May 2021 - Bird-users - Mailing Lists

IPv6 BGP & kernel 4.19
by Robert Sander 25 Aug '21

25 Aug '21

Hi, our routers run on Debian stretch with bird 1.6.4 from bird.network.cz/debian. Yesterday I tried kernel 4.19 from backports.debian.org and ran into a weird issue with IPv6 BGP sessions: All Peerings reported "Error: Hold timer expired" ca. every 40 minutes. IPv6 forwarding was flapping all the time. After rebooting into kernel 4.9 everything worked again. IPv4 BGP was not affected and also OSPF (v4 and v6). I could disable all IPv6 BGP peerings on this router and then it forwarded to another router learned via OSPF for IPv6 without issues. Has anyone seen such a behaviour? Regards -- Robert Sander Heinlein Support GmbH Schwedter Str. 8/9b, 10119 Berlin https://www.heinlein-support.de Tel: 030 / 405051-43 Fax: 030 / 405051-19 Amtsgericht Berlin-Charlottenburg - HRB 93818 B Geschäftsführer: Peer Heinlein - Sitz: Berlin

13 39

[PATCH 1/2] Add mips Debian 8 container
by Skyler Mäntysaari 15 Aug '21

15 Aug '21

Hi! I hope that this will work and help with the mips package building. I originially had forgotten to do the pkg gitlab steps too. Please let me know if I can help with that in any other way and disregard the previous patch. This is basically the same one, with both commits. --- .gitlab-ci.yml | 10 ++++++++++ misc/docker/debian-9-mips/Dockerfile | 26 ++++++++++++++++++++++++++ 2 files changed, 36 insertions(+) create mode 100644 misc/docker/debian-9-mips/Dockerfile diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 3642b671..f6a5bb39 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -17,6 +17,7 @@ stages: allow_failure: true script: - $DOCKER_CMD login -u gitlab-ci-token -p $CI_BUILD_TOKEN registry.labs.nic.cz + - $DOCKER_CMD --rm --privileged aptman/qus -s -- -p mips # Make sure we refresh the base image if it updates (eg. security updates, etc) # If we do just the build, cache is always reused and the freshness of the # base image is never checked. However, pull always asks and updates the @@ -52,6 +53,11 @@ docker_debian-9-i386: IMG_NAME: "debian-9-i386" <<: *docker_build +docker_debian-9-mips: + variables: + IMG_NAME: "debian-9-mips" + <<: *docker_build + docker_debian-10-amd64: variables: IMG_NAME: "debian-10-amd64" @@ -248,6 +254,10 @@ build-debian-9-i386: <<: *build-linux image: registry.labs.nic.cz/labs/bird:debian-9-i386 +build-debian-9-mips: + <<: *build-linux + image: registry.labs.nic.cz/labs/bird:debian-9-mips + build-debian-10-amd64: <<: *build-linux image: registry.labs.nic.cz/labs/bird:debian-10-amd64 diff --git a/misc/docker/debian-9-mips/Dockerfile b/misc/docker/debian-9-mips/Dockerfile new file mode 100644 index 00000000..1600011b --- /dev/null +++ b/misc/docker/debian-9-mips/Dockerfile @@ -0,0 +1,26 @@ +FROM multiarch/debian-debootstrap:mips-stretch-slim +ENV DEBIAN_FRONTEND noninteractive +RUN sed -i 's/deb.debian.org/ftp.cz.debian.org/' /etc/apt/sources.list +RUN apt-get -y update +RUN apt-get -y upgrade +RUN apt-get -y --no-install-recommends install \ + build-essential \ + flex \ + bison \ + autoconf \ + ncurses-dev \ + libreadline-dev \ + libssh-gcrypt-dev \ + linuxdoc-tools-latex \ + texlive-latex-extra \ + opensp \ + docbook-xsl \ + xsltproc +RUN apt-get -y --no-install-recommends install \ + git \ + dpkg-dev \ + debhelper \ + quilt \ + python3 \ + python3-pip \ + python3-setuptools -- 2.26.3

2 6

[PATCH v4 0/8] Add MAC authentication support to the Babel protocol
by Toke Høiland-Jørgensen 11 Jun '21

