: Positive acknowledgement in response to a DATAGRAM message. ✅
• NAK: Negative acknowledgement in response to a DATAGRAM message. ❌

Each CMTP message carries several pieces of info supplied by the sender so the recipient can test the integrity and authenticity of the message. The set of integrity and authenticity checks done after CMTP message reception are collectively called "validation checks," and they're described in section 2.3. 🧐

okay, a bit of history tea ☕ when the IDPR protocols were first designed, CMTP didn't exist as its own protocol. the CMTP-equivalent stuff was just baked into each IDPR protocol. later we decided it'd be cleaner to have one single transport protocol that all the IDPR protocols could share. we originally thought about using an existing transport protocol, but we said nope, and here's why:

• The existing reliable transport protocols don't provide all of the validation checks, especially the timestamp and authenticity checks, that the IDPR protocols need. So if we used one of them, we'd still have to build a separate protocol on top of it just to force retransmission of IDPR messages that failed the required validation checks. 😤
• Lots of existing reliable transport protocols are window-based, which can mean more message delay and resource use when (like with IDPR) multiple independent messages share the same transport connection. One message having transmission trouble and needing a resend can stop the window from moving, so every message after it gets stuck in line behind it. And many window-based protocols don't support selective retransmission of failed messages. Instead they make you resend the failed message and every message before it in the window. big mood, no thank you 🙅‍♀️

so we passed on the existing transport protocols and went with developing CMTP instead 🎀

2.1. Message Transmission

okay so at the sending end, when an IDPR protocol is ready to issue a control message, it hands CMTP a copy of the message. it also passes along a set of parameters for the CMTP header and for proper CMTP message handling 💅 then CMTP turns the control message and its parameters into a DATAGRAM by sticking the right header on the front. the CMTP header holds several pieces of info that help the recipient spot errors (see section 2.4). each IDPR protocol can specify all of the following CMTP parameters that apply to its control message:

• IDPR protocol and message type.
• Destination.
• Integrity/authentication scheme.
• Timestamp.
• Maximum number of transmissions allotted.
• Retransmission interval in microseconds.

one of these parameters, the timestamp, could be set by CMTP itself to whatever the internal clock says when the message goes out. BUT two of the IDPR protocols, flooding and path control, actually need message generation timestamps to work properly 🕰️ so instead of making CMTP pass a timestamp back up to the IDPR protocol, we simplified the service interface: the IDPR protocol gets to specify the timestamp in the first place. much cleaner, much slay ✨

using the control message and the accompanying parameters from the IDPR protocol, CMTP builds a DATAGRAM and adds its own CMTP-specific parameters to the header. in particular, CMTP gives each DATAGRAM it makes a "transaction identifier," which it uses to match acknowledgements back to their DATAGRAM messages. each DATAGRAM recipient copies the received transaction identifier into its returned ACK or NAK, and each DATAGRAM sender uses that identifier to match the incoming ACK or NAK to the original DATAGRAM 🦋

here's the tea: a single DATAGRAM, like a routing information message or a path control message, can get handled by CMTP at lots of different policy gateways 🗺️ between any pair of consecutive IDPR entities, the DATAGRAM sender expects an acknowledgement from the DATAGRAM recipient. BUT only the IDPR entity that actually generated the original CMTP DATAGRAM gets to control the transaction identifier, because that entity might attach a digital signature that covers the entire DATAGRAM. the intermediate policy gateways that pass the DATAGRAM along do NOT change the transaction identifier 🙅‍♀️ still, at each DATAGRAM recipient, the transaction identifier has to uniquely distinguish the DATAGRAM, so that only one acknowledgement from the next DATAGRAM recipient matches the original DATAGRAM. so the transaction identifier must be globally unique. no pressure 😭

the transaction identifier is made up of the numeric identifiers for the domain and IDPR entity (policy gateway or route server) that issued the original DATAGRAM, plus a 32-bit local identifier assigned by CMTP running inside that IDPR entity. we recommend making the 32-bit local identifier either a simple counter that goes up for each DATAGRAM generated, or a fine granularity clock. the counter always guarantees the transaction identifiers are unique 🔢 the clock guarantees uniqueness too, but only if the clock granularity is finer than the minimum possible interval between DATAGRAM generations, AND the clock wrapping period is longer than the maximum round-trip delay to and from any internetwork destination ⏱️ lots of conditions, bestie, so the counter is the easy-mode option 🍓

before transmitting a DATAGRAM, CMTP computes the length of the entire message, taking into account the prescribed integrity/authentication scheme. then it computes the integrity/authentication value over the whole message. CMTP puts both of these in the DATAGRAM header, because they're crucial for the recipient to check message integrity and authenticity 🔐 after sending a DATAGRAM, CMTP saves a copy and sets an associated retransmission timer, as directed by the IDPR protocol parameters. if the timer fires and CMTP has gotten neither an ACK nor a NAK for that DATAGRAM, CMTP retransmits it, as long as that doesn't go over the transmission allotment. 🔁

and if a DATAGRAM runs out of its transmission allotment, CMTP throws it away, tells the IDPR protocol the control message transmission wasn't successful, and logs the event for network management 🪵 at that point the IDPR protocol can either resubmit its control message to CMTP with an alternate destination specified, or just discard the control message altogether. your call, queen 👑

2.2. Message Reception ✨

okay so bestie, let's talk about what happens on the receiving end 👀. When CMTP grabs a DATAGRAM, it does one of the following, depending on how the validation checks go:

• The DATAGRAM passes the CMTP validation checks. 💖 CMTP hands the DATAGRAM, with its IDPR control message tucked inside, to the right IDPR protocol. That protocol then runs its own integrity checks on the control message before it acts on anything inside. The recipient IDPR protocol, except in one case, tells CMTP to generate an ACK and send it back to the sender. The one exception is the up/down protocol (see section 3.2), which figures out whether adjacent policy gateways are reachable. It does not use CMTP ACK messages to tell the sender the message was received. Instead, the up/down protocol messages themselves carry implicit info about message reception at the adjacent policy gateway. When the recipient IDPR protocol does tell CMTP to generate an ACK, it MAY pass control information to CMTP for inclusion in the ACK, depending on what the original IDPR control message contained. For example, a route server that can't fill a request for routing information might use an ACK for the initial request to tell the requesting IDPR entity to place its request elsewhere. main character routing energy 🦋
• The DATAGRAM fails at least one of the CMTP validation checks. 💀 CMTP generates a NAK, returns the NAK to the sender, and discards the DATAGRAM, no matter what type of IDPR control message was inside. The NAK shows the nature of the validation failure and helps the sender set up communication with the recipient. The really iconic part is that the CMTP NAK gives a way to negotiate the IDPR version and the integrity/authentication scheme. Those two parameters are crucial for IDPR entities to talk to each other at all 🫶.

Upon receiving an ACK or a NAK, CMTP immediately discards the message if at least one of the validation checks fails, or if it is unable to locate the associated DATAGRAM. CMTP logs the latter event for network management. Otherwise, if all of the validation checks pass and it can locate the associated DATAGRAM, CMTP clears the associated retransmission timer and then takes one of the following actions, depending on the message type:

• The message is an ACK. ✨ CMTP discards the associated DATAGRAM and delivers the ACK, which may contain IDPR control information, to the appropriate IDPR protocol.
• The message is a NAK. 🌸 If the associated DATAGRAM has used up its transmission allotment, CMTP discards the DATAGRAM, tells the appropriate IDPR protocol that the control message transmission was not successful, and logs the event for network management. Otherwise, if the associated DATAGRAM has not used up its transmission allotment yet, CMTP first checks its copy of the DATAGRAM against the failure indication in the NAK. If its copy looks intact, CMTP retransmits the DATAGRAM and sets the associated retransmission timer. However, if its copy looks corrupted, CMTP discards the DATAGRAM, informs the IDPR protocol that the control message transmission was not successful, and logs the event for network management. it's giving careful double-checking 🙈

---

2.3. Message Validation 🎀

On every CMTP message received, CMTP runs a set of validation checks to test message integrity and authenticity. The order of these tests is important, bestie 💅. CMTP MUST first determine whether it can parse enough of the message to compute the integrity/authentication value. (Refer to section 2.4 for a description of CMTP message formats.) Then, CMTP MUST immediately compute the integrity/authentication value before it checks any other header information. An incorrect integrity/authentication value means the message is corrupted, so it is likely that the CMTP header information is incorrect too. Checking specific header fields before computing the integrity/authentication value not only may waste time and resources, but also may lead to incorrect diagnoses of a validation failure. so don't skip the line-up, babe 🧚

The CMTP validation checks are as follows:

• Version and type recognition. 🌈 CMTP verifies that it can recognize both the control message version type contained in the header. Failure to recognize either one of these values means that CMTP cannot continue to parse the message.
• Integrity/authentication type. 🔐 CMTP verifies that it can recognize and accept the integrity/authentication type contained in the header. No integrity/authentication is not an acceptable type for CMTP.
• Integrity/authentication value. 🔑 CMTP computes the integrity/authentication value and verifies that it equals the integrity/authentication value contained in the header. For key-based integrity/authentication schemes, CMTP MAY use the source domain identifier contained in the CMTP header to index the correct key. Failure to index a key means that CMTP cannot compute the integrity/authentication value.
• Message length. 📏 CMTP computes the message length in bytes and verifies that it equals the length value contained in the header.
• Timestamp. ⏰ CMTP verifies that the message timestamp is in the acceptable range. The message SHOULD be no more recent than cmtp_new (300) seconds ahead of the entity's current internal clock time. In this document, when we present an IDPR system configuration parameter, such as cmtp_new, we usually follow it with a recommended value in parentheses. The cmtp_new value allows some clock drift between IDPR entities. Moreover, each IDPR protocol has its own limit on the maximum age of its control messages. The message SHOULD be no less recent than a prescribed number of seconds behind the recipient entity's current internal clock time. Hence, each IDPR protocol performs its own message timestamp check in addition to the one performed by CMTP. double timestamp check, very responsible of them 🍓
• Protocol recognition. 🦋 CMTP verifies that it can recognize the IDPR protocol designated for the enclosed control message.

Whenever CMTP hits a failure while performing any of these validation checks, it logs the event for network management. If the failure occurs on a DATAGRAM, CMTP immediately generates a NAK containing the reason for the failure, returns the NAK to the sender, and discards the DATAGRAM message. If the failure occurs on an ACK or a NAK, CMTP discards the ACK or NAK message. no drama, just discard it 💖

2.4. CMTP Message Formats ✨

okay so when we designed the IDPR control message format, we were trying to find a sweet spot between saving link bandwidth and making messages fast to process 🧠 we mostly went for compact stuff so IDPR info doesn't eat up the link, BUT we also organized things to speed up processing, which doesn't always mean the smallest possible size 💅

to keep bandwidth low, we're currently using fixed-length identifier fields. domains, virtual gateways, policy gateways, and route servers all get fixed-length identifiers 🎀 to keep processing simple, fields that contain an even number of bytes are aligned on even-byte boundaries inside a message 🫶 and if the Internet ever adopts super domains, we'll offer hierarchical, variable-length identifier fields in a later version of IDPR 🔮 bestie, that's the plan for the future ✨

every CMTP message header carries the following info:

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |    VERSION    |  PRT  |  MSG  |  DPR  |  DMS  |    I/A TYP    |
   +---------------+-------+-------+-------+-------+---------------+
   |           SOURCE AD           |           SOURCE ENT          |
   +-------------------------------+-------------------------------+
   |                           TRANS ID                            |
   +---------------------------------------------------------------+
   |                           TIMESTAMP                           |
   +-------------------------------+-------------------------------+
   |            LENGTH             |       message specific        |
   +-------------------------------+-------------------------------+
   |         DATAGRAM AD           |         DATAGRAM ENT          |
   +-------------------------------+-------------------------------+
   |                             INFORM                            |
   +---------------------------------------------------------------+
   |                            INT/AUTH                           |
   |                                                               |
   +---------------------------------------------------------------+

VERSION (8 bits) is the version number for IDPR control messages, currently equal to 1 📜

PRT (4 bits) is the numeric identifier for the control message transport protocol, equal to 0 for CMTP 🦋

MSG (4 bits) is the numeric identifier for the CMTP message type, equal to 0 for a DATAGRAM, 1 for an ACK, and 2 for a NAK 💌

DPR (4 bits) is the numeric identifier for the original DATAGRAM's IDPR protocol type 🌸

DMS (4 bits) is the numeric identifier for the original DATAGRAM's IDPR message type 🍓

I/A TYP (8 bits) is the numeric identifier for the integrity/authentication scheme used. CMTP requires the use of an integrity/authentication scheme, so this value must not be set equal to 0, which would mean no integrity/authentication is in use 🔐 no skipping the lock, babe 🙈

SOURCE AD (16 bits) is the numeric identifier for the domain containing the IDPR entity that generated the message 🌍

SOURCE ENT (16 bits) is the numeric identifier for the IDPR entity that generated the message 🧚

TRANSACTION ID (32 bits) is the local transaction identifier assigned by the IDPR entity that generated the original DATAGRAM 🎟️

TIMESTAMP (32 bits) is the number of seconds elapsed since 1 January 1970 0:00 GMT ⏰

LENGTH (16 bits) is the length of the entire IDPR control message, including the CMTP header, in bytes 📏

message specific (16 bits) depends on the CMTP message type 👀

For DATAGRAM and ACK messages, that field is:

• RESERVED (16 bits): reserved for future use and currently set equal to 0 🫧

For NAK messages, that field is:

• ERR TYP (8 bits): the numeric identifier for the type of CMTP validation failure encountered. ngl this is the part where things go wrong, so here are the validation failures:

1. Unrecognized IDPR control message version number.
2. Unrecognized CMTP message type.
3. Unrecognized integrity/authentication scheme.
4. Unacceptable integrity/authentication scheme.
5. Unable to locate key using source domain.
6. Incorrect integrity/authentication value.
7. Incorrect message length.
8. Message timestamp out of range.
9. Unrecognized IDPR protocol designated for the enclosed control message.

• ERR INFO (8 bits): CMTP gives extra info for certain types of validation failures:
  • Type 1: the acceptable IDPR control message version number 💁
  • Types 3 and 4: the acceptable integrity/authentication type 🔑

DATAGRAM AD (16 bits) is the numeric identifier for the domain containing the IDPR entity that generated the original DATAGRAM. It's only present in ACK and NAK messages 🎯

DATAGRAM ENT (16 bits) is the numeric identifier for the IDPR entity that generated the original DATAGRAM. It's also only present in ACK and NAK messages 🎯

INFORM (optional, variable) is information to be interpreted by the IDPR protocol that issued the original DATAGRAM. It's only present in ACK messages, and it depends on the original DATAGRAM's IDPR protocol type 🗂️

INT/AUTH (variable) is the computed integrity/authentication value, which depends on the type of integrity/authentication scheme used 🔏

---

3. Virtual Gateway Protocol 🌐

every policy gateway inside a domain helps gather info about connectivity within and between the virtual gateways it belongs to, and then passes that info along to the other virtual gateways in its domain 🤝 we call all of these jobs together the Virtual Gateway Protocol (VGP) 💜

the info collected through VGP matters both locally and globally for IDPR 🌟 virtual gateway connectivity info gets distributed to policy gateways within one domain, and it helps them pick routes across and between the virtual gateways that connect their domain to adjacent domains 🛣️ inter-domain connectivity info gets spread across the whole internetwork in routing information messages, and it helps route servers build feasible policy routes 🗺️

if a domain has simple virtual gateway and transit policy configurations, you only need to implement a small subset of the VGP functions 🧁 the connectivity among policy gateways within a virtual gateway and the variety of transit policies within a domain decide which VGP functions have to be implemented, and we'll explain that toward the end of this section 👑

3.1. Message Scope 🔭

policy gateways generate VGP messages that contain info about changes they notice in virtual gateway connectivity, and they send those messages to other policy gateways within the same domain and the same virtual gateway 📨 we sort VGP messages into three categories: "pair-PG", "intra-VG", and "inter-VG", depending on how far the message gets distributed 🧩

policy gateways use CMTP for reliable transport of VGP messages 🚚 the issuing policy gateway has to tell CMTP two things: the maximum number of transmissions per VGP message, vgp_ret, and the interval between VGP message retransmissions, vgp_int microseconds ⏱️ the recipient policy gateway has to decide whether a VGP message is acceptable, and what counts as acceptable depends on the type of VGP message, as we'll describe below 🕵️‍♀️

policy gateways store and act on the info in acceptable VGP messages, and for inter-VG messages, they also forward it 📦 a VGP message that passes the CMTP validation checks but fails a specific VGP message acceptability check is considered unacceptable, so the recipient policy gateway throws it away 🗑️ and a policy gateway that gets an unacceptable VGP message also logs the event for network management 📝

3.1.1. Pair-PG Messages 👯

pair-PG message communication happens between the two members of a pair of adjacent, peer, or neighbor policy gateways 💞 in IDPR, the only pair-PG messages are the ones the up/down protocol generates periodically, which are used to keep an eye on mutual reachability between policy gateways 👀

a pair-PG message is "acceptable" if:

• It passes the CMTP validation checks.
• Its timestamp is less than vgp_old (300) seconds behind the recipient's internal clock time.
• Its destination policy gateway identifier coincides with the identifier of the recipient policy gateway.
• Its source policy gateway identifier coincides with the identifier of a policy gateway configured for the recipient's domain or associated virtual gateway.

3.1.2. Intra-VG Messages 🫂

intra-VG message communication happens between one policy gateway and all of its peers 💌 whenever a policy gateway notices that its connectivity to an adjacent or neighbor policy gateway has changed, it sends an intra-VG message about that change to all of its reachable peers 📢 whenever a policy gateway finds that a previously unreachable peer is now reachable, it sends that peer intra-VG messages about its connectivity to adjacent and neighbor policy gateways 🌉 if the issuing policy gateway doesn't get a matching intra-VG message from the newly reachable peer within twice the configured VGP retransmission interval, vgp_int microseconds, it actively asks that peer for the intra-VG message 🙋‍♀️ all these message exchanges keep peers on the same page about each other's connectivity to adjacent and neighbor policy gateways 💖

an intra-VG message is "acceptable" if:

• It passes the CMTP validation checks.
• Its timestamp is less than vgp_old (300) seconds behind the recipient's internal clock time.
• Its virtual gateway identifier coincides with that of a virtual gateway configured for the recipient's domain.

