RFC 9234

1. Introduction ✨

okay so bestie, RFC 9234 is literally about stopping route leaks 🙈 "Route leaks" are when BGP prefixes get passed along even though they break the assumed topology rules between networks. Like announcing a route you learned from one transit provider to another transit provider, or to a lateral (non-transit) peer. Or taking a route from one lateral peer and sending it to another lateral peer or a transit provider. 💀 These usually happen because of misconfigured or missing BGP route filtering, or because autonomous systems (ASes) just aren't coordinating with each other. [RFC7908] has the full scoop on that one 🧚

Right now the usual fix is operator-driven: you mark routes using configuration, and nobody checks that the config actually matches what the eBGP neighbor thinks the relationship is. Or the two eBGP speakers just... don't agree on the relationship at all. 😭 This document upgrades the BGP OPEN message so both sides literally agree on the peering relationship for each eBGP session between ASes. Then both sides are forced into the right config ✨ and propagated routes get marked according to that agreed relationship. Which means you can prevent leaks AND detect them. Main character energy 👑

This doc is basically swapping the old config-based method for an in-band one, so the leak prevention and detection happens inside the protocol itself 🦋

The new configuration parameter is called BGP Role. It gets negotiated with a BGP Role Capability in the OPEN message [RFC5492]. And an eBGP speaker is allowed to require that capability and a matching BGP Role with its neighbor for the OPEN to succeed. Very strict, very iconic 💅

There's also an optional, transitive BGP Path Attribute called "Only to Customer (OTC)" (Section 5 has the deets 🎀). It stops ASes from creating leaks, and it can detect leaks created by ASes sitting in the middle of an AS path. The main focus is the Internet, meaning IPv4 and IPv6 unicast route advertisements 🌈

2. Requirements Language 🫶

Here's the vibe check on the key words: "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" get interpreted as described in BCP 14 [RFC2119] [RFC8174]. But only when they show up in ALL CAPS, like I just did 💖 Lowercase ones are just regular words, no cap 🙈

3. Terminology 🍓

So "local AS" and "remote AS" are just the two ends of an eBGP session. The local AS is the one doing the protocol action being described, and the remote AS is the one on the other end of that eBGP session we're talking about 🦋

Also, "route is ineligible" means exactly what it means in [RFC4271]: the route is ineligible to be installed in Loc-RIB and gets excluded from the next phase of route selection. Quote: "route is ineligible to be installed in Loc-RIB and will be excluded from the next phase of route selection." ✨

3.1. Peering Relationships 💜

Okay this part is important! The peering relationship terms in this doc do NOT necessarily mean business relationships based on who pays who 💸 They're about limits on BGP route propagation, which people sometimes call the Gao-Rexford model [GAO-REXFORD]. The terms "Provider", "Customer", and "Peer" here are the same as "transit provider", "customer", and "lateral (i.e., non-transit) peer" in [RFC7908] 🎀

Here's the list of BGP Roles for eBGP peering and their route propagation rules:

Provider: MAY propagate any available route to a Customer.

Customer: MAY propagate any route learned from a Customer, or that is locally originated, to a Provider. All other routes MUST NOT be propagated.

Route Server (RS): MAY propagate any available route to a Route Server Client (RS-Client).

Route Server Client (RS-Client): MAY propagate any route learned from a Customer, or that is locally originated, to an RS. All other routes MUST NOT be propagated.

Peer: MAY propagate any route learned from a Customer, or that is locally originated, to a Peer. All other routes MUST NOT be propagated.

So if the local AS has one of those Roles (in the order shown), the peering with the remote AS is Provider-to-Customer, Customer-to-Provider, RS-to-RS-Client, RS-Client-to-RS, or Peer-to-Peer (lateral peers). These are called normal peering relationships 🌸

If the local AS has more than one peering Role with the remote AS, that's a "Complex" peering relationship 🌀 An example is when it's Provider-to-Customer for some prefixes but Peer-to-Peer for others [GAO-REXFORD]. Plot twist, but still valid 🫣

A BGP speaker may apply policy to reduce what it announces, and a recipient may apply policy to reduce the set of routes it accepts 🧹

Breaking the propagation rules above may result in route leaks [RFC7908]. Automatic enforcement of these rules should significantly reduce the leaks that would otherwise come from manual configuration mistakes 🙌

As Section 5 explains, the OTC Attribute is used to identify all the routes in the AS that were received from a Peer, a Provider, or an RS 🎀

