Routing Policy Specification Language (RPSL)
Extracted elements (28)
Hierarchical set names (e.g., AS1:AS-CUSTOMERS) partition the namespace so that the maintainer of the parent object controls all sub-names. This prevents unauthorized parties from creating set names that appear to be sub-delegations of another organization's namespace, providing administrative integrity without a central naming authority.
Policy analysis tools that encounter unknown rp-attributes from an updated dictionary may approximate: filter methods may be treated as always matching and action methods as no-operations. Tools may also download code via mechanisms outside RPSL's scope, enabling forward compatibility as new protocols and attributes are introduced.
RPSL is intentionally a policy specification language, not a router configuration language. Router configurations are generated from RPSL policy descriptions (aut-num class) combined with router descriptions (inet-rtr class) and global IRR database mappings, enabling protection against accidental or malicious distribution of inaccurate routing information.
RPSL supports four extension mechanisms: (1) adding rp-attributes and protocols to the dictionary class, (2) adding new optional attributes to existing classes, (3) adding entirely new classes, and (4) changing the syntax of existing RPSL attributes. This layered extensibility allows new routing protocols and features to be introduced without breaking existing tools.
When multiple import/export expressions overlap (same peering or overlapping filters), RPSL uses the specification-order rule: the action of the first matching specification applies, and routes matched by earlier expressions are excluded from later ones. This avoids requiring disjoint specifications while keeping policy interpretation deterministic.
RPSL obsoletes RFC 2280 and replaces RIPE-181 (RFC 1786). RIPE-81 was the first Internet routing policy language; RIPE-181 succeeded it but was found unable to express certain policies, motivating RPSL's more generalized design.
RPSL is case insensitive and only ASCII characters may be used. Object names must start with a letter and end with a letter or digit; the reserved words (any, as-any, rs-any, peeras, and, or, not, atomic, from, to, at, action, accept, announce, except, refine, networks, into, inbound, outbound) cannot be used as names.
Set name prefixes are reserved by type: 'as-' for as-set, 'rs-' for route-set, 'rtrs-' for rtr-set, 'fltr-' for filter-set, and 'prng-' for peering-set. A hierarchical set name X1:...:Xn can only be created by the maintainer of the object named X1:...:Xn-1, partitioning the namespace.
The mbrs-by-ref attribute controls indirect set membership: if present with specific maintainer names, only objects maintained by those maintainers that reference the set via member-of are included; if ANY, any referencing object is a member; if absent, only directly listed members in the members attribute are in the set.
Address prefix ranges use four range operators: ^- (exclusive more specifics), ^+ (inclusive more specifics), ^n (all length-n specifics), and ^n-m (specifics of length n through m). Operators distribute over set members; chaining two operators directly on a single prefix is an error, but an operator may be applied to a set whose members already contain range operators.
An RPSL object is represented as a list of attribute-value pairs, one per line, with the attribute name at column 0 followed by ':' and the value. The class-name attribute must appear first, the object ends at a blank line, and continuation lines begin with a space, tab, or '+' character; '+' allows blank lines within a value.
AS-path regular expressions in RPSL filters are POSIX-compliant regular expressions over the alphabet of AS numbers, enclosed in '<' and '>'. In addition to standard operators (*, +, ?, {m,n}), RPSL defines homogeneous variants (~*, ~+, ~{m,n}) that require all occurrences to match the same AS number.
Structured import/export policies use EXCEPT and REFINE operators. EXCEPT gives precedence to the right-hand side for the intersection of routes while retaining left-hand side policies for the remainder. REFINE takes the Cartesian product: for each pair of left/right policies with common peerings, the result intersects their filters and concatenates their actions.
The as-set class (name prefix 'as-') defines named sets of AS numbers. Members can be listed directly via the members attribute (AS numbers or other as-set names), or indirectly via mbrs-by-ref: aut-num objects maintained by listed maintainers whose member-of attribute references the set are automatically included.
