November 2017 - Bird-users

Adding more then one bgp community at once
by Борис Коваленко 05 May '23

05 May '23

Hello! Is this possible to add many communites at once? bgp_community.add([(1,1), (1,2)]) is wrong "Setting clist attribute to non-clist value" Regards, Boris -- С уважением, Борис Коваленко

4 5

manipulating the best path, eBGP, MED?
by Thomas＠PhaseHosting 14 Apr '18

14 Apr '18

Supp, I implemented bird in our Private cloud running proxmox to distribute our public address with eBGP to our serverhost. Through iBGP and a ucarp interface i have a HA gateway, the problem is that our host receives the routes but there are multiple entry points to our subnet ( the proxmox hosts). This makes that a diffrent in & out route doenst work. through following link: https://supportforums.cisco.com/document/126691/understanding-bgp-best-path… I learned that my hosts selects its route based on age ( the bird with the first connection is chosen). Can i send a multi-exit discriminator with my eBGP connection to my host? I googled but could find 2 answers that did't change anything: # your default gateway IP below here protocol bgp eBGP { import none; export where proto = "static_packet"; local as 65000; neighbor 10.80.x.x as 65530; password "SECRET"; #med metric 10; #default bgp_med 10; } (offcourse i tried both without # and waited till export) Or is there an other way to make sure that our host routes always to the first server and so on. -- Thomas Valgaeren thomas(a)phasehosting.io +32477915307

6 8

Could bgp password include double quotation character "?
by Eugene Qian 01 Dec '17

01 Dec '17

Hi All, How could I include double quotation in bgp password? in my config file protocol bgp AS_64496 from ABC { description "BIRD BGP instance AS_64496"; multihop; neighbor x.y.z.3 as 65002; source address a.b.c.29; # What local address we use for the TCP connect password "a1s@"xyz"; import all; export where proto = "static_bgp"; } password "a1s@"xyz"; I tried to use \ to escape or use single quotation for password, the bird will give me this error /opt/bird/etc/bird.conf, line 30: syntax error What is the restriction on password? Thanks -Eugene

2 1

OSPF: Cannot find next hop for LSA type
by Eugene M. Zheganin 24 Nov '17

24 Nov '17

Hi, Recenly I occasionally found that one can define the OSPF area twice, like area 0.0.0.1 { interface "eth0"; } area 0.0.0.1 { interface "eth1"; } And this obviously erroneous configuration passes the bird configuration check, and starts causing unpredictable and wierd problems, including the one mentioned in subject. Since bird doesn't seem to have a bug tracker, this list seems to be an appropriate place to report this. Thanks. Eugene.

1 0

BGP AS Path Filter
by Shurshuka 16 Nov '17

16 Nov '17

Hello, I am newbie in Bird & BGP so pardon my question: I have server and my own AS/IP's (/24). I get default from my provider. My provider has a lot of upstreams (different IP transit providers with there own AS). I want my AS/routes to be announce only from some providers upstreams. My provider doesn't provide any self-service BGP communities for that. As I understood, I can do this thing with BGP AS Path Filter (Default is OK for this? Or Full View required?). What filter I need to use (import/export)? I tried to use this filter, but it failed: > import filter { > > if (bgp_path ~ [= * IP_TRANSIT_PROVIDER_AS_1 PROVIDER_AS MY_AS =]) || (bgp_path ~ [= * IP_TRANSIT_PROVIDER_AS_2 PROVIDER_AS MY_AS =]) then { > > accept; > > } else reject; > }; Could you please to answer my questions and to tell in what direction to move on? Thanks.

