September 2020 - Bird-users

Master ready for 2.0.8?
by Kenth Eriksson 28 Sep '20

28 Sep '20

Hi! Is master ready for a 2.0.8 release? The 2.0.7 release has several bugs that I think are worth a release to a broader audience (seems like they are all in master) * OSPF authentication causes SEGV https://bird.network.cz/pipermail/bird-users/2020-January/014174.html * No LPM on static routes https://bird.network.cz/pipermail/bird-users/2020-May/014563.html * Primary route flag corrupt https://bird.network.cz/pipermail/bird-users/2019-October/013931.html * Incorrect CLI output (fix continuation lines) https://bird.network.cz/pipermail/bird-users/2019-December/014019.html When looking thru master I found the following bug fixes are missing; * Multiple routes to the same network with different preference Looks like this is maintained in branch mq-ordered. Will mq-ordered branch merge into master? https://bird.network.cz/pipermail/bird-users/2019-October/013897.html * Socket close https://bird.network.cz/pipermail/bird-users/2019-June/013465.html * CLI socket buffer full https://bird.network.cz/pipermail/bird-users/2019-June/013464.html Thanks, Kenth

6 10

BMP feature in bird
by Kusmierski, Pawel 26 Sep '20

26 Sep '20

Hi, I saw some posts about work on BMP being planned in recent years. Is there anybody working on it right now? Any existing work to base the implementation on? Regards, -- Pawel Kusmierski Senior Manager, Engineering Krakow, Poland

1 0

How to set OSPF dummy0 propagation cost?
by Petr Boltík 25 Sep '20

25 Sep '20

Hello, I have a simple question for most of you, .... I have Bird 2.0.7 and using multiple dummy interface (lo0 and lo1) with /32 IP address. I can propagate this interface using # R1 with lo1: interface "lo1" { cost 2000; stub; }; # R2 with lo1: interface "lo1" { cost 10; stub; }; #router 3 get the same cost for /32 route from R1 and R2 question is - how to propagate the lo1 address from multiple devices with the different costs? Attribute "cost" not makes any changes. What I miss? Thank you. Regards Petr B.

1 1

restart one BGP session cmd
by Irene Lalioti 24 Sep '20

24 Sep '20

Hello! I have difficulty to find which is the command to restart only one BGP session in Bird 2.0.7 ? I am aware of the graceful restarts and so on but for all the sessions. How about for only 1 BGP session while troubleshooting ? Thanks in advance! Eirini -- Irene Lalioti Network Engineer Fondation RESTENA 2, avenue de l'Université L-4365 Esch/Alzette Tel: +352 424409 1 Fax: +352 422473

2 1

[PATCH v2 4/7] nest: Allow specifying security keys as hex bytes as well as strings
by Toke Høiland-Jørgensen 23 Sep '20

