Re: Destination Preference Attribute for BGP

2023-08-30 Thread Mark Tinka
On 8/30/23 18:56, michael brooks - ESC wrote: I, too, am looking for something sexy (explained below). But can you explain why you think AS_PATH is "useless," Mark? Because most network operators use LOCAL_PREF heavily, and no amount of AS_PATH prepending will be able fight that with any

Re: Destination Preference Attribute for BGP

2023-08-30 Thread michael brooks - ESC
>With AS-PATH prepend you have no control on the choice of which ASN should do what action on your advertisements. Robert- It is somewhat this problem we are trying to resolve. >I was imagining something sexier, especially given how pretty "useless" AS_PATH prepending is nowadays. I, too, am

Re: OpenAI access blocked

2023-08-30 Thread Sabri Berisha
Hi, Tell them you know where John Connor is, and all APIs will open up :) Thanks, Sabri - On Aug 29, 2023, at 5:12 PM, Troy via NANOG wrote: > If there's somebody that knows which geo list Open AI uses (or somebody from > Open AI is on the list) - can you please contact me off list.

Re: JunOS/FRR/Nokia et al BGP critical issue

2023-08-30 Thread Steve Noble
Tom Beecher wrote on 8/30/23 8:22 AM:  vendors should adopt RFC7606 Yes   and not be absolutely awful at responding to vulnerability reporting. 1. This isn't exactly new. It's been possible to do this since the original days of BGP. Literally the first thing that came into my

Re: JunOS/FRR/Nokia et al BGP critical issue

2023-08-30 Thread Jakob Heitz (jheitz) via NANOG
You may treat-as-withdraw instead of discard. However, this attribute does not affect routing. It only affects whether a sender of packets to the route will add the entropy label or not to the MPLS header, if such an MPLS header is added. Therefore, it is safe to discard the attribute. Kind

Re: JunOS/FRR/Nokia et al BGP critical issue

2023-08-30 Thread Tom Beecher
> > vendors should adopt RFC7606 > Yes and not be absolutely awful at responding to vulnerability reporting. 1. This isn't exactly new. It's been possible to do this since the original days of BGP. 2. Probably not wise to assume that's accurate just because he thinks that is true. On Wed,

Re: JunOS/FRR/Nokia et al BGP critical issue

2023-08-30 Thread Jakob Heitz (jheitz) via NANOG
IOS-XR passes on the attribute by default. Some other routers incorrectly claim it to be malformed and reset the BGP session. IOS-XR has a configuration to discard an attribute, so it will not pass it on. It will pass the route with all its other attributes. Here is an example configuration:

Re: JunOS/FRR/Nokia et al BGP critical issue

2023-08-30 Thread jeffm
Fair update. To be clear, though, the main point of the article stands, and is maybe even strengthened by the update. A corrupted attribute def can cause the behavior (personal experience speaking here with a different attribute) and vendors should adopt RFC7606 and not be absolutely awful at

Re: JunOS/FRR/Nokia et al BGP critical issue

2023-08-30 Thread Jakob Heitz (jheitz) via NANOG
The blog was updated. Correct link: https://blog.benjojo.co.uk/post/bgp-path-attributes-grave-error-handling The attribute was not malformed. This is the hex dump of the attribute: “E0 1C 00” It is described here. https://www.rfc-editor.org/rfc/rfc6790#section-5.2 This attribute is deprecated, but

OpenAI access blocked

2023-08-30 Thread Troy via NANOG
If there's somebody that knows which geo list Open AI uses (or somebody from Open AI is on the list) - can you please contact me off list. Our ranges seem to have been blocked from accessing the API and platform management tools. We can access the chat demos, but that is all. Regardless of the

Re: JunOS/FRR/Nokia et al BGP critical issue

2023-08-30 Thread Tom Beecher
> > Or do the sensible thing and just drop the announcement and log the > problem. > Which is exactly what an RFC7606 compliant device will do for an unknown path attribute. https://www.rfc-editor.org/rfc/rfc7606#page-5 o Treat-as-withdraw: In this approach, the UPDATE message containing

Re: JunOS/FRR/Nokia et al BGP critical issue

2023-08-30 Thread Eugeniu Patrascu
On Wed, Aug 30, 2023 at 4:04 PM William Herrin wrote: > On Wed, Aug 30, 2023 at 4:50 AM Mike Lyon wrote: > > Ran across this article today and haven't seen posts about it so i > > figured I would share: > > > > https://blog.benjojo.co.uk/post/bgp-path-attributes-grave-error-handling > > Can you

Re: JunOS/FRR/Nokia et al BGP critical issue

2023-08-30 Thread William Herrin
On Wed, Aug 30, 2023 at 4:50 AM Mike Lyon wrote: > Ran across this article today and haven't seen posts about it so i > figured I would share: > > https://blog.benjojo.co.uk/post/bgp-path-attributes-grave-error-handling Can you imagine, as the origin of a route, troubleshooting a connectivity

Re: JunOS/FRR/Nokia et al BGP critical issue

2023-08-30 Thread Mark Prosser
Thanks for sharing this, Mike. I saw it on lobste.rs yesterday and figured everyone would be ahead. I'm running VyOS in a volunteer WISP but not with BGP peering... I'm thinking to test it now as we'll likely swap in VyOS for it soon. I saw this PR as a reply on Mastodon:

JunOS/FRR/Nokia et al BGP critical issue

2023-08-30 Thread Mike Lyon
Ran across this article today and haven't seen posts about it so i figured I would share: