Revised Error Handling for BGP UPDATE Messages
updates
- rfc-1997 — BGP Communities Attribute
- rfc-4271 — A Border Gateway Protocol 4 (BGP-4)
- rfc-4360 — BGP Extended Communities Attribute
- rfc-4456 — BGP Route Reflection: An Alternative to Full Mesh Internal BGP (IBGP)
- rfc-4760 — Multiprotocol Extensions for BGP-4
- rfc-5543 — BGP Traffic Engineering Attribute
- rfc-5701 — IPv6 Address Specific BGP Extended Community Attribute
- rfc-6368 — Internal BGP as the Provider/Customer Edge Protocol for BGP/MPLS IP Virtual Private Networks (VPNs)
Extracted elements (29)
Attribute discard should not be used when the attribute in question has or may have an effect on route selection or installation, unless careful analysis proves it is safe. The tradeoff between preserving connectivity and potential side effects must be analyzed, and such discard policies applied only to EBGP sessions to avoid correctness issues.
Session reset for malformed UPDATE messages is undesirable because it impacts all valid routes on the session, not just the offending route. For optional transitive attributes, the session reset may fall on a router that merely forwarded the attribute without checking it, potentially causing cascading resets across many peering sessions when a single malformed attribute is replicated.
Applying treat-as-withdraw to an UPDATE received over an IBGP session can cause routing inconsistency within an AS, potentially resulting in long-lived forwarding loops and black holes. Operators should trace malformed attributes to the ingress router and apply filters there to restore consistency.
A BGP speaker advertising support for a typed address family (e.g., MCAST-VPN, EVPN) MUST handle routes with unrecognized NLRI types within that AFI/SAFI by discarding them, unless the relevant address family specification states otherwise.
A BGP speaker MUST provide debugging facilities including, at minimum, logging an error listing the NLRI involved and the entire malformed UPDATE message when a malformed attribute is detected.
A document specifying a new BGP attribute MUST provide specifics on what constitutes an error and how it is handled. Treat-as-withdraw is the generally preferred approach; session reset is discouraged. The document SHOULD also address debugging facilities for diagnosing malformed attribute issues.
An UPDATE message with a malformed ATTR_SET attribute SHALL be handled using treat-as-withdraw, replacing the prior conditional logic that referenced the Partial and Neighbor-Complete flags.
AS_PATH is malformed if an unrecognized segment type is found, or a segment has a Path Segment Length that overruns the Attribute Length, an underrun leaving only one octet after the last parsed segment, or a Path Segment Length of zero. Malformed AS_PATH SHALL be handled using treat-as-withdraw. Violations of the leftmost-AS check SHOULD also use treat-as-withdraw but MAY use session reset if configured.
ATOMIC_AGGREGATE is malformed if its length is not 0; an UPDATE with a malformed ATOMIC_AGGREGATE SHALL use attribute discard. AGGREGATOR is malformed if its length is not 6 (without 4-octet AS capability) or not 8 (with 4-octet AS capability on both sides); malformed AGGREGATOR SHALL use attribute discard.
For all path attributes except AS_PATH and ATOMIC_AGGREGATE, an attribute length of zero SHALL be considered a syntax error. AS_PATH and ATOMIC_AGGREGATE are the only attributes defined in this specification that may validly have a zero-length value.
If an UPDATE message contains path attributes other than MP_UNREACH_NLRI but encodes no reachable NLRI, and any path attribute error specifies handling other than attribute discard, then the session reset approach MUST be used, because it is not possible to confirm the NLRI were successfully parsed.
If any well-known mandatory attributes are not present in an UPDATE message, treat-as-withdraw MUST be used.
If MP_REACH_NLRI or MP_UNREACH_NLRI appears more than once in an UPDATE message, a NOTIFICATION MUST be sent with Error Subcode 'Malformed Attribute List'. For any other attribute appearing more than once, all occurrences after the first SHALL be discarded and processing continues.
If the Length of Next Hop Network Address field of MP_REACH_NLRI is inconsistent with what is expected for the given AFI/SAFI (and any extensions in use), the attribute is malformed and the session reset or AFI/SAFI disable approach MUST be used, because the NLRI cannot be reliably located.
