- Bird-users - Mailing Lists

Bug? / Patch for BGP next hop issue with frr peers
by Sebastian Hahn 29 Apr '20

29 Apr '20

Hi, let me preface this that I very much do not know what I am doing here, and have been somewhat unsuccessful in trying to understand what's going on by searching online. I would love an explanation though! In a bird 2.0.7 setup, I was unable to import routes from one of my peers. It is the only one using frr (version 6.02-2 on debian), most other peers use bird1 or bird2. I noticed immediately after adding the peering that I received "Invalid NEXT_HOP attribute" errors in the log. Unfortunately, no more information than that was provided in the log, so I went on a little hunt. Since the exact error is raised from many places, I added some logs to identify the GW_DIRECT case in bgp_apply_next_hop() as the culprit. Here I realized that both gw and ll are set, which means a neighbor is tried to be found which doesn't involve the ll case. I then noticed that in bgp_decode_next_hop_ip(), this can only happen if len == 32. This is where I am absolutely clueless what it means for the nh len to be 32, and thus I don't know if the patch I came up with is correct, even though it works for my testing. Only this one peer using frr causes nh len to be set to 32, so I suppose it might be a rare configuration. I added this simple patch: --- bird2-2.0.7.orig/proto/bgp/packets.c +++ bird2-2.0.7/proto/bgp/packets.c @@ -1174,6 +1174,9 @@ bgp_decode_next_hop_ip(struct bgp_parse_ if (ipa_is_ip4(nh[0]) || !ip6_is_link_local(nh[1])) nh[1] = IPA_NONE; + + if (ip6_is_link_local(nh[1])) + nh[0] = IPA_NONE; } else bgp_parse_error(s, 9); ~ which worked for me to resolve the problem. Thanks for any consideration! Cheers Sebastian

4 11

Support for machine-readable status output
by Pascal Mathis 28 Apr '20

28 Apr '20

Hi everyone, I am wondering if the official maintainers would accept patches for introducing machine-readable status output to BIRD. I am asking as there definitely is a clear demand for such a solution, as can be seen by these previous mailing list posts and projects: - https://github.com/mchackorg/birdwatcher (JSON API Server) - https://github.com/inex/birdseye (JSON API Server) - https://github.com/czerwonk/bird_exporter (Prometheus Exporter) - https://www.npmjs.com/package/node-bird-routeparse (JSON Generator) - https://bird.network.cz/pipermail/bird-users/2018-March/012088.html (Previous JSON patch submitted by Alistair Crooks) - https://github.com/sileht/bird-lg (BIRD LG with Python Command Proxy) - https://bird.network.cz/pipermail/bird-users/2017-June/011362.html (Previous mentions of people working on structured output for BIRD) - https://bird.network.cz/pipermail/bird-users/2011-September/002441.html (ML post showing support for JSON output) All the current solutions mentioned above query BIRD by either running the "birdc" executable or directly interacting with the SMTP-like protocol on the socket, followed by applying regular parsing magic to extract the required information. While this certainly works, I think adding some kind of structured/machine-readable output (e.g. JSON) would greatly simplify such integrations in the future and people would no longer have to rely on brittle text parsing which can break on any text formatting changes. Compared to other routing daemons with massive API interfaces (e.g. NETCONF or gRPC), BIRD clearly follows a path of simplicity and robustness, which is probably a reason why a lot of people are relying on it. I personally think that adding a whole API interface for both reading and writing would be overkill, as the configuration can already be easily templated and reliably reloaded. To cut a long story short, I would appreciate if BIRD2 would be able to output various sorts of information in a structured, machine-readable way, e.g. using JSON to print statistics, bgp peers, route lookups and more. This could be implemented by adding a flag for JSON output to existing commands, as adding a full-blown HTTP server directly into BIRD seems like a bad idea. Would such patches be considered for upstreaming or was there ever a decision to not implement this kind of feature? Is maybe someone already working on a feature like this? Thanks in advance for any kind of reply and have a nice day. Best regards, Pascal