23 Sep '20

From: Toke Høiland-Jørgensen <toke(a)toke.dk> This adds support for specifying a password in raw hexadecimal bytes form, via the 'key' keyword. The result is the same whether a password is specified as a quoted string or a hex-encoded byte string, this just makes it more convenient to input high-entropy byte strings as MAC keys. This means that the config string: password "test" { algorithm hmac sha256; }; is equivalent to: key 74:65:73:74 { algorithm hmac sha256; }; or key 74657374 { algorithm hmac sha256; }; Signed-off-by: Toke Høiland-Jørgensen <toke(a)toke.dk> --- conf/cf-lex.l | 31 +++++++++++++++++++++++++++++++ conf/conf.h | 5 +++++ conf/confbase.Y | 2 ++ doc/bird.sgml | 9 ++++++++- lib/string.h | 1 + lib/strtoul.c | 27 +++++++++++++++++++++++++++ nest/config.Y | 40 ++++++++++++++++++++++------------------ 7 files changed, 96 insertions(+), 19 deletions(-) diff --git a/conf/cf-lex.l b/conf/cf-lex.l index 9ea05e9d9..f8e464734 100644 --- a/conf/cf-lex.l +++ b/conf/cf-lex.l @@ -255,6 +255,37 @@ WHITE [ \t] return IP4; } +{XIGIT}{2}(:{XIGIT}{2}|{XIGIT}{2}){15,} { + char *s = yytext; + size_t len = 0, i; + struct bytestring *bytes; + byte *b; + + while (*s) { + len++; + s += 2; + if (*s == ':') + s++; + } + bytes = cfg_allocz(sizeof(*bytes) + len); + + bytes->sz = len; + b = &bytes->b[0]; + s = yytext; + errno = 0; + for (i = 0; i < len; i++) { + *b = bstrtobyte16(s); + if (errno == ERANGE) + cf_error("Invalid hex string"); + b++; + s += 2; + if (*s == ':') + s++; + } + cf_lval.b = bytes; + return BYTES; +} + ({XIGIT}*::|({XIGIT}*:){3,})({XIGIT}*|{DIGIT}+\.{DIGIT}+\.{DIGIT}+\.{DIGIT}+) { if (!ip6_pton(yytext, &cf_lval.ip6)) cf_error("Invalid IPv6 address %s", yytext); diff --git a/conf/conf.h b/conf/conf.h index 34c6818dc..bdfcda566 100644 --- a/conf/conf.h +++ b/conf/conf.h @@ -127,6 +127,11 @@ struct symbol { char name[0]; }; +struct bytestring { + size_t sz; + byte b[]; +}; + struct sym_scope { struct sym_scope *next; /* Next on scope stack */ struct symbol *name; /* Name of this scope */ diff --git a/conf/confbase.Y b/conf/confbase.Y index 8b22f2367..e68570ac5 100644 --- a/conf/confbase.Y +++ b/conf/confbase.Y @@ -90,6 +90,7 @@ CF_DECLS struct channel_limit cl; struct timeformat *tf; mpls_label_stack *mls; + struct bytestring *b; } %token END CLI_MARKER INVALID_TOKEN ELSECOL DDOT @@ -101,6 +102,7 @@ CF_DECLS %token <i64> VPN_RD %token <s> CF_SYM_KNOWN CF_SYM_UNDEFINED %token <t> TEXT +%token <b> BYTES %type <iface> ipa_scope %type <i> expr bool pxlen4 diff --git a/doc/bird.sgml b/doc/bird.sgml index 0bfe6c0d7..ab37c26c2 100644 --- a/doc/bird.sgml +++ b/doc/bird.sgml @@ -765,7 +765,7 @@ agreement"). protocol packets are processed in the local TX queues. This option is Linux specific. Default value is 7 (highest priority, privileged traffic). - <tag><label id="proto-pass">password "<m/password/" [ { <m>password options</m> } ]</tag> + <tag><label id="proto-pass">password "<m/password/" [ { <m>password options</m> } ] | key <m/hex_key/ </tag> Specifies a password that can be used by the protocol as a shared secret key. Password option can be used more times to specify more passwords. If more passwords are specified, it is a protocol-dependent decision @@ -773,6 +773,13 @@ agreement"). authentication is enabled, authentication can be enabled by separate, protocol-dependent <cf/authentication/ option. + A password can also be specified as a hexadecimal key using the + <cf/key/ option, with the hexadecimal key following the option unquoted. + The same sub-options can be used in both cases. The bytes in the hex_key + can optionally be colon-separated, and a key specified this way must be + at least 16 bytes long (although specific algorithms can impose other + restrictions). + This option is allowed in BFD, OSPF and RIP protocols. BGP has also <cf/password/ option, but it is slightly different and described separately. diff --git a/lib/string.h b/lib/string.h index 0f650178d..976b1c247 100644 --- a/lib/string.h +++ b/lib/string.h @@ -26,6 +26,7 @@ void buffer_puts(buffer *buf, const char *str); u64 bstrtoul10(const char *str, char **end); u64 bstrtoul16(const char *str, char **end); +byte bstrtobyte16(const char *str); int patmatch(const byte *pat, const byte *str); diff --git a/lib/strtoul.c b/lib/strtoul.c index 44a1bb1dd..a5b11f68d 100644 --- a/lib/strtoul.c +++ b/lib/strtoul.c @@ -59,3 +59,30 @@ bstrtoul16(const char *str, char **end) errno = ERANGE; return UINT64_MAX; } + +byte +bstrtobyte16(const char *str) +{ + byte out = 0; + for (int i=0; i<2; i++) { + switch (str[i]) { + case '0' ... '9': + out *= 16; + out += str[i] - '0'; + break; + case 'a' ... 'f': + out *= 16; + out += str[i] + 10 - 'a'; + break; + case 'A' ... 'F': + out *= 16; + out += str[i] + 10 - 'A'; + break; + default: + errno = ERANGE; + return -1; + } + } + + return out; +} diff --git a/nest/config.Y b/nest/config.Y index 710095627..8a99f8c9c 100644 --- a/nest/config.Y +++ b/nest/config.Y @@ -36,6 +36,25 @@ iface_patt_check(void) cf_error("Interface name/mask expected, not IP prefix"); } +static inline void +init_password(void *data, size_t sz) +{ + if (!this_p_list) { + this_p_list = cfg_alloc(sizeof(list)); + init_list(this_p_list); + password_id = 1; + } + this_p_item = cfg_alloc(sizeof (struct password_item)); + this_p_item->password = data; + this_p_item->length = sz; + this_p_item->genfrom = 0; + this_p_item->gento = TIME_INFINITY; + this_p_item->accfrom = 0; + this_p_item->accto = TIME_INFINITY; + this_p_item->id = password_id++; + this_p_item->alg = ALG_UNDEFINED; + add_tail(this_p_list, &this_p_item->n); +} static inline void reset_passwords(void) @@ -75,7 +94,7 @@ CF_KEYWORDS(BGP, PASSWORDS, DESCRIPTION, SORTED) CF_KEYWORDS(RELOAD, IN, OUT, MRTDUMP, MESSAGES, RESTRICT, MEMORY, IGP_METRIC, CLASS, DSCP) CF_KEYWORDS(TIMEFORMAT, ISO, SHORT, LONG, ROUTE, PROTOCOL, BASE, LOG, S, MS, US) CF_KEYWORDS(GRACEFUL, RESTART, WAIT, MAX, FLUSH, AS) -CF_KEYWORDS(CHECK, LINK) +CF_KEYWORDS(CHECK, LINK, KEY) /* For r_args_channel */ CF_KEYWORDS(IPV4, IPV4_MC, IPV4_MPLS, IPV6, IPV6_MC, IPV6_MPLS, IPV6_SADR, VPN4, VPN4_MC, VPN4_MPLS, VPN6, VPN6_MC, VPN6_MPLS, ROA4, ROA6, FLOW4, FLOW6, MPLS, PRI, SEC) @@ -453,23 +472,8 @@ password_item: ; password_item_begin: - PASSWORD text { - if (!this_p_list) { - this_p_list = cfg_alloc(sizeof(list)); - init_list(this_p_list); - password_id = 1; - } - this_p_item = cfg_alloc(sizeof (struct password_item)); - this_p_item->password = $2; - this_p_item->length = strlen($2); - this_p_item->genfrom = 0; - this_p_item->gento = TIME_INFINITY; - this_p_item->accfrom = 0; - this_p_item->accto = TIME_INFINITY; - this_p_item->id = password_id++; - this_p_item->alg = ALG_UNDEFINED; - add_tail(this_p_list, &this_p_item->n); - } + PASSWORD text { init_password((void *)$2, strlen($2)); } + | KEY BYTES { init_password($2->b, $2->sz); } ; password_item_params:

