February 2015 - Bird-users

New in BIRD
by Ilias Pallikarakis 23 Aug '16

23 Aug '16

Hi, I recently started trying to learn BIRD. I should also mention I have no previous experience with any other Routing daemon either. I want to configure a bgp monitor for both ipv4 and ipv6. I am running BIRD in a Ubuntu 13.10 VM. I managed to install both bird and bird6 but I have some problems with the configurations. In ipv4 : I created a very simple configuration which I attach. The conf is compiled but in birdc the bgp session is considered idle. I tried to do a tcpdump and found that the router sends a TCP SYN on the VM's bgp port but the VM responds with a RST and never tries to set a BGP session itself. In ipv6 : No matter the configuration (my configuration or the sample coming with bird6 or examples found on the web) the configuration is not compiled giving the following error : BIRD ipv6 doesn't run (bird: /usr/local/etc/bird6.conf, line 1: Router ID must be configured manually on IPv6 routers) Could anyone give me some pointers on what I am doing wrong ? Thank you for your help, Ilias Pallikarakis

5 8

Bird as an MPLS RR
by Evelio VILA 16 Feb '16

16 Feb '16

Hi guys, I'm following the instructions from http://bird.mpls.in/projects/mpls-bird/wiki/Bird_rr but I get a syntax error when adding the table statements. I'm using Bird 1.4.5 for Ubuntu utopic installed from this ppa: deb http://ppa.launchpad.net/cz.nic-labs/bird/ubuntu utopic main deb-src http://ppa.launchpad.net/cz.nic-labs/bird/ubuntu utopic main But it seems that version is not yet compiled for VPNv4 (AFI/SAFI 1/128) capabilities. already checked this link with no luck... https://www.mail-archive.com/bird-users%40atrey.karlin.mff.cuni.cz/msg03141… any ideas? Thanks! Evelio Vila

3 2

IS-IS
by kveri new 01 Jun '15

01 Jun '15

Hello, I would like to implement IS-IS as a part of my master thesis. Are there any apparent problems which would prevent successful implementation, political and/or technical? Also I would like to hear opinions of the authors. Implementation timeframe is 2013 (if we live past 21th). Regards, Martin Čechvala Faculty of Informatics and Information Technologies Slovak Technical University

7 8

OSPF route selection
by Thomas Goldberg 22 May '15

22 May '15

Hello, we're using OSPF for anycast routing and came across a small problem. We've a BIRD v1.4.4 router which sits in area 0 and 16. Here's the relevant state information (10.236.144.144/32 is announced from two different routers in two areas): area 0.0.0.0 router 10.236.144.241 distance 33 external 10.236.144.144/32 metric 1 area 0.0.0.16 router 10.17.224.253 distance 111 external 10.236.144.144/32 metric 1 The route via area 16 is considered best: 10.236.144.144/32 via 10.176.3.29 on vlan542 [o_internal 2014-10-07 16:49:56] * E1 (150/112) [10.17.224.253] Given that both E1 routes are reachable via intra-area paths. We're wondering why the path via area 16 (higher costs than area 0) is chosen. Is this the intended behavior? Is there any way to make bird prefer routes via a specific/backbone area in a situation like this? Best Regards, Freddy

4 4

[PATCH] Security hardening compiler and linker flags
by David Jorm 06 Mar '15

06 Mar '15

Hi All The attached patch adds security hardening compiler and linker flags. These flags are only applied if --enable-secflags is on, and I've made --enable-secflags on by default. I totally understand if the maintainers may prefer for it to be off by default, at least initially. Here is a brief explanation/justification of each of the flags added by this patch. Compiler flags: -Wformat -Wformat-security -Werror=format-security: Protection against format string vulnerabilities at compile time, no impact to the compiled binaries. -fPIE: Build position independent executable (PIE) binaries. Enables a form of address space layout randomization (ASLR), which makes exploitation of memory corruption vulnerabilities significantly more difficult. This does incur a small performance cost, but this is minimal and I believe an acceptable price to pay for the protection PIE provides. For more details on the performance cost, see [0]. -fstack-protector-strong: Stack-smashing protection at runtime, thwarting many buffer overflow exploits. This does incur a small performance cost. -fstack-protector-strong is designed to incur a minimal performance cost, compared to the more comprehensive -fstack-protector-all. -D_FORTIFY_SOURCE=2: Protection against static sized buffer overflows at compile time, no impact to compiled binaries. Linker flags: -fPIE -pie: To enable PIE as noted above. -Wl,-z,relro: Prevents some memory corruption exploits that overwrite the global offset table (GOT). For more details see [1]. -Wl,-z,now: Part of GOT overwrite protection. Can incur an extremely minimal performance hit at startup time as symbols are resolved. -Wl,-z,noexecstack: Prevents some memory corruption exploits by marking the stack as non-executable. Not all of these flags are available on some architectures and processors, but they should be automatically omitted from the configure script if not supported. Thanks David [0] https://securityblog.redhat.com/2012/12/12/position-independent-executable-… [1] https://isisblogs.poly.edu/2011/06/01/relro-relocation-read-only/