3 2

draft-keyur-idr-bgp-prefix-limit-orf
by Marco Marzetti 15 Nov '17

15 Nov '17

Dear Developer of BIRD, We're working on a draft called draft-keyur-idr-bgp-prefix-limit-orf that you can find on IETF's website at this URL: https://tools.ietf.org/html/ draft-keyur-idr-bgp-prefix-limit-orf-02 Its goal is to allow BGP speakers to exchange maxprefix values in-band by making use of the ORF capability. We think the ideas expressed in the draft are very simple, but we would like to hear from you how hard it would be to get them implemented in your software. Let me briefly explain how it is supposed to work. Peer A and B set up a BGP session and set ORF as one of the active capabilities. Every time administrators of A change/set/remove maxprefix router A sends an ORF message indicating to router B the new value along with the behavior that router B must follow. In case that the Match field is set to DENY router B will consider the value as purely informational and will follow the usual behavior. Else, in case Match is set to PERMIT, router B will not advertise any prefix if that would cause the amount of advertised (non withdrawn) prefixes to exceed router's A maxprefix value. Please note that what described above is just a coarse summary of what is stated within the draft. We encourage you to read it to better understand what we're working on. In case that you're wondering why draft-keyur-idr-bgp-prefix-limit-orf could be useful here some real world cases: 1) Life safer for unplanned redistribution or fat fingers. In MPLS L3VPNs service providers often impose strict maxprefix limit as those are commercial values discussed before of signing the contracts. An unplanned increment in the advertisements may break the VPN. In that case spokes may prefer to not to announce some routes and still be able to reach the rest of the network from the larger part of the site than loosing all connectivity. And hubs can advertise both default and more specific routes for traffic engineering without the risk of breaking the network. Almost the same applies to FlowSpec where you could prefer to not to advertise some "rules" than to get all of them withdrawn because of an error. 2) Easier and faster method to share maxprefix betweem peers. Maxprefix is one of the few protection mechanisms used by autonomous systems when peering in the DFZ. When networks merge or transit providers get new large customers their NOCs have to reach all the peering partners in an attempt to get maxprefix updated. This is usually done by broadcasting the request by email to all peers (maybe multiple times) a few weeks before of the increment. Then "cross the fingers" and send the additional advertisements. What often happens is emails got lost or unnoticed by the network engineers of the receiving network and AS to AS connectivity breaks for some hours or even days. With the proposed solution the NOCs would be able to verify if the change has been executed before of touching anything. At this very moment we're in the process of refining the draft before of submitting it to the IETF community, but we do understand that internet standards are useful only if they're supported by vendors. For this reason we would like to hear from you how hard it could be to add the features of draft-keyur-idr-bgp-prefix-limit-orf in BIRD. In case that it would be too complicated please let us know how we could make things easier. Thank you in advance for the comments or the suggestions you would like to make. Regards -- Marco

1 0

Export only "Primary" (best) route
by Jean-Baptiste COUPIAC 15 Nov '17

15 Nov '17

Hello everybody, I'm trying to configure a Route-Reflector. I have created a filter to import only some AS: ############################ filter bgp_IN prefix set allnet; int set allas; { allas = [10753, 10929, 11478, 12322, 12353, 12392, 12566, 12670, 12684, 12876, 13193, 13238, 13335, 133530, 13414, 14061, 14618, 15133, 15169, 15557, 15895, 16136, 16211, 16276, 16347, 16509, 174, 19506, 197161, 198551, 199064, 201106, 202089, 202727, 203070, 203476, 20473, 20900, 20940, 21502, 21837, 2200, 23033, 23889, 24711, 24940, 24961, 25117, 25186, 25540, 26101, 2635, 2856, 28708, 2914, 29169, 29286, 30999, 31167, 31216, 31976, 32097, 3215, 3269, 32934, 3303, 3320, 3352, 3356, 34010, 34173, 34177, 34274, 34949, 35540, 35625, 35632, 35994, 36351, 36408, 36647, 36903, 36947, 39405, 39473, 39572, 39931, 4134, 43350, 43646, 44050, 44444, 47608, 47833, 47841, 48069, 48072, 4837, 50583, 5089, 51207, 51862, 52075, 5410, 54104, 54113, 5432, 55967, 56844, 5769, 577, 57809, 60068, 60718, 60855, 62044, 62540, 65623, 6661, 6713, 6830, 6848, 702, 714, 786, 7922, 8068, 8075, 8218, 8220, 8228, 8346, 8399, 8560, 8565, 8839, 9003, 9159]; if (bgp_path.last ~ allas) then accept; reject; } ############################ protocol bgp ibgp_AAAAA { table bgp_filtre_IN; import filter bgp_IN; export none; local as XXXXX; neighbor YYYYYYYY as XXXXX; } protocol bgp ibgp_BBBBB { table bgp_filtre_IN; import filter bgp_IN; export none; local as XXXXX; neighbor ZZZZZZZZZ as XXXXX; } ############################ Into to table bgp_filtre_IN, I wan to have only the best route (primary route) instead of all. For example, for 2.22.88.0/22 bird> show route table bgp_filtre_IN for 2.22.88.0/22 2.22.88.0/22 unreachable [ibgp_AAAAA 17:04:11 from YYYYYYYYY] * (100/-) [AS20940i] unreachable [ibgp_BBBBB 17:04:07 from ZZZZZZZ] (100/-) [AS20940i] I just want to import first route, which is the best: 2.22.88.0/22 unreachable [ibgp_AAAAA 17:04:11 from YYYYYYYYY] * (100/-) [AS20940i] Can I do it into table bgp_filtre_IN ? Does I need to create another one with some filtering options ? Regards, __ Jean-Baptiste,

1 0

Re: Decode BGP Shutdown Communication messages (RFC 8203)
by Mikhail Grishin 15 Nov '17

