- Bird-users - Mailing Lists

Fwd: ospfv6 cryptographic crashes bird
by Dries 07 Dec '20

07 Dec '20

Hi I am having an issue that crashes bird 2.0.7 running on latest centos 7.9.2009, most of the time, but sometimes not. Running the same config on other machines, and there is no problem, only on this particular one. So I am maybe missing some (cryptographic) libraries? I don't see any error messages during compilation or build. It has to do with ospfv6 because, when I remove this config, it runs fine. Example config that is causing issues: protocol ospf v3 ospfv6 { ipv6 { import filter import_ospfv6; export filter export_ospfv6; }; area 0.0.0.0 { interface "eth1" { cost 1; authentication cryptographic; password "password" { algorithm hmac sha512; }; type broadcast; ttl security yes; }; interface "xenbr0" { cost 100; type broadcast; ttl security yes; }; }; } When bird runs in debug mode, I get these error messages before bird crashes: sometimes this one: Assertion '*plen < ifa->sk->tbsize' failed at proto/ospf/packet.c:147 sometimes this one: Assertion '*plen < ifa->sk->tbsize' failed at proto/ospf/packet.c:97 These messages also appear during startup: ospfv6: Authentication failed for nbr 123.123.123.123 on eth1 - missing authentication trailer (0) Thank you in advance. Kind regards Dries

2 2

Wrong GPG key listed in the download page
by Baptiste Jonglez 06 Dec '20

06 Dec '20

Hi, I know GPG issues with the Debian packages came up several time on the list already, but more specifically, the GPG key listed here is outdated: https://bird.network.cz/?download&tdir=debian/ The files apt.gpg and apt.key contain key AC0E47584A7A714D from 2014-09-09 called "CZ.NIC Labs Archive Automatic Signing Key <ftpmaster(a)labs.nic.cz>". This key is revoked on key servers, and packages are signed with the newer key B188E2B695BD4743. Could you update the key in the webpage listed above? Thanks, Baptiste

1 0

Issue with unsigned integer LOCAL_PREF
by Alexandre Corso 04 Dec '20

04 Dec '20

Hello Bird team, Thank you for the great tool BIRD. I would like to open an issue (bird v2.0.7) about the local_pref. Today we hit an issue with one filter. if ! is_geo_region_local() then { bgp_local_pref = bgp_local_pref - 200; # If not defined, MED has a type of void instead of int if defined(bgp_med) then { bgp_med = bgp_med + 50; } else { bgp_med = 50; } } When some prefixes with the local_pref was below 200 (for example 100), the value overflow: localpref (unsigned integer 4^32) 100 - 200 = -100 = 4 ^ 32 - 100 = 4294967296 - 100 = 4294967196 We had the prefixes with this value 4294967196 X.X.X.X/32 unicast [ipv4_rr01 07:51:49.603 from 100.100.254.137] * (100/84285) [AS65030?] via 100.99.0.100 on eth1.666 Type: BGP univ BGP.origin: Incomplete BGP.as_path: 64619 65030 BGP.next_hop: y.y.y.y BGP.med: 50 BGP.local_pref: 4294967196 BGP.community: (35280,1040) (35280,2070) (35280,3110) BGP.originator_id: y.y.y.y BGP.cluster_list: 0.0.0.30 We had an exception to check the value of local_pref (on the filter) but can we have the something on the code, not to overflow the local_pref, for example SET to 0 if the value overflow? Our filter looks like this now if bgp_local_pref > 200 then bgp_local_pref = bgp_local_pref - 200; else { bgp_local_pref = 0; } Best Alexandre Corso alexandre@ac <mailto:alexandre@acorus.net>orso.fr

3 3

Inject ethernet-based defaults to OSPF
by daniele 04 Dec '20

04 Dec '20

Hello list, I???m looking for some advice from someone that has more experience. I'm running bird 1.6.6. I have two routers R1 and R2, each with a single internet uplink U1 and U2, running OSPF and sharing a LAN ethernet segment. Both U1 and U2 are dhcp-based ethernet segments themselves with a next-hop IP address that can change. I want R1 to be the primary LAN internet gateway and R2 the secondary. Should U1 fail, R1 has to route to R2 in order to reach internet through U2. How would you recommend to inject U1 and U2 default routes into OSPF? I cannot use the next-hop ip address as it changes along time, and an interface-based static route would not work. thanks a lot, d

