May 2021 - Bird-users - Mailing Lists

Exact Definition of numbers-match bitmask-match and fragmentation-type
by Matt Corallo 18 May '21

18 May '21

The match classifiers for flowspec (numbers-match bitmask-match and fragmentation-type) don't appear to be exactly specified in the documentation anywhere. eg 1) Based on the grouping in the examples, I'd think && and || are parsed first, followed by , and .. ie 1 && 2,3 means 1 AND (two OR three) not (1 AND 2) or 3. Same would apply for fragmentation-type, which makes the spacing in the flow4 example somewhat confusing, though obviously it doesn't change the logic given its all ORs. 2) What are the full list of possible operators? From the examples there is at least <, <=, >, >=, &&, ||, ",", .., and !. 3) I can make a pretty good guess as to what each operator means, but it doesn't seem to be written down anywhere. Separately, the documentation seems to indicate dscp applies for both IPv4 flowspec as well as IPv6 flowspec as-is, however this is somewhat confusing - is DSCP intended to match on v4 ECN bits as well, or is the expected length of DSCP simply 8 bits instead for v6 and matched against the traffic class? Finally, and I suppose this is an RFC question not a BIRD question, how does the fragment field interact with the next header field in v6 - I assume a router is expected to parse a fragment header before checking next header, irrespective of the fragment bits (unless they require all bits unset)? Thanks, Matt

4 19

[PATCH] Filter: Add MPLS label route attribute
by Trisha Biswas 17 May '21

17 May '21

Hi all, While BIRD 2.x has underlying support for MPLS (applying labels to static routes and syncing with kernel), there is no option to set labels via configuration. The attached patch adds support to set or read labels using filters. Currently this supports the addition of one label per route, and can be extended to stacked labels in future. Please let me know if you have any questions. Thank you, Trisha -- *Trisha Biswas* | Sr. Software Engineer, Network Systems fastly.com | @fastly <https://twitter.com/fastly> | LinkedIn <http://www.linkedin.com/company/fastly>

2 3

BIRD2 in Debian Backports
by Kees Meijs | Nefos 17 May '21

17 May '21

Hi list, For those Debian purists like myself: BIRD2 is in Debian Backports! Unfortunately it's version 2.0.7 and not 2.0.8 but it's a leap forward I guess. Please see https://packages.debian.org/buster-backports/bird2 Cheers, Kees -- https://nefos.nl/contact <https://nefos.nl/contact> Nefos IT bv Ambachtsweg 25 (industrienummer 4217) 5627 BZ Eindhoven Nederland KvK 66494931 /Bereikbaar op maandag, dinsdag, woensdag en vrijdag tussen 09:00u en 17:00u./

1 0

Using bird 1.x
by Peter Mitchell 13 May '21

13 May '21

Hello, I am researching BIRD 1.x for my computer science security in an open-source project and I noticed that its last update was in late 2019. I want to understand it from a maintenance perspective and I would like to know if security bugs found in 2.x will be looked into for 1.x and backported to the 1.x branch. Sorry if this has already been asked, I read through some FAQs and search past messages, but if I missed something please point me to it. Thanks, Peter M

2 1

textfsm json template examples
by Logan Rawlins 11 May '21

11 May '21

Like many of you on this list i've seen many running into issues needing json output from bird. For now i'm getting through this using textfsm and then adding the headers to the output creating dict lists of routes or other info from bird. This is probably the easiest method for parsing bird output into json hopefully this is of use to some on this list. <snip> def _parse_bird_output(cls, template, text): template='textfsm/' + template with open(template) as f: fsmtemplate = textfsm.TextFSM(f) header = fsmtemplate.header parsedtext = fsmtemplate.ParseText(text) output = [] for item in parsedtext: output.append(dict(zip(header,item))) return json.dumps(output) </snip> <routedetail.textfsm> Value Required Route (\d+\.\d+\.\d+\.\d+\/\d+|([0-9a-f]{0,4}:){2,7}[0-9a-f]{0,4}/\d{1,3}) Value Neighbor ((\w|\.)+) Value Age (\d+-\d+-\d+ \d+:\d+:\d+) Value NeiIP (\d+\.\d+\.\d+\.\d+) Value OriginAS (\d+) Value Filldown Table (.+) Value BGP_origin (\w+) Value BGP_aspath (.+) Value BGP_nexthop (\d+\.\d+\.\d+\.\d+) Value BGP_localpref (\d+) Value BGP_community (.+) Value BGP_med (\d+) Start ^Table ${Table}: ^${Route}.*\[${Neighbor} ${Age} from ${NeiIP}\].*\[AS${OriginAS}.\] ^\s+BGP.origin: ${BGP_origin} ^\s+BGP.as_path: ${BGP_aspath} ^\s+BGP.next_hop: ${BGP_nexthop} ^\s+BGP.med: ${BGP_med} ^\s+BGP.local_pref: ${BGP_localpref} -> CommCheck CommCheck ^\s+BGP.community: ${BGP_community} -> Record Start # input buffer line doesn't have BGP.community in it, go on to the next rule(s) but save ^\s*((?!BGP.community).)* -> Continue.Record # check for the start of new table or route and move back to initial state ^Table ${Table}: -> Start ^${Route}.*\[${Neighbor} ${Age} from ${NeiIP}\].*\[AS${OriginAS}.\] -> Start </routedetail.textfsm> <routes.textfsm> Value Filldown Table (.+) Value Required Route (\d+\.\d+\.\d+\.\d+\/\d+|([0-9a-f]{0,4}:){2,7}[0-9a-f]{0,4}/\d{1,3}) Value Neighbor ((\w|\.)+) Value NeiIP (\d+\.\d+\.\d+\.\d+) Value Age (\d+-\d+-\d+ \d+:\d+:\d+) Value OriginAS (\d+) Start ^BIRD \d+\.\d+\.\d+ ready. -> RTable RTable ^Table ${Table}: -> Record ^${Route}.*\[${Neighbor} ${Age} from ${NeiIP}\].*\[AS${OriginAS}.\] -> Record ^Table -> Start </routes.textfsm> <routecount.textfsm> Value Table (\S+) Value Routes (\d+) Value Total (\d+) Value Networks (\d+) Value Tables (\d+) Start ^${Routes} of ${Total} routes for ${Networks} networks in table ${Table} -> Record ^Total: ${Routes} of ${Total} routes for ${Networks} networks in ${Tables} tables -> Record </routecount.textfsm>