1 0

[PATCH v2 1/7] sysdep: Add wrapper to get random bytes
by Toke Høiland-Jørgensen 23 Sep '20

23 Sep '20

From: Toke Høiland-Jørgensen <toke(a)toke.dk> The Babel authentication code added by a subsequent commit needs a way to get random bytes for generating nonces. This patch adds a wrapper function in sysdep to get random bytes, and the required checks in configure.ac to select how to do it. The configure script tries, in order, getrandom(), getentropy() and reading from /dev/urandom. Signed-off-by: Toke Høiland-Jørgensen <toke(a)toke.dk> --- conf/conf.c | 1 + configure.ac | 4 ++ lib/birdlib.h | 3 ++ sysdep/unix/main.c | 1 + sysdep/unix/random.c | 88 ++++++++++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 97 insertions(+) diff --git a/conf/conf.c b/conf/conf.c index b21d5213a..e353681d5 100644 --- a/conf/conf.c +++ b/conf/conf.c @@ -515,6 +515,7 @@ order_shutdown(int gr) c->gr_down = gr; config_commit(c, RECONFIG_HARD, 0); + random_close(); shutting_down = 1; } diff --git a/configure.ac b/configure.ac index eabb3d562..d27bb327b 100644 --- a/configure.ac +++ b/configure.ac @@ -373,6 +373,10 @@ elif test "$bird_cv_lib_log" != yes ; then LIBS="$LIBS $bird_cv_lib_log" fi +AC_CHECK_FUNCS(getrandom) +AC_CHECK_FUNCS(getentropy) +AC_CHECK_HEADERS(sys/random.h) + if test "$enable_debug" = yes ; then AC_DEFINE([DEBUGGING], [1], [Define to 1 if debugging is enabled]) LDFLAGS="$LDFLAGS -rdynamic" diff --git a/lib/birdlib.h b/lib/birdlib.h index 23036c1b1..61098f929 100644 --- a/lib/birdlib.h +++ b/lib/birdlib.h @@ -192,5 +192,8 @@ asm( /* Pseudorandom numbers */ u32 random_u32(void); +int random_bytes(char *buf, size_t size); +void random_close(void); +void random_init(void); #endif diff --git a/sysdep/unix/main.c b/sysdep/unix/main.c index 2c7e3ceff..3903ecccb 100644 --- a/sysdep/unix/main.c +++ b/sysdep/unix/main.c @@ -851,6 +851,7 @@ main(int argc, char **argv) parse_args(argc, argv); log_switch(1, NULL, NULL); + random_init(); net_init(); resource_init(); timer_init(); diff --git a/sysdep/unix/random.c b/sysdep/unix/random.c index b1f5086fe..de81f3ca2 100644 --- a/sysdep/unix/random.c +++ b/sysdep/unix/random.c @@ -7,6 +7,21 @@ */ #include <stdlib.h> +#include <fcntl.h> +#include <unistd.h> +#include <errno.h> + +#include "sysdep/config.h" + +#ifdef HAVE_SYS_STAT_H +# include <sys/stat.h> +#endif +#ifdef HAVE_LINUX_RANDOM_H +# include <linux/random.h> +#endif +#if defined(HAVE_SYS_RANDOM_H) && (defined(HAVE_GETRANDOM) || defined(HAVE_GETENTROPY)) +# include <sys/random.h> +#endif #include "nest/bird.h" @@ -19,3 +34,76 @@ random_u32(void) rand_high = random(); return (rand_low & 0xffff) | ((rand_high & 0xffff) << 16); } + +void +random_init() +{ + char buf; + /* get a single random byte to trip any errors early */ + random_bytes(&buf, sizeof(buf)); +} + +#if defined(HAVE_GETRANDOM) || defined(HAVE_GENTROPY) +int +random_bytes(char *buf, size_t size) +{ + int n; + int flags = 0; + while (0 < size) { +#if defined(HAVE_GETRANDOM) + n = getrandom(buf, size, flags); +#else + n = getentropy(buf, size); +#endif + if (n < 0) { + if (errno == EINTR) + continue; + die("Couldn't get random bytes: %m"); + } + buf += n; + size -= n; + } + + return 0; +} + +void random_close(void) {} + +#else + +static int urandom_fd = -1; +int random_bytes(char *buf, size_t size) +{ + int n; + + if (urandom_fd < 0) + { + urandom_fd = open("/dev/urandom", O_RDONLY); + if (urandom_fd < 0) + die("Couldn't open /dev/urandom: %m"); + } + + do + { + n = read(urandom_fd, buf, size); + if (n <= 0) { + if (errno == EINTR) + continue; + die("Couldn't read from /dev/urandom: %m"); + } + buf += n; + size -= n; + } while (size > 0); + + return 0; +} + +void +random_close(void) +{ + if (urandom_fd >= 0) { + close(urandom_fd); + urandom_fd = -1; + } +} +#endif