4. BGP Role 👑

The BGP Role describes the relationship between the eBGP speakers forming a session. One of the Roles below SHOULD be configured at the local AS for each eBGP session (see Section 3) based on the local AS's own knowledge of its Role. The only exception is when the eBGP connection is Complex (see Section 6). BGP Roles get mutually confirmed using the BGP Role Capability (Section 4.1) on each eBGP session 🫶

The allowed Roles for eBGP sessions are:

Provider: the local AS is a transit provider of the remote AS;

Customer: the local AS is a transit customer of the remote AS;

RS: the local AS is a Route Server (usually at an Internet exchange point), and the remote AS is its RS-Client;

RS-Client: the local AS is a client of an RS and the RS is the remote AS; and

Peer: the local and remote ASes are Peers (i.e., have a lateral peering relationship).

4.1. BGP Role Capability 🧚

The BGP Role Capability is defined like this:

Code:  9

Length:  1 (octet)

Value:  integer corresponding to the speaker's BGP Role (see Table 1)

              +=======+==============================+
              | Value | Role name (for the local AS) |
              +=======+==============================+
              |   0   | Provider                     |
              +-------+------------------------------+
              |   1   | RS                           |
              +-------+------------------------------+
              |   2   | RS-Client                    |
              +-------+------------------------------+
              |   3   | Customer                     |
              +-------+------------------------------+
              |   4   | Peer (i.e., Lateral Peer)    |
              +-------+------------------------------+
              | 5-255 | Unassigned                   |
              +-------+------------------------------+

                Table 1: Predefined BGP Role Values

If the BGP Role is locally configured, the eBGP speaker MUST advertise the BGP Role Capability in the BGP OPEN message. An eBGP speaker MUST NOT advertise multiple versions of the BGP Role Capability. The error handling when multiple BGP Role Capabilities are received is described in Section 4.2. 🚨

(Part 1 of 3. Keep going, bestie, Part 2 is coming up next 💖)

4.2. Role Correctness ✨

okay so Section 4.1 is where the BGP Role says what the relationship is on each eBGP session between ASes 💅

just getting the Role Capability sent or received doesn't automatically mean both neighbors agree on the Role 🙈 if you advertise the BGP Role Capability and you also get one back from your peer, the Roles MUST line up with the relationships in Table 2 🎀 if they don't, the BGP speaker MUST reject the connection with the Role Mismatch Notification (code 2, subcode 11). no vibes, just rejection 💀

                 +===============+================+
                 | Local AS Role | Remote AS Role |
                 +===============+================+
                 | Provider      | Customer       |
                 +---------------+----------------+
                 | Customer      | Provider       |
                 +---------------+----------------+
                 | RS            | RS-Client      |
                 +---------------+----------------+
                 | RS-Client     | RS             |
                 +---------------+----------------+
                 | Peer          | Peer           |
                 +---------------+----------------+

                   Table 2: Allowed Pairs of Role
                            Capabilities

for backward compatibility 🦋 if you SEND the BGP Role Capability but don't RECEIVE one back, the BGP Speaker SHOULD ignore that missing capability and carry on with session establishment 🌸 the locally configured BGP Role is what gets used for the procedures in Section 5 ✨

an operator can choose a "strict mode" 👑 in strict mode, the receipt of a BGP Role Capability from the remote AS is REQUIRED. so if you send one but nothing comes back, the connection gets rejected with the Role Mismatch Notification (code 2, subcode 11) 🙅‍♀️ see the comments in Section 8 for more tea ☕

if an eBGP speaker gets multiple BGP Role Capabilities that are identical, with the same value in each, it treats them as one single BGP Role Capability and proceeds [RFC5492] 🧚 but if multiple ones come in and NOT all of them have the same value, the BGP speaker MUST reject the connection with the Role Mismatch Notification (code 2, subcode 11). mismatch = gone 🚫

the BGP Role value for the local AS, together with the OTC Attribute in the received UPDATE message, is what powers the route leak prevention and detection procedures in Section 5 🛡️✨

5. BGP Only to Customer (OTC) Attribute 🩷

okay this is the OTC Attribute and it's giving main character energy 👑 it's an optional transitive Path Attribute of the UPDATE message, with Attribute Type Code 35 and a length of 4 octets 🦋 its whole purpose is to enforce that once a route goes to a Customer, a Peer, or an RS-Client (see definitions in Section 3.1), it will afterwards only go to Customers 💅 the attribute value is an AS number (ASN) figured out by the procedures below 🔥

here's the ingress procedure for handling the OTC Attribute when a route is received 🎀

