RFC 4012

Routing Policy Specification Language next generation (RPSLng)

๐Ÿ“… published March 2005, from ietf

Routing Policy Specification Language next generation (RPSLng) ๐Ÿ’–

okay bestie, let's get into this one ๐ŸŽ€ It's RFC 4012, a Standards Track doc from March 2005, from the Network Working Group. The authors are L. Blunk (Merit Network), J. Damas (Internet Systems Consortium), F. Parent (Hexago), and A. Robachevsky (RIPE NCC). It updates RFC 2725 and RFC 2622 ๐Ÿฆ‹ There's no Obsoletes line, so it doesn't replace anything.


Status of This Memo ๐ŸŒธ

ngl this section is the "what kind of doc is this" part. It says this is an Internet standards track protocol for the Internet community, and it asks for discussion and suggestions for improvements. If you want the current standardization state, check the "Internet Official Protocol Standards" (STD 1) list. And distribution is unlimited, so share it freely ๐Ÿ’…

Copyright (C) The Internet Society (2005).

Abstract ๐Ÿงš

So the big idea is this: it adds a set of simple extensions to the Routing Policy Specification Language (RPSL). These extensions let RPSL document routing policies for the IPv6 and multicast address families that are used on the Internet today. It's giving upgrade ๐Ÿ’œ

Table of Contents ๐Ÿ“

1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  2
2.  Specifying routing policy for different address families . . .  2
    2.1.  Ambiguity Resolution . . . . . . . . . . . . . . . . . .  3
    2.2.  The afi dictionary attribute . . . . . . . . . . . . . .  3
    2.3.  RPSL dictionary extensions . . . . . . . . . . . . . . .  4
    2.4.  IPv6 RPSL types  . . . . . . . . . . . . . . . . . . . .  4
    2.5.  mp-import, mp-export, and mp-default . . . . . . . . . .  4
          2.5.1.  <mp-peering> . . . . . . . . . . . . . . . . . .  6
          2.5.2.  <mp-filter>  . . . . . . . . . . . . . . . . . .  6
          2.5.3.  Policy examples  . . . . . . . . . . . . . . . .  7
3.  route6 Class . . . . . . . . . . . . . . . . . . . . . . . . .  7
4.  Updates to existing Classes to support the extensions  . . . .  8
    4.1.  as-set Class . . . . . . . . . . . . . . . . . . . . . .  8
    4.2.  route-set Class  . . . . . . . . . . . . . . . . . . . .  9
    4.3.  filter-set Class . . . . . . . . . . . . . . . . . . . .  9
    4.4.  peering-set Class  . . . . . . . . . . . . . . . . . . .  9
    4.5.  inet-rtr Class . . . . . . . . . . . . . . . . . . . . . 10
    4.6.  rtr-set Class  . . . . . . . . . . . . . . . . . . . . . 11
5.  RFC 2725 Extensions  . . . . . . . . . . . . . . . . . . . . . 11
    5.1.  Authorization model for route6 Objects . . . . . . . . . 13
6.  Security Considerations  . . . . . . . . . . . . . . . . . . . 13
7.  Acknowledgments  . . . . . . . . . . . . . . . . . . . . . . . 14
8.  References . . . . . . . . . . . . . . . . . . . . . . . . . . 14
    8.1.  Normative References . . . . . . . . . . . . . . . . . . 14
    8.2.  Informative References . . . . . . . . . . . . . . . . . 14
    Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . 15
    Full Copyright Statement . . . . . . . . . . . . . . . . . . . 16

1. Introduction ๐Ÿ’–

okay so RFC 2622 [1] is the one that defines RPSL for the IPv4 unicast routing protocols, and it also gives guidelines for extending RPSL itself. Then RFC 2725 [2] adds the security extensions. This doc builds on both of them ๐Ÿซถ

Here's what this doc is going for:

  • Give RPSL extensibility across address families, so people can document routing policy for IPv6 and multicast.
  • Keep extensions backward compatible with minimal impact on existing tools and processes. For extending RPSL, it follows Section 10 of RFC 2622 [1].
  • Stay clear and unambiguous, because humans read RPSL info too, not just software tools ๐Ÿ‘‘
  • Minimize duplication of information, especially when the routing policies for different address families are the same.

