February 2024 - Bird-users

Re: IPv6 routes not imported into Kernel
by Gerdriaan Mulder 29 Feb '24

29 Feb '24

Hi Robert, On 15/11/2023 22:58, Robert Finze wrote: > The Bird config on both systems is nearly identical (only IPs differ) > and also the systems are setup in a similar manner. It would be good to have a dump of the configuration of the non-working system (redact sensitive information such as passwords etc, but leave other information intact). > The routes are correctly learned from upstream and exported to the > kernel, but the kernel is not "learning" them. Interesting. The following dumps you sent might further help debugging the problem. > Netlink route > 0000 00 04 03 38 00 00 00 00 00 00 00 00 00 00 00 00 ...8............ > 0010 68 00 00 00 18 00 05 05 13 0d 66 02 00 00 00 00 h.........f..... > 0020 0a 28 00 00 fe 0c 00 01 00 00 00 00 14 00 01 00 .(.............. > 0030 26 07 ff 00 0b 00 00 00 00 00 00 00 00 00 00 00 &............... > 0040 08 00 06 00 20 00 00 00 14 00 07 00 2a 0e 39 40 .... .......*.9@ > 0050 10 00 00 00 00 00 00 00 00 00 00 02 08 00 04 00 ................ > 0060 02 00 00 00 14 00 05 00 2a 0e 39 40 de ad 00 00 ........*.9@.... > 0070 00 00 00 00 00 00 00 01 ........ This decodes to (Wireshark supports "Import from hexdump", as I found out): Linux rtnetlink (route netlink) protocol Netlink message header (type: Add network route) Length: 104 Message type: Add network route (24) Flags: 0x0505 Flags: 0x0505 Sequence: 40242451 Port ID: 0 Address family: AF_INET6 (10) Length of destination: 40 Length of source: 0 TOS filter: 0x00 Routing table ID: 254 Routing protocol: BIRD (0x0c) Route origin: global route (0x00) Route type: Gateway or direct route (0x01) Route flags: 0x00000000 Attribute: Route destination address Len: 20 Type: 0x0001, Route destination address (1) Data: 2607ff000b0000000000000000000000 Attribute: RTA_PRIORITY Len: 8 Type: 0x0006, RTA_PRIORITY (6) Data: 20000000 Attribute: RTA_PREFSRC Len: 20 Type: 0x0007, RTA_PREFSRC (7) Data: 2a0e3940100000000000000000000002 Attribute: Output interface index: 2 Len: 8 Type: 0x0004, Output interface index (4) Output interface index: 2 Attribute: Gateway of the route Len: 20 Type: 0x0005, Gateway of the route (5) Data: 2a0e3940dead00000000000000000001 > 0000 00 04 03 38 00 00 00 00 00 00 00 00 00 00 00 00 ...8............ > 0010 7c 00 00 00 02 00 00 00 13 0d 66 02 7a 31 09 81 |.........f.z1.. > 0020 ea ff ff ff 68 00 00 00 18 00 05 05 13 0d 66 02 ....h.........f. > 0030 00 00 00 00 0a 28 00 00 fe 0c 00 01 00 00 00 00 .....(.......... > 0040 14 00 01 00 26 07 ff 00 0b 00 00 00 00 00 00 00 ....&........... > 0050 00 00 00 00 08 00 06 00 20 00 00 00 14 00 07 00 ........ ....... > 0060 2a 0e 39 40 10 00 00 00 00 00 00 00 00 00 00 02 *.9@............ > 0070 08 00 04 00 02 00 00 00 14 00 05 00 2a 0e 39 40 ............*.9@ > 0080 de ad 00 00 00 00 00 00 00 00 00 01 ............ decodes as: Netlink message Netlink message header (type: Error) Length: 124 Message type: Error (0x0002) Flags: 0x0000 Sequence: 40242451 Port ID: 2164863354 Error code: Invalid argument (-EINVAL) (-22) Netlink message header (type: 0x0018) Length: 104 Message type: Protocol-specific (0x0018) Flags: 0x0505 Flags: 0x0505 Sequence: 40242451 Port ID: 0 The first message could probably be replicated by running: ip -6 route add 2607:ff00:b::/40 via 2a0e:3940:dead::1 table 254 protocol bird scope global src 2a0e:3940:1000::2 dev 2 - where dev 2 indicates the network interface with index 2, this is probably ens20 in your setup? - table 254 is most likely the main table (see /etc/iproute2/rt_tables) I'm unsure how to decode RTA_PRIORITY correctly here. Regardless, you could run this command on the non-working host. Perhaps `ip route` can tell you a bit more information. In a slightly modified case (I've replaced the `via ...` with a known gateway), I get: "Error: Invalid source address." (with: iproute2-6.5.0) My current hunch is that `src 2a0e:3940:1000::2` is not a valid address on your system. A closer read on your earlier comment: > The Bird config on both systems is nearly identical (only IPs differ) suggests to look in this direction. Best regards, Gerdriaan Mulder