1. if a route with the OTC Attribute is received from a Customer or an RS-Client, then it's a route leak and it MUST be considered ineligible (see Section 3). 💀
2. if a route with the OTC Attribute is received from a Peer (so a remote AS with a Peer Role) and the Attribute's value is NOT equal to the remote (aka the Peer's) AS number, then it's a route leak and it MUST be considered ineligible. 🙈
3. if a route is received from a Provider, a Peer, or an RS and the OTC Attribute is NOT present, then it MUST be added with a value equal to the AS number of the remote AS. ✨

and here's the egress procedure for when a route is advertised 🌈

1. if a route is going to be advertised to a Customer, a Peer, or an RS-Client (when the sender is an RS), and the OTC Attribute is not present, then when advertising the route, an OTC Attribute MUST be added with a value equal to the AS number of the local AS. 🧚
2. if a route already has the OTC Attribute, it MUST NOT be propagated to Providers, Peers, or RSes. 🚫

the procedures above give you leak prevention for the local AS AND leak detection and mitigation multiple hops away, which is lowkey iconic 😭 for prevention at the local AS, the OTC Attribute tells the egress router that the route was learned from a Peer, a Provider, or an RS, so it can only be advertised to the Customers 🍓 the same OTC Attribute that's set locally also gives a way to detect route leaks by an AS multiple hops away, if the route gets received from a Customer, a Peer, or an RS-Client 🕵️‍♀️ for example, if an AS sets the OTC Attribute on a route sent to a Peer, and a compliant AS later receives that route from a Customer, then the receiving AS detects (based on the presence of the OTC Attribute) that the route is a leak 💖

the OTC Attribute might be set at the egress of the remote AS or at the ingress of the local AS. so if the remote AS isn't compliant with this specification, the local AS will have to set the OTC Attribute if it's absent 🫶 either way, the OTC value will be the same. this makes the scheme more robust and helps early adopters 🌸

the OTC Attribute is considered malformed if its length value is not 4. an UPDATE message with a malformed OTC Attribute SHALL be handled using the "treat-as-withdraw" approach [RFC7606] 💅

the BGP Role negotiation and OTC-Attribute-based procedures in this document are NOT RECOMMENDED to be used between autonomous systems in an AS Confederation [RFC5065]. if an OTC Attribute is added on egress from the AS Confederation, its value MUST equal the AS Confederation Identifier. also, on egress from the AS Confederation, an UPDATE MUST NOT contain an OTC Attribute with a value for any Member-AS Number other than the AS Confederation Identifier. 🌈

the procedures here may be used in scenarios with private AS numbers behind an Internet-facing ASN (e.g., a data-center network [RFC7938] or a stub customer) 🍓 but any details are outside the scope of this document 🙈 on egress from the Internet-facing AS, the OTC Attribute MUST NOT contain a value other than the Internet-facing ASN. 💜

once the OTC Attribute has been set, it MUST be preserved unchanged (this also applies to an AS Confederation). 🔒

the ingress and egress procedures described here only apply to the address families AFI 1 (IPv4) and AFI 2 (IPv6) with SAFI 1 (unicast) in both cases, and they MUST NOT be applied to other address families by default. the operator MUST NOT have the ability to modify the procedures defined in this section. 👑

6. Additional Considerations 🌸

Roles MUST NOT be configured on an eBGP session with a Complex peering relationship. if multiple eBGP sessions can split the Complex peering relationship into sessions with normal peering relationships, BGP Roles SHOULD be used on each of the resulting eBGP sessions. 🧚

an operator may want the same outcome by configuring policies on a per-prefix basis to follow the peering definitions in Section 3.1. however, in that case there are no in-band measures to check the correctness of the per-prefix peering configuration 🙃

an incorrect setting of BGP Roles and/or OTC Attributes may affect prefix propagation. also, this document doesn't specify any special handling of an incorrect AS number in the OTC Attribute 😬

in AS migration scenarios [RFC7705], a given router may represent itself as any one of several different ASes. this shouldn't be a problem, since the egress procedures in Section 5 say the OTC Attribute gets attached as part of route transmission. so a router is expected to set the OTC value equal to the ASN it's currently representing itself as 🦋

Section 6 of [RFC7606] documents possible negative impacts of "treat-as-withdraw" behavior. those impacts may include forwarding loops or dropped traffic. it also discusses debugging considerations related to this behavior. 🔍

