a positive test proves Ze does what the requirement demands and a negative one proves it refuses what the requirement forbids
Supported within BMP sender scope
RFC 8671 - Support for Adj-RIB-Out in the BGP Monitoring Protocol (BMP)
Every requirement this repository extracted from RFC 8671, the tests bound to it, and what a reader has verified about them. This summary is enrolled and gated by ./le rfc check.
Overview
Positive
what Ze has
the requirement admits no counter-case, so one polarity plus a recorded reason is the whole proof available for it
one direction is tested, the other is neither tested nor excused, and nothing states which
scoped tests exist; the remaining obligation is unmet or unproven, with zero whole-requirement credit
no test carries the requirement id, whether or not a gap states why
a red was observed once under a recorded procedure, and the unit, the claim and the producer it rested on still hash to what was recorded. The break is not re-run. A test pair is not a proof until one has been observed
Neutral
measures that are neither good news nor bad
MUST-level requirements the gate HOLDS. A population, not a result: the shares beside it are what says how Ze stands
an obligation that does not bind Ze. A {not-applicable} annotation says it never bound; a {feature-declined} annotation says its condition is an optional feature Ze does not offer, and quotes the RFC sentence that makes it optional. Scope, not coverage: it stays in the denominator every share on this page is taken over
a {not-applicable} annotation says the obligation does not bind Ze, so no test is owed for it. It stays in the denominator every share here is taken over
a {lower-layer} annotation says a layer under Ze performs the behavior, on state Ze installs into that layer, and names the producer that installs it. The obligation binds Ze and is met; Ze proves none of it, because its own boundary carries no value the behavior reads
a {feature-declined} annotation says the obligation is conditional on a feature the RFC makes optional and Ze does not offer, and it quotes the sentence that makes it optional. The condition is false, so nothing is owed and nothing is missing. It stays in the denominator every share here is taken over
The 8 shares marked as a part above are the whole of the 10 gated MUSTs: they add to 100%. Proven by a recorded break is a share of TAGGED UNITS, a different population, so it is not one of them.
How to read the colors
A color names what the measure MEANS, not how well Ze scores on it. Green is a good outcome at any value, red is a bad one, and neither a population nor a scope count is an outcome, so both take no color. The number under the label is what says how far Ze has got.
| Card | Tone here | Why that color |
|---|---|---|
| Gated MUSTs | neutral | no color: a population is a scale, and a larger one is neither good news nor bad. It is the accounting total |
| Out of scope | neutral | no color: an obligation that never bound Ze is neither an achievement nor a failure, and counting it either way would be a claim |
| Tested both ways | ok | green at every value: a test pair is the outcome this gate exists to produce, and the share under the label is what says how far Ze has got |
| One polarity plus reason | ok | green at every value: where no counter-case exists, one polarity IS the complete answer, and a recorded reason is what the gate demands beside it |
| One polarity, unexcused | ok | green at zero, RED above it: half a proof with no reason for the other half |
| Partial proof; remaining gap | ok | green at zero, RED above it: a tested clause cannot prove the whole requirement |
| No test at all | ok | green at zero, RED above it: a binding obligation nothing exercises is a claim with nothing behind it, whether or not a reason is stated |
| Not applicable | neutral | no color: an obligation that never bound Ze is neither an achievement nor a failure, and counting it either way would be a claim |
| Met below Ze | neutral | no color: an obligation met below Ze is neither a test Ze wrote nor work Ze owes, and the two green shares above are what says how much Ze proves itself |