3.1.3. Inter-VG Messages ✨

okay so inter-VG messages are the ones that travel between one policy gateway and all of its neighbors 🦋 Whenever the lowest-numbered operational policy gateway in a set of mutually reachable peers notices that its virtual gateway's connectivity to the adjacent domain or to another virtual gateway has changed, it sends an inter-VG message about that change to all of its neighbors. Specifically, it sends the message to a "VG representative" policy gateway (more on those in section 3.1.4 below) in each virtual gateway in the domain. Then each VG representative passes it along to each of its peers. 💅

When the lowest-numbered operational policy gateway in a group of mutual peers spots one or more previously unreachable peers that are now reachable, it sends requests for inter-VG information to the lowest-numbered operational policy gateway in every other virtual gateway. These requests ask for connectivity to adjacent domains and to other virtual gateways 🌸 The recipients send the requested inter-VG messages back to the one who asked, and that gateway then hands them out to the newly reachable peers. It's giving consistent vibes: every virtual gateway ends up with the same picture of who's connected to whom, and nobody wastes domain resources doing it ✨

Here's the lowkey important part 🎀 An inter-VG message describes the entire virtual gateway, not just the policy gateway that sent it. So when virtual gateway connectivity changes happen in rapid succession, recipients need to be able to figure out which message is the most recent, and that message has to carry the current virtual gateway connectivity information. To keep the information consistent and unambiguous, only one policy gateway generates and distributes inter-VG messages: the lowest-numbered operational peer. Figuring out who that is takes a simple procedure for a group of mutually reachable peers, and we walk through it in section 3.2 below 🧚

Why does only one gateway get to do this? Picture it 😭 Two peers in the same virtual gateway each notice a different connectivity change and each make their own inter-VG message. Recipients might not be able to tell which one is newer if the policy gateways' internal clocks aren't perfectly synchronized. And even with perfectly synchronized clocks, each peer could send its message before hearing the current news from the other one. Result: neither message has the correct connectivity from the virtual gateway's point of view. Chaos 💀 All of that goes away when a single peer, the lowest-numbered operational policy gateway, generates every inter-VG message 👑

An inter-VG message counts as "acceptable" if all of these are true:

• It passes the CMTP validation checks.
• Its timestamp is less than vgp_old (300) seconds behind the recipient's internal clock time.
• Its virtual gateway identifier matches a virtual gateway configured for the recipient's domain.
• Its source policy gateway identifier is the lowest-numbered operational member of the issuing virtual gateway, and it's reachable from the recipient.

Sending intra-VG messages between peers often sets off the generation and distribution of inter-VG messages among virtual gateways 🍓 Usually, the lowest-numbered operational policy gateway in a virtual gateway generates and distributes an inter-VG message right away after it notices a change in virtual gateway connectivity, whether that change came from receiving or generating an intra-VG message. The exception: if this gateway is still waiting for an intra-VG message from a newly reachable peer, it holds off and does not send the inter-VG message immediately.

Waiting for those intra-VG messages is what lets the lowest-numbered operational policy gateway collect the freshest connectivity info before it puts together the inter-VG message 🫶 But sometimes, in unusual circumstances, the gateway never gets that intra-VG message from the newly reachable peer, even after actively asking for it. To handle that case, VGP sets an upper bound of four times the configured retransmission interval, vgp_int microseconds, on how long to wait before generating and distributing an inter-VG message while an intra-VG message is still pending 🌈

3.1.4. VG Representatives 🦋

When it's time to distribute an inter-VG message, the issuing policy gateway picks one neighbor from each virtual gateway in the domain to be its recipient. That neighbor is the VG Representative 💜 To qualify as a VG representative, a policy gateway has to be reachable from the issuing policy gateway through intra-domain routing. The issuing policy gateway prefers neighbors that belong to more than one virtual gateway, and those neighbors become the VG representative for all of the virtual gateways they're part of. They also keep the message traffic lean: any policy gateway that's a peer in more than one of the represented virtual gateways gets at most one copy of the inter-VG message. Less copies, less mess, and it's the most efficient way to spread the connectivity info around 🔥

3.2. Up/Down Protocol ✨

Directly-connected adjacent policy gateways run the Up/Down Protocol to figure out whether they're mutually reachable 🎀 Pairs of peer or neighbor policy gateways can work out mutual reachability from information the intra-domain routing procedure provides, or by running the up/down protocol. Quick heads-up though: in general, we do not recommend running the up/down protocol between every pair of policy gateways in a domain, because it costs O(n**2) communications complexity (where n is the number of policy gateways in the domain) 😬 The exception is when the intra-domain routing procedure is slow to notice connectivity changes, or can't report reachability at the IDPR entity level. Then the reachability info from the up/down protocol might be totally worth the extra communications cost. For the rest of this section, we describe the up/down protocol from the point of view of adjacent policy gateways, but the very same protocol can also be applied to peer and neighbor policy gateways 💖

The up/down protocol decides whether the direct connection between adjacent policy gateways is good enough to carry data traffic 🧚 A direct connection starts out "down" (not acceptable for data traffic transport) and stays that way until the up/down protocol declares it "up" (acceptable for data traffic transport). A virtual gateway counts as "up" if there's at least one pair of adjacent policy gateways whose direct connection is acceptable for data traffic transport. It counts as "down" if there's no such pair at all 😭

When running the up/down protocol, policy gateways swap UP/DOWN messages every ud_per (1) second. Everyone starts with the same default period of ud_per, then negotiates a preferred period by trading UP/DOWN messages 🌸 Each policy gateway puts its desired value for ud_per in its UP/DOWN messages, and then both sides use the larger of the two desired values as the period for the UP/DOWN messages that follow. The messages also share info about the identity of each policy gateway's domain components. That helps the gateways pick routes across virtual gateways to partitioned domains, which is so useful 🍓

Each UP/DOWN message gets sent using CMTP, so it's covered by the CMTP validation checks. Here's the twist: unlike other IDPR control messages, UP/DOWN messages don't need reliable transport 🙈 The up/down protocol only sends one transmission per UP/DOWN message and never tells CMTP to send back an ACK. UP/DOWN messages are pair-PG messages, so they're acceptable under the conditions described in section 3.1.1.

Each policy gateway figures out the state of its direct connection to the adjacent policy gateway by counting how many acceptable UP/DOWN messages it gets within a set of consecutive periods 🦋 It shares its take on that state through its own UP/DOWN messages. At the start, a policy gateway reports the down state in every UP/DOWN message it sends. It only switches to reporting the up state once the direct connection looks up from its side ✨

A policy gateway can start sending data traffic over a direct connection only if both of these are true:

• The policy gateway receives at least j acceptable UP/DOWN messages from the adjacent policy gateway within the last m consecutive periods. From the recipient policy gateway's point of view, this event means the connection has gone up, so the recipient then reports the up state in its later UP/DOWN messages.
• The most recent UP/DOWN message it got from the adjacent policy gateway reports the up state, which tells it the adjacent policy gateway also considers the direct connection up.

A policy gateway must stop sending data traffic over a direct connection whenever either of these is true, so keep an eye on it 👀

• The policy gateway receives from the adjacent policy gateway at most acceptable UP/DOWN messages within the last n consecutive periods.
• The most recent UP/DOWN message it got from the adjacent policy gateway reports the down state, which means the adjacent policy gateway considers the direct connection down.

From the recipient policy gateway's point of view, either of those events counts as the direct connection going from up to down 💀 So the policy gateway reports the down state in its later UP/DOWN messages.

3.3. Implementation ✨

okay bestie, so the recommendation is to build the up/down protocol on a sliding window 🪟💖 Each slot is basically a little tally mark for UP/DOWN message activity during one period. It's either a "hit" (an acceptable UP/DOWN message showed up) or a "miss" (it didn't). Alongside the window, the implementation should include a tally of hits from the current period and a tally of misses across the current window 🎀

When the direct connection moves to the down state, the starting values for the up/down protocol parameters must be set like this:

• The sliding window size is equal to m.
• Each window slot contains a miss.
• The current period hit tally is equal to 0.
• The current window miss tally is equal to m.

When the direct connection moves to the up state, the starting values must be set like this:

• The sliding window size is equal to n.
• Each window slot contains a hit.
• The current period hit tally is equal to 0.
• The current window miss tally is equal to 0.

At the end of each period, a policy gateway works out the miss tally and checks whether the direct connection to the adjacent policy gateway has changed state 👀 In the down state, a miss tally of no more than m - j signals a transition to the up state. In the up state, a miss tally of no less than n - k signals a transition to the down state. 🔄

Getting the right miss tally takes a few steps, so pay attention 💅 First, the policy gateway gets ready to slide the window by one slot, so the oldest slot falls off and makes room for the newest one. Before sliding, though, it checks what's in the oldest slot. If that slot holds a miss, the policy gateway takes 1 off the miss tally, because that slot isn't part of the current window anymore 🙈

After the slide, the policy gateway figures out what goes in the newest slot. If the current period's hit tally is 0, it records a miss there and adds 1 to the miss tally. Otherwise, if the current period's hit tally is greater than 0, it records a hit in the newest slot and takes 1 off the hit tally. Then it uses any leftover hits on slots that hold misses, starting with the newest such slot and working toward the oldest. Each time a hit lands on a miss, it records a hit in that slot and subtracts 1 from both the hit and miss tallies, because the hit cancels out the miss. It keeps doing this until either the hits run out or every slot holding a miss has been dealt with. Before the next up/down period starts, the policy gateway resets the hit tally to 0 🧹✨

Here's the tea: we expect the hit tally in any single period to be no greater than 1, but every so often a policy gateway gets more than one UP/DOWN message from an adjacent policy gateway in the same period. The usual culprits are message delay and clock drift 🕰️ When an UP/DOWN message gets delayed, the receiving policy gateway sees a miss in one period and then two hits in the next, and one of those hits cancels the earlier miss. But if excess hits are still hanging around after the miss cancellation, something is off, like clock drift. So whenever a policy gateway ends up with excess hits, it logs the event for network management 📝🚨

When clock drift happens between two adjacent policy gateways, the period of one grows relative to the period of the other 😵‍💫 Let p(X) be the period for PG X, let p(Y) be the period for PG Y, and let g and h be the smallest positive integers such that g * p(X) = h * p(Y). Say p(Y) > p(X) because of clock drift. Then PG X sees g - h misses in g consecutive periods, while PG Y sees g - h surplus hits in h consecutive periods. As long as (g - h)/g < (n - k)/n and (g - h)/g < or = (m - j)/m, the clock drift on its own won't push the direct connection into the down state or keep it there 🫶🌸

---

3.4. Policy Gateway Connectivity 🌐

Policy gateways collect connectivity info from the intra-domain routing procedure and from VGP. They spread connectivity changes through VGP too: in intra-VG messages to peers, and in inter-VG messages to neighbors 📣 Locally, this info helps policy gateways pick routes, and not just across a virtual gateway to an adjacent domain. It also helps them pick routes across a domain sitting between two virtual gateways 🧭 And connectivity changes between domains get distributed, in routing information messages, to route servers all over the internetwork 💜

3.4.1. Within a Virtual Gateway 🎀

Every policy gateway inside a virtual gateway keeps a constant eye on its connectivity to all its adjacent and all its peer policy gateways 👀 To figure out the state of its direct connection to an adjacent policy gateway, it uses reachability info from the up/down protocol. To figure out the state of its intra-domain routes to a peer policy gateway, it uses reachability info from either the intra-domain routing procedure or the up/down protocol.

A policy gateway generates a PG CONNECT message whenever either of these is true:

• The policy gateway detects a change, in state or in adjacent domain component, linked to its direct connection to an adjacent policy gateway. In this case, it sends a copy of the message to each peer reachable through intra-domain routing.
• The policy gateway detects that a peer that was unreachable is now reachable. In this case, it sends a copy of the message to that newly reachable peer.

A PG CONNECT message is an intra-VG message that carries info about each adjacent policy gateway directly connected to the issuing policy gateway. Specifically, it contains the adjacent policy gateway's identifier, its status (reachable or unreachable), and its domain component identifier. If a PG CONNECT message contains a "request", each peer that gets the message replies to the sender with its own PG CONNECT message 🙌

All mutually reachable peers keep an eye on policy gateway connectivity inside their virtual gateway. They do this through the up/down protocol, the intra-domain routing procedure, and the exchange of PG CONNECT messages 🫧 Within a given virtual gateway, each constituent policy gateway tracks the following about each configured adjacent policy gateway:

• The identifier for the adjacent policy gateway.
• The status of the adjacent policy gateway: reachable/unreachable, directly connected/not directly connected.
• The local exit interfaces used to reach the adjacent policy gateway, provided it is reachable.
• The identifier for the adjacent policy gateway's domain component.
• The set of peers to which the adjacent policy gateway is directly-connected.

So all mutually reachable peers can spot changes in connectivity across the virtual gateway to adjacent domain components 🦋

When the lowest-numbered operational peer policy gateway inside a virtual gateway notices a change in the set of adjacent domain components reachable through direct connections across that virtual gateway, it generates a VGCONNECT message and sends a copy to a VG representative in every other virtual gateway connected to its domain 📬 A VG CONNECT message is an inter-VG message that carries info about each peer's connectivity across the given virtual gateway. Specifically, it contains, for each peer, its identifier and the identifiers of the domain components reachable through its direct connections to adjacent policy gateways. On top of that, the VG CONNECT message gives each recipient enough info to work out whether the issuing virtual gateway is up or down 🆙⬇️

The issuing policy gateway, which is the lowest-numbered operational peer, may have to wait up to four times vgp_int microseconds after detecting the connectivity change before it generates and sends the VGCONNECT message, as described in section 3.1.3 ⏳ Each recipient VG representative then passes a copy of the VG CONNECT message to each of its peers reachable through intra-domain routing. If a VG CONNECT message contains a "request", then in each recipient virtual gateway, the lowest-numbered operational peer that gets the message replies to the original sender with its own VGCONNECT message 🌈

3.4.2. Between Virtual Gateways ✨

okay so rn we expect transit policies to be totally uniform across every intra-domain route between any two policy gateways in a domain 🧚 but once tariffed qualities of service become the norm for intra-domain routing, we can no longer count on uniform transit policies across the whole domain 😭 to keep an eye on the transit policies on intra-domain routes between virtual gateways, you need BOTH a policy-sensitive intra-domain routing procedure AND a VGP exchange of policy info between neighbor policy gateways. it's giving teamwork 🫶

every policy gateway in a domain is constantly watching its connectivity to all of its peer and neighbor policy gateways, including the transit policies on the intra-domain routes to them 👀 to figure out whether its intra-domain connection to a peer or neighbor is up, a policy gateway uses reachability info from either the intra-domain routing procedure or the up/down protocol. to figure out which transit policies are supported on those routes, it uses policy-sensitive reachability info from the intra-domain routing procedure. ngl, when transit policies are uniform across a domain, reachability and policy-sensitive reachability are literally the same thing 💅

inside a virtual gateway, each constituent policy gateway keeps track of the following for every configured peer and neighbor policy gateway:

• The identifier for the peer or neighbor policy gateway. 🎀
• The identifiers for the transit policies that are configured to be supported by intra-domain routes to the peer or neighbor policy gateway.
• For each transit policy, the status of the peer or neighbor policy gateway: reachable or unreachable.
• For each transit policy, the local exit interfaces used to reach the peer or neighbor policy gateway, as long as it's reachable.
• The identifiers for the adjacent domain components that are reachable through direct connections from the peer or neighbor policy gateway, learned through VG CONNECT messages. 🌸

with all of that info, a policy gateway can spot changes in its connectivity to an adjoining domain component, for a given transit policy and through a given neighbor 🔥 and if it combines the info from ALL the neighbors in a given virtual gateway, it can spot changes in its connectivity, for a given transit policy, to that whole virtual gateway and to the adjoining domain components reachable through it. main character energy 👑

here's the tea: all the policy gateways that are mutually reachable over intra-domain routes supporting a configured transit policy don't need to swap info about the connectivity changes they notice for that transit policy 🦋 instead, each one can infer another's policy-sensitive reachability to a third one from the mutual intra-domain reachability info the intra-domain routing procedure already gives them. BUT, whenever two or more policy gateways are no longer mutually reachable for a given transit policy, they can't infer each other's reachability to other policy gateways for that transit policy anymore 😭 in that case, those policy gateways must explicitly exchange info about changes in connectivity to other policy gateways, for that transit policy. no shortcuts, bestie 🙈

a policy gateway generates a PG POLICY message whenever either of these is true:

• The policy gateway detects a change in its connectivity to another virtual gateway, for a configured transit policy, or to an adjoining domain component reachable through that virtual gateway. In this case, it sends a copy of the message to each peer that's reachable via intra-domain routing but not currently reachable via any intra-domain routes of the given transit policy. 💌
• The policy gateway detects that a previously unreachable peer is now reachable. In this case, it sends a copy of the message to the newly reachable peer. 🥳

a PG POLICY message is an intra-VG message that carries info about each configured transit policy and each virtual gateway that's configured to be reachable from the issuing policy gateway via intra-domain routes of the given transit policy 🍓 specifically, the PGPOLICY message contains, for each configured transit policy:

• The identifier for the transit policy.
• The identifiers for the virtual gateways that are associated with the given transit policy and currently reachable from the issuing policy gateway, with respect to that transit policy.
• The identifiers for the domain components that are reachable from, and adjacent to, the members of the given virtual gateways.

if a PG POLICY message has a "request" in it, each peer that gets the message sends its own PG POLICY message back to the original sender 🫶

on top of its connectivity to its neighbors, each policy gateway also keeps an eye on the connectivity between the domain components adjacent to its virtual gateway and the domain components adjacent to OTHER virtual gateways, through its domain and for the configured transit policies 👀 for each member of each of its virtual gateways, a policy gateway watches:

• The set of adjacent domain components currently reachable through direct connections across the given virtual gateway. the policy gateway gets this info from PG CONNECT messages from reachable peers and from UP/DOWN messages from adjacent policy gateways.
• For each configured transit policy, the set of virtual gateways currently reachable from the given virtual gateway for that transit policy, plus the set of adjoining domain components currently reachable through direct connections across those virtual gateways. the policy gateway gets this info from PG POLICY messages from peers, VG CONNECT messages from neighbors, and the intra-domain routing procedure. with this, it can detect connectivity changes, through its domain and for a given transit policy, between adjoining domain components 🔥

when the lowest-numbered operational policy gateway within a virtual gateway spots a change in connectivity between a domain component adjacent to its virtual gateway and a domain component adjacent to another virtual gateway in its domain, for a configured transit policy, it generates a VG POLICY message and sends a copy to a VG representative in selected virtual gateways connected to its domain 💖 to be specific, the lowest-numbered operational policy gateway sends a VG POLICY message to a VG representative in every other virtual gateway that contains a member reachable via intra-domain routing but not currently reachable via any routes of the given transit policy. a VG POLICY message is an inter-VG message that carries info about the connectivity between domain components adjacent to the issuing virtual gateway and domain components adjacent to the other virtual gateways in the domain, for the configured transit policies. specifically, the VG POLICY message contains, for each transit policy:

• The identifier for the transit policy.
• The identifiers for the virtual gateways that are associated with the given transit policy and currently reachable from the issuing virtual gateway, with respect to that transit policy.
• The identifiers for the domain components that are reachable from, and adjacent to, the members of the given virtual gateways.

the issuing policy gateway, which is the lowest-numbered operational peer, may have to wait up to four times vgp_int microseconds after spotting the connectivity change before it generates and sends the VG POLICY message, as described in section 3.1.3. ⏳ each recipient VG representative then sends a copy of the VG POLICY message to each of its peers reachable via intra-domain routing. and if a VG POLICY message has a "request" in it, then in each recipient virtual gateway, the lowest-numbered operational peer that gets the message sends its own VG POLICY message back to the original sender 🌈

