January 2020 - Bird-users

[PATCH] babel: Set onlink flag for IPv4 routes with unreachable next hop
by Toke Høiland-Jørgensen 14 Apr '20

14 Apr '20

If the next hop of a route is not a reachable address, the route should be installed as onlink. This enables a configuration common in mesh networks where the mesh interface is assigned a /32 and babel handles the routing by installing onlink routes. Signed-off-by: Toke Høiland-Jørgensen <toke(a)toke.dk> --- proto/babel/babel.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/proto/babel/babel.c b/proto/babel/babel.c index 88c4711e..4fd88042 100644 --- a/proto/babel/babel.c +++ b/proto/babel/babel.c @@ -640,6 +640,13 @@ babel_announce_rte(struct babel_proto *p, struct babel_entry *e) .nh.iface = r->neigh->ifa->iface, }; + /* If we cannot find a reachable neighbour, set the entry to be onlink. This + * makes it possible to, e.g., assign /32 addresses on a mesh interface and + * have routing work. + */ + if (!neigh_find2(&p->p, &r->next_hop, r->neigh->ifa->iface, 0)) + a0.nh.flags = RNF_ONLINK; + rta *a = rta_lookup(&a0); rte *rte = rte_get_temp(a); rte->u.babel.seqno = r->seqno; -- 2.17.0

3 4

Re: IPv6 BGP & kernel 4.19
by Alarig Le Lay 29 Mar '20

29 Mar '20

We agree then, and I act as a router on all those machines. Le 3 décembre 2019 19:27:11 GMT+01:00, Vincent Bernat <vincent(a)bernat.ch> a écrit : >This is the result of PMTUd. But when you are a router, you don't need >to do that, so it's mostly a problem for end hosts. > >On December 3, 2019 7:05:49 PM GMT+01:00, Alarig Le Lay ><alarig(a)swordarmor.fr> wrote: >>On 03/12/2019 14:16, Vincent Bernat wrote: >>> The information needs to be stored somewhere. >> >>Why has it to be stored? It’s not really my problem if someone else >has >>a non-stantard MTU and can’t do TCP-MSS or PMTUd. >> >>-- >>Alarig > >-- >Sent from my Android device with K-9 Mail. Please excuse my brevity. -- Envoyé de mon appareil Android avec Courriel K-9 Mail. Veuillez excuser ma brièveté.

4 5

RPKI support without SSH transport
by Clemens Schrimpe 25 Mar '20

25 Mar '20

Ahoj BIRD Parents - I was wondering if there is a reason, why BIRD 2.0.x can't be built for RPKI support without libssh, although RPKI-RTR would also work on an unencrypted transport (as documented in the BIRD user documentation). I am asking, because I am building BIRD for a hardware router platform (Ubiquiti's EdgeRouters) and including libssh is, although doable, a real pain-in-the-rear, depending on the OS version and hardware architecture (4 variants in the EdgeOS world at the moment). Without libssh, which drags a whole slew of other library-crap behind it 🙄, BIRD is pretty lightweight and very easy to deploy. Just curious ... Thanks a lot (again) for this great piece of software! Clemens

