January 2020 - Bird-users

Purpose of 'generate from/to' and 'accept from/to' for passwords?
by Toke Høiland-Jørgensen 20 Jan '20

20 Jan '20

Hi Bird people When specifying passwords for protocol authentication in the Bird config, it is possible to specify time windows in which the password will be used to sign messages (the 'generate from/to' configuration options), and a separate time window in which that password will be accepted to authenticate a packet (the 'accept from/to' options). My question is this: What is the purpose of having these two time intervals be separate? I.e., in what deployment scenario is it useful to have a password be accepted to authenticate a message, without also using that password to sign outgoing messages? This question came out of a discussion around whether we should standardise a similar feature in the Babel RFCs. As you can see I'm struggling a little to come up with a definite use case: https://mailarchive.ietf.org/arch/msg/babel/XOahz4fuXXs-nHO4NMGdBwU8AZo -Toke

2 1

BFD getting stuck in Init state when taking down and up the interface
by Julian Schuh 20 Jan '20

20 Jan '20

Hi all, I think I discovered a bug causing BFD sessions to get stuck in the Init state when taking down and up the interface that is being for the BFD session. I'm using bird 2.0.7 on linux 4.19.86. My setup: I have to network namespaces t1 and t2, connected by a veth pair: ip -n t1 addr show > 99: t2_1@if100: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 > link/ether fa:e1:52:51:62:a3 brd ff:ff:ff:ff:ff:ff link-netns t2 > inet6 2001:db8:1::1/64 scope global > valid_lft forever preferred_lft forever > inet6 fe80::f8e1:52ff:fe51:62a3/64 scope link > valid_lft forever preferred_lft forever ip -n t2 addr show > 100: t1_1@if99: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 > link/ether b2:0e:f4:60:1b:08 brd ff:ff:ff:ff:ff:ff link-netns t1 > inet6 2001:db8:1::2/64 scope global > valid_lft forever preferred_lft forever > inet6 fe80::b00e:f4ff:fe60:1b08/64 scope link > valid_lft forever preferred_lft forever The bird config on both sides is almost identical: t1: > protocol device { > debug all; > scan time 10; > } > > router id 1.1.1.1; > > protocol bfd { > debug all; > interface "*" { > min rx interval 50 ms; > min tx interval 100 ms; > idle tx interval 300 ms; > > }; > neighbor 2001:db8:1::2 dev "t2_1" local 2001:db8:1::1; > } t2: > protocol device { > debug all; > scan time 10; > } > > router id 2.2.2.2; > > protocol bfd { > debug all; > interface "*" { > min rx interval 50 ms; > min tx interval 100 ms; > idle tx interval 300 ms; > > }; > neighbor 2001:db8:1::1 dev "t1_1" local 2001:db8:1::2; > } When starting up bird on both sides, the BFD session comes up just as expected. When taking down the interface t1_1 in netns t2 (ip -n t2 link set down dev t1_1), I see the following log message: > bfd1: Session to 2001:db8:1::1 removed Now, when taking up the interface instantly, I get the following log message, the BFD session gets stuck in the Init state and does not recover: > bfd1: Socket error: bind: Cannot assign requested address > bfd1: Session to 2001:db8:1::1 added When I take down the interface and wait for a subsequent device scan (indicated by log message "device1: Scanning interfaces") and only take up the interface after the device scan is carried out, all works fine: >>>> bfd1: Session to 2001:db8:1::1 removed >>>> device1: Scanning interfaces >>>> bfd1: Session to 2001:db8:1::1 added When leaving out the "scan time" statement in the device protocol configuration, it doesn't seem to recover at all (probably, as the documentation states, a large value is used for the scan time by default). Thanks in advance for your feedback. Best Regards Julian Schuh