| Optional feature declined | neutral | no color: an obligation whose condition Ze never meets is neither an achievement nor a failure. The absent FEATURE is disclosed on the RFC's own status row, as an implementation gap a later scope decision can revisit |
| Proven by a recorded break | ok | green at every value: an observed break is the outcome the discrimination gate exists to produce. The denominator is TAGGED UNITS, not obligations, so this share is not one of the parts above |
| Audit verdicts | warn | RED on the first weak, wrong or unimplemented verdict, amber while a verdict is no longer current or a gated MUST is unjudged, green when every one is judged sound and current |
At a glance
| Field | Value |
|---|---|
| Public status | Supported within BMP sender scope |
| Enrolment | Enrolled |
| Requirements | 11 |
| Gated MUST-level | 10 |
| Not applicable, so out of scope | 0 |
| Declared gaps | 0 |
| Declared gaps a test demonstrates | 0 |
| Gated with no test | 0 |
| Nightly-only evidence | 0 |
| Test tags | 20 |
| Tagged units | 20 |
| Recorded audit verdicts | 7 |
| Discrimination records | 4 |
| Summary | rfc/short/rfc8671.md |
| Requirement shard | rfc/requirements/rfc8671.md |
| RFC text | rfc/full/rfc8671.txt |
Enrolment
Enrolled: Support for Adj-RIB-Out in BMP: three MUSTs over the BMP Per-Peer Header (internal/component/bgp/plugins/bmp). RFC8671-x-1 (O flag is bit 4) both polarities: PeerFlagO == 1<<4 and a flags byte with bit 4 set decodes as Adj-RIB-Out while bit 3 does not (TestRFC8671OFlagBit4). RFC8671-x-2 (when O=1 the L flag is also set) both polarities: the sent direction sets O and L (TestPeerHeaderFromEventAdjRIBOut), the received direction sets neither (TestPeerHeaderFromEventAdjRIBIn). RFC8671-x-3 (Adj-RIB-Out Peer Up carries the same OPENs as Adj-RIB-In) is {single-polarity: positive}: ze sources both OPENs from the per-peer openCache (cacheOpenPDU, recordPeerUp in bmp_events.go) independent of the O flag, proven round-tripping in TestBMPPeerUpRoundTrip. Ledger row unchanged (no gap).
What the public ledger says
Status: Supported within BMP sender scope
What the ledger says is covered:
Adj-RIB-Out direction flag handling and sent-route monitoring.What the ledger says remains
No MUST is a gap.RFC8671-6.2-1, the O flag zero on a Statistics Report, was one until the statistics-timeout timer was built (spec-bmp-statistics-timeout-sends-no-report, 2026-09-06): ze now emits a periodic Statistics Report per established peer, so the obligation is exercised and TestRFC8671StatisticsReportOnTheWireClearsTheOFlag reads the flag off a report that path produced. One feature is absent by decision, and it is not a conformance gap: ze exports the post-policy Adj-RIB-Out view only, and the pre-policy Adj-RIB-Out view is not built. RFC 7854 Section 5, which this document updates, leaves that choice to the implementation, so the two obligations conditional on the pre-policy view do not bind ze. The first is RFC8671-5.2-1, the L flag set to 0 to indicate pre-policy, annotated {feature-declined} on its checklist line in rfc/short/rfc8671.md. The second, that a mandatory attribute unknown at the pre-policy phase completion is zero or empty, is not declared as a requirement id: it is excluded at site 5.2:1 of rfc/extraction/rfc8671.json, with the kind feature-out-of-scope and the same reason. A later scope decision can revisit it and build the pre-policy view.
Coverage
| Bucket | Count | What it counts |
|---|---|---|
| Positive and negative tests | 7 | one part of the gated population |
| Annotated (including scoped evidence) | 3 | one part of the gated population |
| One polarity only | 0 | one part of the gated population |
| No test and no annotation | 0 | one part of the gated population |
| Partial proof; remaining gap (subset of annotated; zero whole-requirement credit) | 0 | an overlay: each of these is also counted by the part it falls in |
| Evidence that runs nightly only | 0 | an overlay: each of these is also counted by the part it falls in |
