3 ms·

Agreed, the article title is a bit sensationalist. Really should be titled “RTFM: Juniper routers shutdown BGP on bad input”. That being said, I found it be a

Agreed, the article title is a bit sensationalist. Really should be titled “RTFM: Juniper routers shutdown BGP on bad input”. That being said, I found it be a good deep dive and I appreciate the author looking into this. BGP isn’t perfect but we made it this far and I think it does a pretty good job for handling ~75K autonomous systems.

gregw2 3y ago
Err no, it was not just Juniper. Many other systems were fuzzed, half a dozen vendors were fine, another 5 weren’t and some remain unpatched and vulnerable. If it were just a Juniper implementation flaw it’d be less interesting than explaining an aspect of BGP error handling more generally which is indeed what the article was, for those of us aware of BGP but not familiar with specific protocol design decisions and implications. If you quibbled with the word “Grave” I might agree since it’s not industrywide and impacting major vendors like Cisco and Huawei and those implementing RFC 7606 (although there is no patch for Nokia or Extreme or Bird!) I’d counterpropose that a more neutral TLDR title/summary for an HN audience might be “Grave flaws in non compliant BGP error handling.” But on balance I think the author is better off with raising the alarm with a stronger headline; he clearly put his passion to good use and I learned a little something as a result.
- nsteel 3y ago
  As I understand it, Nokia equipment already does the correct thing if you configure it correctly in fault-tolerance mode.
  - hellt 3y ago
    correct, Nokia implements RFC 7606, it needs to be added to the configuration, as it is not the default for now.
- pdonis 3y ago
  Bird routers didn't have the problem, correct?
basedrum 3y ago
Sure if you didn't read and only skimmed the article...
sgjohnson 3y ago
> BGP isn’t perfect but we made it this far and I think it does a pretty good job for handling ~75K autonomous systems. Absolutely not. To me, it's a miracle that the internet even works.

gregw2 3y ago

Err no, it was not just Juniper. Many other systems were fuzzed, half a dozen vendors were fine, another 5 weren’t and some remain unpatched and vulnerable. If it were just a Juniper implementation flaw it’d be less interesting than explaining an aspect of BGP error handling more generally which is indeed what the article was, for those of us aware of BGP but not familiar with specific protocol design decisions and implications. If you quibbled with the word “Grave” I might agree since it’s not industrywide and impacting major vendors like Cisco and Huawei and those implementing RFC 7606 (although there is no patch for Nokia or Extreme or Bird!) I’d counterpropose that a more neutral TLDR title/summary for an HN audience might be “Grave flaws in non compliant BGP error handling.” But on balance I think the author is better off with raising the alarm with a stronger headline; he clearly put his passion to good use and I learned a little something as a result.

nsteel 3y ago
As I understand it, Nokia equipment already does the correct thing if you configure it correctly in fault-tolerance mode.
- hellt 3y ago
  correct, Nokia implements RFC 7606, it needs to be added to the configuration, as it is not the default for now.
pdonis 3y ago
Bird routers didn't have the problem, correct?

basedrum 3y ago

Sure if you didn't read and only skimmed the article...

sgjohnson 3y ago

> BGP isn’t perfect but we made it this far and I think it does a pretty good job for handling ~75K autonomous systems. Absolutely not. To me, it's a miracle that the internet even works.