1 1

BIRD 2.0.8 packaging update
by Jakub Ružička 10 May '21

10 May '21

Hello BIRD Community! Latest bird-2.0.8 is available from most current downstream distro repos including: * Arch * EPEL/CentOS * Fedora * Gentoo * Manjaro * NixOS * OpenBSD You can use repology to get an overview: https://repology.org/project/bird/versions # Debian Debian is currently in Hard Freeze before 11/Bullseye release and thus updating bird2 package to 2.0.8 is problematic (it lacks autopkgtests): https://release.debian.org/bullseye/freeze_policy.html#hard Current Maintainer of Debian bird2 package Ondřej Surý has agreed to pass the maintenance to me but I don't have access yet. Once I gain it I'll release bird2-2.0.8 in experimental and eventually keep debian/master up-to-date after the freeze ends. The Community is also working on providing Debian backports for Debian stable. Until proper downstream packages are ready, I've prepared upstream packages for Debian 9, 10 and 11 in new bird-latest OBS repos: https://download.opensuse.org/repositories/home:/CZ-NIC:/bird-latest/ However, OBS "Download Package" link is currently missing instructions for Debian for some reason: https://software.opensuse.org//download.html?project=home%3ACZ-NIC%3Abird-l… It's either a bug in OBS or a slow propagation of new repo. I'm trying to resolve this on #opensuse-buildservice but for now you're left to your Debian-fu in enabling these repos. # Ubuntu I've updated BIRD launchpad PPA with upstream bird2-2.0.8 packages for all current Ubuntu releases: https://launchpad.net/~cz.nic-labs/+archive/ubuntu/bird I've tested all of these packages lightly on respective Ubuntu VMs. They installed successfully and bird service started. Ubuntu uses Debian bird packages so once they're updated in Debian, Ubuntu downstream should pick them up. # openSUSE bird-2.0.8 is available from openSUSE Tumbleweed. I've prepared new bird-latest OBS to cover remaining SUSE platforms: https://build.opensuse.org/package/show/home:CZ-NIC:bird-latest/bird Please use "Download Package" link (top right) to enable: https://software.opensuse.org//download.html?project=home%3ACZ-NIC%3Abird-l… # upstream packaging All the upstream packages were created from official 2.0.8 archive using modified downstream sources from Debian and Fedora. Please note that I had to disable -docs subpackages to get working builds on older systems as well as other tweaks like relaxing deps. I've prepared an upstream MR adding packaging in apkg format directly to upstream repo: https://gitlab.nic.cz/labs/bird/-/merge_requests/25 In short it allows building upstream packages directly from upstream sources or from upstream archives(tarballs) or combination of both, see more info in the MR. More work is required for building from sources, but I was able to use apkg to create packages for different .deb/.rpm distros from official upstream archives. Best Regards, Jakub Ružička CZ.NIC packager 📦

2 4

[PATCH] babel: Log the reason when refusing to run on an interface
by Toke Høiland-Jørgensen 10 May '21

