October 2019 - Bird-users

misunderstanding or incorrectly implemented filter?
by Christoph 05 Oct '19

05 Oct '19

Hello, (please keep me in CC) we use filters from https://bgpfilterguide.nlnog.net/ One of the first functions checks for bogon ASNs way before the RPKI ROA check: > filter transit_in { > > reject_bogon_asns(); [...] > if (net.type = NET_IP4) then { > if (roa_check(r4, net, bgp_path.last) = ROA_INVALID) then > { > print "Reject RPKI INVALID announcement ", net, " by AS", bgp_path.last; > reject; > } > } [...] My assumption was that an announcement from AS0 would never end up at the RPKI ROA check since it is already tested and rejected earlier at the reject_bogon_asns() function but then I found log entries suggesting otherwise: > Reject RPKI INVALID announcement 200.124.231.0/24 by AS0 So I was wondering: - Did I incorrectly assume first match wins? - Is the reject_bogon_asns() function not working as intended? > define BOGON_ASNS = [ 0, # RFC 7607 > 23456, # RFC 4893 AS_TRANS > 64496..64511, # RFC 5398 and documentation/example ASNs > 64512..65534, # RFC 6996 Private ASNs > 65535, # RFC 7300 Last 16 bit ASN > 65536..65551, # RFC 5398 and documentation/example ASNs > 65552..131071, # RFC IANA reserved ASNs > 4200000000..4294967294, # RFC 6996 Private ASNs > 4294967295 # RFC 7300 Last 32 bit ASN > ]; > function reject_bogon_asns() > int set bogon_asns; > { > bogon_asns = BOGON_ASNS; > if ( bgp_path ~ bogon_asns ) then { > print "Reject: bogon AS_PATH: ", net, " ", bgp_path; > reject; > } > } thanks, Christoph

2 4

IP version independent RPKI filter
by Christoph 04 Oct '19

04 Oct '19

Hello, the RPKI documentation section has a RPKI ROV example using an IPv4 specific filter: https://bird.network.cz/?get_doc&v=20&f=bird-6.html#ss6.13 > roa4 table r4; > roa6 table r6; > > protocol rpki { > debug all; > > roa4 { table r4; }; > roa6 { table r6; }; > > # Please, do not use rpki-validator.realmv6.org in production > remote "rpki-validator.realmv6.org" port 8282; > > retry keep 5; > refresh keep 30; > expire 600; > } > > filter peer_in_v4 { > if (roa_check(r4, net, bgp_path.last) = ROA_INVALID) then > { > print "Ignore invalid ROA ", net, " for ASN ", bgp_path.last; > reject; > } > accept; > } > > protocol bgp { > debug all; > local as 65000; > neighbor 192.168.2.1 as 65001; > ipv4 { > import filter peer_in_v4; > export none; > }; > } We use a transit_in filter that checks the net.type to decide which roa_check parameter to use: > filter transit_in { > > reject_bogon_asns(); > reject_small_prefixes(); > reject_bogon_prefixes(); > reject_long_aspaths(); > reject_default_route(); > enforce_neighbor_asn(); > reject_our_networks(); > > if (net.type = NET_IP4) then { > if (roa_check(r4, net, bgp_path.last) = ROA_INVALID) then > { > print "Reject RPKI INVALID announcement ", net, " by AS", bgp_path.last; > reject; > } > } else { > if (roa_check(r6, net, bgp_path.last) = ROA_INVALID) then > { > print "Reject RPKI INVALID announcement ", net, " by AS", bgp_path.last; > reject; > } > } > > accept; > > } Is this significantly less efficient than having separate IPv4/6 filters that do not need that additional if (net.type = .. ) check? Or does it not really matter? If possible I'd prefer a single filter that can be applied to IPv4 and IPv6 BGP sessions. thanks, Christoph

