Mailing List Archive

1 2  View All
Re: Netiron AS4 capabilities [ In reply to ]
Thank you, I will not argue anymore as there is not so much interest from Mikrotik.
Yes, RR is an option, but a bad RR implementation is worst than no RR.

Mikrotik last answer is related to the BIRD/FRR issue from 2021:

"That bird problem is completely unrelated. They did not use 2bytes for the length field when extended length bit was set. RouterOS does not do that, length is encoded properly.”

Unfortunately we do not have any support for the CERs and ICXs we have within our network since Brocade got split in many pieces so we cannot ask Extreme Networks anything regarding CER. We do have 2+ years sessions up the CER’s, I cannot say nothing wrong about Netiron.

In the last days I’ve been testing Mikrotik’s CHR 6 release, Junipers vRR, Cisco IOS xRV, none of these generate issues to the CER and neither are affected by the Mikrotik. The only software in my testing that was affected by this is the Netiron, Dell 4032F prints the error and discards the prefix.

Thank you again for your great interest in this issue.

> On 30 Jun 2023, at 17:08, Jörg Kost <jk@ip-clear.de> wrote:
>
> There is a difference if you have to read an unsigned int 16 or unsigned eight from the packet stream, and flags are set to 1 by default, which is not found in the standard.
>
> Also, as a counterexample, looking at the FRR open source code ensures that extended flags are only set if used and corresponding integers are read/written.
>
> I'm just afraid that arguing won't help in your case. It is, of course, a great pity that the manufacturer does not seem to care about the interoperability of its device. The handling will then probably also affect other areas and Co. That doesn't look very customer friendly. Luckily you can choose your manufacturer.
>
> Of course, you can also open a ticket with Extreme again if you sign a valid support contract. Which I always appreciate with Brocade and now Extreme; once you get past the first barrier of "do you think it's a bug?", you quickly have contact with support or engineering, who can really familiarize themselves with your problem and ultimately fix it. In addition, there is the first-class release/change log, where every small bug can also be found.
>
> Unfortunately, in the early days of the SLX, we found and reported many "startup" bugs, and everything was always fixed, it's running for good now. And with NetIron systems, we have BGP sessions with 900 days and more uptime...
>
> In this sense:
> Buy something good with appropriate support :-)
>
>
>
>
> On 30 Jun 2023, at 14:41, Bogdan-Stefan Rotariu wrote:
>
>> Ok, so, this is te answer from Mikrotik regarding the extended-length.
>>
>> "extended length" is not really related to this issue. That flag only signals how length value is encoded. "extended length" does not determine on how ASNs are encoded.
>>
>> Regarding length itself, RFC does not define that extended length attribute MUST not be used when length is less than 255. "MAY" and "MUST" meaning is not the same.
>>
Re: Netiron AS4 capabilities [ In reply to ]
Thank you, can you please detail "What happens if you peer MT:CER with the CER using AS23456.” ?