2 3

babel rtt in bird: How to set the RTT equal to the latency?
by Marek Küthe 29 Feb '24

29 Feb '24

Hello, I have seen that in bird 2.14 the babel rtt extension has been implemented. I was very happy about that! Currently I use the following setting of babeld for rtt: ``` default type tunnel rtt-min 1 rtt-max 1001 max-rtt-penalty 1000 enable-timestamps true ``` It causes the RTT to be equal to the latency to the other node. I have seen that there is both rtt-min and rtt-max setting in bird, but no max-rtt-penalty. So my question is how would I represent the above expression in bird? I would be very happy to get an answer! Greetings Marek Küthe -- Marek Küthe m.k(a)mk16.de er/ihm he/him

3 3

bird not exporting OSPF route
by Nico Schottelius 28 Feb '24

28 Feb '24

Good morning, after switching over to the following filter, as mentioned in the last mails: filter static_and_bgp_and_ospf { if(source = RTS_STATIC || source = RTS_BGP || source = RTS_OSPF) then accept; reject; } I still see routes that are missing in the kernel, even though they are coming in via OSPF and BGP: -------------------------------------------------------------------------------- bird> show route all for 2a0a:e5c0:2:a::b Table master6: 2a0a:e5c0:2:a::b/128 unicast [ospf6 2024-02-26] * E2 (150/10/10000) [147.78.194.129] via fe80::3eec:efff:fecb:d81a on eth0 Type: OSPF-E2 univ OSPF.metric1: 10 OSPF.metric2: 10000 OSPF.tag: 0x00000000 OSPF.router_id: 147.78.194.129 unicast [router1_place10_v6_v4 2024-02-26 from 2a0a:e5c0:1:8::50] (100/10) [i] via fe80::21b:21ff:febc:bf36 on eth1 Type: BGP univ BGP.origin: IGP BGP.as_path: BGP.next_hop: 2a0a:e5c0:1:8::50 fe80::21b:21ff:febc:bf36 BGP.local_pref: 500 bird> bird> show protocols all kernel_v6 Name Proto Table State Since Info kernel_v6 Kernel master6 up 2024-02-05 Channel ipv6 State: UP Table: master6 Preference: 10 Input filter: ACCEPT Output filter: static_and_bgp_and_ospf Routes: 0 imported, 199204 exported, 0 preferred Route change stats: received rejected filtered ignored accepted Import updates: 0 0 0 0 0 Import withdraws: 0 0 --- 0 0 Export updates: 11127835 0 7001 --- 11120834 Export withdraws: 1131164 --- --- --- 1133092 bird> show route count filter static_and_bgp_and_ospf 2802064 of 2802068 routes for 937748 networks in table master4 583651 of 583679 routes for 199200 networks in table master6 Total: 3385715 of 3385747 routes for 1136948 networks in 2 tables bird> -------------------------------------------------------------------------------- (BGP can be ignored, the OSPF route is relevant) Checking on the OS side, I see the local IPv6 address 2a0a:e5c0:2:a::a on lo, but not the remote IPv6 address 2a0a:e5c0:2:a::b that should be added: -------------------------------------------------------------------------------- [08:08] server122.place10:~# ip -6 r | grep 2a0a:e5c0:2:a 2a0a:e5c0:2:a::a dev lo proto kernel metric 256 pref medium [08:08] server122.place10:~# ip route get 2a0a:e5c0:2:a::b RTNETLINK answers: Host is unreachable [08:17] server122.place10:~# -------------------------------------------------------------------------------- What am I doing wrong here? And is there actually a CLI syntax for verifying that a route is accepted by a filter? In case of this particular filter there are a lot of matches, so displaying them and checking is not really feasible. Greetings from Seoul, Nico -- Sustainable and modern Infrastructures by ungleich.ch

