January 2023 - Bird-users

ABR sets E-bit (and B-bit) in router LSA
by Kenth Eriksson 27 Jan '23

27 Jan '23

I have a setup as in the attached drawing. I can see that the bird ABR node (R2) sets the E-bit and the B-bit in the router LSA. The B-bit seems correct as it is the ABR, but it is not an ASBR. Below is a tcpdump captured on R1 Frame 11347: 124 bytes on wire (992 bits), 124 bytes captured (992 bits) Linux cooked capture v2 PPP-over-Ethernet Session Point-to-Point Protocol Internet Protocol Version 4, Src: 10.210.138.69, Dst: 224.0.0.5 Open Shortest Path First OSPF Header Version: 2 Message Type: LS Update (4) Packet Length: 76 Source OSPF Router: 10.210.138.69 Area ID: 0.0.0.0 (Backbone) Checksum: 0x9d61 [correct] Auth Type: Null (0) Auth Data (none): 0000000000000000 LS Update Packet Number of LSAs: 1 LSA-type 1 (Router-LSA), len 48 .000 0000 0000 0001 = LS Age (seconds): 1 0... .... .... .... = Do Not Age Flag: 0 Options: 0x42, O, (E) External Routing 0... .... = DN: Not set .1.. .... = O: Set ..0. .... = (DC) Demand Circuits: Not supported ...0 .... = (L) LLS Data block: Not Present .... 0... = (N) NSSA: Not supported .... .0.. = (MC) Multicast: Not capable .... ..1. = (E) External Routing: Capable .... ...0 = (MT) Multi-Topology Routing: No LS Type: Router-LSA (1) Link State ID: 10.210.138.69 Advertising Router: 10.210.138.69 Sequence Number: 0x80000075 Checksum: 0x180f Length: 48 Flags: 0x03, (E) AS boundary router, (B) Area border router 0... .... = (H) flag: No ...0 .... = (N) flag: No .... 0... = (W) Wild-card multicast receiver: No .... .0.. = (V) Virtual link endpoint: No .... ..1. = (E) AS boundary router: Yes .... ...1 = (B) Area border router: Yes Number of Links: 2 Type: Stub ID: 10.210.138.69 Data: 255.255.255.255 Metric: 0 Type: PTP ID: 10.210.138.66 Data: 10.210.138.69 Metric: 10 The Cisco router sees these bird routers as ASBR routers as well R3-Cisco>show ip ospf border-routers OSPF Router with ID (10.210.138.65) (Process ID 1) Base Topology (MTID 0) Internal Router Routing Table Codes: i - Intra-area route, I - Inter-area route i 10.210.138.66 [1] via 10.210.138.66, GigabitEthernet0/0/1, ASBR, Area 0.0.0.0, SPF 77 i 10.210.138.69 [11] via 10.210.138.66, GigabitEthernet0/0/1, ABR/ASBR, Area 0.0.0.0, SPF 77 I 10.210.138.73 [21] via 10.210.138.66, GigabitEthernet0/0/1, ASBR, Area 0.0.0.0, SPF 77 R3-Cisco> R3-Cisco>show ip ospf database OSPF Router with ID (10.210.138.65) (Process ID 1) Router Link States (Area 0.0.0.0) Link ID ADV Router Age Seq# Checksum Link count 10.210.138.65 10.210.138.65 870 0x800000DE 0x0091B0 2 10.210.138.66 10.210.138.66 828 0x800000AC 0x00DBB2 3 10.210.138.69 10.210.138.69 828 0x8000009F 0x00C339 2 Net Link States (Area 0.0.0.0) Link ID ADV Router Age Seq# Checksum 10.210.138.65 10.210.138.65 870 0x80000035 0x003F26 Summary Net Link States (Area 0.0.0.0) Link ID ADV Router Age Seq# Checksum 10.210.138.73 10.210.138.69 591 0x8000002D 0x002465 Summary ASB Link States (Area 0.0.0.0) Link ID ADV Router Age Seq# Checksum 10.210.138.73 10.210.138.69 591 0x8000002D 0x001672 Type-5 AS External Link States Link ID ADV Router Age Seq# Checksum Tag 0.0.0.0 10.210.138.65 1650 0x80000034 0x004EA1 1 R3-Cisco>

2 2

SYM_MAX_LEN
by Alexander Zubkov 27 Jan '23

27 Jan '23

Hi, If I do not mistake, cf_new_symbol() has incorrect check of symbol length. In other places where SYM_MAX_LEN is used, it is expected that leading zero is counted in it. But the check in cf_new_symbol() allows symbol length equal to SYM_MAX_LEN. This does not cause a problem (as I unederstand), because the space is allocated anyway and this string is not copied later to fixed size arrays. I attached a patch with the fix, there is also a couple of bsprintf replaced with safer bsnprintf calls.

