March 2018 - Bird-users - Mailing Lists

FreeBSD, firewall patch in port of 1.6.x branche
by Leo Vandewoestijne 23 Mar '18

23 Mar '18

Hi, Yesterday I've submitted patches to upgrade Bird 1.6.x and 2.0.x to yesterdays releases. Now at the 1.6.x there used to be a firewall patch, made by Alexander V. Chernikov. But it's a stuggle to not break that option. So now I wonder, is this only used by few people, or are thousands of routers depending on this option? Further the 2.0.2 branche may become the default, and 1.6.5 will be -legacy https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=226859 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=226860 -- Met vriendelijke groet, With kind regards, Leo Vandewoestijne <%2A%2A%2A(a)dns.company> <www.dns.company>

1 0

Re: FreeBSD, BGP and md5
by Leo Vandewoestijne 23 Mar '18

23 Mar '18

On Fri, 23 Mar 2018, Peter Andreev wrote: > Is it still necessary to build custom kernel to get md5 auth working? > I'm pretty sure, yes. The only way I got it working in 11.1 i.c.w. 1.6.x was: # kernel config options IPSEC options TCP_SIGNATURE # /etc/rc.conf ipsec_enable="YES" ipsec_program="/sbin/setkey" ipsec_file="/etc/setkey.conf" # /etc/setkey.conf flush; # useful when running mutations manually spdflush; # useful when running mutations manually add -4 12.34.56.6 12.34.56.7 tcp 0x1000 -A tcp-md5 "teNp8XUrZtNteNjbep68jXgUGroZtUN"; add -4 12.34.56.7 12.34.56.6 tcp 0x1000 -A tcp-md5 "teNp8XUrZtNteNjbep68jXgUGroZtUN"; And initially nothing in bird.conf (just like I did in OpenBGPd in the pre-Bird era). But suddenly -about a year ago- at one Asian location I needed the password option in bird.conf. I however do see a setkey patch in the current 1.6.4 port, so I don't know what has changed there. I have not used that, as I migrated to 2.0.x, which offered a password option in bird.conf: # bird.conf - at the BGP protocol: password "teNp8XUrZtNteNjbep68jXgUGroZtUN"; So the intented design was to only need it in bird.conf, but in reality I now only got it working when setting it both in setkey.conf and in bird.conf Clearly things have changed, somewhere in 11.1. I already noticed IPSEC_NAT_T was removed (which was useful on vlan) https://svnweb.freebsd.org/base/stable/11/sys/modules/tcp/tcpmd5/Makefile?v… So this week I puzzled some more after having IPSEC_SUPPORT added to the kernel. But so far I did not witness any difference, so I'm still with the double config - not a real issue; it works fine. So I continued with finding out the correct restrictions/permissions in PF. For clarity; the double config "problem" is unrelated to firewalling - I did pretty much all of my testing without. I don't wish to threadjack yet, with something in fact unrelated to Bird, but once your problem is solved I'd like to bring that question up. Feel free to contact me off list in case you feel any need to. -- Met vriendelijke groet, With kind regards, Leo Vandewoestijne <%2A%2A%2A(a)dns.company> <www.dns.company>