2 2

Injecting OSPF learned routes (only)
by Nico Schottelius 27 Feb '24

27 Feb '24

Good morning bird users, I am a bit puzzled about properly adding OSPF learned routes into the kernel and let me show you why: If I use a filter such as: filter static_and_bgp_and_ospf { if(source = RTS_STATIC || source = RTS_BGP || source = RTS_OSPF) then accept; reject; } And configure the kernel to use it like this: protocol kernel kernel_v4 { ipv4 { export filter static_and_bgp_and_ospf; }; } protocol kernel kernel_v6 { ipv6 { export filter static_and_bgp_and_ospf; }; } Then I get route duplications in the kernel: [04:29] server123.place10:~# ip r | grep 147.78.195.224/27 147.78.195.224/27 dev eth1 proto kernel scope link src 147.78.195.254 147.78.195.224/27 dev eth1 proto bird scope link metric 32 The reason for that semes: - server123 has the route because of an interface address - other hosts in the network also have an interface in that network While this is not necessarily a big problem, it seems wrong to inject the route, because we learned it from OSPF, even though we already had it in the first place. How do you usually handle inserting OSPF learned routes? Do you just have them duplicate or do you have some logic that resembles.. "If I already have that route and I receive it again from outside (such as OSPF), do not inject it again" ? Looking forward to read how you handle this logic! Best regards from Seoul, Nico -- Sustainable and modern Infrastructures by ungleich.ch

4 3

segfault on running "show mem" command with bird-3.0alpha2
by Prem Anand 26 Feb '24

26 Feb '24

Hi All, I am seeing this segfault with bird-3.0alpha2 on trying to run the "show mem" command. Not sure if it is a known issue. Just thought of reporting it. By the way, bird-3.0 though in alpha, looks really stable. Was able to scale upto 1K BGP Sessions without any major issues. Eagerly looking for a 3.0 stable release soon. Regards Prem Thread 1 "bird" received signal SIGSEGV, Segmentation fault. 0x00005555555841c3 in rmemsize (res=<optimized out>) at lib/resource.c:271 271 if (!r->class->memsize) (gdb) bt #0 0x00005555555841c3 in rmemsize (res=<optimized out>) at lib/resource.c:271 #1 cmd_show_memory () at nest/cmds.c:122 #2 0x000055555560c03e in cf_parse.isra.0 () at nest/config.Y:640 #3 0x000055555556a523 in cli_parse (c=0x7fffffffd920) at conf/conf.c:179 #4 0x00005555555837fd in cli_command (c=c@entry=0x5555556bb338) at nest/cli.c:273 #5 0x0000555555583b3c in cli_event (data=0x5555556bb338) at nest/cli.c:302 #6 0x00005555555786cb in ev_run_list_limited (l=0x555555681000 <global_event_list>, limit=4294967294) at lib/event.c:331 #7 0x0000555555566e14 in io_loop () at sysdep/unix/io.c:2216 #8 main (argc=<optimized out>, argv=<optimized out>) at sysdep/unix/main.c:972 (gdb) f 1 #1 cmd_show_memory () at nest/cmds.c:122 122 struct resmem total = rmemsize(&root_pool); (gdb) print root_pool $3 = {r = {n = {next = 0x0, prev = 0x0, list = 0x0}, class = 0x0}, inside = {first = 0x555555685360, last = 0x5555556bb630}, domain = 0x555555680e40 <the_bird_domain_gen.lto_priv>, name = 0x555555656735 "Root"} (gdb) print root_pool->r->class $5 = (const struct resclass *) 0x0 (gdb)

