July 2026 - Bird-users - Mailing Lists

[PATCH] BGP: Fix bucket assert when encoding BMP route monitoring messages
by Yifei Sun 07 Oct '26

07 Oct '26

Good afternoon, the 2 issues I reported last week (e038bf6 and 371531d) was resolved on my side in 3.3.1. Thank you! Today in CI, I'm seeing some assertion throws that affects both 3.3.0 and 3.3.1 with BMP (traces also in the linked CI log): - https://github.com/stepbrobd/rfm/actions/runs/27352866052/job/80819677363#s… - https://github.com/stepbrobd/rfm/actions/runs/27347885470/job/80814124422#s… Relevant config: - https://github.com/stepbrobd/rfm/blob/187c61620b3af6ec77e1cc730c6b6b37d174d… I applied the same patch on 3.3.1 locally to unblock CI, and the current patch is based on thread-next bgp_create_update_bmp() encodes routes for BMP using a temporary bucket allocated on stack. Such buckets are not allocated from the bucket slab and have no ID assigned, so the assert at the beginning of bgp_delete_from_bucket() fails as soon as the NLRI encoder pops the prefix, aborting the daemon on the first route monitoring message that carries a real prefix. On BIRD 3.3.1: > Assertion 'b->my_id' failed at proto/bgp/attrs.c:2020 Temporary BMP buckets always hold exactly one prefix and take the single-prefix path, which does not use the bucket ID at all, so allow them through the assert. Introduced in 9fa3e89476ed53b6a9d41931a8cdf9a8c675be27 "BGP: Compacting export prefix buckets" --- proto/bgp/attrs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/proto/bgp/attrs.c b/proto/bgp/attrs.c index 6c38d4955..ee893d2c1 100644 --- a/proto/bgp/attrs.c +++ b/proto/bgp/attrs.c @@ -2063,7 +2063,7 @@ bgp_delete_from_bucket(struct bgp_ptx_private *c, struct bgp_bucket *b, u32 id) bgp_bucket_consistency(b); #endif - ASSERT_DIE(b->my_id); + ASSERT_DIE(b->my_id || b->bmp); u32 row_num = BUCKET_PREFIX_ROW(id); u32 pos = BUCKET_PREFIX_POS(id); ASSERT_DIE(b->last_pref_id); -- 2.54.0

3 5

BMP: no monitoring messages when enabled after BGP sessions (BIRD 3.2.1)
by Thomas Holterbach 01 Oct '26

01 Oct '26

Dear BIRD community, I am running a BMP collector and encountering an issue where no monitoring messages are exported over BMP, even though I am using the latest BIRD version (3.2.1), which should include the fix for the previous route export bug: https://gitlab.nic.cz/labs/bird/-/commit/2500b450b404ab41eeff3b2d92ba943d01… We tested this both in our lab and with a network operator, and consistently observe the following behavior: If the BMP session is activated before the BGP sessions, everything works as expected, and monitoring messages are exported. If the BGP sessions are established before enabling BMP, then BMP does not export monitoring messages at all. This suggests that BMP does not correctly pick up already-established BGP sessions. Below is a minimal configuration example. The behavior depends solely on the order in which the sessions are established : debug protocols all; router id 192.168.222.54; protocol kernel { ipv4 { export all; }; } protocol device { scan time 10; } filter ALLOW_ALL { accept; } protocol bmp { station address ip 192.168.222.1 port 4567; monitoring rib in pre_policy; tx buffer limit 1024; } protocol bgp peer_asn_10 { local 192.168.222.54 as 11; neighbor 192.168.222.52 as 10; multihop 255; ipv4 { import all; export all; next hop self; import table on; }; ipv6 { import all; export all; next hop self; import table on; }; } protocol bgp peer_asn_12 { local 192.168.222.54 as 11; neighbor 192.168.222.53 as 12; multihop 255; ipv4 { import all; export all; next hop self; }; ipv6 { import all; export all; next hop self; }; } Has anyone else experienced similar behavior? Could this be another bug related to BMP? Thanks in advance for your help. Best regards, Thomas

3 6

[Bug]: BIRD 3.3.1 memory leak on CLI call invocations
by Laszlo Király 29 Sep '26

