September 2021 - Bird-users

RPKI not working with protocol pipe
by Dewangga Alam 28 Sep '21

28 Sep '21

Hello! I just migrating configuration using port pipe recently, but I just realized the RPKI/ROA validation isn’t working. Debian 10 Bird 2.0.8 … snip … ipv4 table master4; ipv6 table master6; ipv4 table igptable4; ipv6 table igptable6; roa4 table t_roa4; roa6 table t_roa6; protocol rpki rpki1 { roa4 { table t_roa4; }; roa6 { table t_roa6; }; remote “ip.ad.dr.es" port 8282; retry keep 30; refresh keep 30; expire keep 3600; } function is_v4_rpki_invalid() { return roa_check(t_roa4, net, bgp_path.last_nonaggregated) = ROA_INVALID; } function is_v6_rpki_invalid() { return roa_check(t_roa6, net, bgp_path.last_nonaggregated) = ROA_INVALID; } protocol pipe pipe1 { # sync routing table igp to master table master4; peer table igptable4; export all; import all; } … snip … Starting using the filter to call is_v4_rpki_invalid(), isn’t working. But if the setup without proto pipe, the filter and table t_roa4 and t_roa6 are able validate the prefix. The configuration for rpki is working. # show proto rpki1 Name Proto Table State Since Info rpki1 RPKI --- up 2021-09-11 Established Is it possible to pipe Roa with pipe protocol and put the RPKI in place? Any feedback are welcome and appreciated. Many thanks.

1 0

Bird 2.0.8 + uClibc-ng, BGP RR + OSPF - OSPF falls to 'Alone' state at BGP routes recalculation
by Andrew 24 Sep '21

24 Sep '21

Hi all. I have Bird 2.0.8 on one of border routers, it runs with kernel 5.10.26 and uClibc-ng 1.0.38. It acts as RR and receives FV from uplink + FV from second border (also RR), and it has 2 routing tables (one which receives BGP routes, then routes sinks to main table. When second border's BGP link fails, Bird starts to rebuild routing table, and acts quite strange (too slow birdc response, etc) and after ~5 minutes OSPF looses neighbors and falls to state 'Alone'. It can be in that state for hours, and initiated only after bird restart (I didn't tried protocol restart - usually I don't wait for end of route table recalculation). When table recalculation is in progress, perf top shows that 40+% CPU time is used by malloc routine. Are there fixes in trunk for such behavior? If no - what extra info is needed for debugging?

2 2

IP addresses assigning via Bird
by Blažej Krajňák 23 Sep '21

23 Sep '21

Hi everybody, is there any way to use Bird for binding IP addresses to interfaces? Something like Zebra do in Quagga. interface dummy1 ip address 192.168.1.0/24 Thanks, Blažej

