改变BGP数据包大小小于19和大于4096

Question

我在Ubuntu BGP实现工作。我想要做的BGP报文的一些畸形，BGP限制在19间大小为4096我们，但是对于测试目的，我改变了尺寸小于19和大于4096在此之后，当我把这个分组从一到二，两个扬声器之间建立BGP会话，第二个应发送通知消息包含错误：坏消息长度。但我没有得到在Wireshark中，与其它显示恶意数据包，也我不能够在Wireshark中打开包。任何人可以帮助我在这畸形数据包，并获得通知的错误。

只为信息：我想尽包一样打开，更新和存活。畸形的开包：

Answer 1

已更新回答以下

在Wireshark中所示的BGP分组具有标记字段（16×FF），随后加入长度为16（00 10）。

因此，这的确是你想测试的情景：你的测试BGP扬声器发出的BGP数据包长度不正确，并且在测试远程BGP发言人应通过发送回的通知包，错误代码“消息头错误”作出回应，错误子代码“坏消息长度”。

Wireshark是示出从测试仪BGP扬声器被测发送到BGP扬声器畸形BGP数据包。 Wireshark是正确的抱怨，这是一个畸形BGP包：它是畸形的，因为长度是无效的。显然，Wireshark是不是很具体什么不喜欢的包。

你应该看看的TCP流在相反的方向（来源10.0.0.2目的地10.0.0.1），并寻找下测试的BGP发言者发回的BGP通告报文。

修订ANSWER从这里开始

基于错误信息（[Error] bgp_read_packet error: Connection reset），它看起来像你正在测试自由放养的路由，或者它的前身斑驴或斑马之一。

我复制你正在测试的情景。

我运行一个自由放养的路由（FRR）BGP扬声器具有以下配置：

Current configuration:
!
frr version 7.1-dev-MyOwnFRRVersion
frr defaults traditional
hostname ip-172-31-31-121
log file /var/log/frr/debug.log
log syslog
service integrated-vtysh-config
!
debug bgp neighbor-events
!
router bgp 100
 neighbor X.X.X.X remote-as 200   
!
line vty
!
end

我用下面的Python测试程序发送一条消息以“太短”头：

#!/usr/bin/env python3

import socket

BGP_IP = 'Y.Y.Y.Y'

SHORT_MSG = (b'\xff\xff\xff\xff\xff\xff\xff\xff'     # First 8 bytes of marker
             b'\xff\xff\xff\xff\xff\xff\xff\xff'     # Last 8 bytes of marker
             b'\x00\x10'                             # Length 16
             b'\x01')                                # Open

def main():
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    print("Socket created")
    sock.connect((BGP_IP, 179))
    print("Socket connected")
    sock.send(SHORT_MSG)
    print("Short message sent")
    while True:
        data = sock.recv(1)
        if data == b'':
            print("Connection closed or reset")
            break
        print("Received:", data)

if __name__ == "__main__":
    main()

