<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<font face="DejaVu Sans">Hi,<br>
<br>
as of my understanding ports for BFD session are not ephemeral;
the port is chosen statically when the daemon spawns (and even
survives lost BFD sessions).<br>
<br>
Further, there is no RFC known to me that requests limitations on
usable port ranges for arbitrary outgoing connections in general--
linux just likes to use 'its' port range and and the world is fine
with this.<br>
On the other hand, RFC5581 requests specifically the narrow range
of 49152-65535 for originating BFD sessions, so bird should comply
with this.<br>
<br>
Thus the somewhat silly workaround would just seem the thing to be
done to fix this issue.<br>
<br>
Kind regards<br>
Christian</font><br>
<br>
<div class="moz-cite-prefix">On 2/17/22 15:43, Ondrej Zajicek wrote:<br>
</div>
<blockquote type="cite"
cite="mid:Yg5fJTNl9aTj0Zbu@feanor.crfreenet.org">
<pre class="moz-quote-pre" wrap="">On Thu, Feb 17, 2022 at 01:09:33PM +0100, Christian Bruns wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">Hi all,
we experienced issues with non-functional BFD Sessions. Debugging yielded
that bird does not use RFC compliant BFD Port ranges.
RFC 5881 states: "" The source port MUST be in the range 49152 through
65535. ""; however, the port range is not restricted within bird and thus
using arbitrary high ports.
Some tier 1 transit providers like "Deutsche Telekom" apply strict filter
for BFD and only allow RFC5881 compliant ports, hence the issue.
There is a workaround to limit the port range globally at system level
(/proc/sys/net/ipv4/ip_local_port_range); this seems to work, but we have
the strong feeling that restriction of port range for BFD sessions should
happen within bird itself.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
Hi
Unfortunately, this AFAIK does not have a good solution without some additional
Linux kernel API.
First, restriction for port ranges 49152-65535 is not a speciality of
BFD, it is an ephemeral port range designated for outgoing connections or
datagrams without defined port number, but Linux by default use range
starting with 32768. So setting ip_local_port_range just fixes Linux bad
default values.
Second, there is no API in Linux to allocate 'any free socket within
range'. BSD has IP_PORTRANGE socket option, but there is (AFAIK) no such
thing in Linux. One could either require explicit port number, or any
free port from the range. And doing systematic enumeration of port
numbers from ephemeral port range and trying them one after another
seems like silly workaround.
</pre>
</blockquote>
<br>
</body>
</html>