March 2014 - Bird-users - Mailing Lists

Bird file descriptor leak
by MrBr ＠ GMail 25 Mar '14

25 Mar '14

Hi Running multiple "configure" commands via birdc, while there is an error in configuration file, creates multiple file descriptors. Scenario CentOS 6.4 2.6.32-358.el6.x86_64 bird 1.4.0 birdc.conf main configuration file comp.conf included in bird.conf there a loop of "configure" and several "show" commands runs in a background to ease configuration debugging after a while following error appears /etc/bird/bird.conf, line 96: Unable to open included file /etc/bird/comp.conf: Too many open files lsof provides thousands of the following bird 20566 root 657r REG 253,0 617 25314 /etc/bird/comp.conf~ (deleted) bird 20566 root 658r REG 253,0 617 25314 /etc/bird/comp.conf~ (deleted) bird 20566 root 659r REG 253,0 617 25314 /etc/bird/comp.conf~ (deleted) bird 20566 root 660r REG 253,0 617 25314 /etc/bird/comp.conf~ (deleted) bird 20566 root 661r REG 253,0 617 25314 /etc/bird/comp.conf~ (deleted) bird 20566 root 662r REG 253,0 643 25313 /etc/bird/comp.conf~ (deleted) bird 20566 root 663r REG 253,0 643 25313 /etc/bird/comp.conf~ (deleted) bird 20566 root 664r REG 253,0 643 25313 /etc/bird/comp.conf~ (deleted) bird 20566 root 665r REG 253,0 695 25034 /etc/bird/comp.conf bird 20566 root 666r REG 253,0 695 25034 /etc/bird/comp.conf bird 20566 root 667r REG 253,0 695 25034 /etc/bird/comp.conf bird 20566 root 668r REG 253,0 695 25034 /etc/bird/comp.conf bird 20566 root 669r REG 253,0 695 25034 /etc/bird/comp.conf bird 20566 root 670r REG 253,0 695 25034 /etc/bird/comp.conf Only solution found is to restart the bird proccess

2 1

Empty sets
by Alexander Shikov 25 Mar '14

25 Mar '14

Hi all! Is there a way to pass empty set to function? For example, function function bgp_in (prefix set plist) { ... } called either as 'import where bgp_in([])' or as 'import where bgp_in()' causes error. And further, how to detect in function whether set is defined? Does built-in 'defined()' function apply to variables or function arguments? Thanks in advance! -- Alexander Shikov Technical Staff, Digital Telecom IX Tel.: +380 44 201 14 07 http://dtel-ix.net/

2 1

next_hop issue on iBGP peer
by MrBr ＠ GMail 25 Mar '14

25 Mar '14

Hi, I'm trying to solve an issue of "unreachable" prefix The scenario is as followin: BIRD 1.4.0 (RtrB) has iBGP peer with (RtrC) that has route reflector originating prefix 10.0.2.0/24 RtrB ip is 10.1.1.1 RtrC ip is 10.1.1.2 on RtrC "sh ip bgp 10.0.2.0/24" provides that the next_hop is 10.4.4.4 on RtrB "show route 11.0.2.0/24 table master all" provides BGP.next_hop: 10.4.4.4 adding "gateway direct;" provides "Multihop BGP cannot use direct gateway mode" I'm little bit confused , isn't it a whole purpose of "gateway direct;" to provide legacy functionality to iBGP peers? I've tried changing next hop via import filter " bgp_next_hop = 10.4.4.4;" Next hop of prefix in RtrB changed , however the prefix itself stayed "unreachable" The only thing helped configuring static protocol record for 10.4.4.4, but this is not an option for production environment due to dynamic nature of prefixes and multiple next hops Please advise

2 1

BIRD and SNMP Traps
by Dmitry S. Nikolaev 21 Mar '14

21 Mar '14

Hi all, The question is whether planned or thought someone from the BIRD developers on the implementation of snmp traps in BIRD ? It would be nice to have a possibility to send SNMP trap when BGP session goes up/down or OSPF neighbor. For now, the only opportunity for the monitoring system to receive such an event it is parsing BIRD logs. Work with SNMP traps would be much easier for implementing into monitoring system. Thanks to the BIRD dev team. -- With best regards, Dmitry S. Nikolaev Moscow, Russia