2 1

add bird repository information to documentation?
by Christoph 04 Oct '19

04 Oct '19

Hello, I only found out via this mailing list that there are RPM packages and apparently debian packages. Maybe you could add it to the documentation ("Installing BIRD" section?) if these are the official, maintained and recommended repos to use? https://bird.network.cz/?get_doc&v=20&f=bird-1.html#ss1.2 https://bird.network.cz/?download&tdir=debian/ > There are backported packages for the BIRD Internet Routing Daemon > available. Packages are maintained by Ondrej Sury , > currently i386 and amd64 ports are available for Debian and Ubuntu. > > If you want use this Debian package repository for BIRD, please > execute following commands as root: > > # wget -O - http://bird.network.cz/debian/apt.key | apt-key add - you probably want to replace http with https there. This appears to be key AC0E47584A7A714D: public key "CZ.NIC Labs Archive Automatic Signing Key <ftpmaster(a)labs.nic.cz>" but that does not appear to be the key that is used for signing: apt update [...] Err:2 https://bird.network.cz/debian buster InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY B188E2B695BD4743 Could you clarify and update the file on the server? > # apt-get install lsb-release > # echo "deb http://bird.network.cz/debian/ $(lsb_release -sc) main" > /etc/apt/sources.list.d/bird.list http -> https thanks, Christoph

1 0

Is BIRD on BSD a second class citizen?
by Christoph 04 Oct '19

04 Oct '19

Hello, (reminder: please keep me in CC, the mailing list issue is still unsolved) so far we get the impression that BIRD on BSD appears to be somewhat less supported when compared to Linux based systems. The two main points being so far: - security: no privilege dropping on BSD - performance issue when syncing with kernel routing table? Are there more limitations of BIRD on BSD? Do you actively recommend running BIRD on Linux (and against BSD)? thanks, Christoph

6 9

Re: Is BIRD on BSD a second class citizen?
by Mike Mazarick 03 Oct '19

03 Oct '19

Years ago, in the 2009-2010 timeframe, a telecom operator the "next rack over" told me that Linux didn't have the necessary security structures for telephone conversations and BSD had them. He used OpenBSD because what he wanted to do wasn't practical in Linux. I really didn't follow up and don't know what the advantages of were for BSD deployments back then. If you wanted to describe the inherent security advantages of BSD over Linux today, this would be welcomed. A lot has happened in 9-10 years in both BSD and Linux. At one time, I though BSD was a contender for Linux. Because of the volume, I'm not sure of this presently. Mike Mazarick --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

1 0

OSPF over openvpn; adjacency problems
by Thorsten Alteholz 02 Oct '19

02 Oct '19

Hi, I am trying to use OSPF over an openvpn link. tcpdump tells me that both ends send their HELLO packet but bird does not want to recognize them. When looking at ospf_rc_hook() in proto/ospf/packet.c the HELLO packet arrives in bird, but is discarded because of "strange address combinations": src_local is 0: sk->faddr = 10.25.0.26 ifa->addr->prefix = 10.25.0.2 ifa->addr->pxlen = 32 dst_mcast is 1: sk->laddr = 224.0.0.5 ifa->all_routers = 224.0.0.5 ifa->des_routers = 224.0.0.6 dst_mcast = 1 || 0 >From my point of view these values do not look that bad (the tun interface on this server has an address of 10.25.0.1 and on the client it is 10.25.0.26). But of course (dst_mcast && !src_local) is 1 and the HELLO packet is ignored. Does anybody have any idea what went wrong here? Best regards Thorsten The OSPF configuration on the server: protocol ospf { debug all; import all; export none; area 10.10.10.0 { interface "tun1" { type ptp; cost 2000; neighbors { 10.25.0.1; }; }; }; }

3 3

Explicit as-path filtering (with prepending allowed)
by Nigel Kukard 02 Oct '19

02 Oct '19

Hi guys, Is there perhaps an equivalent in BIRD for the following... ^(65000_)+(65101_)+(65253_)+$ The closest I could come was the following, but I am unsure if it would match if any of the networks prepend. if (bgp_path ~ [= 65000 65101 65253 =]) -N

2 2