April 2019 - Bird-users - Mailing Lists

Unknown instruction 8574 in same (~) error when nesting if's
by Nico Schottelius 20 Apr '19

20 Apr '19

Hello, I am using bird 1.6.3 (from debian) and if I use the following filter, bird "crashes" when issueing the "conf" command: Apr 19 21:29:53 router1 bird: Reconfiguring Apr 19 21:29:53 router1 bird: Unknown instruction 8574 in same (~) filter: filter to_netstream { if(is_inside_ungleich()) then { if(net !~ net_prefer_netstream) then { bgp_path.prepend(myas); bgp_path.prepend(myas); bgp_path.prepend(myas); print "Policy: changed bgppath ", net, " ", bgp_path, " for init7"; } accept; } reject; } If I change the filter to filter to_netstream { if(is_inside_ungleich()) then { # if(net !~ net_prefer_netstream) then { # bgp_path.prepend(myas); # bgp_path.prepend(myas); # bgp_path.prepend(myas); # print "Policy: changed bgppath ", net, " ", bgp_path, " for init7"; # } accept; } reject; } this problem does not occur. Is this a bug in bird or am I using it "incorrectly"? Best, Nico Relevant context: version: -------------------------------------------------------------------------------- [17:14:30] router1.place5:/var/log# dpkg -l | grep bird ii bird 1.6.3-2 amd64 Internet Routing Daemon [17:18:49] router1.place5:/var/log# config: -------------------------------------------------------------------------------- define net_ungleich = [ 2a0a:e5c0::/29+, 2a09:2940::/29+ ]; define net_prefer_netstream = [ 2a09:2940::/29+ ]; define net_rickbakker = [ 2001:678:a10::/48+, 2a0d:1a44::/32+, 2a0d:1a47::/32+, 2a0d:2406::/39+, 2a0d:2406:e00::/39+, 2a07:a904:1000::/40+ ]; function is_ungleich() { if net ~ net_ungleich then return true; return false; } function is_from_rickbakker() { if net ~ net_rickbakker && bgp_path.first = 204526 then return true; return false; } # what we have inside dcl function is_inside_ungleich() { if(is_ungleich()) then return true; if(is_from_rickbakker()) then return true; return false; } protocol bgp netstream { local as 209898; neighbor 2a01:330:1000:1002::1 as 15517; password "xxx"; import filter from_netstream; export filter to_netstream; } -------------------------------------------------------------------------------- -- Your Swiss, Open Source and IPv6 Virtual Machine. Now on www.datacenterlight.ch.

2 2

BGP routing table update time
by Tom Petty 18 Apr '19

18 Apr '19

Hi all, I’m trying to parse birdc output to process routing tables. While each route entry has a timestamp associated with it, I can’t find a convenient way of determining when the contents of a table were last changed, other than parsing the entire table and checking the timestamps of each route. I’d like to avoid this, so is there a better way of determining when a route table was last updated that I’m missing? If not, would a patch adding a “time of last update” value to the table be of interest? Thanks, Tom P

2 2

BIRDv2: OSPFv3: vrf stub interface not recognized
by bauen1 18 Apr '19

18 Apr '19

Hi again, Now that OSPF stub networks work on loopback and dummy interfaces work again, I've run across another Issue, OSPFv3 refuses to recognize any networks on a vrf interface, even with a ipv6-ll adress added. I'm not entirely sure if I'm even supposed to add addresses to the vrf interface, but as far as I know, I can just use the vrf interface for the router ip (normally the job of loopback). BIRD v2.0.4-10-g6ff81197 ready. bird> show interfaces lo up (index=1) MultiAccess AdminUp LinkUp Loopback Ignored MTU=65536 127.0.0.1/8 (Preferred, scope host) 10.30.0.54/32 (scope site) ::1/128 (Preferred, scope host) fe80::1/128 (Preferred, scope link) enp1s0 up (index=2) MultiAccess Broadcast Multicast AdminUp LinkUp MTU=1500 10.30.0.54/24 (Preferred, scope site) fe80::5054:ff:fe01:ea75/64 (Preferred, scope link) fdde:e540:e627:0:5054:ff:fe01:ea75/64 (Preferred, scope site) enp7s0 up (index=3) MultiAccess Broadcast Multicast AdminUp LinkUp MTU=1500 169.254.169.2/32 (Preferred, opposite 169.254.169.254, scope univ) fe80::5054:ff:fe15:9119/64 (Preferred, scope link) dummy0 down (index=6) MultiAccess Broadcast Multicast AdminDown LinkDown MTU=1500 dn42 up (index=8) MultiAccess AdminUp LinkUp MTU=65536 172.20.18.226/32 (Preferred, scope site) 172.20.10.0/24 (scope site) fe80::1111:1111:1111:1111/64 (Preferred, scope link) enp8s0 up (index=4 master=dn42) MultiAccess Broadcast Multicast AdminUp LinkUp MTU=1500 169.254.254.1/32 (Preferred, opposite 169.254.254.2, scope univ) fe80::5054:ff:feec:af5/64 (Preferred, scope link) bird> show ospf interface ospf1 ospf1: Not a protocol bird> show ospf interface dn42_ospf_ip4 dn42_ospf_ip4: Interface enp8s0 (IID 64) Type: ptp Area: 0.0.0.0 (0) State: PtP Priority: 1 Cost: 10 ECMP weight: 1 Hello timer: 10 Wait timer: 40 Dead timer: 40 Retransmit timer: 5 bird> important part of bird.conf protocol ospf v3 dn42_ospf_ip4 { vrf "dn42"; ipv4 { table dn42 }; area 0.0.0.0 { interface "dn42" { stub yes; }; }; };

