August 2021 - Bird-users

BIRD Debian Repo signing keys need updating
by Laura Smith 16 Aug '21

16 Aug '21

See https://github.com/oerdnj/deb.sury.org/issues/1325 which highlights wrong keys being published. TL;DR - @oerdnj left cz.nic three years ago but you are still publishing wrong keys on the repo ?

2 2

[PATCH 1/2] Add mips Debian 8 container
by Skyler Mäntysaari 15 Aug '21

15 Aug '21

Hi! I hope that this will work and help with the mips package building. I originially had forgotten to do the pkg gitlab steps too. Please let me know if I can help with that in any other way and disregard the previous patch. This is basically the same one, with both commits. --- .gitlab-ci.yml | 10 ++++++++++ misc/docker/debian-9-mips/Dockerfile | 26 ++++++++++++++++++++++++++ 2 files changed, 36 insertions(+) create mode 100644 misc/docker/debian-9-mips/Dockerfile diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 3642b671..f6a5bb39 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -17,6 +17,7 @@ stages: allow_failure: true script: - $DOCKER_CMD login -u gitlab-ci-token -p $CI_BUILD_TOKEN registry.labs.nic.cz + - $DOCKER_CMD --rm --privileged aptman/qus -s -- -p mips # Make sure we refresh the base image if it updates (eg. security updates, etc) # If we do just the build, cache is always reused and the freshness of the # base image is never checked. However, pull always asks and updates the @@ -52,6 +53,11 @@ docker_debian-9-i386: IMG_NAME: "debian-9-i386" <<: *docker_build +docker_debian-9-mips: + variables: + IMG_NAME: "debian-9-mips" + <<: *docker_build + docker_debian-10-amd64: variables: IMG_NAME: "debian-10-amd64" @@ -248,6 +254,10 @@ build-debian-9-i386: <<: *build-linux image: registry.labs.nic.cz/labs/bird:debian-9-i386 +build-debian-9-mips: + <<: *build-linux + image: registry.labs.nic.cz/labs/bird:debian-9-mips + build-debian-10-amd64: <<: *build-linux image: registry.labs.nic.cz/labs/bird:debian-10-amd64 diff --git a/misc/docker/debian-9-mips/Dockerfile b/misc/docker/debian-9-mips/Dockerfile new file mode 100644 index 00000000..1600011b --- /dev/null +++ b/misc/docker/debian-9-mips/Dockerfile @@ -0,0 +1,26 @@ +FROM multiarch/debian-debootstrap:mips-stretch-slim +ENV DEBIAN_FRONTEND noninteractive +RUN sed -i 's/deb.debian.org/ftp.cz.debian.org/' /etc/apt/sources.list +RUN apt-get -y update +RUN apt-get -y upgrade +RUN apt-get -y --no-install-recommends install \ + build-essential \ + flex \ + bison \ + autoconf \ + ncurses-dev \ + libreadline-dev \ + libssh-gcrypt-dev \ + linuxdoc-tools-latex \ + texlive-latex-extra \ + opensp \ + docbook-xsl \ + xsltproc +RUN apt-get -y --no-install-recommends install \ + git \ + dpkg-dev \ + debhelper \ + quilt \ + python3 \ + python3-pip \ + python3-setuptools -- 2.26.3

2 6

bird 2.0.8 ignores local routes during import?
by Tim Meusel 12 Aug '21

12 Aug '21

Hi, I'm running bird 2.0.8 on Arch Linux: I would like to import local device routes and export them via BGP. My assumption is that the direct protocol would be required here? My config looks like this: router id 192.168.178.35; debug protocols all; log syslog { debug, trace, info, remote, warning, error, auth, fatal, bug }; timeformat protocol iso long; protocol device { scan time 10; interface "uplink" { preferred 192.168.178.35; }; } protocol kernel kernelv4 { learn; persist; scan time 20; ipv4 { import all; export filter { if source = RTS_STATIC then reject; krt_prefsrc = OWNIP; accept; }; }; } protocol direct { ipv4; ipv6; interface "uplink"; } The box has a few local routes: # ip -4 r s default via 192.168.178.1 dev enp3s0 proto dhcp src 192.168.178.35 metric 1024 169.254.0.7 dev as3668-1 proto kernel scope link src 169.254.0.8 169.254.0.9 dev as3668-2 proto kernel scope link src 169.254.0.10 172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown 192.168.178.0/24 dev enp3s0 proto kernel scope link src 192.168.178.35 metric 1024 192.168.178.1 dev enp3s0 proto dhcp scope link src 192.168.178.35 metric 1024 But it looks like the direct protocol doesn't import any routes and via the kernel I don't get theh route for 192.168.178.0/24? root@server ~ # birdc show route protocol device1 BIRD 2.0.8 ready. No valid tables root@server ~ # birdc show route protocol kernelv4 BIRD 2.0.8 ready. Table master4: 0.0.0.0/0 unicast [kernelv4 2021-08-08] * (10) via 192.168.178.1 on enp3s0 192.168.178.1/32 unicast [kernelv4 2021-08-08] * (10) dev enp3s0 root@server ~ # any clues why I don't see see "192.168.178.0/24 dev enp3s0" route in bird? Cheers, Tim