1 0

rename symbols
by Alexander Zubkov 25 Jan '23

25 Jan '23

Hi all, Some weird idea. I'm not sure it needs to be in the mainstream version, but somebody might find it helpful. For example I may want to refactor the naming scheme for protocols/tables in my bird config. But when I apply the new config with the new names, such renamed protocols will be recreated or restarted, which may be undesired. So if I could rename protocols/tables in advance and then load the new config, I can hope than no changes would be found and the there would be no interruptions. The attached patch solves the problem, by introducing such changes: To rename some symbol one can use cli command: rename <old_symbol> "<new_name>" The new name is in the form of the string, because symbol form requires symbol to be created. I tried to use CF_SYM_UNDEFINED for the second parameter. It works somehow, but leaves duplicate symbols in the table. If there is some way to clean them after it, it could be more visually pleasing option. The other problem is that a symbol has the fixed buffer for the name bound by its length. And one would not be able to rename it to a new name that is longer. But to overcome that, I add a field to a symbol to remember the length of the allocated buffer and allow the buffer to be bigger. This can be controlled by config option: symbols min <len> Which sets minum length that will fit the buffer. But as symbols are allocated while reading the config, you need to place this configuration option to the top of your config, i.e. before all the symbols you want to rename. So you can load the old config with the old names and this option added, it will allocate bigger buffers for the symbols. Then you can rename your symbols to the new ones. And finally load the new config with the new names. Of course you need the bird version with this patch applied in advace to do the trick. :)

3 9

Question: ROA verification does not work properly on bird 2.0.11
by haima 23 Jan '23

23 Jan '23

Hello dear community members, I am configuring RPKI verification for my network, but I have encountered a strange syntax error problem. My configuration is as follows: roa4 table roa_table4; roa6 table roa_table6; protocol rpki Cloudflare_RPKI { roa4 { table roa_table4; }; roa6 { table roa_table6; }; remote "172.65.0.2" port 8282; retry keep 90; refresh keep 900; expire keep 172800; } function is_rpki_invalid () { } if roa_check(roa_table4, net, bgp_path.last) = ROA_INVALID then return true if roa_check(roa_table6, net, bgp_path.last) = ROA_INVALID then return true; return false; } bird will return the following error: /etc/bird/function.conf:59:22 Syntax error, unexpected CF_SYM_UNDEFINED, expecting CF_SYM_KNOWN This error is also returned by the example configuration provided in the documentation. PS: RPKI session placed in bird.conf PS: Function placed in function.conf Regards, Haima MoeBee Network

3 4

回覆: 回覆: Question: ROA verification does not work properly on bird 2.0.11
by haima 23 Jan '23

23 Jan '23

Hi Maria, This is not an empty Funciton, it is complete as follows: function is_rpki_invalid() { if roa_check(roa_table4, net, bgp_path.last) = ROA_INVALID then return true; if roa_check(roa_table6, net, bgp_path.last) = ROA_INVALID then return true; return false; } Thank you for your reply Haima MoeBee Network 寄件者: Maria Matejka 已傳送: 星期一, 2023 年 1 月 23 日 23:55 收件者: haima; bird-users(a)network.cz 主旨: Re: 回覆: Question: ROA verification does not work properly on bird 2.0.11 Oh, looking at your previous post, I've spotted that on the previous line, you have this: function is_rpki_invalid() { } The ending brace creates an empty function and the following line is then probably misinterpreted as something strange. Maria On 1/23/23 16:50, haima wrote: > Hi, Maria, Thanks for your reply, > > Line 59 reads as follows: > > if roa_check(roa_table4, net, bgp_path.last) = ROA_INVALID then return true; > > > Thanks, > > Haima > MoeBee Network > > > > 寄件者: Bird-users 代表 Maria Matejka via Bird-users > 已傳送: 星期一, 2023 年 1 月 23 日 23:38 > 收件者: bird-users(a)network.cz > 主旨: Re: Question: ROA verification does not work properly on bird 2.0.11 > > > > > Hello! > >> bird will return the following error: /etc/bird/function.conf:59:22 Syntax error, unexpected CF_SYM_UNDEFINED, expecting CF_SYM_KNOWN > > > > The numbers 59:22 are actually the line:char index in that file. Could > > you please disclose what is in /etc/bird/function.conf around line 59 to > > let us help you find out what's the case? > > > > Thanks > > > > Maria >

1 0

RE: 回覆: Question: ROA verification does not work properly on bird 2.0.11
by haima 23 Jan '23

