January 2021 - Bird-users

logging via udp
by Alexander Zubkov 13 Dec '23

13 Dec '23

Hello, Made some dirty patch for myself to allow bird to send logs via udp. But it may be useful not only for me, so posting it here. It could be useful when server experiencing high IO-load. As syslog and file operations in bird are blocking, it can be blocked on writing to it for indefinite time, which could lead to various problems like protocol timeouts. So udp logging comes in handy here. The tradeoff is that we can miss some logs if they are not processed in time. You can specify udp log destination like that: log udp [host IP|"hostname"] [port NUMBER|"portname"] ... By default it uses destination ip 127.0.0.1 and port 514. There are some constraints like not much error handling. And this destination replaces file destination, i.e. you can not use those simultaneously and it may leak descriptors and some memory probably if both are specified. It also makes a new socket every time configuration is reloaded even if there is no change in options, but this is not a great deal.

2 9

Adding more then one bgp community at once
by Борис Коваленко 05 May '23

05 May '23

Hello! Is this possible to add many communites at once? bgp_community.add([(1,1), (1,2)]) is wrong "Setting clist attribute to non-clist value" Regards, Boris -- С уважением, Борис Коваленко

4 5

[PATCH] feature to keep protocol's state while configuring
by Alexander Zubkov 29 Jan '23

29 Jan '23

Hello. I have created a patch (attached) with new protocol option: disabled keep on|off. To keep the protocol's state while loading new config. It is useful when protocols disabled manually in the runtime, but we want to keep that state when loading new config. Patch is attached. I have made it against the current int-new branch.

3 16

IGP Metric to MED
by Corban Johnson 29 Apr '22

29 Apr '22

Hello, I am trying to set MED on a BGP route using the metric value from OSPF, but the attributes of the next-hop route do not seem to be available in filter evolution. Am I missing something? Example Bird 2.0 config: protocol bgp test_peer { bfd on; med metric on; graceful restart on; ipv4 { table test_table; gateway recursive; }; local as 65656; } protocol ospf t1_igp { ipv4 { table test_table; }; } OSPF is distributing loopbacks and link nets only. BGP protocols from ‘test_peer’ will use routes learned from ‘t1_igp’ in ‘test_table’ to resolve next hop information (gateway recursive). So far, so good. However, I also have an eBGP peer (i.e. who is not participating in my IGP above) who is multi homed with AS65656. I would like to use MED to inform the peer about my IGP distances to each exit — something like the ‘metric-out minimum-igp <offset>’ command in Junos (https://www.juniper.net/documentation/en_US/junos/topics/reference/configur…) > You can increase or decrease the variable metric calculated from the IGP metric (either from the igp or minimum-igp statement) by specifying a value for offset. The metric is increased by specifying a positive value for offset, and decreased by specifying a negative value for offset. The problem seems to be that filters may only access attributes of the route currently processed, and the 'gateway recursive’ channel directive only calculates next-hop without passing any route attributes of that next-hop through. Has anyone had any luck trying something similar? Many thanks.

3 5

Re: BIRD trying to reinsert existing kernel routes, netlink issue?
by Zhaofeng Li 18 Feb '22

18 Feb '22

I know this was an old thread, but would really appreciate if anyone is interested in digging in deeper. I can confirm the exact same behavior happens to me on NixOS with the 5.4.69 kernel but not on 4.19.149. BIRD 2.0.7 on 5.4.69 would incessantly attempt to insert the same routes, rendering birdc unusable as it was presumably taking up so much time in the main loop (it was receiving an IPv4 full table over iBGP as well). While it was doing that, it stopped announcing the prefixes of stub interfaces to OSPF neighbors. Thanks, Zhaofeng Li On Sun, Aug 2, 2020, at 17:36 PM, Sasha Romijn wrote: > Hello, > I’m running into a rather complex issue where BIRD tries to reinsert routes into the kernel routing table that are already in there. I’m at the point of suspecting a netlink bug in the 5.x linux kernel. However, I may be entirely off, and would like to hear what people with more BIRD and/or netlink expertise think about it. > My setup is bird 2.0.7 on Ubuntu 20.04. I’ve been able to reproduce this with the default 5.4.0-42-generic kernel as well as the ubuntu mainline 5.7.0-050700-generic kernel. This bird instance has an IBGP peering with another bird 2.0.7 instance, which sends an IPv4 full table. The IBGP peering is set up over a GRE tunnel. There is no other routing software running. I am seeing this issue on another server too, ubuntu 20.04 with 5.4.0-42-generic. A third one with ubuntu 18.04 and a 4.15.0-20-generic kernel, is fine.

