Hello BIRD maintainers,
I would like to report that BIRD does not currently implement RFC 8538
(Notification
Message Support for BGP Graceful Restart). This is not a protocol violation
— RFC
8538 is an optional extension that a speaker may choose not to implement.
However,
the lack of N-bit advertisement and Hard Reset handling limits
interoperability with
implementations that do support RFC 8538 (e.g., FRR, Cisco IOS-XR, Junos).
## Summary
RFC 8538 extends RFC 4724 Graceful Restart with three mechanisms:
1. **N-bit** (Notification bit, 0x4000 in the 16-bit Restart Flags + Time
field,
i.e., 0x40 in the first byte): A speaker that is willing to send and
receive
NOTIFICATION messages under RFC 8538 semantics MUST advertise this bit.
Only
when both peers have advertised the N-bit is RFC 8538 behavior active.
2. **Hard Reset** (CEASE/subcode=9): When N-bit is mutually negotiated and a
session teardown is intended to be unconditional (routes must be flushed
immediately), the sender wraps applicable CEASE notifications inside a
Hard Reset outer envelope (code=6, subcode=9, data=original
notification).
3. **Soft notification handling**: When N-bit is negotiated and a non-CEASE
notification is sent/received, routes are retained in stale state (GR
hold)
to allow a GR-style recovery, instead of being immediately withdrawn.
BIRD 2.x implements RFC 4724 base Graceful Restart but has no code for any
of the
above RFC 8538 behaviors.
## Affected Version
```text
BIRD version 2.0.7
```
Static code analysis also confirms the absence in the current development
tree.
## Observed Behavior
### Test 1 — N-bit not advertised in OPEN
A Python BGP peer connected to BIRD 2.0.7 with `graceful restart yes;
graceful
restart time 120;` and captured BIRD's OPEN message. The Graceful Restart
capability
(type=64) contained:
```text
Raw GR capability data: 0x007800010100
16-bit Restart Flags + Time field: 0x0078
Restart Flags nibble (bits 15-12): 0x0
R-bit (0x8000 / bit 15): False
N-bit (0x4000 / bit 14, RFC 8538): False ← not set
Restart Time (bits 11-0): 120s
Per-AF: IPv4 unicast, F-bit=0
```
The N-bit (0x4000 in the 16-bit field, 0x40 in the first byte) is not set.
BIRD's
only defined GR restart flag is `BGP_GRF_RESTART` (0x80, the R-bit). There
is no
definition or code path for the RFC 8538 N-bit.
### Test 2 — CEASE not wrapped as Hard Reset
After session establishment, `birdc disable gr_test` triggered an admin
shutdown.
BIRD sent:
```text
NOTIFICATION: code=6 (CEASE), subcode=2 (Administrative Shutdown)
Data: (none)
```
This is a raw CEASE/AdminShutdown. RFC 8538 recommends that, when the N-bit
has been
exchanged, CEASE subcodes such as Administrative Shutdown be wrapped as
Hard Reset
(code=6, subcode=9) so the peer immediately flushes preserved routes.
## Expected Behavior
RFC 8538 is an optional extension, so BIRD is not required to implement it.
However,
if BIRD intends to support RFC 8538, the expected behavior would be:
1. Provide a configuration knob to advertise the N-bit (0x4000) in the GR
capability when the operator enables RFC 8538 notification mode.
2. When the N-bit has been mutually negotiated and an admin shutdown
occurs, use
Hard Reset encapsulation:
```text
NOTIFICATION: code=6 (CEASE), subcode=9 (Hard Reset)
Data: [original code=6][original subcode=2]
```
3. When receiving a non-CEASE notification from a peer that negotiated the
N-bit,
retain the peer's routes in stale state instead of immediately
withdrawing them,
enabling GR-style recovery from notification-triggered session drops.
## Source-Level Analysis
In `proto/bgp/packets.c`, `bgp_write_capabilities()` builds the GR
capability:
```c
if (caps->gr_aware)
{
*buf++ = 64; /* Capability 64: Support for graceful restart
*/
*buf++ = 0; /* length, filled later */
data = buf;
put_u16(buf, caps->gr_time);
buf[0] |= caps->gr_flags; /* only BGP_GRF_RESTART (0x80) defined */
buf += 2;
...
