April 2020 - Bird-users - Mailing Lists

Correct way to advertise network in BIRD 2.x
by Laura Smith 29 Apr '20

29 Apr '20

Hi, I am unfortunatley finding the docs a little terse in terms of lack of real-life examples. I have a simple question, how do I advertise networks to my peers ? I am guessing the syntax below is not correct because I see error messages such as "Apr 27 11:08:53 vpw bird: KRT: Received route 192.0.2.224/28 with strange next-hop 198.51.100.33" in my logs. 2a01:db8:a1d:1e11::1111 / 198.51.100.33 is the IP of the interface facing the upstream BGP peer. protocol static { ipv4; route 192.0.2.224/28 via 198.51.100.33; } protocol static { ipv6; route 2a01:db8:6a66::/48 via 2a01:db8:a1d:1e11::1111; } filter out_filter { if net ~ 2a01:db8:6a66::/48 then accept; if net ~ 192.0.2.224/28 then accept; else reject; } protocol bgp v4n1 { local as 65200; source address 198.51.100.33; neighbor 198.51.100.250 as 64515; med metric on; default bgp_med 0; ipv4 { import all; export filter out_filter; graceful restart on; }; } protocol bgp v6n1 { local as 65200; source address 2a01:db8:a1d:1e11::1111; neighbor 2a01:db8:a1d:1e11::2222 as 64515; med metric on; default bgp_med 0; ipv6 { import all; export filter out_filter; graceful restart on; }; }

3 3

How to fix BGP 'Invalid NEXT_HOP attribute' errors?
by Erik Zscheile 29 Apr '20

29 Apr '20

Hi, I get relatively much "log spam" about one specific BGP session which logs dozens of 'Invalid NEXT_HOP attribute' messages. I haven't found much information online, but have already tried to find out which code path in BIRD produces the message. (The peers all have a BIRD-2.0.7 installation). The following code paths in 'proto/bgp/packets.c:bgp_update_next_hop_ip' are hit: --snip-- /* Forbid zero next hop */ if (ipa_zero(nh[0]) && ((len != 32) || ipa_zero(nh[1]))) WITHDRAW(BAD_NEXT_HOP); /* Forbid next hop equal to neighbor IP */ if (ipa_equal(peer, nh[0]) || ((len == 32) && ipa_equal(peer, nh[1]))) WITHDRAW(BAD_NEXT_HOP); --end snip-- Thus, I already concluded that one source of the error is a 'zeroed' next hop. But I don't really understand what the second check does and why. I found out that sometimes (after some printf-debugging), 'peer' is equal to 'nh[0]', but the second code path isn't always hit when that is the case, but only sometimes. The error only seems to happen if the BGP update message contains a next-hop with the same AF as the 'peer' has. If the peer sends the same BGP message, but via IPv6, and same IPv4 next_hop (which is equal to the peer ll address), the message is (somewhat inconsistent with the other behavior) accepted. The error does only happen if the previous if block 'if (!a || !bgp_use_next_hop(s, a))' is not hit. If it is hit, the next hop is updated to point at the local ll address and the message is accepted. I don't really know how to fix this problem, but I already tried to adjust the config to modify the 'bgp_next_hop' variable or use 'next hop self;' to no avail. Cheers Erik

2 1

Bug? / Patch for BGP next hop issue with frr peers
by Sebastian Hahn 29 Apr '20

29 Apr '20

Hi, let me preface this that I very much do not know what I am doing here, and have been somewhat unsuccessful in trying to understand what's going on by searching online. I would love an explanation though! In a bird 2.0.7 setup, I was unable to import routes from one of my peers. It is the only one using frr (version 6.02-2 on debian), most other peers use bird1 or bird2. I noticed immediately after adding the peering that I received "Invalid NEXT_HOP attribute" errors in the log. Unfortunately, no more information than that was provided in the log, so I went on a little hunt. Since the exact error is raised from many places, I added some logs to identify the GW_DIRECT case in bgp_apply_next_hop() as the culprit. Here I realized that both gw and ll are set, which means a neighbor is tried to be found which doesn't involve the ll case. I then noticed that in bgp_decode_next_hop_ip(), this can only happen if len == 32. This is where I am absolutely clueless what it means for the nh len to be 32, and thus I don't know if the patch I came up with is correct, even though it works for my testing. Only this one peer using frr causes nh len to be set to 32, so I suppose it might be a rare configuration. I added this simple patch: --- bird2-2.0.7.orig/proto/bgp/packets.c +++ bird2-2.0.7/proto/bgp/packets.c @@ -1174,6 +1174,9 @@ bgp_decode_next_hop_ip(struct bgp_parse_ if (ipa_is_ip4(nh[0]) || !ip6_is_link_local(nh[1])) nh[1] = IPA_NONE; + + if (ip6_is_link_local(nh[1])) + nh[0] = IPA_NONE; } else bgp_parse_error(s, 9); ~ which worked for me to resolve the problem. Thanks for any consideration! Cheers Sebastian