3.4.3. Communication Complexity 🧮

okay this part is so fun, we get an example to estimate how many VGP messages get exchanged within a domain, AD X, after a detected change in policy gateway connectivity 🎀 say an adjacent domain, AD Y, partitions in a way that's detectable through the exchange of UP/DOWN messages across a virtual gateway connecting AD X and AD Y 💀 let V be the number of virtual gateways in AD X. suppose each virtual gateway contains P peer policy gateways, and no policy gateway is a member of more than one virtual gateway. then, within AD X, the detected partition results in the following VGP message exchanges:

• P policy gateways each receive at most P-1 PG CONNECT messages.

each policy gateway that detects the adjacent domain partition generates a PG CONNECT message and sends it to each reachable peer in the virtual gateway. 🌸

• P * (V-1) policy gateways each receive at most one VG CONNECT message. the lowest-numbered operational policy gateway in the virtual gateway that detects the partition of the adjacent domain generates a VG CONNECT message and sends it to a VG representative in all other virtual gateways connected to the domain. then each VG representative sends the VG CONNECT message to each reachable peer within its virtual gateway.
• P * (V-1) policy gateways each receive at most P-1 PG POLICY messages, and only if the domain has more than a single uniform transit policy. each policy gateway in each virtual gateway generates a PG POLICY message and sends it to all reachable peers that aren't currently reachable with respect to the given transit policy. 🔥
• P * V policy gateways each receive at most V-1 VG POLICY messages, only if the domain has more than a single uniform transit policy. the lowest-numbered operational policy gateway in each virtual gateway generates a VG POLICY message and sends it to a VG representative in all other virtual gateways containing at least one reachable member that isn't currently reachable with respect to the given transit policy. then each VG representative sends a VG POLICY message to each peer within its virtual gateway. 🦋

---

3.5. VGP Message Formats 💅

the virtual gateway protocol number is equal to 0. we break down the contents of each type of VGP message below 🎀

3.5.1. UP/DOWN 💖

okay so UP/DOWN is the message type that equals 0 🫶 here's the layout:

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |            SRC CMP            |            DST AD             |
   +-------------------------------+---------------+---------------+
   |            DST PG             |    PERIOD     |     STATE     |
   +-------------------------------+---------------+---------------+

• SRC CMP (16 bits): the numeric ID for the domain component that holds the policy gateway sending this 🎀
• DST AD (16 bits): the numeric ID for the destination domain 🌸
• DST PG (16 bits): the numeric ID for the destination policy gateway 🧚
• PERIOD (8 bits): how long the UP/DOWN message generation period is, in seconds ⏰
• STATE (8 bits): the perceived state of the direct connection, from the issuing policy gateway's point of view. 1 means up and 0 means down. It sits in the right-most bit 🦋

3.5.2. PG CONNECT 🌈

the PG CONNECT message type is equal to 1. PG CONNECT messages are not required for any virtual gateway containing exactly two policy gateways, so if it's just two of them, you can skip this one 🙈

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |            ADJ AD             |      VG       |     RQST      |
   +-------------------------------+---------------+---------------+
   |            NUM RCH            |           NUM UNRCH           |
   +-------------------------------+-------------------------------+
   For each reachable adjacent policy gateway:
   +-------------------------------+-------------------------------+
   |            ADJ PG             |            ADJ CMP            |
   +-------------------------------+-------------------------------+
   For each unreachable adjacent policy gateway:
   +-------------------------------+
   |            ADJ PG             |
   +-------------------------------+

• ADJ AD (16 bits): the numeric ID for the adjacent domain 🌷
• VG (8 bits): the numeric ID for the virtual gateway 💜
• RQST (8 bits): a request for a PG CONNECT message from each recipient peer. 1 means request, 0 means no request. It lives in the right-most bit 🙋‍♀️
• NUM RCH (16 bits): how many adjacent policy gateways in the virtual gateway are directly connected to the issuing policy gateway and reachable from it right now ✨
• NUM UNRCH (16 bits): how many adjacent policy gateways in the virtual gateway are directly connected to the issuing policy gateway but not reachable from it right now 😭
• ADJ PG (16 bits): the numeric ID for a directly connected adjacent policy gateway 🍓
• ADJ CMP (16 bits): the numeric ID for the domain component that holds the reachable, directly connected adjacent policy gateway 🫧

3.5.3. PG POLICY 🎀

the PG POLICY message type is equal to 2. PG POLICY messages are not required for any virtual gateway containing exactly two policy gateways, or for any domain with a single uniform transit policy. 💅

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |            ADJ AD             |      VG       |     RQST      |
   +-------------------------------+---------------+---------------+
   |            NUM TP             |
   +-------------------------------+
   For each transit policy associated with the virtual gateway:
   +-------------------------------+-------------------------------+
   |              TP               |            NUM VG            |
   +-------------------------------+-------------------------------+
   For each virtual gateway reachable via the transit policy:
   +-------------------------------+---------------+---------------+
   |            ADJ AD             |      VG       |    UNUSED     |
   +-------------------------------+---------------+---------------+
   |            NUM CMP            |            ADJ CMP            |
   +-------------------------------+-------------------------------+

• ADJ AD (16 bits): the numeric ID for the adjacent domain 🌸
• VG (8 bits): the numeric ID for the virtual gateway 💖
• RQST (8 bits): a request for a PG POLICY message from each recipient peer. 1 means request, 0 means no request. It's in the right-most bit 🙏
• NUM TP (8 bits): how many transit policies are configured to include the virtual gateway 🧁
• TP (16 bits): the numeric ID for a transit policy associated with the virtual gateway 🦋
• NUM VG (16 bits): how many virtual gateways are reachable from the issuing policy gateway through intra-domain routes that support the transit policy 🗺️
• UNUSED (8 bits): not currently used, so it must be set equal to 0 🫧
• NUM CMP (16 bits): how many adjacent domain components are reachable through direct connections via the virtual gateway 🌈
• ADJ CMP (16 bits): the numeric ID for a reachable adjacent domain component 💜

3.5.4. VG CONNECT 🦋

the VG CONNECT message type is equal to 3 ✨

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |            ADJ AD             |      VG       |     RQST      |
   +-------------------------------+---------------+---------------+
   |            NUM PG             |
   +-------------------------------+
   For each reach policy gateway in the virtual gateway:
   +-------------------------------+-------------------------------+
   |              PG               |            NUM CMP            |
   +-------------------------------+-------------------------------+
   |            ADJ CMP            |
   +-------------------------------+

• ADJ AD (16 bits): the numeric ID for the adjacent domain 🌷
• VG (8 bits): the numeric ID for the virtual gateway 🎀
• RQST (8 bits): a request for a VG CONNECT message from a recipient in each virtual gateway. 1 means request, 0 means no request. It's in the right-most bit 🙋‍♀️
• NUM PG (16 bits): how many mutually reachable peer policy gateways are in the virtual gateway 🫶
• PG (16 bits): the numeric ID for a peer policy gateway 🍓
• NUM CMP (16 bits): how many components of the adjacent domain are reachable through direct connections from the policy gateway 🧚
• ADJ CMP (16 bits): the numeric ID for a reachable adjacent domain component 💜

3.5.5. VG POLICY 👑

the VG POLICY message type is equal to 4. VG POLICY messages are not required for any domain with a single uniform transit policy 🌸

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |            ADJ AD             |      VG       |     RQST      |
   +-------------------------------+---------------+---------------+
   |            NUM TP             |
   +-------------------------------+
   For each transit policy associated with the virtual gateway:
   +-------------------------------+-------------------------------+
   |              TP               |            NUM GRP            |
   +-------------------------------+-------------------------------+
   For each virtual gateway group reachable via the transit policy:
   +-------------------------------+-------------------------------+
   |            NUM VG             |            ADJ AD             |
   +---------------+---------------+-------------------------------+
   |     VG        |    UNUSED     |            NUM CMP            |
   +---------------+---------------+-------------------------------+
   |            ADJ CMP            |
   +-------------------------------+

• ADJ AD (16 bits): the numeric ID for the adjacent domain 🦋
• VG (8 bits): the numeric ID for the virtual gateway 💖
• RQST (8 bits): a request for a VG POLICY message from a recipient in each virtual gateway. 1 means request, 0 means no request. It's in the right-most bit 🙏
• NUM TP (16 bits): how many transit policies are configured to include the virtual gateway 🧁
• TP (16 bits): the numeric ID for a transit policy associated with the virtual gateway ✨
• NUM GRP (16 bits): how many groups of virtual gateways there are, where every member of a group is reachable from the issuing virtual gateway through intra-domain routes that support the given transit policy 🗺️
• NUM VG (16 bits): how many virtual gateways are in a virtual gateway group 🫧
• UNUSED (8 bits): not currently used, so it must be set equal to 0 🌈
• NUM CMP (16 bits): how many adjacent domain components are reachable through direct connections via the virtual gateway 💜
• ADJ CMP (16 bits): the numeric ID for a reachable adjacent domain component 🍓

Normally, each VG POLICY message contains a single virtual gateway group. But if the issuing virtual gateway gets partitioned, so that peers are mutually reachable under some transit policies but not others, you may need more than one group. 🫠

Here's an example. Say PG X and PG Y are two peers in VG A, configured to support transit policies 1 and 2. Suppose PG X and PG Y can reach each other under transit policy 1 but not under transit policy 2. Also suppose PG X can reach the members of VG B through intra-domain routes of transit policy 2, and PG Y can reach the members of VG C through intra-domain routes of transit policy 2. Then the entry for transit policy 2 in the VG POLICY message issued by VG A will include two groups of virtual gateways: one containing VG B and one containing VG C. 😭

3.5.6. Negative Acknowledgements 🙈

when a policy gateway gets a VGP message that is unacceptable but still passes the CMTP validation checks, it puts an appropriate VGP negative acknowledgement into its CMTP ACK. That info goes in the INFORM field of the CMTP ACK (described earlier, in section 2.4), and the numeric ID for each type of VGP negative acknowledgement lives in the left-most 8 bits of the INFORM field. The VGP negative acknowledgement types are:

1. Unrecognized VGP message type. Includes the numeric ID for the unrecognized message type (8 bits). 🫣
2. Out-of-date VGP message. 🕰️
3. Unrecognized virtual gateway source. Includes the numeric ID for the unrecognized virtual gateway, made up of the adjacent domain identifier (16 bits) and the local identifier (8 bits). 🧚

4. Routing Information Distribution ✨

okay so every domain in IDPR makes its own routing information messages and sends them out to route servers all over the internetwork 🌐💖. These messages are basically the domain's vibe check: they spell out the transit policies in effect across that domain and the virtual gateway connectivity to adjacent domains 🦋. Then route servers take that IDPR routing information and use it to build policy routes between source and destination domains. it's giving teamwork 🫶

There are three different procedures for distributing IDPR routing information, and each one has its own energy:

• The flooding protocol. Here, a representative policy gateway in each domain floods its routing information messages out to route servers in all the other domains 🌊
• Remote route server communication. Here, a route server distributes its domain's routing information messages to route servers in specific destination domains, by wrapping these messages inside IDPR data messages 🎀. This means a domain administrator can control how the domain's routing information gets distributed, by restricting routing information exchange with remote route servers. Currently, routing information distribution restrictions are not included in IDPR configuration information 🙈
• The route server query protocol. Here, a policy gateway or route server asks another route server for routing information, and that route server answers with info from its database 🔍. This one is perfect for quickly updating the routing information a policy gateway or route server has when it has just been connected or reconnected to an internetwork ✨. It can also be used to grab routing information from domains that restrict distribution of their routing information 👀

In this section, we only cover the flooding protocol 💅. Section 5 is where we get into the route server query protocol, and section 5.2 covers communication between route servers in separate domains 🧚

Now for the transport part 🚚. Policy gateways and route servers use CMTP for reliable transport of IDPR routing information messages that get flooded between peer, neighbor, and adjacent policy gateways, and between those policy gateways and route servers 🔥. The issuing policy gateway has to tell CMTP two things: the maximum number of transmissions per routing information message, which is flood_ret, and the interval between routing information message retransmissions, which is flood_int microseconds. The recipient policy gateway or route server has to figure out whether a routing information message is acceptable, and we'll get into how that works in section 4.2.3 below 💀

4.1. AD Representatives 👑

We pick a single policy gateway, the "AD representative", to generate and distribute IDPR routing information about its domain 💅. This keeps the routing information distributed consistent and unambiguous, and it keeps the communication needed for distribution to a minimum 🍓. There is usually only a single AD representative per domain, and it's the lowest-numbered operational policy gateway in the domain 🌸. Within a domain, policy gateways don't need any explicit election procedure to figure out the AD representative. Instead, all members of a set of policy gateways that can reach each other via intra-domain routes can agree on set membership, and therefore on which member has the lowest number 🤝

A partitioned domain has as many AD representatives as it has domain components 🧩. In fact, the numeric identifier for an AD representative is identical to the numeric identifier for a domain component. You can't normally predict when and where a domain partition will happen, so any policy gateway within a domain may become an AD representative at any time 😭. To get ready for that role in case of a domain partition, every policy gateway has to continually monitor its domain's IDPR routing information, through VGP and through the intra-domain routing procedure 👀

4.2. Flooding Protocol 🌊

An AD representative policy gateway uses unrestricted flooding among all domains to distribute its domain's IDPR routing information messages to route servers in an internetwork 🚀. There are two kinds of IDPR routing information messages issued by each AD representative: CONFIGURATION and DYNAMIC messages 💜. Each CONFIGURATION message contains the transit policy information configured by the domain administrator. That includes, for each transit policy, its identifier, its specification, and the sets of virtual gateways configured as mutually reachable via intra-domain routes supporting that transit policy 📋. Each DYNAMIC message contains information about current virtual gateway connectivity to adjacent domains, and about the sets of virtual gateways currently mutually reachable via intra-domain routes supporting the configured transit policies ⭐

The IDPR Flooding Protocol is similar to the flooding procedures described in [9]-[11] 🧠. Through flooding, the AD representative distributes its routing information messages to route servers in its own domain and in adjacent domains 🌈. After generating a routing information message, the AD representative sends a copy to each of its peers, and to a selected VG representative (see section 3.1.4) in all other virtual gateways connected to the domain 💖. Each VG representative then distributes a copy of the routing information message to each of its peers 🫶. We note that distribution of routing information messages among virtual gateways, and among peers within a virtual gateway, is identical to distribution of inter-VG messages in VGP, as described in section 3.1.3 ✨

Within a virtual gateway, each policy gateway distributes a copy of the routing information message in two ways:

• To each route server in its configured set of route servers. A domain administrator should ensure that each route server not contained within a policy gateway appears in the set of configured route servers for at least two distinct policy gateways 🎀. That way, such a route server keeps receiving routing information messages even when one of the policy gateways becomes unreachable 🛟. However, the route server will normally receive duplicate copies of a routing information message 👯
• To certain directly-connected adjacent policy gateways. A policy gateway distributes a routing information message to a directly-connected adjacent policy gateway in an adjacent domain component only when it is the lowest-numbered operational peer with a direct connection to the given domain component 🔢. We note that each policy gateway knows, through information provided by VGP, which peers have direct connections to which components of the adjacent domain 🗺️. If the policy gateway has direct connections to more than one adjacent policy gateway in that domain component, it selects the routing information message recipient according to the order in which the adjacent policy gateways appear in its database, and picks the first one encountered 📚. This selection procedure makes sure a copy of the routing information message reaches each component of the adjacent domain, while limiting the number of copies distributed 🧚‍♀️

Once a routing information message reaches an adjacent policy gateway, that policy gateway distributes copies of the message throughout its domain. The adjacent policy gateway, acting as the first recipient of the routing information message in its domain, follows the same message distribution procedure as the AD representative in the source domain, as described above. The flooding procedure terminates when all reachable route servers in an internetwork receive a copy of the routing information message 🏁

Neighbor policy gateways may receive copies of the same routing information message from different adjoining domains 😳. If two neighbor policy gateways receive the message copies simultaneously, they will distribute them to VG representatives in other virtual gateways within their domain, which results in duplicate message distribution 🙃. However, each policy gateway stops the spread of duplicate routing information messages as soon as it detects them, as described in section 4.2.3 below 🛑. In the Internet, we expect simultaneous message receptions to be the exception rather than the rule, given the hierarchical structure of the current topology 🌍💅

4.2.1. Message Generation ✨

okay so an AD representative generates and sends out a CONFIGURATION message whenever something changes in a transit policy or virtual gateway that belongs to its domain 💅 this is how route servers stay up to date on the domain's configured transit policies and adjacencies. An AD representative may also send a CONFIGURATION message on a configurable period of conf_per (500) hours 🕰️

the CONFIGURATION message holds, for each configured transit policy, the identifier the domain administrator gave it, the specification, and the set of associated "virtual gateway groups" 🎀 each virtual gateway group is a bunch of virtual gateways that are set up to be mutually reachable through intra-domain routes of that transit policy. Every virtual gateway in the list also comes with a flag saying whether it's configured as a domain entry point, a domain exit point, or both, according to that transit policy 🦋 and the message includes the set of local route servers that the domain administrator has made available to IDPR clients in other domains 🌸

An AD representative generates and sends a DYNAMIC message whenever the currently supported transit policies or the current virtual gateway connectivity associated with its domain changes 💖 this keeps route servers current on the supported transit policies and existing adjacencies, and on how those differ from what was configured for the domain. Specifically, an AD representative generates a DYNAMIC message whenever the connectivity changes, through the given domain and with respect to a configured transit policy, between two components of adjoining domains 🧚 An AD representative may also send a DYNAMIC message on a configurable period of dyn_per (24) hours ⭐ For each configured transit policy, the DYNAMIC message contains its identifier, its associated virtual gateway groups, and the domain components reachable through the virtual gateways in each group. Each DYNAMIC message also contains the set of currently "unavailable" virtual gateways in the domain, meaning ones that are either down or unreachable 💀

We note that each virtual gateway group in a DYNAMIC message may be a proper subset of one of the matching virtual gateway groups in a CONFIGURATION message 👑 Here's an example. Say that for a given domain, the virtual gateway group (VG A,...,VG E) was configured for a transit policy, and every virtual gateway in it was both a domain entry and exit point. So all the virtual gateways in this group are set up to be mutually reachable through intra-domain routes of that transit policy. Now imagine VG E goes unreachable because of a power failure, and the remaining virtual gateways split into two separate groups, (VG A,VG B) and (VG C,VG D). Each group can still reach the other through some intra-domain routes, but not through any intra-domain routes of that transit policy anymore 😭 In this case the virtual gateway groups for that transit policy become (VG A,VG B) and (VG C,VG D), and VG E gets listed as an unavailable virtual gateway 🙈

A route server uses the set of unavailable virtual gateways to figure out which of its routes are no longer viable, and then it removes those routes from its route database 🗑️ Route servers could work this out themselves from the configured virtual gateways and the currently reachable ones, but the processing cost is high 🥴 A route server would have to look through every virtual gateway group in a DYNAMIC message just to find out whether any virtual gateways in the given domain are unavailable. To cut down on message processing at each route server, we decided to include the set of unavailable virtual gateways in every DYNAMIC message 💅✨

