March 2015 - Bird-users - Mailing Lists

RIP and directly connected routes
by olivier a 28 Mar '15

28 Mar '15

I'm studying RIP and have a really hard time understanding the rationals behind to automatically pulling directly connected routes. If I connect 4 RIP routers in a circle and neither is advertising it's connected routes, it's going to be very quiet ... Please help me understand :-) Secondly, I use 'protocol direct' to have these connected routes pulled from kernel tables to RIP and advertised. Is that the right way to do it ? Lastly, these 'protocol direct' routes override the split horizon rule. Is there a way to prevent an interface to multicast its own subnet ? Thanks, I 'm just discovering BIRD, I may be asking clumsy questions ;-)

2 3

New version, v0.5, of BPGSEC implementation for BIRD
by Michael Baer 24 Mar '15

24 Mar '15

Hi all, I wanted to announce a new, v0.5, version of BGPsec protocol supporting code for BIRD. It's been updated to work with v1.4.5 BIRD and is available as a patch or as a full source tarball at: http://bgpsec.tislabs.com This is an ongoing project following the IETF's SIDR Working Group's BGPsec implementation. This version has been updated to match the current changes in the draft BGPsec protocol specification. Notably, the code also includes a client, bgpsec-bird-client, that uses RTRlib (http://rpki.realmv6.org/trac/) to download RPKI data from a Resource Public Key Infrastructure (RPKI) to Router Protocol server and populate BIRD's ROA tables. It will also download router keys from the RPKI to Router protocol server. SIDR working group and protocol links: http://datatracker.ietf.org/wg/sidr/charter/ http://datatracker.ietf.org/doc/draft-ietf-sidr-bgpsec-protocol/ http://tools.ietf.org/html/rfc6810 (RPKI to Router Protocol) The code is still at the experimental/testing stage and should not be use used for production services. If any one wants to play with the code, please feel free to email me any questions or bug reports. Thanks, Mike -- Michael Baer PARSONS baerm(a)tislabs.com

1 0

Force BGP add-path configuration option
by Eric Cables 20 Mar '15

20 Mar '15

I realize that BGP add-path is a negotiated capability, but I'm running into an instance where I am attempting to send multiple copies of the same prefix, with different BGP attributes (next hop, etc.), but since the receiving router does not support add path BIRD is only sending its "best" prefix. Would it be possible to add a "add paths force" configuration option? What potential implications would this cause for the receiving device that is unaware of this capability, and likely will never have support for it? -- Eric

1 0

on mrt support
by Evelio VILA 19 Mar '15

19 Mar '15

Hi, Does bird dump mrt rib entries? as per rfc rfc6396 ? i see it has support for bgp messages and states but not the rib. How exactly does the dump routes command works? thanks Evelio Vila

2 1

BIRD ignored routes
by Nat J 12 Mar '15

12 Mar '15

Hi All, I’m having an issue with bird ignoring some prefixes it’s receiving. I'm new to bird and may be overlooking something simple. The config is essentially this [1] Exabpg1:AS_X < — > BIRD:AS_Y (route-server) [2] Exabgp2:AS_X < — > BIRD:AS_Y (route-server) [3] BIRD:AS_Y < — > BIRD:AS_Z [1] & [2] behave as expected, however when the route-server exports to the 2nd BIRD instance the routes are ignored. The debug file unfortunately makes no mention of the routes being ignored. Any suggestions on how I can find the cause for those being ignored. Attached are the configs and outputs from BIRD Thanks -nat

2 2

BGP export connected or static prefixes
by Anand Buddhdev 09 Mar '15

09 Mar '15

Dear BIRD users, I'm setting up BIRD 1.4.5 as a router for an AS112 anycast instance. I've got the router running and creating peering sessions with peers, and also importing prefixes from them into the kernel. However, it's not exporting my prefix, and I'm afraid I don't understand why. I'm quite new to BIRD, so please bear with me if my question looks naive. I would appreciate any clues. My configuration looks like this: list bgp address <myaddr>; router id <myaddr>; tabe anycast; filter as112 { if net = 192.75.48.0/24 then accept; reject; } protocol direct { interface "dummy0*"; } protocol device { } protocol kernel { export all; kernel table 10; table anycast; } protocol bgp { export filter as112; local <myaddr> as 112; neighbor <peeraddr> as <peeras>; table anycast; }

2 6

Re: Compiling from source with --enable-ipv6
by Anand Buddhdev 08 Mar '15

08 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 08/03/15 20:13, Jay Turner wrote: > You're going to need both binaries and to configure both bird.conf > and bird6.conf. There are both positives and negatives to this > design implementation, but the ability to separately configure and > control the two protocols has a lot of upside. Thank you Ondrej and Jay for your explanation. Regards, Anand -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iEYEARECAAYFAlT8wiMACgkQi+U8Q0SwlCsBtQCfeQv9m9+8PS3mV8dBvt4pTiKD 4bkAn0cEpstR2WJxAkgqzYlZD5dPcqeD =M23w -----END PGP SIGNATURE-----