7. IANA Considerations 🎀

IANA has registered a new BGP Capability (Section 4.1) in the "Capability Codes" registry within the "IETF Review" range [RFC5492]. the description for the new capability is "BGP Role". IANA has assigned the value 9. this document is the reference for the new capability. 🌈

IANA has created and now maintains a new subregistry called "BGP Role Value" within the "Capability Codes" registry. registrations should include a value, a role name, and a reference to the defining document. IANA has registered the values in Table 3. future assignments may be made by the "IETF Review" policy as defined in [RFC8126]. 📋

      +=======+===============================+===============+
      | Value | Role name (for the local AS)  |   Reference   |
      +=======+===============================+===============+
      |   0   | Provider                      | This document |
      +-------+-------------------------------+---------------+
      |   1   | RS                            | This document |
      +-------+-------------------------------+---------------+
      |   2   | RS-Client                     | This document |
      +-------+-------------------------------+---------------+
      |   3   | Customer                      | This document |
      +-------+-------------------------------+---------------+
      |   4   | Peer (i.e., Lateral Peer)     | This document |
      +-------+-------------------------------+---------------+
      | 5-255 | To be assigned by IETF Review |               |
      +-------+-------------------------------+---------------+

                 Table 3: IANA Registry for BGP Role

IANA has registered a new OPEN Message Error subcode named "Role Mismatch" (see Section 4.2) in the "OPEN Message Error subcodes" registry. IANA has assigned the value 11. this document is the reference for the new subcode. 💖

due to improper use of the values 8, 9, and 10, IANA has marked values 8-10 as "Deprecated" in the "OPEN Message Error subcodes" registry. this document is listed as the reference. 🥀

IANA has also registered a new Path Attribute named "Only to Customer (OTC)" (see Section 5) in the "BGP Path Attributes" registry. IANA has assigned code value 35. this document is the reference for the new attribute. ✨

8. Security Considerations 🔐✨

Okay bestie, security time, and I'm not gonna be casual about it 🫶 The security considerations of BGP (as specified in [RFC4271] and [RFC4272]) apply. Everything from those docs still counts, no exceptions 💅

This doc proposes a mechanism that uses the BGP Role to prevent and detect route leaks that come from BGP policy misconfiguration 🚨 A misconfigured BGP Role can mess with prefix propagation. For example, if a downstream peering link (aka one pointing toward a Customer) got set up with a Provider or Peer Role, it would limit how many prefixes can be advertised in that direction 😭 On the flip side, if an upstream provider got misconfigured (by a local AS) with the Customer Role, it may end up propagating routes it got from other Providers or Peers. Yikes 💀 But the BGP Role negotiation and the resulting confirmation of Roles make these misconfigurations unlikely, so that's the saving grace 🙏

Setting the strict mode of operation for BGP Role negotiation as the default may result in a situation where the eBGP session will not come up after a software update. Implementations with that default behavior are strongly discouraged. Not a vibe 🚫

Removing the OTC Attribute or changing its value can limit the opportunity for route leak detection. This can be done on purpose as part of an on-path attack. For example, an AS can remove the OTC Attribute on a received route and then leak the route to its transit provider. This kind of threat is not new in BGP, and it may affect any Attribute. Note that BGPsec [RFC8205] only offers protection for the AS_PATH Attribute. 🕵️‍♀️

Adding an OTC Attribute when the route is advertised from Customer to Provider will limit the propagation of the route. Such a route may be considered ineligible by the immediate Provider, its Peers, or upper-layer Providers 🙈 This kind of OTC Attribute addition is unlikely to happen on the Provider side, because it would limit the traffic volume toward its Customer. On the Customer side, adding an OTC Attribute for traffic-engineering purposes is also discouraged, since it will limit route propagation in an unpredictable way 🌀

---

9. References 📚

9.1. Normative References 💜

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119,
           DOI 10.17487/RFC2119, March 1997,
           <https://www.rfc-editor.org/info/rfc2119>.

[RFC4271]  Rekhter, Y., Ed., Li, T., Ed., and S. Hares, Ed., "A
           Border Gateway Protocol 4 (BGP-4)", RFC 4271,
           DOI 10.17487/RFC4271, January 2006,
           <https://www.rfc-editor.org/info/rfc4271>.