| Derived from other rows | 0 | outside the gated population: each asserts nothing and derives its state from the rows it names, which the parts above already count |
| Gated MUST-level requirements | 10 | every gated MUST falls in exactly one bucket above |
Positive and negative tests (7): RFC8671-x-1, RFC8671-x-2, RFC8671-4-1, RFC8671-5.1-1, RFC8671-6.1-1, RFC8671-6.3.1-1, RFC8671-7.2-1
Annotated (including scoped evidence) (3): RFC8671-x-3, RFC8671-5.2-1, RFC8671-6.2-1
Requirements
| Requirement | Level | Section | Tests |
|---|---|---|---|
RFC8671-x-1 | The per-peer header has the same structure and flags as defined in Section 4.2 of [RFC7854] with the addition of the O flag as shown here: 0 1 2 3 4 5 6 7 +-+-+-+-+-+-+-+-+ |V|L|A|O| Resv | +-+-+-+-+-+-+-+-+ * The O flag indicates Adj-RIB-In if set to 0 and Adj-RIB-Out if set to 1. (§4) | ||
| MUST | 4 - Per-Peer Header | ||
RFC8671-x-2 | The L flag MUST be set to 1 to indicate post-policy. (§5.1) | ||
| MUST | 5.1 - Post-policy | ||
RFC8671-x-3 | Peer Up and Down Notifications convey BGP peering session state to BMP receivers. The state is independent of whether or not route monitoring or route mirroring messages will be sent for Adj-RIB-In, Adj-RIB-Out, or both. (§6.3) | ||
| MUST | 6.3 - Peer Up and Down Notifications | negative
no testno negative test{single-polarity}: ze builds every Peer Up from the peer's cached sent and received OPEN messages (cacheOpenPDU and recordPeerUp in internal/component/bgp/plugins/bmp/bmp_events.go, pair.sent/pair.received) regardless of the O flag, so an Adj-RIB-Out Peer Up carries the same OPENs as an Adj-RIB-In one by construction; there is no "different OPENs for Adj-RIB-Out" case to assert as a negative. The positive (a Peer Up round-trips its sent/received OPENs) is proven in TestBMPPeerUpRoundTrip, and the independence through the producer in TestRFC8671PeerUpDoesNotDependOnTheMonitoredRIB, which primes one collector per route-monitoring policy (pre-policy, post-policy, all) over the same Established peer and finds the same Peer Up on each. The Peer Down half is proven in TestRFC8671PeerDownDoesNotDependOnTheMonitoredRIB, which drives the same down event through a plugin per policy and finds the same Peer Down, header, reason and data, on each |
|
RFC8671-x-5 | Similar to Adj-RIB-In policy validation, pre-policy Adj-RIB-Out can be used to validate and audit outbound policies. (§5.2) | ||
| MAY | 5.2 - Pre-policy | positive
no testno positive testnegative
no testno negative test |
|
RFC8671-4-1 | The existing flags are defined in Section 4.2 of [RFC7854], and the remaining bits are reserved for future use. They MUST be transmitted as 0, and their values MUST be ignored on receipt. (§4) | ||
| MUST | 4 - Per-Peer Header | ||
RFC8671-5.1-1 | Post-policy Adj-RIB-Out MUST convey to the BMP receiver what is actually transmitted to the peer (§5.1) | ||
| MUST | 5.1 - Post-policy | ||
RFC8671-5.2-1 | The L flag MUST be set to 0 to indicate pre-policy (§5.2) | ||
| MUST | 5.2 - Pre-policy | positive
no testno positive testnegative
no testno negative test{feature-declined}: "Similar to Adj-RIB-In policy validation, pre-policy Adj-RIB-Out can be used to validate and audit outbound policies."; the L flag rule binds a speaker that sends the pre-policy Adj-RIB-Out view, and ze declined that view. RFC 8671 states no obligation to offer it, and RFC 7854 Section 5, which this document updates, leaves the choice to the implementation: 'A BMP speaker may send pre-policy routes, post-policy routes, or both.' internal/component/bgp/plugins/bmp/bmp_events.go::peerHeaderFromEvent is the only producer that sets the O flag, and it sets PeerFlagO and PeerFlagL in one statement for a sent-direction event, so no ze message carries O=1 with L=0. The route-monitoring-policy leaf (internal/component/bgp/plugins/bmp/yang/ze-bmp-conf.yang) offers pre-policy (Adj-RIB-In), post-policy (Adj-RIB-Out) and all, with no pre-policy Adj-RIB-Out choice |
|
RFC8671-6.1-1 | The O flag MUST be set accordingly to indicate if the route monitor or route mirroring message conveys Adj-RIB-In or Adj-RIB-Out. (§6.1) | ||
| MUST | 6.1 - Route Monitoring and Route Mirroring | ||
