- Bird-users - Mailing Lists

Reporting issues
by Brian Topping 12 Apr '19

12 Apr '19

Hi all, I think I looked in all the regular places and inferred that reporting issues might best be done here. The gitlab issue tracker shows no issues. The problem I have seen is where BIRD BGP is running a passive process. The initiator peer is running the product at https://metallb.universe.tf <https://metallb.universe.tf/>. This product can only initiate sessions. Due to (what I assume) is a bug in the product, it was able to initiate a session from a TCP socket source address that was not matched to the router ID. More specifically, both BGP processes were running on the same host, with MetalLB configured to take a router ID that was a secondary (internal / private) interface and and BIRD using the primary interface address (so as to be able to connect to other external peers). I believe the BIRD team would be interested in this because when BIRD BGP accepted a connection with the same source address as it’s own Router ID, even though the session provided a different router ID, it caused BIRD the BIRD RIB and kernel exports to show the source of the route to be a completely different BGP peer. In this case, the different peer was the default route of a stub area, so incoming traffic to these addresses formed a routing loop. It’s unclear to me whether this is a bug or a feature. If it is indeed a feature or unavoidable side effect that needs to be supported all the same, what would have been desirable is if there was at least some log message of the form “this is probably not what you want” when a peer connected in this manner. More information can be found at https://github.com/danderson/metallb/issues/422 <https://github.com/danderson/metallb/issues/422> and the referenced PR. I’m happy to help reproduce the problem if needed. Thanks for a great product!! best, Brian

