bgp rpki

Pre-Alpha. This page describes behavior that may change.

RPKI origin validation via the RTR protocol (RFC 6811, RFC 8210) and ASPA path verification with policy enforcement (RTR v2, RFC 9582, draft-ietf-sidrops-aspa-verification). Connects to RTR cache servers, downloads Validated ROA Payloads (VRPs) and ASPA records, applies origin validation (RFC 6811) and upstream path verification to received routes. ASPA policy enforcement supports reject/log-only/accept actions.

Configuration

plugin {
    external rpki       { use bgp-rpki;       encoder json; }
    external adj-rib-in { use bgp-adj-rib-in; encoder json; }
}

bgp {
    rpki {
        cache-server 192.0.2.1 { port 323; }
        policy { invalid-action reject; }
    }

    peer upstream {
        process rpki       { receive [ update ] }
        process adj-rib-in { receive [ update state ] }
    }
}

Full reference on the RPKI configuration page.

Behaviour

For every received UPDATE, the plugin extracts the origin AS (the rightmost AS in the final AS_SEQUENCE segment), looks up covering VRPs for each NLRI prefix, and computes one of three states per RFC 6811: Valid, Invalid, or NotFound. Invalid routes are rejected by default. NotFound and Valid routes are accepted.

When ASPA validation is enabled (aspa-validation true) and the RTR session negotiates v2, the plugin also verifies the AS_PATH against ASPA records. The path is normalized (consecutive duplicate removal, confederation stripping), and each adjacent hop pair is checked against the ASPA cache. The result (Valid, Invalid, or Unknown) is included as "aspa-state" in the RPKI event JSON. ASPA policy enforcement is configurable via rpki/aspa-policy/invalid-action (reject/log-only/accept).

The plugin holds routes in the bgp-adj-rib-in validation gate while it computes the state. If the plugin does not respond within validation-timeout seconds (default 30), pending routes are fail-open promoted to installed. When every RTR cache server disconnects, the existing VRP cache is retained until a connection comes back.

The plugin emits rpki events that other plugins can subscribe to. bgp-rpki-decorator consumes those events and produces merged update-rpki events that combine the UPDATE and the validation state in one envelope.

Metrics

Registered via ConfigureMetrics on the plugin registration.

Metric	Type	Meaning
`ze_rpki_vrps_cached`	gauge	VRPs currently in the ROA cache.
`ze_rpki_sessions_active`	gauge	Active RTR cache sessions.
`ze_rpki_validation_outcomes_total{result}`	counter	RPKI validation outcomes, labelled by `result` (valid / invalid / notfound).