与测试的IP地址替换X.X.X.X，并与BGP扬声器测试的IP地址替换Y.Y.Y.Y。

在这种情况下，被测试的BGP发言者确实发送正确的通知消息。

这里是什么FRR日志报告：

2019/02/09 21:49:05 BGP: 172.31.17.121 [FSM] Timer (connect timer expire)
2019/02/09 21:49:05 BGP: 172.31.17.121 [FSM] ConnectRetry_timer_expired (Active->Connect), fd -1
2019/02/09 21:49:05 BGP: 172.31.17.121 [Event] Connect start to 172.31.17.121 fd 26
2019/02/09 21:49:05 BGP: 172.31.17.121 [FSM] Non blocking connect waiting result, fd 26
2019/02/09 21:49:05 BGP: bgp_fsm_change_status : vrf 0, established_peers 0
2019/02/09 21:49:05 BGP: 172.31.17.121 went from Active to Connect
2019/02/09 21:49:05 BGP: 172.31.17.121 [Event] Connect failed 111(Connection refused)
2019/02/09 21:49:05 BGP: 172.31.17.121 [FSM] TCP_connection_open_failed (Connect->Active), fd 26
2019/02/09 21:49:05 BGP: bgp_fsm_change_status : vrf 0, established_peers 0
2019/02/09 21:49:05 BGP: 172.31.17.121 went from Connect to Active
2019/02/09 21:49:08 BGP: [Event] BGP connection from host 172.31.17.121 fd 26
2019/02/09 21:49:08 BGP: bgp_fsm_change_status : vrf 0, established_peers 0
2019/02/09 21:49:08 BGP: 172.31.17.121 went from Idle to Active
2019/02/09 21:49:08 BGP: 172.31.17.121 [FSM] TCP_connection_open (Active->OpenSent), fd 26
2019/02/09 21:49:08 BGP: 172.31.17.121 passive open
2019/02/09 21:49:08 BGP: 172.31.17.121 Sending hostname cap with hn = ip-172-31-31-121, dn = (null)
2019/02/09 21:49:08 BGP: 172.31.17.121 sending OPEN, version 4, my as 100, holdtime 180, id 172.31.31.121
2019/02/09 21:49:08 BGP: bgp_fsm_change_status : vrf 0, established_peers 0
2019/02/09 21:49:08 BGP: 172.31.17.121 went from Active to OpenSent
2019/02/09 21:49:08 BGP: 172.31.17.121 bad message length - 16 for OPEN
2019/02/09 21:49:08 BGP: %NOTIFICATION: sent to neighbor 172.31.17.121 1/2 (Message Header Error/Bad Message Length) 2 bytes 00 10
2019/02/09 21:49:08 BGP: 172.31.17.121 [FSM] BGP_Stop (OpenSent->Idle), fd 26
2019/02/09 21:49:08 BGP: bgp_fsm_change_status : vrf 0, established_peers 0
2019/02/09 21:49:08 BGP: 172.31.17.121 went from OpenSent to Deleted

注意：“坏消息长度”的消息。

下面是测试程序报告：

Socket created
Socket connected
Short message sent
Received: b'\xff'
Received: b'\xff'
Received: b'\xff'
Received: b'\xff'
Received: b'\xff'
Received: b'\xff'
Received: b'\xff'
Received: b'\xff'
Received: b'\xff'
Received: b'\xff'
Received: b'\xff'
Received: b'\xff'
Received: b'\xff'
Received: b'\xff'
Received: b'\xff'
Received: b'\xff'
Received: b'\x00'
Received: b'\x17'
Received: b'\x03'
Received: b'\x01'
Received: b'\x02'
Received: b'\x00'
Received: b'\x10'
Connection closed or reset

请注意，这是正确的坏消息长度的通知。

这是坏消息的Wireshark的解码：

以下是通知的Wireshark的解码：

如果测试程序终止，并且不试图读取通知消息，然后根据测试的BGP发言者将无法发送通知消息在电线上。这是因为它会收到一个TCP RST消息之前，它是能够发送通知。为什么你没有看到电线上的通知，这是最有可能的。

事实上，我能够通过修改测试程序如下重现此假设：

#!/usr/bin/env python3

import socket
import struct

BGP_IP = '172.31.31.121'

SHORT_MSG = (b'\xff\xff\xff\xff\xff\xff\xff\xff'     # First 8 bytes of marker
             b'\xff\xff\xff\xff\xff\xff\xff\xff'     # Last 8 bytes of marker
             b'\x00\x10'                             # Length 16
             b'\x01')                                # Open

def main():
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    print("Socket created")
    sock.connect((BGP_IP, 179))
    print("Socket connected")
    sock.send(SHORT_MSG)
    # Trick TCP into sending a RST when the socket is closed
    on_off = 1
    linger = 0
    sock.setsockopt(socket.SOL_SOCKET, socket.SO_LINGER, struct.pack('ii', on_off, linger))
    print("Socket linger time set to 0")
    # Close the socket
    sock.close()
    print("Socket closed")
    # Terminate without reading the response NOTIFICATION

if __name__ == "__main__":
    main()

使用这个测试程序，该通知从Wireshark的跟踪（完全是你报吧）失踪：

注意，我必须通过一些跳铁圈（具体设置逗留时间为零）来强制测试程序发送一个RST，而不是一个FIN ACK。 （见Sending a reset in TCP/IP Socket connection了解详细信息。）

如果测试程序发送一个FIN ACK，而不是一个RST（发生，如果你正常关闭套接字，甚至正常终止，而无需关闭套接字）的，则被测BGP扬声器就能收到FIN ACK后发送通知但发送它自己的FIN ACK之前。