Adding IPv6 and multicast means there are four distinct routing policies that need to be told apart: (IPv4 {unicast|multicast}, IPv6 {unicast|multicast}). It's giving math, but it's clean ๐Ÿงš

2. Specifying Routing Policy for Different Address Families ๐ŸŒˆ

Right now, routing policy lives in the aut-num class, using the import:, export:, and default: attributes. Sometimes you need to tell apart policies for different address families, and also unicast from multicast. That's the whole reason for this section ๐Ÿ’…

The existing import, export, and default syntax could be extended, but that would cause backward compatibility issues and could make the expressions less clear. So the plan is this: import:, export:, and default: keep implicitly meaning IPv4 unicast policy, and they stay as previously defined in RPSL. New multi-protocol attributes, prefixed with the string mp-, get introduced instead. Those are described below โœจ

2.1. Ambiguity Resolution ๐Ÿ”ฅ

The same peering can be covered by more than one multi-protocol policy attribute. It can also be covered by a mix of multi-protocol policy attributes (when specifying IPv4 unicast policy) and the older IPv4 unicast policy attributes. When that happens, implementations SHOULD follow the specification-order rule defined in Section 6.4 of RFC 2622 [1]. To break the tie, the action from the first peering specification is the one that gets used ๐ŸŽ€

2.2. The afi Dictionary Attribute ๐Ÿฆ‹

This section introduces a new dictionary attribute. Address Family Identifier, <afi>, is an RPSL list of address families that a given routing policy expression gets evaluated for. <afi> is OPTIONAL within the new multi-protocol attributes in the aut-num class. There's also a pseudo identifier called any, which makes policy expressions more compact when the routing policy has converged ๐ŸŒธ

The possible values for <afi> are:

ipv4.unicast
ipv4.multicast
ipv4 (equivalent to ipv4.unicast, ipv4.multicast)
ipv6.unicast
ipv6.multicast
ipv6 (equivalent to ipv6.unicast, ipv6.multicast)
any (equivalent to ipv4, ipv6)
any.unicast (equivalent to ipv4.unicast, ipv6.unicast)
any.multicast (equivalent to ipv4.multicast, ipv6.multicast)

Any of these values, when it shows up in an attribute, MUST be preceded by the keyword afi ๐Ÿ™ˆ

An <afi-list> is a comma-separated list of one or more afi values. That's it, that's the whole vibe ๐Ÿ’œ

2.3. RPSL Dictionary Extensions โœจ

To support IPv6 addresses for the next-hop rp-attribute, a new predefined dictionary type called ipv6_address gets added to the RPSL dictionary. Its definition comes from Section 2.2 of RFC 3513 [3] ๐Ÿงš

The next-hop rp-attribute gets expanded in the dictionary like this:

rp-attribute: # next hop router in a static route
              next-hop
              operator=(union ipv4_address, ipv6_address, enum[self])

There's also a new value for the <protocol> dictionary specification: MPBGP ๐ŸŒˆ

MPBGP means BGP4 with multi-protocol extensions, which people often call BGP4+. Why not just call it BGP4+? Because the + character isn't allowed in RPSL protocol names. Not me having to explain that ๐Ÿ’€

2.4. IPv6 RPSL Types ๐Ÿ’–

This doc references three new IPv6 RPSL types: <ipv6-address>, <ipv6-address-prefix>, and <ipv6-address-prefix-range>. The first two are defined in Sections 2.2 and 2.3 of RFC 3513 [3]. The third one, <ipv6-address-prefix-range>, is the <ipv6-address-prefix> type with a range operator added. That range operator comes from Section 2 of RFC 2622 [1] ๐Ÿซถ

2.5. mp-import, mp-export, and mp-default ๐Ÿ“

Three new policy attributes get introduced in the aut-num Class:

mp-import:
mp-export:
mp-default:

These attributes bring in the afi (address-family) specification, and that specification is OPTIONAL. If there's no afi specification, the policy expression is presumed to apply to all protocol families. Those are ipv4.unicast, ipv4.multicast, ipv6.unicast, and ipv6.multicast. That's the same as writing afi any ๐Ÿ‘‘ The mp-import and mp-export attributes each have a basic policy specification and a more powerful structured policy specification.