RFC8671-6.2-1 | Statistics report messages are not specific to Adj-RIB-In or Adj-RIB-Out and MUST have the O flag set to zero. (§6.2) | ||
| MUST | 6.2 - Statistics Report | negative
no testno negative test{single-polarity}: the only production encoder of a Statistics Report is `senderSession.writeStatisticsReport` (internal/component/bgp/plugins/bmp/sender.go), which clears PeerFlagO on the header its caller hands in, so there is no valid ze Statistics Report carrying the O flag to reject and no negative case to construct. The positive is TestRFC8671StatisticsReportOnTheWireClearsTheOFlag (internal/component/bgp/plugins/bmp/statistics_test.go), which reports on a peer monitored for Adj-RIB-Out, reads the message off the collector socket after `sendStatisticsReports` produced it, and asserts the L flag survives so a cleared flags byte fails. It was recorded as a gap until 2026-09-06, for the reason the 2026-08-31 owner ruling gave: a green encoder test proves nothing about a requirement no production path exercises, and `statistics.go` is that path |
|
RFC8671-6.3.1-1 | When multiple Admin Labels are included, the BMP receiver MUST preserve their order (§6.3.1) | ||
| MUST | 6.3.1 - Peer Up Information | ||
RFC8671-7.2-1 | In case of any change that results in the alteration of behavior of an existing BMP session (i.e., changes to filtering and table names), the session MUST be bounced with a Peer Down/Peer Up sequence. (§7.2) | ||
| MUST | 7.2 - Changes to Existing BMP Session | ||
Gaps and untested MUSTs
| Requirement | State | Reason |
|---|---|---|
RFC8671-5.2-1 The L flag MUST be set to 0 to indicate pre-policy (§5.2) |
no test | no test carries this requirement id; annotated {feature-declined}: "Similar to Adj-RIB-In policy validation, pre-policy Adj-RIB-Out can be used to validate and audit outbound policies."; the L flag rule binds a speaker that sends the pre-policy Adj-RIB-Out view, and ze declined that view. RFC 8671 states no obligation to offer it, and RFC 7854 Section 5, which this document updates, leaves the choice to the implementation: 'A BMP speaker may send pre-policy routes, post-policy routes, or both.' internal/component/bgp/plugins/bmp/bmp_events.go::peerHeaderFromEvent is the only producer that sets the O flag, and it sets PeerFlagO and PeerFlagL in one statement for a sent-direction event, so no ze message carries O=1 with L=0. The route-monitoring-policy leaf (internal/component/bgp/plugins/bmp/yang/ze-bmp-conf.yang) offers pre-policy (Adj-RIB-In), post-policy (Adj-RIB-Out) and all, with no pre-policy Adj-RIB-Out choice |
Proof state
A tagged unit reads unproven where no discrimination record exists for it: nothing in this tree has been observed to break it, so the claim its tag makes is unproven.
RFC8671-x-1
The per-peer header has the same structure and flags as defined in Section 4.2 of [RFC7854] with the addition of the O flag as shown here: 0 1 2 3 4 5 6 7 +-+-+-+-+-+-+-+-+ |V|L|A|O| Resv | +-+-+-+-+-+-+-+-+ * The O flag indicates Adj-RIB-In if set to 0 and Adj-RIB-Out if set to 1. (§4)
Audit verdict: enforced (the tests do what the requirement demands), fresh. Re-read 2026-09-27 against the §4 quote (header layout with O in the fourth flag position; O=0 Adj-RIB-In, O=1 Adj-RIB-Out). Forbidden: O at another bit, or its meaning inverted. TestRFC8671OFlagBit4 fails if PeerFlagO != 0x10, if flags 0x10 does not decode as Adj-RIB-Out, or if 0x08 does.
| Polarity | Test | Kind and tier | Proof state |
|---|---|---|---|
| negative | TestRFC8671OFlagBit4 |
unit/verify | unproven |
| positive | TestRFC8671OFlagBit4 |
unit/verify | unproven |
RFC8671-x-2
The L flag MUST be set to 1 to indicate post-policy. (§5.1)
Audit verdict: enforced (the tests do what the requirement demands), fresh. Re-read 2026-09-27 against §5.1 'The L flag MUST be set to 1 to indicate post-policy'. Ze's Adj-RIB-Out is post-policy only. Forbidden: a post-policy Adj-RIB-Out header with L=0; TestPeerHeaderFromEventAdjRIBOut fails when the sent direction lacks PeerFlagL. TestPeerHeaderFromEventAdjRIBIn shows L is not set unconditionally.
