<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Just received a reponse from the Mikrotik ticket:<div><br></div><div>"<span style="caret-color: rgb(23, 43, 77); color: rgb(23, 43, 77); font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen, Ubuntu, "Fira Sans", "Droid Sans", "Helvetica Neue", sans-serif; font-size: 14px; background-color: rgb(255, 255, 255);">RFC 6793 updates RFC4271 where Section 4.1 states</span><div class="jsd-message-content" style="margin-bottom: 30px; caret-color: rgb(23, 43, 77); color: rgb(23, 43, 77); font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen, Ubuntu, "Fira Sans", "Droid Sans", "Helvetica Neue", sans-serif; font-size: 14px; background-color: rgb(255, 255, 255);"><div class="jsd-activity-item-content"><p>"<br>A BGP speaker that advertises such a capability to a particular peer,<br>and receives from that peer the advertisement of such a capability,<br>MUST encode AS numbers as four-octet entities in both the AS_PATH<br>attribute and the AGGREGATOR attribute in the updates it sends to the<br>peer and MUST assume that these attributes in the updates received<br>from the peer encode AS numbers as four-octet entities.<br>"</p><p>AS4_AGGREGATOR does not apply here in this case because both speakers are considered "NEW BGP Speakers"</p><p>Section 3 states what is "NEW Speaker" and what is "OLD Speaker”</p><p>"</p></div></div><div><blockquote type="cite"><div>On 30 Jun 2023, at 10:44, Jörg Kost <jk@ip-clear.de> wrote:</div><br class="Apple-interchange-newline"><div><div>I see, however, you won't be able to solve it any other way than<br><br>1.) Open a new bug report with extended-length at Mikrotik (or use older firmware?)<br>or<br>2.) Use a route reflector, which takes the communication between the routers.<br><br>There's no point in flagging if the length, for example, can be represented as fixed with 8 bits, or is even set to 0. So there is conflicting information in the BGP message and therefore an Attributes Length or Attributed Data error is thrown. Or do I miss something?<br><br>IMHO, the Brocade/Extreme Device protects you from reading "out-of-bounds" and implements the RFC correctly. Otherwise these would be classic exploitable buffer overflow conditions.<br><br>https://datatracker.ietf.org/doc/html/rfc1771 used to be much more striking: "Extended Length may be used only if the length of the attribute<br> value is greater than 255 octets."<br><br>While https://www.rfc-editor.org/rfc/rfc4271.html says:<br>If the Extended Length bit of the Attribute Flags octet is set<br> to 1, the third and fourth octets of the path attribute contain<br> the length of the attribute data in octets.<br><br><br><br>On 30 Jun 2023, at 0:41, Bogdan Rotariu wrote:<br><br><blockquote type="cite">Ok, I can totally replicate the issue using Mikrotik's CHR latest 7.11beta2. Session between a CHR and a CER2024 closes with same error "Error: Invalid AGGREGATOR attribute length 8”. If anyone would like to do a test I would appreciate that.<br><br><blockquote type="cite">On 30 Jun 2023, at 00:50, Bogdan Rotariu <bogdan@rotariu.ro> wrote:<br><br>Ty, during my research I have found out that Mikrotik forces atomic-aggregate attribute to any announced prefixes, I guess the extended-length: set comes from that? This bug they acknowledge but said it has nothing to do with my issue and its just Brocade fault.<br><br><blockquote type="cite">On 30 Jun 2023, at 00:27, Jörg Kost <jk@ip-clear.de> wrote:<br><br>Bottom line: Vote with your wallet, buy some Extreme ;-)<br><br>In your dump e.g. there is an empty AS-Path with length 0 and then Extended-Length is set anyway.<br>I think that the spontaneously flag setting, will cause problems for other vendors too.<br><br>Path Attribute - AS_PATH: empty<br> Flags: 0x50, Transitive, Extended-Length, Well-known, Complete<br> 0... .... = Optional: Not set<br> .1.. .... = Transitive: Set<br> ..0. .... = Partial: Not set<br> ...1 .... = Extended-Length: Set<br> .... 0000 = Unused: 0x0<br> Type Code: AS_PATH (2)<br> Length: 0<br><br><br>On 29 Jun 2023, at 23:13, Bogdan Rotariu wrote:<br><br><blockquote type="cite">Yes Netiron is a real stable software, we have plenty Brocades in use and except the ones that got many sessions and occasionally have memory issues, we never had any issues. Unfortunately I cannot convince Mikrotik that they have a bug and till now I cannot see anyone else on the forum or on their discord server that are affected by this<br>issue and more unfortunately I got my hands on devices I cannot use :-)<br><br></blockquote></blockquote><br></blockquote><br><br>_______________________________________________<br>foundry-nsp mailing list<br>foundry-nsp@puck.nether.net<br>http://puck.nether.net/mailman/listinfo/foundry-nsp<br></blockquote></div></div></blockquote></div><br></div></body></html>