> On 1 Jul 2023, at 02:17, Tim Warnock <timoid@timoid.org> wrote:
>
> So reading all that - if the CER advertises the capability that it can talk "NEW BGP" as per RFC6793 but then barfs on an UPDATE that matches RFC6793 specifications then the bug must be in the CER.
>
> I'm surprised this hasn't been a bigger problem to date, TBH.
>
> What happens if you peer MT:CER with the CER using AS23456.
>
> Does the MT then switch to "OLD BGP" mode?
>
> -----Original Message-----
> From: foundry-nsp <foundry-nsp-bounces@puck.nether.net> On Behalf Of Jörg Kost
> Sent: Saturday, July 1, 2023 12:09 AM
> To: Bogdan-Stefan Rotariu <bogdan@rotariu.ro>
> Cc: foundry-nsp@puck.nether.net
> Subject: Re: [f-nsp] Netiron AS4 capabilities
>
> There is a difference if you have to read an unsigned int 16 or unsigned eight from the packet stream, and flags are set to 1 by default, which is not found in the standard.
>
> Also, as a counterexample, looking at the FRR open source code ensures that extended flags are only set if used and corresponding integers are read/written.
>
> I'm just afraid that arguing won't help in your case. It is, of course, a great pity that the manufacturer does not seem to care about the interoperability of its device. The handling will then probably also affect other areas and Co. That doesn't look very customer friendly. Luckily you can choose your manufacturer.
>
> Of course, you can also open a ticket with Extreme again if you sign a valid support contract. Which I always appreciate with Brocade and now Extreme; once you get past the first barrier of "do you think it's a bug?", you quickly have contact with support or engineering, who can really familiarize themselves with your problem and ultimately fix it. In addition, there is the first-class release/change log, where every small bug can also be found.
>
> Unfortunately, in the early days of the SLX, we found and reported many "startup" bugs, and everything was always fixed, it's running for good now. And with NetIron systems, we have BGP sessions with 900 days and more uptime...
>
> In this sense:
> Buy something good with appropriate support :-)
>


_______________________________________________
foundry-nsp mailing list
foundry-nsp@puck.nether.net
http://puck.nether.net/mailman/listinfo/foundry-nsp
Re: Netiron AS4 capabilities [ In reply to ]
Well, the weekend is here, and I was able to test and recreate it.

With MLX, the behavior is like with CER
-> BGP DOWN (Attribute Flags Error)

On SLX, the behavior is only a warning.
-> received invalid AGGREGATOR attribute flag (0xd0).
-> However, the actual route is installed, and the session stays up.

To recreate this, I had to actively change the BGP source code of FRR as peer so that it is forced to set an extending length flag for AGGREGATOR Attribute and writes a 16-bit value accordingly.

That's why I give the following verdict :-)
In the name of interoperability when introducing new products and since the Internet consists of many different manufacturers and devices and when it comes to peers, the lowest denominator can sometimes be the best, it would be appropriate to let Mikrotik know to persuade them to do without flagging and the 16 bits in the aggregator. That's also better before people switch to the new Mikrotik version and crash a lot of sessions with NetIrons or maybe other manufacturers. Since the AGGREGATOR attribute has a length 8, an extending length is unnecessary.

However, because I also have support for MLX and SLX, I will submit this as a request when I get a chance. I am sure Extreme will adjust the SLX (different log?) if necessary, but probably not the behavior for NetIron.


On 1 Jul 2023, at 13:58, Bogdan Rotariu wrote:

> Thank you, I will not argue anymore as there is not so much interest from Mikrotik.
> Yes, RR is an option, but a bad RR implementation is worst than no RR.
>
> Mikrotik last answer is related to the BIRD/FRR issue from 2021:
>
> "That bird problem is completely unrelated. They did not use 2bytes for the length field when extended length bit was set. RouterOS does not do that, length is encoded properly.”
>
> Unfortunately we do not have any support for the CERs and ICXs we have within our network since Brocade got split in many pieces so we cannot ask Extreme Networks anything regarding CER. We do have 2+ years sessions up the CER’s, I cannot say nothing wrong about Netiron.
>
> In the last days I’ve been testing Mikrotik’s CHR 6 release, Junipers vRR, Cisco IOS xRV, none of these generate issues to the CER and neither are affected by the Mikrotik. The only software in my testing that was affected by this is the Netiron, Dell 4032F prints the error and discards the prefix.
>
> Thank you again for your great interest in this issue.
_______________________________________________
foundry-nsp mailing list
foundry-nsp@puck.nether.net
http://puck.nether.net/mailman/listinfo/foundry-nsp
Re: Netiron AS4 capabilities [ In reply to ]
Thank you for your time and your interest in solving this issue.
Your test added light to the issue, I will forward to Mikrotik the information received from you, maybe they will care and do something in the future updates.

Could you please share the patch for FRR so I can replicate the issue with FRR too?

