- Bird-users - Mailing Lists

bird.network.cz HTTPS does not verify on some systems
by Leon Meßner 09 Aug '18

09 Aug '18

Hi, since lately Debian9 has problems fetching the bird repository here. I suppose this is because bird.network.cz does not send the Let's Encrypt certificate and http redirects to https now. Output of openssl is below[1]. If you run the same command against helloworld.letsencrypt.org it verifies correctly. I assume because LE's cert is also sent. Using a web browser, bird.network.cz works because of some magic. Regards, Leon [1]: openssl s_client -verify 5 -host bird.network.cz -port 443 CONNECTED(00000003) --- Certificate chain 0 s:/CN=trubka.network.cz i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3 --- Server certificate -----BEGIN CERTIFICATE----- MIIGHjCCBQagAwIBAgISBP4LGoUGP5l81RdhMqoieW+4MA0GCSqGSIb3DQEBCwUA MEoxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MSMwIQYDVQQD ExpMZXQncyBFbmNyeXB0IEF1dGhvcml0eSBYMzAeFw0xODA2MTQyMTAwMTNaFw0x ODA5MTIyMTAwMTNaMBwxGjAYBgNVBAMTEXRydWJrYS5uZXR3b3JrLmN6MIIBIjAN BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs167eO/VgX3zZyKtlhObqnANKpxm l+LTG1QX2KCyn3qJeNcicZ/M8PUs+69x+ZPfnIdxEwfZrzGg11yLvQnUAaoHpNve Ro/iuO8uTM2r/Z8Ezc6UcFNrQwzll6kuSfGMnM4ybXwOHit3RGSRrwEDPWFBD/UO 982tn0P1TJur3Q4kR+V4xj9Fm6S7Y4dJin/CqjYVsj4W4adzKEpTVOEH/BGQ2IKJ 3ymQczLb2ubk7RfKBU/Q3srKCxlEi1J8Ywbs+4M2sdTVP0QUToIbfimS37XU3WNE MEjaBpS1PY8vlqpvkk2wab2AYo6Ebv2CENbYEzKBAdyi3vHbfENgvnj5CQIDAQAB o4IDKjCCAyYwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggr BgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBSgPnFxv8QSbGhLofscEjTS qCnvaTAfBgNVHSMEGDAWgBSoSmpjBH3duubRObemRWXv86jsoTBvBggrBgEFBQcB AQRjMGEwLgYIKwYBBQUHMAGGImh0dHA6Ly9vY3NwLmludC14My5sZXRzZW5jcnlw dC5vcmcwLwYIKwYBBQUHMAKGI2h0dHA6Ly9jZXJ0LmludC14My5sZXRzZW5jcnlw dC5vcmcvMC0GA1UdEQQmMCSCD2JpcmQubmV0d29yay5jeoIRdHJ1YmthLm5ldHdv cmsuY3owgf4GA1UdIASB9jCB8zAIBgZngQwBAgEwgeYGCysGAQQBgt8TAQEBMIHW MCYGCCsGAQUFBwIBFhpodHRwOi8vY3BzLmxldHNlbmNyeXB0Lm9yZzCBqwYIKwYB BQUHAgIwgZ4MgZtUaGlzIENlcnRpZmljYXRlIG1heSBvbmx5IGJlIHJlbGllZCB1 cG9uIGJ5IFJlbHlpbmcgUGFydGllcyBhbmQgb25seSBpbiBhY2NvcmRhbmNlIHdp dGggdGhlIENlcnRpZmljYXRlIFBvbGljeSBmb3VuZCBhdCBodHRwczovL2xldHNl bmNyeXB0Lm9yZy9yZXBvc2l0b3J5LzCCAQQGCisGAQQB1nkCBAIEgfUEgfIA8AB2 ACk8UZZUyDlluqpQ/FgH1Ldvv1h6KXLcpMMM9OVFR/R4AAABZABQNF0AAAQDAEcw RQIgVcoX61l0XSOMCvzPBTv2u8cO7oyNBDj9IWku74NwngUCIQDedkTRbe3PCvaq