29 Sep '26

Hello BIRD maintainers, I would like to report a memory leak in BIRD3. After uplifting from v2 we can see a persistent memory consumption increase in bird daemon. Running bird daemon by Valgrind turned out that the leak is in BIRD3's 'domain_new' called from 'cli_command'. Every birdc interaction leaks one 80-byte domain object. ==53== 248,160 bytes in 3,102 blocks are definitely lost in loss record 204 of 204 ==53== at 0x48419B4: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==53== by 0x4990D1: bird_xmalloc (xmalloc.c:46) ==53== by 0x584514: domain_new (domain.c:72) ==53== by 0x499438: obstacle_target_init (obstacle.h:57) ==53== by 0x499BCD: cli_command (cli.c:258) ==53== by 0x499D48: cli_event (cli.c:294) ==53== by 0x47CCEE: ev_run_list_limited (event.c:336) ==53== by 0x572FFE: io_loop (io.c:2641) ==53== by 0x5843CF: main (main.c:1114) ==53== ==53== LEAK SUMMARY: ==53== definitely lost: 248,160 bytes in 3,102 blocks ==53== indirectly lost: 0 bytes in 0 blocks ==53== possibly lost: 576 bytes in 2 blocks ==53== still reachable: 481,941 bytes in 3,818 blocks ==53== suppressed: 0 bytes in 0 blocks ==53== ==53== For lists of detected and suppressed errors, rerun with: -s ==53== ERROR SUMMARY: 34 errors from 12 contexts (suppressed: 0 from 0) Not familiar with BIRD source code, just guessing that domain_free() needs to be called when the CLI command's obstacle target completes. BGP+BFD routing was configured and'birdc configure/birdc show'commands are called frequently by our monitor application and the leak is proportional to CLI invocation count. Let me know if any additional detail is needed. --- Additionally, 'use-after-free errors' can be seen in the log: Invalid read of size 8 at bgp_listen_free (bgp.c:416) Address is inside a block that was already free'd by pool_free This happens during BGP protocol shutdown (proto_cleanup > proto_loop_stopped > pool_free > bgp_listen_free). The BGP listen socket structure is accessed after its containing pool is freed. This is a BIRD3 bug in protocol teardown ordering, not related to the memory leak but indicates a use-after-free that could cause crashes. Best Regards, Laszlo Kiraly

2 3

BIRD 3.3.0 Issue with bgp listen in VRF
by Arnaud Houdelette-Langlois 17 Sep '26

17 Sep '26

Hello. I’m currently trying to setup an EVPN SDN with proxmox (FRR) and bird for route reflectors and gateways. My RR BGP conf is like : template bgp vtep { vrf "vrf-underlay"; local as 65000; source address router_id; rr client; #rr cluster id 172.16.2.20; evpn { table evpnrr; igp table underlay; import all; export all; }; } protocol bgp uproxrtr1 from vtep { neighbor 172.16.2.21 internal; } This is working as long as bird is establishing the connexion. But the listening socket is opened in the default VRF. The issue disapear with bird 2.19.0, so I’ll stick with it for now. -- Arnaud HOUDELETTE-LANGLOIS Administrateur systèmes et réseaux informatiques Responsable de la sécurité des systèmes d'information Normandie-Université +33 2 31 56 69 54

2 2

Excuse me
by zx l 31 Jul '26

31 Jul '26

Hello BIRD maintainers, I am a security researcher working on open-source routing software security. Previously, I submitted several security issue reports to bird-support(a)network.cz, including vulnerability analysis, reproduction steps, and technical details related to the BIRD routing daemon. However, I have not received any acknowledgement or feedback so far. I would like to confirm whether these reports have reached the appropriate development/security team, or whether there is another preferred channel for reporting security issues. Could you please help confirm the appropriate security reporting process and whether the previous reports have been received? Thank you very much for maintaining the BIRD routing project. Best regards leo [image: Mailsuite] Sender notified with Mailtrack · Opt out <https://u.list-preferences.com/en/privacy/opt-out/unsubscribe/712ab5bc6586d…> 26/07/31 20:46:00

3 2

BIRD 3.3.2, 3.2.3, 3.1.8, 2.19.2, 2.18.3, 2.17.6 released
by Maria Matejka 31 Jul '26

31 Jul '26

Dear BIRD users, we're releasing patch versions for all the supported branches. Downloads are possible at <https://bird.nic.cz/get-bird/> and in our upstream repositories. There are some slightly security-relevant fixes. We have fixed a bunch of bugs. There are still more bugs to fix. The selection of what is fixed has no particular rule. Mostly, somebody in the team just picked up *something* and fixed it. We are fixing: - minor bugs in BGP and some more bugs in our Flowspec parser - processing of routes with recursive nexthops in Pipe and L3VPN in BIRD 3 - handling of passwords with zero bytes in them - several CLI crashes in BIRD 3 - several race conditions and missed corner cases in BIRD 3 If your bug report has been reported as fixed, we would love if you confirmed that from your side. If not, it will most probably get fixed in the next patch release. Officially supported versions are now: - 3.3.x and 2.19.x until 6 months after 3.4.0 and 2.20.0 get released - 3.2.x and 2.18.x until end of November 2026 - LTS 3.1.x and 2.17.x tracking Debian Trixie Also, on commercial note, we offer BIRD Support services, so that you can get help with configuration, priority access to critical bug information and fixes, and better influence the overall development directions. It's the users paying for these services, who keep the development running, so thank you to all who is already doing so! More on that at our website: <https://bird.nic.cz/commercial-services/> Happy routing! Maria and the BIRD Team -- Maria Matejka (she/her) | BIRD Team Leader | CZ.NIC, z.s.p.o.