To build a DYNAMIC message, an AD representative pulls together information from intra-domain routing and from VGP 🧵 Specifically, the AD representative uses the following information:

• VG CONNECT and UP/DOWN messages, to figure out whether each of its domain's virtual gateways is up or down, and which adjacent domain components are reachable through each virtual gateway 🌈
• Intra-domain routing information, to determine for each of its domain's transit policies whether a given virtual gateway in the domain is reachable under that transit policy 🍓
• VG POLICY messages, to determine how adjoining domain components are connected across the given domain for a configured transit policy, specifically the ones next to virtual gateways that the AD representative's virtual gateway cannot currently reach under that transit policy 🫶

---

4.2.2. Sequence Numbers 🔢

every IDPR routing information message carries a sequence number, and when you pair it with the timestamp in the CMTP message header, you can tell how recent the message is 🕵️‍♀️ An AD representative gives each routing information message it generates a sequence number, and which number it gets depends on its internal clock time:

• The AD representative sets the sequence number to 0 if its internal clock time is greater than the timestamp in its previously generated routing information message 🌟
• The AD representative sets the sequence number to 1 greater than the sequence number in its previously generated routing information message if its internal clock time equals the timestamp for that previous message AND the previous sequence number is less than the maximum value (currently 2**16 - 1). If the previous sequence number equals the maximum value, the AD representative waits until its internal clock time exceeds the timestamp in its previously generated routing information message, and then sets the sequence number to 0 ⏳

Honestly, we don't expect multiple distinct IDPR routing information messages to carry identical timestamps, so the sequence number might look pointless 🤷‍♀️ But it can become necessary during synchronization of an AD representative's internal clock. The AD representative may need to freeze the clock value during synchronization, and in that case distinct sequence numbers are what tell apart the routing information messages generated during that clock synchronization interval 🎀

---

4.2.3. Message Acceptance 🛡️

before a policy gateway forwards a routing information message, or a route server puts routing information into its routing information database, the policy gateway or route server checks whether the message is acceptable 👀 An IDPR routing information message is "acceptable" if:

• It passes the CMTP validation checks. ✅
• Its timestamp is less than conf_old (530) hours behind the recipient's internal clock time for CONFIGURATION messages, and less than dyn_old (25) hours behind the recipient's internal clock time for DYNAMIC messages. ⌛
• Its timestamp and sequence number show that it is more recent than the currently stored routing information from the given domain. If there's no routing information stored from the given domain yet, the routing information message counts as more recent by default 🌸

Policy gateways acknowledge and forward acceptable IDPR routing information messages, following the flooding protocol described in section 4.2 above 🌊 Each policy gateway also keeps the timestamp and sequence number of the most recently accepted routing information message from each domain, and it uses those values to judge whether future routing information messages are acceptable 🧠 Route servers acknowledge acceptable routing information messages and put their contents into their routing information databases, depending on the criteria in section 4.2.4 below. They do NOT take part in the flooding protocol though 🙅‍♀️ We note that when a policy gateway or route server first comes back into service, it immediately updates its routing information database with routing information from another route server, using the route server query protocol described in section 5 🔄

An AD representative takes special action when it receives an acceptable routing information message that is supposedly generated by itself but was originally obtained from a policy gateway or route server other than itself 😳 There are at least three possible reasons this happens:

• The routing information message was corrupted in a way that the integrity/authentication value can't detect. 🧩
• The AD representative has had a memory error. 💾
• Some other entity is generating routing information messages on behalf of the AD representative. 👻

In any case, the AD representative logs the event for network management 📝 The AD representative also has to reestablish its own routing information messages as the most recent for its domain. To do that, it waits until its internal clock time goes past the timestamp in the received routing information message, and then it generates a new routing information message using the currently stored domain routing information supplied by VGP and by the intra-domain routing procedure. The wait is at most cmtp_new (300) seconds, which is the maximum CMTP-tolerated difference between the received message's timestamp and the AD representative's internal clock time ⏱️

IDPR routing information messages that pass the CMTP validity checks but look less recent than the stored routing information are unacceptable 🙃 Policy gateways do not forward unacceptable routing information messages, and route servers do not put the contents of unacceptable routing information messages into their routing information databases. Instead, the recipient of an unacceptable routing information message acknowledges it in one of two ways:

• If the message's timestamp and sequence number match the timestamp and sequence number of the stored routing information for the given domain, the recipient treats the message as a duplicate and acknowledges it 👯‍♀️
• If the message's timestamp and sequence number show that it is less recent than the stored routing information for the domain, the recipient acknowledges the message with an indication that the routing information it contains is out-of-date 📉 That negative acknowledgement tells the sender to ask a route server for more up-to-date routing information, using the route server query protocol. Also, if the recipient of the out-of-date routing information message is a route server, it regenerates a routing information message from its own routing information database and forwards that message to the sender 🚀 The sender may then pass this more recent routing information message along to other policy gateways and route servers 💜

4.2.4. Message Incorporation ✨

okay so a route server usually stores the entire contents of an acceptable IDPR routing information message in its routing information database 🗄️. that way it has access to every advertised transit policy when it's generating a route, and it can regenerate routing information messages later if another route server or policy gateway asks for them 🙌. but a route server may elect not to store all routing information message contents, and that's giving flexibility 💅. it doesn't have to store any transit policy that excludes the route server's domain as a source, or any routing information from a domain that the route server's domain's source policies exclude for transit 🚫. selective storing is lowkey genius because it shrinks the search space of possible routes when it's generating them, and it keeps route server memory from getting stuffed with routing information 🧠. the catch is that the route server can't always regenerate the original routing information message if another route server or policy gateway requests it 💀.

okay, next thing 👀. an acceptable IDPR routing information message can contain transit policy information that isn't well-defined from the route server's point of view. a CONFIGURATION message might have an unrecognized domain, virtual gateway, or transit policy attribute, like user class access restrictions or offered service 🎟️. here, "unrecognized" just means the value in the routing information message isn't listed in the route server's configuration database, as described earlier in section 1.8.2 🔍. a DYNAMIC message might contain an unrecognized transit policy or virtual gateway, and in that case "unrecognized" means the transit policy or virtual gateway wasn't listed in the most recent CONFIGURATION message for that domain 📋.

every route server can always parse an acceptable routing information message, even if some of the info isn't well-defined, so it can always use the stuff it does recognize 🫶. which means a route server can store the contents of acceptable routing information messages from domains it's interested in, no matter whether everything looks well-defined right now ✨. if a routing message has unrecognized info, the route server may try to get the extra information it needs to decode it. for a CONFIGURATION message, the route server logs the event for network management 📝. for a DYNAMIC message, the route server asks another route server for the most recent CONFIGURATION message for that domain 🙏.

when a domain gets partitioned, each domain component has its own AD representative, and that rep generates routing information messages on behalf of its component 🧩. once a partition is discovered, the AD representative for each domain component generates and distributes a DYNAMIC message. so in this case, a route server receives and stores more than one routing information message at a time for the same domain, one for each domain component 👯.

then when the partition heals, the AD representative for the entire domain generates and distributes a DYNAMIC message 🩹. but here's the tea ☕: in each route server's routing information database, that new DYNAMIC message does not automatically replace all the currently-stored DYNAMIC messages for the domain. it only replaces the one whose AD representative matches the AD representative of the new message 🎯. the other DYNAMIC messages, generated during the partition, stick around in the routing information database until they hit their maximum lifetime (more on that in section 4.2.5 below) ⏳. that stale info can lead to routes that fail path setup, which means alternate routes get picked instead 😬. to cut down on those path setup failures, the IDPR folks plan to look into mechanisms for removing partition-related DYNAMIC messages right after a partition disappears, but that's for a future version of IDPR 🔮.

4.2.5. Routing Information Database 🗃️

we expect that most IDPR routing information stored in a routing information database will stay viable for long stretches, maybe until a domain reconfiguration happens 🕰️. by "viable" we mean the information reflects the current state of the domain, so it can be used successfully to generate policy routes ✅. to lower the chance of hanging onto stale routing information, a route server puts a maximum lifetime on each database entry. that timer starts when the route server incorporates an accepted entry into its routing information database ⏱️. the maximum lifetime should be longer than the corresponding message generation period, so the entry is likely to get refreshed before it reaches its maximum lifetime 🔄.

each CONFIGURATION message stored in the routing information database has a maximum lifetime of conf_old (530) hours, and each DYNAMIC message stored there has a maximum lifetime of dyn_old (25) hours ⌛. because routing information messages are generated periodically, it's unlikely that any message sticks around in a routing information database for its full lifetime 🙌. still, a routing information message can hit its maximum lifetime in a route server that's been cut off from the internetwork for a long time 🏝️.

when a routing information message hits its maximum lifetime in a routing information database, the route server deletes the message contents from its database 🗑️. that way it won't generate new routes using the outdated info, and it won't send old routing information when other route servers or policy gateways ask for it 🚫. but the route server keeps handing out routes that were generated with the old info, as long as path setup (see section 7) for those routes still succeeds ✨.

the route server handles expiration differently depending on the message type 🧐. when a CONFIGURATION message expires, the route server asks another route server for the most recent CONFIGURATION message issued for that domain 📩. when a DYNAMIC message expires, the route server doesn't go looking for newer info right away. instead, if it needs to generate a route, it uses the routing information in the corresponding CONFIGURATION message for that domain 📜. only if a path setup failure (see section 7.4) involves that domain does the route server ask another route server for the most recent DYNAMIC message issued for it 🆘.

4.3. Routing Information Message Formats 📦

the flooding protocol number is 1 🔢. we'll describe what each type of routing information message contains right below 👇.

4.3.1. CONFIGURATION 🎀

okay bestie, the CONFIGURATION message type is equal to 0 💅 this is the message that carries a domain's whole transit policy setup, so the layout is a little bit of a maze 🌀 but I'll walk you through it ✨

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|            AD CMP             |              SEQ              |
+-------------------------------+-------------------------------+
|            NUM TP             |            NUM RS             |
+-------------------------------+-------------------------------+
|              RS               |
+-------------------------------+
For each transit policy configured for the domain:
+-------------------------------+-------------------------------+
|              TP               |            NUM ATR            |
+-------------------------------+-------------------------------+
For each attribute of the transit policy:
+-------------------------------+-------------------------------+
|            ATR TYP            |            ATR LEN            |
+-------------------------------+-------------------------------+
For the source/destination access restrictions attribute:
+-------------------------------+
|          NUM AD GRP           |
+-------------------------------+
For each domain group in the source/destination access restrictions:
+-------------------------------+-------------------------------+
|            NUM AD             |              AD               |
+---------------+---------------+-------------------------------+
|    AD FLGS    |    NUM HST    |            HST SET            |
+---------------+---------------+-------------------------------+
For the temporal access restrictions attribute:
+-------------------------------+
|            NUM TIM            |
+-------------------------------+
For each set of times in the temporal access restrictions:
+---------------+-----------------------------------------------+
|   TIM FLGS    |                   DURATION                    |
+---------------+-----------------------------------------------+
|                             START                             |
+-------------------------------+-------------------------------+
|            PERIOD             |            ACTIVE             |
+-------------------------------+-------------------------------+
For the user class access restrictions attribute:
+-------------------------------+
|            NUM UCI            |
+-------------------------------+
For each UCI in the user class access restrictions:
+---------------+
|      UCI      |
+---------------+
For each offered service attribute:
+---------------------------------------------------------------+
|                            OFR SRV                            |
+---------------------------------------------------------------+
For the virtual gateway access restrictions attribute:
+-------------------------------+
|           NUM VG GRP          |
+-------------------------------+
For each virtual gateway group in the virtual gateway access
restrictions:
+-------------------------------+-------------------------------+
|            NUM VG             |            ADJ AD             |
+---------------+---------------+-------------------------------+
|      VG       |    VG FLGS    |
+---------------+---------------+

AD CMP (16 bits) is the numeric identifier for the domain component that holds the AD representative policy gateway 🏠

SEQ (16 bits) is the routing information message sequence number 🔢

NUM TP (16 bits) is how many transit policy specifications are in this routing information message 📦

NUM RS (16 bits) is how many route servers get advertised to serve clients outside the domain 🛰️

RS (16 bits) is the numeric identifier for a route server ✨

TP (16 bits) is the numeric identifier for a transit policy specification 🎟️

NUM ATR (16 bits) is how many attributes are attached to the transit policy 🧩

ATR TYP (16 bits) is the numeric identifier for a type of attribute. The valid attribute types are:

• Set of virtual gateway access restrictions (see section 1.4.2) attached to the transit policy (variable). This attribute must be included.
• Set of source/destination access restrictions (see section 1.4.2) attached to the transit policy (variable). This attribute may be omitted. If it's absent, traffic from any source to any destination is acceptable.
• Set of temporal access restrictions (see section 1.4.2) attached to the transit policy (variable). This attribute may be omitted. If it's absent, the transit policy applies at all times.
• Set of user class access restrictions (see section 1.4.2) attached to the transit policy (variable). This attribute may be omitted. If it's absent, traffic from any user class is acceptable.
• Average delay in milliseconds (16 bits). This attribute may be omitted.
• Delay variation in milliseconds (16 bits). This attribute may be omitted.
• Average available bandwidth in bits per second (48 bits). This attribute may be omitted.
• Available bandwidth variation in bits per second (48 bits). This attribute may be omitted.
• MTU in bytes (16 bits). This attribute may be omitted.
• Charge per byte in thousandths of a cent (16 bits). This attribute may be omitted.
• Charge per message in thousandths of a cent (16 bits). This attribute may be omitted.
• Charge for session time in thousandths of a cent per second (16 bits). This attribute may be omitted. If no charge attribute is present at all, the domain provides free transit service 🆓

ATR LEN (16 bits) is the length of an attribute in bytes, counted from the field right after it 📏

NUM AD GRP (16 bits) is the number of source/destination domain groups (see section 1.4.2) tied to the source/destination access restrictions 👯

NUM AD (16 bits) is the number of domains, or sets of domains, inside a domain group 🌐

AD (16 bits) is the numeric identifier for a domain or domain set 🗺️

AD FLGS (8 bits) is a set of five flags telling you how to read the AD field. They sit in the right-most bits and go left to right:

• The first flag says whether the transit policy applies to all domains or to specific ones (1 all, 0 specific). When it's set to 1, the second and third flags get ignored, so it's a full override 👑
• The second flag says whether the domain identifier means a single domain or a domain set (1 single, 0 set).
• The third flag says whether the transit policy applies to the given domain or domain set (1 applies, 0 does not apply). This one is how you represent complements of sets of domains 🔄
• The fourth flag says whether the domain is a source (1 source, 0 not source).
• The fifth flag says whether the domain is a destination (1 destination, 0 not destination).

At least one of the fourth and fifth flags must be set to 1 💀 no exceptions!

NUM HST (8 bits) is the number of "host sets" (see section 1.4.2) tied to a particular domain or domain set 🖥️ A value of 0 means every host in that domain or domain set is an acceptable source or destination, depending on the fourth and fifth AD flags.

HST SET (16 bits) is the numeric identifier for a host set 🆔

NUM TIM (16 bits) is the number of time specifications tied to the temporal access restrictions ⏰ Each time specification gets split into a set of contiguous, identical periods, which we'll cover below.

TIM FLGS (8 bits) is a set of two flags telling you how to combine the time specifications. They're in the right-most bits, left to right:

• The first flag says whether the transit policy applies during the periods in this time specification (1 applies, 0 does not apply). It's how you represent complements of policy applicability intervals 🙃
• The second flag says whether this time specification takes precedence over the earlier ones listed (1 precedence, 0 no precedence). Precedence works like the boolean OR and AND operators. At any given instant, the transit policy either applies or it doesn't according to a given time specification, so you can give that state a boolean value. If the second flag is 1, the boolean OR gets applied to the applicability values from this time specification and all the earlier ones. If it's 0, the boolean AND gets applied instead 🧠

DURATION (24 bits) is the length of the time specification duration, in minutes. A value of 0 means an infinite duration ♾️

START (32 bits) is the time the time specification first takes effect, in seconds elapsed since 1 January 1970 0:00 GMT 🗓️

PERIOD (16 bits) is the length of each time period within the time specification, in minutes 🔁

ACTIVE (16 bits) is the length of the policy applicable interval during each time period, in minutes counted from the start of that period ✅

NUM UCI (16 bits) is the number of user classes tied to the user class access restrictions 🎭

UCI (8 bits) is the numeric identifier for a user class 🏷️

NUM VG GRP (16 bits) is the number of virtual gateway groups (see section 1.4.2) tied to the virtual gateway access restrictions 🚪

NUM VG (16 bits) is the number of virtual gateways in a virtual gateway group 🚪🚪

ADJ AD (16 bits) is the numeric identifier for the adjacent domain that a virtual gateway connects to 🤝

VG (8 bits) is the numeric identifier for a virtual gateway 🔑

VG FLGS (8 bits) is a set of two flags telling you how to read the VG field. They're in the right-most bits, left to right:

• The first flag says whether the virtual gateway is a domain entry point (1 entry, 0 not entry) 🚶‍♀️
• The second flag says whether the virtual gateway is a domain exit point (1 exit, 0 not exit) 🏃‍♀️

At least one of the first and second flags must be set to 1 💖

4.3.2. DYNAMIC ✨

okay bestie, the DYNAMIC message type is equal to 1 🦋 here's the layout:

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |            AD CMP             |              SEQ              |
   +-------------------------------+-------------------------------+
   |           UNAVL VG            |            NUM PS             |
   +-------------------------------+-------------------------------+
   For each unavailable virtual gateway in the domain:
   +-------------------------------+---------------+---------------+
   |            ADJ AD             |      VG       |    UNUSED     |
   +-------------------------------+---------------+---------------+
   For each set of transit policies for the domain:
   +-------------------------------+-------------------------------+
   |            NUM TP             |          NUM VG GRP           |
   +-------------------------------+-------------------------------+
   |              TP               |
   +-------------------------------+
   For each virtual gateway group associated with the transit policy
   set:
   +-------------------------------+-------------------------------+
   |            NUM VG             |            ADJ AD             |
   +---------------+---------------+-------------------------------+
   |      VG       |    VG FLGS    |            NUM CMP            |
   +---------------+---------------+-------------------------------+
   |            ADJ CMP            |
   +-------------------------------+

Now the fields, one by one, bestie 💅

AD CMP (16 bits) is the numeric identifier for the domain component that holds the AD representative policy gateway 🎀

SEQ (16 bits) is the routing information message sequence number 🌸

UNAVL VG (16 bits) counts the virtual gateways in the domain component that are currently unavailable through any intra-domain routes 😭

NUM PS (16 bits) is how many sets of transit policies are listed. Transit policy sets are lowkey the trick for keeping DYNAMIC messages small ✨ One set of virtual gateway groups covers every transit policy in that set, so you don't repeat yourself 🧚

ADJ AD (16 bits) is the numeric identifier for the adjacent domain that a virtual gateway connects to 🌈

VG (8 bits) is the numeric identifier for a virtual gateway 💜

UNUSED (8 bits) isn't used right now, and it must be set equal to 0 🫶

NUM TP (16 bits) is how many transit policies are in a set 🍓

NUM VGGRP (16 bits) is how many virtual gateway groups are currently linked to the transit policy set 👑

TP (16 bits) is the numeric identifier for a transit policy 🦋

NUM VG (16 bits) is how many virtual gateways are in one virtual gateway group 🎀

VG FLGS (8 bits) is a pair of flags that tell you how to read the VG field. They sit in the right-most bits, and going left to right, the first flag says whether the virtual gateway is a domain entry point (1 means entry, 0 means not entry). The second flag says whether it's a domain exit point (1 means exit, 0 means not exit). At least one of the first and second flags must be set to 1 💖

NUM CMP (16 bits) is how many adjacent domain components can be reached by direct connections through the virtual gateway ✨

ADJ CMP (16 bits) is the numeric identifier for one reachable adjacent domain component 🌸

---

4.3.3. Negative Acknowledgements

okay so, when a policy gateway or route server gets an IDPR routing information message that's NOT acceptable but still passes the CMTP validation checks, it sends back a negative acknowledgement inside its CMTP ACK 🙈 That info goes in the INFORM field of the CMTP ACK (we covered that back in section 2.4), and the numeric identifier for each type of negative acknowledgement lives in the left-most 8 bits of the INFORM field 💅 These are the types of routing information message negative acknowledgements:

1. Unrecognized IDPR routing information message type. This carries the numeric identifier for the unrecognized message type (8 bits) 💀
2. Out-of-date IDPR routing information message. This is a signal to the sender that it may not have the most recent routing information for the given domain 😭🫶

---

5. Route Server Query Protocol 🔥

okay so each route server is basically in charge of two things: keeping the routing information database and the route database, and answering database information requests from policy gateways and other route servers 👑 Those requests and their responses are the messages swapped through the Route Server Query Protocol (RSQP) 💖

Policy gateways and route servers usually call on RSQP to replace information that's missing, outdated, or corrupted in their own routing information or route databases 🧚 Section 4 covered some of the situations where RSQP might get invoked, and this section plus section 7 cover the others 🦋

5.1. Message Exchange

Policy gateways and route servers rely on CMTP for reliable transport of route server requests and responses 🎀 RSQP has to tell CMTP two things: the maximum number of transmissions per request/response message, which is rsqp_ret, and the interval between retransmissions of a request/response message, which is rsqp_int microseconds 🌈 A route server request/response message is "acceptable" if:

• It passes the CMTP validation checks.
• Its timestamp is less than rsqp_old (300) seconds behind the recipient's internal clock time.