5 9

BGP w/ MD5 and range
by Adam Kułagowski 27 Feb '20

27 Feb '20

Hi, Is the following configuration supported ? protocol bgp { debug { states, routes, filters, interfaces, events, packets }; debug all; ipv4 { import none; export filter export_bgp; }; local as 65001; neighbor range 0.0.0.0/0 as 65001 internal; #neighbor 10.255.254.3 as 65001 internal; password "12345678"; } If I switch to non-range neighbour everything works fins. However w/ above configuration in place the BIRD does not react to incoming packet: # tcpdump -veni any port 179 tcpdump: listening on any, link-type LINUX_SLL (Linux cooked v1), capture size 262144 bytes 19:41:05.377600 P 02:42:0a:ff:fe:03 ethertype IPv4 (0x0800), length 88: (tos 0xc0, ttl 64, id 52315, offset 0, flags [DF], proto TCP (6), length 72) 10.255.254.3.35894 > 10.255.254.1.179: Flags [S], cksum 0x123e (incorrect -> 0xb691), seq 307422819, win 64240, options [nop,nop,md5 shared secret not supplied with -M, can't check - ee89cc98bcbc5b38f7500c2f751a7612,mss 1460,nop,nop,sackOK,nop,wscale 7], length 0 However at the same time stracing the BIRD process shows nothing: # strace -p 8042 strace: Process 8042 attached restart_syscall(<... resuming interrupted read ...>) = 0 poll([{fd=3, events=POLLIN}, {fd=4, events=POLLIN}, {fd=5, events=POLLOUT}], 3, 3000) = 0 (Timeout) poll([{fd=3, events=POLLIN}, {fd=4, events=POLLIN}, {fd=5, events=POLLOUT}], 3, 3000) = 0 (Timeout) poll([{fd=3, events=POLLIN}, {fd=4, events=POLLIN}, {fd=5, events=POLLOUT}], 3, 3000) = 0 (Timeout) poll([{fd=3, events=POLLIN}, {fd=4, events=POLLIN}, {fd=5, events=POLLOUT}], 3, 3000) = 0 (Timeout) poll([{fd=3, events=POLLIN}, {fd=4, events=POLLIN}, {fd=5, events=POLLOUT}], 3, 3000) = 0 (Timeout) Am I missing something? The BIRD logs are empty. Best regards, Adam

2 4

BGP session closed after receipt of flowspec route without destination prefix
by Alex D. 05 Feb '20

05 Feb '20

Hi, i configured the following flowspec route on a Juniper router: route v6test { match { source 2a02:xxxx:xxxx:xxxx::1/128; } then discard; } The route was accepted on my Juniper router and blocked all traffic from src ip 2a02:xxxx:xxxx:xxxx::1 as expected. After advertising the route, BIRD closed the BGP session. Is this an expected behaviour, means does is it necessary, that a dst prefix for a flowspec route must exist ? Log: 2020-01-24 09:52:26.750 <RMT> vs_dis_r1_6838: No dst prefix at first pos 2020-01-24 09:52:26.750 <RMT> vs_dis_r1_6838: Error: Malformed attribute list 2020-01-24 09:52:26.750 <TRACE> vs_dis_r1_6838: BGP session closed BIRD accepted the route after changing to: route v6test { match { destination ::/0; source 2a02:xxxx:xxxx:xxxx::1/128; } then discard; } Regards, Alex

3 4

(no subject)
by Anders Hansen 01 Feb '20

01 Feb '20

Hi list I'm having issues with a Debian 10 based router running BIRD 2.0.7. On the router I have several interfaces where OSPFv3 is active. All good. Besides those interfaces, i also have a dummy interface named loopback0. Config example: area 0 { interface "ens*" { type ptp; cost 1; hello 5; }; interface "loopback0" { stub; cost 1; }; }; The ens interfaces work just fine. However, the /128 I have configured on the loopback0 interfaces is constantly not being picked up by BIRD. It's like BIRD completely ignores the existence of that interface. It simply won't announce that /128 out to its peers connected through the ens interfaces. If i change the /128 to a /127 instead, the prefix is advertised by bird. Any clues as to what gives this kinda unexpected (to me) behavior? Why wouldn't BIRD recognize a /128? I'm used to both Cisco and Juniper and have not seen this behavior before. All I'm trying to do is use my loopback for establishing an iBGP mesh - basic use case, i believe :) Thanks! Best Regards Anders Hansen

2 4

wildcard string matching
by Robert Blayzor 28 Jan '20

28 Jan '20

Does pattern matching work with wildcards like below? I tried searching the docs for pattern/wildcard/regex but could not find a definitive answer. It looks like this works with "interface" wildcards.... if (proto = "global_null*") then { bgp_community.add ((MYAS, 888)); } else { -- inoc.net!rblayzor XMPP: rblayzor.AT.inoc.net PGP: https://pgp.inoc.net/rblayzor/