1 0

Compiling from source with --enable-ipv6
by Anand Buddhdev 08 Mar '15

08 Mar '15

I'm trying to build BIRD from sources. If I build without any options, then I end up with a binary called "bird" and its associated control programs, "bird" and "birdcl". This build is only capable of IPv4. So far I understand it. If I configure with the option --enable-ipv6, and build it, I end up with the binary "bird6", and the control programs, "birdc6" and "birdcl6". My question is: is bird6 only able to handle IPv6, or will it also handle IPv4? If it will only handle IPv6, then I would need both bird and bird6. Is there any way to get the build process to build both bird and bird6 without having to "make clean" and reconfigure? Is there any reason why a single bird binary won't just handle both IPv4 and IPv6? The documentation isn't clear about any of this, and could do with some improvement. Regards, Anand

3 2

[PATCH] Security hardening compiler and linker flags
by David Jorm 06 Mar '15

06 Mar '15

Hi All The attached patch adds security hardening compiler and linker flags. These flags are only applied if --enable-secflags is on, and I've made --enable-secflags on by default. I totally understand if the maintainers may prefer for it to be off by default, at least initially. Here is a brief explanation/justification of each of the flags added by this patch. Compiler flags: -Wformat -Wformat-security -Werror=format-security: Protection against format string vulnerabilities at compile time, no impact to the compiled binaries. -fPIE: Build position independent executable (PIE) binaries. Enables a form of address space layout randomization (ASLR), which makes exploitation of memory corruption vulnerabilities significantly more difficult. This does incur a small performance cost, but this is minimal and I believe an acceptable price to pay for the protection PIE provides. For more details on the performance cost, see [0]. -fstack-protector-strong: Stack-smashing protection at runtime, thwarting many buffer overflow exploits. This does incur a small performance cost. -fstack-protector-strong is designed to incur a minimal performance cost, compared to the more comprehensive -fstack-protector-all. -D_FORTIFY_SOURCE=2: Protection against static sized buffer overflows at compile time, no impact to compiled binaries. Linker flags: -fPIE -pie: To enable PIE as noted above. -Wl,-z,relro: Prevents some memory corruption exploits that overwrite the global offset table (GOT). For more details see [1]. -Wl,-z,now: Part of GOT overwrite protection. Can incur an extremely minimal performance hit at startup time as symbols are resolved. -Wl,-z,noexecstack: Prevents some memory corruption exploits by marking the stack as non-executable. Not all of these flags are available on some architectures and processors, but they should be automatically omitted from the configure script if not supported. Thanks David [0] https://securityblog.redhat.com/2012/12/12/position-independent-executable-… [1] https://isisblogs.poly.edu/2011/06/01/relro-relocation-read-only/

3 4

Re: OSPF type broadcast over GRE for NRHP
by Clint Armstrong 05 Mar '15

05 Mar '15

Thanks, that patch is working perfectly for me. I look forward to seeing this in the next release. On Tue, Mar 3, 2015 at 10:11 AM, Ondrej Zajicek <santiago(a)crfreenet.org> wrote: > On Tue, Mar 03, 2015 at 09:48:41AM -0500, Clint Armstrong wrote: > > So I have briefly tested a change that should allow OSPF broadcast over > GRE > > so long as the multicast flag is set on the GRE interface, enabling the > > behavior you were initially expecting. I'd love to hear feedback on this, > > especially if anyone is aware of problems this might cause. > > > > diff --git sysdep/linux/netlink.c sysdep/linux/netlink.c > > index 860c860..4b543a0 100644 > > --- sysdep/linux/netlink.c > > +++ sysdep/linux/netlink.c > > @@ -431,7 +431,7 @@ nl_parse_link(struct nlmsghdr *h, int scan) > > f.flags |= IF_MULTIACCESS | IF_LOOPBACK | IF_IGNORE; > > else if (fl & IFF_POINTOPOINT) /* PtP */ > > f.flags |= IF_MULTICAST; > > - else if (fl & IFF_BROADCAST) /* Broadcast */ > > + else if (fl & (IFF_BROADCAST || IFF_MULTICAST)) /* Broadcast */ > > f.flags |= IF_MULTIACCESS | IF_BROADCAST | IF_MULTICAST; > > else > > f.flags |= IF_MULTIACCESS; /* NBMA */ > > This would work most likely without problems. > > I would use just this one: > > diff --git a/sysdep/linux/netlink.c b/sysdep/linux/netlink.c > index 860c860..48dd8ba 100644 > --- a/sysdep/linux/netlink.c > +++ b/sysdep/linux/netlink.c > @@ -436,6 +436,9 @@ nl_parse_link(struct nlmsghdr *h, int scan) > else > f.flags |= IF_MULTIACCESS; /* NBMA */ > > + if (fl & IFF_MULTICAST) > + f.flags |= IF_MULTICAST; > + > ifi = if_update(&f); > > if (!scan) > > -- > Elen sila lumenn' omentielvo > > Ondrej 'Santiago' Zajicek (email: santiago(a)crfreenet.org) > OpenPGP encrypted e-mails preferred (KeyID 0x11DEADC3, wwwkeys.pgp.net) > "To err is human -- to blame it on a computer is even more so." >

1 0