Routing Policy Specification Language next generation (RPSLng)
updated by
- rfc-7909 — Securing Routing Policy Specification Language (RPSL) Objects with Resource Public Key Infrastructure (RPKI) Signatures
updates
Extracted elements (24)
Existing 'import:', 'export:', and 'default:' attributes are kept as IPv4 unicast only, and new 'mp-' prefixed attributes are introduced instead of extending existing syntax. This preserves backward compatibility and avoids undermining clarity in policy expressions.
IPv6 prefix ranges were added to the existing mnt-routes attribute in aut-num rather than creating a new attribute type, despite potential conflicts with existing IPv4-only implementations, because the optional prefix range list was perceived to have minimal implementation adoption.
The MPBGP protocol name (rather than BGP4+) was chosen for the dictionary because the '+' character is not allowed by RPSL specification in protocol names. MPBGP is understood to mean BGP4 with multi-protocol extensions.
Evaluation of peering-sets and filter-sets is constrained by address family context, which may result in a 'NOT ANY' <mp-filter> or invalid <mp-peering>. Implementations may wish to issue a warning when a 'NOT ANY' filter is encountered.
Inclusion of IPv6 prefix ranges in a mnt-routes attribute within an aut-num object may conflict with existing RPSL implementations that support only IPv4 prefix ranges. The afi specification within refine/except expressions is valid only within the containing policy expression.
If mnt-routes attributes are present in an object, the mnt-by or mnt-lower attributes are not considered for authorization. mnt-lower is used only for inet6num objects that are less specific than the route6 object being added, and only in the absence of mnt-routes.
Implementations should reject filter-set instances where both 'filter:' and 'mp-filter:' attributes are defined, as the interpretation of such a filter-set is undefined.
When a route6 object is added, the submission must satisfy two authentication criteria: it must match authentication in the aut-num object AND in either a route6 object or, if none found, an inet6num object.
When the same peering is covered by more than one multi-protocol policy attribute, implementations should follow the specification-order rule from RFC 2622 Section 6.4, using the action corresponding to the first matching peering specification.
A new 'mp-members:' attribute is added to the route-set class, allowing specification of both IPv4 and IPv6 address-prefix-ranges or references to other route-set names with optional range operators.
A new predefined dictionary type 'ipv6_address' is added to support IPv6 next-hop specification. The next-hop rp-attribute is expanded to accept union of ipv4_address, ipv6_address, or enum[self].
<mp-filter> extends the RPSL <filter> expression to allow IPv6 prefixes and prefix ranges in addition to IPv4. An Address-Prefix Set in an <mp-filter> may contain both IPv4 and IPv6 prefixes, e.g., { 192.0.2.0/24, 2001:0DB8::/32 }.
<mp-peering> identifies the AS and optionally the router using IPv4 or IPv6 addresses, inet-rtr names, or rtr-set names, combined with AND, OR, and EXCEPT operators. It extends the original <peering> concept to support IPv6 router expressions.
The Address Family Identifier (<afi>) is a new dictionary attribute introduced as an optional element within mp- attributes. Valid values include ipv4.unicast, ipv4.multicast, ipv4, ipv6.unicast, ipv6.multicast, ipv6, any, any.unicast, and any.multicast.
The filter-set class gains a new 'mp-filter:' attribute accepting an <mp-filter> expression. A filter-set must contain at least one of 'filter:' or 'mp-filter:'; having both is invalid.
The inet-rtr class gains two new attributes: 'interface:' (supporting IPv4/IPv6 addresses with optional tunnel definitions using GRE or IPinIP encapsulation) and 'mp-peer:' (extending 'peer:' to support IPv6 addresses).
The inet6num class is introduced for IPv6 address space registration, with a mandatory IPv6 address prefix as class key, along with netname, country (ISO 3166), admin-c, tech-c, mnt-lower, mnt-routes, and mnt-by attributes.
The mnt-routes attribute in aut-num is extended to allow mixed IPv4 and IPv6 prefix range lists enclosed in curly braces. The keyword ANY may also be used; default when no set items are specified is ANY.
The peering-set class gains a new 'mp-peering:' attribute accepting an <mp-peering> expression. A peering-set must contain at least one of 'peering:' or 'mp-peering:'.
The route6 class is the IPv6 equivalent of the route class, keyed by the route6 attribute (an IPv6 address prefix) and the origin attribute (AS number). Attributes inject, components, export-comps, holes, and mnt-routes must specify IPv6 prefixes and addresses.
The rtr-set class gains a new 'mp-members:' attribute allowing specification of inet-rtr names, rtr-set names, IPv4 addresses, or IPv6 addresses, extending the original 'members:' to support IPv6.
Three new IPv6 RPSL types are defined: <ipv6-address> and <ipv6-address-prefix> from RFC 3513, and <ipv6-address-prefix-range> which adds the RFC 2622 range operator to <ipv6-address-prefix>.
Three new policy attributes — mp-import, mp-export, and mp-default — are introduced in the aut-num class. Each incorporates an optional afi specification; if absent, the policy applies to all four address families (ipv4.unicast, ipv4.multicast, ipv6.unicast, ipv6.multicast).
RPSLng extensions introduce no new security functionality or threats beyond those in RFC 2622 and RFC 2725. However, the original RPSL standard includes weak authentication mechanisms: MAIL-FROM (vulnerable to spoofing), CRYPT-PW (vulnerable to dictionary attacks and password sniffing over unencrypted channels), and NONE (no protection).