10 May '21

The babel protocol code checks various properties of an interface before starting it: whether the interface is up, whether it supports multicast, and whether it has a link-local address assigned. However, it doesn't give any feedback if any of those checks fail, it just silently ignores the interface. Fix this by explicitly logging errors when any of the checks fail; to avoid spamming the logs for all interfaces on the system, move the checks so they are only performed after it was determined that an interface is actually configured by an interface pattern. Reported-by: Stefan Haller <stefan.haller(a)stha.de> Signed-off-by: Toke Høiland-Jørgensen <toke(a)toke.dk> --- proto/babel/babel.c | 50 ++++++++++++++++++++++++--------------------- 1 file changed, 27 insertions(+), 23 deletions(-) diff --git a/proto/babel/babel.c b/proto/babel/babel.c index 4b6b9d7f9f6f..6ac3bb6a7fec 100644 --- a/proto/babel/babel.c +++ b/proto/babel/babel.c @@ -1639,6 +1639,29 @@ babel_remove_iface(struct babel_proto *p, struct babel_iface *ifa) rfree(ifa->pool); /* contains ifa itself, locks, socket, etc */ } +static int iface_is_valid(struct babel_proto *p, struct iface *iface) +{ + if (!(iface->flags & IF_UP)) { + log(L_ERR "%s: Interface '%s' is down", p->p.name, iface->name); + return 0; + } + + if (!(iface->flags & IF_MULTICAST)) { + log(L_ERR "%s: Interface '%s' does not support multicast", + p->p.name, iface->name); + return 0; + } + + /* We need a link-local address to communicate */ + if (!iface->llv6) { + log(L_ERR "%s: Interface '%s' has no link-local address assigned", + p->p.name, iface->name); + return 0; + } + + return 1; +} + static void babel_if_notify(struct proto *P, unsigned flags, struct iface *iface) { @@ -1655,19 +1678,8 @@ babel_if_notify(struct proto *P, unsigned flags, struct iface *iface) if (ifa) babel_remove_iface(p, ifa); - if (!(iface->flags & IF_UP)) - return; - - /* We only speak multicast */ - if (!(iface->flags & IF_MULTICAST)) - return; - - /* Ignore ifaces without link-local address */ - if (!iface->llv6) - return; - struct babel_iface_config *ic = (void *) iface_patt_find(&cf->iface_list, iface, NULL); - if (ic) + if (ic && iface_is_valid(p, iface)) babel_add_iface(p, iface, ic); return; @@ -1733,20 +1745,12 @@ babel_reconfigure_ifaces(struct babel_proto *p, struct babel_config *cf) WALK_LIST(iface, iface_list) { - if (!(iface->flags & IF_UP)) - continue; - - /* Ignore non-multicast ifaces */ - if (!(iface->flags & IF_MULTICAST)) - continue; - - /* Ignore ifaces without link-local address */ - if (!iface->llv6) - continue; - struct babel_iface *ifa = babel_find_iface(p, iface); struct babel_iface_config *ic = (void *) iface_patt_find(&cf->iface_list, iface, NULL); + if (ic && !iface_is_valid(p, iface)) + continue; + if (ifa && ic) { if (babel_reconfigure_iface(p, ifa, ic)) -- 2.31.1

2 1

[PATCH] sysdep/bsd: propagate OS-level IFF_MULTICAST to internal IF_MULTICAST flag
by Toke Høiland-Jørgensen 10 May '21

10 May '21

The BSD code did not propagate the OS-level IFF_MULTICAST flag to the Bird-internal IF_MULTICAST flag, which causes problems with Wireguard interfaces on FreeBSD. The Linux sysdep code does propagate the flag already, so just copy over the same check and flag update. Tested-by: Stefan Haller <stefan.haller(a)stha.de> Signed-off-by: Toke Høiland-Jørgensen <toke(a)toke.dk> --- sysdep/bsd/krt-sock.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sysdep/bsd/krt-sock.c b/sysdep/bsd/krt-sock.c index c2faa23dd44f..cd89544063c7 100644 --- a/sysdep/bsd/krt-sock.c +++ b/sysdep/bsd/krt-sock.c @@ -665,6 +665,9 @@ krt_read_ifinfo(struct ks_msg *msg, int scan) else f.flags |= IF_MULTIACCESS; /* NBMA */ + if (fl & IFF_MULTICAST) + f.flags |= IF_MULTICAST; + iface = if_update(&f); if (!scan) -- 2.31.1

2 1

ospf ptp link sending unicast packets instead of multicast; peer address config not required
by Senthil Kumar Nagappan 10 May '21

10 May '21

Hi, I did sent this message a week back but I could not see it in the mailing, moreover just now subscribed to this mailing list, so sending this again. I’m seeing some issues with ospf adj over ptpnumbered/unnumbered interface. 1. Forp2p connections, ospf should be sending only multicast packets toallospfrouters, but I see its sending to unicast address. (From RFC “On physical point-to-point networks, theIP destination is always set to the address AllSPFRouters”) 2. Forptp over unnumbered interface, bird requires peer address configuration whichis not required from the ospf perspective. Because bird is using peer addressand sending unicast packets, bird cannot form multiple ospf adj over ptpunnumbered interface between 2 endpoints using same peer address. Made some quick changes and have attached the patch thataddresses the issues. Relaxed the source ip address validation for ptp link inpacket.c for now. More validation can be added to make it complete. Thanks and Regards,Senthil

3 23

Loopback interface as OSPF stub interface (IPv6)
by Kenth Eriksson 07 May '21

07 May '21

Tried setting a loopback interface as an IPv6 OSPF stub interface, but this is not picked up as an OSPF interface. Doing the same on IPv4 loopback interface picks it up as an OSPF interface and announcing it as a stub in the area. Why not for IPv6? Thanks, Kenth

3 5