- Bird-users - Mailing Lists

Re: [babel] Purpose of 'generate from/to' and 'accept from/to' for passwords?
by Toke Høiland-Jørgensen 21 Jan '20

21 Jan '20

Juliusz Chroboczek <jch(a)irif.fr> writes: > Thanks, Ondrej. > >> Well, it is requirement of OSPF spec (RFC 2328). I could assume it could >> help for smoother key transitions when clocks are not perfectly synchronized. > > Ah, I see. > > OSPF only allows one key in the trailer, so it needs the ability to send > one key but accept many. Babel-MAC allows multiple keys in the trailer, > and that ability is therefore not required. > > Or am I missing something? No, I think you're right. > I have no objection to keeping the ability, since it's pretty trivial to > implement. No objection to making it optional, since it's not > particularly useful in Babel-MAC. No objection to removing it altogether, > since it's good to avoid unnecessary features. Well, the Bird implementation (which I really should get around to finishing) is going to re-use the existing config syntax, so that is going to implement it in any case. I don't have any strong opinions as to what the spec should say, as long as it doesn't forbid such an option :) -Toke

1 0

Enabling BGP FlowSpec routes export
by posta＠davidepucci.it 21 Jan '20

21 Jan '20

Hi. I'm setting up Bird (2.0.7) as a BGP FlowSpec controller and it has to send out FS routes to two (FRR-based) neighbors. Actual configuration is defined as below: flow4 table flowtab4; protocol static { flow4 { import all; export all; }; route flow4 { src x.x.y.y/32; dst x.x.z.z/32; } { bgp_ext_community.add( (generic, 0x80060000, 0x0) ); }; } template bgp bgp_fs { local x.x.x.x as ABCDG; capabilities off; flow4 { table flowtab4; import all; export all; }; ipv4 { import all; export all; }; } protocol bgp bgp_svc01 from bgp_fs { neighbor y.y.y.y as ABCDE; } protocol bgp bgp_svc02 from bgp_fs { neighbor z.z.z.z as ABCDF; } The FS is properly assigned to the BGP protocol instances, but flowtab4 table is only UP as a channel for static1 protocol, while for bgp_svc01/02 is not (hence, no FS routes advertised BGP-side): bird> show protocol all static1 Name Proto Table State Since Info static1 Static flowtab4 up 13:02:42.987 Channel flow4 State: UP ================== Table: flowtab4 Preference: 200 Input filter: ACCEPT Output filter: ACCEPT Routes: 1 imported, 0 exported, 1 preferred Route change stats: received rejected filtered ignored accepted Import updates: 1 0 0 0 1 Import withdraws: 0 0 --- 0 0 Export updates: 0 0 0 --- 0 Export withdraws: 0 --- --- --- 0 bird> show protocol all bgp_svc01 Name Proto Table State Since Info bgp_svc01 BGP --- up 13:00:17.256 Established BGP state: Established Neighbor address: y.y.y.y Neighbor AS: ABCDE Local AS: ABCDG Neighbor ID: whateverID Local capabilities Neighbor capabilities Session: external Source address: x.x.x.x Hold timer: 4.820/9 Keepalive timer: 2.054/3 Channel flow4 State: DOWN ==================== Table: flowtab4 Preference: 100 Input filter: ACCEPT Output filter: ACCEPT Channel ipv4 State: UP Table: master4 Preference: 100 Input filter: ACCEPT Output filter: ACCEPT Routes: 13 imported, 2 exported, 13 preferred Route change stats: received rejected filtered ignored accepted [...] BGP Next hop: x.x.x.x Looking forward to get some clarifications. Thank you. Kind regards, Davide Pucci.

2 1

Purpose of 'generate from/to' and 'accept from/to' for passwords?
by Toke Høiland-Jørgensen 20 Jan '20

20 Jan '20

Hi Bird people When specifying passwords for protocol authentication in the Bird config, it is possible to specify time windows in which the password will be used to sign messages (the 'generate from/to' configuration options), and a separate time window in which that password will be accepted to authenticate a packet (the 'accept from/to' options). My question is this: What is the purpose of having these two time intervals be separate? I.e., in what deployment scenario is it useful to have a password be accepted to authenticate a message, without also using that password to sign outgoing messages? This question came out of a discussion around whether we should standardise a similar feature in the Babel RFCs. As you can see I'm struggling a little to come up with a definite use case: https://mailarchive.ietf.org/arch/msg/babel/XOahz4fuXXs-nHO4NMGdBwU8AZo -Toke

2 1

BFD getting stuck in Init state when taking down and up the interface
by Julian Schuh 20 Jan '20