With RSQP, the requesting entity expects an acknowledgement from the queried route server saying whether it can take care of the request ✨ The route server might not be able to fill a request for either of these reasons:

• Its database has no entry, or only a partial entry, for the info that was asked for 😭
• It's under special message distribution rules, set by the domain administrator, that stop it from releasing the requested info. Right now those distribution rules aren't part of IDPR configuration information 🙈

For every request it can't fill, the route server sends back a negative acknowledgement message inside a CMTP acknowledgement, listing the set of unfulfilled requests (see section 5.5.4) 💅

If the requesting entity either gets a negative acknowledgement or gets no acknowledgement at all after rsqp_ret attempts aimed at the same route server, it asks a different route server, as long as the number of attempted requests to different route servers doesn't go over rsqp_try (3) 🍓 It goes round-robin through its list of addressable route servers, lowkey like a playlist 🎶 But if it's still unsuccessful after rsqp_try attempts, it gives up on the request completely and logs the event for network management 💀

A policy gateway or route server can request info from any route server it can address 🫶 Addresses for local route servers inside a domain come from the configuration for each IDPR entity in that domain. Addresses for remote route servers in other domains come from flooded CONFIGURATION messages, as described back in section 4.2.1 ✨ Requesting entities always query local route servers before remote ones, though, so the costs of the query and response stay contained 🌸 If the requesting entity and the queried route server are in the same domain, they can talk over intra-domain routes 🧚 If they're in different domains, they must obtain a policy route and establish a path before they can communicate, which we'll get into below 🦋

5.2. Remote Route Server Communication

RSQP communication with a remote route server needs a policy route and matching path setup (see section 7) between the requesting and queried entities, since they live in different domains 🎀 After generating a request message, the requesting entity hands CMTP its request message along with the remote route server's entity and domain identifiers. CMTP wraps the request in a DATAGRAM and hands the DATAGRAM and the remote route server information to the path agent 💖 Using that remote route server information, the path agent gets a path to the remote route server, setting one up if it has to 🌈 Once the path is successfully established, the path agent wraps the DATAGRAM inside an IDPR data message and forwards that data message along the designated path ✨

When the path agent in the remote route server gets the IDPR data message, it pulls out the DATAGRAM and hands it to CMTP 👑 The path agent also uses the requesting entity and domain identifiers in the path identifier to get a path back to the requesting entity, setting one up if necessary 🦋

If the DATAGRAM fails any of the CMTP validation checks, CMTP sends a NAK back to the requesting entity 💀 If the DATAGRAM passes all of the CMTP validation checks, the remote route server checks whether the request message is acceptable 🙈 As long as the request message is acceptable, the remote route server works out whether it can fulfill the request, and tells CMTP to send an ACK back to the requesting entity ✨ That ACK can include a negative acknowledgement if the whole request can't be fulfilled 😭

The remote route server generates responses for every request it can fulfill and sends them back to the requesting entity 🌸 Specifically, it hands CMTP its response along with the requesting entity information, and CMTP wraps the response in a DATAGRAM 🧚

When sending back an ACK, a NAK, or a response to the requesting entity, the remote route server hands the matching CMTP message and the requesting entity information to the path agent 🎀 Using that requesting entity information, the path agent retrieves the path to the requesting entity, wraps the CMTP message inside an IDPR data message, and forwards that data message along the designated path 🫶

When the path agent in the requesting entity gets the IDPR data message, it extracts the ACK, NAK, or response to its request, and runs the CMTP validation checks on that message 💅 For a response message, the requesting entity also checks whether the message is acceptable before it puts the contents into the appropriate database 🌈

5.3. Routing Information ✨

okay so policy gateways and route servers need routing info from route servers to keep their routing information databases up to date 💖 to get it, the requesting entity sends a ROUTING INFORMATION REQUEST message with the type of info it wants (CONFIGURATION messages, DYNAMIC messages, or both 🎀) plus the set of domains it's asking about.

when a route server gets one of these, it checks message acceptability first, bestie, always check first 🫶 if the message is acceptable, the route server works out how much of the request it can actually fulfill, then tells CMTP to generate an acknowledgement saying so. after that it fulfills as much as it can by rebuilding individual routing information messages from its database, one per requested message type and domain 🧚

ngl this part is so iconic: only a regenerated routing information message whose entire contents match the original may pass the CMTP integrity/authentication checks. every single bit has to line up 🔐💅

5.4. Routes 🌸

path agents ask route servers for routes when they need policy routes to set up a path. to get them, the path agent sends a ROUTE REQUEST message containing the destination domain and the applicable service requirements, the maximum number of routes requested, a directive for whether to generate the routes or retrieve them from the route database, and a directive for whether to refresh the routing information database with the most recent CONFIGURATION or DYNAMIC message from a given domain before generating the routes 🦋

to refresh its routing information database, a route server must obtain routing information from another route server. path agents usually send those refresh directives after a failed path setup. we talk about how these directives get applied in more detail in section 7.4 ✨

upon receiving a ROUTE REQUEST message, the route server checks message acceptability first (same energy as before, always 💅). if it's acceptable, the route server decides whether it can fulfill the request, then tells CMTP to generate an acknowledgement saying what it can do. it fulfills the request with policy routes, either pulled from its route database or generated from its routing information database if needed, and sends them back in a ROUTE RESPONSE message 🎀

5.5. Route Server Message Formats 💜

the route server query protocol number is equal to 2. we break down each type of RSQP message below 🧚

5.5.1. ROUTING INFORMATION REQUEST 🌈

the ROUTING INFORMATION REQUEST message type is equal to 0.

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |            QRY AD             |            QRY RS             |
   +-------------------------------+-------------------------------+
   |            NUM AD             |              AD               |
   +---------------+---------------+-------------------------------+
   |   RIM FLGS    |    UNUSED     |
   +---------------+---------------+

• QRY AD (16 bits): numeric identifier for the domain containing the queried route server.
• QRY RS (16 bits): numeric identifier for the queried route server.
• NUM AD (16 bits): number of domains about which routing information is requested. the value 0 means a request for routing information from all domains.
• AD (16 bits): numeric identifier for a domain. this field is absent when NUM AD equals 0.
• RIM FLGS (8 bits): a set of two flags in the right-most bits, read left to right. the first flag says whether the request is for a CONFIGURATION message (1 CONFIGURATION, 0 no CONFIGURATION). the second flag says whether the request is for a DYNAMIC message (1 DYNAMIC, 0 no DYNAMIC). at least one of the first and second flags must be set to 1.
• UNUSED (8 bits): not currently used; must be set equal to 0.

5.5.2. ROUTE REQUEST 💖

the ROUTE REQUEST message type is equal to 1.

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |            QRY AD             |            QRY RS             |
   +-------------------------------+-------------------------------+
   |            SRC AD             |            HST SET            |
   +---------------+---------------+-------------------------------+
   |      UCI      |    UNUSED     |            NUM RQS            |
   +---------------+---------------+-------------------------------+
   |            DST AD             |            PRX AD             |
   +---------------+---------------+-------------------------------+
   |    NUM RTS    |   GEN FLGS    |            RFS AD             |
   +---------------+---------------+-------------------------------+
   |            NUM AD             |
   +-------------------------------+
   For each domain to be favored, avoided, or excluded:
   +-------------------------------+---------------+---------------+
   |              AD               |    AD FLGS    |    UNUSED     |
   +-------------------------------+---------------+---------------+
   For each requested service:
   +-------------------------------+-------------------------------+
   |            RQS TYP            |            RQS LEN            |
   +-------------------------------+-------------------------------+
   |                            RQS SRV                            |
   +---------------------------------------------------------------+

• QRY AD (16 bits): numeric identifier for the domain containing the queried route server.
• QRY RS (16 bits): numeric identifier for the queried route server.
• SRC AD (16 bits): numeric identifier for the route's source domain.
• HST SET (16 bits): numeric identifier for the source's host set.
• UCI (8 bits): numeric identifier for the source user class. the value 0 means there is no particular source user class.
• UNUSED (8 bits): not currently used; must be set equal to 0.
• NUM RQS (16 bits): number of requested services. the value 0 means the source requests no special services.
• DST AD (16 bits): numeric identifier for the route's destination domain.
• PRX AD (16 bits): numeric identifier for the destination domain's proxy (see section 1.3.1). if the destination domain provides the path agent function for its hosts, then the destination and proxy domains are identical. a route server constructs routes between the source domain's proxy and the destination domain's proxy. the source domain's proxy is identical to the domain issuing the CMTP message containing the ROUTE REQUEST message, and so it is available in the CMTP header 🦋
• NUM RTS (8 bits): number of policy routes requested.
• GEN FLGS (8 bits): a set of three flags indicating how to obtain the requested routes, in the right-most bits, read left to right. the first flag says whether the route server should retrieve existing routes from its route database or generate new routes (1 retrieve, 0 generate). the second flag says whether the route server should refresh its routing information database before generating the requested routes (1 refresh, 0 no refresh). when it is set to 1, it makes the third flag and the RFS AD field significant. the third flag says whether the routing information database refresh should include CONFIGURATION messages or DYNAMIC messages (1 configuration, 0 dynamic).
• RFS AD (16 bits): numeric identifier for the domain for which routing information should be refreshed. this field is meaningful only if the second flag in the GEN FLGS field is set to 1.
• NUM AD (16 bits): number of transit domains that are to be favored, avoided, or excluded during route selection (see section 1.4.1).
• AD (16 bits): numeric identifier for a transit domain to be favored, avoided, or excluded.
• AD FLGS (8 bits): three flags indicating how to interpret the AD field, in the right-most bits, read left to right. the first flag says whether the domain should be favored (1 favored, 0 not favored). the second flag says whether the domain should be avoided (1 avoided, 0 not avoided). the third flag says whether the domain should be excluded (1 excluded, 0 not excluded). no more than one of the first, second, and third flags must set to 1.
• RQS TYP (16 bits): numeric identifier for a type of requested service. valid requested services include the following types:

1. Upper bound on delay, in milliseconds (16 bits). This attribute may be omitted.
2. Minimum delay route. This attribute may be omitted.
3. Upper bound on delay variation, in milliseconds (16 bits). This attribute may be omitted.
4. Minimum delay variation route. This attribute may be omitted.
5. Lower bound on bandwidth, in bits per second (48 bits). This attribute may be omitted.
6. Maximum bandwidth route. This attribute may be omitted.
7. Upper bound on monetary cost, in cents (32 bits). This attribute may be omitted.
8. Minimum monetary cost route. This attribute may be omitted.
9. Path lifetime in minutes (16 bits). This attribute may be omitted but must be present if types 7 or 8 are present. Route servers use path lifetime information together with domain charging method to compute expected session monetary cost over a given domain.
10. Path lifetime in messages (16 bits). This attribute may be omitted but must be present if types 7 or 8 are present.
11. Path lifetime in bytes (48 bits). This attribute may be omitted but must be present if types 7 or 8 are present.

• RQS LEN (16 bits): length of the requested service, in bytes, beginning with the next field.
• RQS SRV (variable): description of the requested service. 🫶

5.5.3. ROUTE RESPONSE

bestie, the ROUTE RESPONSE message type is equal to 2 💖 ✨

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |    NUM RTS    |
   +---------------+
   For each route provided:
   +---------------+---------------+
   |    NUM AD     |   RTE FLGS    |
   +---------------+---------------+
   For each domain in the route:
   +---------------+---------------+-------------------------------+
   |    AD LEN     |      VG       |            ADJ AD             |
   +---------------+---------------+-------------------------------+
   |            ADJ CMP            |            NUM TP             |
   +-------------------------------+-------------------------------+
   |              TP               |
   +-------------------------------+

so here's the breakdown 🎀

• NUM RTS (16 bits) is the number of policy routes being provided 🌸
• RTE FLGS (8 bits) is a set of two flags sitting in the right-most bits, and they tell you which directions the route can be used in. Check sections 6.2, 7, and 7.2 for the full tea on path directionality 👑. Reading left to right, the first flag says whether the route can be used from source to destination (1 means from source, 0 means not from source). The second flag says whether it can be used from destination to source (1 means from destination, 0 means not from destination). If NUM RTS is greater than 0, then at least one of the first and second flags has to be set to 1. no exceptions 🙈
• NUM AD (8 bits) is the number of domains in the policy route, and it doesn't count the first domain on the route 🧚
• AD LEN (8 bits) is the length of the info for one particular domain, in bytes, starting from the next field 🦋
• VG (8 bits) is the numeric ID for an exit virtual gateway 💅
• ADJ AD (16 bits) is the numeric ID for the adjacent domain that's hooked up to the virtual gateway 🫶
• ADJ CMP (16 bits) is the numeric ID for the adjacent domain component. Policy gateways use this one to pick a route across a virtual gateway that connects to a partitioned domain 🌈
• NUM TP (16 bits) is the number of transit policies that apply to the part of the route going through this domain component 🔥
• TP (16 bits) is the numeric ID for a transit policy ⭐

5.5.4. Negative Acknowledgements

ngl this part is so important 😭 when a policy gateway gets an RSQP message that's not acceptable but still passes the CMTP validation checks, it puts an appropriate negative acknowledgement into its CMTP ACK. That info goes in the INFORM field of the CMTP ACK (we covered that back in section 2.4), and the numeric ID for each type of RSQP negative acknowledgement lives in the left-most 8 bits of the INFORM field. These are the RSQP negative acknowledgement types:

1. Unrecognized RSQP message type. This carries the numeric ID for the unrecognized message type (8 bits) 💀
2. Out-of-date RSQP message 🙈
3. Unable to fill requests for routing information from the following domains. This one has the number of domains that can't be filled (16 bits), and a value of 0 means the route server can't fill any of the requests 😭. It also has the numeric ID for each domain whose request can't be filled (16 bits) 🍓
4. Unable to fill requests for routes to the following destination domain. This carries the numeric ID for the destination domain (16 bits) 🥀

6. Route Generation

okay so route generation is the most computationally complex part of IDPR 🧠🔥, because there are so many domains and so many different, wildly heterogeneous policies it has to handle. Route servers have to generate policy routes that satisfy what the source domains requested, and they also have to respect the services that the transit domains offer 💅

Let's get the vocab straight first. Here's how we distinguish requested qualities of service and route generation with respect to them:

• Requested service limits include upper bounds on route delay, route delay variation, and session monetary cost, plus lower bounds on available route bandwidth. Generating a route that has to satisfy more than one quality of service constraint (like route delay of no more than X seconds and available route bandwidth of no less than Y bits per second) is an NP-complete problem 💀
• Optimal requested services include minimum route delay, minimum route delay variation, minimum session monetary cost, and maximum available route bandwidth. In the worst case, generating a route that's optimal for a given requested service has a computational complexity of O((N + L) log N) for Dijkstra's shortest path first (SPF) search, and O(N + (L * L)) for breadth-first (BF) search. Here, N is the number of nodes and L is the number of links in the search graph 🌸. Multi-criteria optimization (like finding a route with minimal delay variation and minimal session monetary cost) can be defined in several ways. One approach is to give each link a single value equal to a weighted sum of the values of the individual offered qualities of service, and then generate a route that's optimal with respect to this new criterion. But picking the weights that give you the behaviour you want is itself an optimization procedure, so it's not trivial at all 🙃

To help contain the combinatorial explosion of processing and memory costs that come with route generation, here are the guidelines for generating suitable policy routes 🦋

• Each route server should only generate policy routes from the perspective of its own domain as the source. It doesn't need to generate policy routes for arbitrary source/destination domain pairs. This way, we can spread the computational burden across all the route servers 🫶
• Route servers should precompute routes for the requests they anticipate, and only generate routes on demand to satisfy unanticipated route requests. So a single route server can spread its computational burden over time ⭐
• Route servers should cache the results of route generation, so they minimize the computation needed to respond to future route requests 💜
• To handle requested service limits, a route server should always select the first route generated that satisfies all of the requested service limits 🎀
• To handle multi-criteria optimization in route selection, a route server should generate routes that are optimal with respect to the first optimal requested service listed in the ROUTE REQUEST message. The route server should resolve ties between otherwise equivalent routes by evaluating them against the other optimal requested services in the ROUTE REQUEST message, in the order they're listed. With respect to the route server's routing information database, the selected route is optimal according to the first optimal requested service listed in the ROUTE REQUEST message, but it's not necessarily optimal according to any other optimal requested service listed in that message 🌈
• To handle a mixture of requested service limits and optimal requested services, a route server should generate routes that satisfy all of the requested service limits. It should resolve ties between otherwise equivalent routes by evaluating them the way described in the multi-criteria optimization case above 👑
• All else being equal, a route server should always prefer minimum-hop routes, because they minimize the amount of network resources the routes consume 🍓
• A route server should generate at least one route to each component of a partitioned destination domain, because it may not know which domain component the destination host lives in. So a route server can maximize its chances of providing a feasible route to a destination within a partitioned domain 🧚