2 1

Learning BIRD source
by Brian Topping 17 Apr '19

17 Apr '19

Developer team: I’d like to get better with the source. Due to being an inferior specimen and/or too many other projects, I need help from tools like CLion to make sense of source trees within weeks instead of years. Are others working on BIRD source within IDEs? I know "real programmers use vim and emacs”, etc, but please refer to previous paragraph in that case… For all it matters, I am not a bush league developer, I have written code using bison and flex and am super stoked to get my hands dirty here. One option that presents itself to me is converting the build from Autotools to CMake. That’s sure to make someone’s blood boil. But if not (or there is a similarly worthy tool folks would accept), would such a transition be PR-worthy? Because it’s declarative vs. procedural, CMake is possible for IDEs to ingest and make sensible semantic presentations with. That leads to better productivity and more possible contributors in the long run. I’m just poking the bear here with ideas and being as lazy as possible, but not afraid of the work at the same time. Grateful for any and all ideas! B

6 10

Setting route destination for DNAT addresses
by Brian Topping 12 Apr '19

12 Apr '19

In this thread[1], I realize I created a new problem in the BIRD BGP configuration with `dest = RTD_BLACKHOLE`. Setting a destination to blackhole works great when the routes are being propagated (no ICMP unreachable is sent by the kernel) and an address being managed by Kubernetes DNAT facilities will be caught in the netfilter chains and sent to the proper container. That configuration: > router id UP.STREAM.143.113; > > protocol bgp bgp_metal_gw01 { > local as ASLOCAL; > neighbor 10.10.0.41 as ASLOCAL; > passive yes; > ipv4 { > next hop self; > import filter { > bgp_origin = ORIGIN_IGP; > dest = RTD_BLACKHOLE; # <=== DISCUSSION LINE > accept; > }; > export none; > }; > } The problem is when a service on the same host as the container needs to connect to the DNAT address presented for the container. Because the local kernel routing table is set to blackhole for an address, the traffic is immediately sunk instead of being offered to netfilter. Removing that dest line simply sets it to a default of RTD_UNREACHABLE, which does the same thing but politely tells the sender that it did so. What I thought would work is to change the line to `ifname = “eno2”`, but doing so generates a parse error. This seems to be a bug in the documentation as the `ifname` attribute is not listed as read-only. How can I set the route to a local interface in the filter? Thanks! Brian [1] https://marc.info/?l=bird-users&m=155458976221242&w=2

2 2

Reporting issues
by Brian Topping 12 Apr '19

12 Apr '19

Hi all, I think I looked in all the regular places and inferred that reporting issues might best be done here. The gitlab issue tracker shows no issues. The problem I have seen is where BIRD BGP is running a passive process. The initiator peer is running the product at https://metallb.universe.tf <https://metallb.universe.tf/>. This product can only initiate sessions. Due to (what I assume) is a bug in the product, it was able to initiate a session from a TCP socket source address that was not matched to the router ID. More specifically, both BGP processes were running on the same host, with MetalLB configured to take a router ID that was a secondary (internal / private) interface and and BIRD using the primary interface address (so as to be able to connect to other external peers). I believe the BIRD team would be interested in this because when BIRD BGP accepted a connection with the same source address as it’s own Router ID, even though the session provided a different router ID, it caused BIRD the BIRD RIB and kernel exports to show the source of the route to be a completely different BGP peer. In this case, the different peer was the default route of a stub area, so incoming traffic to these addresses formed a routing loop. It’s unclear to me whether this is a bug or a feature. If it is indeed a feature or unavoidable side effect that needs to be supported all the same, what would have been desirable is if there was at least some log message of the form “this is probably not what you want” when a peer connected in this manner. More information can be found at https://github.com/danderson/metallb/issues/422 <https://github.com/danderson/metallb/issues/422> and the referenced PR. I’m happy to help reproduce the problem if needed. Thanks for a great product!! best, Brian