20 Jan '20

Hi all, I think I discovered a bug causing BFD sessions to get stuck in the Init state when taking down and up the interface that is being for the BFD session. I'm using bird 2.0.7 on linux 4.19.86. My setup: I have to network namespaces t1 and t2, connected by a veth pair: ip -n t1 addr show > 99: t2_1@if100: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 > link/ether fa:e1:52:51:62:a3 brd ff:ff:ff:ff:ff:ff link-netns t2 > inet6 2001:db8:1::1/64 scope global > valid_lft forever preferred_lft forever > inet6 fe80::f8e1:52ff:fe51:62a3/64 scope link > valid_lft forever preferred_lft forever ip -n t2 addr show > 100: t1_1@if99: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 > link/ether b2:0e:f4:60:1b:08 brd ff:ff:ff:ff:ff:ff link-netns t1 > inet6 2001:db8:1::2/64 scope global > valid_lft forever preferred_lft forever > inet6 fe80::b00e:f4ff:fe60:1b08/64 scope link > valid_lft forever preferred_lft forever The bird config on both sides is almost identical: t1: > protocol device { > debug all; > scan time 10; > } > > router id 1.1.1.1; > > protocol bfd { > debug all; > interface "*" { > min rx interval 50 ms; > min tx interval 100 ms; > idle tx interval 300 ms; > > }; > neighbor 2001:db8:1::2 dev "t2_1" local 2001:db8:1::1; > } t2: > protocol device { > debug all; > scan time 10; > } > > router id 2.2.2.2; > > protocol bfd { > debug all; > interface "*" { > min rx interval 50 ms; > min tx interval 100 ms; > idle tx interval 300 ms; > > }; > neighbor 2001:db8:1::1 dev "t1_1" local 2001:db8:1::2; > } When starting up bird on both sides, the BFD session comes up just as expected. When taking down the interface t1_1 in netns t2 (ip -n t2 link set down dev t1_1), I see the following log message: > bfd1: Session to 2001:db8:1::1 removed Now, when taking up the interface instantly, I get the following log message, the BFD session gets stuck in the Init state and does not recover: > bfd1: Socket error: bind: Cannot assign requested address > bfd1: Session to 2001:db8:1::1 added When I take down the interface and wait for a subsequent device scan (indicated by log message "device1: Scanning interfaces") and only take up the interface after the device scan is carried out, all works fine: >>>> bfd1: Session to 2001:db8:1::1 removed >>>> device1: Scanning interfaces >>>> bfd1: Session to 2001:db8:1::1 added When leaving out the "scan time" statement in the device protocol configuration, it doesn't seem to recover at all (probably, as the documentation states, a large value is used for the scan time by default). Thanks in advance for your feedback. Best Regards Julian Schuh

2 1

Re: Bird exporter
by Irene Lalioti 16 Jan '20

16 Jan '20

Hello Tim, Thanks for your answer. Initially I did not use go to install it. Maybe this is the problem, I guess. My question is how you run it? you just have to run bird or ? In which port is the web server available? 6502? I have installed the bird watcher as well which is python. Do I need the golang necessarily ? So far I get connection refused when I try |wget https://dl.google.com/go/go1.13.4.linux-amd64.tar.gz| | | |Thanks a lot! Irene | || On 1/14/20 11:52 PM, Tim Meusel wrote: > Hi Irene, > > I use the bird exporter, but I'm not sure if I understood your question. > The only thing I needed to configure in the config tog work was the > timeformat setting you already mentioned. Also the three metrics you > posted look correct? > > Cheers, Tim > > On 13.01.20 14:37, Irene Lalioti wrote: >> Hello guys! >> >> I would like to ask you, if anyone of you has deployed bird_exporter for >> Prometheus metrics to Grafana dashboard? >> >> https://github.com/czerwonk/bird_exporter >> >> I have setup Grafana dashboards to visualize the metrics Prometheus >> collects. I have imported the Dashboard for the bird from github. >> >> Now I am not sure how to orchestrate the bird_exporter into the bird >> config, other than : >> >> 1. timeformat protocol iso long; >> >> 2. >> bird_protocol_prefix_import_count{name="bgp1",proto="BGP",ip_version="4"} >> 600000 >> bird_protocol_prefix_import_count{name="bgp1",proto="BGP",ip_version="6"} >> 50000 >> bird_ospfv3_running{name="ospf1"} 1 >> >> >> as instructed in the doc. >> >> My bird is 2.0.7. >> >> >> thanks a lot in advance! >> >> Irene >> >> || >> >> || >> >> || >> >> || >> >> || >> -- Irene Lalioti Network Engineer Fondation RESTENA 2, avenue de l'Université L-4365 Esch/Alzette Tel: +352 424409 1 Fax: +352 422473