3 8

BGP with ECMP and weight control
by Alexander Demenshin 02 Dec '20

02 Dec '20

Hi, I have two uplinks (different AS), and one is more stable/preferred, but when "merge paths" is set to on, all routes are generated with weight 1: 5.21.41.0/24 proto bird nexthop via 10.16.0.1 dev uplink1 weight 1 nexthop via 10.17.0.1 dev uplink2 weight 1 Is there any way to adjust weight for ECMP generated from BGP sessions? I could not find any option/attribute when it is related to BGP or kernel protocol, while it is possible for OSPF and static protocols (to a degree). Adjusting local preference or med (in BGP) does not really help - weight is unchanged, though of course I could force routes from specific AS to be preferred, but then I lose ECMP and if preferred session is dropped it takes time to restore connectivity. Thank you! Best regards, Alexander.

4 6

Direct routes and OSPF
by Alasdair Muckart 01 Dec '20

01 Dec '20

I've got a question about importing direct routes and interaction with BGP & OSPF. We have an issue with BIRD (1.6.3) when we do a 'configure soft' we end up with linknet routes being learned via indirect paths over OSPF which breaks BFD and BGP. It only happens with IPv6, not IPv4. Given routers A, B, C and D: A----B | | C----D Doing a 'birdc6 configure soft' on router A will sometimes end up with the linknet for A-C being put in the kernel table by OSPF learned from B. Not all interfaces are part of OSPF and I'm wondering if importing direct routes into BIRD for all interfaces would stop OSPF from trying to insert the routes into the kernel table? Any ideas would be greatly appreciated. Thanks. -- Alasdair Muckart (he/him) Network Engineer Catalyst IT - Expert Open Source Solutions Mobile: +64 22 638 5141 | DDI: +64 4 897 7794 | www.catalyst.net.nz CONFIDENTIALITY NOTICE: This email is intended for the named recipients only. It may contain privileged, confidential or copyright information. If you are not the named recipient, any use, reliance upon, disclosure or copying of this email or its attachments is unauthorised. If you have received this email in error, please reply via email or call +64 4 499 2267.

2 1

ospf stub interfaces appears as two entries in routing table (direct + ospf)
by Kenth Eriksson 01 Dec '20

01 Dec '20

If I configure an OSPF interface as a stub interface, why does it appear twice the routing table? E.g. setting interface lo as stub interface results in the following; 10.210.137.78/32 unicast [direct1 15:59:09.550] * (255) dev lo unicast [ospfv2_1 20:47:56.864] I (145/0) [10.210.137.78] dev lo The source OSPF-I misleads me in thinking that it was learned from the OSPF area.

2 1

RPKI validation troubles
by Julien Sansonnens 27 Nov '20

27 Nov '20

Hi everybody, I'm using bird 2.0.7 and experience some troubles with RPKI validation. here is my config (relevant parts only): roa6 table r6; protocol rpki validator { roa6 { table r6; }; remote "XXXXXX" port 8282; } protocol bgp XXXX{ ipv6 { import keep filtered; import filter { if ( roa_check( r6, net, bgp_path.last ) = ROA_INVALID ) then { reject; } else ....... I know that ROA support is still incomplete in BIRD. So I specified a connection delay for my BGP peers to wait for the r6 table to be filled. I thought my filter was working fine, and this morning I noticed that there were some invalid routes in my table. However, the status of these routes does not vary, they have not changed from valid to invalid, they have been invalid for years. It's not their status that has changed, it's my filters that suddenly don't work anymore (on some pairs only). Have you ever had this problem ? So, I take advantage of asking if the next version of BIRD will include more complete ROA support? cheers, julien

1 0

[PATCH v3 0/7] Add MAC authentication support to the Babel protocol
by Toke Høiland-Jørgensen 26 Nov '20

