BGP-LS Integration

[andrediashexa]

I've being using this tool for some time, so I was wondering "what if topolograph supports BGP-LS to build the topology"?

This way, I can host outside of the network.

Do you think it can be considered in the future?

Btw, thank you for the tool, its awesome.

[Vadims06]

Hi @andrediashexa ,
Thanks for your request.
Yeah, BGP-LS is a must have feature for Topolograph, and BGP-LS is in alpha stage for IS-IS. I hope that OSPF will be released right after the IS-IS. I will keep you posted!

[Vadims06]

Hi @andrediashexa ,
I've just recently released Topolograph v2.54 and IS-IS Watcher v3.0.0 with BGP-LS support. I will be glad for your feedback

[andrediashexa]

OMG Vadim, sry for the delay. I'll test it ASAP, thank you so much!

[Vadims06]

Hi @andrediashexa
just wanted to share with you a good news - I've just recently released Topolograph v2.59 and OSPF Watcher v3.1.0 with BGP-LS support including TE attributes. It took almost 6 months to fully onboard BGP-LS into Topolograph since you created this feature request, but this task is eventually completed)

Here is a picture how TE metrics are shown on the Monitoring page

[andrediashexa]

Helloooo, sorry the delay! I tested this feature this week and found a bug and when I did the below it worked as a charm.

important information, I changed the public address and the public ASN before posting it here, so the HEX can have something different.

Bug Report: GoBGP rejects BGP-LS default route (prefix-length 0), resetting the session

Date: 2026-06-14
Components: vadims06/bgplswatcher (GoBGP v4.6.0) + ospfwatcher v3.1.0 (BGP-LS mode)
Peer: Huawei NE40E (VRP), OSPF → BGP-LS
Severity: High — BGP-LS session never stays up; no topology is collected.

---

Summary

In BGP-LS mode, the bgplswatcher (GoBGP) session to a Huawei NE40E reached
ESTABLISHED and then immediately reset in a loop. Root cause: GoBGP v4.6.0
rejects a BGP-LS IPv4/IPv6 Topology Prefix NLRI whose IP Reachability
Information TLV carries prefix-length 0 (the default route 0.0.0.0/0),
treating it as a malformed UPDATE. The fix is a small patch to GoBGP's
LsTLVIPReachability.DecodeFromBytes. After patching and rebuilding the image,
the session is stable and the full OSPF topology (incl. the default route) is
collected and pushed to Topolograph.

---

Environment

• Watcher host: Debian 12, Docker 29, containerlab 0.76.0.
• ospfwatcher v3.1.0, image vadims06/ospf-watcher:v3.1.0.
• vadims06/bgplswatcher:latest → GoBGP v4.6.0.
• BGP-LS session: eBGP, watcher AS 64497, NE40 AS 64496, multihop TTL 255,
  watcher active / NE40 listen-only (passive), through NAT.
• NE40 OSPF injected into BGP-LS via ospf 1 / bgp-ls enable +
  opaque-capability enable, with default-route-advertise always.

---

Symptom

gobgp neighbor cycled Idle → Active → Established → Idle. Capability
negotiation succeeded (BGP-LS ls: advertised and received), but the session
dropped within seconds of every establishment.

bgplswatcher logs:

State=BGP_FSM_ESTABLISHED
Session will be reset due to malformed BGP message
  Error="Incorrect IP reachability Info length"
sent notification  Code=3(update) Subcode=10(invalid network field)
Peer Down  Reason="notification-sent code 3(update) subcode 10(invalid network field)"

This repeated indefinitely — the session never carried any topology.

---

Root-cause analysis

The NOTIFICATION data (the offending attribute echoed back) decodes to a BGP-LS
MP_REACH_NLRI:

90 0e 00 44                 attr: optional+ext-len, type 14 (MP_REACH), len 68
40 04 47                    AFI 16388 (BGP-LS), SAFI 71 (BGP-LS)
04 c0 00 02 01 00           nexthop len 4, nexthop 192.0.2.1, reserved
00 03 00 37                 NLRI type 3 (IPv4 Topology Prefix), len 55
   03 ...                   protocol-id 3 (OSPFv2), local-node descriptors ...
   ... 01 08 00 01 04       TLV 264 (OSPF Route Type) = 4
   ... 01 09 00 01 00       TLV 265 (IP Reachability Info) len 1, value 0x00

The last TLV — IP Reachability Information (type 265) — has length 1 and
value 0x00, i.e. prefix-length = 0 with 0 prefix bytes = the default
route 0.0.0.0/0. This is generated on the NE40 by default-route-advertise always (OSPF external) being mirrored into BGP-LS.

GoBGP rejects it in pkg/packet/bgp/bgp.go, LsTLVIPReachability.DecodeFromBytes:

if len(value) < 2 {                                  // (1) value is [0x00] -> len 1 -> REJECTED here
    return malformedAttrListErr("Incorrect IP reachability Info length")
}

// https://tools.ietf.org/html/rfc7752#section-3.2.3.2
if value[0] > 128 || value[0] == 0 {                 // (2) also rejects prefix-length 0
    return malformedAttrListErr("Incorrect IP prefix length")
}

ll := (int(value[0])-1)/8 + 1                         // (3) for value[0]==0 -> ll = 1 (wrong, should be 0)
if len(value[1:]) != ll {
    return malformedAttrListErr("Malformed IP reachability TLV")
}

A default route is a valid BGP-LS prefix NLRI: prefix-length 0 → 0 prefix
bytes → TLV value length 1 (just the prefix-length octet). GoBGP's
len(value) < 2 guard (and the explicit value[0] == 0 check) reject it. The
observed error string is from guard (1).

