- Bird-users - Mailing Lists

Question for proper RPKI check integration in the bird v2.0.4 with Euro-IX Informational BGP communities
by Irene Lalioti 25 Sep '19

25 Sep '19

Hello all, Can you please let me know where is the syntax error in my snippet , or if it is wrong how else I should integrate it in a way bird doesn't complain? Thanks in advance! #RPKI Check filter bgp_in_AS1234 prefix set allnet; { include "/etc/bird/prefix-lists/AS2589-v4"; if (is_martian4()) then reject; if ! (net ~ allnet) then reject; rpki_result = roa check(r4, net, bgp_path.last_nonaggregated ); if ( rpki_result = ROA_INVALID ) then{ bgp_community.add((1234:1000:4)); reject; print "Invalid ROA ", net, " for ASN ", bgp_path.last_nonaggregated, "from AS1234" ; } if ( rpki_result = ROA_VALID ) then{ bgp_community.add((1234:1000:1)); accept; } if ( rpki_result = ROA_ UNKNOWN ) then{ bgp_community.add((1234:1000:2)); accept; print "Unknown RPKI ", net, "for ASN ", bgp_path.last_nonaggregated, "from AS1234 "; } } -- Irene Lalioti Network Engineer Fondation RESTENA 2, avenue de l'Université L-4365 Esch/Alzette Tel: +352 424409 1 Fax: +352 422473

3 8

Bird v2.0.4 "Can't add/delete non-pair" and "END-OF-RR received prior BEGIN-OF-RR, ignoring" meaning
by Irene Lalioti 25 Sep '19

25 Sep '19

Hello all, I would be grateful if you could direct me, provide me some insight to figure out where those errors/alarms emanate from. In my test environment I did not encounter those errors, only upon the actual live migration , while bringing the BGP sessions with the peers up. Some where coming up some not. The 1st error was : ... filters, line 2208: Can't add/delete non-pair The 2nd error was: ...R15814x2: END-OF-RR received without prior BEGIN-OF-RR, ignoring R35283x1: BEGIN-OF-RR received before END-OF-RIB, ignoring R13002x1: BEGIN-OF-RR received before END-OF-RIB, ignoring filters, line 1645: ~ applied on unknown type pair **** Problem with filters? I found also : * bgp_refresh_begin - start incoming enhanced route refresh sequence * @p: BGP instance * * This function is called when an incoming enhanced route refresh sequence is * started by the neighbor, demarcated by the BoRR packet. The function updates * the load state and starts the routing table refresh cycle. Note that graceful * restart also uses routing table refresh cycle, but RFC 7313 and load states * ensure that these two sequences do not overlap. */ void bgp_refresh_begin(struct bgp_proto *p) { if (p->load_state == BFS_LOADING) { log(L_WARN "%s: BEGIN-OF-RR received before END-OF-RIB, ignoring", p->p.name); return; } p->load_state = BFS_REFRESHING; rt_refresh_begin(p->p.main_ahook->table, p->p.main_ahook); } /** Thanks a lot for your help! Regards, Irène -- Irene Lalioti Network Engineer Fondation RESTENA 2, avenue de l'Université L-4365 Esch/Alzette Tel: +352 424409 1 Fax: +352 422473

1 0

Segfault Showing export table on 2.0.6
by Matt Corallo 24 Sep '19

24 Sep '19

Sometimes showing export table(s) from birdc on 2.0.6 results in a Segfault of the bird daemon. I can try to debug further if this isn't sufficient, but largely the only difference between one protocol and the other is the presence of communities on the exports from PROTO2. birdc -s /root/bird-runtime/bird-3.ctl BIRD 2.0.6 ready. bird> show route export table PROTO1.ipv4 all Table export: 69.59.18.0/24 unicast [v4sta 11:55:59.366] * (1000) dev lo Type: static univ 208.68.4.0/24 unicast [v4sta 11:55:59.366] * (1000) dev lo Type: static univ bird> show route export table PROTO2.ipv4 all ... 2019-09-19 11:45:04.706302 bird-out-3.fifo Segmentation fault Matt

3 5

BIRD security bug bounty program
by Christoph 23 Sep '19

23 Sep '19

Hello, do you run a security bug bounty program for BIRD 2 or make use of static source code analyzer like Coverity? thanks, Christoph

2 2

Assertion 'c->channel_state == CS_UP' failed at nest/rt-table.c:1543
by Christoph 23 Sep '19