2 1

Re: Bird exporter
by Irene Lalioti 16 Jan '20

16 Jan '20

Hello Tim, Thanks for your answer. Initially I did not use go to install it. Maybe this is the problem, I guess. My question is how you run it? you just have to run bird or ? In which port is the web server available? 6502? I have installed the bird watcher as well which is python. Do I need the golang necessarily ? So far I get connection refused when I try |wget https://dl.google.com/go/go1.13.4.linux-amd64.tar.gz| | | |Thanks a lot! Irene | || On 1/14/20 11:52 PM, Tim Meusel wrote: > Hi Irene, > > I use the bird exporter, but I'm not sure if I understood your question. > The only thing I needed to configure in the config tog work was the > timeformat setting you already mentioned. Also the three metrics you > posted look correct? > > Cheers, Tim > > On 13.01.20 14:37, Irene Lalioti wrote: >> Hello guys! >> >> I would like to ask you, if anyone of you has deployed bird_exporter for >> Prometheus metrics to Grafana dashboard? >> >> https://github.com/czerwonk/bird_exporter >> >> I have setup Grafana dashboards to visualize the metrics Prometheus >> collects. I have imported the Dashboard for the bird from github. >> >> Now I am not sure how to orchestrate the bird_exporter into the bird >> config, other than : >> >> 1. timeformat protocol iso long; >> >> 2. >> bird_protocol_prefix_import_count{name="bgp1",proto="BGP",ip_version="4"} >> 600000 >> bird_protocol_prefix_import_count{name="bgp1",proto="BGP",ip_version="6"} >> 50000 >> bird_ospfv3_running{name="ospf1"} 1 >> >> >> as instructed in the doc. >> >> My bird is 2.0.7. >> >> >> thanks a lot in advance! >> >> Irene >> >> || >> >> || >> >> || >> >> || >> >> || >> -- Irene Lalioti Network Engineer Fondation RESTENA 2, avenue de l'Université L-4365 Esch/Alzette Tel: +352 424409 1 Fax: +352 422473

1 0

Static route preference incorrect for value 0
by Kenth Eriksson 15 Jan '20

15 Jan '20

When setting preference value of zero on a static route, then this gets shown as preference 200 when doing show route. Preference on static routes is based on a patch from Ondrej with SHA 7a49e97e7ec86bd336dc801411cb8b8f92f38388, but it looks as this has still not made into master. kenth ~ # cat /opt/appl/executing/etc/bird_route.conf protocol static static1 { ipv4 {import all;}; check link 1; route 0.0.0.0/0 via 10.210.137.1 {preference=0;}; } bird> show route Table master4: 0.0.0.0/0 unicast [static1 12:27:07.093] (200) via 10.210.137.1 on eth1 Setting preference to a value >= 1 makes this work correct. /k

2 2

bird conf 1.6 to 2.0
by Mario Rossi 14 Jan '20

14 Jan '20

Hi Bird users, I am trying to migrate the config from 1.6 to 2.0 on CentOS 8. I tried to follow https://gitlab.labs.nic.cz/labs/bird/wikis/transition-notes-to-bird-2 but my test config didn't work. Is there another guide or wiki I can follow to be able to migrate to version 2 ? Thank you ! [...] router id 206.x.y.z; table as65533; table blackholes; [...] # Scans and learns of blackhole routes from table 10, every 10 seconds protocol kernel rtbh { table blackholes; kernel table 10; scan time 20; learn; import filter rtbh_pipe; export all; } # Merges kernel route table 10 into the virtual as65533 routing table protocol pipe { table as65533; peer table blackholes; mode transparent; import filter rtbh_pipe; } protocol bgp ege1a_50_4 { table as65533; description "ege1a_50_4"; local as 65533; neighbor 1.1.1.1 as 12345; multihop; source address 206.x.y.z; # What local address we use for the TCP connection export where source=RTS_STATIC; export filter bgp_out_upstream; }

3 5

bird 2.0.7 crashes with OSPF
by Nico Schottelius 14 Jan '20

14 Jan '20

Hello, continuing my travel now with OSPF, we have found two cases to crash bird via birdc: bird> show ospf topology all ospf_v4 Connection closed by server [00:50] replacement-router1.place5:~# ps aux | grep bird 14220 root 0:00 grep bird bird> show ospf state ospf_v4 Connection closed by server [23:44] router1.place6:~# birdc Unable to connect to server control socket (/var/run/bird.ctl): Connection refused The config leading to this is attached below. Best regards, Nico p.s.: In the documentation for the "instance id" it says "Default value is 0 unless OSPFv3-AF extended address families are used, see RFC 5838 for that case." And further above it says that RFC5838 is enabled by default. However shouldn't it be 64 in case of an ipv4 channel in ospf according to rfc5838? protocol ospf v3 ospf_v6 { instance id 0; ipv6 { import all; export all; }; area 0 { interface "bond0.8" { cost 5; hello 5; retransmit 2; wait 10; dead 20; }; }; } protocol ospf v3 ospf_v4 { instance id 64; ipv4 { import all; export all; }; area 0 { interface "bond0.8" { cost 5; hello 5; retransmit 2; wait 10; dead 20; }; }; } -- Modern, affordable, Swiss Virtual Machines. Visit www.datacenterlight.ch