6.1 Searching

okay so not every domain has to run the exact same route generation procedure 💅 Each domain administrator is free to specify the IDPR route generation procedure for the route servers in their own domain, and it can be as simple or as complex as they want 🌸

We offer an IDPR route generation procedure as a model. With a slight modification, this procedure can be made to search in either BF or SPF order. You can use it to generate a single policy route from the source to a specified destination domain, or to generate a set of policy routes from the source domain to all destination domains. If the source or destination domain has a proxy, then the source or destination endpoint of the policy route is the proxy domain, not the actual source or destination domain 🦋

For high-bandwidth traffic flows, BF search is the recommended search technique, because it produces minimum-hop routes ✨. For low-bandwidth traffic flows, the route server may use either BF search or SPF search. The computational complexity of BF search is O(N + L), so it's the search procedure of choice, except when generating routes with optimal requested services 🔥. We recommend using SPF search only for optimal requested services, and never in response to a request for a maximum bandwidth route 💖

6.1.1. Implementation ✨

Data Structures 🗂️

okay so the routing information database is basically a graph of the whole internetwork 🕸️ The virtual gateways are the nodes and the intra-domain routes between virtual gateways are the links. During route generation, each route gets stored as a sequence of virtual gateways, domains, and relevant transit policies, plus a list of route characteristics. All of that lives in a temporary array that's indexed by destination domain 💅

Steps 🧠

• Run the Policy Consistency routine twice: first with the source domain as the given domain, then with the destination domain as the given domain. If any policy inconsistency precludes the requested traffic flow, go to Exit. 🚫
• For each domain, initialize a null route and set the route bandwidth to. Then set these route characteristics to infinity: route delay, route delay variation, session monetary cost, and route length in hops. ♾️
• For each operational virtual gateway in the source or source proxy domain, associate the initial route characteristics. 🌸
• Initialize a next-node data structure. It holds, for each route in progress, the virtual gateway at the current endpoint of the route, together with the associated route characteristics. This is the thing that decides the order routes get expanded in, so it's kind of a big deal 👑

The next-node data structure can be either of these:

• BF: a fifo queue. 🚶‍♀️
• SPF: a heap, ordered according to the first optimal requested service listed in the ROUTE REQUEST message. ⛰️

Remove Next Node 🗑️

These steps get performed for each virtual gateway in the next-node data structure:

• If there are no more virtual gateways in the next-node data structure, go to Exit. 🏁
• Extract a virtual gateway and its associated route characteristics from the next-node data structure, obtain the adjacent domain, and:
  • SPF: Remake the heap. 🔄
• If there is a specific destination domain, and if for the primary optimal service:
  • BF: Route length in hops.
  • SPF: First optimal requested service listed in the ROUTE REQUEST message.

...the extracted virtual gateway's associated route characteristic is no better than that of the destination domain, go to Remove Next Node. 🙅‍♀️

• Execute the Policy Consistency routine with the adjacent domain as the given domain. If any policy inconsistency precludes the requested traffic flow, go to Remove Next Node. 🚧
• Check that the source domain's transit policies don't preclude traffic generated by members of the source host set, with the specified user class and requested services, from flowing to the adjacent domain as destination. This check matters because the route server caches what it considers to be all feasible routes to intermediate destination domains, generated during the computation of the requested route. If there are no policy inconsistencies, associate the route and its characteristics with the adjacent domain as destination. 🧐
• If there is a specific destination domain, and if the adjacent domain is the destination or destination proxy domain, go to Remove Next Node. 🎯
• Record the set of all exit virtual gateways in the adjacent domain that the adjacent domain's transit policies permit for the requested traffic flow, and that are currently reachable from the entry virtual gateway. 📋

Next Node ➡️

These steps get performed for all exit virtual gateways in the set above:

• If there are no exit virtual gateways in the set, go to Remove Next Node. 🫥
• Compute the characteristics for the route to the exit virtual gateway, and check that all of the route characteristics are within the requested service limits. If any of them fall outside those limits, go to Next Node. 📏
• Compare these route characteristics with the ones already associated with the exit virtual gateway. There may be none, if this is the first time the exit virtual gateway has been visited in the search. The comparison goes by the primary optimal service. ⚖️
• Select the route with the optimal value of the primary optimal service. Ties get resolved by considering optimality according to any other optimal requested services, in the order they're listed in the ROUTE REQUEST message. Then associate the selected route and its characteristics with the exit virtual gateway. 🏆
• Add the virtual gateway to the next-node structure:
  • BF: Add to the end of the fifo queue.
  • SPF: Add to the heap.

and go to Next Node. 🔁

Exit 🚪

Return a response to the route request. It's either a set of candidate policy routes, or an indication that the route request can't be fulfilled. Pick your favourite outcome 🎀

Policy Consistency 🛡️

Check policy consistency for the given domain:

• Check that the given domain is not specified as an excluded domain in the route request. 🙅
• Check that the given domain's transit policies don't preclude traffic generated by members of the source host set, with the specified user class and requested services, from flowing to the destination domain. 🌊

During the computation of the requested routes, a route server also caches what it considers to be all feasible routes to intermediate destination domains. This boosts the chances of answering a future route request without generating a brand-new route 🧠💖 The route server does run some policy consistency checks on these routes as they get generated, to intermediate destinations. But these routes might not actually be feasible, because the transit domains on the route may not permit traffic between the source and the given intermediate destinations. So before handing such a route out in response to a route request, a route server must check that the transit policies of the constituent domains are consistent with the source and destination of the traffic flow. No skipping this step, bestie 🙈

---

6.2. Route Directionality 🧭

A path agent might want to set up a bidirectional path using a route supplied by a route server. (Refer to sections 7.2 and 7.4 for detailed discussions of path directionality.) BUT a route server can only guarantee that its routes are feasible when they're used in the direction from source to destination. Why? The route server lives in the source or source proxy domain, so it can't see the source policies of the destination domain, and it can't account for them. Not its fault, it just doesn't have the info 🥺 Still, the route server can give the path agent an indication of how it assesses feasibility in the direction from destination to source ✨

A necessary but insufficient condition for a route to be feasible in the direction from destination to source is this: the route must be consistent, in the direction from destination to source, with the transit policies of the domains that make up the route. The transit policy consistency checks a route server runs during route generation account for the direction from source to destination, but not for the direction from destination to source. So a route server only does the destination-to-source checks after it has generated a feasible route from source to destination. Then, in its ROUTE RESPONSE message to the path agent, it includes an indication of its assessment of route feasibility in each direction 💌

---

6.3. Route Database 🗄️

A policy route, as originally specified by a route server, is an ordered list of virtual gateways, domains, and transit policies, written like this:

VG 1 - AD 1 - TP 1 - ... - VG n - AD n - TP n.

Here VG i is the virtual gateway that serves as the exit from AD i-1 and the entry to AD i. TP i is the set of transit policies associated with AD i and relevant to the particular route. Every route is indexed by source and destination domain 🗂️ Route servers and path agents store policy routes in route databases that are maintained as caches. Those entries must be flushed periodically, so stale policy routes don't stick around forever 🧹

A route server's route database is the set of all routes it has generated on behalf of its domain as source or source proxy. Each route in the database has its route characteristics attached. A path agent's route database is the set of all routes it has requested and received from route servers, on behalf of the hosts it's configured to act for 🥰

When a path agent tries to find a feasible route for a traffic flow, it checks its own route database first, before querying a route server. If its route database has one or more routes between the given source and destination domains that accommodate the given host set and UCI, the path agent checks each of those routes against the set of excluded domains listed in the source policy. Then it either selects the first route it finds that doesn't include the excluded domains, or, if no such route exists in its route database, it requests a route from a route server 🔍

A path agent must query a route server for routes whenever it can't fulfill a route request from its own route database. Also, we recommend that a path agent automatically forward all route requests with non-null requested services to a route server. Why? Because the path agent keeps no route characteristics in its route database, so it can't tell whether an entry there satisfies the requested services 🙃 It just can't know, poor thing 💀

When a route server is answering a path agent's request for a policy route, it checks its route database first, unless the ROUTE REQUEST message contains an explicit directive to generate a new route. If its route database has one or more routes between the given source and destination domains that accommodate the given host set and UCI, the route server checks each of those routes against the set of excluded domains listed in the ROUTE REQUEST message. It then either selects all routes it encounters that don't include the excluded domains, or, if no such route exists in its route database, it tries to generate one. Once the route server has selected a set of routes, it checks each one against the services requested by the path agent and the services offered by the domains composing the route. To get the offered services information, the route server consults its routing information database. Finally, it either selects the first route it encounters that's consistent with both the requested and offered services, or, if no such route exists in its route database, it tries to generate one 🦋

6.3.1. Cache Maintenance 🧹

Every route stored in a route database has a max cache lifetime of rdb_rs minutes for a route server and rdb_ps minutes for a path agent. Route servers and path agents clear out cache space by flushing entries that have hit their max lifetimes 🗑️. Path agents also reclaim space for routes whose paths failed to get set up or got torn down (see section 7.4) 💀.

Nevertheless, the cache can still run out of room even with all that cleanup 😭. If a cache fills up, the route server or path agent logs the event for network management 📝. To make space in a full cache, it deletes the oldest entry from the cache 🫶.

7. Path Control Protocol and Data Message Forwarding Procedure 🦋

Two entities in different domains can only swap IDPR data messages if an IDPR path has already been set up between those two domains 🌸. Path setup needs teamwork from path agents and intermediate policy gateways 🤝. Path agents find policy routes, kick off the Path Control Protocol (PCP), and manage the existing paths between administrative domains ✨. Intermediate policy gateways check that a policy route fits their domains' transit policies, set up the forwarding information, and forward messages along the paths that already exist 🚦.

Every policy gateway and every route server has a path agent inside it 🧚. The path agent that starts path setup in the source or source proxy domain is the "originator" 💖. The path agent that handles the originator's path setup message in the destination or destination proxy domain is the "target" 💜. Every path has two possible directions of traffic flow: from originator to target, and from target to originator 🔁. Path control messages are free to travel in either direction, but data messages may be restricted to just one direction 🚧.

Once a policy route has a path set up, that path is physically a bunch of consecutive policy gateways, with policy gateways or route servers at the endpoints 🔗. Any two successive entities in that set belong to either the same domain or the same virtual gateway 🏠. At any time, a policy gateway or route server can take back the resources it dedicated to a path going through it, by tearing that path down 🧹. For example, a policy gateway might decide to tear down a path that hasn't been used for a while 😴.

PCP can build multiple paths between the source and destination domains, but it isn't responsible for managing those paths as a group or for getting rid of redundant ones 🤷‍♀️.

7.1. An Example of Path Setup 🎀

Let's walk through an example, because it's the best way to see how path setup works 👀. Say host Hx in domain AD X wants to talk to host Hy in domain AD Y, and both AD X and AD Y support IDPR 💅. Hx doesn't need to know its own domain's identity, or Hy's domain's identity, to send messages to Hy 🙌. Hx just forwards a message meant for Hy to one of the gateways on its local network, going only by its local forwarding information 📬. If the gateway it hands off to is a policy gateway, the path agent living there works out how to send the message outside the domain 🌍. Otherwise, that gateway passes the message to another gateway in AD X, using its own local forwarding information 🔀. Eventually the message reaches a policy gateway in AD X, since policy gateways are the only exit points to other domains, in domains that support IDPR 🚪.

The path agent in the receiving policy gateway reads the message header, including the source and destination addresses and any requested service information (for example, type of service) 🔍. From that, it figures out whether the message is intra-domain or inter-domain, and, if it's inter-domain, whether it needs an IDPR policy route 🧐. Specifically, the path agent tries to find a forwarding information database entry for the traffic flow, using what's in the message header 🕵️‍♀️. Later on, for IP messages, the relevant header information might also include special service-specific IP options, or even info from higher layer protocols 🔮.

Forwarding database entries exist for all of the following:

• All intra-domain traffic flows. Intra-domain forwarding information is put into the forwarding information database as soon as it's received 🏡.
• Inter-domain traffic flows that don't need IDPR policy routes. Non-IDPR forwarding information goes into the forwarding database as soon as it's received 🛤️.
• IDPR inter-domain traffic flows that already have a path set up. IDPR forwarding information only gets put into the forwarding database during path setup 🎟️.

The path agent uses the message header contents to guide its search for a forwarding information database entry for a given traffic flow 🧭. We recommend a radix search for finding that entry 🌳. When the search finishes, it either produces an entry, or, for a brand new IDPR traffic flow, a directive to generate one ✨. If the search ends on an existing forwarding information database entry, the path agent forwards the message according to that entry 🚀.

Now suppose the search says the traffic flow from Hx to Hy needs an IDPR policy route, and there's no forwarding information database entry for that flow yet 😳. In that case, the path agent first works out the source and destination domains tied to the message's source and destination addresses, before it tries to get a policy route 🗺️. The path agent relies on mapping servers to supply the domain information, but it caches every mapping server response locally so it doesn't have to ask again and again 💾. When it needs to resolve an address to a domain, the path agent always checks its local cache before contacting a mapping server 👑.

Once it has the domain info, the path agent tries to get a policy route to carry the traffic from Hx to Hy 🛣️. The path agent relies on route servers to supply policy routes, but it caches every route server response locally to cut down on future queries 🧠. When it's looking for a suitable policy route, the path agent usually checks its local cache before contacting a route server, as described earlier in section 6.3 📦.

If there's no suitable cache entry, the path agent queries the route server, giving it the source and destination domains along with the source policy information that came in the host message or was set through configuration 📨. When a route server gets a policy route query, it checks its route database 🔎. If it can't find a suitable route there, the route server tries to generate at least one route to AD Y that matches the services requested for Hx 🪄.

The route server always sends a response back to the path agent, whether or not it managed to find a suitable policy route 💌. A successful route query response is a set of candidate routes, and the path agent picks from that set 🎯. We expect a path agent to usually choose a single route from the candidate set 1️⃣. That said, IDPR doesn't stop a path agent from selecting multiple routes from the set 🙅‍♀️. A path agent might want multiple routes for things like fault tolerance or load balancing 🛡️, but IDPR doesn't currently spell out how the path agent should use multiple routes 🤔.

If the policy route is a brand new one from the route server, there's no existing path for it yet, so the path agent has to set one up 🏗️. But if the policy route is an existing one pulled from the path agent's cache, there might already be a path for it, set up for some other host traffic flow 🔄. IDPR lets multiple traffic flows share the same path, as long as everything sharing that path goes between the same endpoint domains and has the same service requirements 🤝. Still, IDPR doesn't stop a path agent from setting up separate paths along the same policy route, if it wants to keep host traffic flows distinct 💅.

The path agent gives the path an identifier 🏷️. That identifier goes into every message traveling down the path, and the policy gateways along the path use it to decide how to forward the message 📍. If the path already exists, the path agent uses the identifier it already has 🔁. For new paths, though, the path agent picks a path identifier that's different from every other path it manages 🆕. It also updates its forwarding information database so the path identifier is referenced, and it tweaks its search procedure so the right entry comes back for a given data message header 🎯.

For new paths, the path agent starts path setup by sending the policy route to policy gateways in intermediate domains 📤. That includes the requested services, the constituent domains, the relevant transit policies, and the connecting virtual gateways 🧾. Using this information, an intermediate policy gateway decides whether to accept or refuse the path, and which policy gateway to send the path setup information to next ⚖️. The path setup procedure lets policy gateways set up a path in both directions at the same time ↔️. After accepting a path, each intermediate policy gateway updates its forwarding information database with an entry that links the path identifier to the right previous and next hop policy gateways 🔗.

When a policy gateway in AD Y accepts a path, it lets the source path agent in AD X know 🎉. Normally, we expect the source path agent to wait until the path is successfully established before it uses that path to carry data traffic ⏳. However, PCP doesn't stop a path agent from forwarding messages along a path before path establishment is confirmed 🏃‍♀️. Paths stick around until they're torn down, either because of a failure, because they expired, or because resources got scarce and they were preempted in favor of other paths 🌪️.

Heads up: data between Hx and Hy might travel over two separate IDPR paths, one from AD X to AD Y and another from AD Y to AD X 👯‍♀️. That's because inside a domain, hosts don't know anything about path agents or IDPR paths, and path agents don't know about other path agents' existing IDPR paths 🙈. So in AD Y, the path agent that ends the path from AD X might not be the same path agent that gets traffic from Hy headed for Hx 😵‍💫. When that happens, receiving traffic from Hy forces the second path agent to set up its own independent path from AD Y to AD X 🛤️💖.

7.2. Path Identifiers ✨

okay bestie, every path gets its own path identifier 🦋, and it has to be unique across the whole internetwork 💅. Every IDPR data message riding along that path carries the path identifier so it can be forwarded 🎀. The path identifier is three things stuck together: the identifier of the originator's domain, the identifier of the originator's policy gateway or route server, and a 32-bit local path identifier that the originator picks 💖. The path identifier and the CMTP transaction identifier have analogous syntax and play analogous roles in their own protocols, so they're basically cousins 🧚.

When the originator makes a new path identifier, it always picks a local path identifier that's different from every other active path, and different from any path that was recently torn down by that same path agent 💀. This helps tell new paths apart from replays 🙈. So the originator has to keep a record of each extinct path for long enough that every policy gateway on the path has wiped any reference to it from its memory 🧹. The right-most 30 bits of the local identifier are the same for each path direction, since the originator assigns them 🌸. The left-most 2 bits are the ones that show the path direction ⭐.

At path setup time, the originator decides which path directions to enable, based on what it got back from the route server in the ROUTE RESPONSE message 👑. "Enable" means that each path agent and each intermediate policy gateway sets up an association between the path identifier and the previous and next policy gateways on the path, which it uses to forward data messages along that path 🫶. IDPR data messages can only travel in the enabled directions, but path control messages are always free to go either way 🦋. The originator may enable neither direction, if the whole data transaction fits inside the path setup message itself 🍓. In that case, the path agents and intermediate policy gateways don't set up forwarding associations. They still check that the policy information in the setup message matches their own transit policies before passing the setup message on to the next policy gateway 🔍.

The path direction bits mean different things depending on the message type 🌈. In an IDPR path setup message, the path direction tells everyone which directions to enable:

• 01: originator to target
• 10: target to originator
• 11: both directions
• 00: neither direction

Each policy gateway along the path reads the path direction in the setup message and sets up the forwarding information as directed. In an IDPR data message, the path direction shows the current direction of traffic flow, either 01 for originator to target or 10 for target to originator. So if an originator sets up a path that only enables the direction from target to originator, the target sends data messages with the path identifier the originator picked, plus the path direction set to 10 ✨.