3 4

IPv6 BGP over link-local addresses
by Job Snijders 08 Mar '14

08 Mar '14

Hi all, I have a very specific use case in which it would be nice if I could set up BGP sessions from link-local address to another link-local address across a link. This is what I have, and the error I am getting: root@test203:/etc# service bird6 start Mar 7 15:27:11 test203 bird6: Started Mar 7 15:27:11 test203 bird6: bgp1: Invalid remote address fe80::200:5efe:d413:dc3a ^C root@test203:/etc# cat bird6.conf router id 1.1.2.3; protocol kernel { persist; # Don't remove routes on bird shutdown scan time 20; # Scan kernel routing table every 20 seconds export all; # Default is export none } protocol device { scan time 10; # Scan interfaces every 10 seconds } protocol bgp { local as 64496; neighbor fe80::200:5efe:d413:dc3a as 65000; source address fe80::200:5efe:4e98:2a46; } root@test203:/etc# Addresses in the form of fe80::200:5efe:d413:dc3a%eth0 are also not accepted. Kind regards, Job

2 2

OSPF: Bad packet from ... - authentication failed
by Daniel Wendler 07 Mar '14

07 Mar '14

Hello List, we have at the moment an strange problem in our OSPF setup.

1 0

Blackholing: security considerations
by Alexander Shikov 07 Mar '14

07 Mar '14

Hi All, As usually IXPs do, we also perform route filtering with prefix lists. In prefix lists we include only those prefixes which have corresponding "route" objects in RADB/RIPE. We don't accept by default longer prefixes, i.e. in prefix list we include, for example, 10.0.0.0/21 but not 10.0.0.0/21+. With the purposes of blackholing sometimes there is need to accept more-specific prefixes, mostly /32, from BGP peers. The easiest way is just to accept /32 in filter. But the main problem is that any peer can announce /32 route to any network, even to unreachable one. Thus there is need to additionally check /32 routes. For the first look, we may include longer prefixes to prefix list, and then check incoming /32 prefix against it. Result will look like: bird> show route protocol ITCONS 109.68.40.20/32 via 193.25.181.253 on vlan777 [ITCONS 2014-03-06 22:02:42 from 193.25.180.17] * (100) [AS25372i] 109.68.40.0/21 via 193.25.180.17 on vlan777 [ITCONS 2014-03-06 21:45:24] * (100) [AS25372i] i.e. filtering against [ 109.68.40.0/21+ ]. Now let's assume that 109.68.40.0/21 is reachable via other peer, and we got new route, and it is better due to as-path length, and new peer does not want to blackhole 109.68.40.20. Then "109.68.40.0/21 via 193.25.180.17" will become inactive, but "109.68.40.20/32 via 193.25.181.253 from 193.25.180.17" will stay best, and new peer will lose traffic to 109.68.40.20. Thus, it'd be reasonable to compare received /32 against routing table, and accept it only if there is active less-specific route from same peer. Personally I was not able to find solution for bird. Now I'm wondering how do other IXPs perform such filtering? Any ideas or thoughts are kindly appreciated! Thanks in advance! -- Alexander Shikov Technical Staff, Digital Telecom IX http://dtel-ix.net/

4 4

bitwise operation in filters
by Daniel Wendler 03 Mar '14

03 Mar '14

Hello List, at the moment we try to implement an fine granulary filter mechanism in our Bird OSPF setup. We ask ourselfes if anyone has implementet bitwise operations in Bird filters which is not in official code. If not, are there any plans to implement such an feature in Bird filters or should we try it to implement on our own and contribute this to the mailing list? For better understanding i include an example: We use the ospf_tag attribute as an group identifier. at the moment we have 4 groups. There are routers which could belong to more than one group. So we would like to combine the groups in any way. The most efficient way to reach this is an bitwise operation. -- Mit freundlichen Grüßen --------------------------------- Daniel Wendler

3 3

Filter being ignored.
by Steve (Telsat Broadband) 02 Mar '14

02 Mar '14

Hi All, I've configured the following 'export' filter in my OSPF protocol: protocol ospf { import all; export filter { ospf_metric1 = 1000; if ( net = [ 192.168.0.0/16+ ] ) then reject; if ( source = RTS_STATIC ) then accept; else reject; }; Yet on my router, I'm still seeing the route coming in via OSPF: O 192.168.38.0/24 [110/1001] via xxx.xxx.xxx.xxx, 00:00:05, GigabitEthernet0/1 O 192.168.39.0/24 [110/1001] via xxx.xxx.xxx.xxx, 00:00:05, GigabitEthernet0/1 Is there something I'm missing? How can I get these network's excluded? Cheers. Steve.

2 3