}
```
`caps->gr_flags` is set in `bgp_prepare_capabilities()`:
```c
caps->gr_flags = p->p.gr_recovery ? BGP_GRF_RESTART : 0;
```
`BGP_GRF_RESTART` is defined as `0x80` (R-bit). The N-bit (`0x40` in the
first byte,
`0x4000` in the 16-bit field) is not defined anywhere in BIRD's source.
`bgp_create_notification()` writes NOTIFICATION messages directly:
```c
buf[0] = conn->notify_code;
buf[1] = conn->notify_subcode;
memcpy(buf+2, conn->notify_data, conn->notify_size);
return buf + 2 + conn->notify_size;
```
There is no Hard Reset wrapping, no N-bit negotiation check, and no
soft-notification
route-retention logic anywhere in the BIRD source.
## Comparison with FRR
FRR bgpd fully implements RFC 8538 (`bgp_open.h`):
```c
#define GRACEFUL_RESTART_R_BIT 0x8000
#define GRACEFUL_RESTART_N_BIT 0x4000 /* RFC 8538 */
```
In OPEN construction:
```c
SET_FLAG(gr_restart_time, GRACEFUL_RESTART_N_BIT);
SET_FLAG(peer->cap, PEER_CAP_GRACEFUL_RESTART_N_BIT_ADV);
```
Negotiation check:
```c
bool bgp_has_graceful_restart_notification(struct peer *peer) {
return CHECK_FLAG(peer->cap, PEER_CAP_GRACEFUL_RESTART_N_BIT_RCV) &&
CHECK_FLAG(peer->cap, PEER_CAP_GRACEFUL_RESTART_N_BIT_ADV);
}
```
Because BIRD never advertises the N-bit,
`bgp_has_graceful_restart_notification()`
always returns false on the FRR side for BIRD peers. Both implementations
correctly
fall back to RFC 4724 base GR behavior: this is an interoperability
limitation, not a
negotiated RFC 8538 failure.
## Dynamic Verification
Verified against BIRD 2.0.7 using a Python BGP peer that:
- Advertised the N-bit (0x4000) in its own OPEN to offer RFC 8538 to BIRD
- Parsed BIRD's OPEN response for the N-bit
- Triggered admin shutdown via `birdc` and captured BIRD's outgoing
NOTIFICATION
```text
TEST 1 (N-bit in OPEN) : N_BIT_NOT_SET
GR data 0x0078... → Restart Flags nibble = 0x0 → N-bit absent
TEST 2 (Hard Reset on CEASE) : CEASE_RAW
NOTIFICATION code=6/sub=2 (AdminShutdown) — not wrapped as Hard Reset
RESULT: BIRD does NOT implement RFC 8538
```
## Impact
There is no current security or operational impact in BIRD-only or BIRD-FRR
deployments, because the N-bit is never mutually negotiated and both sides
fall back to standard RFC 4724 GR behavior.
The forward-looking concern is: if BIRD adds N-bit advertisement in the
future
without also implementing Hard Reset and soft-notification semantics,
sessions
with RFC 8538-capable peers could exhibit asymmetric teardown. Specifically:
- BIRD sends a raw CEASE/AdminShutdown (no Hard Reset envelope)
- The RFC 8538 peer interprets this as a soft GR event and retains stale
routes
for the full restart timer window, instead of flushing them immediately
This would be a behavioral surprise for operators who configure BIRD as an
RFC 8538
peer in a mixed-vendor network.
## Suggested Fix
If RFC 8538 support is planned:
1. Define the N-bit flag:
```c
#define BGP_GRF_NOTIFICATION 0x40 /* RFC 8538 N-bit, 0x4000 in 16-bit
field */
```
2. Add a configuration knob and set the bit in `bgp_prepare_capabilities()`
when
the operator enables GR notification mode.
3. Implement Hard Reset wrapping in the NOTIFICATION send path when N-bit
is active.
4. On NOTIFICATION receive, when N-bit has been negotiated and the
notification is
not a Hard Reset, retain peer routes (stale hold) instead of immediate
withdrawal.
Best regards.
