November 2020 - Bird-users

Direct routes and OSPF
by Alasdair Muckart 01 Dec '20

01 Dec '20

I've got a question about importing direct routes and interaction with BGP & OSPF. We have an issue with BIRD (1.6.3) when we do a 'configure soft' we end up with linknet routes being learned via indirect paths over OSPF which breaks BFD and BGP. It only happens with IPv6, not IPv4. Given routers A, B, C and D: A----B | | C----D Doing a 'birdc6 configure soft' on router A will sometimes end up with the linknet for A-C being put in the kernel table by OSPF learned from B. Not all interfaces are part of OSPF and I'm wondering if importing direct routes into BIRD for all interfaces would stop OSPF from trying to insert the routes into the kernel table? Any ideas would be greatly appreciated. Thanks. -- Alasdair Muckart (he/him) Network Engineer Catalyst IT - Expert Open Source Solutions Mobile: +64 22 638 5141 | DDI: +64 4 897 7794 | www.catalyst.net.nz CONFIDENTIALITY NOTICE: This email is intended for the named recipients only. It may contain privileged, confidential or copyright information. If you are not the named recipient, any use, reliance upon, disclosure or copying of this email or its attachments is unauthorised. If you have received this email in error, please reply via email or call +64 4 499 2267.

2 1

ospf stub interfaces appears as two entries in routing table (direct + ospf)
by Kenth Eriksson 01 Dec '20

01 Dec '20

If I configure an OSPF interface as a stub interface, why does it appear twice the routing table? E.g. setting interface lo as stub interface results in the following; 10.210.137.78/32 unicast [direct1 15:59:09.550] * (255) dev lo unicast [ospfv2_1 20:47:56.864] I (145/0) [10.210.137.78] dev lo The source OSPF-I misleads me in thinking that it was learned from the OSPF area.

2 1

RPKI validation troubles
by Julien Sansonnens 27 Nov '20

27 Nov '20

Hi everybody, I'm using bird 2.0.7 and experience some troubles with RPKI validation. here is my config (relevant parts only): roa6 table r6; protocol rpki validator { roa6 { table r6; }; remote "XXXXXX" port 8282; } protocol bgp XXXX{ ipv6 { import keep filtered; import filter { if ( roa_check( r6, net, bgp_path.last ) = ROA_INVALID ) then { reject; } else ....... I know that ROA support is still incomplete in BIRD. So I specified a connection delay for my BGP peers to wait for the r6 table to be filled. I thought my filter was working fine, and this morning I noticed that there were some invalid routes in my table. However, the status of these routes does not vary, they have not changed from valid to invalid, they have been invalid for years. It's not their status that has changed, it's my filters that suddenly don't work anymore (on some pairs only). Have you ever had this problem ? So, I take advantage of asking if the next version of BIRD will include more complete ROA support? cheers, julien

1 0

[PATCH v3 0/7] Add MAC authentication support to the Babel protocol
by Toke Høiland-Jørgensen 26 Nov '20