2 1

BIRD 3.3.1 persist option (proto kernel) not working
by artem＠bonzo.me 31 Jul '26

31 Jul '26

After upgrade 3.2.2 -> 3.3.1 the ability to leave routes is broken. When stop Bird, all routes are removed from the linux kernel. Conf sample: protocol static { ipv4; route 172.16.0.0/12 blackhole; } protocol kernel { persist; scan time 5; learn off; ipv4 { import none; export all; }; }

3 3

Disable Sender Side Loop Protections
by Charles Rumford 20 Jul '26

20 Jul '26

Hello - I ‘m currently building a lab mockup of our network and using Bird the fake routers for the “internet”. A part of this mockup is having two to routers peer into the internet with the same AS and be able to receive the routes from the other. Juniper has this ability with the configuration option “advertise-peer-as”. I have read through the documentation, but can’t seem to find a configuration option to achieve the same thing. Is this possible with Bird? Charles Rumford Principal Infrastructure Architect charlesr(a)summithq.com<mailto:charlesr@summithq.com> O (312) 268-9342 [Summit]<https://www.summithq.com>

2 2

[3.3.1] How to debug excessive memory usage
by Mariusz Gronczewski 18 Jul '26

18 Jul '26

Hi, I've been observing some memory leak (slowly gets to ~30GB across 18 hours then dies to oomkiller, ~500kB/s growth), how can I debug it furter ? # birdc BIRD 3.3.1 ready. bird> show memory BIRD memory usage Effective Overhead Routing tables: 6059.3 MB 564.4 MB Route attributes: 9510.1 MB 565.8 MB Protocols: 22.3 MB 82.9 kB Current config: 60.8 kB 1232.0 B Standby memory: 0.0 B 32.7 MB Total: 15.2 GB 1163.0 MB Active pages: 16.2 GB Kept free pages: 32.7 MB Cold free pages: 194.2 MB Hot page cache depleted while in RCU: 66929 bird> show route count 2098594 of 2098594 routes for 1051498 networks in table master4 0 of 0 routes for 0 networks in table master6 it's relatively simple config with 2 peers like this: protocol bgp ispX { local as 12345; graceful restart; bfd; allow as sets; neighbor 1.2.3.4 as 65432; ipv4 { import table; export table; export filter bgp_ext_out; import filter bgp_ext_in; import keep filtered on; }; # kernel and OSPF }; protocol kernel kcore { kernel table 1002; learn all; ipv4 { export filter core_to_kernel; import filter kernel_to_core; }; }; protocol ospf core { vrf "core"; ecmp; tick 2; ipv4 { import keep filtered on; import filter ospf_core_in; export filter ospf_core_out; }; area 0 { interface "b-swcore.3000" { type pointopoint; }; interface "b-swcore.3011" { type pointopoint; }; interface "b-swcore.3012" { type pointopoint; }; interface "core" { stub; }; }; }; version from current Debian Testing It only started happening once router was enabled (before it was peered but did not push the routes to kernel table), tho it coincided with upgrade from 3.1 to 3.3.1 as I hit different bug there . I have also tried to disable "export/import table", "import keep filtered on" and "allow as sets" just to narrow it down but appears there is no change Regards, Mariusz -- Mariusz Gronczewski (XANi) <xani%2Bbird(a)devrandom.pl> GnuPG: 0xEA8ACE64 https://devrandom.eu

4 11

BIRD Blogpost: ASPA
by Maria Matejka 16 Jul '26

16 Jul '26

Dear BIRD users, after some discussions, we decided to write a blog post about ASPA. You may find and read the blog post here: https://en.blog.nic.cz/2026/07/16/aspa-explainer/ You'll find there: - an explanation how ASPA verification is performed - a link to a vibecoded ASPA simulator where one can try it out and see the partial results - a bunch of operational recommendations by the team As always, we appreciate you using BIRD. If you appreaciate us maintaining BIRD, we'd love to see a contract with you, so that we can safely continue with that. You may also buy some merch: https://bird-daemon.myspreadshop.co.uk/ Have a nice summer, winter, or whatever season you are currently in! -- Maria Matejka (she/her) | BIRD Team Leader | CZ.NIC, z.s.p.o.

1 0