[dependabot]

Bumps exabgp from 4.2.25 to 5.0.14.

Release notes

Sourced from exabgp's releases.

ExaBGP 5.0.14 'Package'

Version 5.0.14 📦

This release is mostly about what ExaBGP sends and accepts. Please read the compatibility notes before upgrading as there is some changes.

The full list of changes is in the changelog.

New:

• every release now comes with a zipapp, exabgp.pyz: ExaBGP in a single file, which any Python 3.8 or later runs, with nothing to install.

  curl -LO https://github.com/Exa-Networks/exabgp/releases/download/5.0.14/exabgp.pyz
  curl -LO https://github.com/Exa-Networks/exabgp/releases/download/5.0.14/SHA256SUMS
  sha256sum --ignore-missing -c SHA256SUMS
  chmod +x exabgp.pyz
  ./exabgp.pyz version

• FlowSpec rate limits can be given in packets per second, with rate-limit <n> packets (RFC 8955). A rate limit without a unit is still in bytes per second.

Compatibility:

• ADD-PATH is no longer offered for ipv4 mup and ipv6 mup. The encoder never sent a path identifier, so a peer accepting the capability misread every route.

• with multi-session enabled, ExaBGP also offers the Cisco capability code (131). A Cisco peer offering only 131 was refused with NOTIFICATION 2/9.

• after a session was established, a reconnection no longer claims a Graceful Restart restart. The first session and an explicit re-establishment still do.

Fixes:

• UPDATE generation was reworked. IPv4 multicast uses the MP attributes, native and MP routes are no longer mixed or repeated across packets, and an MP route too large to fit is logged and skipped rather than resetting the session over and over.

• decoding was tightened across communities, Prefix-SID, AS4_PATH, AS4_AGGREGATOR, EVPN, MVPN, FlowSpec and BGP-LS. Malformed attributes are treated as withdraw or discarded as the RFCs ask, rather than resetting the session or being accepted. One peer's ASN4 or AIGP negotiation no longer changes how another peer's UPDATE is read.

• a FlowSpec rule with no match component is refused. It used to become a filter matching all traffic.

• reload now removes idle passive peers and the listening sockets nobody uses, and opens newly configured ones. Restarting API helpers during a reload no longer counts as a crash.

• sessions without authentication work on Linux kernels without TCP_MD5SIG. A configured password still fails if the kernel can not provide it. incoming-ttl now also applies to outgoing sessions.

ExaBGP 5.0.13 'Waving Hand'

Version 5.0.13 👋

This release is about what a BGP peer can do to ExaBGP and to the programs reading its API. Three changes alter what a peer or a consumer sees, so read the compatibility notes before upgrading.

• Security: a peer could write data of its own into the API streams: fields into the JSON stream through a BGP-LS attribute, and whole events into the

... (truncated)

Changelog

Sourced from exabgp's changelog.

Version explained:

• major : codebase increase on incompatible changes
• minor : increase on risk of code breakage during a major release
• bug : increase on bug or incremental changes

Version 5.0.14:

• Feature: every release has a zipapp attached, exabgp.pyz: ExaBGP as one file, run by any Python 3.8 or later, nothing to install. "./release binary" builds it from the wheel and checks it runs, with --functional to also run the functional tests against it.
• Feature: FlowSpec supports packet-per-second rate limits with "rate-limit packets" (RFC 8955). Existing rate limits remain in bytes per second; an explicit "bytes" unit is also accepted.
• Fix: automatic local-AS sessions advertise the resolved local ASN and matching ASN4 capability. Unresolved identities, AS_TRANS as a local identity, and four-octet identities with ASN4 disabled are refused.
• Fix: RouterID.create() constructs a RouterID and enforces its IPv4-only check. It returned a plain IPv4 or IPv6 object. The configuration already refuses a neighbour which could reach it with an IPv6 address, so no OPEN was affected.
• Fix: MULTISESSION Session Ids are decoded and checked against the grouping capabilities. Conflicting or missing grouping capabilities are refused rather than accepted or raising KeyError. The first repeated MULTISESSION capability is retained.
• Fix: with multi-session enabled, ExaBGP also offers the Cisco capability code (131), with a flags octet and no Session Id. Offering only the draft code (68) caused a Cisco peer offering 131 alone to be refused with NOTIFICATION 2/9.
• Fix: route-refresh and multisession capability variants belong to each decoded OPEN. Another peer's OPEN no longer changes an existing session's capability descriptions in logs and JSON.
• Fix: after a session has been established, ordinary reconnections no longer advertise the Graceful Restart Restart State flag. Initial establishment and explicit re-establishment still claim a restart.
• Fix: unsupported OPEN optional parameters are reported as NOTIFICATION 2/4. Bad Message Length notifications include the two erroneous length octets instead of an English error message.
• Fix: sending or receiving an OPERATIONAL message no longer raises KeyError on missing peer counters. Both counters reset when the session closes or the peer stops.
• Fix: IPv4 multicast announcements and withdrawals use MP attributes rather than the IPv4 unicast encoding. MP withdrawals do not require a next hop.
• Fix: UPDATE generation separates native announcements, native withdrawals, MP_REACH and MP_UNREACH, preserving withdrawal-before- reannouncement ordering within each family. Native prefixes are not repeated in later MP packets, and native withdrawals are not blocked by oversized announcement attributes.
• Fix: suppressing initial MP withdrawals no longer emits an empty UPDATE mistaken for IPv4 end-of-RIB.

... (truncated)

Commits

• 8601505 feat: every release has a zipapp attached, run by any Python 3.8 or later
• b999721 doc: changelog entries for the rest of 5.0.14
• 4c421f0 chore: remove the unused exabgp.conf.yang package
• aa8af7c qa: the api scripts wait on what reached the wire, not on the clock
• e1ca58e fix: offer the Cisco multisession capability code as well as the draft one
• 9e45cb5 fix: the end of RIB line to an API process had its braces doubled
• 6c8420b fix: sending or receiving an OPERATIONAL message raised KeyError
• 2050931 fix: RouterID.create() returned an IPv4 or IPv6, not a RouterID
• bc2c16e fix: the end of RIB marker reported to an API process was not JSON
• 967d4fb fix: validate complete route encodings with resolved offline ASNs
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)