Skip to content

1.1.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 05 Nov 21:41
· 141 commits to main since this release
1.1.0
dd3ee62

BNG Blaster 1.1.0

This release adds BGP L2VPN (RFC 6624), EVPN E-LAN, targeted LDP, LAG member flapping and LACP passive mode. It also makes BGP and TCP more robust at scale, adds a containerlab example, and fixes many bugs found by a code review of the whole code base, including LSPGEN.

New features

Routing

  • BGP L2VPN (RFC 6624): BGP sessions with the family l2vpn learn the label blocks of remote CEs, which the new command bgp-l2vpn-routes shows. Traffic streams with bgp-l2vpn-rd, bgp-l2vpn-ce-id and bgp-l2vpn-local-ce-id send Ethernet over MPLS frames over the pseudowire to the remote CE.
  • EVPN E-LAN: traffic streams with bgp-evpn-elan send to the label of the MAC/IP route of the destination (known unicast). If the MAC isn't learned, they fall back to the ingress replication label of the IMET route (unknown unicast). The new stream option tx-control-word adds the PW control word to EVPN VPWS and E-LAN traffic. A new EVPN test guide is part of the documentation.
  • Targeted LDP (RFC 5036 extended discovery) for IPv4 and IPv6, configured with the new LDP options targeted-neighbors, targeted-hold-time and targeted-hello-accept.
  • LDP label withdraw: LDP now handles label withdraw messages and the loss of a session. Streams stop sending until the label is advertised again, and ldp-database shows whether each entry is active.
  • BGP TCP-AO: the new BGP option tcp-ao-exclude-options keeps TCP options other than TCP-AO out of the MAC (RFC 5925). This is required for TCP-AO sessions with Junos unless tcp-ao-option is enabled there.
  • Routing teardown order: BGP and LDP sessions are now closed before IS-IS and OSPF withdraw their routes, so that sessions between loopbacks close cleanly. The new IS-IS and OSPF option teardown-delay delays the withdraw further.

Access

  • PPPoE lcp-restart command: sends a new LCP Configure-Request on established sessions without PADT, to test LCP renegotiation on the BNG (#360).
  • L2TP proxy authentication on the LNS: if the ICCN carries Proxy Authen AVPs, the LNS answers PAP or CHAP at once instead of waiting for a retransmission (#154). The new l2tp-server option proxy-auth (default true) turns this off.
  • L2TP tunnel session counts: l2tp-tunnels now shows sessions and sessions-established for every tunnel.
  • PPPoE MRU limit: the LCP MRU is now limited to the PPP-Max-Payload (RFC 4638). Larger MRUs are answered with Configure-Nak and counted as lcp-mru-invalid.

Interfaces and I/O

  • LAG monkey: with the new LAG option monkey, one random member interface is disabled or enabled every 30 seconds. It is controlled with monkey-start and monkey-stop, like the session monkey.
  • LACP passive mode: the new LAG option lacp-passive (default false) clears the LACP activity flag. The first LACPDU is now sent as soon as a member is added. Before, it went out only after the first periodic interval, which delayed the LAG by 30 seconds with the long timeout.
  • Gratuitous ARP and unsolicited NA: the new network interface options gratuitous-arp and unsolicited-na announce all interface addresses at the start and, with announce-interval, periodically. The new command network-announce restarts the announcements. They are counted as tx-garp and tx-unsolicited-na.
  • AF_XDP copy-rx mode: the new af-xdp-mode value copy-rx binds the RX queues in copy mode and the TX queues in zero-copy mode. This is for NICs like the i40e with an IOMMU in translation mode, where zero-copy RX fails while zero-copy TX works.
  • Stream capture: with capture-include-streams, the capture now includes stream packets sent and received by the TX and RX threads. The outer VLAN that the kernel stripped is restored for these packets.
  • Logging: the log now includes the process ID at the start, and the thread ID and CPU of every I/O thread.

Container and containerlab

  • The container image now includes bash completion for bngblaster-cli and the other tools, also in docker exec shells.
  • The image includes the BNG Blaster controller 1.1.1, which can start a test automatically and wait for its interfaces. It also provides a health check and writes the report when the container is stopped.
  • New example examples/containerlab/pppoe: a PPPoE lab for containerlab.