> On 1 Jul 2023, at 17:20, Jörg Kost <jk@ip-clear.de> wrote:
>
> Well, the weekend is here, and I was able to test and recreate it.
>
> With MLX, the behavior is like with CER
> -> BGP DOWN (Attribute Flags Error)
>
> On SLX, the behavior is only a warning.
> -> received invalid AGGREGATOR attribute flag (0xd0).
> -> However, the actual route is installed, and the session stays up.
>
> To recreate this, I had to actively change the BGP source code of FRR as peer so that it is forced to set an extending length flag for AGGREGATOR Attribute and writes a 16-bit value accordingly.
>
> That's why I give the following verdict :-)
> In the name of interoperability when introducing new products and since the Internet consists of many different manufacturers and devices and when it comes to peers, the lowest denominator can sometimes be the best, it would be appropriate to let Mikrotik know to persuade them to do without flagging and the 16 bits in the aggregator. That's also better before people switch to the new Mikrotik version and crash a lot of sessions with NetIrons or maybe other manufacturers. Since the AGGREGATOR attribute has a length 8, an extending length is unnecessary.
>
> However, because I also have support for MLX and SLX, I will submit this as a request when I get a chance. I am sure Extreme will adjust the SLX (different log?) if necessary, but probably not the behavior for NetIron.
>
>
> On 1 Jul 2023, at 13:58, Bogdan Rotariu wrote:
>
>> Thank you, I will not argue anymore as there is not so much interest from Mikrotik.
>> Yes, RR is an option, but a bad RR implementation is worst than no RR.
>>
>> Mikrotik last answer is related to the BIRD/FRR issue from 2021:
>>
>> "That bird problem is completely unrelated. They did not use 2bytes for the length field when extended length bit was set. RouterOS does not do that, length is encoded properly.”
>>
>> Unfortunately we do not have any support for the CERs and ICXs we have within our network since Brocade got split in many pieces so we cannot ask Extreme Networks anything regarding CER. We do have 2+ years sessions up the CER’s, I cannot say nothing wrong about Netiron.
>>
>> In the last days I’ve been testing Mikrotik’s CHR 6 release, Junipers vRR, Cisco IOS xRV, none of these generate issues to the CER and neither are affected by the Mikrotik. The only software in my testing that was affected by this is the Netiron, Dell 4032F prints the error and discards the prefix.
>>
>> Thank you again for your great interest in this issue.


_______________________________________________
foundry-nsp mailing list
foundry-nsp@puck.nether.net
http://puck.nether.net/mailman/listinfo/foundry-nsp
Re: Netiron AS4 capabilities [ In reply to ]
Hello,

I have submitted the findings on Github. May I include your PCAP?
https://github.com/ipcjk/mikrotikSLXMLX

I will also forward and create a support request later on with Extreme and ask for their opinion.

BR
Jörg



On 1 Jul 2023, at 23:58, Bogdan Rotariu wrote:

> Thank you for your time and your interest in solving this issue.
> Your test added light to the issue, I will forward to Mikrotik the information received from you, maybe they will care and do something in the future updates.
>
> Could you please share the patch for FRR so I can replicate the issue with FRR too?
_______________________________________________
foundry-nsp mailing list
foundry-nsp@puck.nether.net
http://puck.nether.net/mailman/listinfo/foundry-nsp
Re: Netiron AS4 capabilities [ In reply to ]
Hi,

It "looks like" something I got last october, when upgrading one of my
router to ROS7. Network was consisting of 3 Mikrotiks, and 1 Edgerouter
infinity: When the ROS7 exports routes learnt from one of their
transit, the Edgerouter (Vyatta) resets its IBGP session.
https://twitter.com/acontios_net/status/1580915560074055680/photo/1

I didn't dig much, as it was a "toy asn" and discarded input updates
from the ROS7 transit link, but I feel that ROS7 behaviour is incorrect
regarding aggregator flag.


