- Bird-users - Mailing Lists

RPKI validation state community not reflected
by Alarig Le Lay 08 May '20

08 May '20

Hi, I’m facing a weird situation where a BIRD receives a prefix from on session, add the community for the RPKI state, but doesn’t reflect it to a rr client. It’s the exact same case as https://puck.nether.net/pipermail/cisco-nsp/2020-May/107542.html (although I’m not trying to debug the cisco here :D) I’m just on the BIRD part while Pierre is on the Cisco part. Here is some complementary output from BIRD: bird> show protocols all ibgp_nominoe_ipv4 Name Proto Table State Since Info ibgp_nominoe_ipv4 BGP --- up 2020-04-26 Established Description: fullmesh iBGP BGP state: Established Neighbor address: 89.234.186.33 Neighbor AS: 204092 Local AS: 204092 Neighbor ID: 89.234.186.33 Local capabilities Multiprotocol AF announced: ipv4 Route refresh Graceful restart 4-octet AS numbers Enhanced refresh Long-lived graceful restart Neighbor capabilities Multiprotocol AF announced: ipv4 Route refresh 4-octet AS numbers Enhanced refresh Session: internal multihop route-reflector AS4 Source address: 89.234.186.34 Hold timer: 171.386/180 Keepalive timer: 38.337/60 Channel ipv4 State: UP Table: master4 Preference: 100 Input filter: (unnamed) Output filter: (unnamed) Routes: 99289 imported, 0 filtered, 721270 exported, 97651 preferred Route change stats: received rejected filtered ignored accepted Import updates: 2734159 0 0 394005 2340154 Import withdraws: 14320933 0 --- 13300654 1020279 Export updates: 12994153 2019568 20 --- 10974565 Export withdraws: 414224 --- --- --- 636177 BGP Next hop: 89.234.186.34 IGP IPv4 table: master4 bird> template bgp iBGP_IPv4 { local as 204092; ipv4 { import where source = RTS_BGP; import keep filtered; import filter { if ((65535,666) ~ bgp_community || (204092,65535,666) ~ bgp_large_community) then { dest = RTD_BLACKHOLE; accept; } else { accept; } }; export where source = RTS_BGP; gateway recursive; }; rr client; } protocol bgp ibgp_nominoe_ipv4 from iBGP_IPv4 { description "fullmesh iBGP"; neighbor 89.234.186.33 as 204092; ipv4 { export filter { if (source != RTS_BGP) then { reject; } else { bgp_large_community.add((204092,204092,100)); bgp_community.add((64496,2150)); accept; } }; }; } I’m not seeing anything that should remove this community from the filters, but we do not receive it on the other side (tried with another BIRD too). Is it an expected behaviour or am I missing something obvious there? Thanks, -- Alarig Le Lay

2 2

VRF and protocol direct
by Erik Zscheile 07 May '20

07 May '20

I tried the following config snipped, but it doesn't work. Is there any way available to import device routes from an VRF and direct them to specific tables instead of the master tables? <snip> protocol direct direct_ytrizja { vrf "vrf_ytrizja"; ipv4 { table tab_ytrizja4; }; ipv6 { table tab_ytrizja6; }; } </snip> Thanks in advance, Erik

2 1

Enable RPKI on Centos
by Fabiano D'Agostino 05 May '20

05 May '20

Good evening, Before I was using Ubuntu and to enable the RPKI protocol I did: ./configure --enable-libssh. Now I am a new Centos7 user and I don't know really well how to enable RPKI. I downloaded bird2-2.0.6-1.el7.x86_64.rpm <ftp://bird.network.cz/pub/bird/centos/7/x86_64/bird2-2.0.6-1.el7.x86_64.rpm> and then: yum install bird2-2.0.6-1.el7.x86_64.rpm <ftp://bird.network.cz/pub/bird/centos/7/x86_64/bird2-2.0.6-1.el7.x86_64.rpm> But now how do I enable RPKI? Thanks in advance, Fabiano