4 5

crash in ospf lsupd/dbdes (only if authentication enabled?)
by Kenth Eriksson 14 Jan '20

14 Jan '20

We have seen a bird crash due to memory corruption. The call stacks shows that it can happen at different locations, but they all seem to come from that the packet size becomes larger than the socket tx buffer size. Before the crash happens, the following trace can be observed in the log; 2020-01-08 11:06:52.584 <DBG> Assertion '*plen < ifa->sk->tbsize' failed at /usr/local/src/tm3000/ext/bird/proto/ospf/packet.c:97 Debugging shows that *plen is 1504 (after adding auth_len of 32 bytes). The tbsize is set to 1492 which corresponds to the MTU size. The procedure ospf_pkt_maxsize does not take account for authentication, is that correct? valgrind evidence of issue; ==3272== Invalid write of size 4 ==3272== at 0xFFB8594: memcpy (in /usr/lib/valgrind/vgpreload_memcheck-ppc32-linux.so) ==3272== by 0x10015F6F: ??? (in /opt/appl/cuappl04a-r34a-39/sbin/bird) ==3272== by 0x10039B87: ??? (in /opt/appl/cuappl04a-r34a-39/sbin/bird) ==3272== by 0x1002E813: ??? (in /opt/appl/cuappl04a-r34a-39/sbin/bird) ==3272== by 0x1003978F: ??? (in /opt/appl/cuappl04a-r34a-39/sbin/bird) ==3272== by 0x10046963: ??? (in /opt/appl/cuappl04a-r34a-39/sbin/bird) ==3272== by 0x100473B7: ??? (in /opt/appl/cuappl04a-r34a-39/sbin/bird) ==3272== by 0x1000245F: ??? (in /opt/appl/cuappl04a-r34a-39/sbin/bird) (gdb) list *0x1002E813 0x1002e813 is in ospf_do_send_dbdes (/usr/local/src/builduser/rc/rel_34_0/ext/bird/proto/ospf/dbdes.c:196). 191 struct ospf_iface *ifa = n->ifa; 192 193 OSPF_PACKET(ospf_dump_dbdes, n->ldd_buffer, 194 "DBDES packet sent to nbr %R on %s", n->rid, ifa->ifname); 195 sk_set_tbuf(ifa->sk, n->ldd_buffer); 196 ospf_send_to(ifa, n->ip); 197 sk_set_tbuf(ifa->sk, NULL); 198 } 199 200 /** (gdb) list *0x10039B87 0x10039b87 is in ospf_send_to (/usr/local/src/builduser/rc/rel_34_0/ext/bird/proto/ospf/packet.c:110). 105 if (pass->alg < ALG_HMAC) 106 strncpy(auth_tail, pass->password, auth_len); 107 else 108 memset32(auth_tail, HMAC_MAGIC, auth_len / 4); 109 110 mac_fill(pass->alg, pass->password, pass->length, (byte *) pkt, *plen, auth_tail); 111 break; 112 113 default: 114 bug("Unknown authentication type"); (gdb) list *0x10015F6F 0x10015f6f is in mac_fill (/usr/local/src/builduser/rc/rel_34_0/ext/bird/lib/mac.h:112). 107 108 static inline void mac_update(struct mac_context *ctx, const byte *data, uint datalen) 109 { ctx->type->update(ctx, data, datalen); } 110 111 static inline byte *mac_final(struct mac_context *ctx) 112 { return ctx->type->final(ctx); } 113 114 static inline void mac_cleanup(struct mac_context *ctx) 115 { memset(ctx, 0, ctx->type->ctx_length); } 116 (gdb) ASAN evidence of the crash; ================================================================= ==3202==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xb4105a64 at pc 0x38630004 bp 0xbf958200 sp 0xbf958218 WRITE of size 4 at 0xb4105a64 thread T0 #0 0x38630000 (+0x10630000) #1 0xfb2aa10 in __asan_report_error (/usr/lib/gcc/powerpc-unknown-linux-gnu/4.9.3/libasan.so.1+0x65a10) #2 0xfb2bd70 in __asan_report_store4 (/usr/lib/gcc/powerpc-unknown-linux-gnu/4.9.3/libasan.so.1+0x66d70) #3 0x100d26d0 in ospf_send_to (/opt/appl/cuappl04a-r34a-39/sbin/bird+0x100d26d0) 0xb4105a64 is located 0 bytes to the right of 1508-byte region [0xb4105480,0xb4105a64) allocated by thread T0 here: #0 0x10060ab4 in bird_xmalloc (/opt/appl/cuappl04a-r34a-39/sbin/bird+0x10060ab4) SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 ?? Shadow bytes around the buggy address: 0x36820af0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x36820b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x36820b10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x36820b20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x36820b30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x36820b40: 00 00 00 00 00 00 00 00 00 00 00 00[04]fa fa fa 0x36820b50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x36820b60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x36820b70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x36820b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x36820b90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Contiguous container OOB:fc ASan internal: fe ==3202==ABORTING