| Polarity | Test | Kind and tier | Proof state |
|---|---|---|---|
| negative | TestPeerHeaderFromEventAdjRIBIn |
unit/verify | unproven |
| positive | TestPeerHeaderFromEventAdjRIBOut |
unit/verify | unproven |
RFC8671-x-3
Peer Up and Down Notifications convey BGP peering session state to BMP receivers. The state is independent of whether or not route monitoring or route mirroring messages will be sent for Adj-RIB-In, Adj-RIB-Out, or both. (§6.3)
Audit verdict: enforced (the tests do what the requirement demands), fresh. Re-judged 2026-10-13. TestRFC8671PeerDownDoesNotDependOnTheMonitoredRIB changed by setup only: recordPeerUpFor seeds the Peer Up that RFC 7854 Section 3.3 now requires before a Peer Down, identically under pre-policy, post-policy and all, so the comparison of presence, per-peer header, reason and data across the three policies is unchanged and still runs through handleSenderState. TestRFC8671PeerUpDoesNotDependOnTheMonitoredRIB (identical header, both OPENs, transport fields through primeSender) and rfc8671_msg_test.go::TestBMPPeerUpRoundTrip unchanged. {single-polarity: positive} holds.
| Polarity | Test | Kind and tier | Proof state |
|---|---|---|---|
| positive | TestBMPPeerUpRoundTrip |
unit/verify | revert, verified |
| positive | TestRFC8671PeerDownDoesNotDependOnTheMonitoredRIB |
unit/verify | revert, verified |
| positive | TestRFC8671PeerUpDoesNotDependOnTheMonitoredRIB |
unit/verify | revert, verified |
RFC8671-4-1
The existing flags are defined in Section 4.2 of [RFC7854], and the remaining bits are reserved for future use. They MUST be transmitted as 0, and their values MUST be ignored on receipt. (§4)
Audit verdict: enforced (the tests do what the requirement demands), fresh. Re-read 2026-09-27. Transmit clause: TestRFC8671ReservedPeerFlagsTransmittedAsZero fails if peerHeaderFromEvent, locRIBPeerHeader or the byte writePeerHeader puts on the wire carries a reserved bit. Receipt clause: TestRFC8671ReservedPeerFlagsIgnoredOnReceipt fails if a header with every reserved bit set is refused or changes a defined flag, over two bases.
| Polarity | Test | Kind and tier | Proof state |
|---|---|---|---|
| negative | TestRFC8671ReservedPeerFlagsIgnoredOnReceipt |
unit/verify | unproven |
| positive | TestRFC8671ReservedPeerFlagsTransmittedAsZero |
unit/verify | unproven |
RFC8671-5.1-1
Post-policy Adj-RIB-Out MUST convey to the BMP receiver what is actually transmitted to the peer (§5.1)
Audit verdict: not audited: no reader has judged these tests
| Polarity | Test | Kind and tier | Proof state |
|---|---|---|---|
| negative | TestRFC8671AdjRIBOutConveysNoUntransmittedUpdate |
unit/verify | unproven |
| negative | TestRFC8671PostPolicyConveysUnknownAttributeUnchanged |
unit/verify | unproven |
| positive | TestRFC8671PostPolicyConveysTransmittedBytes |
unit/verify | unproven |
RFC8671-5.2-1
The L flag MUST be set to 0 to indicate pre-policy (§5.2)
Audit verdict: not audited: no reader has judged these tests
No test carries RFC8671-5.2-1, so no unit is bound to it.
RFC8671-6.1-1
The O flag MUST be set accordingly to indicate if the route monitor or route mirroring message conveys Adj-RIB-In or Adj-RIB-Out. (§6.1)
Audit verdict: enforced (the tests do what the requirement demands), fresh. Re-read 2026-09-27. Forbidden: O not matching the RIB conveyed on Route Monitoring or Route Mirroring. TestRFC8671OFlagSetOnAdjRIBOutMessages fails if either message for a sent UPDATE lacks O; TestRFC8671OFlagClearOnAdjRIBInMessages fails if either for a received UPDATE carries it. Both read off the collector pipe after handleStructuredEvent.