23 Jan '23

Hi Maria, This is not an empty Funciton, it is complete as follows: function is_rpki_invalid() { if roa_check(roa_table4, net, bgp_path.last) = ROA_INVALID then return true; if roa_check(roa_table6, net, bgp_path.last) = ROA_INVALID then return true; return false; } Thank you for your reply Haima MoeBee Network 寄件者: Maria Matejka 已傳送: 星期一, 2023 年 1 月 23 日 23:55 收件者: haima; bird-users(a)network.cz 主旨: Re: 回覆: Question: ROA verification does not work properly on bird 2.0.11 Oh, looking at your previous post, I've spotted that on the previous line, you have this: function is_rpki_invalid() { } The ending brace creates an empty function and the following line is then probably misinterpreted as something strange. Maria On 1/23/23 16:50, haima wrote: > Hi, Maria, Thanks for your reply, > > Line 59 reads as follows: > > if roa_check(roa_table4, net, bgp_path.last) = ROA_INVALID then return true; > > > Thanks, > > Haima > MoeBee Network > > > > 寄件者: Bird-users 代表 Maria Matejka via Bird-users > 已傳送: 星期一, 2023 年 1 月 23 日 23:38 > 收件者: bird-users(a)network.cz > 主旨: Re: Question: ROA verification does not work properly on bird 2.0.11 > > > > > Hello! > >> bird will return the following error: /etc/bird/function.conf:59:22 Syntax error, unexpected CF_SYM_UNDEFINED, expecting CF_SYM_KNOWN > > > > The numbers 59:22 are actually the line:char index in that file. Could > > you please disclose what is in /etc/bird/function.conf around line 59 to > > let us help you find out what's the case? > > > > Thanks > > > > Maria >

1 0

回覆: Question: ROA verification does not work properly on bird 2.0.11
by haima 23 Jan '23

23 Jan '23

Hi, Maria, Thanks for your reply, Line 59 reads as follows: if roa_check(roa_table4, net, bgp_path.last) = ROA_INVALID then return true; Thanks, Haima MoeBee Network 寄件者: Bird-users 代表 Maria Matejka via Bird-users 已傳送: 星期一, 2023 年 1 月 23 日 23:38 收件者: bird-users(a)network.cz 主旨: Re: Question: ROA verification does not work properly on bird 2.0.11 Hello! > bird will return the following error: /etc/bird/function.conf:59:22 Syntax error, unexpected CF_SYM_UNDEFINED, expecting CF_SYM_KNOWN The numbers 59:22 are actually the line:char index in that file. Could you please disclose what is in /etc/bird/function.conf around line 59 to let us help you find out what's the case? Thanks Maria

2 1

small fix of indenting
by Alexander Zubkov 23 Jan '23

23 Jan '23

Hello, I found some bad indenting of if/else statements. Please see the attached patch.

2 1

BIRD version 2.0.12
by Ondrej Filip 23 Jan '23

23 Jan '23

Dear users, happy new year for everyone. We just released first stable version of BIRD this year. Many thanks to my great colleagues and namely Santiago. This release fixes some important bugs, here is a list of the main improvements: Version 2.0.12 (2023-01-23) o Filter: New 'onlink' route attribute o Compile-time option to use 4-way tries instead of 16-way ones o BSD: Support for kernel route metric and other improvements o Important bugfixes Enjoy! Ondrej

1 0

[PATCH] Set PR_SET_DUMPABLE before switching uid to allow core dumps.
by Thomas Liske 22 Jan '23

22 Jan '23

Signed-off-by: Thomas Liske <liske(a)ibh.de> --- This patch sets the PR_SET_DUMPABLE capability before switching to a unprivileged user to allow core dumps (see also the paragraph about set-user-ID in `man 5 core`) Background: While debugging bird on Alpine we wonder why it was not possible to get a core dump when bird runs under a unprivileged user. Original Alpine Issue: https://gitlab.alpinelinux.org/alpine/aports/-/issues/14408 sysdep/linux/syspriv.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sysdep/linux/syspriv.h b/sysdep/linux/syspriv.h index 8b210f06..efb1fff0 100644 --- a/sysdep/linux/syspriv.h +++ b/sysdep/linux/syspriv.h @@ -73,6 +73,10 @@ drop_uid(uid_t uid) if (prctl(PR_SET_KEEPCAPS, 1) < 0) die("prctl: %m"); + /* allow core dumps after dropping root ID */ + if (prctl(PR_SET_DUMPABLE, 1) < 0) + die("prctl: %m"); + /* completely switch to the unprivileged user ID */ if (setresuid(uid, uid, uid) < 0) die("setresuid: %m"); -- 2.30.2

2 1