<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8" />
<meta name="generator" content="pandoc" />
<meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
<style>
html {
line-height: 1.2;
font-family: serif;
font-size: 0.9em;
color: black;
background-color: white;
}
body {
margin: 0;
margin-right: auto;
max-width: 36em;
padding: 1em;
hyphens: auto;
overflow-wrap: break-word;
text-rendering: optimizeLegibility;
font-kerning: normal;
}
@media print {
body {
background-color: transparent;
color: black;
font-size: 11pt;
}
p, h2, h3 {
orphans: 3;
widows: 3;
}
h2, h3, h4 {
page-break-after: avoid;
}
}
p {
margin: 1em 0;
}
a {
color: black;
}
a:visited {
color: black;
}
img {
max-width: 100%;
}
h1, h2, h3, h4, h5, h6 {
margin-top: 1.4em;
}
h5, h6 {
font-size: 1em;
font-style: italic;
}
h6 {
font-weight: normal;
}
ol, ul {
padding-left: 1.7em;
margin-top: 1em;
}
li > ol, li > ul {
margin-top: 0;
}
blockquote {
margin: 0.5em;
padding-left: 0.5em;
border-left: 2px solid #e6e6e6;
color: #444;
}
code {
font-family: 'Lucida Console', monospace;
font-size: 95%;
margin: 0;
}
pre {
margin: 1em 0;
overflow: auto;
max-width: unset;
width: fit-content;
}
pre code {
padding: 0;
overflow: visible;
overflow-wrap: normal;
max-width: unset;
white-space: pre-wrap;
}
pre code span {
white-space: pre;
}
.sourceCode {
background-color: transparent;
overflow: visible;
}
code.diff span.kw,
code.diff span.dt {
font-weight: bold;
}
code.diff span.va {
background-color: rgba(192, 255, 192, 64);
color: rgb(0, 64, 0);
}
code.diff span.st {
background-color: rgba(255, 192, 192, 64);
color: rgb(64, 0, 0);
}
pre.diff {
background-color: rgb(240, 240, 240);
padding: 0.4em;
border: 1pt solid grey;
}
hr {
background-color: black;
border: none;
height: 1px;
margin: 1em 0;
}
table {
margin: 1em 0;
border-collapse: collapse;
width: 100%;
overflow-x: auto;
display: block;
font-variant-numeric: lining-nums tabular-nums;
}
table caption {
margin-bottom: 0.75em;
}
tbody {
margin-top: 0.5em;
border-top: 1px solid black;
border-bottom: 1px solid black;
}
th {
border-top: 1px solid black;
padding: 0.25em 0.5em 0.25em 0.5em;
}
td {
padding: 0.125em 0.5em 0.25em 0.5em;
}
header {
margin-bottom: 4em;
text-align: center;
}
code{white-space: pre-wrap;}
span.smallcaps{font-variant: small-caps;}
span.underline{text-decoration: underline;}
div.column{display: inline-block; vertical-align: top; width: 50%;}
div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
ul.task-list{list-style: none;}
q { quotes: "„" "”" "»" "«"; }
.display.math{display: block; text-align: center; margin: 0.5rem auto;}
</style>
</head>
<body>
<p>Thanks, Radu!</p>
<p>If I interpret this correctly, you run <code>from_kubernetes</code>
in two places:</p>
<ul>
<li>BGP import</li>
<li>kernel export</li>
</ul>
<p>I expect that in the table, there are routes from:</p>
<ul>
<li>BGP</li>
<li>Direct</li>
<li>Kernel</li>
</ul>
<p>While the BGP routes (should) have the <code>from</code> attribute
properly set (and therefore the <code>gw</code> setting works), the
Direct and Kernel routes have no such attribute, and on export to
kernel, the filter complains.</p>
<p>There is actually an undocumented difference between BIRD 2 and 3
(mea culpa, gonna fix that soon in the documentation) → in BIRD 2, all
routes have the <code>from</code> attribute available but ony BGP, Babel
and RIP set it to a meaningful value. Notably, Direct and Kernel set
<code>::</code> there.</p>
<p>In BIRD 3, only BGP, Babel and RIP routes have the <code>from</code>
attribute and in others, the attribute is undefined, therefore the
filter complains.</p>
<p>And because the filter is run on export to the kernel, it also runs
on the Direct routes, and exactly as I checked with our test setup, the
final behavior of the filter looks the same in v2 and v3. It lets BGP
routes pass (because they have <code>from</code> set) and rejects Direct
routes.</p>
<p>The only difference is that with Direct routes, the :: nexthop is
considered invalid in BIRD 2 (yielding the “Invalid gw address” error),
whereas in BIRD 3, it’s caught one step earlier and the report is more
cryptic.</p>
<p>The occassional “Invalid gw address” error in the logs, as well as
the new error message should be possible to tame by this piece of
filter:</p>
<pre><code>if ! defined(from) || (from = ::) then reject "from not set for ", net;</code></pre>
<p>… or just <code>… then reject;</code> if you want it silent.</p>
<p>Now I hope that I have deciphered your situation correctly and this
brings some help to you.</p>
<p>I may obviously be wrong and there may be a bug, but to help locate
it, I’ll need a log with <code>debug channels all;</code> on toplevel of
your config, and logs including the <code>trace</code> level. This will
pin the error message to the actual offending route, and in turn to the
source of that route which we can then investigate for missing the
<code>from</code> attribute.</p>
<p>Have a nice day!<br />
Maria</p>
<p>–<br />
Maria Matejka (she/her) | BIRD Team Leader | CZ.NIC, z.s.p.o.</p>
<p>On Wed, May 28, 2025 at 05:31:16PM +0200, Radu CARPA wrote:</p>
<blockquote>
<p>Hi, Maria,</p>
<p>Hereafter is the (very slightly modified) full configuration. Please
tell me if you need any more context information about it.</p>
<p>Regards, Radu</p>
<p>On 5/28/25 3:04 PM, Maria Matejka wrote: ><br />
> Which protocol originates the routes which are filtered by >
|from_kubernetes|? It looks like the |from| attribute is not set (which
> is probably another bug). ></p>
<pre><code>router id from "-tun*", "*";
filter from_kubernetes {
if ( net ~ 10.0.0.0/16 ) then {
ifname = "tunl0";
onlink = true;
gw = from;
accept;
}
reject;
}
filter direct_tunl0 {
if ( net ~ 10.0.0.0/16 && source = RTS_DEVICE ) then {
accept;
}
reject;
};
protocol direct {
debug { states };
ipv4;
interface "tunl0";
}
protocol kernel {
merge paths on limit 32;
learn;
persist;
scan time 2;
ipv4 {
table master4;
import all;
export filter from_kubernetes;
};
graceful restart;
}
protocol device {
debug { states };
scan time 2;
}
template bgp bgp_template {
passive on; # Kubernetes nodes will connect to us.
debug { states };
password "password";
local as 64512;
ipv4 {
import filter from_kubernetes;
export filter direct_tunl0;
add paths on;
};
graceful restart;
connect delay time 2;
connect retry time 5;
error wait time 5,30;
}
protocol bgp kube_nodes from bgp_template {
neighbor range 10.0.0.0/16 internal;
}
log syslog all;</code></pre>
</blockquote>
</body>
</html>