The syntax for mp-default and for the basic policy specification of mp-import and mp-export looks like this:

Attribute  Value                                         Type
mp-import  [protocol <protocol-1>] [into <protocol-2>]   optional,
           [afi <afi-list>]                              multi-valued
           from <mp-peering-1> [action <action-1>; ... <action-N>;]
           . . .
           from <mp-peering-M> [action <action-1>; ... <action-N>;]
           accept <mp-filter> [;]

mp-export  [protocol <protocol-1>] [into <protocol-2>]   optional,
           [afi <afi-list>]                              multi-valued
           to <mp-peering-1> [action <action-1>; ... <action-N>;]
           . . .
           to <mp-peering-M> [action <action-1>; ... <action-N>;]
           announce <mp-filter> [;]

mp-default [afi <afi-list>] to <mp-peering>              optional,
           [action <action-1>; ... <action-N>;]          multi-valued
           [networks <mp-filter>]

Now the structured stuff ๐Ÿ”ฎ mp-import and mp-export can be structured. Same as RFC 2622 [1], structured policies are RECOMMENDED to advanced RPSL users only. The mp-import structured policy syntax is defined below. Watch out: the semicolon at the end of an <import-factor> is mandatory for structured policy expressions, but it's optional for non-structured ones. The mp-export structured syntax mirrors mp-import symmetrically. Structured syntax also allows exceptions and refinements through the except and refine keywords. Those exceptions and refinements can also carry an optional afi list, which restricts the policy expression to particular address families ๐ŸŒธ

One more thing: the definition allows subsequent or "cascading" refinements and exceptions. RFC 2622 [1] calls these "nested" expressions, which is incorrect. The syntax does not allow true nested expressions ๐Ÿ™ˆ

Here's the grammar:

<import-factor> ::=
     from <mp-peering-1> [action <action-1>; ... <action-M>;]
     . . .
     from <mp-peering-N> [action <action-1>; ... <action-K>;]
     accept <mp-filter>;

<import-term> :: = import-factor |
     {
     <import-factor-1>
     . . .
     <import-factor-N>
     }

<import-expression> ::= <import-term> |
     <import-term> EXCEPT <afi-import-expression> |
     <import-term> REFINE <afi-import-expression>

<afi-import-expression> ::= [afi <afi-list>] <import-expression>

mp-import: [protocol <protocol-1>] [into <protocol-2>]
     <afi-import-expression>

That's the first chunk, bestie! ๐ŸŒˆ๐Ÿ’– The rest of this doc keeps going from here.

2.5.1. <mp-peering> ๐ŸŒธ

okay so <mp-peering> is basically how you say WHO you're peering with: the AS, and the router too if you want to be extra specific ๐Ÿ’…

<mp-peering> ::= <as-expression> [<mp-router-expression-1>]
                 [at <mp-router-expression-2>] | <peering-set-name>

<as-expression> is an expression over AS numbers and AS sets, using the operators AND, OR, and EXCEPT. <mp-router-expression> is an expression over router ipv4-addresses or ipv6-addresses, inet-rtr names, and rtr-set names, also using AND, OR, and EXCEPT. โœจ

EXCEPT is the set subtraction operator. It has the same precedence as AND, and it's semantically the same as an "AND NOT" combo. ๐Ÿงš So (AS65001 OR AS65002) EXCEPT AS65002 equals AS65001. Cute, right? ๐ŸŽ€

2.5.2. <mp-filter> ๐Ÿฆ‹

<mp-filter> is built from the RPSL <filter> policy filter expression defined in section 5.4 of RFC 2622 [1]. bestie, the big upgrade here is that it lets you write IPv6 prefixes and prefix ranges too ๐Ÿ˜ญ

An Address-Prefix Set inside an <mp-filter> can hold IPv4 AND IPv6 prefixes or prefix ranges, all mixed together. Otherwise <mp-filter> is basically the same as the RPSL <filter> expression. Address-Prefix Sets get wrapped in braces, '{' and '}'. The policy filter matches the set of routes whose destination address-prefix is in the set. Examples:

{ 192.0.2.0/24, 2001:0DB8::/32 }
{ 2001:0DB8:0100::/48^+, 2001:0DB8:0200::/48^64 }

2.5.3. Policy Examples ๐Ÿ’–

The address family can be specified in later refine or except policy expressions, and it only counts inside the policy expression that contains it. Main character energy for the address family, no cap ๐Ÿ‘‘

