October 2023 - Bird-users

BIRD presence on meetings until end of 2023
by Maria Matejka 30 Oct '23

30 Oct '23

Dear BIRD Users, I'd like to let you know that we're planning to visit several meetings before this year ends: * LinuxDays in Prague, October 7 (presentation in Czech), * NANOG 89 in San Diego, October 16 to 18, * Euro-IX 39th Forum in Prague, November 19 to 22, * RIPE 87 in Rome, November 27 to December 1. Feel free to approach us with any questions you have. We are usually pretty busy, so if you'd like to have some time with us guaranteed, we can plan an in-person meeting with you in advance. If you wish to get a Support Package for your BIRD deployment, these are perfect opportunities to discuss your needs with us. There is also IETF 118, November 4 to 10, in Prague. If anyone of you comes to Prague these days and would like to meet us, you're welcome, just let me know in advance and we'll arrange the meeting. And even if you come to Prague outside these dates, don't hesitate to contact us – we can meet anyway. Looking forward to seeing you. Maria -- Maria Matejka (she/her) | BIRD Team Leader | CZ.NIC, z.s.p.o.

5 9

Is it possible to set an IP address to an interface?
by Robért Guhr 26 Oct '23

26 Oct '23

Hi, is it possible to set an ipv4 address (e.g. "10.186.100.11/32" ) via bird on a dummy interface called "anycast"? I mean via the bird config not via bgp/ospf pushes. Background: I have setup four DNS server in two sites. All these DNS servers announces 10.186.100.11/32 (and 10.186.100.12/32) up to the routers to create an anycast environment. Currently 10.186.100.11/32 (and 10.186.100.12/32) are set fixed on the dummy interface. Bird just imports these IP addresses. We would like to use 10.186.100.11/32 and 10.186.100.12/32 as resolver in /etc/resolv.conf But if we stop the local DNS server then the dns resolution is no longer possible because the addresses are hardcoded on the local interface and the other three dns server will not be used. Idee was to set the ip addreses via bird so that when we stop Bird and the local DNS server, we automatically forward the DNS requests to the other three servers. I was hoping the direct protocol converts a route also to an ip address but this seems not to be the case. With the kernel protocol I can export the route to the kernel routing table but that is not was I was want. pns-b2-ns02 ~ # cat /etc/bird.conf # Ansible managed router id 10.186.244.12; protocol device { scan time 10; } protocol direct { ipv4 { import none; export all; }; interface "anycast"; } protocol static { ipv4 { import all; export all; }; route 10.186.100.11/32 via "anycast"; } protocol kernel { ipv4 { import none; export all; }; } pns-b2-ns02 ~ # birdc show route; echo; ip a show dev anycast; echo; ip r | grep 10.186.100 BIRD 2.13.1 ready. Table master4: 10.186.100.11/32 unicast [static1 17:22:18.282] * (200) dev anycast 4: anycast: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000 link/ether 8e:b5:2b:bf:0d:5e brd ff:ff:ff:ff:ff:ff inet 10.186.100.9/32 scope global noprefixroute anycast # <----- here should also be the address 10.186.100.11/32 valid_lft forever preferred_lft forever 10.186.100.11 dev anycast proto bird scope link metric 32 Regards, Robért

4 6

Babel over br-lan and export via bgp
by Oriol Rico 25 Oct '23

25 Oct '23

Hello everybody I have a bird daemon with this configuration # Configure logging log syslog all; log "/var/log/bird.log" all; log stderr all; #debug protocols { routes, interfaces }; # Override router ID router id 10.20.2.2; # Sync bird routing table with kernel protocol kernel { learn; ipv4 { import all; export all; }; } protocol device { scan time 10; } # Include directly connected networks protocol direct { ipv4; } protocol static static4 { ipv4 { export all;}; route 10.0.0.0/8 via 10.20.2.1; route 0.0.0.0/0 via 10.20.2.1; } protocol babel { interface "wlan0" { type wireless; hello interval 1 s; rx buffer 15000; }; interface "br-lan" { type wired; }; ipv4 { export where (source = RTS_DEVICE) || (source = RTS_BABEL) || (source = RTS_STATIC); }; } filter rr_export { if ( net ~ [ 10.0.0.0/8{24,32} ] ) then { accept; } else{ reject; } } protocol bgp { local 10.20.2.2 as 114108; source address 10.20.2.2; neighbor 10.20.2.1 as 111796; ipv4 { import none; export filter rr_export; }; } I received a route via br-lan with the prefix 10.20.3.32/27 via babel protocol, but when i export via bgp the peer logs a Withdrawn, but when i am in the router with the setup i send i can reach 10.20.3.32/27 via br-lan over babel. I don't know where is the problem. All other config it's ok. Can you help me? Thanks in advanced Oriol