11 Jun '21

This series adds MAC authentication support to the Babel protocol as specified in in RFC8967: https://www.rfc-editor.org/rfc/rfc8967 I have performed basic interoperability testing between this implementation and the current babeld HMAC implementation[1]. The two implementations were able to successfully exchange authenticated messages with both HMAC-256 and Blake2s-256 keys. Given the above, and the fact that the RFC was finally published at the the IETF, I believe this series is ready for merging (subject to review, of course). For those wanting to test the code, a version of Bird with this series applied is available on Github[2] for easy consumption. [1] https://github.com/jech/babeld/pull/52 [2] https://github.com/tohojo/bird/tree/babel-mac-04 Changelog: v4: - Update RFC references to the published RFC numbers (for both MAC and Babel itself). - Rework WALK_TLVS macro to not cast initial argument, and not use goto for framing errors. - Change MAC validation logic to just let algorithms specify min/max len and enforce full key size length even for the smaller-output variants of Blake2. v3: - Add variants with smaller digest sizes for blake2s and blake2b. - Rebase on current master v2: - Don't reinvent AC_CHECK_FUNCS() for configure - Make sure random_bytes() never fails (without taking the whole daemon with it) - Use existing endianness defines in blake2s code - Just leave MAC-related code in babel.c/packets.c instead of adding a new file - Add blake2s test vectors (new patch 3) - Support supplying mac keys as raw hexadecimal bytes and allow algorithms to validate keys on configure (new patches 4-5) v1: - Add wrapper function to bird sysdep code to pick a suitable source of random bytes - Import reference Blake2 implementations into lib/ - Rename function names and data structures to use an auth_ prefix instead of hmac_ - Perform a separate authentication pass before parsing the packet, and move the authentication-related code to its own source file - Enforce key length recommendation from the specification - Add a 'permissive' configuration mode where outgoing packets are signed but incoming packets are accepted even though they fail authentication - Add user documentation for the authentication configuration, and function docstrings to the main authentication functions - Fix a bunch of nits and code style issues --- Toke Høiland-Jørgensen (8): sysdep: Add wrapper to get random bytes nest: Add Blake2s and Blake2b hash functions mac_test: Add tests for blake2s and blake2b nest: Allow specifying security keys as hex bytes as well as strings config: Allow MAC algorithms to specify a function to validate their keys babel: Refactor TLV parsing code for easier reuse babel: Add MAC authentication support babel: Update RFC references to new standards track RFC8966 conf/cf-lex.l | 31 + conf/conf.h | 5 + conf/confbase.Y | 2 + doc/bird.sgml | 49 +- lib/Makefile | 2 +- lib/blake2-impl.h | 160 ++ lib/blake2-kat.h | 4111 +++++++++++++++++++++++++++++++++++++++++ lib/blake2-ref.h | 112 ++ lib/blake2.c | 48 + lib/blake2.h | 65 + lib/blake2b-ref.c | 270 +++ lib/blake2s-ref.c | 263 +++ lib/mac.c | 35 +- lib/mac.h | 11 + lib/mac_test.c | 91 + lib/string.h | 1 + lib/strtoul.c | 27 + nest/config.Y | 54 +- nest/password.c | 6 + nest/password.h | 1 + proto/babel/Makefile | 2 +- proto/babel/babel.c | 162 +- proto/babel/babel.h | 66 +- proto/babel/config.Y | 42 +- proto/babel/packets.c | 667 ++++++- 25 files changed, 6164 insertions(+), 119 deletions(-) create mode 100644 lib/blake2-impl.h create mode 100644 lib/blake2-kat.h create mode 100644 lib/blake2-ref.h create mode 100644 lib/blake2.c create mode 100644 lib/blake2.h create mode 100644 lib/blake2b-ref.c create mode 100644 lib/blake2s-ref.c

2 15

Bird Interference with systemd-networkd
by Marvin Gaube 28 May '21

28 May '21

Hi, on one of my systems, I'm migrating from ifupdown2 to systemd-networkd. The scenario is an wireguard-overlay running OSPF and BGP using bird 2.0.7, and the underlay/public network interface being configured using DHCP and SLAAC. During the setup, I ran into problems with systemd-networkd, which changed the interface state into "Could not set NDisc route: Connection timed out" and loosing the Default WAN Route some time after bird installed the routes. This seems like a problem on a netlink-level etc. - likely on the networkd side, but I wonder if someone on this list had a similar problem. Bugreport and Discussion is ongoing over at systemd github: https://github.com/systemd/systemd/issues/19738 Thanks! Marvin

2 1

BIRD traffic
by Mike Marchal 26 May '21

26 May '21

Hi there, I use BIRD for my personal network and i'm trying to figure out if i can see a traffic consumed per IP somewhere, or create that output to php. Thanks, Best regards, Mike Marchal