26 Nov '20

This series adds MAC authentication support to the Babel protocol as specified in by the IETF Babel working group in draft-babel-hmac-10: https://tools.ietf.org/html/draft-ietf-babel-hmac-10 I have performed basic interoperability testing between this implementation and the current babeld HMAC implementation[1]. The two implementations were able to successfully exchange authenticated messages with both HMAC-256 and Blake2s-256 keys. Given the above, and the close-to-final state of the specification at the IETF, I believe this series is ready for merging (subject to review, of course). For those wanting to test the code, a version of Bird with this series applied is available on Github[2] for easy consumption. [1] https://github.com/jech/babeld/pull/52 [2] https://github.com/tohojo/bird/tree/babel-mac-03 Changelog: v3: - Add variants with smaller digest sizes for blake2s and blake2b. - Rebase on current master v2: - Don't reinvent AC_CHECK_FUNCS() for configure - Make sure random_bytes() never fails (without taking the whole daemon with it) - Use existing endianness defines in blake2s code - Just leave MAC-related code in babel.c/packets.c instead of adding a new file - Add blake2s test vectors (new patch 3) - Support supplying mac keys as raw hexadecimal bytes and allow algorithms to validate keys on configure (new patches 4-5) v1: - Add wrapper function to bird sysdep code to pick a suitable source of random bytes - Import reference Blake2 implementations into lib/ - Rename function names and data structures to use an auth_ prefix instead of hmac_ - Perform a separate authentication pass before parsing the packet, and move the authentication-related code to its own source file - Enforce key length recommendation from the specification - Add a 'permissive' configuration mode where outgoing packets are signed but incoming packets are accepted even though they fail authentication - Add user documentation for the authentication configuration, and function docstrings to the main authentication functions - Fix a bunch of nits and code style issues --- Toke Høiland-Jørgensen (7): sysdep: Add wrapper to get random bytes nest: Add Blake2s and Blake2b hash functions mac_test: Add tests for blake2s and blake2b nest: Allow specifying security keys as hex bytes as well as strings config: Allow MAC algorithms to specify a function to validate their keys babel: Refactor TLV parsing code for easier reuse babel: Add MAC authentication support conf/cf-lex.l | 31 + conf/conf.h | 5 + conf/confbase.Y | 2 + doc/bird.sgml | 47 +- lib/Makefile | 2 +- lib/blake2-impl.h | 160 ++ lib/blake2-kat.h | 4111 +++++++++++++++++++++++++++++++++++++++++ lib/blake2-ref.h | 112 ++ lib/blake2.c | 48 + lib/blake2.h | 67 + lib/blake2b-ref.c | 270 +++ lib/blake2s-ref.c | 263 +++ lib/mac.c | 31 +- lib/mac.h | 14 + lib/mac_test.c | 91 + lib/string.h | 1 + lib/strtoul.c | 27 + nest/config.Y | 54 +- nest/password.c | 6 + nest/password.h | 1 + proto/babel/Makefile | 2 +- proto/babel/babel.c | 156 +- proto/babel/babel.h | 66 +- proto/babel/config.Y | 46 +- proto/babel/packets.c | 661 ++++++- 25 files changed, 6161 insertions(+), 113 deletions(-) create mode 100644 lib/blake2-impl.h create mode 100644 lib/blake2-kat.h create mode 100644 lib/blake2-ref.h create mode 100644 lib/blake2.c create mode 100644 lib/blake2.h create mode 100644 lib/blake2b-ref.c create mode 100644 lib/blake2s-ref.c

2 9

Passive BGP configuration
by Robert Scheck 26 Nov '20

26 Nov '20

Hello, where is my mistake? Static routing between 2001:db8:1::/64 and 2001:db8:1:a::/64 (configured outside of BIRD) works. # r1 (2001:db8:1::1/64) protocol bgp r2 { local as 4200000000; neighbor range 2001:db8:1::/50 as 4200000001; # Never comes up # neighbor 2001:db8:1:a::1 as 4200000001; # Just works... source address 2001:db8:1::1; multihop 2; } # r2 (2001:db8:1:a::1/64) protocol bgp r1 { local as 4200000001; neighbor 2001:db8:1::1 as 4200000000; multihop 2; } Both systems are BIRD 2.0.7. Regards, Robert

2 3

[PATCH] more list node initialisation
by Andreas Rammhold 25 Nov '20

25 Nov '20

Hi, In addition to those list node initialisation patches that went into master so far I still have these two commits in my local tree. One of them is about the logging configuration that I described in my initial email on the topic. The other patch is about new memory buckets in the BGP implementation. I am still hunting another variant of this that crashes BIRD (with --enable-debug) whenever a Babel peer is shutting down.. andi-

3 4

Derive OSPF stub network configuration from interface?
by Kenth Eriksson 25 Nov '20

25 Nov '20

Is it possible to configure OSPF stub network by giving the interface as parameter instead of the prefix? E.g. current syntax is area { stubnet prefix; } But can it be stated as interface instead of prefix so that if the interface address changes I don't need to update my configuration file?

2 2

[PATCH v3 1/7] sysdep: Add wrapper to get random bytes
by Toke Høiland-Jørgensen 24 Nov '20