Instead of path identifiers that are unique throughout an internetwork, we could have used path identifiers that are only unique between a pair of consecutive policy gateways and that change from one policy gateway pair to the next 💭. The upside of locally unique path identifiers is that they can be much shorter than globally unique ones, so they eat less transmission bandwidth 📉. The downside is that the path identifier in each IDPR data message has to be changed at each policy gateway. If the integrity/authentication information covers the path identifier, then that value has to be recomputed at each policy gateway too 😭. For security reasons, we chose to include the path identifier in the information covered by the integrity/authentication value, and we advocate public-key based signatures for authentication 🔐. So it's not possible for intermediate policy gateways to modify the path identifier and then recompute the correct integrity/authentication value. That's why we went with path identifiers that don't change from hop to hop and so must be globally unique 👑. To speed forwarding of IDPR data messages with long path identifiers, policy gateways should hash the path identifiers in order to index IDPR forwarding information 🚀.

---

7.3. Path Control Messages 🎀

Messages exchanged by the path control protocol are sorted into "requests": SETUP, TEARDOWN, and REPAIR, and "responses": ACCEPT, REFUSE, and ERROR 💅. These messages matter to intermediate policy gateways as well as to path agents, so everyone's watching 👀.

• SETUP: Establishes a path by linking together pairs of policy gateways. The SETUP message is generated by the originator and propagates to the target. After sending a SETUP message, the originator expects to receive an ACCEPT, REFUSE, or ERROR message. The SETUP message carries all the information needed to set up the path, including the path identifier, requested services, transit policy information for each domain traversed, and optionally, expedited data 🚀.
• ACCEPT: Signals successful path establishment ✅. The ACCEPT message is generated by the target, in response to a SETUP message, and propagates back to the originator. When the originator receives an ACCEPT message, that means it can now safely go ahead and send data along the path 🫶. The ACCEPT message contains the path identifier and an optional reason for conditional acceptance.
• REFUSE: Signals that the path couldn't be established, either because resources weren't available, or because the services requested by the source didn't match the services offered by a transit domain along the path 😤. The REFUSE message is generated by the target or by any intermediate policy gateway, in response to a SETUP message, and propagates back to the originator. Everyone who receives a REFUSE message gets their resources for that path back 🧹. The REFUSE message contains the path identifier and the reason for the refusal.
• TEARDOWN: Tears down a path, usually when a non-recoverable failure is detected 💀. The TEARDOWN message can be generated by any path agent or policy gateway on the path, and it usually propagates in both path directions. Everyone who receives a TEARDOWN message gets their resources for that path back 🧹. The TEARDOWN message contains the path identifier and the reason for the teardown.
• REPAIR: Establishes a repaired path by linking together pairs of policy gateways 🔧. The REPAIR message is generated by a policy gateway after it detects that the next policy gateway on one of its existing paths is unreachable. A policy gateway that generates a REPAIR message propagates it forward by at most one virtual gateway. After sending a REPAIR message, the policy gateway expects to receive an ACCEPT, REFUSE, TEARDOWN, or ERROR message. The REPAIR message carries the original SETUP message 🎁.
• ERROR: Sends information about a path error back to the originator, when a PCP message contains unrecognized information 🙈. The ERROR message can be generated by the target or by any intermediate policy gateway, and it propagates back to the originator. Most, but not all, ERROR messages come from errors found during path setup. The ERROR message includes the path identifier and an explanation of the error detected.

Policy gateways use CMTP for reliable transport of PCP messages, between path agents and policy gateways, and between consecutive policy gateways on a path 📬. PCP must tell CMTP the maximum number of transmissions per path control message, pcp_ret, and the interval between path control message retransmissions, pcp_int microseconds ⏱️. All path control messages, except ERROR messages, may be transmitted up to pcp_ret times. ERROR messages are never retransmitted 🚫. A path control message is "acceptable" if:

• It passes the CMTP validation checks.
• Its timestamp is less than pcp_old (300) seconds behind the recipient's internal clock time.
• It carries a recognized path identifier, as long as it isn't a SETUP message.

An intermediate policy gateway on a path forwards acceptable PCP messages. As we describe in section 7.4 below, SETUP messages have to pass additional tests at each intermediate policy gateway before they get forwarded 🔍. Also, receiving an acceptable ACCEPT, REFUSE, TEARDOWN, or ERROR message at either path agent or any intermediate policy gateway indirectly cancels any active local CMTP retransmissions of the original SETUP message 🛑. When a path agent or intermediate policy gateway receives an unacceptable path control message, it discards the message and logs the event for network management 📝. The path control message age limit reduces the likelihood of denial of service attacks based on message replay 🛡️😭.

7.4. Setting Up and Tearing Down a Path ✨

okay bestie, path setup kicks off when the originator whips up a SETUP message 💌 containing:

• The path identifier, including the path directions to enable.
• An indication of whether the message includes expedited data.
• The source user class identifier.
• The requested services (see section 5.5.2) and source-specific information (see section 7.6.1) for the path.
• For each domain on the path, the domain component, applicable transit policies, and entry and exit virtual gateways.

The only mandatory requested service is the maximum path lifetime, pth_lif, and the only mandatory source-specific information is the data message integrity/authentication type. If these aren't in the path setup message, each recipient policy gateway fills in defaults: (60) minutes for pth_lif, and no authentication for the integrity/authentication type. 🫶 Each path agent and intermediate policy gateway tears the path down once the path lifetime is exceeded. So no single source can hog policy gateway resources forever, or keep the still-working bits of a half-broken path alive. Main character energy, but make it fair 🦋

After generating the SETUP message and setting up the right local forwarding information, the originator picks the next policy gateway on the path and forwards the SETUP message to it. The next policy gateway selection procedure (described below) applies whenever either the originator or an intermediate policy gateway is doing the picking. We've chosen to explain it from the point of view of a selecting intermediate policy gateway. 🧚

The policy gateway picks the next policy gateway on a path in round-robin order, from its list of policy gateways in the present or next virtual gateway, as explained below. When choosing, it uses information in the SETUP message plus whatever VGP and the intra-domain routing procedure provide. 💅

If the selecting policy gateway is a domain entry point, the next policy gateway must be:

• A member of the next virtual gateway listed in the SETUP message.
• Reachable according to intra-domain routes that support the transit policies listed in the SETUP message.
• Able to reach, according to VGP, the next domain component listed in the SETUP message.

On top of that, the selecting policy gateway may use quality of service information from intra-domain routing to break ties between otherwise equivalent next policy gateways in the same domain. Specifically, it may pick the next policy gateway whose connecting intra-domain route is optimal for the requested services listed in the SETUP message. Iconic tiebreaker behavior 👑

If the selecting policy gateway is a domain exit point, the next policy gateway must be:

• A member of the current virtual gateway listed in the SETUP message (which is also the selecting policy gateway's virtual gateway).
• Reachable according to VGP.
• A member of the next domain component listed in the SETUP message.

Once the originator or an intermediate policy gateway has picked a next policy gateway, it forwards the SETUP message to that policy gateway. Each recipient (a policy gateway or the target) of an acceptable SETUP message runs several checks on the message contents to decide whether to establish or reject the path. We'll walk through these checks in detail below, from the point of view of a policy gateway receiving a SETUP message. 🎀

7.4.1. Validating Path Identifiers 🔍

The recipient of a SETUP message checks the path identifier first, to make sure it doesn't match one from an already existing or recently extinct path. To catch replays, malicious or otherwise, path agents and policy gateways keep a record of each path they establish for max{pth_lif, pcp_old} seconds. If the path identifier and timestamp in the SETUP message match a stored path identifier and timestamp, the policy gateway treats the message as a retransmission and doesn't forward it. If the path identifier in the SETUP message matches a stored one but the timestamps don't agree, the policy gateway abandons path setup, logs the event for network management, and returns an ERROR message to the originator via the previous policy gateway. Not it, bestie 🙈

7.4.2. Path Consistency with Configured Transit Policies 📜

As long as the path identifier in the SETUP message looks new, the policy gateway goes on to check whether the SETUP message contents are consistent with the transit policies configured for its domain. To evaluate path consistency, the policy gateway must find the source and destination domains, the source host set and user class identifier, and the domain-specific information for its own domain inside the SETUP message. If the policy gateway doesn't recognize the source user class (or one or more of the requested services), it logs the event for network management but keeps going with path setup. If the policy gateway can't locate its domain in the SETUP message, it abandons path setup, logs the event for network management, and returns an ERROR message to the originator via the previous policy gateway. The originator responds by tearing down the path and then removing the route from its cache. 😭

Once the policy gateway finds its domain-specific portion of the SETUP message, it may run into these problems with the contents:

• The domain-specific portion lists a transit policy that isn't configured for the domain.
• The domain-specific portion lists a virtual gateway that isn't configured for the domain.

In each case, the policy gateway abandons path setup, logs the event for network management, and returns an ERROR message to the originator via the previous policy gateway. These kinds of ERROR messages tell the originator that the route may have been generated from information in an out-of-date CONFIGURATION message.

The originator handles an ERROR message like this. First, it tears down the path and removes the route from its cache. Then it sends a ROUTE REQUEST message to a route server, asking it to refresh the routing information database with the most recent CONFIGURATION message from the domain that issued the ERROR message, before the originator generates a new route. 🔄

Once the policy gateway has confirmed its domain-specific information in the SETUP message is recognizable, it checks that the rest of the SETUP message is consistent with the transit policies configured for its domain. A policy gateway at the entry to a domain checks path consistency in the direction from originator to target, if the enabled path directions include originator to target. A policy gateway at the exit from a domain checks path consistency in the direction from target to originator, if the enabled path directions include target to originator. 🧭

While evaluating whether the path is consistent with the transit policies configured for the domain, the policy gateway may run into any of these problems with the SETUP message contents:

• A transit policy doesn't apply in the given direction between the virtual gateways listed in the SETUP message.
• A transit policy denies access to traffic from the given host set between the source and destination domains listed in the SETUP message.
• A transit policy denies access to traffic from the source user class listed in the SETUP message.
• A transit policy denies access to traffic at the current time.

In each case, the policy gateway abandons path setup, logs the event for network management, and returns a REFUSE message to the originator via the previous policy gateway. These kinds of REFUSE messages tell the originator that the route may have been generated from information in an out-of-date CONFIGURATION message. The REFUSE message also serves to tear down the path. 🚫

The originator handles a REFUSE message like this. First, it removes the route from its cache. Then it sends a ROUTE REQUEST message to a route server, asking it to refresh the routing information database with the most recent CONFIGURATION message from the domain that issued the REFUSE message, before the originator generates a new route. 💖

7.4.3. Path Consistency with Virtual Gateway Reachability 🌸

Once the SETUP message contents are consistent with the transit policies configured for its domain, the policy gateway checks whether the path is consistent with the reachability of the virtual gateway that contains the potential next hop. To work out virtual gateway reachability, the policy gateway uses information from VGP and from the intra-domain routing procedure. 🛰️

When checking whether the path is consistent with virtual gateway reachability, the policy gateway may run into any of these problems:

• The virtual gateway containing the potential next hop is down.
• The virtual gateway containing the potential next hop isn't reachable via any intra-domain routes that support the transit policies listed in the SETUP message.
• The next domain component listed in the SETUP message isn't reachable.

Each of these conclusions is reached from the view of a single policy gateway, so it may not match the actual reachability. In each case, the policy gateway that hits the problem returns a REFUSE message to the previous policy gateway, which then picks a different next policy gateway in round-robin order, as described previously. If the policy gateway gets the same response from every next policy gateway it selected, it abandons path setup, logs the event for network management, and returns the REFUSE message to the originator via the previous policy gateway. These kinds of REFUSE messages tell the originator that the route may have been generated from information in an out-of-date DYNAMIC message. The REFUSE message also serves to tear down the path. 🥀

The originator handles a REFUSE message like this. First, it removes the route from its cache. Then it sends a ROUTE REQUEST message to a route server, asking it to refresh the routing information database with the most recent DYNAMIC message from the domain that issued the REFUSE message, before the originator generates a new route. ✨

7.4.4. Obtaining Resources ✨

Okay so once the policy gateway confirms the SETUP message is totally consistent with the transit policies and virtual gateway reachability of its domain 💅, it goes and grabs resources for the new path. For this version of IDPR, path resources are just memory in the local forwarding information database 🧚. Later on, path resources may also include reserved link bandwidth 🌈.

If the policy gateway doesn't have enough resources to set up the new path, it runs a little algorithm to decide whether to send a REFUSE message for the new path or a TEARDOWN message for an existing path so the new one can take its spot 👑. There are two cases:

• Nobody has been idle for more than pcp_idle (300) seconds 😭. The policy gateway sends a REFUSE message back to the previous policy gateway. That previous gateway then tries to pick a different next policy gateway, like we talked about earlier, as long as the gateway that sent the REFUSE wasn't the target. If the REFUSE came from the target, or there's no other next policy gateway available, the policy gateway sends the REFUSE back to the originator via the previous policy gateway and logs the event for network management 📝. The REFUSE message is what tears the path down 💀.
• At least one path has been idle for more than pcp_idle seconds ✨. The policy gateway tears down an older path to make room for the newer one and logs the event for network management. Specifically, it tears down the least recently used path among the ones idle for longer than pcp_idle seconds, and if there's a tie, it picks the oldest one of those 🦋.

If the policy gateway has enough resources to set up the path, it tries to update its local forwarding information database with info about the path identifier, the previous and next policy gateways on the path, and the directions in which the path should be enabled for data traffic transport 🎀.

---

7.4.5 Target Response 🎯

When an acceptable SETUP message makes it to an entry policy gateway in the destination or destination proxy domain, that gateway runs all of the SETUP message checks from the sections above 🔍. The gateway's path agent becomes the target, provided no checks fail, unless the SETUP message names an explicit target. For example, remote route servers act as both originator and target during RSQP message exchanges (see section 5.2) 🤝. If the receiving policy gateway isn't the target, it tries to forward the SETUP message to the target along an intra-domain route. But if the target isn't reachable via intra-domain routing, the policy gateway gives up on path setup, logs the event for network management, and sends a REFUSE message back to the originator via the previous policy gateway. The REFUSE message tears down the path 😵.

Once the SETUP message reaches the target, the target checks whether it has enough path resources. If it does, it generates an ACCEPT message. Otherwise, it generates a REFUSE message 🫶.

The target may choose to use the reverse path to carry data traffic back to the source domain, if the enabled path directions include 10 or 11. But the target must first verify that the reverse path is consistent with its own domain's configured transit policies before it sends any data over that path 🙈.

---

7.4.6. Originator Response 💖

The originator expects to get an ACCEPT, REFUSE, or ERROR message back after a SETUP message, and here's how it reacts:

• Got an ACCEPT? Yay, the path is confirmed 🎉. To speed things up, the originator may start forwarding data messages along the path before the ACCEPT shows up, but with the understanding that there's no guarantee the path actually exists 🤞.
• Got a REFUSE or an ERROR? Then the path couldn't be set up successfully. So the originator tries to set up a different path to the same destination, as long as the number of selected different paths doesn't exceed setup_try (3) 🔁. If it's still unsuccessful after setup_try attempts, it abandons path setup and logs the event for network management 📋.
• No response to the SETUP message within setup_int microseconds after transmission? The originator tries path setup again using the same policy route and a new path identifier, as long as the number of path setup attempts on that same route doesn't exceed setup_ret (2) 🔄. If there's still no response after setup_ret attempts, it logs the event for network management and then proceeds as though it got a negative response, namely a REFUSE or an ERROR 😬. Specifically, it either tries a different path to the same destination or abandons path setup altogether, depending on the value of setup_try.

---

7.4.7. Path Life ⏳

Once set up, a path does not live forever 🦋. A path agent or policy gateway may tear down an existing path, provided any of the following conditions are true:

• The maximum path lifetime (in minutes, bytes, or messages) has been exceeded at the originator, the target, or an intermediate policy gateway. In each case, the IDPR entity detecting path expiration logs the event for network management and generates a TEARDOWN message as follows:
  • The originator path agent generates a TEARDOWN message for propagation toward the target.
  • The target path agent generates a TEARDOWN message for propagation toward the originator.
  • An intermediate policy gateway generates two TEARDOWN messages, one for propagation toward the originator and one for propagation toward the target.
• The previous or next policy gateway becomes unreachable, across a virtual gateway or across a domain according to a given transit policy, and the path is not reparable. In either case, the policy gateway detecting the reachability problem logs the event for network management and generates a TEARDOWN message as follows:
  • If the previous policy gateway is unreachable, an intermediate policy gateway generates a TEARDOWN message for propagation to the target.
  • If the next policy gateway is unreachable, an intermediate policy gateway generates a TEARDOWN message for propagation to the originator.
• All of the policy gateway's path resources are in use at the originator, the target, or an intermediate policy gateway, a new path requires resources, and the given existing path is expendable, according to the least recently used criterion discussed in section 7.4.4 above. In each case, the IDPR entity initiating path preemption logs the event for network management and generates a TEARDOWN message as follows:
  • The originator path agent generates a TEARDOWN message for propagation toward the originator.
  • The target path agent generates a TEARDOWN message for propagation toward the originator.
  • An intermediate policy gateway generates two TEARDOWN messages, one for propagation toward the originator and one for propagation toward the target.

Path teardown at a path agent or policy gateway, whether it's initiated by one of the above events, by receipt of a TEARDOWN message, or by receipt of a REFUSE message during path setup (as discussed in the previous sections), results in the path agent or policy gateway releasing all resources devoted to both directions of the path 🧹.

---

7.5. Path Failure and Recovery 🛠️

When a policy gateway fails, it may not be able to save information pertaining to its established paths 😵‍💫. So when the policy gateway returns to service, it may have no recollection of the paths set up through it, and it may no longer be able to forward data messages along those paths. We expect that when a policy gateway fails, it will usually be out of service for long enough that the up/down protocol and the intra-domain routing procedure can detect that the policy gateway is no longer reachable ⏰. In that case, adjacent or neighbor policy gateways that set up paths through the failed policy gateway, and that detected the failure, attempt local path repair (see section 7.5.2 below) 🔧. If that's unsuccessful, they issue TEARDOWN messages for all affected paths 🥀.

7.5.1. Handling Implicit Path Failures 💔

okay so policy gateways have to be able to handle the case where one fails and then comes back to service without the up/down protocol or the intra-domain routing procedure noticing 🙈. We don't expect this to happen often, but it can. If the policy gateway had forwarding info for a bunch of established paths before it failed, it might suddenly get a flood of IDPR data messages with unrecognized path identifiers. The policy gateway should alert the data sources that their paths through it are no longer viable 🚨.