4 11

Support for machine-readable status output
by Pascal Mathis 28 Apr '20

28 Apr '20

Hi everyone, I am wondering if the official maintainers would accept patches for introducing machine-readable status output to BIRD. I am asking as there definitely is a clear demand for such a solution, as can be seen by these previous mailing list posts and projects: - https://github.com/mchackorg/birdwatcher (JSON API Server) - https://github.com/inex/birdseye (JSON API Server) - https://github.com/czerwonk/bird_exporter (Prometheus Exporter) - https://www.npmjs.com/package/node-bird-routeparse (JSON Generator) - https://bird.network.cz/pipermail/bird-users/2018-March/012088.html (Previous JSON patch submitted by Alistair Crooks) - https://github.com/sileht/bird-lg (BIRD LG with Python Command Proxy) - https://bird.network.cz/pipermail/bird-users/2017-June/011362.html (Previous mentions of people working on structured output for BIRD) - https://bird.network.cz/pipermail/bird-users/2011-September/002441.html (ML post showing support for JSON output) All the current solutions mentioned above query BIRD by either running the "birdc" executable or directly interacting with the SMTP-like protocol on the socket, followed by applying regular parsing magic to extract the required information. While this certainly works, I think adding some kind of structured/machine-readable output (e.g. JSON) would greatly simplify such integrations in the future and people would no longer have to rely on brittle text parsing which can break on any text formatting changes. Compared to other routing daemons with massive API interfaces (e.g. NETCONF or gRPC), BIRD clearly follows a path of simplicity and robustness, which is probably a reason why a lot of people are relying on it. I personally think that adding a whole API interface for both reading and writing would be overkill, as the configuration can already be easily templated and reliably reloaded. To cut a long story short, I would appreciate if BIRD2 would be able to output various sorts of information in a structured, machine-readable way, e.g. using JSON to print statistics, bgp peers, route lookups and more. This could be implemented by adding a flag for JSON output to existing commands, as adding a full-blown HTTP server directly into BIRD seems like a bad idea. Would such patches be considered for upstreaming or was there ever a decision to not implement this kind of feature? Is maybe someone already working on a feature like this? Thanks in advance for any kind of reply and have a nice day. Best regards, Pascal

4 3

Invalid ROA
by Fabiano D'Agostino 28 Apr '20

28 Apr '20

Hi, how can I check which prefixes are not valid and so rejected? It seems the rpki is working, but I'd like to be sure. I have this: if (roa_check(r4, net, bgp_path.last) = ROA_INVALID) then { print "Ignore RPKI invalid ", net, " for ASN ", bgp_path.last; but I don't understand where the prints go. Thanks, Fabiano

6 14

Bird2 installation failing for debian https://bird.network.cz/?download&tdir=debian/
by Akshay kumar 27 Apr '20

27 Apr '20

Hi all, I am trying to install bird2 from apt as mention in https://bird.network.cz/?download&tdir=debian/ for debian. Its getting failed, seems to be related to apt key is missing, please advise. "W: GPG error: http://bird.network.cz/debian buster InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY B188E2B695BD4743 E: The repository 'http://bird.network.cz/debian buster InRelease' is not signed. N: Updating from such a repository can't be done securely, and is therefore disabled by default. N: See apt-secure(8) manpage for repository creation and user configuration details." Thanks Akshay

2 2

Need to run 'configure' command two times to apply route filter change
by Nasato Goto 27 Apr '20

