September 2013 - Bird-users

bird OSPFv2 exstart & router-id change
by Alexander V. Chernikov 13 Sep '13

13 Sep '13

Hello list! There is a "bug" in hello validation code causing neighbor to stuck in "exstart" state forever in case of router id change. RFC 2328 tells us to rely on neighbor source address for Broadcast/PtMP/MBMA links (10.5). No special checks are required for the router id (the same, 10.5). So, the problem can easily be repeated with 2 bird instances: B1 (rtr-id 1.2.3.22) B2 (rtr-id 1.2.3.20) Configure OSPFv2 on some shared medium, wait until they become adjacent (actually, FULL) Change B2 rtr-id to 1.2.3.200 and perform re-configure. Bird then (like any other good implementation) will send new hello without any neighbors in it, so B1 changes its state to "Down". When going to 'exstart' state the following problem occurs: B1 "remembers" old rtr-id (which is smaller than B1's) so it assumes B2 to be the master. B2 by the same rules assumes B1 is the master, so they start infinite DBDES ping-pong every RxmitInterval seconds (10.8) Patch to fix this behavior attached.

2 1

import functions & filters at same time of BGP protocol
by Javor Kliachev 12 Sep '13

12 Sep '13

Hello, I would like to know what will happen if we use function & filters configured at same time on import direction of given BGP procotol. Which is first pass? Till now we use one function to many applied to many BGP protocol with arguments and everything seems fine. But when I decided to apply and "filter import <some filter>" all conditions and rules in my applied function was totally ignored. Only the condition in the filter was checked. Here is my simple filter configuration: filter in_AS1234 { if ( net = 10.10.10.0/24 ) then reject; else accept; } My BGP protocol has following structure: protocol bgp R0_88 from PEERS { description "0.88_Customer"; neighbor 10.0.0.88 as 1234; import where MM_BGP_IN(1234,1,1); export where MM_BGP_OUT(1234); import filter in_AS1234; table T1234; route limit 1000; } Thank you for your help in advance. Best~ -- --- Find out about our new Cloud service - Cloudware.bg <http://cloudware.bg/?utm_source=email&utm_medium=signature&utm_content=link…> Access anywhere. Manage it yourself. Pay as you go. ------------------------------------------------------------------------ *Javor Kliachev* IP Engineer Neterra Ltd. Telephone: +359 2 975 16 16 Fax: +359 2 975 34 36 www.neterra.net <http://www.neterra.net>

2 3

BIRD and RPKI
by Michael Baer 11 Sep '13

11 Sep '13

Hi, I've been working on a BGPSEC implementation using BIRD. A requirement of the BGPSEC protocol is the availability of origin authentication using the RPKI. I understand that BIRD has implemented roa_tables that will allow a user to filter routes based on asn/prefix information pulled from the RPKI. It looks like it would be pretty straight forward to have a separate tool that uses one of the available RPKI pulling packages and then populates the roa_tables using BIRD's CLI or configuration interface. But for the sake of not duplicating effort and to make sure that I'm not missing anything, is this the expected method for someone supporting origin authentication in BIRD? or are there (currently) future plans for support that is more integral to BIRD? Thanks, Mike -- Michael Baer PARSONS baerm(a)tislabs.com

