Week of 2026-02-16
A hard round of route reflector hardening, a live web dashboard for the chaos tool, and a batch of BGP protocol and config improvements.
🔀 Route reflector hardening
The route reflector had a rough week of bug-hunting and came out solid. Fixes landed for routes being dropped under a slow consumer, deadlocks from subscribing to both directions of a session, incorrect per-family filtering, and log spam during backpressure. The UPDATE cache is now refcounted with configurable size and TTL, out-of-order acknowledgements are treated as no-ops instead of protocol violations, and forwarding moved to per-source and per-destination worker pools so one slow peer no longer stalls the others. Shutdown got faster too: sequential per-component timeouts that used to compound are now parallel waits under a single deadline, making daemon stop near-instant.
🌪️ Chaos tool dashboard
The chaos testing tool (now renamed ze-chaos) gained a live web dashboard (--web :8080) with real-time SSE event streaming, a peer status grid, a route matrix heatmap, and pause/resume/rate controls. Underneath it: an in-process simulation mode with virtual time that runs over 100x faster than driving real TCP connections, a set of composable RFC property assertions (route consistency, convergence deadlines, no duplicate routes, hold-timer enforcement, message ordering) checked against every run, and a shrink engine that reduces a failing run down to a minimal reproduction automatically. Chaos fault injection can now also be wired directly into a running Ze process via CLI flag, environment variable, or config.
📄 A new IETF draft: ATTR_TOMBSTONE
RFC 7606's "attribute discard" action says a malformed attribute MUST be removed and the UPDATE continues to be processed. The conventional way to do that is to rebuild the whole path attributes section: shift every attribute after the bad one down to close the gap, then recompute the path attributes length, the UPDATE's total length, and any offsets an implementation cached while parsing.
There's a cheaper trick: overwrite the malformed attribute in place with an unused attribute code instead of removing it. Nothing moves, no length field changes, and any offsets already computed for the rest of the message stay valid. This already works against any conformant BGP speaker today, no new RFC required, because RFC 4271 already specifies safe handling of attributes a speaker doesn't recognize.
Ze started enforcing RFC 7606 error handling this week and implemented
exactly this: attribute-discard markers written in place, first under the
name ATTR_DISCARD (and a first draft, draft-mangin-idr-attr-discard-00).
A few days later both got renamed to ATTR_TOMBSTONE, with the draft revised
to match: a specific, reserved code point with a defined value format
(which attribute got discarded, and why), so implementations that adopt it
are speaking the same language instead of each inventing their own
incompatible version of the same trick. It's the same principle behind Ze's
own wire encoding: operate on the buffer in place instead of copying it.
🛰️ Protocol and config
- Duplicate router IDs within the same AS are now rejected on OPEN per RFC 4271 §4.2
- All BGP capabilities (ASN4, route refresh, extended message, add-path, graceful restart, extended next-hop) now share the same four enforcement modes as address families: enable, disable, require, refuse
- Peers can each bind a dedicated listen port, so multiple peers can run on 127.0.0.1 without loopback aliases
- The
passiveboolean peer option was replaced with aconnectionmode (both/passive/active) for clearer intent - Config gained presence containers, inline list syntax, and an extended-community length suffix
🛠️ Under the hood
BGP capability handling (route refresh, graceful restart, hostname, software version) moved out of the core engine into independent plugins, and a lightweight "summary" subscription format was added for consumers that only need announce/withdraw and family information rather than fully decoded attributes.