27 Apr '20

Hi all, I run BIRD v2.0.7 as a route server. When I changed the route filter configuration in BIRD, for example adding prefix entry to a filter, I needed to execute 'configure' command twice to apply new route filter. The first 'configure' command didn't affect. The prefix which I added to filter configuration was kept to be rejected. I could only see '<protocol_name> reconfigured' message in the log file. Then the second 'configure' worked. The prefix was accepted. I saw '<protocol_name>: Sending ROUTE-REFRESH' message in log file. Is this a normal behavior or am I missing something? Best regards, ----- Nasato Goto INTERNET MULTIFEED CO. goto(a)mfeed.ad.jp -----

2 2

Vulnerability? Bug? Missing check after xmalloc() in xstrdup().
by liupeiyu＠zju.edu.cn 27 Apr '20

27 Apr '20

Hi,In lib/string.h line 38,staticinlinechar*xstrdup(constchar*c){size_tl=strlen(c)+1;// xmalloc may fail, and z will be NULL. char*z=xmalloc(l);// write to a NULL pointer, crash. memcpy(z,c,l);returnz;}I think this is a vulnerability, and maybe we can fix it as following:staticinlinechar*xstrdup(constchar*c){size_tl=strlen(c)+1;char*z=xmalloc(l); if(z) { memcpy(z,c,l);returnz; } else return -1;}Thanks for any consideration!Peiyu Liu, NESA lab, Zhejiang University

2 2

"bird -p" creates log file owned by root
by Brian Candler 24 Apr '20

24 Apr '20

Hello, I'm testing out the bird2 2.0.7 package from the PPA under Ubuntu 18.04, and I've found a problem with permissions on log files when run under systemd. I created a directory /var/log/bird/ owned by bird:bird, and configured logging as: log "/var/log/bird/bird.log" all; This works fine when I start bird by hand: root@rs1:/etc/bird# ls -l /var/log/bird total 0 root@rs1:/etc/bird# /usr/sbin/bird -f -u bird -g bird ^C root@rs1:/etc/bird# ls -l /var/log/bird total 4 -rw-r--r-- 1 bird bird 39 Apr 24 11:00 bird.log The problem is that when running under systemd, the log file is created owned by root:root and this causes bird to crash with a permissions error: root@rs1:/etc/bird# rm /var/log/bird/bird.log root@rs1:/etc/bird# systemctl start bird root@rs1:/etc/bird# ls -l /var/log/bird total 0 -rw-r--r-- 1 root root 0 Apr 24 11:03 bird.log root@rs1:/etc/bird# journalctl -eu bird ... Apr 24 11:01:28 rs1 systemd[1]: Starting BIRD Internet Routing Daemon... Apr 24 11:01:28 rs1 systemd[1]: Started BIRD Internet Routing Daemon. Apr 24 11:01:28 rs1 bird[1849]: /etc/bird/bird.conf:9:30 Unable to open log file '/var/log/bird/bird.log': Permission denied Apr 24 11:01:28 rs1 bird[1849]: bird: /etc/bird/bird.conf:9:30 Unable to open log file '/var/log/bird/bird.log': Permission denied Apr 24 11:01:28 rs1 systemd[1]: bird.service: Main process exited, code=exited, status=1/FAILURE Apr 24 11:01:28 rs1 systemd[1]: bird.service: Failed with result 'exit-code'. I found the cause. /lib/systemd/system/bird.service includes the line "ExecStartPre=/usr/sbin/bird -p", and if the log file doesn't exist, it creates it owned by root:root root@rs1:/etc/bird# rm /var/log/bird/bird.log root@rs1:/etc/bird# /usr/sbin/bird -p root@rs1:/etc/bird# ls -l /var/log/bird/bird.log -rw-r--r-- 1 root root 0 Apr 24 11:07 /var/log/bird/bird.log The documentation for the -p flag states: -p Just parse the config file and exit. Return value is zero if the config file is valid, nonzero if there are some errors. So it seems like a bug that it creates the log file. Workaround is to create the log file manually first: root@rs1:/etc/bird# touch /var/log/bird/bird.log root@rs1:/etc/bird# chown bird:bird /var/log/bird/bird.log You would have to be careful whenever rotating the log file too. Cheers, Brian.

2 1

BGP Socket:Connection closed
by Fabiano D'Agostino 23 Apr '20

23 Apr '20

Good evening, I am facing this problem with bgp protocol: Info: Active Socket:Connection closed Why do I have this? Thanks in advance, Fabiano

1 0