2 1

compiling bird for Synology DS713+
by Александр 11 Sep '13

11 Sep '13

Hello! I want to compile bird for Synology DS713+ (Linux DiskStation 3.2.40 #3776 SMP Mon Aug 26 23:41:39 CST 2013 x86_64 GNU/Linux), but fails here is configure output =========Beginning of the citation============== checking for gcc... gcc checking whether the C compiler works... yes checking for C compiler default output file name... a.out checking for suffix of executables... checking whether we are cross compiling... no checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking for library containing clock_gettime... -lrt checking build system type... x86_64-unknown-linux-gnu checking host system type... x86_64-unknown-linux-gnu checking for gcc... (cached) gcc checking whether we are using the GNU C compiler... (cached) yes checking whether gcc accepts -g... (cached) yes checking for gcc option to accept ISO C89... (cached) none needed checking whether CC supports -Wno-pointer-sign... yes checking whether CC supports -fno-strict-aliasing... yes checking whether CC supports -fno-strict-overflow... yes checking CFLAGS... -g -O2 -Wall -Wstrict-prototypes -Wno-parentheses -Wno-pointer-sign -fno-strict-a liasing -fno-strict-overflow checking how to run the C preprocessor... gcc -E checking for a BSD-compatible install... /opt/bin/install -c checking for ranlib... ranlib checking for flex... flex checking for bison... bison checking for gm4... no checking for m4... m4 checking which OS configuration should we use... ./sysdep/cf/linux.h checking system-dependent directories... sysdep/linux sysdep/unix lib checking protocols... ok checking for linux/rtnetlink.h... yes checking for grep that handles long lines and -e... /bin/grep checking for egrep... /bin/grep -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking syslog.h usability... yes checking syslog.h presence... yes checking for strings.h... yes checking alloca.h usability... yes checking alloca.h presence... yes checking for alloca.h... yes checking whether 'struct sockaddr' has sa_len... no checking whether byte ordering is bigendian... no checking size of char... 1 checking size of short int... 2 checking size of int... 4 checking size of long int... 4 checking size of long long int... 8 checking for 8-bit type... char checking for 16-bit type... short int checking for 32-bit type... int checking for 64-bit type... long long int checking usual alignment of structures... 8 checking characteristics of time_t... 32-bit signed checking for struct ip_mreqn... yes checking for add_history in -lhistory... yes checking for tgetent in -lncurses... yes checking for rl_callback_read_char in -lreadline... yes checking for rl_crlf in -lreadline... yes checking for rl_ding in -lreadline... yes configure: creating ./config.status config.status: creating Makefile config.status: creating obj/Makefile config.status: creating obj/Rules config.status: creating obj/sysdep/autoconf.h config.status: obj/sysdep/autoconf.h is unchanged config.status: executing merge commands Merging system-dependent modules (sysdep/linux sysdep/unix lib) BIRD was configured with the following options: Source directory: . Object directory: obj Iproute2 directory: /etc/iproute2 System configuration: ./sysdep/cf/linux.h Debugging: no Routing protocols: bgp ospf pipe rip static =========The end of the citation================ and make, which is fails =========Beginning of the citation============== make -C obj all make[1]: Entering directory `/volume1/tmp/bird-1.3.11/obj' echo > sysdep/paths.h "/* Generated by Makefile, don't edit manually! */" echo >> sysdep/paths.h "#define PATH_CONFIG_FILE \"/usr/local/etc/bird.conf\"" echo >> sysdep/paths.h "#define PATH_CONTROL_SOCKET \"/usr/local/var/run/bird.ctl\"" if test -n "/etc/iproute2" ; then echo >>sysdep/paths.h "#define PATH_IPROUTE_DIR \"/etc/iproute2\"" fi make depend make[2]: Entering directory `/volume1/tmp/bird-1.3.11/obj' mkdir -p nest filter proto/bgp proto/ospf proto/pipe proto/rip proto/static client doc touch .dir-stamp set -e ; for a in lib conf ; do make -C $a depend ; done make[3]: Entering directory `/volume1/tmp/bird-1.3.11/obj/lib' gcc -I../ -I../.. -MM bitops.c checksum.c event.c io.c ip.c ipv4.c krt.c lists.c log.c main.c md5.c mempool.c netlink.c patmatch.c printf.c random.c resource.c slab.c slists.c xmalloc.c >depend make[3]: Leaving directory `/volume1/tmp/bird-1.3.11/obj/lib' make[3]: Entering directory `/volume1/tmp/bird-1.3.11/obj/conf' m4 -P ../../conf/gen_keywords.m4 ../../conf/confbase.Y ../../sysdep/unix/config.Y ../../sysdep/unix/ krt.Y ../../sysdep/linux/netlink.Y ../../nest/config.Y ../../filter/config.Y ../../proto/bgp/config .Y ../../proto/ospf/config.Y ../../proto/pipe/config.Y ../../proto/rip/config.Y ../../proto/static/c onfig.Y >keywords.h m4 -P ../../conf/gen_commands.m4 ../../client/cmds.m4 ../../conf/confbase.Y ../../sysdep/unix/config .Y ../../sysdep/unix/krt.Y ../../sysdep/linux/netlink.Y ../../nest/config.Y ../../filter/config.Y . ./../proto/bgp/config.Y ../../proto/ospf/config.Y ../../proto/pipe/config.Y ../../proto/rip/config.Y ../../proto/static/config.Y | sort >commands.h m4 -P ../../conf/gen_parser.m4 ../../conf/confbase.Y ../../sysdep/unix/config.Y ../../sysdep/unix/kr t.Y ../../sysdep/linux/netlink.Y ../../nest/config.Y ../../filter/config.Y ../../proto/bgp/config.Y ../../proto/ospf/config.Y ../../proto/pipe/config.Y ../../proto/rip/config.Y ../../proto/static/con fig.Y >cf-parse.y bison -bcf-parse -dv -pcf_ cf-parse.y make[3]: *** [cf-parse.tab.c] Broken pipe make[3]: Leaving directory `/volume1/tmp/bird-1.3.11/obj/conf' make[2]: *** [depend] Error 2 make[2]: Leaving directory `/volume1/tmp/bird-1.3.11/obj' make[1]: *** [.dep-stamp] Error 2 make[1]: Leaving directory `/volume1/tmp/bird-1.3.11/obj' make: *** [all] Error 2 =========The end of the citation================ what can I do to compile it? thanks.