The aut-num class is the primary class for routing policy, keyed by AS number. It contains import, export, and default attributes specifying the AS's routing policy. The admin-c attribute is mandatory for the aut-num class (unlike other classes where it is optional).
The default attribute specifies a fallback routing policy: 'default: to <peering> [action <action>] [networks <filter>]'. A router uses the default only if it has received routes matched by the optional filter from the specified peer. Multiple defaults with different pref actions enable ordered preference among candidates.
The dictionary class provides RPSL extensibility by defining rp-attributes (with strongly typed access methods using predefined, union, or list types), named types via typedef, and protocols with mandatory/optional peering parameters. The well-known dictionary object is named 'RPSL' and is used by all tools by default.
The export attribute syntax mirrors import: 'export: [protocol <p1>] [into <p2>] to <peering-1> [action <action-1>] ... announce <filter>'. Both protocol keywords default to BGP; specifying them enables multi-protocol policies and route injection between protocols such as BGP4 into OSPF or STATIC into BGP4.
The filter-set class (name prefix 'fltr-') defines a named policy filter as a logical expression using AND, OR, NOT operators over address prefix sets, route-set names, AS-path regular expressions, or rp-attributes defined in the dictionary. Routing policy attribute filters are evaluated before AND/OR/NOT operators.
The import attribute syntax is: 'import: [protocol <p1>] [into <p2>] from <peering-1> [action <action-1>] ... accept <filter>'. Actions execute left-to-right while importing; pref is the inverse of BGP local-pref (65535 - pref); lower pref integers indicate higher preference.
The inet-rtr class describes individual routers, providing router ID, the AS number of the router, interface addresses, and peer information. It is used in conjunction with aut-num policy descriptions to generate low-level router configurations from RPSL policy specifications.
The initial RPSL dictionary (object name 'RPSL') defines seven rp-attributes: pref (local preference), med (BGP MED, supports igp_cost), dpa (BGP DPA), aspath (prepend method), community (set/append/delete/contains operations supporting RFC 1997 values internet/no_export/no_advertise), next-hop (for static routes), and cost. It defines protocols BGP4, OSPF, RIP, IGRP, IS-IS, STATIC, RIPng, DVMRP, PIM-DM, PIM-SM, CBT, and MOSPF.
The mntner class specifies authentication required to create, delete, and update RPSL objects. Its auth attribute supports schemes NONE, MAIL-FROM (regex on email addresses), CRYPT-PW (UNIX crypt password), and PGP-KEY (reference to key-certif object). If multiple auth attributes are present, satisfying any one grants authorization.
The PeerAS keyword substitutes the AS number of the peer AS in filters and actions, enabling a single policy expression to apply to a set of peers. For example, 'import: from AS-FOO accept PeerAS' imports each member AS's own routes and is equivalent to a separate per-AS import expression for each member.
The peering-set class (name prefix 'prng-') defines sets of peerings. A peering expression is '<as-expression> [<router-expr-1>] [at <router-expr-2>]' using AND/OR/EXCEPT on AS numbers, AS sets, inet-rtr names, and rtr-set names. EXCEPT has the same precedence as AND and is semantically equivalent to 'AND NOT'.
The route class represents each interAS route with a composite key of route (address-prefix) and origin (AS number), allowing the same prefix to be registered as originated by multiple ASes. Optional aggregation attributes (inject, components, aggr-bndry, aggr-mtd, export-comps, holes) support aggregate route specification.
The route-set class (name prefix 'rs-') defines named sets of route prefixes (not route objects). Members can be address-prefix-ranges, other route-set names with optional range operators, or AS numbers and as-set names (which implicitly define the set of routes originated by those ASes). The predefined set rs-any contains all routes in the IRR.
RPSL's security relies on the mntner class for authentication and authorization of object updates. The mntner auth attribute supports NONE, MAIL-FROM, CRYPT-PW, and PGP-KEY schemes. Full details of the authentication and authorization model, including how maintainer hierarchies protect the IRR, are specified in the companion 'Routing Policy System Security' document.