7 8

IBGP cannot import prefixs with its as_path
by 智慧雨泽 23 Sep '21

23 Sep '21

Hi, I use ibgp to transport full tables in my network. iBGP delete my ASN but I use my ASN to identify my prefixes. So I added this code to my ibgp import filter if bgp_path ~ [= =] then { #bgp_path.prepend(LOCAL_ASN); if my_opt_prefix() then bgp_path.prepend(LOCAL_ASN); } It works when 2 servers connect, but when I have 3 servers, the third server can not import my first server's prefixed with my ASN. At the first server bird> show route export HOME_1_ARCH Table master6: 2a0c:e640:1017::/48 unreachable [BGP_Prefix 22:12:23.507] * (200) 2602:feda:ab9::/48 unreachable [BGP_Prefix 22:12:23.507] * (200) At the second server bird> show route for 2a0c:e640:1017:: export Aperture_IX all Table master6: 2a0c:e640:1017::/48 unicast [ZHYZ_PC 14:53:29.056] * (100) [AS141011i] via 2a0c:e640:1017::1 on zhyz_pc Type: BGP univ BGP.origin: IGP BGP.as_path: 141011 BGP.next_hop: 2a0c:e640:1017::1 BGP.local_pref: 100 At the third server bird> show route for 2a0c:e640:1017::/48 protocol HOME_1_ARCH all Table master6: ::/0 unicast [HOME_1_ARCH 06:10:14.802] * (100) [AS134835i] via 2602:feda:ab5::1 on home_1_arch Type: BGP univ BGP.origin: IGP BGP.as_path: 134835 BGP.next_hop: 2602:feda:ab5::1 BGP.local_pref: 100 BGP.community: (65530,2000) HOME_1_ARCH BGP --- up 06:10:14.802 Established Description: HOME_1_ARCH BGP BGP state: Established Neighbor address: 2602:feda:ab5::1%home_1_arch Neighbor AS: 141011 Local AS: 141011 Neighbor ID: 192.168.117.52 Local capabilities Multiprotocol AF announced: ipv6 Route refresh Graceful restart Restart time: 120 AF supported: ipv6 AF preserved: 4-octet AS numbers Enhanced refresh Long-lived graceful restart Neighbor capabilities Multiprotocol AF announced: ipv6 Route refresh Graceful restart Restart time: 120 AF supported: ipv6 AF preserved: 4-octet AS numbers Enhanced refresh Long-lived graceful restart Session: internal route-reflector AS4 Source address: 2602:feda:ab7::1 Hold timer: 183.267/240 Keepalive timer: 63.087/80 Channel ipv6 State: UP Table: master6 Preference: 100 Input filter: (unnamed) Output filter: (unnamed) Routes: 2560 imported, 129220 exported, 2557 preferred Route change stats: received rejected filtered ignored accepted Import updates: 266057 0 0 5170 260887 Import withdraws: 261009 0 --- 5382 255627 Export updates: 681596 17838 129330 --- 534428 Export withdraws: 3020 --- --- --- 131521 BGP Next hop: 2602:feda:ab7::1 You could see the third server cannot import 2a0c:e640:1017::/48 But when I deleted this code on the second server. if bgp_path ~ [= =] then { #bgp_path.prepend(LOCAL_ASN); if my_opt_prefix() then bgp_path.prepend(LOCAL_ASN); } it has been successful import bird> show route for 2a0c:e640:1017::/48 protocol HOME_1_ARCH all Table master6: 2a0c:e640:1017::/48 unicast [HOME_1_ARCH 07:14:07.526] * (100) [AS141011i] via 2602:feda:ab5::1 on home_1_arch Type: BGP univ BGP.origin: IGP BGP.as_path: 141011 BGP.next_hop: 2602:feda:ab5::1 BGP.local_pref: 100 BGP.originator_id: 172.16.229.1 BGP.cluster_list: 192.168.117.52 I know that maybe no one will use ibgp like this, but why it won't work?

2 1

RFC 5575 feasibility check
by Alexander Shikov 23 Sep '21

23 Sep '21

Hello! RFC5575 and newer RFC8955 define validation procedure for flowspec routes received by BGP protocol. While testing flowspec in bird 2.0.8 I've found strange behavior: # birdc show route protocol BGP4_IPPORT filtered BIRD 2.0.8 ready. Table T4_IPPORT: 185.23.164.48/28 unicast [BGP4_IPPORT 18:02:30.148] * (100) [AS8647i] via 193.25.180.134 on bxe0 -- the unicast route is filtered by import policy. # birdc show route BIRD 2.0.8 ready. Table FLOW4: flow4 { dst 185.23.164.48/28; proto 1; icmp type 8; } [BGP4_IPPORT 18:02:31.214 from 193.25.180.134] * (100) [AS8647i] -- flow route remains. So the question, is feasibility check implemented in bird? Thank you! -- Alexander Shikov Technical Staff, Digital Telecom IX Tel.: +380 44 201 14 07 Mob.: +380 50 410 30 57 http://dtel-ix.net/

2 1

latest bgp perf tests blog
by Justin Pietsch 22 Sep '21

22 Sep '21

Hi, my latest blog post on bgp perf testing: https://elegantnetwork.github.io/posts/bird-on-bird-bgp-perf-episode4/. I used the code that Maria added to use BIRD as a tester, and it works better, but shows some issues with BIRD as the target. Justin