| Polarity | Test | Kind and tier | Proof state |
|---|---|---|---|
| negative | TestRFC8671OFlagClearOnAdjRIBInMessages |
unit/verify | unproven |
| positive | TestRFC8671OFlagSetOnAdjRIBOutMessages |
unit/verify | unproven |
RFC8671-6.2-1
Statistics report messages are not specific to Adj-RIB-In or Adj-RIB-Out and MUST have the O flag set to zero. (§6.2)
Audit verdict: enforced (the tests do what the requirement demands), fresh. Re-read 2026-09-27. Forbidden: a Statistics Report with O=1. TestRFC8671StatisticsReportOnTheWireClearsTheOFlag fails when the report sendStatisticsReports puts on the collector pipe carries PeerFlagO for a peer whose header holds O, and asserts L survives. Single polarity is declared on the row.
| Polarity | Test | Kind and tier | Proof state |
|---|---|---|---|
| positive | TestRFC8671StatisticsReportOnTheWireClearsTheOFlag |
unit/verify | revert, verified |
RFC8671-6.3.1-1
When multiple Admin Labels are included, the BMP receiver MUST preserve their order (§6.3.1)
Audit verdict: not audited: no reader has judged these tests
| Polarity | Test | Kind and tier | Proof state |
|---|---|---|---|
| negative | TestRFC8671AdminLabelReversedOrderPreserved |
unit/verify | unproven |
| positive | TestRFC8671AdminLabelOrderPreserved |
unit/verify | unproven |
RFC8671-7.2-1
In case of any change that results in the alteration of behavior of an existing BMP session (i.e., changes to filtering and table names), the session MUST be bounced with a Peer Down/Peer Up sequence. (§7.2)
Audit verdict: enforced (the tests do what the requirement demands), fresh. Re-read 2026-09-27. Forbidden: a behaviour-altering change (the RFC's i.e.: filtering, table names) without a Peer Down/Peer Up per peer. Filtering: TestRFC8671BehaviorChangeBouncesEachPeerAndKeepsTheSession fails unless each of two peers gets exactly one Peer Down then one Peer Up after a route-monitoring-policy change through the engine reload rail. Table names: the Loc-RIB table name is the constant locRIBTableName, so no change can occur. Negatives: TestRFC8671UnrelatedBGPChangeBouncesNothing, TestRFC8671RemovingEveryCollectorBouncesTheSession. Not asserted: that other behavior leaves (route-mirroring, loc-rib) also bounce.
| Polarity | Test | Kind and tier | Proof state |
|---|---|---|---|
| negative | TestRFC8671RemovingEveryCollectorBouncesTheSession |
unit/verify | unproven |
| negative | TestRFC8671UnrelatedBGPChangeBouncesNothing |
unit/verify | unproven |
| positive | TestRFC8671BehaviorChangeBouncesEachPeerAndKeepsTheSession |
unit/verify | unproven |
Extraction sign-off
| Field | Value |
|---|---|
| Reviewer | ze-fix agent, false public conformance claim on rfc8671, section 5.2 re-walked 2026-09-05 |
| Signed off | 2026-09-05 |
| Register | rfc2119 |
| Source | rfc/full/rfc8671.txt |
| Source fingerprint | aed5ce37b74c3a4d |
| Record | rfc/extraction/rfc8671.json |
| Mapped sentences | 8 |
| Declined as scope | 2 |
| Relocated to a spec, which Ze OWES | 0 |
| Unclassified | 0 |
Sections
| Section | Name | Sites | Disposition | Reason |
|---|---|---|---|---|
front |
not stated | 0 | skipped (front-matter) | Title block, Abstract, Status of This Memo, Copyright Notice and Table of Contents. The Abstract restates section 1 and states no obligation. |
1 |
Introduction | 0 | walked | Introduction. Indicative prose: what BMP monitors today, why an operator cannot see what it advertises, and that this document updates the per-peer header of RFC 7854 Section 4.2 with a new flag. No sentence directs a speaker. |
2 |
Terminology | 0 | walked | Terminology. The BCP 14 key-words paragraph, which binds the key words only when they appear in all capitals. It tells a reader how to read the other sections and binds no speaker, which is why the derivation excludes it from the site inventory. |
3 |
Definitions | 1 | walked | Definitions. Three terms: Adj-RIB-Out quoted from RFC 4271, pre-policy Adj-RIB-Out and post-policy Adj-RIB-Out. The one capitalised keyword sits in the post-policy definition and repeats section 5.1 word for word, so it is excluded below as a duplicate. |
4 |