Best regards,

Clément Cavadore

On Sun, 2023-07-02 at 11:06 +0200, Jörg Kost wrote:
> Hello,
>
> I have submitted the findings on Github. May I include your PCAP?
> https://github.com/ipcjk/mikrotikSLXMLX
>
> I will also forward and create a support request later on with
> Extreme and ask for their opinion.
>
> BR
> Jörg
>
>
>
> On 1 Jul 2023, at 23:58, Bogdan Rotariu wrote:
>
> > Thank you for your time and your interest in solving this issue.
> > Your test added light to the issue, I will forward to Mikrotik the
> > information received from you, maybe they will care and do
> > something in the future updates.
> >
> > Could you please share the patch for FRR so I can replicate the
> > issue with FRR too?
> _______________________________________________
> foundry-nsp mailing list
> foundry-nsp@puck.nether.net
> http://puck.nether.net/mailman/listinfo/foundry-nsp

_______________________________________________
foundry-nsp mailing list
foundry-nsp@puck.nether.net
http://puck.nether.net/mailman/listinfo/foundry-nsp
Re: Netiron AS4 capabilities [ In reply to ]
Oh yes, that looks similar. In line two, the parser complains that the expected flags do not match those of the incoming flags for the aggregator attribute.

And then, especially in line 3, does the parser then try to read from the wrong offset for routes? Whoops! At least that shouldn't happen.

Anyway, I just opened a case for MLXe. Let's see what the Extreme Engineers have to say about it. MLXe has Software Maintenance until 7/31/2025 and End of Service until 7/31/2027. And maybe they can still find a solution for both platforms.

On 2 Jul 2023, at 11:36, Clement Cavadore wrote:

> Hi,
>
> It "looks like" something I got last october, when upgrading one of my
> router to ROS7. Network was consisting of 3 Mikrotiks, and 1 Edgerouter
> infinity: When the ROS7 exports routes learnt from one of their
> transit, the Edgerouter (Vyatta) resets its IBGP session.
> https://twitter.com/acontios_net/status/1580915560074055680/photo/1
>
> I didn't dig much, as it was a "toy asn" and discarded input updates
> from the ROS7 transit link, but I feel that ROS7 behaviour is incorrect
> regarding aggregator flag.
>
>
> Best regards,
>
> Clément Cavadore
>
> On Sun, 2023-07-02 at 11:06 +0200, Jörg Kost wrote:
>> Hello,
>>
>> I have submitted the findings on Github. May I include your PCAP?
>> https://github.com/ipcjk/mikrotikSLXMLX
>>
>> I will also forward and create a support request later on with
>> Extreme and ask for their opinion.
>>
>> BR
>> Jörg
>>
>>
>>
>> On 1 Jul 2023, at 23:58, Bogdan Rotariu wrote:
>>
>>> Thank you for your time and your interest in solving this issue.
>>> Your test added light to the issue, I will forward to Mikrotik the
>>> information received from you, maybe they will care and do
>>> something in the future updates.
>>>
>>> Could you please share the patch for FRR so I can replicate the
>>> issue with FRR too?
>> _______________________________________________
>> foundry-nsp mailing list
>> foundry-nsp@puck.nether.net
>> http://puck.nether.net/mailman/listinfo/foundry-nsp
_______________________________________________
foundry-nsp mailing list
foundry-nsp@puck.nether.net
http://puck.nether.net/mailman/listinfo/foundry-nsp
Re: Netiron AS4 capabilities [ In reply to ]
Hi,

Cool, yes, you can use the dump wihout any problems.

Thank you!