24 Nov '20

From: Toke Høiland-Jørgensen <toke(a)toke.dk> The Babel authentication code added by a subsequent commit needs a way to get random bytes for generating nonces. This patch adds a wrapper function in sysdep to get random bytes, and the required checks in configure.ac to select how to do it. The configure script tries, in order, getrandom(), getentropy() and reading from /dev/urandom. Signed-off-by: Toke Høiland-Jørgensen <toke(a)toke.dk> --- conf/conf.c | 1 + configure.ac | 4 ++ lib/birdlib.h | 3 ++ sysdep/unix/main.c | 1 + sysdep/unix/random.c | 88 ++++++++++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 97 insertions(+) diff --git a/conf/conf.c b/conf/conf.c index 6f64b5416..5f20f6ed5 100644 --- a/conf/conf.c +++ b/conf/conf.c @@ -515,6 +515,7 @@ order_shutdown(int gr) c->gr_down = gr; config_commit(c, RECONFIG_HARD, 0); + random_close(); shutting_down = 1; } diff --git a/configure.ac b/configure.ac index eabb3d562..d27bb327b 100644 --- a/configure.ac +++ b/configure.ac @@ -373,6 +373,10 @@ elif test "$bird_cv_lib_log" != yes ; then LIBS="$LIBS $bird_cv_lib_log" fi +AC_CHECK_FUNCS(getrandom) +AC_CHECK_FUNCS(getentropy) +AC_CHECK_HEADERS(sys/random.h) + if test "$enable_debug" = yes ; then AC_DEFINE([DEBUGGING], [1], [Define to 1 if debugging is enabled]) LDFLAGS="$LDFLAGS -rdynamic" diff --git a/lib/birdlib.h b/lib/birdlib.h index 23036c1b1..61098f929 100644 --- a/lib/birdlib.h +++ b/lib/birdlib.h @@ -192,5 +192,8 @@ asm( /* Pseudorandom numbers */ u32 random_u32(void); +int random_bytes(char *buf, size_t size); +void random_close(void); +void random_init(void); #endif diff --git a/sysdep/unix/main.c b/sysdep/unix/main.c index 2c7e3ceff..3903ecccb 100644 --- a/sysdep/unix/main.c +++ b/sysdep/unix/main.c @@ -851,6 +851,7 @@ main(int argc, char **argv) parse_args(argc, argv); log_switch(1, NULL, NULL); + random_init(); net_init(); resource_init(); timer_init(); diff --git a/sysdep/unix/random.c b/sysdep/unix/random.c index b1f5086fe..de81f3ca2 100644 --- a/sysdep/unix/random.c +++ b/sysdep/unix/random.c @@ -7,6 +7,21 @@ */ #include <stdlib.h> +#include <fcntl.h> +#include <unistd.h> +#include <errno.h> + +#include "sysdep/config.h" + +#ifdef HAVE_SYS_STAT_H +# include <sys/stat.h> +#endif +#ifdef HAVE_LINUX_RANDOM_H +# include <linux/random.h> +#endif +#if defined(HAVE_SYS_RANDOM_H) && (defined(HAVE_GETRANDOM) || defined(HAVE_GETENTROPY)) +# include <sys/random.h> +#endif #include "nest/bird.h" @@ -19,3 +34,76 @@ random_u32(void) rand_high = random(); return (rand_low & 0xffff) | ((rand_high & 0xffff) << 16); } + +void +random_init() +{ + char buf; + /* get a single random byte to trip any errors early */ + random_bytes(&buf, sizeof(buf)); +} + +#if defined(HAVE_GETRANDOM) || defined(HAVE_GENTROPY) +int +random_bytes(char *buf, size_t size) +{ + int n; + int flags = 0; + while (0 < size) { +#if defined(HAVE_GETRANDOM) + n = getrandom(buf, size, flags); +#else + n = getentropy(buf, size); +#endif + if (n < 0) { + if (errno == EINTR) + continue; + die("Couldn't get random bytes: %m"); + } + buf += n; + size -= n; + } + + return 0; +} + +void random_close(void) {} + +#else + +static int urandom_fd = -1; +int random_bytes(char *buf, size_t size) +{ + int n; + + if (urandom_fd < 0) + { + urandom_fd = open("/dev/urandom", O_RDONLY); + if (urandom_fd < 0) + die("Couldn't open /dev/urandom: %m"); + } + + do + { + n = read(urandom_fd, buf, size); + if (n <= 0) { + if (errno == EINTR) + continue; + die("Couldn't read from /dev/urandom: %m"); + } + buf += n; + size -= n; + } while (size > 0); + + return 0; +} + +void +random_close(void) +{ + if (urandom_fd >= 0) { + close(urandom_fd); + urandom_fd = -1; + } +} +#endif

1 0

[PATCH v2] lib/slab: introduce sl_allocz() function and use it in Babel
by Toke Høiland-Jørgensen 24 Nov '20