So in this example:

aut-num:    AS65534
mp-import: afi any.unicast from AS65001 accept as-foo;
             except afi any.unicast {
               from AS65002 accept AS65226;
             } except afi ipv6.unicast {
                 from AS65003 accept {2001:0DB8::/32};
               }

the last "except" only gets evaluated for the IPv6 unicast address family. Everything else in the import expressions gets evaluated for both the IPv6 and IPv4 unicast address families. โœจ

Evaluating a policy expression means evaluating each of its components one by one. Peering-sets and filter-sets are constrained by the address family. Those constraints can end up as a "NOT ANY" <mp-filter> or an invalid <mp-peering>, depending on how the address family is defined (implicitly or explicitly) in the set. Clashes between explicit and implicit declarations get sorted out at runtime while the policy expression is being evaluated. ๐Ÿ™ˆ An RPSL evaluation implementation may wish to issue a warning when it hits a "NOT ANY" <mp-filter>. Here's an mp-import policy with an <mp-filter> that should be evaluated as "NOT ANY":

aut-num: AS65002
mp-import: afi ipv6.unicast from AS65001 accept {192.0.2.0/24}

3. route6 Class ๐Ÿฆ‹

The route6 class is the IPv6 version of the route class. Same as with route, the class key for route6 is the route6 and origin attribute pair. Apart from the route6 attribute, route6 uses the same attribute names as route. The attribute names stay identical, but inject, components, exports-comps, holes, and mnt-routes have to specify IPv6 prefixes and addresses instead of IPv4 ones. That's what <ipv6-router-expression>, <ipv6-filter>, and <ipv6-address-prefix> are for. <ipv6-address-prefix> was already defined earlier. <ipv6-filter> is related to <mp-filter> (see Section 2.5.2), except only <ipv6-address-prefix> types are allowed. Similarly, <ipv6-router-expression> is related to <mp-router-expression> (see Section 2.5.1), except only <ipv6-address> types are allowed. ๐ŸŒˆ

Attribute     Value                             Type
route6        <ipv6-address-prefix>             mandatory, class key,
                                                single-valued
origin        <as-number>                       mandatory, class key,
                                                single-valued
member-of     list of <route-set-name>          optional, multi-valued
inject        [at <ipv6-router-expression>] ... optional, multi-valued
              [action <action>]
              [upon <condition>]
components    [ATOMIC] [[<ipv6-filter>]         optional, single-valued
              [protocol <protocol> <ipv6-filter> ...]]
aggr-bndry    <as-expression>                   optional, single-valued
aggr-mtd      inbound or outbound               optional, single-valued
              [<as-expression>]
export-comps  <ipv6-filter>                     optional, single-valued
holes         list of <ipv6-address-prefix>     optional, multi-valued
mnt-lower     list of <mntner-name>             optional, multi-valued
mnt-routes    list of <mntner-name>             optional, multi-valued
              [{list of <ipv6-address-prefix-range>} or ANY]

Example:

route6:   2001:0DB8::/32
origin:   AS65001

4. Updates to Existing Classes to Support the Extensions ๐ŸŒŸ

4.1. as-set Class ๐Ÿง

The as-set class defines a set of Autonomous Systems (AS). You can specify them directly by listing them in the members attribute, or indirectly by referring to another as-set or using the mbrs-by-ref facility. Here's the big part: "In a context that expects a route set (e.g., members attribute of the route-set class), [...] an as-set AS-X defines the set of routes that are originated by the ASes in AS-X", (section 5.3 of RFC 2622 [1]). ๐Ÿ˜ญ

So the as-set class is used to collect a set of route prefixes, which can be limited to one specific address family. ๐ŸŒธ

The existing as-set class doesn't need any changes. To get the prefixes that belong to a particular address family, evaluating the class has to be filtered with the traditional filtering mechanism that Internet Routing Registry (IRR) systems use today. ๐Ÿ’…

4.2. route-set Class ๐ŸŽ€

This class is used to specify a set of route prefixes. โœจ

There's a new attribute, "mp-members:", for this class. It lets you specify IPv4 or IPv6 address-prefix-ranges. ๐Ÿฆ‹

