December 2021 - Bird-users

Invalid NEXT_HOP attribute for OSPF known route
by Nico Schottelius 16 Dec '21

16 Dec '21

Hello, every year or then bird is putting me into the Invalid NEXT_HOP message. TL;DR: Why does bird on router1+router2 refuse the route 2a0a:e5c0:0:12:b01a:5ae3:1bd4:1e00/122 via 2a0a:e5c0::225:90ff:fe1e:3e62 even though router1+router2 know how to reach 2a0a:e5c0::/64 via fe80::20d:b9ff:fe57:2f91 by means of ospf? In detail: router1, router2 are peered to apu-router1,apu-router2 via OSPF + BGP. apu-router1,apu-router2 are peered to a set of kubernetes hosts. The goal is to have router1 + router2 import the routes sent by the kubernetes hosts: router1 router2---------| | \ | | | \ | | | \ | | apu-router1 apu-router2 | . | . | |-------------------------- . . [ kubernetes cluster via apu-routers ] The problem: router1+router reject the routes with: Dec 14 20:33:51 router1 daemon.err bird: apu_router1_place5_ungleich_ch_v6: Invalid NEXT_HOP attribute The setup: router1, router2, apu-router1, apu-router2 = ASN209898 kubernetes hosts = ASN65533 kubernetes peers with apu-routers only. The routes: Kubernetes announces parts of 2a0a:e5c0:0:12::/64 and 2a0a:e5c0:0:13::/64, for instance the route 2a0a:e5c0:0:12:b01a:5ae3:1bd4:1e00/122. Kubernetes nodes live in 2a0a:e5c0::/64. apu-routers have a leg in 2a0a:e5c0::/64, via eth1.2. They reach the cluster directly. They have the routes. routers1+2 receive the route for 2a0a:e5c0::/64 via ospf: bird> show route 2a0a:e5c0::/64 Table master6: 2a0a:e5c0::/64 unicast [ospf6 17:08:18.515] * I (150/20) [0.0.0.47] via fe80::20d:b9ff:fe57:2f91 on bond0.8 Thus routers *can* reach the kubernetes cluster. The apu-routers: - They import the route [0] - They export the route to the routers [1] The routers: - print 4x the Invalid NEXT_HOP attribute, once per exported kubernetes network - They ignore the 4 routes [2] Question: why does bird on the routers not accept the routes? Or is there a different problem I am not seeing? Aside from that, shouldn't bird on the apu-routers set itself as nexthop for the kubernetes routes? Any help appreciated. Best regards, Nico [0] [20:29] apu-router2.place5:~# birdc show route 2a0a:e5c0:0:12:b01a:5ae3:1bd4:1e00/122 BIRD 2.0.8 ready. Table master6: 2a0a:e5c0:0:12:b01a:5ae3:1bd4:1e00/122 unicast [k8s_p5_1_4 19:16:10.910 from 2a0a:e5c0::225:90ff:fe1e:3e74] * (100) [AS65533i] via 2a0a:e5c0::225:90ff:fe1e:3e62 on eth1.2 unicast [k8s_p5_1_3 19:16:10.910 from 2a0a:e5c0::225:90ff:fe1a:d680] (100) [AS65533i] via 2a0a:e5c0::225:90ff:fe1e:3e62 on eth1.2 unicast [k8s_p5_1_5 19:16:10.909] (100) [AS65533i] via 2a0a:e5c0::225:90ff:fe1e:3e62 on eth1.2 unicast [k8s_p5_1_1 19:16:10.910 from 2a0a:e5c0::225:90ff:fe1a:d682] (100) [AS65533i] via 2a0a:e5c0::225:90ff:fe1e:3e62 on eth1.2 unicast [k8s_p5_1_2 19:16:10.910 from 2a0a:e5c0::225:90ff:fe1e:3e64] (100) [AS65533i] via 2a0a:e5c0::225:90ff:fe1e:3e62 on eth1.2 unicast [k8s_p5_1_6 19:16:10.910 from 2a0a:e5c0::225:90ff:fe1e:62d6] (100) [AS65533i] via 2a0a:e5c0::225:90ff:fe1e:3e62 on eth1.2 [20:42] apu-router2.place5:~# [1] [20:43] apu-router2.place5:~# birdc show protocol all router1_place5_ungleich_ch_v6 BIRD 2.0.8 ready. Name Proto Table State Since Info router1_place5_ungleich_ch_v6 BGP --- up 20:29:06.203 Established BGP state: Established Neighbor address: 2a0a:e5c0:1:8::3 Neighbor AS: 209898 Local AS: 209898 Neighbor ID: 147.78.195.249 Local capabilities Multiprotocol AF announced: ipv6 Route refresh Graceful restart 4-octet AS numbers Enhanced refresh Long-lived graceful restart Neighbor capabilities Multiprotocol AF announced: ipv6 Route refresh Graceful restart 4-octet AS numbers Enhanced refresh Long-lived graceful restart Session: internal AS4 Source address: 2a0a:e5c0:1:8::47 Hold timer: 175.206/240 Keepalive timer: 53.629/80 Channel ipv6 State: UP Table: master6 Preference: 100 Input filter: REJECT Output filter: ungleich_networks_no_igp Routes: 0 imported, 6 exported, 0 preferred Route change stats: received rejected filtered ignored accepted Import updates: 98 0 98 0 0 Import withdraws: 3 0 --- 3 0 Export updates: 35 0 29 --- 6 Export withdraws: 0 --- --- --- 0 BGP Next hop: 2a0a:e5c0:1:8::47 fe80::20d:b9ff:fe49:a705 [2] bird> show protocol all apu_router2_place5_ungleich_ch_v6 Name Proto Table State Since Info apu_router2_place5_ungleich_ch_v6 BGP --- up 20:29:06.189 Established BGP state: Established Neighbor address: 2a0a:e5c0:1:8::47 Neighbor AS: 209898 Local AS: 209898 Neighbor ID: 0.0.0.47 Local capabilities Multiprotocol AF announced: ipv6 Route refresh Graceful restart 4-octet AS numbers Enhanced refresh Long-lived graceful restart Neighbor capabilities Multiprotocol AF announced: ipv6 Route refresh Graceful restart 4-octet AS numbers Enhanced refresh Long-lived graceful restart Session: internal AS4 Source address: 2a0a:e5c0:1:8::1 Hold timer: 157.409/240 Keepalive timer: 45.770/80 Channel ipv6 State: UP Table: master6 Preference: 100 Input filter: ungleich_networks Output filter: ungleich_networks_no_igp Routes: 2 imported, 101 exported, 1 preferred Route change stats: received rejected filtered ignored accepted Import updates: 2 0 0 0 2 Import withdraws: 4 0 --- 4 0 Export updates: 140674 8 140565 --- 101 Export withdraws: 334 --- --- --- 0 BGP Next hop: 2a0a:e5c0:1:8::1 fe80::a236:9fff:fe08:a780 -- Sustainable and modern Infrastructures by ungleich.ch