jM4xV3NFgawt6JIrtUzaiqaXNGegcgB2ANt0r+7LKeyx/so+cW0s5bmquzb3hHGD x12dTze2H79kAAABZABQNIcAAAQDAEcwRQIgML48N4VM1PeN6diunYt/X6NQrHj2 2avg1yyONjos8IcCIQDtSVYatJVvikyZAO1Q4sc7hCfwg5Drs2+qRLXA2rI63zAN BgkqhkiG9w0BAQsFAAOCAQEAJaWpxMV9a69QwxQEc28YMmi1ytMT0IOwBID0d5fv kTOf8eRAiIePMPcvtX2sTw5WAxX5NeRteNioS6/UWiQxSUZgRig1XqVsYZIIZmyE 8m/YfLHtAsTH9OnP4tgx7Ys02xAqiexhvA2eL3Kv6VMcPng6UPZsqwuvhUh/bxEj psPvNGkid+vsG7v7n1koY5qDhrNu2nSBsJlVSUP7VMmaZma7fE4iFJhOJWTh15v/ Z3Q2sp3tJA9an/TiNc8wLivntS9AoxsajltiSozfw67JjrVJH+bnCEQSJ9LFpPO3 jsrxaWvY/l0MnEfMxPt5riHpgyFT3nQ3KPZP6Ifrs3M7WA== -----END CERTIFICATE----- subject=/CN=trubka.network.cz issuer=/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3 --- No client certificate CA names sent Peer signing digest: SHA512 Server Temp Key: X25519, 253 bits --- SSL handshake has read 2227 bytes and written 269 bytes Verification error: unable to verify the first certificate --- New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384 Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-GCM-SHA384 Session-ID: 48FBE690BAB54A4EF0BCF647D3EC40F771EF070B92B2ADA82BBC78495A0E28A9 Session-ID-ctx: Master-Key: 4BF3560B6E3542C49A2E40534746B31AB97C1751C195C6A453B6B3C5687AAD7B48DA17D20FA8D4765BD627095BB0AF93 PSK identity: None PSK identity hint: None SRP username: None TLS session ticket lifetime hint: 300 (seconds) TLS session ticket: 0000 - 05 e6 6b 5b d2 a0 81 8d-e0 16 45 6f 44 d8 b0 86 ..k[......EoD... 0010 - b6 d9 24 8b 5f e3 e9 24-74 3c 77 55 98 cc 1a cf ..$._..$t<wU.... 0020 - 41 6e d3 41 48 c1 dc 8a-c9 b9 5c 67 e4 bb a0 bb An.AH.....\g.... 0030 - 1f 64 10 48 14 1c 38 75-18 f7 33 2f 22 9e 3d eb .d.H..8u..3/".=. 0040 - 8d 7d aa e4 1b 7d d4 94-b1 ba d9 6c 1e d9 f5 0d .}...}.....l.... 0050 - 5e af de 8f 33 31 b2 b0-fa 62 02 5b 9b c6 a0 a7 ^...31...b.[.... 0060 - f2 0b 7f d9 2e ae 24 b6-91 e6 62 5d 8d f6 c5 02 ......$...b].... 0070 - 38 05 25 75 90 51 0a 0a-47 67 79 08 89 b1 dd 3a 8.%u.Q..Ggy....: 0080 - 92 3c d5 9d b9 1a 38 34-12 d0 09 07 30 60 d6 0e .<....84....0`.. 0090 - 5f f6 8a 04 10 11 94 29-75 99 94 2d eb 1f 7f 03 _......)u..-.... 00a0 - a9 fb 77 85 07 43 35 25-a1 de d4 d7 b3 50 b3 bb ..w..C5%.....P.. 00b0 - 06 90 9d a0 49 02 64 0a-66 47 88 ac 38 10 a1 ea ....I.d.fG..8... Start Time: 1533827231 Timeout : 7200 (sec) Verify return code: 21 (unable to verify the first certificate) Extended master secret: yes ---