Attribute   Value                                 Type
mp-members  list of (<ipv4-address-prefix-range>  optional, multi-valued
            or <ipv6-address-prefix-range>
            or <route-set-name>
            or <route-set-name><range-operator>)

Example:

route-set:  rs-foo
mp-members: rs-bar
mp-members: 2001:0DB8::/32  # v6 member
mp-members: 192.0.2.0/24   # v4 member

4.3. filter-set Class ๐Ÿงš

The new "mp-filter:" attribute holds the set's policy filter. A policy filter is a logical expression that, when applied to a set of routes, returns a subset of those routes. Here's the updated filter-set class:

Attribute   Value                Type
filter-set  <object-name>        mandatory, single-valued, class key
filter      <filter>             optional, single-valued
mp-filter   <mp-filter>          optional, single-valued

<mp-filter> is defined above in Section 2.5.2. The "filter:" and "mp-filter:" attributes are both type "optional", but a filter-set still has to include one of the two. Implementations should reject any object that defines both attributes, since the interpretation of such a filter-set is undefined. โš ๏ธ

heads up: if an object has both "filter:" and "mp-filter:", implementations should reject it. The meaning of that filter-set is undefined, so don't go there ๐Ÿ™ˆ

4.4. peering-set Class ๐Ÿ“

The peering-set class gets a new "mp-peering:" attribute. ๐ŸŒˆ

Attribute    Value               Type
peering-set  <object-name>       mandatory, single-valued, class key
peering      <peering>           optional, multi-valued
mp-peering   <mp-peering>        optional, multi-valued

Example:

peering-set:   prng-ebgp-peers
mp-peering:    AS65002 2001:0DB8::1 at 2001:0DB8::2

<mp-peering> is defined above in Section 2.5.1. Both "peering:" and "mp-peering:" are type "optional", but a peering-set has to contain at least one of them. ๐Ÿ’œ

4.5. inet-rtr Class ๐ŸŒธ

Two new attributes join the inet-rtr class. "interface:" lets you define generic interfaces. It covers the info that used to live in "ifaddr:", and it adds support for tunnel definitions. "mp-peer:" builds on the existing "peer:" attribute. ๐Ÿซถ

Here's the syntax for "interface:":

Attribute  Value                               Type
interface  <ipv4-address> or <ipv6-address>    optional, multi-valued
           masklen <mask>
           [action <action>]
           [tunnel <remote-endpoint-address>,<encapsulation>]

The syntax handles native IPv4 and IPv6 interfaces, as well as tunnels as virtual interfaces. Without the optional tunnel part, this attribute does the same thing as "ifaddr:", but now with IPv6 addresses too. โœจ

If the interface is a tunnel, here's how it works. <remote-endpoint-address> is the IPv4 or IPv6 address of the tunnel's remote endpoint. Its address family has to match the local endpoint's. <encapsulation> is the encapsulation used in the tunnel, and it's one of {GRE,IPinIP}. The outer and inner IP protocol versions can be figured out from the interface context. For example, IPv6-in-IPv4 encapsulation is just IPinIP. ๐Ÿง  Routing policies for these routers should be described in the appropriate classes (e.g., aut-num).

The "mp-peer:" attribute is next. The only difference from "peer:" is that it supports IPv6 addresses. ๐Ÿฆ‹

Attribute  Value                                     Type
mp-peer    <protocol> <ipv4-address> <options>  or   optional,
           <protocol> <ipv6-address> <options>  or   multi-valued
           <protocol> <inet-rtr-name> <options> or
           <protocol> <rtr-set-name> <options>  or
           <protocol> <peering-set-name> <options>

Here <protocol> is a protocol name, and <options> is a comma-separated list of peering options for that protocol, as listed in the RPSL dictionary. ๐Ÿ’…

4.6. rtr-set Class ๐ŸŒŸ

The rtr-set class gets a new attribute, "mp-members:". It extends the original "members:" attribute so you can specify IPv6 addresses too. ๐ŸŽ€

Attribute   Value                             Type
mp-members  list of (<inet-rtr-name> or       optional, multi-valued
            <rtr-set-name> or
            <ipv4-address> or
            <ipv6-address>)

5. RFC 2725 Extensions ๐ŸŽ€

okay so RFC 2725 [2] brings in an authorization model to keep the policy in routing registries legit ๐Ÿ”. It adds two new attributes to do that job, "mnt-routes" and "mnt-lower" ๐Ÿ’….