Per-Peer Header | 1 | walked | Per-Peer Header. Adds the O flag to the RFC 7854 Section 4.2 flags field and redefines Peer Address, Peer AS, Peer BGP ID and Timestamp for O=1. The bit position and the meaning of the flag are stated indicatively ('The O flag indicates Adj-RIB-In if set to 0 and Adj-RIB-Out if set to 1') and in the bit diagram, so section 2 gives them no RFC 2119 level and the site scan cannot see them; RFC8671-x-1 is read from there and is listed as unsourced. The one site is the reserved-bits sentence, mapped below. The four redefined fields are value definitions carried by the O Flag table of rfc/short/rfc8671.md, not directives. |
5 |
Adj-RIB-Out | 0 | walked | Adj-RIB-Out. A heading with no body text: 5.1 and 5.2 carry the whole section. |
5.1 |
Post-policy | 2 | walked | Post-policy. States the primary use case, then two capitalised MUSTs, both mapped below. The rest is indicative: which attributes are set at transmission time, and what post-policy reflects. |
5.2 |
Pre-policy | 2 | walked | Pre-policy. Two capitalised MUSTs. Site 5.2:2 is mapped to RFC8671-5.2-1 and site 5.2:1 is excluded below. Each is conditional on the pre-policy Adj-RIB-Out view, an OPTIONAL feature ze declined, and the RFC8671-5.2-1 line of rfc/short/rfc8671.md carries the {feature-declined} annotation that records the decision. Until 2026-09-05 both sites read excluded as binding a role ze does not implement, which the presumed-wrong ruling on binds-another-role bans for a role ze fills: ze IS the BMP sender. The remaining prose is indicative: what the candidate route set holds for each peering session type, and that a null or loopback next hop is common before transmission. RFC8671-x-5 records that pre-policy Adj-RIB-Out is permitted and uncommon; that is read from this section's indicative prose, so it is listed as unsourced. |
6 |
BMP Messages | 0 | walked | BMP Messages. Two sentences. The first says some messages carrying a per-peer header are not applicable to the Adj-RIB-In or Adj-RIB-Out distinction, and names Peer Up and Peer Down. The second, 'Unless otherwise defined, the O flag should be set to 0 in the per-peer header in BMP messages', uses a lowercase 'should', so under section 2 it carries no RFC 2119 level and the site scan does not see it. ze meets it anyway: peerHeaderFromEvent sets the O flag only for a sent-direction event, so a Peer Up, a Peer Down and a Loc-RIB message all carry O=0. |
6.1 |
Route Monitoring and Route Mirroring | 1 | walked | Route Monitoring and Route Mirroring. One sentence, one capitalised MUST, mapped below. |
6.2 |
Statistics Report | 1 | walked | Statistics Report. One capitalised MUST, excluded below, then the four new Stat Types 14 to 17 as value definitions. Its second sentence, 'The O flag SHOULD be ignored by the BMP receiver', is a SHOULD and never gates; ze's receiver meets it, because decodeStatisticsReport reads the per-peer header and processStatisticsReport stores the entries without consulting the O flag. |
6.3 |
Peer Up and Down Notifications | 0 | walked | Peer Up and Down Notifications. No capitalised MUST-level keyword. Two indicative sentences and one SHOULD: the peering state a Peer Up or Peer Down conveys 'is independent of whether or not route monitoring or route mirroring messages will be sent for Adj-RIB-In, Adj-RIB-Out, or both', and a receiver SHOULD ignore the O flag on these two messages. RFC8671-x-3, which records that an Adj-RIB-Out Peer Up carries the same sent and received OPEN messages as an Adj-RIB-In one, is read from that independence sentence, so it is listed as unsourced. RFC8671-x-4 is NOT listed: it records that one BGP session MAY produce two Peer Up messages, and no sentence of RFC 8671 says that. It is a MAY, so it gates nothing and the reverse arithmetic asks no home for it. |
6.3.1 |
Peer Up Information | 1 | walked | Peer Up Information. Defines Peer Up Information TLV type 4, Admin Label: a free-form UTF-8 string, administratively assigned, with no terminator required. One capitalised MUST on the order of multiple labels, mapped below. The type number is a value definition and the last sentence, 'The Admin Label is optional', removes any obligation to send one. |