1 1

BIRD Setup for B.A.T.M.A.N. Advanced network.
by Maurice Smulders 06 Aug '21

06 Aug '21

Network description (simplest form) Two internet gateways GW1: 192.168.30.1/24, DHCP Range 192.168.30.10 ... 192.168.30.39 GW2: 192.168.30.2/24, DHCP Range 192.168.30.40... 192.168.30.70 Both GWs are connected to internet, and are running DNSMasq Client: does a DHCP Request, happens to get 192.168.30.56 , so from GW2 Failure scenarios - GW2 goes down fully - Upstream internet link to GW2 is severed Can BIRD be used to deal with this, i.e. for example have a script / bird ping some known Internet DNS servers, like Google's 8.8.8.8 and 8.8.4.4 and force the client to switch over to GW1 to get a valid internet connection again as fast as possible? For simplicity, I'm looking at RIPv2 - network is small enough, or should I use OSPF? I'm looking for some suggestions/recommendations... Maurice

3 2

BIRD Debian repo instructions need updating to reflect best-practice
by Laura Smith 05 Aug '21

05 Aug '21

Re: https://bird.network.cz/?download&tdir=debian/ The instructions presented are not inline with Debian best-practices. As per https://wiki.debian.org/DebianRepository/UseThirdParty: "The key MUST be downloaded over a secure mechanism like HTTPS to a location only writable by root, which SHOULD be /usr/share/keyrings. The key MUST NOT be placed in /etc/apt/trusted.gpg.d or loaded by apt-key add. A sources.list entry SHOULD have the signed-by option set. The signed-by entry MUST point to a file, and not a fingerprint."

1 0

Bird Constant replacement of prefix
by Van Dyk, Donovan 04 Aug '21

04 Aug '21

Hello, Is anyone able to share some insight into the meaning of the following log lines? I can’t find it anymore, but I think this was related to export data. If this is export data, why is it constantly being replaced? Aug 4 14:15:42 a10-1-1-1 bird: router < replaced 10.12.1.0/24 via 10.200.168.220 on bbforward Aug 4 14:16:13 a10-1-1-1 bird: router < replaced 10.12.1.0/24 via 10.200.168.220 on bbforward Aug 4 14:16:23 a10-1-1-1 bird: router < replaced 10.12.1.0/24 via 10.200.168.220 on bbforward I am seeing prefixes constantly being replaced. Is this indicative on any issues on the bird process? Thanks -- Donovan Van Dyk Platform Operations Engineer, Senior Fort Lauderdale, FL USA [signature_1567698687] The information contained in this electronic mail transmission and its attachments may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient (or an individual responsible for delivery of the message to such person), you are strictly prohibited from copying, disseminating or distributing this communication. If you have received this communication in error, please notify the sender immediately and destroy all electronic, paper or other versions.

1 0

Handling IPv6 BGP routes with :: next-hop
by Alexander Shikov 04 Aug '21

04 Aug '21

Hello! Yesterday we noticed a strange behavior of Bird 1.6.8 with handling one IPv6 BGP route: >birdc6 show route for 2a09:8387:ffff:: all BIRD 1.6.8 ready. 2a09:8387:ffff::/48 via 2001:7f8:63::f2 on bge0 [SIMTELECOM 2021-08-03 00:07:16] * (100) [AS51972i] Type: BGP unicast univ BGP.origin: IGP BGP.as_path: 51972 BGP.next_hop: :: BGP.med: 0 BGP.local_pref: 100 BGP.community: (31210,31210) BGP.ext_community: (rt, 31210, 31210) via 2001:7f8:63::69 on bge0 [DATAGROUP2 2021-07-20 16:07:45] (100) [AS51972i] Type: BGP unicast univ BGP.origin: IGP BGP.as_path: 3326 51972 BGP.next_hop: 2001:7f8:63::69 fe80::2e21:7201:935e:37ce BGP.med: 510 BGP.local_pref: 100 BGP.community: (3326,3010) (3326,11001) (3326,22050) (3326,50990) (31210,31210) BGP.ext_community: (rt, 31210, 31210) via 2001:7f8:63::60 on bge0 [HE 2021-07-22 00:53:03] (100) [AS51972i] Type: BGP unicast univ BGP.origin: IGP BGP.as_path: 6939 3326 51972 BGP.next_hop: 2001:7f8:63::60 fe80::629c:9fff:fe83:8c13 BGP.med: 0 BGP.local_pref: 100 BGP.community: (0,16509) (0,15169) (0,13335) (0,15133) (0,22822) (0,12989) (0,2906) (0,20940) (0,3255) (0,16265) (0,16276) (0,13188) (0,714) (0,32590) (0,48641) (0,49029) (31210,31210) BGP.ext_community: (rt, 31210, 31210) via 2001:7f8:63::f4 on bge0 [DATAGROUP 2021-07-07 11:00:57] (100) [AS51972i] Type: BGP unicast univ BGP.origin: IGP BGP.as_path: 3326 51972 BGP.next_hop: 2001:7f8:63::f4 fe80::ae4b:c8ff:fe96:67c3 BGP.med: 510 BGP.local_pref: 100 BGP.community: (3326,3010) (3326,11001) (3326,22050) (3326,50990) (31210,31210) BGP.ext_community: (rt, 31210, 31210) The first (best) route has next-hop '::' and routers of some of our customers started dropping BGP sessions with 'Invalid next-hop' cause. I dumped packets coming from customer 2001:7f8:63::f2 and it is really sending next-hop as '::'. I enabled logging of 'gw' and 'from' route attributes for net 2a09:8387:ffff::/48, and I got the following: Aug 3 09:57:10 <daemon.info> rs1 bird6: DEBUG: gw:2001:7f8:63::f4 ---- from:2001:7f8:63::f4 Aug 3 09:57:10 <daemon.info> rs1 bird6: DEBUG: gw:2001:7f8:63::69 ---- from:2001:7f8:63::69 Aug 3 09:57:11 <daemon.info> rs1 bird6: DEBUG: gw:2001:7f8:63::f2 ---- from:2001:7f8:63::f2 Aug 3 09:57:12 <daemon.info> rs1 bird6: DEBUG: gw:2001:7f8:63::60 ---- from:2001:7f8:63::60 Thus 'gw' and 'from' variables both contain IPv6 address of the peer. But shouldn't 'gw' contain '::'? Due to that the checks like if gw != from then return false; fail. Please advice, thanks! -- Alexander Shikov Technical Staff, Digital Telecom IX Tel.: +380 44 201 14 07 Mob.: +380 50 410 30 57 http://dtel-ix.net/