1 0

Temporarily announcing more specific prefix?
by Robert Sander 22 Sep '20

22 Sep '20

Hi, I have the task to configure BIRD to be able to announce a more specific prefix temporarily to our BGP peers. Currently we announce a /22 and want to be able to flip a switch and announce one /24 from that /22. As we partition the network internally I cannot use the prefixes learned for the BGP announcements. Currently there is one static protocol that contains the /22 and the export filter looks at the protocol name. I was thinking about setting up another static protocol and enable it if needed. But the /24 is also used internally and therefor the preferred route in the table, even when the static protocol is enabled. This means I cannot filter on the protocol name in the export filter. I cannot filter on the prefix itself as it must not be exported always. How do I achieve that? Regards -- Robert Sander Heinlein Support GmbH Schwedter Str. 8/9b, 10119 Berlin http://www.heinlein-support.de Tel: 030 / 405051-43 Fax: 030 / 405051-19 Zwangsangaben lt. §35a GmbHG: HRB 93818 B / Amtsgericht Berlin-Charlottenburg, Geschäftsführer: Peer Heinlein -- Sitz: Berlin

3 4

RAdv protocol extensions, version 2, for bird 1.6.8
by Gehrkens.IT GmbH | Heiko Wundram 15 Sep '20

15 Sep '20

Hey all, I've had time over the weekend to play a bit more with the radv protocol, and I've implemented some additional functional changes based on the patch I sent last week that make (at least our) configuration/usage of radv more concise. In addition to the device routes as prefixes of last week, this patch implements: * Interface specific triggers (i.e., there can be more than one additive trigger and triggers need no longer be protocol globals, but can be specified on an interface basis) * Proper aging for routes when an exported route becomes a prefix becomes a route * Selection mechanism for which device routes to export as prefixes (the default being no export as prefix) * Sensitive prefixes (which are deconfigured and aged out normally, not only lifetime set to zero) when an interface becomes inactive/suppressed. * Route propagation per interface, not per protocol. Generally, the configuration should be backwards compatible (i.e., same behaviour as bird 1.6.8), except for propagate routes, which now does not exist in the protocol global state; that's something that I still plan on implementing as a global toggle which can be overridden on the interface. Radv works with this patch, but is not extensively tested as the other changes I posted last week (which have been in use for somewhere around a month now). Thanks for any feedback and hoping that somebody might find this useful! --- Heiko.

