Extended BGP Administrative Shutdown Communication
obsoletes
- rfc-8203 — BGP Administrative Shutdown Communication
updates
- rfc-4486 — Subcodes for BGP Cease Notification Message
Extracted elements (18)
The maximum permitted Shutdown Communication length was increased from 128 (RFC 8203) to 255 octets because operators in regions using multibyte character sets (e.g., Russian) found that messages equivalent in meaning to 65-byte English messages required up to 139 bytes, exceeding the RFC 8203 limit.
The Shutdown Communication field is not NUL-terminated, and when it contains multibyte characters the character count will be less than the Length value in octets. This design reflects that Length measures octets, not Unicode code points.
If a Shutdown Communication longer than 128 octets is sent to a BGP speaker implementing RFC 8203, that speaker will treat it as an error and log a message. If sent to a speaker implementing neither RFC 8203 nor RFC 9003, it will likewise be treated as an error.
A receiving BGP speaker MUST NOT interpret invalid UTF-8 sequences in the Shutdown Communication field.
An erroneous or malformed Shutdown Communication itself MAY be logged in a hexdump format.
If a Shutdown Communication with an invalid UTF-8 sequence is received, a message indicating this event SHOULD be logged for the attention of the operator.
If it is known that the peer BGP speaker supports this specification, a Shutdown Communication not longer than 255 octets MAY be sent; otherwise a Shutdown Communication MAY be sent but SHOULD NOT be longer than 128 octets.
Mechanisms for reporting information contained in the Shutdown Communication are implementation specific but SHOULD include methods such as syslog.
The Shutdown Communication field MUST be encoded using UTF-8 to support international characters.
The Subcode field in the Cease NOTIFICATION message MUST be either 2 ('Administrative Shutdown') or 4 ('Administrative Reset') when carrying a Shutdown Communication.
UTF-8 'Shortest Form' encoding is REQUIRED in the Shutdown Communication to guard against the technical security issues outlined in Unicode Technical Report #36 (UTR36).
Users of this mechanism should apply data minimization practices (per RFC 6973 Section 6.1) because a received Shutdown Communication may be used at the receiver's discretion and could expose sensitive operational information.
A BGP speaker MAY include a UTF-8-encoded free-form string (the Shutdown Communication) in a Cease NOTIFICATION message with Error Subcode 'Administrative Shutdown' or 'Administrative Reset'. The string contents are at the operator's discretion.
IANA has referenced RFC 9003 at subcodes 'Administrative Shutdown' (2) and 'Administrative Reset' (4) in the 'BGP Cease NOTIFICATION message subcodes' registry under the 'Border Gateway Protocol (BGP) Parameters' group, in addition to RFC 4486.
BGP Shutdown Communications are likely to appear in syslog output, creating a risk that a carefully constructed message could be formatted to appear as additional syslog messages (log injection). The 255-octet length limit helps constrain such attacks.
Unless a transport providing integrity is used for the BGP session, a Shutdown Communication message could be forged; unless confidentiality is provided, it could be snooped. These risks are heightened here because the information is intended for human-to-human communication.
UTF-8 encoding carries inherent Unicode security issues. Implementers and operators are advised to review Unicode Technical Report #36 (UTR36). UTF-8 Shortest Form encoding is required to guard against these issues.
The Cease NOTIFICATION message with a Shutdown Communication consists of Error Code 6, a Subcode byte (2 or 4), an 8-bit Length field indicating the byte length of the Shutdown Communication, and the variable-length UTF-8 Shutdown Communication field. When Length is zero, no Shutdown Communication field follows.