bgp rpki decorator

Pre-Alpha. This page describes behavior that may change.

Correlates UPDATE events and RPKI validation events into merged update-rpki events for consumer plugins that want both in one envelope.

Category

Validation.

Configuration

plugin {
    internal rpki-decorator { use bgp-rpki-decorator }
    internal rpki           { use bgp-rpki }
    internal adj-rib-in     { use bgp-adj-rib-in }
}

bgp {
    peer upstream {
        process my-consumer    { receive [ update-rpki ] }
        process rpki           { receive [ update ] }
        process rpki-decorator { receive [ update rpki ] }
        process adj-rib-in     { receive [ update state ] }
    }
}

A consumer plugin subscribes to update-rpki and gets the combined envelope. The rpki-decorator plugin is the thing that builds it.

Behaviour

The decorator subscribes to both the UPDATE event stream and the RPKI validation event stream for the same peer. For each UPDATE, it waits up to 2 seconds for the matching RPKI validation result, then emits a merged update-rpki event containing the full UPDATE JSON with an rpki section injected.

If the RPKI validation does not arrive within the 2-second window, the decorator emits the event without the rpki section (graceful degradation). Consumers that rely on the RPKI state need to handle the missing-section case.

The merged event shape is the same UPDATE envelope with an extra rpki field:

{
  "type": "bgp",
  "bgp": {
    "peer":    {"address": "10.0.0.1", "remote": {"as": 65001}},
    "message": {"id": 42, "type": "update-rpki"},
    "update":  {"...": "..."},
    "rpki":    {"ipv4/unicast": {"10.0.1.0/24": "valid"}}
  }
}

Interactions

• Consumes update and rpki events from the bus.
• Emits update-rpki events on its own namespace.
• Requires bgp-rpki for the RPKI side.

Source

main/internal/component/bgp/plugins/rpki_decorator/