3 7

Bird exporter
by Irene Lalioti 13 Jan '20

13 Jan '20

Hello guys! I would like to ask you, if anyone of you has deployed bird_exporter for Prometheus metrics to Grafana dashboard? https://github.com/czerwonk/bird_exporter I have setup Grafana dashboards to visualize the metrics Prometheus collects. I have imported the Dashboard for the bird from github. Now I am not sure how to orchestrate the bird_exporter into the bird config, other than : 1. timeformat protocol iso long; 2. bird_protocol_prefix_import_count{name="bgp1",proto="BGP",ip_version="4"} 600000 bird_protocol_prefix_import_count{name="bgp1",proto="BGP",ip_version="6"} 50000 bird_ospfv3_running{name="ospf1"} 1 as instructed in the doc. My bird is 2.0.7. thanks a lot in advance! Irene || || || || || -- Irene Lalioti Network Engineer Fondation RESTENA 2, avenue de l'Université L-4365 Esch/Alzette Tel: +352 424409 1 Fax: +352 422473

1 0

RPKI doesn’t work with a FQDN
by Alarig Le Lay 11 Jan '20

11 Jan '20

Hi, I have this configuration: asbr02 ~ # cat /etc/bird.conf.d/protocol_rpki/* protocol rpki rpki_alarig { roa4 { table r4; }; roa6 { table r6; }; #remote "msi.no.swordarmor.fr"; remote 2a0e:f42::1; } protocol rpki rpki_conan { roa4 { table r4; }; roa6 { table r6; }; remote "conan.grifon.fr"; } The first protocol establish with the second fails bird> show protocols all rpki_alarig Name Proto Table State Since Info rpki_alarig RPKI --- up 15:54:25.902 Established Cache server: 2a0e:f42::1:323 Status: Established Transport: Unprotected over TCP Protocol version: 1 Session ID: 28569 Serial number: 285 Last update: before 84.055 s Refresh timer : 323.944/408 Retry timer : --- Expire timer : 7115.944/7200 Channel roa4 State: UP Table: r4 Preference: 100 Input filter: ACCEPT Output filter: REJECT Routes: 100516 imported, 0 exported, 100516 preferred Route change stats: received rejected filtered ignored accepted Import updates: 100816 0 0 0 100816 Import withdraws: 300 0 --- 0 300 Export updates: 0 0 0 --- 0 Export withdraws: 0 --- --- --- 0 Channel roa6 State: UP Table: r6 Preference: 100 Input filter: ACCEPT Output filter: REJECT Routes: 16578 imported, 0 exported, 16578 preferred Route change stats: received rejected filtered ignored accepted Import updates: 16641 0 0 0 16641 Import withdraws: 63 0 --- 0 63 Export updates: 0 0 0 --- 0 Export withdraws: 0 --- --- --- 0 bird> show protocols all rpki_conan Name Proto Table State Since Info rpki_conan RPKI --- start 15:54:25.847 Transport-Error Cache server: conan.grifon.fr:323 Status: Transport-Error Transport: Unprotected over TCP Protocol version: 1 Session ID: --- Serial number: --- Last update: --- Refresh timer : --- Retry timer : 451.669/600 Expire timer : --- Channel roa4 State: DOWN Table: r4 Preference: 100 Input filter: ACCEPT Output filter: REJECT Channel roa6 State: DOWN Table: r6 Preference: 100 Input filter: ACCEPT Output filter: REJECT I see the DNS request (and the answer): 15:54:25.851095 IP6 