7 |
Other Considerations | 0 | walked | Other Considerations. A heading with no body text. |
7.1 |
Peer and Update Groups | 0 | walked | Peer and Update Groups. Indicative prose on why a BMP sender cannot publish a simple peer group name, and why the Admin Label of section 6.3.1 answers the same need. Its last sentence puts label configuration and assignment outside the document. No directive. |
7.2 |
Changes to Existing BMP Session | 1 | walked | Changes to Existing BMP Session. One sentence, one capitalised MUST, mapped below to RFC8671-7.2-1. |
8 |
Security Considerations | 0 | walked | Security Considerations. Imports Section 11 of RFC 7854, states that an implementation SHOULD require sessions with authorized and trusted monitoring devices, and states that this document adds no further consideration. The SHOULD is advisory and never gates. |
9 |
IANA Considerations | 0 | skipped (iana) | IANA Considerations. Names the registry the three subsections write to. |
9.1 |
Addition to the BMP Peer Flags registry: flag 3, the O flag | 0 | skipped (iana) | Addition to the BMP Peer Flags registry: flag 3, the O flag. Binds IANA, not a speaker. |
9.2 |
not stated | 0 | skipped (iana) | Additions to the BMP Statistics Types registry: types 14 to 17. Binds IANA, not a speaker. |
9.3 |
not stated | 0 | skipped (iana) | Addition to the BMP Initiation Message TLVs registry: type 4, Admin Label. Binds IANA, not a speaker. |
10 |
Normative References: RFC 2119, RFC 4271, RFC 7854, RFC 8174 | 0 | skipped (references) | Normative References: RFC 2119, RFC 4271, RFC 7854, RFC 8174. The section also absorbs the Acknowledgements, Contributors and Authors' Addresses blocks, none of which states an obligation. |
Excluded sentences
| Site | Excluded kind | Reason | Quote |
|---|---|---|---|
3:1 |
duplicate-ofnever bound Ze the same obligation is already captured under another requirement id |
The Definitions entry for post-policy Adj-RIB-Out closes with the same sentence section 5.1 states: 'This MUST convey to the BMP receiver what is actually transmitted to the peer.' Site 5.1:1 maps that obligation to RFC8671-5.1-1. One obligation, written twice. | This MUST convey to the BMP receiver what is actually transmitted to the peer. |
5.2:1 |
feature-out-of-scopenever bound Ze the RFC makes a feature OPTIONAL, Ze decided not to offer it, and this obligation is conditional on offering it |
The obligation is CONDITIONAL on the pre-policy Adj-RIB-Out view, an OPTIONAL feature ze decided not to offer, so it is excluded rather than declared. The sentence binds a speaker only at 'the pre-policy phase completion', which ze never reaches. RFC 8671 states no obligation to offer the pre-policy view, and RFC 7854 Section 5, which this document updates, leaves the choice to the implementation: 'A BMP speaker may send pre-policy routes, post-policy routes, or both.' peerHeaderFromEvent (internal/component/bgp/plugins/bmp/bmp_events.go) is the only producer that sets the O flag, and it sets PeerFlagO and PeerFlagL in one statement for a sent-direction event, so O=1 with L=0 is unreachable; the route-monitoring-policy leaf (yang/ze-bmp-conf.yang) offers pre-policy (Adj-RIB-In), post-policy (Adj-RIB-Out) and all, with no pre-policy Adj-RIB-Out choice. ze holds no route at a pre-policy phase for which it would have to zero or empty a mandatory attribute. This is a SCOPE DECISION and not outstanding work. The absent feature is disclosed on the summary's Support status and Support remaining rows, which name this site, and never as a conformance gap. It is NOT declared as a requirement id: rfc8671 derives 10 capitalised keyword sites and its summary already declares 10 gated requirements, two of them read from indicative prose and recorded in unsourced-ids, so an eleventh declaration would push DeriveRegister (internal/le/rfc/inventory.go) off the rfc2119 grade this source supports. | All mandatory attributes, such as next hop, MUST be either zero or have an empty length if they are unknown at the pre-policy phase completion. |
Superseded
No document obsoletes RFC 8671, so its obligations are stated where they were written.