3 7

Bird, RPKI/RTR and issues with SSH
by Louis Poinsignon 12 Apr '19

12 Apr '19

Hello everyone, I hope this mailing list is the correct place for my message. I am the developer of GoRTR (https://github.com/cloudflare/gortr) a tool to send RPKI/ROA validated data to routers. I just implemented SSH support (no-auth, password and publickey) With Bird 2.0.2, I managed to setup a cleartext connection. I made a docker-compose environment with two birds connected and a GoRTR. https://github.com/lspgn/compose-bird-gortr While it's not impacting, when the RTR server returns a NO DATA, the client will bomb of requests as shown by a higher log level of GoRTR. > gortr_1 | time="2019-04-11T21:40:13Z" level=debug msg="10.1.0.3:54874 > (v1) / Serial: 0: Received PDU Reset Query v1" > gortr_1 | time="2019-04-11T21:40:13Z" level=debug msg="10.1.0.3:54874 > (v1) / Serial: 0 > Request Cache" > gortr_1 | time="2019-04-11T21:40:13Z" level=debug msg="10.1.0.3:54874 > (v1) / Serial: 0 < No data" > gortr_1 | time="2019-04-11T21:40:13Z" level=debug msg="10.1.0.3:54874 > (v1) / Serial: 0: Received PDU Reset Query v1" > gortr_1 | time="2019-04-11T21:40:13Z" level=debug msg="10.1.0.3:54874 > (v1) / Serial: 0 > Request Cache" I am not sure if I'm missing a timeout but I feel this may be a bug. For ssh I am having another issue. The faulty configuration is the following: https://github.com/lspgn/compose-bird-gortr/blob/bird-rtr-ssh/bird/config_l… With the statement: > protocol rpki gortr { > debug all; > roa4 { table t_roa4; }; > roa6 { table t_roa6; }; > remote "10.1.0.4" port 8283; > transport ssh { > user "rpki"; > bird private key "/etc/bird/id_rsa"; > }; > retry keep 90; > refresh keep 900; > expire keep 172800; > } The logs are the following: > Creating network "bird-gortr-compose_vpcbr" with driver "bridge" > Creating bird-gortr-compose_gortr_1 ... done > Creating bird-gortr-compose_bird1_1 ... done > Attaching to bird-gortr-compose_gortr_1, bird-gortr-compose_bird1_1 > gortr_1 | time="2019-04-12T00:33:16Z" level=info msg="Enabling ssh with > the following authentications: password=false, key=true" > gortr_1 | time="2019-04-12T00:33:18Z" level=info msg="New update (79929 > uniques, 79929 total prefixes). 0 bytes. Updating sha256 hash -> > db4486e353d9f1f7e30ad90ab4b93c0c91adb30dfc572a0493ca8030471768c9" > gortr_1 | time="2019-04-12T00:33:18Z" level=info msg="Updated added, new > serial 1" > gortr_1 | time="2019-04-12T00:33:18Z" level=info msg="Accepted ssh > connection from 10.1.0.2:33758 (1/0)" > gortr_1 | time="2019-04-12T00:33:18Z" level=info msg="Connected > (ssh-key): rpki/10.1.0.2:33758 with key ssh-rsa > AAAAB3NzaC1yc2EAAAADAQABAAABAQC1PYoRv0xuIMbv6aQZbXUNzqS611+FgahO0tNJ1C/CD2yxmzDuijjiAL3ia3UNPuIwS4Bwukn0EQJP/J2UGM0ABGR6r8n46RzFFkBqVBXrpRNThsD36hSYeUqfir1DChxknXCEG0pLcs5cW3OZagROcW5eZbbbTD40lIglhthtrf/9d241WUcvrhXiE/VaZvj8wi2lY26MuvqDGJgApOK4gi4gLzlr5qT4aDIzUIV0LlYul3hOFX/UMlX0yJg2cgEz/xRRlUfpsx6rQkwQZ0z1lwI0QBvHlON/+Azy/HmGWFcQ2S0V+CWUFHoZ/PBqmBnLT5MBSy5r/9RQVfoaeHBv" > gortr_1 | time="2019-04-12T00:33:18Z" level=error msg="Error with ssh > client 10.1.0.2:33758: ssh: unmarshal error for field Language of type > disconnectMsg" > gortr_1 | time="2019-04-12T00:33:18Z" level=info msg="Accepted tcp > connection from 10.1.0.3:55344 (1/0)" > bird1_1 | bird: gortr: Channel roa4 connected to table t_roa4 > bird1_1 | bird: gortr: Channel roa6 connected to table t_roa6 > bird1_1 | bird: gortr: Initializing > bird1_1 | bird: gortr: Starting > bird1_1 | bird: gortr: Changing from Down to Connecting state > bird1_1 | bird: gortr: Opening a connection > bird1_1 | bird: gortr: State changed to start > bird1_1 | bird: Started > bird1_1 | bird: gortr: Lost connection: Failed to read private key: > /etc/bird/id_rsa > bird1_1 | bird: gortr: Changing from Connecting to Transport-Error state > bird1_1 | bird: gortr: Closing a connection GoRTR sees the connection with the correct public key but Bird drops it. If I do not set any statement "bird private key", it does not connect as well. Have anyone successfully setup a RTR+SSH session? The password authentication work well with Cisco routers but apart from rtrdump (another tool related to GoRTR) I could not test publickey authentication. Thank you in advance, Best, Louis

2 2

For developer, required some explanation on code with timer and BGP
by Mattia Milani 06 Apr '19