[RFC5065]  Traina, P., McPherson, D., and J. Scudder, "Autonomous
           System Confederations for BGP", RFC 5065,
           DOI 10.17487/RFC5065, August 2007,
           <https://www.rfc-editor.org/info/rfc5065>.

[RFC5492]  Scudder, J. and R. Chandra, "Capabilities Advertisement
           with BGP-4", RFC 5492, DOI 10.17487/RFC5492, February
           2009, <https://www.rfc-editor.org/info/rfc5492>.

[RFC7606]  Chen, E., Ed., Scudder, J., Ed., Mohapatra, P., and K.
           Patel, "Revised Error Handling for BGP UPDATE Messages",
           RFC 7606, DOI 10.17487/RFC7606, August 2015,
           <https://www.rfc-editor.org/info/rfc7606>.

[RFC7908]  Sriram, K., Montgomery, D., McPherson, D., Osterweil, E.,
           and B. Dickson, "Problem Definition and Classification of
           BGP Route Leaks", RFC 7908, DOI 10.17487/RFC7908, June
           2016, <https://www.rfc-editor.org/info/rfc7908>.

[RFC8126]  Cotton, M., Leiba, B., and T. Narten, "Guidelines for
           Writing an IANA Considerations Section in RFCs", BCP 26,
           RFC 8126, DOI 10.17487/RFC8126, June 2017,
           <https://www.rfc-editor.org/info/rfc8126>.

[RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
           2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
           May 2017, <https://www.rfc-editor.org/info/rfc8174>.

9.2. Informative References 🌸

[GAO-REXFORD]
           Gao, L. and J. Rexford, "Stable Internet routing without
           global coordination", IEEE/ACM Transactions on Networking,
           Volume 9, Issue 6, pp. 689-692, DOI 10.1109/90.974523,
           December 2001,
           <https://ieeexplore.ieee.org/document/974523>.

[RFC4272]  Murphy, S., "BGP Security Vulnerabilities Analysis",
           RFC 4272, DOI 10.17487/RFC4272, January 2006,
           <https://www.rfc-editor.org/info/rfc4272>.

[RFC7705]  George, W. and S. Amante, "Autonomous System Migration
           Mechanisms and Their Effects on the BGP AS_PATH
           Attribute", RFC 7705, DOI 10.17487/RFC7705, November 2015,
           <https://www.rfc-editor.org/info/rfc7705>.

[RFC7938]  Lapukhov, P., Premji, A., and J. Mitchell, Ed., "Use of
           BGP for Routing in Large-Scale Data Centers", RFC 7938,
           DOI 10.17487/RFC7938, August 2016,
           <https://www.rfc-editor.org/info/rfc7938>.

[RFC8205]  Lepinski, M., Ed. and K. Sriram, Ed., "BGPsec Protocol
           Specification", RFC 8205, DOI 10.17487/RFC8205, September
           2017, <https://www.rfc-editor.org/info/rfc8205>.

---

Acknowledgments 🫶

The authors wish to thank Alvaro Retana, Bruno Decraene, Jeff Haas, John Scudder, Sue Hares, Ben Maddison, Andrei Robachevsky, Daniel Ginsburg, Ruediger Volk, Pavel Lunin, Gyan Mishra, and Ignas Bagdonas for their reviews, comments, and suggestions during the course of this work. Thanks are also due to many IESG reviewers whose comments greatly helped improve the clarity, accuracy, and presentation in the document. The whole squad is iconic 👑

Contributors ✨

Brian Dickson
Independent
Email: brian.peter.dickson@gmail.com


Doug Montgomery
USA National Institute of Standards and Technology
Email: dougm@nist.gov

Authors' Addresses 🦋

Alexander Azimov
Qrator Labs & Yandex
Ulitsa Lva Tolstogo 16
Moscow
119021
Russian Federation
Email: a.e.azimov@gmail.com


Eugene Bogomazov
Qrator Labs
1-y Magistralnyy tupik 5A
Moscow
123290
Russian Federation
Email: eb@qrator.net


Randy Bush
Internet Initiative Japan & Arrcus, Inc.
5147 Crystal Springs
Bainbridge Island, Washington 98110
United States of America
Email: randy@psg.com


Keyur Patel
Arrcus
2077 Gateway Place
Suite #400
San Jose, CA 95119
United States of America
Email: keyur@arrcus.com


Kotikalapudi Sriram
USA National Institute of Standards and Technology
100 Bureau Drive
Gaithersburg, MD 20899
United States of America
Email: ksriram@nist.gov