2 5

using BIRD as route reflector - add paths option not working?
by mike＠routerpro.ca 15 Dec '21

15 Dec '21

Hello, I am using bird as a RR and have set the add paths tx; option, however I am still only seeing best path being advertised. ==== protocol bgp RR_Client_IPv4 { local my_ip as my_as; neighbor range rr_ipv4_range internal; rr client; rr cluster id cluster_id; capabilities on; dynamic name "RR_Client_IPv4_"; dynamic name digits 2; ipv4 { add paths tx; import filter Internal_In_Route_Reflector; export filter Internal_Out_Route_Reflector_default; }; } ==== show protocols all shows that ADD-PATH is enabled. I also have it enabled RX on the RR clients ADD-PATH RX: TX: ipv4 === 3 routes present , with one marked as BEST: bird> show route x.x.x.x/32 Table master4: x.x.x.x/32 unreachable [RR_Client_IPv4_03 2021-12-15 21:05:36 from y.y.y.y] * (100) [AS4200001111?] unreachable [RR_Client_IPv4_05 2021-12-15 21:05:35 from y.y.y.x] (100) [AS4200001111?] unreachable [RR_Client_IPv4_01 2021-12-15 21:05:16 from y.y.y.z] (100) [AS4200000110?] === 1 BEST route advertised to RR client: bird> show route export RR_Client_IPv4_01 x.x.x.x/32 Table master4: x.x.x.x/32 unreachable [RR_Client_IPv4_03 2021-12-15 21:05:36 from y.y.y.y] (100) [AS4200001111?] Is this expected behavior even with add paths enabled? I was expecting all 3 routes to be advertised to RR client.

2 1

[PATCH] BGP: Log value of invalid NEXT_HOP in bgp_apply_next_hop()
by Simon Ruderich 15 Dec '21