1 0

Making a wish ... errr ... *four* wishes! 😳
by Clemens Schrimpe 23 Mar '18

23 Mar '18

Gentlepeople (especially those from the BIRD development team) - being an avid BIRD user for some time now I always kept a small list of „it would be nice, if …“-things for BIRD 1.x, which I kept for myself, as I knew BIRD 2.x was in the works (and thus people were busy already…), but now I get the feeling, that 2.x is slowly stabilizing and I’d like to put them on the table for open discussion: Simple things, a.k.a. low hanging fruits: (Optional) unicast replies to IPv6 RS As one of my many uses for BIRD is in large wireless environments (i.e., IETF meetings) I am very interested in keeping the amount of multicast traffic as low as possible. The standards allow for a router to (immediately) respond with a unicast RA to an RS as an alternative to sending out a multicast RA „some (short, random) time“ after receiving an RS. Many others (Juniper, et.al.) have implemented this and I’d like to see this in BIRD too. The code changes are apparently very simple, so I almost did it myself, but then I didn’t want to interfere with ongoing 2.x developments. (lame excuse, I know …) Context dependent (global) „variables“ for functions/filters I (and probably others too) would really enjoy having more global variables defined for use inside filters & functions, depending on the context within which the respective filter/function is being called. The most obvious ones would be the peer’s (and our own) AS number (in the context of BGP protocols), the filtering direction, the protocol (type and name), the next hop’s address (where applicable), and so on. Yes, I know, most of these could be explicitly given (at least to a function) when calling it as the import/export filter for a protocol with a „where“ clause, but that would defeat the purpose of using templates (which I really do like and use a lot). The general concept of having „globals“ inside functions/filters is already there - just presently only in the context of the route that is being evaluated. I’d like to see this expanded into other contexts as described above. Discuss! 😉😜 More „controversial“ things: Maintain interface addresses (Linux et.al.) It would be nice, if BIRD could be „enhanced“ [sic] to take care of addresses assigned to interfaces, i.e. establish them in the first place and afterwards maintain them, i.e., re-install static, global IPv6 addresses on interfaces, which have suffered a link-state bounce. The latter is particularly interesting, since Linux -by design- removes global IPv6 addresses from an interface during a link-down state transition. Rationale: The various Linux distributions have all sorts of (different and sometimes „funky“) implementations of how to establish addresses to interfaces in the first place and then „deal with them“ during link-state state changes. I would like to have BIRD take care of this relatively simple task as well as the way more complicated task of maintaining millions of routes. If only to have a clean way to define „a router“ within one system (BIRD) as opposed to „get the addresses onto the interfaces with a bunch of iproute2 commands and then start BIRD to take care of the rest“-approach I’ll have to use now. A simple „boot the machine and fire up BIRD - done“ one-stop-shopping solution, if you may. 😉 This is particularly interesting to smaller, dedicated routers, like (former) OpenWRT platforms, Raspberry Pis - or (my application) Ubiquiti routers of all shapes and sizes, where I presently replace the built-in Quagga Version with BIRD. Speaking of Quagga: It takes care of interface addresses too, you know … ;-) An „ipset“ protocol for Linux It would be tremendously helpful to have a protocol, which would maintain given (named) „ipset <http://ipset.netfilter.org/>“ tables on Linux. This would allow for very easy interactions with iptables-based ACLs on Linux platforms. It should/could be treated like a Linux route-table, just with less/different attributes. So it should „sync“, could possibly „import“ items from the ipset, could be made „persistent“, etc. Applications are numerous: From fully automatic BCP38 handling at border interfaces to (again, fully automated) suppression of bogon traffic, to statistical analysis, to … whatever. It would be a single, well defined tool to interact with the whole world of capabilities the iptables/ipsets world offers. If there is any interest in discussing the latter two any further I’d be very happy to spec them out in more detail, of course. Looking forward to hear what people think about these … 😳 Clemens

3 5

FreeBSD, BGP and md5
by Peter Andreev 23 Mar '18

23 Mar '18

Hi, Is it still necessary to build custom kernel to get md5 auth working? I got message "Error: Kernel MD5 auth failed” on FreeBSD 11.1 and bird 1.6.3. -- Peter Andreev MSK-IX/RIPN +7 (495) 737-0685 DNS Network Operational Center +7 (499) 192-9179