In RPSLng, those two attributes get extended to the route6 and inet6num classes (more on those below) ๐Ÿฆ‹. The existing mnt-routes syntax also gets a glow-up โœจ. It can now take an optional list of IPv6 prefix ranges when it shows up in inet6num, route6, and aut-num class objects. That list is comma-separated and wrapped in curly braces. In the aut-num class, IPv6 prefix ranges can be mixed in with IPv4 ones ๐ŸŒˆ. You can also use the keyword "ANY" instead of prefix ranges. For inet6num and route6 objects, "ANY" covers all the more specifics of the prefix in the class key field. For aut-num, "ANY" literally means any prefix ๐Ÿ’€. If you don't add any set items, the default is "ANY" ๐Ÿ’–.

Here's a shortened look at the aut-num class with the updated mnt-routes syntax:

Attribute     Value                             Type
aut-num       <as-number>                       mandatory, class key,
                                                single-valued
mnt-routes    list of <mntner-name>             optional, multi-valued
              [{list of (<ipv6-address-prefix-range> or
                         <ipv4-address-prefix-range>)} or ANY]

Here's an example of mnt-routes in action. In this one, MAINT-65001 gets the green light to create route6 objects with an origin AS of 65002 for IPv6 prefixes inside the 2001:0DB8::/32^+ range, plus route objects with origin AS 65002 for IPv4 prefixes inside the 192.0.2.0/24^+ range ๐Ÿซถ.

aut-num: AS65002
mnt-routes: MAINT-AS65001 {2001:0DB8::/32^+, 192.0.2.0/24^+}

Heads up, though โš ๏ธ. Putting IPv6 prefix ranges inside an mnt-routes attribute in an aut-num object might clash with existing RPSL implementations that only support IPv4 prefix ranges. Still, since this optional prefix range list hasn't really been implemented much, it was considered more acceptable to extend the existing mnt-routes definition in the aut-num class than to make a whole new attribute type ๐Ÿ™ˆ.

Now for the inet6num class. Its attributes look like this:

Attribute     Value                    Type
inet6num      <ipv6-address-prefix>    mandatory, single-valued,
                                       class key
netname       <netname>                mandatory, single-valued
descr         <free-form>              mandatory, multi-valued
country       <country-code>           mandatory, multi-valued
admin-c       <nic-handle>             mandatory, multi-valued
tech-c        <nic-handle>             mandatory, multi-valued
remarks       <free-form>              optional, multi-valued
notify        <email-address>          optional, multi-valued
mnt-lower     list of <mntner-name>    optional, multi-valued
mnt-routes    list of <mntner-name>    optional, multi-valued
              [{list of <ipv6-address-prefix-range>} or ANY]
mnt-by        list of <mntner-name>    mandatory, multi-valued
changed       <email-address> <date>   mandatory, multi-valued
source        <registry-name>          mandatory, single-valued

A couple of quick notes on those fields ๐Ÿ“. The <country-code> must be a valid two-letter ISO 3166 country code identifier ๐ŸŒ. <netname> is a symbolic name for the IPv6 address space you've specified, and it doesn't have a restriction on RPSL reserved prefixes ๐Ÿงš. These definitions come from the RIPE Database Reference Manual [4] โœจ.

5.1. Authorization Model for route6 Objects ๐Ÿ”

deleting or updating a route6 object works the same as any other object, as laid out in RFC 2725 [2] ๐Ÿ’…. The creation rules for a route6 object are copied over from the matching route object rules in RFC 2725 [2] section 9.9, so nothing new to memorize, bestie ๐Ÿฆ‹.

When you add a route6 object, the submission has to pass two authentication checks. It must match the authentication in the aut-num object, and it must also match the authentication in either a route6 object or, if no applicable route6 object shows up, an inet6num object ๐Ÿ‘‘.

An addition is submitted using an AS number and an IPv6 prefix as its key. If the aut-num object doesn't exist for the route6 you're trying to add, the addition gets rejected ๐Ÿ’€. If the aut-num does exist, the submission is checked against the applicable maintainers. Next, a search runs for the prefix. It looks for an exact match first and, if that fails, for the longest prefix match that's less specific than the prefix you specified ๐Ÿ”. If that search works, it returns one or more route6 objects. Your submission has to match an applicable maintainer in at least one of those route6 objects for the addition to go through. If the route6 search fails, a search runs for an inet6num object that exactly matches the prefix, or for the most specific inet6num that's less specific than the route6 object submission ๐ŸŒธ.