3 7

Bird, RPKI/RTR and issues with SSH
by Louis Poinsignon 12 Apr '19

12 Apr '19

Hello everyone, I hope this mailing list is the correct place for my message. I am the developer of GoRTR (https://github.com/cloudflare/gortr) a tool to send RPKI/ROA validated data to routers. I just implemented SSH support (no-auth, password and publickey) With Bird 2.0.2, I managed to setup a cleartext connection. I made a docker-compose environment with two birds connected and a GoRTR. https://github.com/lspgn/compose-bird-gortr While it's not impacting, when the RTR server returns a NO DATA, the client will bomb of requests as shown by a higher log level of GoRTR. > gortr_1 | time="2019-04-11T21:40:13Z" level=debug msg="10.1.0.3:54874 > (v1) / Serial: 0: Received PDU Reset Query v1" > gortr_1 | time="2019-04-11T21:40:13Z" level=debug msg="10.1.0.3:54874 > (v1) / Serial: 0 > Request Cache" > gortr_1 | time="2019-04-11T21:40:13Z" level=debug msg="10.1.0.3:54874 > (v1) / Serial: 0 < No data" > gortr_1 | time="2019-04-11T21:40:13Z" level=debug msg="10.1.0.3:54874 > (v1) / Serial: 0: Received PDU Reset Query v1" > gortr_1 | time="2019-04-11T21:40:13Z" level=debug msg="10.1.0.3:54874 > (v1) / Serial: 0 > Request Cache" I am not sure if I'm missing a timeout but I feel this may be a bug. For ssh I am having another issue. The faulty configuration is the following: https://github.com/lspgn/compose-bird-gortr/blob/bird-rtr-ssh/bird/config_l… With the statement: > protocol rpki gortr { > debug all; > roa4 { table t_roa4; }; > roa6 { table t_roa6; }; > remote "10.1.0.4" port 8283; > transport ssh { > user "rpki"; > bird private key "/etc/bird/id_rsa"; > }; > retry keep 90; > refresh keep 900; > expire keep 172800; > } The logs are the following: > Creating network "bird-gortr-compose_vpcbr" with driver "bridge" > Creating bird-gortr-compose_gortr_1 ... done > Creating bird-gortr-compose_bird1_1 ... done > Attaching to bird-gortr-compose_gortr_1, bird-gortr-compose_bird1_1 > gortr_1 | time="2019-04-12T00:33:16Z" level=info msg="Enabling ssh with > the following authentications: password=false, key=true" > gortr_1 | time="2019-04-12T00:33:18Z" level=info msg="New update (79929 > uniques, 79929 total prefixes). 0 bytes. Updating sha256 hash -> > db4486e353d9f1f7e30ad90ab4b93c0c91adb30dfc572a0493ca8030471768c9" > gortr_1 | time="2019-04-12T00:33:18Z" level=info msg="Updated added, new > serial 1" > gortr_1 | time="2019-04-12T00:33:18Z" level=info msg="Accepted ssh > connection from 10.1.0.2:33758 (1/0)" > gortr_1 | time="2019-04-12T00:33:18Z" level=info msg="Connected > (ssh-key): rpki/10.1.0.2:33758 with key ssh-rsa > AAAAB3NzaC1yc2EAAAADAQABAAABAQC1PYoRv0xuIMbv6aQZbXUNzqS611+FgahO0tNJ1C/CD2yxmzDuijjiAL3ia3UNPuIwS4Bwukn0EQJP/J2UGM0ABGR6r8n46RzFFkBqVBXrpRNThsD36hSYeUqfir1DChxknXCEG0pLcs5cW3OZagROcW5eZbbbTD40lIglhthtrf/9d241WUcvrhXiE/VaZvj8wi2lY26MuvqDGJgApOK4gi4gLzlr5qT4aDIzUIV0LlYul3hOFX/UMlX0yJg2cgEz/xRRlUfpsx6rQkwQZ0z1lwI0QBvHlON/+Azy/HmGWFcQ2S0V+CWUFHoZ/PBqmBnLT5MBSy5r/9RQVfoaeHBv" > gortr_1 | time="2019-04-12T00:33:18Z" level=error msg="Error with ssh > client 10.1.0.2:33758: ssh: unmarshal error for field Language of type > disconnectMsg" > gortr_1 | time="2019-04-12T00:33:18Z" level=info msg="Accepted tcp > connection from 10.1.0.3:55344 (1/0)" > bird1_1 | bird: gortr: Channel roa4 connected to table t_roa4 > bird1_1 | bird: gortr: Channel roa6 connected to table t_roa6 > bird1_1 | bird: gortr: Initializing > bird1_1 | bird: gortr: Starting > bird1_1 | bird: gortr: Changing from Down to Connecting state > bird1_1 | bird: gortr: Opening a connection > bird1_1 | bird: gortr: State changed to start > bird1_1 | bird: Started > bird1_1 | bird: gortr: Lost connection: Failed to read private key: > /etc/bird/id_rsa > bird1_1 | bird: gortr: Changing from Connecting to Transport-Error state > bird1_1 | bird: gortr: Closing a connection GoRTR sees the connection with the correct public key but Bird drops it. If I do not set any statement "bird private key", it does not connect as well. Have anyone successfully setup a RTR+SSH session? The password authentication work well with Cisco routers but apart from rtrdump (another tool related to GoRTR) I could not test publickey authentication. Thank you in advance, Best, Louis

