Skip to content

Release v0.2.0

Latest
Latest

Choose a tag to compare

View all tags
@gmazoyer gmazoyer released this 20 Oct 19:13
· 2 commits to main since this release
Immutable release. Only release title and notes can be modified.
v0.2.0
f3cb5c8
This commit was signed with the committer’s verified signature.
gmazoyer Guillaume Mazoyer
GPG key ID: BD61E7CAA5205F51
Verified
Learn about vigilant mode.

Reflet can keep periodic snapshots of the RIB of a peer. BGP sessions no
longer reset when a message arrives in two TCP segments. Reflet stops
cleanly on SIGTERM and sends a Cease NOTIFICATION to its peers.

Changes that can need an action after the upgrade

  • The RPKI fetch uses the root certificates of the operating system, not a
    copy of the Mozilla root certificates in the binary. A host with no system
    root certificates cannot fetch VRPs over HTTPS. The Docker image has these
    certificates.
  • The HTTP server answers 406 Not Acceptable to a client that refuses all
    encodings, for example with Accept-Encoding: identity;q=0 and no other
    encoding. Before, it sent the response without compression.

RIB snapshots

  • Reflet can save a copy of the RIB of a peer at a fixed interval. You can
    then view the routes of the peer at the time of each snapshot, in the web
    UI and through the API.
  • To enable snapshots, set snapshot_interval (60 seconds or more) on each
    peer and add a [snapshots] section with data_dir. Use max_snapshots
    and max_age_hours to limit the number of snapshots that Reflet keeps.
    See docs/configuration.md.
  • The routes page of a peer shows a "Live / History" switch when snapshots
    exist.
  • New API endpoints and fields:
    • GET /api/v1/peers/{id}/snapshots lists the snapshots of a peer.
    • GET /api/v1/peers/{id}/snapshots/{timestamp}/routes/ipv4 and
      .../routes/ipv6 return the routes of one snapshot, with the same
      search filters as the live routes.
    • GET /api/v1/summary has a new field, snapshots_enabled.
  • Each request on a snapshot reads and decompresses a full RIB from disk.
    Do not enable snapshots on a public instance.

BGP sessions

  • Sessions no longer reset when a BGP message arrives in two TCP segments.
    Before, Reflet lost the first part of the message when the keepalive
    timer expired between the two segments. It then closed the session
    without a NOTIFICATION, and the peer saw a TCP reset. On a session with a
    full table, this happened several times a day.
  • Reflet sends a NOTIFICATION with error code 1 (Message Header Error)
    before it closes a session because of a bad message header. RFC 4271
    section 6.1 requires this NOTIFICATION. Before, the peer saw only a TCP
    reset. The subcodes are:
    • 1 (Connection Not Synchronized) for a bad marker.
    • 2 (Bad Message Length) for a length outside 19 to 4096. The data field
      contains the bad length.
    • 3 (Bad Message Type) for an unknown message type. The data field
      contains the bad type, followed by one zero octet.

Shutdown

  • Reflet stops cleanly on SIGTERM, which docker stop and systemctl stop
    send. Before, Reflet stopped cleanly only on SIGINT (Ctrl+C). After a
    SIGTERM, it did not save the RIBs for graceful restart and did not write
    the buffered events to the event log file:
    • Outside a container, SIGTERM stopped Reflet at once.
    • In a container, docker stop waited for its stop timeout and then
      killed Reflet.
  • On shutdown, each established session sends a Cease NOTIFICATION with
    subcode 2 (Administrative Shutdown) to its peer. Before, the TCP
    connections closed without a NOTIFICATION. Reflet waits at most 2 seconds
    for the sessions to close, so the event log file also contains the
    session down events.

Web UI and API

  • The web UI and the API list the peers in the order of the configuration
    file. Before, the order did not follow the configuration file.
  • The frontend Docker image trusts the X-Forwarded-For header from
    private networks (10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16). Behind a
    reverse proxy, the "Your IP" field and /api/v1/whoami show the IP
    address of the client, not the address of the proxy. The reverse proxy
    must send the header. See docs/deployment.md.
  • The /docs page uses a newer Swagger UI. In the OpenAPI document, three
    oneOf lists of nullable fields put "null" after the schema reference.

Build and dependencies

  • The Docker image builds with Rust 1.99, the same version as CI.
  • The configuration file can use TOML 1.1. All TOML 1.0 files stay valid.
  • Upgraded crates:
    • reqwest 0.13
    • tower-http 0.7
    • toml 1
    • prefix-trie 0.10
    • utoipa 6, utoipa-axum 0.3 and utoipa-swagger-ui 10
  • The other crates use their latest compatible versions.

All changes: v0.1.0...v0.2.0

Assets 3
Loading