1 1

bird control socket response
by LIU Chris 18 Oct '23

18 Oct '23

Classified as: {OPEN} I want to implement an application to talk to bird daemon, basically like birdc/birdcl. The control socket is TCP stream, it is fine. But the response from bird daemon adds some headers for each line I understand server want to make a boundary/delimiter for stream. Just wondering why not just add how many bytes in the beginning of response, instead of this inconvenient way (have to decode line by line). I am not question bird implementation, just wondering :) Current format like below Show protocols 0001 BIRD 2.0.10 ready. 2002-Name Proto Table State Since Info 1002-device1 Device --- up static_bgp Static master4 up kernel1 Kernel master4 up 0000 With Best Regards, Chris LIU {OPEN} Thales is in the process of carving out its Transportation activity (GTS) from other Thales' activities. In order to prepare this internal restructuring, a new e-mail address has been adopted and your GTS contacts now use urbanandmainlines.com. Please note that their Thales e-mail address remains also valid.

4 5

Proper use of graceful restart functionality
by Pavlos Parissis 17 Oct '23

17 Oct '23

Hi all, I am using latest 2.x version of Bird and I have a question about graceful restart. I have `graceful restart on` for BGP protocol and I currently perform below steps when I want to utilize it: 1. birdc graceful restart 2. systemctl start bird.service According to the documentation I need `-R` command-line option, thus I have adjusted systemd unit file accordingly: ``` ExecStart=/usr/sbin/bird -R -f -u bird -g bird ``` How does the aforementioned command-line option behave when `birdc graceful restart` is not issued? I scanned the code to understand it and I think bird is smart enough to know that a graceful restarted was not requested and it doesn't do anything during the startup. While I was testing graceful restart functionality, I noticed that even without the aforementioned command-line option the upstream peer does not remove the routes until restart timeout expires. So, I was wondering if that option is real needed thus the question. Regards, Pavlos

2 2

[OSPF3 IPv6] error "wrong authentication length" between Proxmox 8 (Debian 12) (bird2 2.13.1) and MikroTik RouterOS 7.11 (stable)
by Chriztoffer (bird-users) 17 Oct '23

17 Oct '23

Hello bird-users list, I am seeking input into if anyone can provide suggestions on how to debug the below described error message. Cheers, Chriztoffer ********************************************************** The two proxmox nodes are running bird2 2.13.1 (compiled using apkg) and are connected to a MikroTik Router running RouterOS 7.11 directly on the same L2 domain. All three nodes can talk directly to each other on the same L2 domain. When trying to establish the OSPFv3 IPv6 connections between the three nodes. The connection from the two Proxmox nodes to the MikroTik Router fails with error "wrong authentication length" when logged by bird2. The OSPFv2 (IPv4) connection succeeds between all three nodes. OSPFv2 and OSPFv3 and setup with the same auth type (hmac sha512; cryptographic) and auth-id (0). Looking at the bird2 source code [0] did not really give me any clue to what the error is. [0]: https://gitlab.nic.cz/labs/bird/-/blob/master/proto/ospf/packet.c#L219 From looking at the PCAP I do indeed see the auth-data is not of the same length. ## MikroTik (MAC OUI 4c:5e:0c) OSPF Authentication Trailer Authentication Type: HMAC Cryptographic Authentication (1) Authentication Data Length: **64** Reserved: 0x0000 Security Association Identifier (SA ID): 0x0000 Cryptographic Sequence Number: 71479 Authentication Data: 021d5635eac7b92d28bfad6507bcda7702a5f1e323197be18d42d436dcae998f5ae462da… ## Bird 2.13.1 (MAC OUI 70:54:d2) OSPF Authentication Trailer Authentication Type: HMAC Cryptographic Authentication (1) Authentication Data Length: **80** Reserved: 0x0000 Security Association Identifier (SA ID): 0x0000 Cryptographic Sequence Number: 405 Authentication Data: 95c0ecfcd54a50e0da70acbf242181d3f45fce7dd1d8b6ccdb783d96c319c49e0cb77e5e… In this instance. I assume the error is located with MikroTik RouterOS 7.11 (stable). But still wanting to solicit feedback via the bird-users list regardless. ********************************************************** # ASCII L2 Diagram MikroTik -- Proxmox-2 | / | / Proxmox-1 # ASCII L1 Diagram MikroTik -- Proxmox-2 | | Proxmox-1 ********************************************************** # Proxmox 8 node 1 2023-08-19 19:47:15.579Z <AUTH> ospf3_main: Authentication failed for nbr {{MikroTik}} on vmbr0 - wrong authentication length (64) # Proxmox 8 node 2 2023-08-19 19:46:55.581Z <AUTH> ospf3_main: Authentication failed for nbr {{MikroTik}} on vmbr0 - wrong authentication length (64) # MikroTik { version: 3 router-id: {{MikroTik}} } ospf3-backbone { 0.0.0.0 } interface { broadcast fe80::4e5e:cff:fexx:xxxx%bridge1 } corrupted auth trailer from fe80::7254:d2ff:fexx:xxxx%bridge1 ********************************************************** # MikroTik RouterOS 7.11 (stable) OSPFv6 IPv6 configuration /routing ospf instance add disabled=no in-filter-chain=v6private name=ospf3-main \ originate-default=if-installed out-filter-chain=ospf3-out redistribute=\ connected,static,dhcp router-id=loopback routing-table=main version=3 /routing ospf area add disabled=no instance=ospf3-main name=ospf3-backbone /routing ospf interface-template add area=ospf3-backbone auth=sha512 \ auth-id=0 auth-key=Zzma9IOrDa7pg9iJwi439nfIZ59oQsXeZBdNb-Upj631GG8 \ dead-interval=20s disabled=no \ hello-interval=5s interfaces=bridge1 retransmit-interval=2s ********************************************************** # Bird 2.13.1 OSPFv6 (IPv6) configuration on Proxmox 8.x (Debian 12) protocol ospf v3 ospf3_main { graceful restart on; graceful restart time 300; ipv6 { import all; export filter { if is_self_network_6() && source ~ [RTS_STATIC] then accept; else reject; }; }; area 0 { interface "vmbr0" { type broadcast; hello 5; retransmit 2; wait 10; dead 20; authentication cryptographic; password "Zzma9IOrDa7pg9iJwi439nfIZ59oQsXeZBdNb-Upj631GG8" { id 0; algorithm hmac sha512; }; check link on; }; interface "lo" { check link no; strict nonbroadcast yes; type pointopoint; }; interface "*" { stub; }; }; } ********************************************************** # PCAP https://drive.google.com/file/d/1wDimK0WppM6JvIJIEeEMmFfvllGjj54Q/view?usp=…