1 0

BIRD 1.6.3 + ROA crashing issue
by Javor Kliachev 23 Mar '18

23 Mar '18

Hello, We have been using BIRD 1.6.3 on Ubuntu 16.04 as Route Server for a long time. Recently we decided to implement a ROA check filtration but we're experiencing the daemon is crashing whenever removing roa table from the file config even when the roa table is not applied anywhere. In simple words: The ROA table is only defined in the config. Here is а specific example: root@rs2-lab:/usr/local/bird-new/etc# cat roa.conf roa table r65501 { roa 1.2.3.0/24 max 32 as 65501; } ################################# *Here is our simple bird config:* root@rs2-lab:/usr/local/bird-new/etc# cat bird.conf log "/var/log/bird.log" all; log syslog all; debug protocols { events }; router id 10.10.10.100; define myas = 12345; protocol device {} include "roa.conf"; ################################# So when I remove/comment "roa.conf" from the config - bird process is crashing /root@rs2-lab:/usr/local/bird-new/etc# birdc c// //BIRD 1.6.3 ready.// //Connection closed by server/ *Here is dmesg with the crash info:* /[62285.414645] bird[11272]: segfault at 0 ip 000000000040ace7 sp 00007ffd5040e950 error 4 in bird[400000+74000]// //[62508.998315] bird[11487]: segfault at 0 ip 000000000040ace7 sp 00007ffe148741c0 error 4 in bird[400000+74000]// //[62599.558242] bird[11570]: segfault at 0 ip 000000000040ace7 sp 00007ffdfa129070 error 4 in bird[400000+74000]// //[62649.377296] bird[11575]: segfault at 0 ip 000000000040ace7 sp 00007ffd5d8da0a0 error 4 in bird[400000+74000]// //[63895.137084] bird[11730]: segfault at 0 ip 000000000040ace7 sp 00007ffdd4f08f00 error 4 in bird[400000+74000]// //[63927.053383] bird[11738]: segfault at 0 ip 000000000040ace7 sp 00007ffe9c5c8110 error 4 in bird[400000+74000]// //[66260.552622] bird[13629]: segfault at 0 ip 000000000040ace7 sp 00007ffc58de2ad0 error 4 in bird[400000+74000]// //[69835.274826] bird[14098]: segfault at 0 ip 000000000040ace7 sp 00007ffe306bc640 error 4 in bird[400000+74000]// //[70481.342658] bird[14218]: segfault at 0 ip 000000000040ace7 sp 00007ffd556c04c0 error 4 in bird[400000+74000]// //[70587.636343] bird[14234]: segfault at 0 ip 000000000040ace7 sp 00007ffdbc90e4d0 error 4 in bird[400000+74000]/ Could someone BIRD developer can help on this issue? Thanks in advance! Best~ -- --- Javor Kliachev Senior Engineer IP Services office:+359 2 974 33 11 mobile:+359 885 98 84 95 www.neterra.net <http://www.neterra.net> <https://bg.linkedin.com/pub/javor-kliachev/11/b46/843>

2 3

OSPF over OpenVPN
by Michael McConnell 22 Mar '18

22 Mar '18

Hello all, I am trying to establish OSPF over OpenVPN without any luck. The client side always turns up with no neighbours. I’ve tried pointtopoint and exclusively listing my neighbours all with no luck. I originally was using the tun interface and switched to tap hoping that would help, but still nothing. Below are my configurations, does anyone see anything obvious that I am missing? Thanks so much for your time and thoughts! === show ospf ospf1: RFC1583 compatibility: disabled Stub router: No RT scheduler tick: 1 Number of areas: 1 Number of LSAs in DB: 1 Area: 0.0.0.0 (0) [BACKBONE] Stub: No NSSA: No Transit: No Number of interfaces: 0 Number of neighbors: 0 Number of adjacent neighbors: 0 Server === protocol ospf { import all; export filter { ospf_metric1 = 1000; if source = RTS_STATIC then accept; else reject; }; area 0 { networks { 10.40.32.0/24; 10.10.10.32/27; }; interface "bond1" { type broadcast; cost 5; hello 5; wait 10; dead 25; authentication cryptographic; password “boogers"; }; interface "tap*" { type broadcast; cost 5; hello 5; wait 10; dead 25; authentication cryptographic; password “boogers"; }; interface "*" { cost 1000; stub; #type pointopoint; }; }; Client === protocol ospf { import all; export filter { ospf_metric1 = 1000; if source = RTS_STATIC then accept; else reject; }; area 0 { networks { 10.40.32.0/24; 10.10.10.32/27; }; interface "bond1" { type broadcast; cost 5; hello 5; wait 10; dead 25; authentication cryptographic; password “boogers"; }; interface "tap*" { type broadcast; cost 5; hello 5; wait 10; dead 25; authentication cryptographic; password "boogers"; }; interface "*" { cost 1000; stub; #type pointopoint; }; }; -- Michael McConnell WINK Streaming; email: michael(a)winkstreaming.com toll free: 877-GO-4-WINK x 7400 direct: +1 312 281-5434 cell: +506 8706-2389 skype: wink-michael web: http://winkstreaming.com