2 1

Where to post patches to bird for making radv more useful?
by Gehrkens.IT GmbH | Heiko Wundram 11 Sep '20

11 Sep '20

Hey all, I’ve played around with bird a bit (which we use as a routing daemon, mainly for OSPF and BGP), and found the RADV-functionality lacking, as it's currently (at least with the 1.6 release where we're on due to Debian, and also from the documentation of 2.0 this seems not to have changed) impossible to inject additional prefixes into the router advertisement messages than those from the addresses that are set up on the interface that's managed by RA. This is a problem on routers which do radv through bird, as this means that they need an IP address from the corresponding prefixes on every interface that is to have radv enabled and makes their (source) addressing unpredictable with respect to firewall configuration and (e.g.) anycast targets. To remedy this, I thought that I'd just reconfigure the network to just have device routes to the corresponding IPv6 prefixes on their respective interfaces, without actually configuring an address on the gateway, which generally works (and is also the way that I learnt to set up IPv6), but in this case, bird doesn't pick up the corresponding prefixes anymore which makes radv (rather: SLAAC) unusable. I've patched exactly this functionality (i.e., picking up device routes pushed to the protocol through the export filter and using them to configure prefixes on the interface that they are attached to) and additionally also the possibility to configurably NOT filter the trigger route (which the current implementation always does, and I generally understand the reason, but sometimes you still don't want this) into bird 1.6.8, and AFAICT from my preliminary tests, the patch seems to be stable. To make it available to others (I guess that my experience with radv needing work hasn't been unique), I'd like to upstream the patch. I thought about using Github, but the BIRD repository there doesn't seem to be maintained/synchronized with the actual repository at gitlab.nic.cz (the mirror URL is broken), so I can't push any patches to 1.6.8 there. Additionally, I've registered an account on gitlab.nic.cz, which worked, but it seems I don't have any rights to fork the project (my quota is used). So: how do I upstream my patches? 😉 Thanks for any hints and hope that somebody may find this work useful! Heiko.