3 2

Sticked routers
by Alexey 26 May '21

26 May '21

Hello, my bird is periodicy routes stick. Logs: -- Boot 168108ca9fc345ddaf52baeeaed51516 -- May 26 03:48:51 router systemd[1]: Starting BIRD routing daemon... May 26 03:48:51 router systemd[1]: Started BIRD routing daemon. May 26 03:48:51 router bird[542]: Started May 26 03:48:51 router bird[542]: Next hop address 198.18.2.1 resolvable through recursive route for 0.0.0.0/0 May 26 03:48:51 router bird[542]: Next hop address 2a01:*:*:1::1 resolvable through recursive route for ::/0 May 26 03:48:51 router bird[542]: Next hop address 2a01:*:*:: resolvable through recursive route for ::/0 May 26 03:48:51 router bird[542]: Netlink: Invalid argument May 26 03:48:51 router bird[542]: Netlink: Invalid argument May 26 03:48:52 router bird[542]: Netlink: Invalid argument May 26 03:48:52 router bird[542]: Netlink: Invalid argument May 26 03:48:52 router bird[542]: Netlink: Invalid argument May 26 03:48:52 router bird[542]: ... May 26 03:48:53 router bird[542]: Netlink: Invalid argument May 26 03:48:57 router bird[542]: bfd1: Bad packet from 169.254.100.6 - unknown session id (3861494737) May 26 03:48:57 router bird[542]: bfd1: Bad packet from 169.254.100.6 - unknown session id (3861494737) May 26 03:48:57 router bird[542]: bfd1: Bad packet from 169.254.100.6 - unknown session id (3861494737) May 26 03:48:57 router bird[542]: bfd1: Bad packet from 169.254.100.6 - unknown session id (3861494737) May 26 03:48:57 router bird[542]: bfd1: Bad packet from 169.254.100.6 - unknown session id (3861494737) May 26 03:48:58 router bird[542]: bfd1: Bad packet from 169.254.101.4 - unknown session id (2963707952) May 26 03:48:58 router bird[542]: bfd1: Bad packet from 169.254.101.4 - unknown session id (2963707952) May 26 03:48:58 router bird[542]: bfd1: Bad packet from 169.254.101.4 - unknown session id (2963707952) May 26 03:48:58 router bird[542]: bfd1: Bad packet from 169.254.101.4 - unknown session id (2963707952) May 26 03:48:58 router bird[542]: bfd1: Bad packet from 169.254.101.4 - unknown session id (2963707952) May 26 03:56:10 router bird[542]: Next hop address 2002:c612:78ff:1::6 resolvable through recursive route for ::/0 May 26 07:23:28 router bird[542]: bfd1: Bad packet from 169.254.100.4 - unknown session id (2189589031) May 26 07:23:28 router bird[542]: bfd1: Bad packet from 169.254.100.4 - unknown session id (2189589031) May 26 07:23:28 router bird[542]: bfd1: Bad packet from 169.254.100.4 - unknown session id (2189589031) May 26 07:23:28 router bird[542]: bfd1: Bad packet from 169.254.100.4 - unknown session id (2189589031) May 26 07:23:28 router bird[542]: bfd1: Bad packet from 169.254.100.4 - unknown session id (2189589031) May 26 07:23:28 router bird[542]: bfd1: Bad packet from 169.254.100.4 - unknown session id (2189589031) May 26 07:25:18 router bird[542]: AS4200220007_2: Error: Hold timer expired May 26 07:27:16 router bird[542]: bfd1: Bad packet from 169.254.101.4 - invalid flags (240) Routes received from AS4200220007_2 is not removed from kernel tables. Kernel: 5.12.5-arch1-1 Destribution: Arch Linux