2 2

bird 2 and vpn4 mpls
by Chris Herdt 08 Aug '18

08 Aug '18

Following the example at https://github.com/BIRD/bird/ blob/v2.0.2/doc/bird.conf.example2, I set up a simple bird config (see below). It is working, but I am not certain what the '---' in the table column of the output of `show protocols` means. I expected the column to display vpntab4. $ sudo /usr/local/sbin/birdc show protocols BIRD v2.0.2 ready. Name Proto Table State Since Info peer1 BGP --- up 17:14:48.474 Established The output of `show route count` shows that there are routes in table vpntab4: $ sudo /usr/local/sbin/birdc show route count BIRD v2.0.2 ready. 0 of 0 routes for 0 networks in table master4 0 of 0 routes for 0 networks in table master6 9581 of 9581 routes for 9581 networks in table vpntab4 Total: 9581 of 9581 routes for 9581 networks in 3 tables The contents of my bird.conf: log syslog { debug, trace, info, remote, warning, error, auth, fatal, bug }; log stderr all; router id 127.0.0.1; vpn4 table vpntab4; protocol bgp peer1 { local as 65321; neighbor 192.168.1.1 as 65321; hold time 180; vpn4 mpls { import all; }; } Thanks, -- Chris Herdt https://osric.com/chris/

3 4

Bird 2 and device routes switch in kernel configuration section
by Julien Dessaux 06 Aug '18

06 Aug '18

Hello, I have found something odd will try testing bird 2 with some of my configurations. It seems that the "device routes on" in the kernel configuration section doesn't exist anymore. The documentation still references it in the introduction for the kernel section, but not in the detailed list of configuration entries : http://bird.network.cz/?get_doc&v=20&f=bird-6.html#ss6.6 . For reference, here it is also for bird 1.6 : http://bird.network.cz/?get_doc&v=16&f=bird-6.html#ss6.6 Is there any information as to how to port the "device routes on" behavior from bird 1.6 to bird 2? I use it to have bird learn routes that are push from an openvpn server I connect to, so that I can announce those to other servers. Best regards, -- Julien

3 3

seemless configuration change
by Kurt Wauters 04 Aug '18

04 Aug '18

Hello, I've got BIRD running for v4 and v6 but i was wondering if there is a way to switch between configurations without shutting down bird in order to avoid BGP flaps. I basically add regularly neighbors to the RS and i don't want my allready active bgp sessions to flap. Initially i thought I would be able to load the new configuration files but he complains that there is already a process running. Anyone an idea? Kurt

4 3

OpenVPN-Server as Bird-Router
by Dawid Kulesza 03 Aug '18

03 Aug '18

Hello, I have some issues runinng a few Bird-instances, where two border PC's are connected over a VPN-Connection. The image below shows the setting: clientA 192.168.30.2 (eth) |//|//192.168.30.1 (eth) routerA 192.168.21.5 (eth) |//|//192.168.21.1 (eth) clientB 10.29.0.8 (tun) |//|//10.29.0.1 (tun) Server 10.29.0.1 (tun) |//|//10.29.0.4 (tun) clientC 192.168.21.17 (eth) Now running route -n on ClientC gives following result: route -n (routes with metric 12 are set by bird) Destination Gateway Genmask Flags Metric Ref Use Iface 10.29.0.0 0.0.0.0 255.255.252.0 U 0 0 0 tun0 WWWWW 0.0.0.0 255.255.255.252 U 0 0 0 eth1 XXXXXXX 0.0.0.0 255.255.255.255 UH 1024 0 0 eth1 192.168.21.0 10.29.0.8 255.255.255.240 UG 12 0 0 tun0 192.168.21.16 0.0.0.0 255.255.255.240 U 0 0 0 eth0 192.168.30.0 10.29.0.8 255.255.255.240 UG 12 0 0 tun0 On Server: Ziel Router Genmask Flags Metric Ref Use Iface 192.168.21.16 10.29.0.4 255.255.255.240 UG 17 0 0 tun0 192.168.21.0 10.29.0.8 255.255.255.240 UG 17 0 0 tun0 192.168.30.0 10.29.0.8 255.255.255.240 UG 17 0 0 tun0 192.168.20.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 10.29.0.0 0.0.0.0 255.255.252.0 U 0 0 0 tun0 ZZZZZZZZ 0.0.0.0 255.255.0.0 U 1002 0 0 eth0 With /birdc show ospf neighbors / I can see on each router everyone else, so the initialization is done correctly but somehow data packages aren't transferred correctly. There are no invalid iptables rules nor any other firewall is set. Regards Dawid