1 0

Mitigations/tunables for reducing netlink loss?
by Dave Johnson 21 Sep '21

21 Sep '21

Hi, I'm seeing these warnings quite frequently on a system that has full-internet table programmed into Linux kernel. Sep 20 11:50:48 ganges bird: Kernel dropped some netlink messages, will resync on next scan. Sep 20 11:50:57 ganges bird: Kernel dropped some netlink messages, will resync on next scan. Sep 20 11:50:59 ganges bird: Kernel dropped some netlink messages, will resync on next scan. Sep 20 11:51:00 ganges bird: Kernel dropped some netlink messages, will resync on next scan. Sep 20 11:51:01 ganges bird: Kernel dropped some netlink messages, will resync on next scan. Sep 20 11:51:05 ganges bird: Kernel dropped some netlink messages, will resync on next scan. Sep 20 11:51:05 ganges bird: Kernel dropped some netlink messages, will resync on next scan. Sep 20 11:51:07 ganges bird: Kernel dropped some netlink messages, will resync on next scan. Sep 20 11:51:10 ganges bird: Kernel dropped some netlink messages, will resync on next scan. Sep 20 11:51:10 ganges bird: Kernel dropped some netlink messages, will resync on next scan. Sep 20 11:51:14 ganges bird: Kernel dropped some netlink messages, will resync on next scan. Sep 20 11:51:17 ganges bird: Kernel dropped some netlink messages, will resync on next scan. Sep 20 11:51:19 ganges bird: Kernel dropped some netlink messages, will resync on next scan. Sep 20 11:51:19 ganges bird: Kernel dropped some netlink messages, will resync on next scan. First off, I'm not expecting wonders here, I don't expect having near to 1m routes in Linux to work flawlessly however just looking to improve on the situation. My setup: bird 1.6.6 (Debian 10) with Linux 4.9.xxx Internet routes are segregated into a dedicated kernel routing table (#99 below), no non-bird routes are in this table. prot kernel is export only (again, no non-bird routes in this kernel table) bird table "internet" contains a protocol kernel, a protocol pipe, and 3 protocol bgps (for 3 iBGP peers). prot kernel config is: protocol kernel kernel_internet { debug { states, interfaces }; table internet; kernel table 99; scan time 60; persist; learn off; graceful restart on; import none; export filter { if net ~ IP_MY_NET_PLUS then reject; if net ~ IP_CORE_NET then reject; accept; }; } I'm seeing netlink drops when upstream internet churn is say more than 200 updates/sec or so, not huge, but quite freqent and can continue for minutes/hours. Some items I've investigated so far: Increasing net.core.rmem_max and net.core.wmem_max sysctls doesn't seem to help much, strace of bird doesn't indicate any EAGAIN or blocking when writing to the netlink sockets. strace shows some room for optimization in the prot kernel (these would obviously be code changes). For example, when a route changes next-hop/interface, 2 netlink messages are sent, delete followed by add, instead of a single change/replace (this would complicate bird, but reduce netlink message in half for updates). There is plenty of cpu cycles available, bird is <%1, etc... Any pointers on tuning or config changes that may help here are appreciated. -- Dave

4 6

Bird 2 config syntax
by Robert Sander 21 Sep '21

21 Sep '21

Hi, why is it not possible to define BGP sessions like this? protocol bgp g60 { local as 64501; neighbor as 64499; ipv4 { import all; export all; }; local 192.0.2.4; neighbor 192.0.2.5; }; ipv6 { import all; export all; local 2001:db8::4; neighbor 2001:db8::5; }; }; It seems still necessary to write two bgp definitions separately for IPv4 and IPv6 repeating the AS numbers and name. I see no benefit from the Bird 1.6 notation here. Regards -- Robert Sander Heinlein Consulting GmbH Schwedter Str. 8/9b, 10119 Berlin http://www.heinlein-support.de Tel: 030 / 405051-43 Fax: 030 / 405051-19 Zwangsangaben lt. §35a GmbHG: HRB 220009 B / Amtsgericht Berlin-Charlottenburg, Geschäftsführer: Peer Heinlein -- Sitz: Berlin

3 2

Show all ROAs for an ASN
by Darren O'Connor 20 Sep '21

20 Sep '21

I have an rpki-rtr session to my bird instance. All v4 roas go to a table called roa_v4, and v6 goes to roa_v6 - Is there a way in a single query to show me all ROAs from an ASN without listing them all? Right now I'm doing something like this, which is extremely messy: birdc 'show route all table roa_v4' | grep AS13414 It would be ideal to have something like show route all table roa_v4 source 13414 - Am I missing something here? Thanks Darren

2 2

Compilation directive LOCAL_DEBUG and DBG()
by Senthil Kumar Nagappan 17 Sep '21

17 Sep '21

Hi, To enable debug outputs using DBG macro, it requires LOCAL_DEBUG or GLOBAL_DEBUG to be defined during compilation. 1. Defined it in the Makefile as below. Is there an option without changing the auto generated Makefile? CFLAGS=$(CPPFLAGS) -g -O2 -pthread -fno-strict-aliasing -fno-strict-overflow -flto -Wall -Wextra -Wstrict-prototypes -Wno-parentheses -Wno-pointer-sign -Wno-missing-field-initializers -DLOCAL_DEBUG 2. If we try to define LOCAL_DEBUG in the code, there are undef directive in the different places of the code, so may not work consistently. 3. If we define this LOCAL_DEBUG or GLOBAL_DEBUG, there are compilation errors that needs to be addressed. Thanks and Regards,Senthil

2 4