2 2

L3VPN and BGP add-path
by Marcel Menzel 26 Feb '24

26 Feb '24

Hello List, I am running the new MPLS L3VPN feature for quite a while now, and it's working without issues so far for me, but I have one question: I set "add paths on;" on my iBGP peer template in all SAFIs and while it was running successfully before the migration to L3VPN, the additional routes in the RIB are now gone, but the capabilities are still exchanged between peers. Furthermore, I can't set "add paths on;" property for any SAFI in the L3VPN protocol, this might be the reason why those additional routes are missing? My only question now is if this just hasn't been implemented yet with BIRD (I am just being curious hence I'm asking), my config is something missing or this being the general fact that add-path with MPLS L3VPN simply is not a thing with other vendors aswell (to be fair, I've never seen an L3VPN network with add-path enabled in production so far). Thanks for the heads-up in advance, Marcel

2 1

Re: FOSDEM 2024 talk recording - Flying higher: hardware offloading with BIRD
by Asbjørn Sloth Tønnesen 23 Feb '24

23 Feb '24

Hi Tim, Thanks for posting. On 2/20/24 09:14, Tim Small wrote: > If anyone is looking to reproduce this setup, then ConnectX 5 NICs (both 25Gb and 100Gb) seem to be available used on > online auction sites from around 150 Euro. The talk was a bit crammed for time, but the next speaker didn't show up, so we unexpectedly had time for questions. Once I get the last bit's done, I will do a more detailed blog post, about the setup we are making at my hackerspace Labitat (AS2052350), for that we also need forwarding to directly connected hosts and reverse path filtering. One of the last slides has a picture of this setup, with a thin client and a ConnectX-5 running at <15W while doing 10G routing (DAC). Currently I am trying to fix kernel performance, for the non-offloaded long-tail traffic: https://lore.kernel.org/netdev/20240215160458.1727237-1-ast@fiberby.net/ -- Best regards Asbjørn Sloth Tønnesen

2 2

[patch] add 'source address' configuration option to RPKI protocols
by Job Snijders 22 Feb '24