Once you've got the aut-num and either a list of route6 objects or an inet6num, the authorization comes from those objects. The applicable maintainer object is whatever gets referenced by the mnt-routes attributes. If one or more mnt-routes attributes are present in an object, the mnt-by or mnt-lower attributes are not considered ๐Ÿ™…โ€โ™€๏ธ. If an object has no mnt-routes attribute, the first mnt-lower attributes are used, but only if the object is an inet6num object and it's less specific than the route6 object being added โœจ. If no applicable mnt-lower attribute is found, the mnt-by attributes are used for that object instead ๐Ÿง. The authentication must match one of the authorizations in each of the two objects ๐Ÿ’œ.

6. Security Considerations ๐Ÿ’€

This document describes extensions to RFC 2622 [1] and RFC 2725 [2] ๐Ÿ“œ. The extensions are there to fix the limitations those two documents have when it comes to IPv6 and multicast ๐ŸŒ. The extensions don't bring in any new security functionality or threats, so no new drama here... yet ๐Ÿ˜ญ.

Okay, but the original RFC 2622 [1] RPSL standard had some seriously sus authentication mechanisms, and they're worth knowing about ๐Ÿšจ.

Even though these extensions add no new threats, it should be noted that RFC 2622 [1] shipped with a few weak and/or vulnerable authentication mechanisms. First up is the "MAIL-FROM" scheme, which can be easily defeated via source email address spoofing ๐Ÿ“ง. Second is the "CRYPT-PW" scheme, which is open to dictionary attacks and password sniffing if RPSL objects get submitted over unencrypted channels, like email ๐Ÿซฃ. And last but definitely not least is the "NONE" mechanism, which offers no protection for objects at all ๐Ÿ’€๐Ÿ’€.

7. Acknowledgements ๐Ÿซถ

The authors want to thank everyone who helped shape this document through tons of discussions ๐ŸŒท. Special shout-out to Ekaterina Petrusha for super valuable discussions and suggestions ๐Ÿ‘‘. Thanks also to Shane Kerr, Engin Gunduz, Marc Blanchet, and David Kessens, who joined in constructively during many discussions, and to Cengiz Alaettinoglu, who is still the reference for all things RPSL ๐Ÿงšโ€โ™€๏ธ๐Ÿ’–.

8. References ๐Ÿ“š

8.1. Normative References ๐Ÿ”ฅ

  • [1] Alaettinoglu, C., Villamizar, C., Gerich, E., Kessens, D., Meyer, D., Bates, T., Karrenberg, D., and M. Terpstra, "Routing Policy Specification Language (RPSL)", RFC 2622, June 1999.
  • [2] Villamizar, C., Alaettinoglu, C., Meyer, D., and S. Murphy, "Routing Policy System Security", RFC 2725, December 1999.
  • [3] Hinden, R. and S. Deering, "Internet Protocol Version 6 (IPv6) Addressing Architecture", RFC 3513, April 2003.

8.2. Informative References ๐ŸŒˆ

  • [4] Damas, J. and A. Robachevsky, "RIPE Database Reference Manual", August 2002.

Authors' Addresses ๐Ÿงš

Larry Blunk Merit Network EMail: ljb@merit.edu

Joao Damas Internet Systems Consortium EMail: Joao_Damas@isc.org

Florent Parent Hexago EMail: Florent.Parent@hexago.com

Andrei Robachevsky RIPE NCC EMail: andrei@ripe.net

Copyright (C) The Internet Society (2005).

This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.

This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property ๐Ÿ’œ

The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document, or the extent to which any license under such rights might or might not be available. It also doesn't claim to have made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79 ๐Ÿ“–.

Copies of IPR disclosures made to the IETF Secretariat, and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification, can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr ๐Ÿ”—.

The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org ๐Ÿ’Œ.

Acknowledgement ๐ŸŒธ

Funding for the RFC Editor function is currently provided by the Internet Society ๐Ÿ’–.

๐Ÿ“ฆ where this page comes from