1 0

[PATCH] Add mips Debian 9 container
by Skyler Mäntysaari 24 May '21

24 May '21

I hope that this will help with the mips package building. The mips qemu emulation should be enabled with the: "docker --rm aptman/qus -s -- -p mips" so that it it would even work at all. --- .gitlab-ci.yml | 10 ++++++++++ misc/docker/debian-9-mips/Dockerfile | 26 ++++++++++++++++++++++++++ 2 files changed, 36 insertions(+) create mode 100644 misc/docker/debian-9-mips/Dockerfile diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 3642b671..f6a5bb39 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -17,6 +17,7 @@ stages: allow_failure: true script: - $DOCKER_CMD login -u gitlab-ci-token -p $CI_BUILD_TOKEN registry.labs.nic.cz + - $DOCKER_CMD --rm --privileged aptman/qus -s -- -p mips # Make sure we refresh the base image if it updates (eg. security updates, etc) # If we do just the build, cache is always reused and the freshness of the # base image is never checked. However, pull always asks and updates the @@ -52,6 +53,11 @@ docker_debian-9-i386: IMG_NAME: "debian-9-i386" <<: *docker_build +docker_debian-9-mips: + variables: + IMG_NAME: "debian-9-mips" + <<: *docker_build + docker_debian-10-amd64: variables: IMG_NAME: "debian-10-amd64" @@ -248,6 +254,10 @@ build-debian-9-i386: <<: *build-linux image: registry.labs.nic.cz/labs/bird:debian-9-i386 +build-debian-9-mips: + <<: *build-linux + image: registry.labs.nic.cz/labs/bird:debian-9-mips + build-debian-10-amd64: <<: *build-linux image: registry.labs.nic.cz/labs/bird:debian-10-amd64 diff --git a/misc/docker/debian-9-mips/Dockerfile b/misc/docker/debian-9-mips/Dockerfile new file mode 100644 index 00000000..1600011b --- /dev/null +++ b/misc/docker/debian-9-mips/Dockerfile @@ -0,0 +1,26 @@ +FROM multiarch/debian-debootstrap:mips-stretch-slim +ENV DEBIAN_FRONTEND noninteractive +RUN sed -i 's/deb.debian.org/ftp.cz.debian.org/' /etc/apt/sources.list +RUN apt-get -y update +RUN apt-get -y upgrade +RUN apt-get -y --no-install-recommends install \ + build-essential \ + flex \ + bison \ + autoconf \ + ncurses-dev \ + libreadline-dev \ + libssh-gcrypt-dev \ + linuxdoc-tools-latex \ + texlive-latex-extra \ + opensp \ + docbook-xsl \ + xsltproc +RUN apt-get -y --no-install-recommends install \ + git \ + dpkg-dev \ + debhelper \ + quilt \ + python3 \ + python3-pip \ + python3-setuptools -- 2.26.3

1 0

Re: BIRD packages in Gitlab CI
by Skyler Mäntysaari 21 May '21

21 May '21

Unfortunately, doesn't change the fact that Bird 2.0.8 is not available on mips. The Gitlab CI should be extended to include that too. P.S Do not email me off-list please. On 21/05/2021 8.05, Kees Meijs | Nefos wrote: > On https://packages.debian.org/buster-backports/bird2 you can find all > flavours. > > K. > > On 21-05-2021 06:22, Skyler Mäntysaari wrote: >> Still x86_64 and i386 platforms only. :( >> >> On 20/05/2021 17.18, Ondrej Zajicek wrote: >>> Hello >>> >>> Finally we managed to integrate apkg into Gitlab CI and now we not only >>> have apkg metafiles in the master branch (so anybody can use apkg to >>> build deb or rpm packages for their distribution), but we also have >>> automatic build of packages in Gitlab CI for most mainstream >>> distributions (Debian, Ubuntu, Fedora, CentOS, OpenSUSE), which can be >>> downloaded as artifacts [*] for each commit. Thanks to Jakub Ruzicka and >>> Matous Holinka for some work on this. >>> >>> It is not as comfortable as fully automated and signed public >>> repository, >>> but still better than compile it yourself approach :-). >>> >>> [*] Right side drop menus on https://gitlab.nic.cz/labs/bird/-/pipelines >>>

4 3

config.Y grammar for a new protocol
by Vinod Padmanabhan 21 May '21

21 May '21

Hi, I would like to know how to add a config.Y file for any new protocol in Bird2.0. For example, if my config file looks like: ipv4 table xyz; protocol new { ipv4 { table xyz; import all; export where source = RTS_BGP; }; } How will the corresponding grammar look like? Thanks, Vinod

2 1

BIRD packages in Gitlab CI
by Ondrej Zajicek 21 May '21

21 May '21

Hello Finally we managed to integrate apkg into Gitlab CI and now we not only have apkg metafiles in the master branch (so anybody can use apkg to build deb or rpm packages for their distribution), but we also have automatic build of packages in Gitlab CI for most mainstream distributions (Debian, Ubuntu, Fedora, CentOS, OpenSUSE), which can be downloaded as artifacts [*] for each commit. Thanks to Jakub Ruzicka and Matous Holinka for some work on this. It is not as comfortable as fully automated and signed public repository, but still better than compile it yourself approach :-). [*] Right side drop menus on https://gitlab.nic.cz/labs/bird/-/pipelines -- Elen sila lumenn' omentielvo Ondrej 'Santiago' Zajicek (email: santiago(a)crfreenet.org) OpenPGP encrypted e-mails preferred (KeyID 0x11DEADC3, wwwkeys.pgp.net) "To err is human -- to blame it on a computer is even more so."

2 1