2 1

The Show command
by Anibe Onuche 11 Sep '13

11 Sep '13

Hello All, Is there a complete command list for the show command on the bird client? The following Cisco command equivalent is top most on the list Show ip bgp neigbor xxx.xxx.xxx.xxx received -route Show ip bgp neighbor xxx.xxx.xxx.xxx advertised -route show ip bgp sum show int brief -- A.O Internet Exchange Point of Nigeria

1 0

bird OSPF lsupd bug (FULL/EXCHANGE problem)
by Alexander V. Chernikov 10 Sep '13

10 Sep '13

Hello list! There is a problem in OSPFv2/v3 lsupdate flooding code triggering incorrect state machine change. The problem is triggered under the following OSPF instability conditions: a) bird falls down to init state b) DR router LSA seqnum immediately increases after that c) some problems (like CoPP/policer/high CPU load) preventing DR to send DBD packets fast. In that case the following can happen: * Our local/remote fsm state is EXCHANGE * Some small number of LSA's are sent (so we have no outstanding LSRequests other than DR router LSA) * DR is a bit slow on sending the next portion * Given router LSA is received via other neighbor (so we have empty LSR list) * We are changing state to FULL while other side is stuck in EXCHANGE state. (So in practice we can end with up to 50% neighbors stuck in EXCHANGE state (from DR point of view) in case of OSPF flapping..)

2 1

IPSec design for OSPFv3?
by Thomas Johnson 09 Sep '13

09 Sep '13

I'm looking around, and not seeing anything online regarding how to protect BIRD OSPFv3 with IPSec (at least on FreeBSD). I am able to configure IPSec transport mode to protect unicast traffic between routers; but multicast traffic is still transmitted without AH. A number of sources seem to be setting up a GRE/IPSec tunnel between routers, and running OSPF on that interface, facilitating multicast traffic. That seems counter to performance though, wouldn't data traffic then [needlessly] use the tunnel? Another thought I had was to configure all OSPF interfaces as NBMA, making OSPF traffic easier to protect. Thoughts on this? Are BIRD users just skipping authentication for OSPFv3? Thanks, -- Thomas Johnson -- This e-mail and any files transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If you are not the intended recipient or the individual responsible for delivering the e-mail to the intended recipient, please be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing, or copying of this e-mail is strictly prohibited. If you have received this communication in error, please return it to the sender immediately and delete the original message and any copy of it from your computer system. If you have any questions concerning this message, please contact the sender or call ClaimLynx at (952) 593-5969.

4 3

IPv6 and router advertisement
by Miłosz Oller 05 Sep '13

05 Sep '13

Hi I have a problem with RA. My BIRD config: http://wklej.org/hash/81158faf8c6/ My network config: Protocol radv dc1 on router 1 is "master", protocol radv dc2 on router 2 is "master". vlan 10 - 14 On each vlan interface, eg bond1.10, are assigned addresses (with keepalived): eg 2001:67c:2ad8::1/64 and 2001:67c:2ad8:1::1/64 Problem is on router 2 and protocol dc2. When I assign the address on vlan interface, eg 2001:67c:16f8:2::1/64 dev bond1.10 on router 2, hosts in this vlan recive addresses with this prefix. Host in vlan 10 3: eth0.10@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 inet6 2001:67c:16f8:3:c9dd:c2cb:611e:bcfd/64 scope global temporary dynamic valid_lft 86397sec preferred_lft 14397sec inet6 2001:67c:16f8:3:216:3eff:fe35:578b/64 scope global dynamic valid_lft 86397sec preferred_lft 14397sec inet6 2001:67c:16f8:2:c9dd:c2cb:611e:bcfd/64 scope global temporary dynamic valid_lft 86397sec preferred_lft 14397sec inet6 2001:67c:16f8:2:216:3eff:fe35:578b/64 scope global dynamic With protocol dc1 on router 1 is everything ok. Hosts don't recive any addresses. Why host recive address from router? -- Miłosz