15 Nov '17

Hi, 1) You also implemented enable bgp2 "enable message" This message currently seen only at local side and doesn't seen at remote peer. Scenario: You made maintenance work with the shutdown message "Session will be down from 13:00 till 14:00". Later session was established again. Days after at remote peer side still printed the same message. That's confusing. Suggestion: (May be) To show two different messages? Tx and Rx. To clear Rx message every time when BGP session state changed to established. 2) Is it possible to log such messages and see via syslog? P.S. For russian UTF8 text 128 bytes restriction (RFC) probably not always enough. Ondrej Zajicek пишет 19.09.2017 21:53: > On Thu, Jul 27, 2017 at 05:55:40PM +0200, Job Snijders wrote: >> Hi all, >> >> Here is a patch to decode received BGP shutdown communication messages >> as specified in RFC 8203. In the following example scenario I'm sending >> a shutdown communication with openbgpd: >> >> $ bgpctl neighbor 94.142.241.204 down "TICKET-2331 we are upgrading, back in 30 min" >> request processed > Hi > > Merged with some significant changes, with support for both RX and TX of > shutdown communication: > > https://gitlab.labs.nic.cz/labs/bird/commit/cd1d99611e445c9fe2452d05627ccfc… > > I generalized it a bit, so the message is not specific to BGP, but can be > attached to any protocol, so it makes sense that it can be changed by > general commands like disable, restart. That means it also changed the > output a bit: > > bird> show protocols all bgp2 > name proto table state since info > bgp2 BGP master down 19:39:00 > Description: My BGP session > Message: Planned shutdown, back in 30 min > Preference: 100 > Input filter: ACCEPT > Output filter: (unnamed) > BGP state: Down > Neighbor address: 10.0.1.1 > Neighbor AS: 10 > > Conceptually, it is one-item mailbox, which can be set by either the core > (using enable/disable/restart commands) or the protocol (received BGP > Notification with the RFC 8203 message). I am not sure if it would not be > better to have two separate mailboxes for both directions, but it > probably does not matter. > > The message can be send from BIRD shell: > > birdc> disable bgp1 "hi, we will upgrade to bird 1.6.4" > > Unfortunately, that means that from Unix shell you have to do double qouting: > > birdc disable bgp1 '"hi, we will upgrade to bird 1.6.4"' > > Currently no support for message associated with 'disabled' in bird.conf > or for message associated with BIRD global shutdown. > > > Otherwise, there are some minor changes w.r.t. your patch: > > 1) Your patch requires that RFC 8203 message fills the entire space of > BGP notification (i.e. msg_len + 1 == remaining_len). I do not see any > such requirement in RFC 8203, so i accept if (msg_len + 1 <= remaining_len) > > 2) I reset the message not with any RX notification, but only with > administrative shutdown/reset notification. That prevents message reset > with subsequent errors unrelated to administrative notification. > > 3) Proper handling of zero-length messages (should be handled equally > like no message at all according to RFC 8203). > > 4) Some basic sanitization of received strings to avoid escape-attacks > and newlines in logs. > > Any comments, suggestions, opposition? >

3 4

bird control-socket: connection reset by peer
by Oliver Herms 14 Nov '17

14 Nov '17

Hello bird users, I'm running bird 1.6.3 on ubuntu 16.04 as kind of a route server. I wrote a piece of software that connects to the bird control-socket and runs queries against it like this: "show route all for x.y.z.a protocol xxx". The software keeps the socket open and executes the queries in a loop persisting of a write() call followed by a read() call. Now to the problem: At some point bird resets the connection and the logs are not showing anything related. Did anyone make similar experiences or can help me to find out what's wrong with bird here? Thanks Oliver -- Oliver Herms oliver.peter.herms(a)gmail.com

2 2

Bird6 high CPU usage
by Saksham Manchanda 12 Nov '17

12 Nov '17

Hi All, I have a loopback IPv6 address on a server. IP addr = 2dd:1111:1111:1111:1111::1 I use BGP to announce this to the upstream router. Client traffic comes in through an interface ens3 connected to the router with destination address as the loopback. Bird configuration: protocol direct { description "Local anycast addresses"; export none; interface "lo"; } # The kernel protocol gives us access to the kernel routing table. protocol kernel { #persist; # Don't remove routes on shutdown scan time 20; # Scan kernel routing table every 20 seconds export all; # Default is export none } # The device protocol is needed in order to see what addresses are local # to this server. protocol device { scan time 10; # Scan interfaces every 10 seconds } protocol bgp { description "Arya"; import none; local as 65001; neighbor neighbourIPv6ADDR as 100; direct; # Neighbors are directly connected hold time 240; connect retry time 120; keepalive time 80; # defaults to hold time / 3 #export filter packetdns; export all; } All this works great. Now, when client traffic comes in we get the following entries in the routing table: . . . CLIENTIP::136 via 2dd:1111:1111:1111:1111::1 dev ens3 metric 0 cache CLIENTIP::5 via 2dd:1111:1111:1111:1111::1 dev ens3 metric 0 cache CLIENTIP::13 via 2dd:1111:1111:1111:1111::1 dev ens3 metric 0 cache CLIENTIP::15 via 2dd:1111:1111:1111:1111::1 dev ens3 metric 0 cache . . . This table grows to ip -6 r s |wc -l 8296 And changes constantly. Now, the top output shows bird using a lot of CPU: 2205 root 20 0 6924 780 560 R 26.2 0.0 0:06.14 bird6 Since my configuration will never make use of these entries, is there a way to disable this scanning behaviour in bird? Thanks! -- Saksham Manchanda

1 0