2 2

For developer, required some explanation on code with timer and BGP
by Mattia Milani 06 Apr '19

06 Apr '19

Hello all, this is a message for developer and who know how bird use timer, and buffer. Sorry for the length of this mail. For first, the protocol i want to modify and upgrade is BGP, i see that there isn't the timer MRAI implemented and it will be useful for some studies on information propagation, so i decided to develop a first version of it. The actual process to send any kind of pkt is to call the function bgp_fire_tx() and it's called by two other function respectively bgp_kick_tx() and bgp_tx() and the function bgp_fire_tx() take care to read from the buffer the message that has to be sent and send it. bgp_kick_tx() and bgp_tx() call bgp_fire_tx() while it don't return 0, so the clear all the buffer of the message that has to be sent. So my idea to introduce MRAI was that: Create a timer (for now I created it for connection, after like say RFC 4271 this timer has to be set for every route) and put it on the connection. Initialize it with the other timer of the conn when the state of the conn goes up i set it to some value and start the timer. when the timer finish i call the function MRAI_finish() that call the function bgp_fire_tx() while there is something to send more ore less like the while loop in bgp_kick_tx() and bgp_tx() when it's called bgp_fire_tx() on the update message part i written a check, if the timer isn't at 0 i can't send the update, because the function can be called from bgp_kick_tx() or bgp_tx(), but if it 0 it is finished so i can send the message When all the message had been send i reset the timer and start it again. But unfortunately i see something that doesn't make my code work. when something call bgp_kick_tx() or bgp_tx() the call bgp_fire_tx() and they clear all the buffer, including update message that wasn't sended so when the timer finish it didn't found anything on the buffer. Now how can i change that? My idea is to use a secondary buffer, when in bgp_fire_tx() i see that i can't send the update I will insert the pkt in this secondary buffer and consume the pkt on the main buffer. when bgp_kick_tx() or bgp_tx() have send all the messages I will transfer all the pkt in the secondary buffer into the main buffer. So I ask you it's possible that? there is something in the code already written that could help me? do you see another way to implement the MRAI timer? Thanks a lot to everyone, Mattia

2 3

BFD session support over vlan tagged interfaces on linux.
by Rohit Gujrati 04 Apr '19

04 Apr '19

Simplified Topology: I have got 2 linux boxes connected back to back. I am running bird 2.0.2 on both only for bfd sessions. int 1/1 (with ip 1.0.0.0.1/16) of linux1 is connected to int 1/2(with ip 1.0.0.2/16) of linux2 after configuring the bird.conf files I can see that bfd sessions are up. now if I create vlan interface on the these interfaces, and try creating bfd session over the vlan tagged interface, it doesnot work. can someone please help if I am any special configuration to indicate the vlan tagging or this scenario is not supported as of now. This scenario can be considered same as having bfd sessions over SVI interfaces (in terms of cisco terminology). -- Thanks, Rohit.

1 0

Error msg on "make install"
by Toru Nozaki (tonozaki) 04 Apr '19

04 Apr '19

Hi experts, I’m trying to build Bird v2.0.4 on my environment. Ubunts 16.4 LTS $ uname -a Linux Y01-JUMP-01 4.4.0-87-generic #110-Ubuntu SMP Tue Jul 18 12:55:35 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux In case of “#make install” , following error messages are displayed and can’t build. ------------------------------- #make install /usr/bin/install -c -d //usr/local/sbin //usr/local/etc //usr/local/var/run for BIN in bird birdcl birdc ; do \ /usr/bin/install -c ./$BIN //usr/local/sbin/$BIN ; \ done if ! test -f //usr/local/etc/bird.conf ; then \ /usr/bin/install -c -m 644 ./doc/bird.conf.example //usr/local/etc/bird.conf ; \ else \ echo "Not overwriting old bird.conf" ; \ fi Not overwriting old bird.conf ------------------------------- Does anyone help to solve this? /regards, Toru Nozaki

3 3