3 3

Pipe with scope link
by David Haupt 05 May '20

05 May '20

Hi First time user of bird here so please be gentle. :) I am trying to use bird for a project and I'd like to use it for creating separate routing tables in linux. I tried to simplify my setup as much as possible like this: [root@host1 etc]# cat bird.conf log stderr all; router id 172.30.2.20; protocol device { scan time 2; # Scan interfaces every 2 seconds } protocol kernel { learn; # Learn all alien routes from the kernel persist; # Don't remove routes on bird shutdown scan time 2; # Scan kernel routing table every 2 seconds graceful restart; export all; # Default is export none merge paths; # enable ecmp } protocol direct { debug all; interface "-dummy0", "dummy1", "eth*", "em*", "en*", "br-mgmt"; } table extra; protocol kernel kernelextra { learn; persist; scan time 2; table extra; kernel table 100; import all; export all; } protocol pipe { table extra; peer table master; import all; export all; } [root@host1 etc]# ip link add mylink type dummy [root@host1 etc]# ip link set mylink up [root@host1 etc]# ip route add 10.0.2.3/32 dev mylink [root@host1 etc]# systemctl restart bird [root@host1 etc]# ip r default via 172.29.0.1 dev eth1 10.0.2.3 dev mylink scope link 172.29.0.0/25 dev eth1 proto kernel scope link src 172.29.0.20 172.30.2.0/25 dev eth0 proto kernel scope link src 172.30.2.20 [root@host1 etc]# ip r show table 100 default via 172.29.0.1 dev eth1 proto bird Is there any way that I can have the 10.0.2.3/32 route show up in kernel table 100? [root@host1 etc]# bird --version BIRD version 1.6.8 Thank you so much for an awesome piece of software! //Per

3 4

Unable to add a static IPv6 route with fe80 next-hop
by Alarig Le Lay 02 May '20

02 May '20

Hi, It’s the first time I try to do such a configuration, but I can’t find the right syntax. route 2a00:5884:105::/48 via fe80::ae1f:6bff:fead:2ed8%enp3s0f1.30 → syntax error, unexpected '.' route 2a00:5884:105::/48 via fe80::ae1f:6bff:fead:2ed8%"enp3s0f1.30" → syntax error, unexpected TEXT, expecting CF_SYM_KNOWN or CF_SYM_UNDEFINED route 2a00:5884:105::/48 via "fe80::ae1f:6bff:fead:2ed8%enp3s0f1.30" → no error but no route route 2a00:5884:105::/48 via fe80::ae1f:6bff:fead:2ed8 interface "enp3s0f1.30" → syntax error, unexpected INTERFACE route 2a00:5884:105::/48 via fe80::ae1f:6bff:fead:2ed8 "enp3s0f1.30" → syntax error, unexpected TEXT And https://bird.network.cz/?get_doc&v=20&f=bird-6.html#ss6.14 only shows examples about IPv4. What is the correct syntax? Thanks, -- Alarig Le Lay

2 2

Correct way to advertise network in BIRD 2.x
by Laura Smith 29 Apr '20

29 Apr '20

Hi, I am unfortunatley finding the docs a little terse in terms of lack of real-life examples. I have a simple question, how do I advertise networks to my peers ? I am guessing the syntax below is not correct because I see error messages such as "Apr 27 11:08:53 vpw bird: KRT: Received route 192.0.2.224/28 with strange next-hop 198.51.100.33" in my logs. 2a01:db8:a1d:1e11::1111 / 198.51.100.33 is the IP of the interface facing the upstream BGP peer. protocol static { ipv4; route 192.0.2.224/28 via 198.51.100.33; } protocol static { ipv6; route 2a01:db8:6a66::/48 via 2a01:db8:a1d:1e11::1111; } filter out_filter { if net ~ 2a01:db8:6a66::/48 then accept; if net ~ 192.0.2.224/28 then accept; else reject; } protocol bgp v4n1 { local as 65200; source address 198.51.100.33; neighbor 198.51.100.250 as 64515; med metric on; default bgp_med 0; ipv4 { import all; export filter out_filter; graceful restart on; }; } protocol bgp v6n1 { local as 65200; source address 2a01:db8:a1d:1e11::1111; neighbor 2a01:db8:a1d:1e11::2222 as 64515; med metric on; default bgp_med 0; ipv6 { import all; export filter out_filter; graceful restart on; }; }

3 3

How to fix BGP 'Invalid NEXT_HOP attribute' errors?
by Erik Zscheile 29 Apr '20

29 Apr '20

Hi, I get relatively much "log spam" about one specific BGP session which logs dozens of 'Invalid NEXT_HOP attribute' messages. I haven't found much information online, but have already tried to find out which code path in BIRD produces the message. (The peers all have a BIRD-2.0.7 installation). The following code paths in 'proto/bgp/packets.c:bgp_update_next_hop_ip' are hit: --snip-- /* Forbid zero next hop */ if (ipa_zero(nh[0]) && ((len != 32) || ipa_zero(nh[1]))) WITHDRAW(BAD_NEXT_HOP); /* Forbid next hop equal to neighbor IP */ if (ipa_equal(peer, nh[0]) || ((len == 32) && ipa_equal(peer, nh[1]))) WITHDRAW(BAD_NEXT_HOP); --end snip-- Thus, I already concluded that one source of the error is a 'zeroed' next hop. But I don't really understand what the second check does and why. I found out that sometimes (after some printf-debugging), 'peer' is equal to 'nh[0]', but the second code path isn't always hit when that is the case, but only sometimes. The error only seems to happen if the BGP update message contains a next-hop with the same AF as the 'peer' has. If the peer sends the same BGP message, but via IPv6, and same IPv4 next_hop (which is equal to the peer ll address), the message is (somewhat inconsistent with the other behavior) accepted. The error does only happen if the previous if block 'if (!a || !bgp_use_next_hop(s, a))' is not hit. If it is hit, the next hop is updated to point at the local ll address and the message is accepted. I don't really know how to fix this problem, but I already tried to adjust the config to modify the 'bgp_next_hop' variable or use 'next hop self;' to no avail. Cheers Erik