4 4

bird display 'unreachable' on all bgp routers
by 孔晖 07 Sep '20

07 Sep '20

Hi: I have a network 10.8.192.0/24, I have a client(gobgp 10.8.192.[15-21] as 65000) report static route to the reflector(10.8.192.159 as 65000). It always return unrechable on reflector(10.8.192.159) like this: BIRD 2.0.7 ready. bird> show route Table master4: 10.254.0.192/26 unreachable [r4 11:36:47.139 from 10.8.192.18] * (100) [i] 10.254.165.123/32 unreachable [r1 11:36:48.747 from 10.8.192.15] * (100) [i] unreachable [r3 11:37:05.421 from 10.8.192.17] (100) [i] unreachable [r2 11:37:04.970 from 10.8.192.16] (100) [i] unreachable [r6 11:36:48.774 from 10.8.192.20] (100) [i] unreachable [r4 11:36:47.139 from 10.8.192.18] (100) [i] unreachable [r5 11:36:45.972 from 10.8.192.19] (100) [i] 10.254.0.128/26 unreachable [r3 11:37:05.421 from 10.8.192.17] * (100) [i] 10.254.180.155/32 unreachable [r1 11:36:48.747 from 10.8.192.15] * (100) [i] unreachable [r3 11:37:05.421 from 10.8.192.17] (100) [i] unreachable [r2 11:37:04.970 from 10.8.192.16] (100) [i] unreachable [r6 11:36:48.774 from 10.8.192.20] (100) [i] unreachable [r4 11:36:47.139 from 10.8.192.18] (100) [i] unreachable [r5 11:36:45.972 from 10.8.192.19] (100) [i] 10.254.172.95/32 unreachable [r1 11:36:48.747 from 10.8.192.15] * (100) [i] unreachable [r3 11:37:05.421 from 10.8.192.17] (100) [i] unreachable [r2 11:37:04.970 from 10.8.192.16] (100) [i] unreachable [r6 11:36:48.774 from 10.8.192.20] (100) [i] unreachable [r4 11:36:47.139 from 10.8.192.18] (100) [i] unreachable [r5 11:36:45.972 from 10.8.192.19] (100) [i] 10.254.0.64/26 unreachable [r1 11:36:48.747 from 10.8.192.15] * (100) [i] 10.254.186.204/32 unreachable [r1 11:36:48.747 from 10.8.192.15] * (100) [i] unreachable [r3 11:37:05.421 from 10.8.192.17] (100) [i] unreachable [r2 11:37:04.970 from 10.8.192.16] (100) [i] unreachable [r6 11:36:48.774 from 10.8.192.20] (100) [i] unreachable [r4 11:36:47.139 from 10.8.192.18] (100) [i] unreachable [r5 11:36:45.972 from 10.8.192.19] (100) [i] 10.254.1.64/26 unreachable [r6 11:36:48.774 from 10.8.192.20] * (100) [i] 10.254.128.1/32 unreachable [r1 11:36:48.747 from 10.8.192.15] * (100) [i] unreachable [r3 11:37:05.421 from 10.8.192.17] (100) [i] unreachable [r2 11:37:04.970 from 10.8.192.16] (100) [i] unreachable [r6 11:36:48.774 from 10.8.192.20] (100) [i] unreachable [r4 11:36:47.139 from 10.8.192.18] (100) [i] unreachable [r5 11:36:45.972 from 10.8.192.19] (100) [i] 10.254.128.10/32 unreachable [r1 11:36:48.747 from 10.8.192.15] * (100) [i] unreachable [r3 11:37:05.421 from 10.8.192.17] (100) [i] unreachable [r2 11:37:04.970 from 10.8.192.16] (100) [i] unreachable [r6 11:36:48.774 from 10.8.192.20] (100) [i] unreachable [r4 11:36:47.139 from 10.8.192.18] (100) [i] unreachable [r5 11:36:45.972 from 10.8.192.19] (100) [i] 10.254.163.78/32 unreachable [r1 11:36:48.747 from 10.8.192.15] * (100) [i] unreachable [r3 11:37:05.421 from 10.8.192.17] (100) [i] unreachable [r2 11:37:04.970 from 10.8.192.16] (100) [i] unreachable [r6 11:36:48.774 from 10.8.192.20] (100) [i] unreachable [r4 11:36:47.139 from 10.8.192.18] (100) [i]10.8.192.0/24 unreachable [r5 11:36:45.972 from 10.8.192.19] (100) [i] 10.254.0.0/26 unreachable [r2 11:37:04.970 from 10.8.192.16] * (100) [i] 10.254.1.0/26 unreachable [r5 11:36:45.972 from 10.8.192.19] * (100) [i] 10.254.152.194/32 unreachable [r1 11:36:48.747 from 10.8.192.15] * (100) [i] unreachable [r3 11:37:05.421 from 10.8.192.17] (100) [i] unreachable [r2 11:37:04.970 from 10.8.192.16] (100) [i] unreachable [r6 11:36:48.774 from 10.8.192.20] (100) [i] unreachable [r4 11:36:47.139 from 10.8.192.18] (100) [i] unreachable [r5 11:36:45.972 from 10.8.192.19] (100) [i] 10.254.138.100/32 unreachable [r1 11:36:48.747 from 10.8.192.15] * (100) [i] unreachable [r3 11:37:05.421 from 10.8.192.17] (100) [i] unreachable [r2 11:37:04.970 from 10.8.192.16] (100) [i] unreachable [r6 11:36:48.774 from 10.8.192.20] (100) [i] unreachable [r4 11:36:47.139 from 10.8.192.18] (100) [i] unreachable [r5 11:36:45.972 from 10.8.192.19] (100) [i] 10.254.166.10/32 unreachable [r1 11:36:48.747 from 10.8.192.15] * (100) [i] unreachable [r3 11:37:05.421 from 10.8.192.17] (100) [i] unreachable [r2 11:37:04.970 from 10.8.192.16] (100) [i] unreachable [r6 11:36:48.774 from 10.8.192.20] (100) [i] unreachable [r4 11:36:47.139 from 10.8.192.18] (100) [i] unreachable [r5 11:36:45.972 from 10.8.192.19] (100) [i] 10.254.171.1/32 unreachable [r1 11:36:48.747 from 10.8.192.15] * (100) [i] unreachable [r3 11:37:05.421 from 10.8.192.17] (100) [i] unreachable [r2 11:37:04.970 from 10.8.192.16] (100) [i] unreachable [r6 11:36:48.774 from 10.8.192.20] (100) [i] unreachable [r4 11:36:47.139 from 10.8.192.18] (100) [i] unreachable [r5 11:36:45.972 from 10.8.192.19] (100) [i] I can visit all of this destination from the advise node (10.8.192.