22 Feb '24

Dear BIRD team, Greetings from Amsterdam! I'd like to be able to explicitly configure the source IP address for RPKI-To-Router sessions. Predictable source addresses are useful for minimizing the holes to be poked in ACLs. The below changeset adds a 'source address' configuration option to RPKI protocols. Kind regards, Job diff --git doc/bird.sgml doc/bird.sgml index 76ca7f75..a271d47e 100644 --- doc/bird.sgml +++ doc/bird.sgml @@ -5700,6 +5700,7 @@ protocol rpki [<name>] { refresh [keep] <num>; retry [keep] <num>; expire [keep] <num>; + source address <ip>; transport tcp; transport ssh { bird private key "</path/to/id_rsa>"; @@ -5753,6 +5754,9 @@ specify both channels. instead. This may be useful for implementing loose RPKI check for blackholes. Default: disabled. + <tag>source address <m/ip/</tag> + Define local address we should use as a source address for the RTR session. + <tag>transport tcp</tag> Unprotected transport over TCP. It's a default transport. Should be used only on secure private networks. Default: tcp diff --git proto/rpki/config.Y proto/rpki/config.Y index c28cab7a..31656057 100644 --- proto/rpki/config.Y +++ proto/rpki/config.Y @@ -32,7 +32,7 @@ rpki_check_unused_transport(void) CF_DECLS CF_KEYWORDS(RPKI, REMOTE, BIRD, PRIVATE, PUBLIC, KEY, TCP, SSH, TRANSPORT, USER, - RETRY, REFRESH, EXPIRE, KEEP, IGNORE, MAX, LENGTH) + RETRY, REFRESH, EXPIRE, KEEP, IGNORE, MAX, LENGTH, SOURCE, ADDRESS) %type <i> rpki_keep_interval @@ -60,6 +60,7 @@ rpki_proto_item: | REMOTE rpki_cache_addr | REMOTE rpki_cache_addr rpki_proto_item_port | rpki_proto_item_port + | SOURCE ADDRESS ipa { RPKI_CFG->local_ip = $3; } | TRANSPORT rpki_transport | REFRESH rpki_keep_interval expr { if (rpki_check_refresh_interval($3)) diff --git proto/rpki/rpki.h proto/rpki/rpki.h index 8a5c38fd..e67eb0e3 100644 --- proto/rpki/rpki.h +++ proto/rpki/rpki.h @@ -116,6 +116,7 @@ struct rpki_proto { struct rpki_config { struct proto_config c; const char *hostname; /* Full domain name or stringified IP address of cache server */ + ip_addr local_ip; /* Source address to use */ ip_addr ip; /* IP address of cache server or IPA_NONE */ u16 port; /* Port number of cache server */ struct rpki_tr_config tr_config; /* Specific transport configuration structure */ diff --git proto/rpki/transport.c proto/rpki/transport.c index 81bd6dd8..26571977 100644 --- proto/rpki/transport.c +++ proto/rpki/transport.c @@ -82,6 +82,7 @@ rpki_tr_open(struct rpki_tr_sock *tr) sk->daddr = cf->ip; sk->dport = cf->port; sk->host = cf->hostname; + sk->saddr = cf->local_ip; sk->rbsize = RPKI_RX_BUFFER_SIZE; sk->tbsize = RPKI_TX_BUFFER_SIZE; sk->tos = IP_PREC_INTERNET_CONTROL;

2 2

Take Specific Value Inside BGP Community
by Ilham Maulana 20 Feb '24

20 Feb '24

Hi, Is it possible in bird to copy specific value inside BGP Community? Example: Route 1, Community (a,b,c) -> inbound Route 2, Community (a,b,d) -> inbound -- Route 1, Community (k,l,c) -> outbound Route 2, Community (k,l,d) -> outbound The specific value I want to preserve is c and d, and it is dynamic variable. whatever c and d inbound, copy to c and d outbound. Thanks. Ilham [5f622eb5-c189-4e05-8584-e4a1d2071a6b]

3 4

Adding support for an experimental IPv6 Hop By Hop Extension header
by Mccherry, Paul (Postgraduate Researcher) 19 Feb '24

19 Feb '24

I am a Phd Researcher at Lancaster university researching the security of the UK Internet infrastructure. I need to add support for a proposed experimental IPv6 Hop By Hop Extension Header to a routers Kernel to test my theories. I am more a server/network engineer and researcher than I am a programmer but I am able to write in Python and use scripting languages. Can anyone recommend tools and Router emulation software where one could add support for an experimental IPv6 Hop By Hop Extension Header in order to test the methodology ? The new extension header requires changes to the IFindex table (an additional field) and a new ACL to make routing decisions on the new field within the IFindex table. It also will need to provide the capability of allowing an installation engineer to make changes to this field on initial setup. If Bird is unable to provide such a testbed, can anyone recommend another solution. ? However, I do think a capability to provide researchers with an easy method to test new IPv6 Extension headers would be really useful considering the takeup of IPv6 and the future of the internet.

3 2