23 Sep '19

Hi, (please keep me in CC, thanks) I got the following somewhat strangely formatted log lines in /var/log/messages on a BIRD v2.0.6 instance connected to routinator3000 v0.5 ("r3k" bellow) running on FreeBSD 12: kernel: 8-48 AS2119 kernel: CS_UP' failed at nest/rt-table.c:1543 kernel: 9-22T00:59:04.466158+01:00 - - Assertion 'c->channel_state == CS_UP' failed at nest/rt-table.c:1543 kernel: Assertion 'c->channel_state == CS_UP' failed at nest/rt-table.c:1543 kernel: 6f8::/32-32 AS25525 kernel: :59:05.654000+01:00 bird 1144 - - Assertion 'c->channel_state == CS_UP' failed at nest/rt-table.c:1543 kernel: P' failed at nest/rt-table.c:1543 kernel: acket (81.89.96.0/20-20 AS35366) kernel: nel_state == CS_UP' failed at nest/rt-table.c:1543 kernel: at nest/rt-table.c:1543 kernel: 22T00:59:10.355042+01:00 bird 1144 - - r3k: Received IPv4 Prefix packet (46.252.16.0/20-24 AS20738) kernel: ate == CS_UP' failed at nest/rt-table.c:1543 kernel: 0 bird 1144 - - Assertion 'c->channel_state == CS_UP' failed at nest/rt-table.c:1543 kernel: 9)

2 5

Filters do not auto-reload on called function changes
by Matt Corallo 23 Sep '19

23 Sep '19

Upon upgrading from 2.0.4 to 2.0.6, filters which call changed functions (at least when those functions are in included from external files) are no longer automatically reloaded upon reconfiguration. Matt

3 3

privilege dropping on BSD?
by Christoph 22 Sep '19

22 Sep '19

Hello, (please keep me in CC, thanks) According to the documentation BIRD can not drop privileges on BSD systems: "The privilege restriction is not implemented in BSD port of BIRD." https://bird.network.cz/?get_doc&v=20&f=bird-1.html#ss1.4 Is privilege dropping on the roadmap that we will see in the future on BSD as well? thanks, Christoph

2 1

graceful restart command not shown in context help
by Christoph 22 Sep '19

22 Sep '19

Hello, (for some unknown reason I'm not getting any emails from this mailing list even though I'm subscribed, please keep me in CC if you reply thanks!) The NEWS entry for BIRD 2.0.5 mentions the graceful restart command: https://gitlab.labs.nic.cz/labs/bird/blob/master/NEWS :> Version 2.0.5 (2019-08-01) [...] > o Graceful restart command but I didn't see it in the "?" output so I assumed it does not exist: birdc BIRD 2.0.6 ready. bird> ? quit Quit the client exit Exit the client help Description of the help system show ... Show status information dump ... Dump debugging information eval <expr> Evaluate an expression echo ... Control echoing of log messages disable (<protocol> | "<pattern>" | all) [message] Disable protocol enable (<protocol> | "<pattern>" | all) [message] Enable protocol restart (<protocol> | "<pattern>" | all) [message] Restart protocol reload <protocol> | "<pattern>" | all Reload protocol debug ... Control protocol debugging via BIRD logs mrtdump ... Control protocol debugging via MRTdump files restrict Restrict current CLI session to safe commands configure ... Reload configuration down Shut the daemon down By using "g<tab>", auto-completion revealed the existence of the command and it works as intended. bird> graceful restart Graceful restart requested Connection closed by server Would be great to add it to the interactive help output so more people can find out about it by using "?". thanks! Christoph

2 1

Bgp_local_pref path depending
by mattia.milani＠studenti.unitn.it 20 Sep '19

20 Sep '19

Hello all, I’m writing this email because i was trying to create an input filter for my daemon. Protocol: BGP I would like to evaluate an input path and change the bgp preference if the path correspond to a certain path. I configured a default bgp_local_pref with the command: default bgp_local_pref 1; And in the input filter I wrote a code like: If bgp_path ~ [= * 1 2 3 =] then { bgp_local_pref = 100; } But this doesn’t seems to do the expected work, if the path finish with 1 2 3 no matter how much it is long I would like to prefer it over other paths. If anyone can suggest me how to handle it thanks, Mattia

2 2

Do you want to participate in IPv4 to IPv6 transition rather than an outage?
by Mike Mazarick 20 Sep '19

20 Sep '19

In 1998, I participated in Nortel's movement from one set of IPv4 numbers to another set of IPv4 numbers. It was disastrous - we ended up going back to the original IPv4 numbers even though there was a senior Unix admin per building (about 200 employees) on a Sunday afternoon to make this happen. It was a "bad cut-over" to borrow from Telecom vocabulary. More than 20 years have passed and the world is going to IPv6. In 1998, a network engineer told me that IPv6 was the answer to all the inherent problems with IPv4, but the world has still not migrated to IPv6. It took an economic incentive to allow the world to migrate and I would prefer that the routing be open source that controls this effort. This is "dual stack" at the device level, "dual stack on steroids", or "dual stack for less than a day". It remains the only solution that provides a customer with a pure IPv6 network and provides the necessary IPv4 network for the parts that are uneconomic to migrate to IPv6. As such, it deserves its own RFC and a separate job function is to provide the RFC to IETF. If Cisco can provide an RFC to IETF by demonstrating working code to IETF, then we can do it too. Let me know of your interest, either on this mailing list or privately. Mike Mazarick mike.mazarick(a)virtudatacenter.com 1-919-413-1274 Raleigh, NC 27607 --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

1 0