> On 2 Jul 2023, at 12:06, Jörg Kost <jk@ip-clear.de> wrote:
>
> Hello,
>
> I have submitted the findings on Github. May I include your PCAP?
> https://github.com/ipcjk/mikrotikSLXMLX
>
> I will also forward and create a support request later on with Extreme and ask for their opinion.
>
> BR
> Jörg
>
>
>
> On 1 Jul 2023, at 23:58, Bogdan Rotariu wrote:
>
>> Thank you for your time and your interest in solving this issue.
>> Your test added light to the issue, I will forward to Mikrotik the information received from you, maybe they will care and do something in the future updates.
>>
>> Could you please share the patch for FRR so I can replicate the issue with FRR too?


_______________________________________________
foundry-nsp mailing list
foundry-nsp@puck.nether.net
http://puck.nether.net/mailman/listinfo/foundry-nsp
Re: Netiron AS4 capabilities [ In reply to ]
Looks like twitter has some firmware issues too :-) It took a few hours to load the tweet.

Edgerouter had issues with handling extended length a few years ago did found this[1] when searching for my issue.

It seems that there are some holes in the RFC’s and the implementations of the BGP protocol differ pretty much for each vendor even if it should not.

[1] https://community.ui.com/questions/BGP-problem/8272f27f-8671-4570-b9a6-f2b960b2c617


> On 2 Jul 2023, at 12:36, Clement Cavadore <clement@cavadore.net> wrote:
>
> Hi,
>
> It "looks like" something I got last october, when upgrading one of my
> router to ROS7. Network was consisting of 3 Mikrotiks, and 1 Edgerouter
> infinity: When the ROS7 exports routes learnt from one of their
> transit, the Edgerouter (Vyatta) resets its IBGP session.
> https://twitter.com/acontios_net/status/1580915560074055680/photo/1
>
> I didn't dig much, as it was a "toy asn" and discarded input updates
> from the ROS7 transit link, but I feel that ROS7 behaviour is incorrect
> regarding aggregator flag.
>
>
> Best regards,
>
> Clément Cavadore
>
> On Sun, 2023-07-02 at 11:06 +0200, Jörg Kost wrote:
>> Hello,
>>
>> I have submitted the findings on Github. May I include your PCAP?
>> https://github.com/ipcjk/mikrotikSLXMLX
>>
>> I will also forward and create a support request later on with
>> Extreme and ask for their opinion.
>>
>> BR
>> Jörg
>>
>>
>>
>> On 1 Jul 2023, at 23:58, Bogdan Rotariu wrote:
>>
>>> Thank you for your time and your interest in solving this issue.
>>> Your test added light to the issue, I will forward to Mikrotik the
>>> information received from you, maybe they will care and do
>>> something in the future updates.
>>>
>>> Could you please share the patch for FRR so I can replicate the
>>> issue with FRR too?
>> _______________________________________________
>> foundry-nsp mailing list
>> foundry-nsp@puck.nether.net
>> http://puck.nether.net/mailman/listinfo/foundry-nsp
>
Re: Netiron AS4 capabilities [ In reply to ]
So, to "close" the topic, Extreme thinks it is also a bug in the Mikrotik implementation, and they should fix it. Completely independent of this, the issue of BGP attributes and their diversity also seems to be affecting other vendors. A recent blog article published at the end of August reports the results of BGP Attribute Fuzzing: https://blog.benjojo.co.uk/post/bgp-path-attributes-grave-error-handling

Extreme is also represented here with EXOS.

On 2 Jul 2023, at 21:50, Bogdan Rotariu wrote:

> Looks like twitter has some firmware issues too :-) It took a few hours to load the tweet.
>
> Edgerouter had issues with handling extended length a few years ago did found this[1] when searching for my issue.
>
> It seems that there are some holes in the RFC’s and the implementations of the BGP protocol differ pretty much for each vendor even if it should not.
>
> [1] https://community.ui.com/questions/BGP-problem/8272f27f-8671-4570-b9a6-f2b960b2c617
>
_______________________________________________
foundry-nsp mailing list
foundry-nsp@puck.nether.net
http://puck.nether.net/mailman/listinfo/foundry-nsp

1 2  View All