2 1

determining ipv4 or ipv6 net in filter
by Robert Blayzor 28 Jan '20

28 Jan '20

Migrating from BIRD 1.6 to 2.0 and I would like to consolidate some BGP filters and use them for IPv4 or IPv6 sessions.... What is the best way to enumerate if a net is IPv4 or IPv6 if you wanted to make a if/then/else on.. ie: filter MY_FILTER { if ((MYAS, 888) ~ bgp_community) then { if (< Is IPv4 ?>) then { do this...; accept; } else if (< Is IPv6 ?> then { do that...; accept; } else { reject; } } reject; } TIA -- inoc.net!rblayzor XMPP: rblayzor.AT.inoc.net PGP: https://pgp.inoc.net/rblayzor/

3 5

Re: [babel] Purpose of 'generate from/to' and 'accept from/to' for passwords?
by Toke Høiland-Jørgensen 21 Jan '20

21 Jan '20

Juliusz Chroboczek <jch(a)irif.fr> writes: > Thanks, Ondrej. > >> Well, it is requirement of OSPF spec (RFC 2328). I could assume it could >> help for smoother key transitions when clocks are not perfectly synchronized. > > Ah, I see. > > OSPF only allows one key in the trailer, so it needs the ability to send > one key but accept many. Babel-MAC allows multiple keys in the trailer, > and that ability is therefore not required. > > Or am I missing something? No, I think you're right. > I have no objection to keeping the ability, since it's pretty trivial to > implement. No objection to making it optional, since it's not > particularly useful in Babel-MAC. No objection to removing it altogether, > since it's good to avoid unnecessary features. Well, the Bird implementation (which I really should get around to finishing) is going to re-use the existing config syntax, so that is going to implement it in any case. I don't have any strong opinions as to what the spec should say, as long as it doesn't forbid such an option :) -Toke

1 0

Enabling BGP FlowSpec routes export
by posta＠davidepucci.it 21 Jan '20

21 Jan '20

Hi. I'm setting up Bird (2.0.7) as a BGP FlowSpec controller and it has to send out FS routes to two (FRR-based) neighbors. Actual configuration is defined as below: flow4 table flowtab4; protocol static { flow4 { import all; export all; }; route flow4 { src x.x.y.y/32; dst x.x.z.z/32; } { bgp_ext_community.add( (generic, 0x80060000, 0x0) ); }; } template bgp bgp_fs { local x.x.x.x as ABCDG; capabilities off; flow4 { table flowtab4; import all; export all; }; ipv4 { import all; export all; }; } protocol bgp bgp_svc01 from bgp_fs { neighbor y.y.y.y as ABCDE; } protocol bgp bgp_svc02 from bgp_fs { neighbor z.z.z.z as ABCDF; } The FS is properly assigned to the BGP protocol instances, but flowtab4 table is only UP as a channel for static1 protocol, while for bgp_svc01/02 is not (hence, no FS routes advertised BGP-side): bird> show protocol all static1 Name Proto Table State Since Info static1 Static flowtab4 up 13:02:42.987 Channel flow4 State: UP ================== Table: flowtab4 Preference: 200 Input filter: ACCEPT Output filter: ACCEPT Routes: 1 imported, 0 exported, 1 preferred Route change stats: received rejected filtered ignored accepted Import updates: 1 0 0 0 1 Import withdraws: 0 0 --- 0 0 Export updates: 0 0 0 --- 0 Export withdraws: 0 --- --- --- 0 bird> show protocol all bgp_svc01 Name Proto Table State Since Info bgp_svc01 BGP --- up 13:00:17.256 Established BGP state: Established Neighbor address: y.y.y.y Neighbor AS: ABCDE Local AS: ABCDG Neighbor ID: whateverID Local capabilities Neighbor capabilities Session: external Source address: x.x.x.x Hold timer: 4.820/9 Keepalive timer: 2.054/3 Channel flow4 State: DOWN ==================== Table: flowtab4 Preference: 100 Input filter: ACCEPT Output filter: ACCEPT Channel ipv4 State: UP Table: master4 Preference: 100 Input filter: ACCEPT Output filter: ACCEPT Routes: 13 imported, 2 exported, 13 preferred Route change stats: received rejected filtered ignored accepted [...] BGP Next hop: x.x.x.x Looking forward to get some clarifications. Thank you. Kind regards, Davide Pucci.

2 1