3 2

BGP strict bind socket error
by Ben Tremblay 09 Jan '22

09 Jan '22

Hi all, I have encountered a problem with how BIRD opens the listening socket for strict bind BGP. In particular, BIRD sometimes tries to open the listening socket for the protocol when the configured local IP is not yet present on the interface. It seems that BIRD will try to bind the BGP socket to the configured IP if any address exists on the protocol interface that can be used to reach the neighbor. Let me give an example to clarify. I have a minimal reproducible example with the following BGP configuration: router id 192.168.0.1; protocol device { scan time 10; } protocol bgp bgp_01 { ipv4 { import all; export all; }; debug all; local 192.168.0.1 port 179 as 1; neighbor 192.168.0.2 port 179 as 1; interface "host1"; direct; strict bind yes; } Given this configuration, I can reproduce the problem behaviour by starting the protocol with no addressing on the host1 interface and then adding an address which includes the neighbor IP in its subnet, e.g. 192.168.0.3/24. Once this address/route is added, BIRD logs the following: Jan 07 12:09:31 router03 bird[57497]: bgp_01: Neighbor ready Jan 07 12:09:31 router03 bird[57497]: bgp_01: Socket error: bind: Cannot assign requested address Jan 07 12:09:31 router03 bird[57497]: bgp_01: Cannot open listening socket And the protocol enters an error state: BIRD 2.0.6 ready. Name Proto Table State Since Info device1 Device --- up 11:55:51.049 bgp_01 BGP --- down 12:09:31.264 Error: No listening socket The reason this error is so problematic for me is that the protocol cannot recover from this state without administrative intervention (e.g. configuring bird or restarting the protocol). So, I have two questions: 1. Is this correct behaviour? 2. Can I configure BIRD so that my protocol is able to recover after suffering a socket error like this? I should also mention I can actually observe this socket error occur when adding the 'correct' address to the protocol interface, but only in the context of a larger application and only some of the time. Thanks, Ben

4 12

[BIRD 2.0.x] Netlink: ignore dead routes
by Vincent Bernat 09 Jan '22

09 Jan '22

With net.ipv4.conf.XXX.ignore_routes_with_linkdown sysctl, a user can ensure the kernel does not use a route whose target interface is down. The route is marked with a "dead"/RTNH_F_DEAD flag. Currently, BIRD still uses and distributes this route. This patch just ignores such a route. This patch could be backported to 1.6.x. Signed-off-by: Vincent Bernat <vincent(a)bernat.ch> --- sysdep/linux/netlink.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sysdep/linux/netlink.c b/sysdep/linux/netlink.c index f85bcf35685b..c28126510e6e 100644 --- a/sysdep/linux/netlink.c +++ b/sysdep/linux/netlink.c @@ -1690,6 +1690,9 @@ nl_parse_route(struct nl_parse_state *s, struct nlmsghdr *h) if (i->rtm_flags & RTNH_F_ONLINK) ra->nh.flags |= RNF_ONLINK; + if (i->rtm_flags & RTNH_F_DEAD) + return; + neighbor *nbr; nbr = neigh_find(&p->p, ra->nh.gw, ra->nh.iface, (ra->nh.flags & RNF_ONLINK) ? NEF_ONLINK : 0); -- 2.28.0

5 15

bgp_large_community wildcard in conditional
by Brooks Swinnerton 18 Oct '21

18 Oct '21

Hello, I was wondering if it's possible to create a conditional that matches on a wildcard for a part of a BGP large community. For example: if ([*, 600, 6939]) ~ bgp_large_community then reject; This currently results in a syntax error at the position of the comma after the *.