06 Apr '19

Hello all, this is a message for developer and who know how bird use timer, and buffer. Sorry for the length of this mail. For first, the protocol i want to modify and upgrade is BGP, i see that there isn't the timer MRAI implemented and it will be useful for some studies on information propagation, so i decided to develop a first version of it. The actual process to send any kind of pkt is to call the function bgp_fire_tx() and it's called by two other function respectively bgp_kick_tx() and bgp_tx() and the function bgp_fire_tx() take care to read from the buffer the message that has to be sent and send it. bgp_kick_tx() and bgp_tx() call bgp_fire_tx() while it don't return 0, so the clear all the buffer of the message that has to be sent. So my idea to introduce MRAI was that: Create a timer (for now I created it for connection, after like say RFC 4271 this timer has to be set for every route) and put it on the connection. Initialize it with the other timer of the conn when the state of the conn goes up i set it to some value and start the timer. when the timer finish i call the function MRAI_finish() that call the function bgp_fire_tx() while there is something to send more ore less like the while loop in bgp_kick_tx() and bgp_tx() when it's called bgp_fire_tx() on the update message part i written a check, if the timer isn't at 0 i can't send the update, because the function can be called from bgp_kick_tx() or bgp_tx(), but if it 0 it is finished so i can send the message When all the message had been send i reset the timer and start it again. But unfortunately i see something that doesn't make my code work. when something call bgp_kick_tx() or bgp_tx() the call bgp_fire_tx() and they clear all the buffer, including update message that wasn't sended so when the timer finish it didn't found anything on the buffer. Now how can i change that? My idea is to use a secondary buffer, when in bgp_fire_tx() i see that i can't send the update I will insert the pkt in this secondary buffer and consume the pkt on the main buffer. when bgp_kick_tx() or bgp_tx() have send all the messages I will transfer all the pkt in the secondary buffer into the main buffer. So I ask you it's possible that? there is something in the code already written that could help me? do you see another way to implement the MRAI timer? Thanks a lot to everyone, Mattia

2 3

BFD session support over vlan tagged interfaces on linux.
by Rohit Gujrati 04 Apr '19

04 Apr '19

Simplified Topology: I have got 2 linux boxes connected back to back. I am running bird 2.0.2 on both only for bfd sessions. int 1/1 (with ip 1.0.0.0.1/16) of linux1 is connected to int 1/2(with ip 1.0.0.2/16) of linux2 after configuring the bird.conf files I can see that bfd sessions are up. now if I create vlan interface on the these interfaces, and try creating bfd session over the vlan tagged interface, it doesnot work. can someone please help if I am any special configuration to indicate the vlan tagging or this scenario is not supported as of now. This scenario can be considered same as having bfd sessions over SVI interfaces (in terms of cisco terminology). -- Thanks, Rohit.

1 0

Error msg on "make install"
by Toru Nozaki (tonozaki) 04 Apr '19

04 Apr '19

Hi experts, I’m trying to build Bird v2.0.4 on my environment. Ubunts 16.4 LTS $ uname -a Linux Y01-JUMP-01 4.4.0-87-generic #110-Ubuntu SMP Tue Jul 18 12:55:35 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux In case of “#make install” , following error messages are displayed and can’t build. ------------------------------- #make install /usr/bin/install -c -d //usr/local/sbin //usr/local/etc //usr/local/var/run for BIN in bird birdcl birdc ; do \ /usr/bin/install -c ./$BIN //usr/local/sbin/$BIN ; \ done if ! test -f //usr/local/etc/bird.conf ; then \ /usr/bin/install -c -m 644 ./doc/bird.conf.example //usr/local/etc/bird.conf ; \ else \ echo "Not overwriting old bird.conf" ; \ fi Not overwriting old bird.conf ------------------------------- Does anyone help to solve this? /regards, Toru Nozaki

3 3

Two IPv4s lead to "Missing broadcast address for interface"?
by Robert Scheck 29 Mar '19

29 Mar '19

Hello folks, since upgrading from BIRD 2.0.2 to 2.0.4 I'm seeing the message "Missing broadcast address for interface bond0" on one out of two systems in syslog e.g. when starting BIRD. System cr0 with "Missing broadcast address for interface bond0" is: [root@cr0 ~]# ip a s bond0 10: bond0: <BROADCAST,MULTICAST,MASTER,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff inet 192.0.2.251/29 brd 192.0.2.255 scope global bond0 valid_lft forever preferred_lft forever inet 192.0.2.249/29 scope global secondary bond0 valid_lft forever preferred_lft forever inet6 2001:db8::1/64 scope global nodad valid_lft forever preferred_lft forever inet6 2001:db8::3/64 scope global valid_lft forever preferred_lft forever inet6 fe80::xxxx:xxxx:xxxx:xxxx/64 scope link valid_lft forever preferred_lft forever [root@cr0 ~]# System cr1 without "Missing broadcast address for interface bond0" is: [root@cr1 ~]# ip a s bond0 10: bond0: <BROADCAST,MULTICAST,MASTER,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff inet 192.0.2.252/29 brd 192.0.2.255 scope global bond0 valid_lft forever preferred_lft forever inet6 2001:db8::4/64 scope global valid_lft forever preferred_lft forever inet6 fe80::xxxx:xxxx:xxxx:xxxx/64 scope link valid_lft forever preferred_lft forever [root@cr1 ~]# If I move the cluster/floating IPv4 address 192.0.2.249/29 using keepalived from cr0 to cr1, then system cr1 shows the message and system cr0 is quiet. Thus it feels like BIRD 2.0.4 tries to do some broadcast detection if there are two IPv4 addresses from the same network on an interface? Might this be related to the "bird 2.0.4 autodetects /30 as ptp" thread? Regards, Robert