24 Nov '20

The babel protocol code was initialising objects returned from the slab allocator by assigning to each of the struct members individually, but wasn't touching the NODE member while doing so. This leads to warnings on debug builds since commit: baac7009063d ("List expensive check.") To fix this, introduce an sl_allocz() variant of the slab allocator which will zero out the memory before returning it, and switch all the babel call sites to use this version. The overhead for doing this should be negligible for small objects, and in the case of babel, the largest object being allocated was being zeroed anyway, so we can drop the memset in babel_read_tlv(). Signed-off-by: Toke Høiland-Jørgensen <toke(a)toke.dk> --- v2: - Introduce sl_allocz() instead of adding more zeroing to the babel code. lib/resource.h | 1 + lib/slab.c | 24 ++++++++++++++++++++++++ proto/babel/babel.c | 7 +++---- proto/babel/packets.c | 7 +++---- 4 files changed, 31 insertions(+), 8 deletions(-) diff --git a/lib/resource.h b/lib/resource.h index ad17d9ed4..b56bcff55 100644 --- a/lib/resource.h +++ b/lib/resource.h @@ -83,6 +83,7 @@ typedef struct slab slab; slab *sl_new(pool *, unsigned size); void *sl_alloc(slab *); +void *sl_allocz(slab *); void sl_free(slab *, void *); /* diff --git a/lib/slab.c b/lib/slab.c index c3035b45b..f31355e02 100644 --- a/lib/slab.c +++ b/lib/slab.c @@ -88,6 +88,14 @@ sl_alloc(slab *s) return o->data; } +void * +sl_allocz(slab *s) +{ + void *obj = sl_alloc(s); + memset(obj, 0, s->size); + return obj; +} + void sl_free(slab *s, void *oo) { @@ -278,6 +286,22 @@ no_partial: goto okay; } +/** + * sl_allocz - allocate an object from Slab and zero it + * @s: slab + * + * sl_allocz() allocates space for a single object from the + * Slab and returns a pointer to the object after zeroing out + * the object memory. + */ +void * +sl_allocz(slab *s) +{ + void *obj = sl_alloc(s); + memset(obj, 0, s->data_size); + return obj; +} + /** * sl_free - return a free object back to a Slab * @s: slab diff --git a/proto/babel/babel.c b/proto/babel/babel.c index 618abaa8a..4b6b9d7f9 100644 --- a/proto/babel/babel.c +++ b/proto/babel/babel.c @@ -113,7 +113,7 @@ babel_get_source(struct babel_proto *p, struct babel_entry *e, u64 router_id) if (s) return s; - s = sl_alloc(p->source_slab); + s = sl_allocz(p->source_slab); s->router_id = router_id; s->expires = current_time() + BABEL_GARBAGE_INTERVAL; s->seqno = 0; @@ -159,8 +159,7 @@ babel_get_route(struct babel_proto *p, struct babel_entry *e, struct babel_neigh if (r) return r; - r = sl_alloc(p->route_slab); - memset(r, 0, sizeof(*r)); + r = sl_allocz(p->route_slab); r->e = e; r->neigh = nbr; @@ -323,7 +322,7 @@ babel_add_seqno_request(struct babel_proto *p, struct babel_entry *e, } /* No entries found */ - sr = sl_alloc(p->seqno_slab); + sr = sl_allocz(p->seqno_slab); found: sr->router_id = router_id; diff --git a/proto/babel/packets.c b/proto/babel/packets.c index d4ecf649d..e135866f4 100644 --- a/proto/babel/packets.c +++ b/proto/babel/packets.c @@ -1144,7 +1144,6 @@ babel_read_tlv(struct babel_tlv *hdr, return PARSE_ERROR; state->current_tlv_endpos = tlv_data[hdr->type].min_length; - memset(msg, 0, sizeof(*msg)); int res = tlv_data[hdr->type].read_tlv(hdr, msg, state); if (res != PARSE_SUCCESS) @@ -1275,7 +1274,7 @@ void babel_send_unicast(union babel_msg *msg, struct babel_iface *ifa, ip_addr dest) { struct babel_proto *p = ifa->proto; - struct babel_msg_node *msgn = sl_alloc(p->msg_slab); + struct babel_msg_node *msgn = sl_allocz(p->msg_slab); list queue; msgn->msg = *msg; @@ -1304,7 +1303,7 @@ void babel_enqueue(union babel_msg *msg, struct babel_iface *ifa) { struct babel_proto *p = ifa->proto; - struct babel_msg_node *msgn = sl_alloc(p->msg_slab); + struct babel_msg_node *msgn = sl_allocz(p->msg_slab); msgn->msg = *msg; add_tail(&ifa->msg_queue, NODE msgn); babel_kick_queue(ifa); @@ -1386,7 +1385,7 @@ babel_process_packet(struct babel_pkt_header *pkt, int len, break; } - msg = sl_alloc(p->msg_slab); + msg = sl_allocz(p->msg_slab); res = babel_read_tlv(tlv, &msg->msg, &state); if (res == PARSE_SUCCESS) { -- 2.29.2

5 9

[patch]: Uninitialized list nodes
by Mikael 24 Nov '20

24 Nov '20

Hi, I have found two occurrences of uninitialized list nodes in bird's master branch. The following config causes asserts (when built with debugging). # Router ID in IPv4 format router id 62.168.0.1; protocol device { interface "*"; } # Static route feed template static t1 { ipv4 { export all; }; route 10.0.0.0/24 unreachable; } protocol static from t1 { } The attached patches solves the problems. /Mikael

2 1