1 0

Static route preference incorrect for value 0
by Kenth Eriksson 15 Jan '20

15 Jan '20

When setting preference value of zero on a static route, then this gets shown as preference 200 when doing show route. Preference on static routes is based on a patch from Ondrej with SHA 7a49e97e7ec86bd336dc801411cb8b8f92f38388, but it looks as this has still not made into master. kenth ~ # cat /opt/appl/executing/etc/bird_route.conf protocol static static1 { ipv4 {import all;}; check link 1; route 0.0.0.0/0 via 10.210.137.1 {preference=0;}; } bird> show route Table master4: 0.0.0.0/0 unicast [static1 12:27:07.093] (200) via 10.210.137.1 on eth1 Setting preference to a value >= 1 makes this work correct. /k

2 2

bird conf 1.6 to 2.0
by Mario Rossi 14 Jan '20

14 Jan '20

Hi Bird users, I am trying to migrate the config from 1.6 to 2.0 on CentOS 8. I tried to follow https://gitlab.labs.nic.cz/labs/bird/wikis/transition-notes-to-bird-2 but my test config didn't work. Is there another guide or wiki I can follow to be able to migrate to version 2 ? Thank you ! [...] router id 206.x.y.z; table as65533; table blackholes; [...] # Scans and learns of blackhole routes from table 10, every 10 seconds protocol kernel rtbh { table blackholes; kernel table 10; scan time 20; learn; import filter rtbh_pipe; export all; } # Merges kernel route table 10 into the virtual as65533 routing table protocol pipe { table as65533; peer table blackholes; mode transparent; import filter rtbh_pipe; } protocol bgp ege1a_50_4 { table as65533; description "ege1a_50_4"; local as 65533; neighbor 1.1.1.1 as 12345; multihop; source address 206.x.y.z; # What local address we use for the TCP connection export where source=RTS_STATIC; export filter bgp_out_upstream; }

3 5

bird 2.0.7 crashes with OSPF
by Nico Schottelius 14 Jan '20

14 Jan '20

Hello, continuing my travel now with OSPF, we have found two cases to crash bird via birdc: bird> show ospf topology all ospf_v4 Connection closed by server [00:50] replacement-router1.place5:~# ps aux | grep bird 14220 root 0:00 grep bird bird> show ospf state ospf_v4 Connection closed by server [23:44] router1.place6:~# birdc Unable to connect to server control socket (/var/run/bird.ctl): Connection refused The config leading to this is attached below. Best regards, Nico p.s.: In the documentation for the "instance id" it says "Default value is 0 unless OSPFv3-AF extended address families are used, see RFC 5838 for that case." And further above it says that RFC5838 is enabled by default. However shouldn't it be 64 in case of an ipv4 channel in ospf according to rfc5838? protocol ospf v3 ospf_v6 { instance id 0; ipv6 { import all; export all; }; area 0 { interface "bond0.8" { cost 5; hello 5; retransmit 2; wait 10; dead 20; }; }; } protocol ospf v3 ospf_v4 { instance id 64; ipv4 { import all; export all; }; area 0 { interface "bond0.8" { cost 5; hello 5; retransmit 2; wait 10; dead 20; }; }; } -- Modern, affordable, Swiss Virtual Machines. Visit www.datacenterlight.ch

4 5

crash in ospf lsupd/dbdes (only if authentication enabled?)
by Kenth Eriksson 14 Jan '20