3 2

GRE link state detection
by thegeezer 05 Sep '13

05 Sep '13

Howdy all, i was wondering if anyone has any idea if there is a means by which i can detect GRE link state ? what i have is two sites each with two very unstable internet links in order to vpn between them i have ipsec tunnels linking each side twice (four ipsec tunnels in total) i then have 4x GRE tunnels over the top of those in order that i have a secured routable VPN this gives me net.vpn0 net.vpn1 net.vpn2 and net.vpn3 finally i run BIRD over the top which works very well, and synchronises routing tables between the two sites, and allows for me to do such fun as # /etc/init.d/net.vpn0 stop and watch all traffic automagically cut over to another link. so far so awesome. however, as i said the internet links are very unstable, and sometimes just blackhole. so what i was hoping to do is just enable keepalives on the gre tunnel. which sadly seems to be cisco only. can anyone suggest a way of detecting if the GRE is not fully connected ? BIRD only fails over if the net.vpn0 device is down (ifconfig up/down) and for the life of me i cannot find how to detect if a GRE tunnel is 'connected', it seems to just blindly send packets to the remote IP. is my only choice to use L2TP instead ? thanks in advance for any suggestions; PS if i'm on the wrong list i'd welcome a friendly push to the correct list

4 4

direct protocol behaviour
by Dan Rimal 05 Sep '13

05 Sep '13

Hello, I have problem with direct protocol. I try to export connected routes to "custom" kernel tables, so i have kernel protocol, pipe protocol and appropriate config switches (i hope), see below. Everything seems ok, but there is bad behaviour in one situation. When i have added secondary IP from same subnet to the same interface (like VRRP does) and delete this secondary IP subsequently (like VRRP does on backup state), direct record disappear from bird table too, although primary address is stil up on the interface. To restore connected routes in bird table, i must restart direct protocol which initiate bgp reconnecting on all peers. Steps to reproduce problem: 1) [root@router.devel.f16 ~]# ip addr eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 52:54:00:56:ee:a8 brd ff:ff:ff:ff:ff:ff inet 172.20.24.2/24 brd 172.20.24.255 scope global eth1 [root@router.devel.f16 ~]# birdc BIRD 1.3.9 ready. bird> show route 10.0.10.0/24 dev eth0 [direct1 16:03] * (240) 172.20.24.0/24 dev eth1 [direct1 16:03] * (240) bird> 2) [root@router.devel.f16 ~]# ip addr add 172.20.24.15/24 dev eth1 [root@router.devel.f16 ~]# ip addr eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 52:54:00:56:ee:a8 brd ff:ff:ff:ff:ff:ff inet 172.20.24.2/24 brd 172.20.24.255 scope global eth1 inet 172.20.24.15/24 scope global secondary eth1 3) [root@router.devel.f16 ~]# ip addr del 172.20.24.15/24 dev eth1 [root@router.devel.f16 ~]# birdc BIRD 1.3.9 ready. bird> show route 10.0.10.0/24 dev eth0 [direct1 16:03] * (240) bird> restart direct1 direct1: restarted bird> show route 10.0.10.0/24 dev eth0 [direct1 16:09] * (240) 172.20.24.0/24 dev eth1 [direct1 16:09] * (240) bird> config file: table t_cust; filter to_t_cust { if ( source = RTS_DEVICE ) then { accept; } else { reject; } } protocol kernel { scan time 180; import all; export all; } protocol device { scan time 10; } protocol direct { } protocol pipe p_cust { table t_cust; peer table master; import filter to_t_cust; export none; } protocol kernel k_cust { kernel table 90; table t_cust; persist; device routes; scan time 180; import none; # z kernelu do birda export all; # z birda do kernelu } Regards, Dan Rimal

2 2