[15-21]) correctly. And all node in the one network (10.8.192.0/24), The destination is the POD and Service IP on the Kubernetes. Here is the reflector(10.8.192.159) show protocols output bird> show protocols all Name Proto Table State Since Info device1 Device --- up 11:31:03.028 kernel1 Kernel master4 up 11:31:03.028 Channel ipv4 State: UP Table: master4 Preference: 10 Input filter: ACCEPT Output filter: (unnamed) Routes: 0 imported, 17 exported, 0 preferred Route change stats: received rejected filtered ignored accepted Import updates: 0 0 0 0 0 Import withdraws: 0 0 --- 0 0 Export updates: 39 0 0 --- 39 Export withdraws: 0 --- --- --- 0 direct1 Direct --- up 11:31:03.028 r1 BGP --- up 11:31:07.217 Established Description: bgp reflector BGP state: Established Neighbor address: 10.8.192.15 Neighbor AS: 65000 Local AS: 65000 Neighbor ID: 10.8.192.15 Local capabilities Multiprotocol AF announced: ipv4 Route refresh Graceful restart 4-octet AS numbers Enhanced refresh Long-lived graceful restart Neighbor capabilities Multiprotocol AF announced: ipv4 ipv6 Route refresh Graceful restart Restart time: 90 Restart recovery AF supported: ipv4 ipv6 AF preserved: ipv4 ipv6 4-octet AS numbers Session: internal multihop route-reflector AS4 Source address: 10.8.192.159 Hold timer: 60.231/90 Keepalive timer: 21.313/30 Channel ipv4 State: UP Table: master4 Preference: 100 Input filter: ACCEPT Output filter: ACCEPT Routes: 12 imported, 5 exported, 12 preferred Route change stats: received rejected filtered ignored accepted Import updates: 30 0 0 18 12 Import withdraws: 0 0 --- 0 0 Export updates: 39 12 0 --- 27 Export withdraws: 0 --- --- --- 11 BGP Next hop: 10.8.192.159 IGP IPv4 table: master4 r2 BGP --- up 11:31:04.090 Established Description: bgp reflector BGP state: Established Neighbor address: 10.8.192.16 Neighbor AS: 65000 Local AS: 65000 Neighbor ID: 10.8.192.16 Local capabilities Multiprotocol AF announced: ipv4 Route refresh Graceful restart 4-octet AS numbers Enhanced refresh Long-lived graceful restart Neighbor capabilities Multiprotocol AF announced: ipv4 ipv6 Route refresh Graceful restart Restart time: 90 Restart recovery AF supported: ipv4 ipv6 AF preserved: ipv4 ipv6 4-octet AS numbers Session: internal multihop route-reflector AS4 Source address: 10.8.192.159 Hold timer: 82.204/90 Keepalive timer: 8.541/30 Channel ipv4 State: UP Table: master4 Preference: 100 Input filter: ACCEPT Output filter: ACCEPT Routes: 12 imported, 16 exported, 1 preferred Route change stats: received rejected filtered ignored accepted Import updates: 30 0 0 18 12 Import withdraws: 0 0 --- 0 0 Export updates: 39 1 0 --- 38 Export withdraws: 0 --- --- --- 0 BGP Next hop: 10.8.192.159 IGP IPv4 table: master4 r3 BGP --- up 11:31:04.541 Established Description: bgp reflector BGP state: Established Neighbor address: 10.8.192.17 Neighbor AS: 65000 Local AS: 65000 Neighbor ID: 10.8.192.17 Local capabilities Multiprotocol AF announced: ipv4 Route refresh Graceful restart 4-octet AS numbers Enhanced refresh Long-lived graceful restart Neighbor capabilities Multiprotocol AF announced: ipv4 ipv6 Route refresh Graceful restart Restart time: 90 Restart recovery AF supported: ipv4 ipv6 AF preserved: ipv4 ipv6 4-octet AS numbers Session: internal multihop route-reflector AS4 Source address: 10.8.192.159 Hold timer: 72.931/90 Keepalive timer: 2.506/30 Channel ipv4 State: UP Table: master4 Preference: 100 Input filter: ACCEPT Output filter: ACCEPT Routes: 12 imported, 16 exported, 1 preferred Route change stats: received rejected filtered ignored accepted Import updates: 30 0 0 18 12 Import withdraws: 0 0 --- 0 0 Export updates: 39 1 0 --- 38 Export withdraws: 0 --- --- --- 0 BGP Next hop: 10.8.192.159 IGP IPv4 table: master4 r4 BGP --- up 11:31:07.232 Established Description: bgp reflector BGP state: Established Neighbor address: 10.8.192.18 Neighbor AS: 65000 Local AS: 65000 Neighbor ID: 10.8.192.18 Local capabilities Multiprotocol AF announced: ipv4 Route refresh Graceful restart 4-octet AS numbers Enhanced refresh Long-lived graceful restart Neighbor capabilities Multiprotocol AF announced: ipv4 ipv6 Route refresh Graceful restart Restart time: 90 Restart recovery AF supported: ipv4 ipv6 AF preserved: ipv4 ipv6 4-octet AS numbers Session: internal multihop route-reflector AS4 Source address: 