If the Optional or Transitive bits in Attribute Flags conflict with their specified values, the attribute MUST be treated as malformed and the treat-as-withdraw approach used, unless the attribute specification mandates different handling.
If Total Attribute Length is exceeded when parsing enclosed path attributes, or insufficient octets remain to parse a minimum-sized attribute, treat-as-withdraw MUST be used. The Total Attribute Length MUST then be relied upon to locate the beginning of the NLRI field.
LOCAL_PREF received from an external neighbor SHALL be discarded using attribute discard. If received from an internal neighbor and its length is not 4, the UPDATE SHALL be handled using treat-as-withdraw.
MP_REACH_NLRI or MP_UNREACH_NLRI (if present) SHALL be encoded as the very first path attribute in an UPDATE message. An UPDATE message MUST NOT contain more than one of: non-empty Withdrawn Routes field, non-empty NLRI field, MP_REACH_NLRI attribute, or MP_UNREACH_NLRI attribute. Implementations MUST still handle messages where these appear in any position or combination.
NEXT_HOP is malformed if its length is not 4. MULTI_EXIT_DISC is malformed if its length is not 4. Both SHALL be handled using treat-as-withdraw when malformed.
The Community attribute is malformed if its length is not a non-zero multiple of 4; treat-as-withdraw SHALL be used. ORIGINATOR_ID received from an external neighbor SHALL be discarded; from an internal neighbor it is malformed if length != 4 and SHALL use treat-as-withdraw. CLUSTER_LIST from an external neighbor SHALL be discarded; from an internal neighbor it is malformed if length is not a non-zero multiple of 4 and SHALL use treat-as-withdraw.
The Extended Community attribute is malformed if its length is not a non-zero multiple of 8; treat-as-withdraw SHALL be used. A BGP speaker MUST NOT treat an unrecognized Extended Community Type or Sub-Type as an error.
The IPv6 Address Specific Extended Community attribute is malformed if its length is not a non-zero multiple of 20; treat-as-withdraw SHALL be used. A BGP speaker MUST NOT treat an unrecognized IPv6 Address Specific Extended Community Type or Sub-Type as an error.
The ORIGIN attribute is malformed if its length is not 1 or if it has an undefined value. An UPDATE with a malformed ORIGIN SHALL be handled using treat-as-withdraw.
Treat-as-withdraw MUST be used for error cases involving ORIGIN, AS_PATH, NEXT_HOP, MULTI_EXIT_DISC, or LOCAL_PREF that previously specified session reset. Attribute discard MUST be used for ATOMIC_AGGREGATE or AGGREGATOR error cases that previously specified session reset.
When multiple attribute errors exist in a single UPDATE message, if the same error-handling approach applies to all, that approach MUST be used; otherwise the approach with the strongest action MUST be used.
An NLRI field or Withdrawn Routes field is syntactically incorrect if any included NLRI has a length greater than 32, or the last NLRI's length exceeds remaining unconsumed data. For MP_REACH_NLRI/MP_UNREACH_NLRI, additional checks apply: NLRI length inconsistent with AFI/SAFI, last NLRI overrunning remaining data, inconsistent attribute flags, or attribute length less than 3 (MP_UNREACH) or 5 (MP_REACH).
Four error-handling approaches are defined in order of decreasing severity: (1) session reset — send NOTIFICATION and terminate session; (2) AFI/SAFI disable — ignore all subsequent routes for the affected AFI/SAFI; (3) treat-as-withdraw — treat all routes in the UPDATE as withdrawn; (4) attribute discard — discard only the malformed attribute and continue processing. Attribute discard MUST NOT be used if the attribute affects route selection or installation.
The improved error handling could interact badly with hypothetical confidentiality-only (non-integrity-protecting) cryptographic mechanisms applied to BGP, allowing an attacker to make repeated ciphertext manipulation attempts rather than a single attempt before session teardown. The recommended mitigation is to use AEAD ciphers (RFC 5116) so messages that fail integrity checks are discarded.
This specification addresses the attack whereby a distant attacker generates a malformed optional transitive attribute that propagates through routers that do not recognize it. When the attribute reaches a recognizing router, the resulting session reset can be amplified many times due to fan-out, making the attack particularly harmful. Treating such attributes with treat-as-withdraw instead of session reset mitigates this amplification.