asbr02.cogent-rns.grifon.fr.35411 > drogon.grifon.fr.domain: 167+ A? conan.grifon.fr. (33) 15:54:25.851105 IP6 asbr02.cogent-rns.grifon.fr.35411 > drogon.grifon.fr.domain: 14516+ AAAA? conan.grifon.fr. (33) 15:54:25.851495 IP6 drogon.grifon.fr.domain > asbr02.cogent-rns.grifon.fr.35411: 167 1/0/0 A 89.234.186.8 (49) 15:54:25.851515 IP6 drogon.grifon.fr.domain > asbr02.cogent-rns.grifon.fr.35411: 14516 1/0/0 AAAA 2a00:5884::8 (61) But no SYN over 323. However, I can telnet to it: asbr02 ~ # mtr -bzwe msi.no.swordarmor.fr Start: Sat Jan 11 15:55:59 2020 HOST: asbr02.cogent-rns.grifon.fr Loss% Snt Last Avg Best Wrst StDev 1. AS204092 regis.swordarmor.fr (2a00:5884::1f) 0.0% 10 0.2 0.2 0.1 0.3 0.0 2. AS208627 tinc0.core02-arendal.no.swordarmor.fr (2a0e:f42:fffe::6) 0.0% 10 51.5 51.7 51.2 52.2 0.0 3. AS208627 msi.no.swordarmor.fr (2a0e:f42::1) 0.0% 10 52.0 52.3 51.4 52.8 0.0 asbr02 ~ # mtr -bzwe conan.grifon.fr Start: Sat Jan 11 15:57:47 2020 HOST: asbr02.cogent-rns.grifon.fr Loss% Snt Last Avg Best Wrst StDev 1. AS204092 conan.grifon.fr (2a00:5884::8) 0.0% 10 0.3 0.3 0.2 0.5 0.0 asbr02 ~ # telnet msi.no.swordarmor.fr 323 Trying 2a0e:f42::1... Connected to msi.no.swordarmor.fr. Escape character is '^]'. ^] telnet> quit Connection closed. asbr02 ~ # telnet conan.grifon.fr 323 Trying 2a00:5884::8... Connected to conan.grifon.fr. Escape character is '^]'. ^] telnet> quit Connection closed. And then I see the SYN: 16:01:28.787297 IP6 asbr02.cogent-rns.grifon.fr.60330 > conan.grifon.fr.323: Flags [S], seq 1340260165, win 28800, options [mss 1440,sackOK,TS val 4034128416 ecr 0,nop,wscale 7], le ngth 0 16:01:28.787677 IP6 conan.grifon.fr.323 > asbr02.cogent-rns.grifon.fr.60330: Flags [S.], seq 287295091, ack 1340260166, win 64260, options [mss 1440,sackOK,TS val 4292064010 ecr 403 4128416,nop,wscale 7], length 0 16:01:28.787713 IP6 asbr02.cogent-rns.grifon.fr.60330 > conan.grifon.fr.323: Flags [.], ack 1, win 225, options [nop,nop,TS val 4034128416 ecr 4292064010], length 0 16:01:31.114241 IP6 asbr02.cogent-rns.grifon.fr.60330 > conan.grifon.fr.323: Flags [F.], seq 1, ack 1, win 225, options [nop,nop,TS val 4034130743 ecr 4292064010], length 0 16:01:31.114709 IP6 conan.grifon.fr.323 > asbr02.cogent-rns.grifon.fr.60330: Flags [F.], seq 1, ack 2, win 503, options [nop,nop,TS val 4292066337 ecr 4034130743], length 0 16:01:31.114725 IP6 asbr02.cogent-rns.grifon.fr.60330 > conan.grifon.fr.323: Flags [.], ack 2, win 225, options [nop,nop,TS val 4034130743 ecr 4292066337], length 0 The first protocol only established when I put the IP address directly. Plus, not having the brackets over the literal IPv6 address is a bit confusing. The IP isn’t 2a0e:f42::1:323. Regards, -- Alarig

2 2

Multi thread support
by Marcelo Balbinot 10 Jan '20

10 Jan '20

Hello, About multi thread support (cpu multi-core use) is it in the roadmap? thanks -- Marcelo Balbinot IP/MPLS Backbone Manager at AS53062 G G NET Telecomunicações www.gegnet.com.br INOC 53062*100

2 1