3 2

Newbie question about 'export' semantics
by Mark Petrovic 02 Aug '18

02 Aug '18

Hi. I am new to bird, and am studying an existing bird 1.6 configuration to understand how the system it supports works. Nothing is broken on my system; I just want to understand how it works. In the main bird.cfg within a bgp template, I see this export filter calico_pools; that calico_pools filter calls this via a bird function if ( net = 10.6.130.64/26 ) then { accept; } Now, I correctly see this route as advertised when viewed from a BGP peer. What I don't understand are the semantics of this if-statement. In an export statement, the docs say the relationship is from routing table to protocol export: "This is similar to the import keyword, except that it works in the direction from the routing table to the protocol." What confuses me is that there is *no* net = 10.6.130.64/26 in the local routing table, so where is the value of "net" coming from such that the if-net comparison can be made and the export makes sense works? I know the statement somehow does the right thing; I just don't know how to read and explain it to others in the export context. Can someone please help me understand how to read this? Thanks.

1 1

BIRD not redistributing iBGP routes
by Matthias Merkel 31 Jul '18

31 Jul '18

I have three BIRD routers: A uses iBGP only B also only uses iBGP C uses eBGP and iBGP They are connected as follows: A<->B<->C (all via iBGP) The goal is to allow A to announce routes to B, have B redistribute the route to C and have C announce it to the peers. The issue is that B receives the route (and adds it to the kernel) however it does not send it to C. Any ideas how to fix this? Matthias Merkel CTO BoltN Hosting Limited c-Level Phone +498941207255 Mobile +4915752259219 Email matthias(a)boltn-hosting.com Skype matthias_merkel1 Follow us <https://img.beta.newoldstamp.com/r/27887/twitter> <https://img.beta.newoldstamp.com/r/27887/linkedin> <https://img.beta.newoldstamp.com/r/27887/android> <https://img.beta.newoldstamp.com/r/27887/whatsapp>

3 2

lists issue
by Arvin Gan 27 Jul '18

27 Jul '18

Hi all, There may be an issue in blow function when deleted the node is the first one, that mean n->prev is NULL....., similarly, same issue as the last one node is deleted. LIST_INLINE void rem_node(node *n) { node *z = n->prev; node *x = n->next; z->next = x; x->prev = z; n->next = NULL; n->prev = NULL; } Thanks Arvin

2 1

Not getting out of "Connect" state
by Scott Ellentuch 26 Jul '18

26 Jul '18

Hi, I've had a bird(1.4.5)<>bird(1.5.0) up and running for 2 months now, and I was forced to reboot one of the servers. Now I can't get them to re-establish.... bgp_aws1 BGP master start 12:15:07 Connect bgp_isp1 BGP master start 12:14:08 Connect I've disable them both, waited a bit, then enabled them both with no luck. Tried a few times. Is there somewhere/something else I should be checking? I know BGP should be BGP, but is it potentially a glitch between 2 versions (I have another set just like this, and disable/wait/enable resolved that) Tnx, Tuc

2 1

question
by Farhadtoosky 24 Jul '18

24 Jul '18

Hi, I'm using the Bird for a project and I need to use command line interface such as Cisco router for OSPF config. Bird and birdc using .conf file for configuration. Are there any way for config with CLI? How enable interactive mode of bird? By regards, Zeinab

3 2