3 4

BGP on GRE Idle
by 智慧雨泽 03 Aug '21

03 Aug '21

Hi,My configuration file can work normally on the wireguard tunnel, but GRE does not work. Server1 11: home_1_vpn: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1280 qdisc noqueue state UNKNOWN group default qlen 1000 link/none inet 5.101.92.125/32 scope global home_1_vpn valid_lft forever preferred_lft forever root@ll-ix:~# ip route get 2602:feda:ab4:5247:5247:5247:5247:5247 2602:feda:ab4:5247:5247:5247:5247:5247 from :: dev frc_ca src 2602:feda:ab2:5247:5247:5247:5247:5247 metric 1024 pre f medium root@ll-ix:~# birdc s p a FRC_CA BIRD 2.0.7 ready. Name Proto Table State Since Info FRC_CA BGP --- start 2021-07-31 Idle BGP state: Idle Neighbor address: 2602:feda:ab4:5247:5247:5247:5247:5247%frc_ca Neighbor AS: 141011 Local AS: 141011 Channel ipv6 State: DOWN Table: master6 Preference: 100 Input filter: (unnamed) Output filter: (unnamed) root@ll-ix:~# birdc s p HOME_1_ARCH BGP --- up 2021-07-31 Established The protocol home_1_arch use the same template as Server 1 and Server 2,but it do Established.The only difference is using Wireguard as tun,I don't think I have a problem with the IP configuration on Server1 and Server2. protocol bgp FRC_CA from tpl_ibgp { source address 2602:feda:ab2:5247:5247:5247:5247:5247; neighbor 2602:feda:ab4:5247:5247:5247:5247:5247 as 141011; } Server2 9: ll_ix@NONE: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1476 qdisc noqueue state UNKNOWN group default qlen 1000 link/gre 104.218.61.232 peer 5.189.255.107 inet6 2602:feda:ab4:5247:5247:5247:5247:5247/128 scope global valid_lft forever preferred_lft forever inet6 fe80::200:5efe:68da:3de8/64 scope link valid_lft forever preferred_lft forever root@vpsuser:~# ip route get 2602:feda:ab4:5247:5247:5247:5247:5247 local 2602:feda:ab4:5247:5247:5247:5247:5247 from :: dev lo table local proto kernel src 2602:feda:ab4:5247:5247:524 7:5247:5247 metric 0 pref medium root@vpsuser:~# birdc s p a LL_IX BIRD 2.0.7 ready. Name Proto Table State Since Info LL_IX BGP --- start 02:48:26.395 Idle BGP state: Idle Neighbor address: 2602:feda:ab2:5247:5247:5247:5247:5247 Neighbor AS: 141011 Local AS: 141011 Channel ipv6 State: DOWN Table: master6 Preference: 100 Input filter: (unnamed) Output filter: (unnamed) protocol bgp LL_IX from tpl_ibgp { source address 2602:feda:ab4:5247:5247:5247:5247:5247; neighbor 2602:feda:ab2:5247:5247:5247:5247:5247 as 141011; } Both Server use the same template,As shown below template bgp tpl_ibgp { local as LOCAL_ASN; rr client; direct; ipv6 { next hop self; import filter { if is_bogon_asn() then { print "is bogon asn", net, " for ASN ", bgp_path.last; reject; } if is_bogon_prefix() then { print "is bogon prefix", net, " for ASN ", bgp_path.last; reject; } accept; }; export filter { if bgp_export_all() then accept; reject; }; }; } Please help me,thanks.

3 2