14 Jan '20

We have seen a bird crash due to memory corruption. The call stacks shows that it can happen at different locations, but they all seem to come from that the packet size becomes larger than the socket tx buffer size. Before the crash happens, the following trace can be observed in the log; 2020-01-08 11:06:52.584 <DBG> Assertion '*plen < ifa->sk->tbsize' failed at /usr/local/src/tm3000/ext/bird/proto/ospf/packet.c:97 Debugging shows that *plen is 1504 (after adding auth_len of 32 bytes). The tbsize is set to 1492 which corresponds to the MTU size. The procedure ospf_pkt_maxsize does not take account for authentication, is that correct? valgrind evidence of issue; ==3272== Invalid write of size 4 ==3272== at 0xFFB8594: memcpy (in /usr/lib/valgrind/vgpreload_memcheck-ppc32-linux.so) ==3272== by 0x10015F6F: ??? (in /opt/appl/cuappl04a-r34a-39/sbin/bird) ==3272== by 0x10039B87: ??? (in /opt/appl/cuappl04a-r34a-39/sbin/bird) ==3272== by 0x1002E813: ??? (in /opt/appl/cuappl04a-r34a-39/sbin/bird) ==3272== by 0x1003978F: ??? (in /opt/appl/cuappl04a-r34a-39/sbin/bird) ==3272== by 0x10046963: ??? (in /opt/appl/cuappl04a-r34a-39/sbin/bird) ==3272== by 0x100473B7: ??? (in /opt/appl/cuappl04a-r34a-39/sbin/bird) ==3272== by 0x1000245F: ??? (in /opt/appl/cuappl04a-r34a-39/sbin/bird) (gdb) list *0x1002E813 0x1002e813 is in ospf_do_send_dbdes (/usr/local/src/builduser/rc/rel_34_0/ext/bird/proto/ospf/dbdes.c:196). 191 struct ospf_iface *ifa = n->ifa; 192 193 OSPF_PACKET(ospf_dump_dbdes, n->ldd_buffer, 194 "DBDES packet sent to nbr %R on %s", n->rid, ifa->ifname); 195 sk_set_tbuf(ifa->sk, n->ldd_buffer); 196 ospf_send_to(ifa, n->ip); 197 sk_set_tbuf(ifa->sk, NULL); 198 } 199 200 /** (gdb) list *0x10039B87 0x10039b87 is in ospf_send_to (/usr/local/src/builduser/rc/rel_34_0/ext/bird/proto/ospf/packet.c:110). 105 if (pass->alg < ALG_HMAC) 106 strncpy(auth_tail, pass->password, auth_len); 107 else 108 memset32(auth_tail, HMAC_MAGIC, auth_len / 4); 109 110 mac_fill(pass->alg, pass->password, pass->length, (byte *) pkt, *plen, auth_tail); 111 break; 112 113 default: 114 bug("Unknown authentication type"); (gdb) list *0x10015F6F 0x10015f6f is in mac_fill (/usr/local/src/builduser/rc/rel_34_0/ext/bird/lib/mac.h:112). 107 108 static inline void mac_update(struct mac_context *ctx, const byte *data, uint datalen) 109 { ctx->type->update(ctx, data, datalen); } 110 111 static inline byte *mac_final(struct mac_context *ctx) 112 { return ctx->type->final(ctx); } 113 114 static inline void mac_cleanup(struct mac_context *ctx) 115 { memset(ctx, 0, ctx->type->ctx_length); } 116 (gdb) ASAN evidence of the crash; ================================================================= ==3202==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xb4105a64 at pc 0x38630004 bp 0xbf958200 sp 0xbf958218 WRITE of size 4 at 0xb4105a64 thread T0 #0 0x38630000 (+0x10630000) #1 0xfb2aa10 in __asan_report_error (/usr/lib/gcc/powerpc-unknown-linux-gnu/4.9.3/libasan.so.1+0x65a10) #2 0xfb2bd70 in __asan_report_store4 (/usr/lib/gcc/powerpc-unknown-linux-gnu/4.9.3/libasan.so.1+0x66d70) #3 0x100d26d0 in ospf_send_to (/opt/appl/cuappl04a-r34a-39/sbin/bird+0x100d26d0) 0xb4105a64 is located 0 bytes to the right of 1508-byte region [0xb4105480,0xb4105a64) allocated by thread T0 here: #0 0x10060ab4 in bird_xmalloc (/opt/appl/cuappl04a-r34a-39/sbin/bird+0x10060ab4) SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 ?? Shadow bytes around the buggy address: 0x36820af0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x36820b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x36820b10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x36820b20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x36820b30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x36820b40: 00 00 00 00 00 00 00 00 00 00 00 00[04]fa fa fa 0x36820b50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x36820b60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x36820b70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x36820b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x36820b90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Contiguous container OOB:fc ASan internal: fe ==3202==ABORTING

3 7

Bird exporter
by Irene Lalioti 13 Jan '20

13 Jan '20

Hello guys! I would like to ask you, if anyone of you has deployed bird_exporter for Prometheus metrics to Grafana dashboard? https://github.com/czerwonk/bird_exporter I have setup Grafana dashboards to visualize the metrics Prometheus collects. I have imported the Dashboard for the bird from github. Now I am not sure how to orchestrate the bird_exporter into the bird config, other than : 1. timeformat protocol iso long; 2. bird_protocol_prefix_import_count{name="bgp1",proto="BGP",ip_version="4"} 600000 bird_protocol_prefix_import_count{name="bgp1",proto="BGP",ip_version="6"} 50000 bird_ospfv3_running{name="ospf1"} 1 as instructed in the doc. My bird is 2.0.7. thanks a lot in advance! Irene || || || || || -- Irene Lalioti Network Engineer Fondation RESTENA 2, avenue de l'Université L-4365 Esch/Alzette Tel: +352 424409 1 Fax: +352 422473

1 0