10.8.192.159 Hold timer: 43.757/90 Keepalive timer: 22.803/30 Channel ipv4 State: UP Table: master4 Preference: 100 Input filter: ACCEPT Output filter: ACCEPT Routes: 12 imported, 16 exported, 1 preferred Route change stats: received rejected filtered ignored accepted Import updates: 30 0 0 18 12 Import withdraws: 0 0 --- 0 0 Export updates: 39 12 0 --- 27 Export withdraws: 0 --- --- --- 11 BGP Next hop: 10.8.192.159 IGP IPv4 table: master4 r5 BGP --- up 11:31:03.996 Established Description: bgp reflector BGP state: Established Neighbor address: 10.8.192.19 Neighbor AS: 65000 Local AS: 65000 Neighbor ID: 10.8.192.19 Local capabilities Multiprotocol AF announced: ipv4 Route refresh Graceful restart 4-octet AS numbers Enhanced refresh Long-lived graceful restart Neighbor capabilities Multiprotocol AF announced: ipv4 ipv6 Route refresh Graceful restart Restart time: 90 Restart recovery AF supported: ipv4 ipv6 AF preserved: ipv4 ipv6 4-octet AS numbers Session: internal multihop route-reflector AS4 Source address: 10.8.192.159 Hold timer: 76.457/90 Keepalive timer: 17.788/30 Channel ipv4 State: UP Table: master4 Preference: 100 Input filter: ACCEPT Output filter: ACCEPT Routes: 12 imported, 16 exported, 1 preferred Route change stats: received rejected filtered ignored accepted Import updates: 30 0 0 18 12 Import withdraws: 0 0 --- 0 0 Export updates: 39 12 0 --- 27 Export withdraws: 0 --- --- --- 0 BGP Next hop: 10.8.192.159 IGP IPv4 table: master4 r6 BGP --- up 11:31:07.795 Established Description: bgp reflector BGP state: Established Neighbor address: 10.8.192.20 Neighbor AS: 65000 Local AS: 65000 Neighbor ID: 10.8.192.20 Local capabilities Multiprotocol AF announced: ipv4 Route refresh Graceful restart 4-octet AS numbers Enhanced refresh Long-lived graceful restart Neighbor capabilities Multiprotocol AF announced: ipv4 ipv6 Route refresh Graceful restart Restart time: 90 Restart recovery AF supported: ipv4 ipv6 AF preserved: ipv4 ipv6 4-octet AS numbers Session: internal multihop route-reflector AS4 Source address: 10.8.192.159 Hold timer: 53.441/90 Keepalive timer: 17.733/30 Channel ipv4 State: UP Table: master4 Preference: 100 Input filter: ACCEPT Output filter: ACCEPT Routes: 12 imported, 16 exported, 1 preferred Route change stats: received rejected filtered ignored accepted Import updates: 30 0 0 18 12 Import withdraws: 0 0 --- 0 0 Export updates: 39 1 0 --- 38 Export withdraws: 0 --- --- --- 0 BGP Next hop: 10.8.192.159 IGP IPv4 table: master4 r7 BGP --- up 11:31:06.968 Established Description: bgp reflector BGP state: Established Neighbor address: 10.8.192.21 Neighbor AS: 65000 Local AS: 65000 Neighbor ID: 10.8.192.21 Local capabilities Multiprotocolrouter id 10.8.192.159; AF announced: ipv4 Route refresh Graceful restart 4-octet AS numbers Enhanced refresh Long-lived graceful restart Neighbor capabilities Multiprotocol AF announced: ipv4 Route refresh Graceful restart 4-octet AS numbers Enhanced refresh Long-lived graceful restart Session: internal multihop route-reflector AS4 Source address: 10.8.192.159 Hold timer: 135.252/240 Keepalive timer: 65.646/80 Channel ipv4 State: UP Table: master4 Preference: 100 Input filter: ACCEPT Output filter: ACCEPT Routes: 0 imported, 17 exported, 0 preferred Route change stats: received rejected filtered ignored accepted Import updates: 0 0 0 0 0 Import withdraws: 0 0 --- 0 0 Export updates: 39 0 0 --- 39 Export withdraws: 0 --- --- --- 0 BGP Next hop: 10.8.192.159 IGP IPv4 table: master4 Here is my reflector configuration(bird.conf): router id 10.8.192.159; protocol device { scan time 10; }; protocol kernel { ipv4 { export filter { if source = RTS_STATIC then reject; accept; }; }; } protocol direct { interface "*"; } template bgp rr_client { description "bgp reflector"; local 10.8.192.159 as 65000; rr client; rr cluster id 10.8.192.159; ipv4 { export all; import all; }; } protocol bgp r1 from rr_client { neighbor 10.8.192.15 as 65000; } protocol bgp r2 from rr_client { neighbor 10.8.192.16 as 65000; } protocol bgp r3 from rr_client { neighbor 10.8.192.17 as 65000; } protocol bgp r4 from rr_client { neighbor 10.8.192.18 as 65000; } protocol bgp r5 from rr_client { neighbor 10.8.192.19 as 65000; } protocol bgp r6 from rr_client { neighbor 10.8.192.20 as 65000; } protocol bgp r7 from rr_client { neighbor 10.8.192.21 as 65000; } I sure client(gobgp) didn't send any withdrawn route to the reflector(by package capture). And I use bird as client. Send static network also mark as unreachable by the reflector. Is there any thing I misconfigured? Thank you very much.

1 0