5 7

IPv6 BGP & kernel 4.19
by Robert Sander 25 Aug '21

25 Aug '21

Hi, our routers run on Debian stretch with bird 1.6.4 from bird.network.cz/debian. Yesterday I tried kernel 4.19 from backports.debian.org and ran into a weird issue with IPv6 BGP sessions: All Peerings reported "Error: Hold timer expired" ca. every 40 minutes. IPv6 forwarding was flapping all the time. After rebooting into kernel 4.9 everything worked again. IPv4 BGP was not affected and also OSPF (v4 and v6). I could disable all IPv6 BGP peerings on this router and then it forwarded to another router learned via OSPF for IPv6 without issues. Has anyone seen such a behaviour? Regards -- Robert Sander Heinlein Support GmbH Schwedter Str. 8/9b, 10119 Berlin https://www.heinlein-support.de Tel: 030 / 405051-43 Fax: 030 / 405051-19 Amtsgericht Berlin-Charlottenburg - HRB 93818 B Geschäftsführer: Peer Heinlein - Sitz: Berlin

13 39

[PATCH v4 0/8] Add MAC authentication support to the Babel protocol
by Toke Høiland-Jørgensen 11 Jun '21

11 Jun '21

This series adds MAC authentication support to the Babel protocol as specified in in RFC8967: https://www.rfc-editor.org/rfc/rfc8967 I have performed basic interoperability testing between this implementation and the current babeld HMAC implementation[1]. The two implementations were able to successfully exchange authenticated messages with both HMAC-256 and Blake2s-256 keys. Given the above, and the fact that the RFC was finally published at the the IETF, I believe this series is ready for merging (subject to review, of course). For those wanting to test the code, a version of Bird with this series applied is available on Github[2] for easy consumption. [1] https://github.com/jech/babeld/pull/52 [2] https://github.com/tohojo/bird/tree/babel-mac-04 Changelog: v4: - Update RFC references to the published RFC numbers (for both MAC and Babel itself). - Rework WALK_TLVS macro to not cast initial argument, and not use goto for framing errors. - Change MAC validation logic to just let algorithms specify min/max len and enforce full key size length even for the smaller-output variants of Blake2. v3: - Add variants with smaller digest sizes for blake2s and blake2b. - Rebase on current master v2: - Don't reinvent AC_CHECK_FUNCS() for configure - Make sure random_bytes() never fails (without taking the whole daemon with it) - Use existing endianness defines in blake2s code - Just leave MAC-related code in babel.c/packets.c instead of adding a new file - Add blake2s test vectors (new patch 3) - Support supplying mac keys as raw hexadecimal bytes and allow algorithms to validate keys on configure (new patches 4-5) v1: - Add wrapper function to bird sysdep code to pick a suitable source of random bytes - Import reference Blake2 implementations into lib/ - Rename function names and data structures to use an auth_ prefix instead of hmac_ - Perform a separate authentication pass before parsing the packet, and move the authentication-related code to its own source file - Enforce key length recommendation from the specification - Add a 'permissive' configuration mode where outgoing packets are signed but incoming packets are accepted even though they fail authentication - Add user documentation for the authentication configuration, and function docstrings to the main authentication functions - Fix a bunch of nits and code style issues --- Toke Høiland-Jørgensen (8): sysdep: Add wrapper to get random bytes nest: Add Blake2s and Blake2b hash functions mac_test: Add tests for blake2s and blake2b nest: Allow specifying security keys as hex bytes as well as strings config: Allow MAC algorithms to specify a function to validate their keys babel: Refactor TLV parsing code for easier reuse babel: Add MAC authentication support babel: Update RFC references to new standards track RFC8966 conf/cf-lex.l | 31 + conf/conf.h | 5 + conf/confbase.Y | 2 + doc/bird.sgml | 49 +- lib/Makefile | 2 +- lib/blake2-impl.h | 160 ++ lib/blake2-kat.h | 4111 +++++++++++++++++++++++++++++++++++++++++ lib/blake2-ref.h | 112 ++ lib/blake2.c | 48 + lib/blake2.h | 65 + lib/blake2b-ref.c | 270 +++ lib/blake2s-ref.c | 263 +++ lib/mac.c | 35 +- lib/mac.h | 11 + lib/mac_test.c | 91 + lib/string.h | 1 + lib/strtoul.c | 27 + nest/config.Y | 54 +- nest/password.c | 6 + nest/password.h | 1 + proto/babel/Makefile | 2 +- proto/babel/babel.c | 162 +- proto/babel/babel.h | 66 +- proto/babel/config.Y | 42 +- proto/babel/packets.c | 667 ++++++- 25 files changed, 6164 insertions(+), 119 deletions(-) create mode 100644 lib/blake2-impl.h create mode 100644 lib/blake2-kat.h create mode 100644 lib/blake2-ref.h create mode 100644 lib/blake2.c create mode 100644 lib/blake2.h create mode 100644 lib/blake2b-ref.c create mode 100644 lib/blake2s-ref.c

2 15