4 3

Invalid ROA
by Fabiano D'Agostino 28 Apr '20

28 Apr '20

Hi, how can I check which prefixes are not valid and so rejected? It seems the rpki is working, but I'd like to be sure. I have this: if (roa_check(r4, net, bgp_path.last) = ROA_INVALID) then { print "Ignore RPKI invalid ", net, " for ASN ", bgp_path.last; but I don't understand where the prints go. Thanks, Fabiano

6 14

Bird2 installation failing for debian https://bird.network.cz/?download&tdir=debian/
by Akshay kumar 27 Apr '20

27 Apr '20

Hi all, I am trying to install bird2 from apt as mention in https://bird.network.cz/?download&tdir=debian/ for debian. Its getting failed, seems to be related to apt key is missing, please advise. "W: GPG error: http://bird.network.cz/debian buster InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY B188E2B695BD4743 E: The repository 'http://bird.network.cz/debian buster InRelease' is not signed. N: Updating from such a repository can't be done securely, and is therefore disabled by default. N: See apt-secure(8) manpage for repository creation and user configuration details." Thanks Akshay

2 2

Need to run 'configure' command two times to apply route filter change
by Nasato Goto 27 Apr '20

27 Apr '20

Hi all, I run BIRD v2.0.7 as a route server. When I changed the route filter configuration in BIRD, for example adding prefix entry to a filter, I needed to execute 'configure' command twice to apply new route filter. The first 'configure' command didn't affect. The prefix which I added to filter configuration was kept to be rejected. I could only see '<protocol_name> reconfigured' message in the log file. Then the second 'configure' worked. The prefix was accepted. I saw '<protocol_name>: Sending ROUTE-REFRESH' message in log file. Is this a normal behavior or am I missing something? Best regards, ----- Nasato Goto INTERNET MULTIFEED CO. goto(a)mfeed.ad.jp -----

2 2

Vulnerability? Bug? Missing check after xmalloc() in xstrdup().
by liupeiyu＠zju.edu.cn 27 Apr '20

27 Apr '20

Hi,In lib/string.h line 38,staticinlinechar*xstrdup(constchar*c){size_tl=strlen(c)+1;// xmalloc may fail, and z will be NULL. char*z=xmalloc(l);// write to a NULL pointer, crash. memcpy(z,c,l);returnz;}I think this is a vulnerability, and maybe we can fix it as following:staticinlinechar*xstrdup(constchar*c){size_tl=strlen(c)+1;char*z=xmalloc(l); if(z) { memcpy(z,c,l);returnz; } else return -1;}Thanks for any consideration!Peiyu Liu, NESA lab, Zhejiang University