3 2

Transition from BIRD 1 to 2
by Robert Sander 17 Oct '23

17 Oct '23

Hi, please help me understand the configuration logic for BIRD2. In BIRD 1 we have a config file common.conf that gets included from bird.conf and bird6.conf. It holds common configuration applicable to both IPv4 and IPv6 like this: table bgpext; protocol pipe p_bgpext { table master; peer table bgpext; import all; export none; } For BIRD2 I seem to have to rewrite that simple configuration to: ipv4 table bgpext4; ipv6 table bgpext6; protocol pipe p_bgpext4 { table master4; peer table bgpext4; import all; export none; } protocol pipe p_bgpext6 { table master6; peer table bgpext6; import all; export none; } Why do I have to double the configuration now? Did I miss something? This is a quite simple example. There are more complex protocol templates and filter functions that all would have to be doubled. Kindest Regards -- Robert Sander Heinlein Consulting GmbH Schwedter Str. 8/9b, 10119 Berlin https://www.heinlein-support.de Tel: 030 / 405051-43 Fax: 030 / 405051-19 Amtsgericht Berlin-Charlottenburg - HRB 220009 B Geschäftsführer: Peer Heinlein - Sitz: Berlin

4 6

Low voltage server for bird.
by Mike Neo 15 Oct '23

15 Oct '23

Hello, I am looking for a 1U rack platform with 2x PSU with low power consumption for a bird-based bgp router (Ubuntu). The supported traffic is expected to be ~1-2Gbps. Can anyone recommend a tested solution? Thank you in advance. Mike

3 2

Use bgp_aigp instead of bgp_med to select the optimal route based on delay
by Brandon Zhi 13 Oct '23

13 Oct '23

Hi all, I plan to use bgp_aigp instead of bgp_med to find the optimal route based on incremental pings per node. For example, if the delay between one node and another node is 40, then bgp_aigp increases by 40 after passing this ibgp. void bgp_aigp [O] This attribute contains accumulated IGP metric, which is a total distance to the destination through multiple autonomous systems. Currently, the attribute is not accessible from filters. But it seems I can't modify this value? Best Regard, *Brandon Zhi* HUIZE LTD www.huize.asia <https://huize.asia/>| www.ixp.su | Twitter This e-mail and any attachments or any reproduction of this e-mail in whatever manner are confidential and for the use of the addressee(s) only. HUIZE LTD can’t take any liability and guarantee of the text of the email message and virus.

3 4

Question Verification regarding UDP port of BFD
by Irene Lalioti 10 Oct '23

10 Oct '23

Hello dear Maria, Marian, and BIrd community, I would like to ask you your feedback regarding an issue a member of us has indicated. That member has stumbled upon a non-RFC compliant BFD source port with result their CISCO router to drop the BFD packets. Is it that Bird does not or does change the code to use a different source port? We would need to see how to workaround this issue. Předem moc děkuji!! Hesky den! Irene -- Irene Lalioti Network Engineer Fondation RESTENA 2, avenue de l'Université L-4365 Esch/Alzette Tel: +352 424409 1 Fax: +352 422473 This email may contain information for limited distribution only, please treat accordingly.

2 2