bgp role

Pre-Alpha. This page describes behavior that may change.

RFC 9234 BGP Role enforcement. Stamps the OTC attribute on eligible egress updates and rejects routes that arrive carrying OTC from a non-customer direction.

Category

Policy.

Configuration

The plugin activates per peer when a role { import <role> } declaration is present.

bgp {
    peer upstream {
        role {
            import customer;
            strict true;
        }
    }
}

Full configuration reference on the BGP Role configuration page.

Behaviour

The plugin is registered as a mandatory filter that runs on both ingress and egress for peers with a declared role. On ingress, it checks the OTC attribute against the peer's role and marks the route as a leak if OTC is present when the peer is a customer or route-server-client. On egress, it stamps OTC with the local ASN when the destination peer is a customer, route-server-client, or peer AND the UPDATE advertises a route.

The RFC 9234 Section 5 procedures act on what the PEER is to Ze. That value comes from the Role capability in the peer's OPEN when the peer sent one, and from the complement of the local import role when it did not. RFC 9234 Section 4.2 prescribes the second: "The locally configured BGP Role is used for the procedures described in Section 5." An empty capability value used to select the permissive branch of every Section 5 gate, so a capability-less peer skipped all three ingress rules and both egress rules.

OTC processing is bounded to IPv4 and IPv6 unicast, and to an UPDATE that advertises a route. A withdraw-only UPDATE, an MP_UNREACH-only UPDATE and an End-of-RIB marker are forwarded untouched, because adding an attribute to one produces a message RFC 4271 Section 4.3 forbids.

A peer created from a dynamic group resolves its role through its group, so the Section 5 gates, the Section 4.2 OPEN pair check, strict mode and the advertised Role capability all reach a member.

With strict true, the plugin requires the remote peer to advertise the Role capability in its OPEN. A peer that does not advertise Role gets a Role Mismatch NOTIFICATION (code 2, subcode 11) and the session is rejected. With strict false (the default), the session proceeds and OTC filtering is applied based on the locally configured role.

Metrics

Every drop is counted, and the first drop of each reason raises a warning naming the peer. Later drops are counted only, with per-route detail at debug level.

Metric	Reason labels
ze_role_route_rejects_total	leak, malformed-otc
ze_role_route_suppressions_total	otc-present, source-role, export-set, role-unrecorded

Six series per metric, bounded. Peer identity is in the log line, never in a label.

Interactions

• Runs as a filter in the redistribution chain. Mandatory: cannot be overridden.
• Reads and writes the OTC attribute (type 35) through the egress ModAccumulator.

Source

main/internal/component/bgp/plugins/role/