2 2

"bird -p" creates log file owned by root
by Brian Candler 24 Apr '20

24 Apr '20

Hello, I'm testing out the bird2 2.0.7 package from the PPA under Ubuntu 18.04, and I've found a problem with permissions on log files when run under systemd. I created a directory /var/log/bird/ owned by bird:bird, and configured logging as: log "/var/log/bird/bird.log" all; This works fine when I start bird by hand: root@rs1:/etc/bird# ls -l /var/log/bird total 0 root@rs1:/etc/bird# /usr/sbin/bird -f -u bird -g bird ^C root@rs1:/etc/bird# ls -l /var/log/bird total 4 -rw-r--r-- 1 bird bird 39 Apr 24 11:00 bird.log The problem is that when running under systemd, the log file is created owned by root:root and this causes bird to crash with a permissions error: root@rs1:/etc/bird# rm /var/log/bird/bird.log root@rs1:/etc/bird# systemctl start bird root@rs1:/etc/bird# ls -l /var/log/bird total 0 -rw-r--r-- 1 root root 0 Apr 24 11:03 bird.log root@rs1:/etc/bird# journalctl -eu bird ... Apr 24 11:01:28 rs1 systemd[1]: Starting BIRD Internet Routing Daemon... Apr 24 11:01:28 rs1 systemd[1]: Started BIRD Internet Routing Daemon. Apr 24 11:01:28 rs1 bird[1849]: /etc/bird/bird.conf:9:30 Unable to open log file '/var/log/bird/bird.log': Permission denied Apr 24 11:01:28 rs1 bird[1849]: bird: /etc/bird/bird.conf:9:30 Unable to open log file '/var/log/bird/bird.log': Permission denied Apr 24 11:01:28 rs1 systemd[1]: bird.service: Main process exited, code=exited, status=1/FAILURE Apr 24 11:01:28 rs1 systemd[1]: bird.service: Failed with result 'exit-code'. I found the cause. /lib/systemd/system/bird.service includes the line "ExecStartPre=/usr/sbin/bird -p", and if the log file doesn't exist, it creates it owned by root:root root@rs1:/etc/bird# rm /var/log/bird/bird.log root@rs1:/etc/bird# /usr/sbin/bird -p root@rs1:/etc/bird# ls -l /var/log/bird/bird.log -rw-r--r-- 1 root root 0 Apr 24 11:07 /var/log/bird/bird.log The documentation for the -p flag states: -p Just parse the config file and exit. Return value is zero if the config file is valid, nonzero if there are some errors. So it seems like a bug that it creates the log file. Workaround is to create the log file manually first: root@rs1:/etc/bird# touch /var/log/bird/bird.log root@rs1:/etc/bird# chown bird:bird /var/log/bird/bird.log You would have to be careful whenever rotating the log file too. Cheers, Brian.

2 1

BGP Socket:Connection closed
by Fabiano D'Agostino 23 Apr '20

23 Apr '20

Good evening, I am facing this problem with bgp protocol: Info: Active Socket:Connection closed Why do I have this? Thanks in advance, Fabiano

1 0

RFC 5575 question: is Destination Prefix mendatory?
by Alarig Le Lay 22 Apr '20

22 Apr '20

Hi, it seems that for bird, the flowspec destination prefix is mentatory. I have a session with an exabgp and if I send this echo 'announce flow route { match { source 213.167.241.55/32; destination 0.0.0.0/0; } then { discard; } }' > /var/run/exabgp.cmd It works, I have the route: bird> show route all table flowtab4 Table flowtab4: flow4 { dst 0.0.0.0/0; src 213.167.241.55/32; } [bgp_wfiltr1_ipv4 15:44:14.440 from 217.70.176.118] * (100) [i] Type: BGP univ BGP.origin: IGP BGP.as_path: BGP.local_pref: 100 BGP.ext_community: (generic, 0x80060000, 0x0) But, if I send this: echo 'announce flow route { match { source 213.167.241.55/32; } then { discard; } }' > /var/run/exabgp.cmd It doesn’t work, the session is in error state (BGP Error: Malformed attribute list) and the log says "Invalid flow route: Destination prefix is missing". However, https://tools.ietf.org/html/rfc5575#section-4 says We define a "Flow Specification" NLRI type that may include several components such as destination prefix, source prefix, protocol, ports, etc. This NLRI is treated as an opaque bit string prefix by BGP. Each bit string identifies a key to a database entry with which a set of attributes can be associated. As it’s “may”, I would say that it’s not mendatory. The sessions toward ASR9K routers accept the annoucement. Regards, -- Alarig

2 2

BIRD mailing list issue - root cause found: BIRD MTA fails to resend after being greylisted
by Christoph 21 Apr '20

21 Apr '20

Hi, the root cause for the mailing list issues have been found. trubka.network.cz gets greylisted by never tries to delivery the emails again. {{ Oct 4 13:17:46 mx2 postgrey[1652]: action=greylist, reason=new, client_name=trubka.network.cz, client_address=2001:1568:b:145::1 Could you look into your MTA configuration to resolve this issue? thanks, Christoph

2 3