#MoonRouteGuard

#Run locally

git clone https://github.com/Wyh123456559/MoonRouteGuard.git
cd MoonRouteGuard
moon test --target js
moon run --target js src/cmd/routeguard -- --help
moon run --target js src/cmd/routeguard -- examples/before.csv examples/after.csv examples/routes.csv

#What works

• strict parsing of canonical IPv4 CIDR prefixes;
• IPv6 CIDR parsing, RFC 5952 formatting, and 128-bit prefix containment;
• VRP validation for prefix length and maxLength consistency;
• RFC 6811 Valid, Invalid, and NotFound route states;
• separate evidence for origin-AS and maximum-length mismatches;
• correct handling of overlapping VRPs where any authorizing payload makes the route valid;
• Routinator csv and quoted csvcompat VRP input with trust-anchor labels;
• mixed IPv4/IPv6 Routinator CSV parsing through a separate dual-stack API;
• two-column IPv4 route CSV input with line-numbered diagnostics;
• mixed IPv4/IPv6 route CSV parsing for batch assessment;
• deterministic Routinator csv and csvcompat output with round-trip safety;
• recoverable, line-numbered diagnostics for malformed or unsupported rows;
• set-based comparison of complete VRP snapshots, including trust-anchor changes, duplicate suppression, and hash-indexed membership checks;
• order-preserving batch route validation;
• indexed validation with at most 33 prefix-key lookups per IPv4 route;
• IPv6 VRP validation and an index with at most 129 prefix-key lookups per route;
• route-impact analysis across VRP snapshots with old and new evidence;
• IPv6 snapshot comparison and indexed route-impact analysis;
• human-readable explanations for each route transition, including every covering VRP and ASN or prefix-length mismatch;
• dual-stack Node.js command-line assessment of three CSV files, with an optional failure exit code for newly invalid routes;
• RFC 8416 IPv4/IPv6 SLURM policy rollout and rollback simulation in the command-line assessment;
• deterministic JSON assessment reports with exact added/removed VRP records, trust-anchor labels, and old/new route evidence;
• RFC 8416 IPv4/IPv6 prefix filters and locally added assertions;
• strict RFC 8416 JSON parsing with atomic configuration rejection;
• deterministic RFC 8416 JSON output with parse/write round-trip safety;
• RFC 8210 version 1 control and IPv4/IPv6 prefix PDU encoding and decoding;
• portable library code without filesystem or network dependencies.

#Example

let payload = @moonrouteguard.Vrp::new(
  @moonrouteguard.Ipv4Prefix::parse("203.0.113.0/24").unwrap(),
  24,
  64496U,
).unwrap()
let route = @moonrouteguard.RouteAnnouncement::new(
  @moonrouteguard.Ipv4Prefix::parse("203.0.113.0/24").unwrap(),
  64496U,
)
let decision = @moonrouteguard.validate_route(route, [payload])
println(decision.summary())

let csv =
  #|ASN,IP Prefix,Max Length,Trust Anchor
  #|AS64496,203.0.113.0/24,24,arin
let parsed = @moonrouteguard.parse_vrp_csv(csv)
if parsed.is_valid() {
  let payloads = parsed.records.map(record => record.vrp)
  let decisions = @moonrouteguard.validate_routes([route], payloads)
  println(decisions[0].summary())
}

moon run --target js src/cmd/routeguard -- examples/before.csv examples/after.csv examples/routes.csv
moon run --target js src/cmd/routeguard -- --json examples/before-dual.csv examples/after-dual.csv examples/routes-dual.csv
moon run --target js src/cmd/routeguard -- --json --slurm examples/slurm-dual.json examples/before-dual.csv examples/after-dual.csv examples/routes-dual.csv
moon run --target js src/cmd/routeguard -- --fail-on-valid-loss examples/before.csv examples/withdrawn.csv examples/routes.csv
moon check --target wasm --deny-warn
moon test --target wasm --deny-warn
moon test --target js --deny-warn

1. For CI that needs the exact code, build with moon build --target js and run node _build/js/debug/build/cmd/routeguard/routeguard.js with the same arguments. Pass --fail-on-valid-loss to also treat a transition from Valid to either Invalid or NotFound as a failed check. The two gates can be combined; either condition uses exit code 3. The examples/withdrawn.csv command above shows a Valid-to-NotFound regression that --fail-on-new-invalid alone would not stop. Text reports show the total number of routes losing Valid status, and each address family's JSON routeImpact section includes validLosses alongside newlyInvalid. Both gates inspect only the supplied route CSV. A successful check is not a claim that every route in the global BGP table has been assessed. The CLI reads mixed IPv4/IPv6 CSV input and requires Node.js; the library remains portable across Wasm, Wasm-GC, and JavaScript. CLI reports group IPv4 and IPv6 transitions by address family rather than preserving interleaved route-row order. Added and removed snapshot records include their trust-anchor labels. Covering VRPs inside route decisions do not yet carry source labels because the current validation decision model retains payloads but not their provenance.

let prefix = @moonrouteguard.Ipv6Prefix::parse("2001:db8::/32").unwrap()
let payload = @moonrouteguard.Ipv6Vrp::new(prefix, 48, 64496U).unwrap()
let route = @moonrouteguard.Ipv6RouteAnnouncement::new(
  @moonrouteguard.Ipv6Prefix::parse("2001:db8:1::/48").unwrap(),
  64496U,
)
let index = @moonrouteguard.Ipv6VrpIndex::new([payload])
println(index.validate(route).summary())

ASN,IP Prefix
AS64496,203.0.113.0/24
AS64500,198.51.100.0/24

let output = @moonrouteguard.write_vrp_csv(
  parsed.records,
  @moonrouteguard.RoutinatorCsvCompat,
).unwrap()

let diff = @moonrouteguard.compare_snapshots(old.records, current.records)
println(diff.summary()) // +12 -3 (148921 unchanged)

let vrps = current.records.map(record => record.vrp)
let index = @moonrouteguard.VrpIndex::new(vrps)
let decision = index.validate(route)

let impact = @moonrouteguard.assess_snapshot_impact(
  routes,
  old_payloads,
  current_payloads,
)
for change in impact.changed {
  println(change.summary())
}

let filter = @moonrouteguard.SlurmPrefixFilter::by_asn(64496U)
let assertion = @moonrouteguard.slurm_assertion(prefix, 64500U).unwrap()
let local = @moonrouteguard.apply_slurm(payloads, [filter], [assertion])
let index = @moonrouteguard.VrpIndex::new(local.vrps)

let policy = @moonrouteguard.parse_slurm_json(source).unwrap()
let local = policy.apply(payloads)
let ipv6_local = policy.apply_ipv6(ipv6_payloads)

let normalized = @moonrouteguard.write_slurm_json(policy)

let query = @moonrouteguard.encode_rtr_pdu(
  @moonrouteguard.SerialQuery(42, 7U),
).unwrap()
let response = @moonrouteguard.decode_rtr_pdus(received_bytes).unwrap()

#Next steps

#License