2 1

Filtering export to kernel of local nets
by Brian Topping 29 Mar '19

29 Mar '19

Greetings! I am new to production use of BIRD 2 and having a problem. Given two instances on a shared network and both running OSPF, the kernel is getting two copies of the shared network: one from the native kernel entry for the device and one from the LSA of the other BIRD instance on the same network. Since the LSA needs to be there so other remote networks can get it, how do I filter the kernel export so that I don’t push LSAs that are already represented by local devices? Apologies if this has been answered already. I did some searching of the list and I’m haven’t found a set of addresses that I can use the ~ operator on for filtering. Brian

1 0

Import filter on 2nd ASN in AS path?
by Robert Scheck 29 Mar '19

29 Mar '19

Hello folks, can I somehow import filter only on the 2nd AS number in the AS path? I know with the snippet below (heavily inspired by bgpfilterguide.nlnog.net) I can filter on AS numbers that appear somewhere in the AS path, however this import filter catches by nature also some pseudo-legitimate networks. define BOGON_ASNS = [ 0, 23456, 64496..64511, 64512..65534, 65535, 65536..65551, 65552..131071, 4200000000..4294967294, 4294967295 ]; if (bgp_path ~ BOGON_ASNS) then { print "Detected bogon AS path: ", net, " ", bgp_path, ", (neighbour ", from, ")"; } There are unfortunately some transits with broken export filters which e.g. export their DSL/FTTC and FTTH networks using private ASNs and I would like to explicitly filter these (example path: AS-TRANSIT AS-BOGON1 AS-BOGON2). The documentation has hints for first and last ASN in path, but this would catch in above example only AS-TRANSIT or AS-BOGON2, but not AS-BOGON1. Any pointers? Thank you. Regards, Robert

4 5

bird 2.0.4 autodetects /30 as ptp
by Kenth Eriksson 28 Mar '19

28 Mar '19

It seems as bird autodetects a /30 OSPF interface as ptp. bird> show ospf interface ospfv2_1: Interface eth0 (10.210.138.32/30) Type: ptp Area: 0.0.0.0 (0) State: PtP Priority: 0 Cost: 10 Hello timer: 10 Wait timer: 40 Dead timer: 40 Retransmit timer: 5 bird> Is this really correct behaviour? The peering Cisco router thinks the /30 network is a broadcast interface... Thanks, Kenth

3 5

BGP end mark
by Arvin Gan 26 Mar '19

26 Mar '19

Hi Ondrej, In bgp_create_end_mark(), suggest to add condition ext_next_hop to select ip_end_mark or mp_end_mark that is aligned with bgp_create_update function, although this don't affect protocols communication :) @@ -2225,7 +2297,7 @@ bgp_create_end_mark(struct bgp_channel * BGP_TRACE(D_PACKETS, "Sending END-OF-RIB"); - return (c->afi == BGP_AF_IPV4) ? + return (c->afi == BGP_AF_IPV4) && !c->ext_next_hop ? bgp_create_ip_end_mark(c, buf): bgp_create_mp_end_mark(c, buf); } Best Regards, Arvin Gan

1 0