15 Dec '21

--- Hello, while debugging "Invalid NEXT_HOP attribute" messages in my setup I had to recompile bird2 with additional debug output to determine which BAD_NEXT_HOP line was triggered and with which NEXT_HOP value. After adding this patch determining the problem was very easy. I also looked at the other BAD_NEXT_HOP in the file but I'm not sure how to properly print their values. Regards Simon proto/bgp/packets.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/proto/bgp/packets.c b/proto/bgp/packets.c index 99b5d5b4..830a2060 100644 --- a/proto/bgp/packets.c +++ b/proto/bgp/packets.c @@ -955,7 +955,7 @@ bgp_apply_next_hop(struct bgp_parse_state *s, rta *a, ip_addr gw, ip_addr ll) nbr = neigh_find(&p->p, ll, p->neigh->iface, 0); if (!nbr || (nbr->scope == SCOPE_HOST)) - WITHDRAW(BAD_NEXT_HOP); + WITHDRAW(BAD_NEXT_HOP " %I (direct)", gw); a->dest = RTD_UNICAST; a->nh.gw = nbr->addr; @@ -965,7 +965,7 @@ bgp_apply_next_hop(struct bgp_parse_state *s, rta *a, ip_addr gw, ip_addr ll) else /* GW_RECURSIVE */ { if (ipa_zero(gw)) - WITHDRAW(BAD_NEXT_HOP); + WITHDRAW(BAD_NEXT_HOP " %I (recursive)", gw); rtable *tab = ipa_is_ip4(gw) ? c->igp_table_ip4 : c->igp_table_ip6; s->hostentry = rt_get_hostentry(tab, gw, ll, c->c.table); -- 2.34.1 -- + privacy is necessary + using gnupg http://gnupg.org + public key id: 0x92FEFDB7E44C32F9

2 1

OSPF/general question: Using v6 next-hop for v4 routes
by Sebastian Hahn 10 Dec '21

10 Dec '21

Hi there, I've been trying to remove v4 transit nets from my setup. This seems to work well for BGP (both eBGP and iBGP) - I have routes for all external v4 addresses with the appropriate next hop set. For my internal routing, I'm using OSPF, but it seems OSPF does not allow v6 next hops for v4 routes. Checking RFC 5838 seems to imply that this is a general design choice for OSPF, but I am not sure if my reading is correct. Also, are there any practical drawbacks for this kind of setup that I may have missed when choosing it for BGP? Thanks, also for any pointers how to achieve the intended setup! Sebastian

2 2

how to do IPv6 address assignment (eBGP --> iBGP --> home/lan)
by Nicolas Embriz 01 Dec '21

01 Dec '21

Hi, I manage to configure, establish a session and announce my prefix with this configuration: --- log "/var/log/bird.log" all; router id <ipv4>; define MYAS = 1234; protocol device { scan time 10; } protocol direct { ipv6; interface "dummy*"; } # templates template bgp uplink { local as MYAS; ipv6 { import all; export filter { if net = <ipv6::/44> then accept; reject; }; }; graceful restart on; } protocol bgp SBv6 from uplink { neighbor <ipv6> a as 12345; source address <myipvy>; } --- For testing I added to eth0 an IPv6 address alias belonging to my /44 segment, I was available to ping and so far all good, but now something that I am struggling with (probably something very basic) is how to do IP address assignment to my network from the router? This router is a VM but I would like to know how I could use a /64 subnet and assign IP's to my home network. Probably I am following the wrong approach, but I wanted to give a try creating an internal router (iBGP) and announce only the /64 subnet, I am using wireguard to connect the VM's but can't find a way to ping any IP I assign in this VM, something like this (internet) | | ( VM eBGP/44 ) <--- Wireguard ---> (VM iBGP/64) <----> HOME/LAN (/64) this is my config: log "/var/log/bird.log" all; router id <ipv4>; define MYAS = 1234; protocol device { scan time 10; } protocol direct { ipv6; interface "dummy*"; } template bgp iAS { local as MYAS; ipv6 { import all; export filter { if net = <ipv6::/64> then accept; reject; }; }; graceful restart on; } protocol bgp iBGP from iAS { debug all; neighbor <peer wireguard ipv6>%wg0 as MYAS; direct; source address <wireguard ipv6>; } The session gets established but only from the eBGP I can ping the iBGP but not the other way around or from other hosts. Probably I may be over-complicating things, and I could do everything from the main router but is that the case, still wondering how can I then start to assign IPv6's address to my home network? should I configure something like radvd so that my devices can claim an IPv6? I am doing this just for learning purposes, so if there is a better way or practice to follow let me know. regards.

2 3

Quick suggestion about enable/disable protocol
by bird21＠sensation.net.au 01 Dec '21

01 Dec '21

Hi, Is this list the place to discuss feature requests? Please let me know if there's somewhere more appropriate. Re enable/disable <prot> available in CLI, but not config: 1. Allow enable/disable to be part of the config, so that a protocol can be disabled by default, and needs a manual poke via CLI command to enable it. For example, a backup session that will only be enabled when the main link is down. 2a. When reloading config, preserve the current state of a protocol that has been disabled. (I'm trying to debug a config, which involves disabling a particular BGP session, but every time I reload config BIRD re-enables the session.) 2b. An explicit "enable" directive in config (see #1) could also be used to make it clear that a reload *should* enable this protocol regardless of its previous state. Thanks!

3 4