5 7

Patch to output JSON from BIRD
by Alistair Crooks 22 Mar '18

22 Mar '18

Hi folks, I've attached a patch which outputs JSON from BIRD - this is used to save some cycles - where previously we converted to JSON externally, this patch enables output directly in JSON. This is based on bird-1.6.3_4 (from FreeBSD ports) Best, Alistair

1 0

Static Route /24
by Michael McConnell 21 Mar '18

21 Mar '18

Hello fellow Bird users, I’ve run into a strange issue trying to subnet a /24 into a series of smaller /27 and /28’s and have the routed via BGP. I currently do the following; route 10.10.10.0/24 reject; However if I don’t bring the interface up as a /24 (i.e. ifconfig eth0:10 10.10.10.10 netmask 255.255.255.0 up) I am unable to get the route explored when I run show route - the interface needs to be online in order for “show route” to show the import as a unreachable. I can kinda make this work through a series of strange static routes, but this seems incorrect. Can anyone suggest a better way to ensure my /24 is announced regardless so that I can then subnet it down for the purpose of serving over a VPN the /28’s and /27’s? Hopefully that question makes sense and isn’t too much nonsense. Thanks for you help and comments! Mike -- Michael McConnell WINK Streaming; email: michael(a)winkstreaming.com toll free: 877-GO-4-WINK x 7400 direct: +1 312 281-5434 cell: +506 8706-2389 skype: wink-michael web: http://winkstreaming.com

2 2

constant not available everywhere and passing variables from protocols
by Saku Ytti 21 Mar '18

21 Mar '18

My config: define local_ip = 129.250.14.127; define default_candidate_net = 129.250.0.0/16; define default_candidate_ip = 129.250.0.0; define default_net = 0.0.0.0/0; include "common.conf"; protocol static { route 0.0.0.0/0 recursive default_candidate_ip; } # ens192 protocol bgp active from NTT { neighbor 204.141.224.0; } # ens 224 protocol bgp backup from NTT { neighbor 204.141.224.2; } 1) constant not available everywhere a) this works - define default_candidate_ip = 129.250.0.0; - route 0.0.0.0/0 recursive default_candidate_ip; b) this does not - define default_route = 0.0.0.0/0; - route default_route recursive 129.250.0.0; Why not? It barfs with 'line 10: IP address expected' 2) passing variables from protocols I'm thinking how to tell which neighbour is backup which is primary. My thoughts a) 'import (backup, bgp_in) => no way to define >1 filter? b) 'bool backup = true' => no way to set variables in protocols c) 'define backup = true' => no way to set constants in protocols d) ''import bgp_in(true)' => no way to pass variables to filters I resorted to matching to protocol name, and call the backup group backup. But I'd really prefer way to give neighbour or protocol some information I can use in filter to discriminate. Are constants considered strings? If so, should the strings have some methods, like split, sub, []? I bit needlessly need to define 129.250.0.0 and 129.250.0.0/16 as one is used as static route next-hop another is used as filter to permit prefix. I could just maybe say 'default_candidate_net.split('/')[0]'. -- ++ytti

2 3

feature query
by Sarkar, Kawshik 21 Mar '18

21 Mar '18

Hi , I work for a satellite operator and we are looking for a vrouter that integrates with VPP. We are looking for the following functionalities: 1)full VRF support not VRF LITE 2)MPLS l3 vpn 3)MP BGP Support with vpnv4 4)DLEP (optional) Can you kindly confirm how many of these protocols are currently supported? Thanks Kawshik ============================================================================================================================================ This electronic message and any files transmitted with it contains information from iDirect, which may be privileged, proprietary and/or confidential. It is intended solely for the use of the individual or entity to whom they are addressed. If you are not the original recipient or the person responsible for delivering the email to the intended recipient, be advised that you have received this email in error, and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. If you received this email in error, please delete it and immediately notify the sender.

2 3