Improvements

  • BGP at scale:
    • A single listen socket now accepts sessions of any local address. Before, at most 256 local addresses could be used.
    • Received segments find their session in a hashtable instead of searching a list. This was 30% of the CPU with 1000 sessions.
  • TCP: data queued from timers or the control socket is now sent at once, instead of with the next received packet or the 500 ms poll. Sending also resumes after a full TX queue. This fixes stalled raw updates with many parallel BGP sessions.
  • BGP teardown: sessions with pending data are now closed with RST, so that teardown doesn't wait for a peer that has stopped reading. The notification is no longer sent behind a partially sent raw update. BGP notifications are logged with their data and the shutdown communication.
  • PACKET_MMAP: jumbo frames are rounded up to the page size, so that they also work on systems with 16K or 64K pages (e.g. aarch64).

Bug fixes

Access

  • A10NSP: every 65536th session got the reserved PPPoE session ID 0 and hung in PPPoE Request.
  • DHCPv6: an Advertise or Reply was ignored if one of the requested IAs returned a status code (e.g. IA_PD with NoPrefixAvail). The client then sent Solicits forever.
  • DHCPv6: IA_NA and IA_PD timers and lifetimes were sent in the wrong byte order.
  • DHCP: decoding of a repeated relay agent information option.
  • L2TP: TX buffer overflow, retry backoff shift, and a stack overflow of l2tp-csurq with many sessions.

Routing

  • IS-IS: own LSPs are now re-originated if the neighbor floods back a purge with the same sequence number. Before, the BNG Blaster stayed unreachable after a restart until the next LSP refresh.
  • IS-IS: LSP garbage collection removed level 1 LSPs from the level 2 database as well, which could overflow the stack.
  • IS-IS: hello neighbor TLV overflow and cleartext authentication.
  • OSPF: LSAs of type 43 are now rejected, and short packets are decoded correctly (also IGMP).
  • LDP: decoding of invalid lengths when receiving and in raw updates.
  • BGP: the bgp-sessions, bgp-raw-update and bgp-disconnect commands applied the IPv6 address filters to IPv4 sessions as well.
  • BGP: read buffer rebase.

Interfaces, streams and control socket

  • LAG: disabling a member of a LAG without LACP left it active, and its streams were lost. LAGs without LACP are now limited to 64 links.
  • LACP: decoding of invalid TLVs.
  • Streams: stream-update of streams without I/O and with invalid rates.
  • Streams: the label databases are now locked while TX threads search them.
  • Control socket: commands that walk dynamic structures (session-info, l2tp-tunnels, l2tp-sessions, isis-database, ospf-database, ldp-database, li-flows) now run in the main loop, which fixes races. Argument conversion is fixed as well.
  • Signals: teardown signals are now handled in the main thread only. Log output and ncurses output are serialized.
  • Timers: a use-after-free of timer owners after timer_del, and a skipped timer when a callback moved its timer.
  • I/O: PACKET_MMAP now uses the captured length and acquire/release ordering of the frame status.
  • Configuration: integer values outside the range in the schema are now rejected (e.g. tx-interval, rx-cpuset, IS-IS sr-algo), as are non-string IS-IS area entries, which crashed.
  • Utilities: parsing of prefix lengths and ISO addresses.
  • ICMP client: a request data overflow with size 0 or 1.
  • LI flow keys, HTTP response parsing, and TUN and ARP client errors.
  • Schema: the default of DHCPv6 ia-separate is now false, as in the code and the documentation.

LSPGEN

LSPGEN got many fixes and new unit tests, among them:

  • OSPF packet checksum, area ID byte order, prefix SIDs, network masks and connectors.
  • IS-IS fragmentation and connector parsing.
  • Links between subgraphs of large topologies.
  • Reading of config files (root node, OSPF link IDs and prefixes, OSPFv3 hostnames, IS-IS router capabilities). Config files with errors are now rejected.
  • Control socket error handling.
  • Memory leaks, buffer overflows and out of bounds reads.
  • Graphviz is now executed without a shell.

Documentation

  • New EVPN test guide.
  • The performance guide is updated for AF_XDP and stream capture.
  • Documentation for targeted LDP, BGP L2VPN, L2TP proxy authentication and the LSPGEN tool is updated.
  • Epoch values in the API are now documented as monotonic clock seconds.

Full changelog: 1.0.2...1.1.0

Assets 7
Loading