---

Fix

Patch pkg/packet/bgp/bgp.go, LsTLVIPReachability.DecodeFromBytes to accept
prefix-length 0:

-	if len(value) < 2 {
+	if len(value) < 1 {
 		return malformedAttrListErr("Incorrect IP reachability Info length")
 	}

 	// https://tools.ietf.org/html/rfc7752#section-3.2.3.2
-	if value[0] > 128 || value[0] == 0 {
+	// PrefixLength 0 is valid (default route 0.0.0.0/0 or ::/0).
+	if value[0] > 128 {
 		return malformedAttrListErr("Incorrect IP prefix length")
 	}

-	ll := (int(value[0])-1)/8 + 1
+	ll := 0
+	if value[0] > 0 {
+		ll = (int(value[0])-1)/8 + 1
+	}
 	if len(value[1:]) != ll {
 		return malformedAttrListErr("Malformed IP reachability TLV")
 	}

LsTLVIPReachability.toPrefix() already handles prefix-length 0 safely (it
zero-fills a 16-byte buffer and netip.ParsePrefix("0.0.0.0/0") succeeds), so no
change is needed there.

---

Validation

Unit test against the exact captured bytes:

func TestIPReachDefault(t *testing.T) {
    // TLV: type 0x0109 (IP_REACH), len 1, value 0x00 (prefix-length 0 = default)
    data := []byte{0x01, 0x09, 0x00, 0x01, 0x00}
    l := &LsTLVIPReachability{}
    if err := l.DecodeFromBytes(data); err != nil {
        t.Fatalf("decode failed: %v", err)
    }
    if l.PrefixLength != 0 {
        t.Fatalf("want preflen 0, got %d", l.PrefixLength)
    }
    if p := l.toPrefix(false); p.String() != "0.0.0.0/0" {
        t.Fatalf("want 0.0.0.0/0, got %s", p.String())
    }
}

Result: PASS — decodes the default route to 0.0.0.0/0.

---

Build & deploy

bgplswatcher is a command inside a GoBGP fork tree
(module github.com/osrg/gobgp/v4/cmd/bgplswatcher, replace ... => ../..).
Rebuild:

# 1. GoBGP v4.6.0 source with the patch applied
git clone --depth 1 --branch v4.6.0 https://github.com/osrg/gobgp.git gobgp-src
#    edit gobgp-src/pkg/packet/bgp/bgp.go (patch above)

# 2. add the bgplswatcher command + Dockerfile from the bgplswatcher repo
cp bgplswatcher/{main.go,go.mod,go.sum,config.toml} gobgp-src/cmd/bgplswatcher/
cp bgplswatcher/Dockerfile gobgp-src/Dockerfile

# 3. build the patched image
docker build -t vadims06/bgplswatcher:patched gobgp-src/

Point the containerlab node at it:

bgplswatcher:
  kind: linux
  image: vadims06/bgplswatcher:patched
  image-pull-policy: never

Redeploy: containerlab deploy --topo watcher/watcher1-bgpls-ospf/config.yml.

---

Result

• Session ESTABLISHED and stable, 0 malformed messages.
• gobgp global rib -a ls: full topology (NODE / LINK / PREFIX NLRIs), default
  route included.
• Topology pushed to Topolograph (24 nodes, 158 networks).

---

Operational note (separate startup race)

bgplswatcher establishes BGP and forwards paths to ospf-watcher's gRPC server
(:50201) the moment routes arrive. On a cold deploy, ospf-watcher is still
starting (startup-delay 10s + Python import time), so the first burst of
forwards fails with connection refused and is lost (BGP WatchEvent does not
replay). After everything is up, force a hard reset so all routes are re-learned
and forwarded:

docker exec watcher1-bgpls-ospf-bgplswatcher gobgp neighbor 192.0.2.1 reset

A soft reset / route-refresh is not enough — GoBGP does not emit WatchEvent
updates for re-received identical routes. (Long-term fix would be to start
ospf-watcher and bind :50201 before the BGP session establishes.)

[Vadims06]

Hi @andrediashexa,

Thank you so much for this incredibly detailed bug report — the hex decode, root-cause analysis, the exact fix diff, and even a unit test. That is exactly the level of depth that makes a bug report actionable immediately.

The fix has been implemented and published:

• GoBGP fix (PR osrg/gobgp#3458) — LsTLVIPReachability.DecodeFromBytes now correctly accepts prefix-length 0 (0.0.0.0/0 / ::/0)
• New image — vadims06/bgplswatcher:v1.0.4 / vadims06/bgplswatcher:latest is published on Docker Hub with the fix applied

Could you please pull the new image and confirm the session stays stable with your Huawei NE40E?

docker pull vadims06/bgplswatcher:latest

Thank you again!

[andrediashexa]

No problems, glad to help! I'll test it ASAP

[andrediashexa]

Yeeeeeah! Confirmed working!

• BGP-LS session: Established, 338/338 NLRIs accepted.
• Default route now accepted: 0.0.0.0/0 NLRIs are present in the LS-RIB (no more Incorrect IP reachability Info length / NOTIFICATION code 3 subcode 10).
• No flap — session stayed up cleanly through ~2+ min of monitoring, uptime monotonic.
• Pulled the new image, swapped it into the containerlab topology, redeployed — worked like a charm!

Thanks mate!