2 1

Bug? / Patch for BGP next hop issue with frr peers
by Sebastian Hahn 29 Apr '20

29 Apr '20

Hi, let me preface this that I very much do not know what I am doing here, and have been somewhat unsuccessful in trying to understand what's going on by searching online. I would love an explanation though! In a bird 2.0.7 setup, I was unable to import routes from one of my peers. It is the only one using frr (version 6.02-2 on debian), most other peers use bird1 or bird2. I noticed immediately after adding the peering that I received "Invalid NEXT_HOP attribute" errors in the log. Unfortunately, no more information than that was provided in the log, so I went on a little hunt. Since the exact error is raised from many places, I added some logs to identify the GW_DIRECT case in bgp_apply_next_hop() as the culprit. Here I realized that both gw and ll are set, which means a neighbor is tried to be found which doesn't involve the ll case. I then noticed that in bgp_decode_next_hop_ip(), this can only happen if len == 32. This is where I am absolutely clueless what it means for the nh len to be 32, and thus I don't know if the patch I came up with is correct, even though it works for my testing. Only this one peer using frr causes nh len to be set to 32, so I suppose it might be a rare configuration. I added this simple patch: --- bird2-2.0.7.orig/proto/bgp/packets.c +++ bird2-2.0.7/proto/bgp/packets.c @@ -1174,6 +1174,9 @@ bgp_decode_next_hop_ip(struct bgp_parse_ if (ipa_is_ip4(nh[0]) || !ip6_is_link_local(nh[1])) nh[1] = IPA_NONE; + + if (ip6_is_link_local(nh[1])) + nh[0] = IPA_NONE; } else bgp_parse_error(s, 9); ~ which worked for me to resolve the problem. Thanks for any consideration! Cheers Sebastian

4 11

Support for machine-readable status output
by Pascal Mathis 28 Apr '20

28 Apr '20

Hi everyone, I am wondering if the official maintainers would accept patches for introducing machine-readable status output to BIRD. I am asking as there definitely is a clear demand for such a solution, as can be seen by these previous mailing list posts and projects: - https://github.com/mchackorg/birdwatcher (JSON API Server) - https://github.com/inex/birdseye (JSON API Server) - https://github.com/czerwonk/bird_exporter (Prometheus Exporter) - https://www.npmjs.com/package/node-bird-routeparse (JSON Generator) - https://bird.network.cz/pipermail/bird-users/2018-March/012088.html (Previous JSON patch submitted by Alistair Crooks) - https://github.com/sileht/bird-lg (BIRD LG with Python Command Proxy) - https://bird.network.cz/pipermail/bird-users/2017-June/011362.html (Previous mentions of people working on structured output for BIRD) - https://bird.network.cz/pipermail/bird-users/2011-September/002441.html (ML post showing support for JSON output) All the current solutions mentioned above query BIRD by either running the "birdc" executable or directly interacting with the SMTP-like protocol on the socket, followed by applying regular parsing magic to extract the required information. While this certainly works, I think adding some kind of structured/machine-readable output (e.g. JSON) would greatly simplify such integrations in the future and people would no longer have to rely on brittle text parsing which can break on any text formatting changes. Compared to other routing daemons with massive API interfaces (e.g. NETCONF or gRPC), BIRD clearly follows a path of simplicity and robustness, which is probably a reason why a lot of people are relying on it. I personally think that adding a whole API interface for both reading and writing would be overkill, as the configuration can already be easily templated and reliably reloaded. To cut a long story short, I would appreciate if BIRD2 would be able to output various sorts of information in a structured, machine-readable way, e.g. using JSON to print statistics, bgp peers, route lookups and more. This could be implemented by adding a flag for JSON output to existing commands, as adding a full-blown HTTP server directly into BIRD seems like a bad idea. Would such patches be considered for upstreaming or was there ever a decision to not implement this kind of feature? Is maybe someone already working on a feature like this? Thanks in advance for any kind of reply and have a nice day. Best regards, Pascal

4 3

Invalid ROA
by Fabiano D'Agostino 28 Apr '20

28 Apr '20

Hi, how can I check which prefixes are not valid and so rejected? It seems the rpki is working, but I'd like to be sure. I have this: if (roa_check(r4, net, bgp_path.last) = ROA_INVALID) then { print "Ignore RPKI invalid ", net, " for ASN ", bgp_path.last; but I don't understand where the prints go. Thanks, Fabiano

6 14