26 Nov '20

This series adds MAC authentication support to the Babel protocol as specified in by the IETF Babel working group in draft-babel-hmac-10: https://tools.ietf.org/html/draft-ietf-babel-hmac-10 I have performed basic interoperability testing between this implementation and the current babeld HMAC implementation[1]. The two implementations were able to successfully exchange authenticated messages with both HMAC-256 and Blake2s-256 keys. Given the above, and the close-to-final state of the specification at the IETF, I believe this series is ready for merging (subject to review, of course). For those wanting to test the code, a version of Bird with this series applied is available on Github[2] for easy consumption. [1] https://github.com/jech/babeld/pull/52 [2] https://github.com/tohojo/bird/tree/babel-mac-03 Changelog: v3: - Add variants with smaller digest sizes for blake2s and blake2b. - Rebase on current master v2: - Don't reinvent AC_CHECK_FUNCS() for configure - Make sure random_bytes() never fails (without taking the whole daemon with it) - Use existing endianness defines in blake2s code - Just leave MAC-related code in babel.c/packets.c instead of adding a new file - Add blake2s test vectors (new patch 3) - Support supplying mac keys as raw hexadecimal bytes and allow algorithms to validate keys on configure (new patches 4-5) v1: - Add wrapper function to bird sysdep code to pick a suitable source of random bytes - Import reference Blake2 implementations into lib/ - Rename function names and data structures to use an auth_ prefix instead of hmac_ - Perform a separate authentication pass before parsing the packet, and move the authentication-related code to its own source file - Enforce key length recommendation from the specification - Add a 'permissive' configuration mode where outgoing packets are signed but incoming packets are accepted even though they fail authentication - Add user documentation for the authentication configuration, and function docstrings to the main authentication functions - Fix a bunch of nits and code style issues --- Toke Høiland-Jørgensen (7): sysdep: Add wrapper to get random bytes nest: Add Blake2s and Blake2b hash functions mac_test: Add tests for blake2s and blake2b nest: Allow specifying security keys as hex bytes as well as strings config: Allow MAC algorithms to specify a function to validate their keys babel: Refactor TLV parsing code for easier reuse babel: Add MAC authentication support conf/cf-lex.l | 31 + conf/conf.h | 5 + conf/confbase.Y | 2 + doc/bird.sgml | 47 +- lib/Makefile | 2 +- lib/blake2-impl.h | 160 ++ lib/blake2-kat.h | 4111 +++++++++++++++++++++++++++++++++++++++++ lib/blake2-ref.h | 112 ++ lib/blake2.c | 48 + lib/blake2.h | 67 + lib/blake2b-ref.c | 270 +++ lib/blake2s-ref.c | 263 +++ lib/mac.c | 31 +- lib/mac.h | 14 + lib/mac_test.c | 91 + lib/string.h | 1 + lib/strtoul.c | 27 + nest/config.Y | 54 +- nest/password.c | 6 + nest/password.h | 1 + proto/babel/Makefile | 2 +- proto/babel/babel.c | 156 +- proto/babel/babel.h | 66 +- proto/babel/config.Y | 46 +- proto/babel/packets.c | 661 ++++++- 25 files changed, 6161 insertions(+), 113 deletions(-) create mode 100644 lib/blake2-impl.h create mode 100644 lib/blake2-kat.h create mode 100644 lib/blake2-ref.h create mode 100644 lib/blake2.c create mode 100644 lib/blake2.h create mode 100644 lib/blake2b-ref.c create mode 100644 lib/blake2s-ref.c

2 9

Passive BGP configuration
by Robert Scheck 26 Nov '20

26 Nov '20

Hello, where is my mistake? Static routing between 2001:db8:1::/64 and 2001:db8:1:a::/64 (configured outside of BIRD) works. # r1 (2001:db8:1::1/64) protocol bgp r2 { local as 4200000000; neighbor range 2001:db8:1::/50 as 4200000001; # Never comes up # neighbor 2001:db8:1:a::1 as 4200000001; # Just works... source address 2001:db8:1::1; multihop 2; } # r2 (2001:db8:1:a::1/64) protocol bgp r1 { local as 4200000001; neighbor 2001:db8:1::1 as 4200000000; multihop 2; } Both systems are BIRD 2.0.7. Regards, Robert

2 3