3 4

[PATCH] RPM spec file with systemd integration
by David Jorm 04 Mar '15

04 Mar '15

Hi All The attached patch provides an RPM spec file with systemd integration, rather than sysv init. I have tested it on Fedora 20 and 21. Note that this spec file includes: %global _hardened_build 1 Which automatically adds security hardening compiler flags. Thanks David

2 6

Bird hangs on startup (MIPS, EdgeOS 1.6.0, Debian wheezy)
by Joel Brunenberg 27 Feb '15

27 Feb '15

Hi, I am new to this list so please excuse, if I do look a little bit clumsy. I have a problem with bird 1.3.7 (debian wheezy 1.3.7-1) on mips, namingly EdgeOS 1.6.0 on an EdgeRouter Lite. I am trying to set up Bird to be able to use OSPF on Interfaces that are not supported by EdgeOS natively. Before you let me burn in hell for having that idea, please let me explain my problems. 1) On my platform does not start but hangs forever before the fork can take place - this is, if I have the "device" protocol enabled which I of cause need. I can reproduce that on several devices using the following minimal config (given another config without the device proto, bird starts) (given another config without the device proto, bird starts) (given another config without the device proto, bird starts) (given another config without the device proto, bird starts) (given another config without the device proto, bird starts) (given another config without the device proto, bird starts) (given another config without the device proto, bird starts) (given another config without the device proto, bird starts): ### bird.conf log syslog { warning, error, auth, fatal, bug, info, debug}; router id 10.24.1.104; debug protocols all; protocol device device0 { scan time 10; } ### end of bird.conf (I fixed problem 2 before trying this) I get no error messages or any indication whatsoever why or where it is hanging. Strace shows the last syscall to be the last one completing. recvmsg(5, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"\0\0\0\24\0\3\0\2\0\0\21\345\377\377\357\236\0\0\0\0\0\0\0\1\0\10\0\1\177\0\0\1"..., 8192}], msg_controllen=0, msg_flags=0}, 0) = 20 ltrace seems to be unavailable on MIPS with debian wheezy. I have no idea where to look right now. I am not that good with gdb, but I could try something, given instructions. I saw this Post in the mailinglist from 2013: http://comments.gmane.org/gmane.network.bird.user/2371 bit I am not sure if the two issues are related. I have no toolchain installed on this machine and I would rather not install one. I am not that good with crosscompiling either, but if someone could point me in the right direction, I would be glad to try a self-compiled version. 2) I use DHCP to get an IP on my WAN interface (cable modem) and the broadcast address on the interface after configuration is 255.255.255.255, which is not the right broadcast address for the IP assigned. If I do not fix that before starting bird, I get the following error Feb 27 16:16:14 bel bird: KIF: Invalid broadcast address \ 255.255.255.255 for eth1 Of cause, bird is right and the interface broadcast address is wrong. My question is: Is this a fatal error? The interface eth1 is not relevant to me. Can I leave the Broadcast address as it is or will this break bird even if not "using" this interface anywhere? Thank you for looking into this and sorry for the long post, /jbn -- Joel Brunenberg - Troisdorf PGP: 0xAD25981C

2 2

Introduction
by David Jorm 26 Feb '15

26 Feb '15

Hi All I am a security engineer based in Brisbane, Australia. I'm starting to work on a large-scale deployment of BIRD, and look forward to engaging with the BIRD community. I have created a couple of patches which I will send to this list shortly. Thanks David

1 0

bird4 scope link
by Amadeus Alfa 26 Feb '15

26 Feb '15

Hello list, in bird6 I can use the following configuration snippet with IPv6 link local addresses: protocol bgp xxx { neighbor fe80::2ff:c0bb:fe00:1234 % '784648196' as 1234; }; ('784648196' is the interface name) My question is now: How can I use IPv4 scope link addresses in bird4? When I use the line below I get an error: "Link-local address and interface scope must be used together" protocol bgp xxx { neighbor 169.254.0.1 % '784648196' as 1234; }; Thanks, Amadeus

2 4

Bird6 freeze under high load
by Baptiste Jonglez 24 Feb '15

24 Feb '15

Hi, We are experiencing regular "freezes" of bird6 on a BGP router. When this happens, bird6 maxes out a CPU for several minutes. If a command is run in birdc6 during such a freeze, the command hangs, and the result is only returned when birdc6 has stopped using the CPU. Note that this also applies to "cheap" commands like "show protocols", which usually complete instantly (both with bird, and with bird6 in non-freeze conditions). Sometimes (but not always), the non-responsiveness of bird6 causes all BGP sessions to drop, which is really annoying on a full-view BGP router. The freezes happen at random, but seem to happen more frequently when the router is under load (typically, at peak time, each CPU spends ~20% forwarding packets, on a 4-core box). The BGP setup is made of multiple transit and peerings, on multiple VLANs (some BGP neighbours share the same VLAN). The setup is pretty similar on bird and bird6, but only bird6 exhibits these freezes, bird works just fine. The box is running Debian wheezy on amd64, with bird from backports: 1.4.5-1~bpo70+1 Attached is the configuration, and two extracts of the logs when all BGP sessions dropped (with debug { states, interfaces, events }). All files are anonymised, but should be consistent. What do you think? It looks like bird6 gets stuck on some very expensive operation, which prevents it from doing anything else (include maintaining BGP sessions alive). Thanks, Baptiste

4 11