Policy gateways that get IDPR data messages with unrecognized path identifiers take one of the following two actions, depending on their past failure record:

• The policy gateway has not failed in the past pg_up (24) hour period. In this case, there are at least four possible reasons for the unrecognized path identifier in the data message:
  • The data message path identifier has been corrupted in a way that is not detectable by the integrity/authentication value, if one is present.
  • The policy gateway has experienced a memory error.
  • The policy gateway failed sometime during the life of the path and source sent no data on the path for a period of pg_up hours following the failure. Although paths may persist for more than pg_up hours, we expect that they will also be used more frequently than once every pg_up hours.
  • The path was not successfully established, and the originator sent data messages down the path prior to receiving a response to its SETUP message.

In all cases, the policy gateway discards the data message and logs the event for network management.

• The policy gateway has failed at least once in the past pg_up (24) hour period. Thus, the policy gateway assumes that the unrecognized path identifier in the data message may be attributed to its failure. In response to the data message, the policy gateway generates an ERROR message containing the unrecognized path identifier. The policy gateway then sends the ERROR message back to the entity from which it received the data message, which should be equivalent to the previous policy gateway on the path. 🍓

When the previous policy gateway receives such an ERROR message, it decides whether the message is acceptable. If the policy gateway does not recognize the path identifier contained in the ERROR message, it does not find the ERROR message acceptable and subsequently discards the message. However, if the policy gateway does find the ERROR message acceptable, it then determines whether it has already received an ACCEPT message for the given path. If the policy gateway has not received an ACCEPT message for that path, it discards the ERROR message and takes no further action.

If the policy gateway has received an ACCEPT message for that path, it then attempts path repair, as described in section 7.5.2 below. Only if path repair is unsuccessful does the previous policy gateway generate a TEARDOWN message for the path and return it to the originator. The TEARDOWN message includes the domain and virtual gateway containing the policy gateway that failed, which aids the originator in selecting a new path that does not include the domain containing the failed policy gateway. This mechanism ensures that path agents quickly discover and recover from disrupted paths, while guarding against unwarranted path teardown 🦋.

---

7.5.2. Local Path Repair 🛠️

Failure of one of more entities on a given path may render the path unusable. If the failure is within a domain, IDPR relies on the intra-domain routing procedure to find an alternate route across the domain, which leaves the path unaffected. If the failure is in a virtual gateway, policy gateways must bear the responsibility of repairing the path. Policy gateways nearest to the failure are the first to recognize its existence and hence can react most quickly to repair the path ⚡.

Relinquishing control over path repair to policy gateways in other domains may be unacceptable to some domain administrators. The reason is that these policy gateways cannot guarantee construction of a path that satisfies the source policies of the source domain, as they have no knowledge of other domains' source policies 🙅‍♀️.

Nevertheless, limited local path repair is feasible, without distributing either source policy information throughout an internetwork or detailed path information among policy gateways in the same domain or in the same virtual gateway. We say that a path is "locally reparable" if there exists an alternate route between two policy gateways, separated by at most one virtual gateway, on the path. This definition covers path repair in the presence of failed routes between consecutive policy gateways as well as failed policy gateways themselves 💜.

An IDPR entity attempts local repair of an established path, in the direction from originator to target, immediately after detecting that the next policy gateway on the path is no longer reachable. To prevent multiple path repairs in response to the same failure, we have stipulated that path repair can only be initiated in the direction from originator to target. The IDPR entity initiating local path repair attempts to find an alternate path to the policy gateway immediately following the unreachable policy gateway on the path.

Local path repair minimizes the disruption of data traffic flow caused by certain types of failures along an established path. Specifically, local path repair can accommodate an individual failed policy gateway or failed direct connection between two adjacent policy gateways. However, it can only be attempted through virtual gateways containing multiple peer policy gateways. Local path repair is not designed to repair paths traversing failed virtual gateways or domain partitions. Whenever local path repair is impossible, the failing path must be torn down 💀.

7.5.3. Repairing a Path ✨

Okay so bestie, this is the repair glow-up 💅 When an IDPR entity finds out through an ERROR message that the next policy gateway has no clue about a given path, it whips up a REPAIR message and sends it to that next policy gateway. That REPAIR message is what re-establishes the path through the next policy gateway 🦋

Now when an entity notices the next policy gateway on a path is no longer reachable, it does one of two things, depending on whether it's a member of that gateway's virtual gateway. The drama splits here 🎀

• If the entity is not a member of the next policy gateway's virtual gateway, then one of these two conditions must be true:
  • The next policy gateway has a peer that is reachable via an intra-domain route consistent with the requested services. Here the entity generates a REPAIR message containing the original SETUP message and forwards it to that peer.
  • The next policy gateway has no peers reachable via intra-domain routes consistent with the requested services. Here the entity tears down the path back to the originator.
• If the entity is a member of the next policy gateway's virtual gateway, then one of these four conditions must be true:
  • The next policy gateway has a peer that belongs to the same domain component and is directly connected to and reachable from the entity. Here the entity generates a REPAIR message and forwards it to that peer.
  • The next policy gateway has a peer that belongs to the same domain component, is not directly connected to the entity, but is directly connected to and reachable from one of the entity's peers. That peer must in turn be reachable from the entity via an intra-domain route consistent with the requested services. Here the entity generates a REPAIR message and forwards it to its peer.
  • The next policy gateway has no operational peers within its domain component, but is directly connected to and reachable from one of the entity's peers. That peer must in turn be reachable from the entity via an intra-domain route consistent with the requested services. Here the entity generates a REPAIR message and forwards it to its peer.
  • The next policy gateway has no operational peers within its domain component, and the entity has no operational peers that are both reachable via intra-domain routes consistent with the requested services and directly connected to and reachable from the next policy gateway. Here the entity tears down the path back to the originator.

A recipient of a REPAIR message reacts based on how it's related to the entity that sent the REPAIR message 👀

• If the recipient and the issuing entity are in the same domain or the same virtual gateway, the recipient pulls out the SETUP message inside the REPAIR message and treats it like any other SETUP message. Specifically, it checks that the path is consistent with its domain's transit policies and virtual gateway reachability. If there are unrecognized portions of the SETUP message, the recipient generates an ERROR message. If there are path inconsistencies, it generates a REFUSE message. Either way, the recipient returns that message to the policy gateway it got the REPAIR message from. Otherwise, if the recipient accepts the REPAIR message, it updates its local forwarding information database accordingly and forwards the REPAIR message to a potential next policy gateway, based on the information in the enclosed SETUP message.
• If the recipient and the issuing entity are in different domains and different virtual gateways, the recipient extracts the SETUP message from the REPAIR message and checks whether the associated path matches any of its established paths. If the path doesn't match an established path, the recipient generates a REFUSE message and sends it back to the policy gateway it got the REPAIR message from. When a policy gateway receives a REFUSE message, it tries a different next policy gateway 🙃

A path is reparable if a path match is found. In that case, the recipient updates the path entry in its local forwarding information database and issues an ACCEPT message to the policy gateway it got the REPAIR message from. That policy gateway then passes the message back to the entity that issued the REPAIR message. A path is irreparable if every potential next policy gateway has been used up and no path match has turned up yet. In that case, the policy gateway that couldn't find a next policy gateway issues a TEARDOWN message to return to the originator 💀

An IDPR entity expects to get an ACCEPT, TEARDOWN, REFUSE, or ERROR message in response to a REPAIR message, and it reacts to each one differently:

• The entity always returns a TEARDOWN message to the originator via the previous policy gateway.
• The entity does not return an ACCEPT message to the originator. Still, getting one means the path has been repaired successfully ✨
• The entity decides the path is irreparable, then tears it down and logs the event for network management, if it receives a REFUSE or ERROR message, or if no response to the REPAIR message arrives within setup_int microseconds.

When an entity detects that the previous policy gateway on a path has become unreachable, it expects a REPAIR message within setup_wait microseconds. If no REPAIR message for that path arrives in that time, it decides the path is irreparable, tears it down, and logs the event for network management 🫶

---

7.6. Path Control Message Formats 💖

The path control protocol number is equal to 3. Below we go through the contents of each type of PCP message 🧚

7.6.1. SETUP 🌸

The SETUP message type is equal to 0. Here's the layout:

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                            PATH ID                            |
|                                                               |
+-------------------------------+-------------------------------+
|            SRC AD             |            HST SET            |
+---------------+---------------+-------------------------------+
|      UCI      |    UNUSED     |            NUM RQS            |
+---------------+---------------+-------------------------------+
|            DST AD             |            TGT ENT            |
+-------------------------------+-------------------------------+
|            AD PTR             |
+-------------------------------+
For each requested service for the path:
+-------------------------------+-------------------------------+
|            RQS TYP            |            RQS LEN            |
+-------------------------------+-------------------------------+
|                            RQS SRV                            |
+---------------------------------------------------------------+
For each domain contained in the path:
+---------------+---------------+-------------------------------+
|    AD LEN     |      VG       |            ADJ AD             |
+---------------+---------------+-------------------------------+
|            ADJ CMP            |            NUM TP             |
+-------------------------------+-------------------------------+
|              TP               |
+-------------------------------+

Now let's break down each field, bestie 🎀

• PATH ID (64 bits) is the path identifier. It's made up of the numeric identifier for the originator's domain (16 bits), the numeric identifier for the originator policy gateway or route server (16 bits), the path direction (2 bits), and the local path identifier (30 bits) 🦋
• SRC AD (16 bits) is the numeric identifier for the source domain. It may be different from the originator domain if the originator domain is a proxy for the source.
• HST SET (16 bits) is the numeric identifier for the source's host set.
• UCI (8 bits) is the numeric identifier for the source user class. A value of 0 means there's no particular source user class.
• UNUSED (8 bits) is not currently used, and it must be set equal to 0 🙈
• NUM RQS (16 bits) is the number of requested services.
• DST AD (16 bits) is the numeric identifier for the destination domain. It may be different from the target domain if the target domain is a proxy for the destination.
• TGT ENT (16 bits) is the numeric identifier for the target entity. A value of 0 means there's no specific target entity.
• AD PTR (16 bits) is a byte offset from the beginning of the message, pointing to where the domain-specific information begins. That offset lives in the right-most 15 bits. The left-most bit says whether the message includes expedited data: 1 means expedited data is included, 0 means it isn't 💜
• RQS TYP (16 bits) is the numeric identifier for a type of requested service or source-specific information. Valid requested services are described in section 5.5.2. Valid source-specific information includes these types:
  • 12: MD4/RSA data message authentication (see [16]).
  • 13: MD5/RSA data message authentication (see [17]).
  • 14: Billing address (variable).
  • 15: Charge number (variable).
• RQS LEN (16 bits) is the length of the requested service or source-specific information, in bytes, starting from the next field.
• RQS SRV (variable) is the description of the requested service or source-specific information.
• AD LEN (8 bits) is the length of the information associated with a particular domain on the route, in bytes, starting from the next field.
• VG (8 bits) is the numeric identifier for an exit virtual gateway.
• ADJ AD (16 bits) is the numeric identifier for an adjacent domain.
• ADJ CMP (16 bits) is the numeric identifier for a component of the adjacent domain. It helps a policy gateway route across a virtual gateway connected to a partitioned domain 🧩
• NUM TP (16 bits) is the number of transit policies that apply to the section of the path crossing the given domain component.
• TP (16 bits) is the numeric identifier for a transit policy.

7.6.2. ACCEPT 🦋

okay so ACCEPT is message type 1 ✨. it's the "yes, you can have this path" reply, with a little asterisk for conditional acceptance 💅

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                            PATH ID                            |
   |                                                               |
   +---------------+-----------------------------------------------+
   |    RSN TYP    |                    REASON                     |
   +---------------+-----------------------------------------------+

• PATH ID (64 bits): the path identifier from the original SETUP message 🌸
• RSN TYP (optional, 8 bits): a numeric ID for why the path was only conditionally accepted 🎀
• REASON (optional, variable): a description of that reason. Currently, no reasons have been defined. 🙈

---

7.6.3. REFUSE 💖

REFUSE is message type 2 💀 and it's the "nope, not today" message. the reasons are where it gets spicy, so pay attention bestie 👑

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                            PATH ID                            |
   |                                                               |
   +---------------+-----------------------------------------------+
   |    RSN TYP    |                    REASON                     |
   +---------------+-----------------------------------------------+

• PATH ID (64 bits): the path identifier from the original SETUP message 🌸
• RSN TYP (8 bits): a numeric ID for why the path got refused 🍓
• REASON (variable): a description of the refusal. Valid reasons include the following types: ✨

1. Transit policy does not apply between the virtual gateways in a given direction. Numeric identifier for the transit policy (16 bits).
2. Transit policy denies access to traffic from the host set between the source and destination domains. Numeric identifier for the transit policy (16 bits).
3. Transit policy denies access to traffic from the source user class. Numeric identifier for the transit policy (16 bits).
4. Transit policy denies access to traffic at the current time. Numeric identifier for the transit policy (16 bits).
5. Virtual gateway is down. Numeric identifier for the virtual gateway (8 bits) and associated adjacent domain (16 bits).
6. Virtual gateway is not reachable according to the given transit policy. Numeric identifier for the virtual gateway (8 bits), associated adjacent domain (16 bits), and transit policy (16 bits).
7. Domain component is not reachable. Numeric identifier for the domain (16 bits) and the component (16 bits).
8. Insufficient resources to establish the path. 😭
9. Target is not reachable via intra-domain routing. 🥺
10. No existing path with the given path identifier, in response to a REPAIR message only. 🔥

---

7.6.4. TEARDOWN 🧚

TEARDOWN is message type 3 🦋. this is the "ok we're done, peace out" message, and it has its own list of reasons 🫶

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                            PATH ID                            |
   |                                                               |
   +---------------+-----------------------------------------------+
   |    RSN TYP    |                    REASON                     |
   +---------------+-----------------------------------------------+

• PATH ID (64 bits): the path identifier from the original SETUP message 🌸
• RSN TYP (8 bits): a numeric ID for why the path is being torn down 💜
• REASON (variable): a description of the teardown. Valid reasons include the following types: ✨

1. Virtual gateway is down. Numeric identifier for the virtual gateway (8 bits) and associated adjacent domain (16 bits).
2. Virtual gateway is not reachable according to the given transit policy. Numeric identifier for the virtual gateway (8 bits), associated adjacent domain (16 bits), and transit policy (16 bits).
3. Domain component is not reachable. Numeric identifier for the domain (16 bits) and the component (16 bits).
4. Maximum path lifetime exceeded. ⏰
5. Preempted path. 👑
6. Unable to repair path. 💀

---

7.6.5. ERROR 🙈

ERROR is message type 4 🚨. it's the "something in your message was wrong, bestie" message, and it tells you exactly what went sideways 😭

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                            PATH ID                            |
   |                                                               |
   +---------------+---------------+-------------------------------+
   |      MSG      |    RSN TYP    |            REASON             |
   +---------------+---------------+-------------------------------+

• PATH ID (64 bits): the path identifier from the path control or data message in error 🌸
• MSG (8 bits): a numeric ID for the type of path control message in error. This field is ignored for error type 5. 🍑
• RSN TYP (8 bits): a numeric ID for the reason behind the PCP message error 🎀
• REASON (variable): a description of the PCP message error. Valid reasons include the following types: 🌿

1. Path identifier is already currently active. 🙃
2. Domain does not appear in the SETUP message. 🫠
3. Transit policy is not configured for the domain. Numeric identifier for the transit policy (16 bits).
4. Virtual gateway not configured for the domain. Numeric identifier for the virtual gateway (8 bits) and associated adjacent domain (16 bits).
5. Unrecognized path identifier in an IDPR data message. 🧐

---

7.6.6. REPAIR 🔧

REPAIR is message type 5 💅. it's the "hey, can we fix this path?" message, and it's super simple: a REPAIR message contains the original SETUP message only. 🌈

---

7.6.7. Negative Acknowledgements 💜

okay so here's the deal. when a policy gateway gets a PCP message that's unacceptable but still passes the CMTP validation checks, it sends back a CMTP ACK with an appropriate negative acknowledgement, no cap 🫶 that info goes in the INFORM field of the CMTP ACK (we covered that back in section 2.4 🦋). the numeric ID for each PCP negative acknowledgement lives in the left-most 8 bits of the INFORM field, so it's giving very organized ✨

The PCP negative acknowledgements are:

1. Unrecognized PCP message type. Numeric identifier for the unrecognized message type (8 bits). 🙈
2. Out-of-date PCP message. ⏳
3. Unrecognized path identifier (for all PCP messages except SETUP). Numeric identifier for the unrecognized path (64 bits). 🥀

---

8. Security Considerations 🔐

Okay, this one is SERIOUS bestie 😭🔐. Refer to sections 1.6, 1.7, and 2.3 for details on security in IDPR. Go read those, no skipping! 💀

---

9. Author's Address 🌸

Martha Steenstrup
BBN Systems and Technologies
10 Moulton Street
Cambridge, MA 02138

Phone: (617) 873-3192
Email: msteenst@bbn.com

---

References 📚

• [1] Clark, D., "Policy Routing in Internet Protocols", RFC 1102, May 1989.
• [2] Estrin, D., "Requirements for Policy Based Routing in the Research Internet", RFC 1125, November 1989.
• [3] Little, M., "Goals and Functional Requirements for Inter-Autonomous System Routing", RFC 1126, July 1989.
• [4] Breslau, L. and Estrin, D., "Design of Inter-Administrative Domain Routing Protocols", Proceedings of the ACM SIGCOMM '90 Symposium, September 1990.
• [5] Steenstrup, M., "An Architecture for Inter-Domain Policy Routing", RFC 1478, July 1993.
• [6] Austein, R., "DNS Support for IDPR", Work in Progress, March 1993.
• [7] Bowns, H. and Steenstrup, M., "Inter-Domain Policy Routing Configuration and Usage", Work in Progress, July 1991.
• [8] Woodburn, R., "Definitions of Managed Objects for Inter-Domain Policy Routing (Version 1)", Work in Progress, March 1993.
• [9] McQuillan, J., Richer, I., Rosen, E., and Bertsekas, D., "ARPANET Routing Algorithm Improvements: Second Semiannual Technical Report", BBN Report No. 3940, October 1978.
• [10] Moy, J., "The OSPF Specification", RFC 1131, October 1989.
• [11] Oran, D. (editor), "Intermediate System to Intermediate System Routeing Exchange Protocol for Use in Conjunction with the Protocol for Providing the Connectionless-mode Network Service (ISO 8473)", ISO/IEC JTC1/SC6/WG2, October 1989.
• [12] Estrin, D., and Tsudik, G., "Secure Control of Transit Internetwork Traffic, TR-89-15, Computer Science Department, University of Southern California.
• [13] Linn, J., "Privacy Enhancement for Internet Electronic Mail: Part I - Message Encipherment and Authentication Procedures", RFC 1113, August 1989.
• [14] Kent, S., and Linn, J., "Privacy Enhancement for Internet Electronic Mail: Part II - Certificate-based Key Management", RFC 1114, August 1989.
• [15] Linn, J., "Privacy Enhancement for Internet Electronic Mail: Part III - Algorithms, Modes, and Identifiers", RFC 1115, August 1989.
• [16] Rivest, R., "The MD4 Message-Digest Algorithm", RFC 1320, April 1992.
• [17] Rivest, R., "The MD5 Message-Digest Algorithm", RFC 1321, April 1992.