- Bird-users - Mailing Lists

Cannot connect two ospf-instances over tun-interface
by dawid k 05 Apr '18

05 Apr '18

I'm trying to set up pretty simply configuration consisting of two linux machines connected over tun-interface created by OpenVPN. The VPN-connection is working fine - I can send data over this interface. Now I installed bird and configured ospf on both devices. I can see that both bird instances are sending hello packets on tun-interface however no one of them is getting the message. I can see with tcpdump, that every device is getting the hello-message. However they are not forwarded to bird or bird just ignores them. I tried my setup over cabel with eth0-interface and everything is working fine. Right now every machine is advertising just one example static network. I will focus on correct advertising later after I connect those two instances. The tun0 interface is working in type ptp and the netmask is 255.255.255.255. Do you have any idea what's wrong? Thanks for every input, tookie009

5 17

[PATCH] babel: Use acknowledged retractions when losing a prefix
by Toke Høiland-Jørgensen 04 Apr '18

04 Apr '18

In order to prevent routing loops, Babel installs temporary blackhole routes to prefixes that expire or are otherwise lost. These blackhole routes are maintained for a while to ensure the route has been flushed from the whole network; the default hold time is 64 seconds. In the updated IETF version of Babel (rfc6126bis), an alternative procedure was added which replaces this hold time with an explicit acknowledgement procedure. This procedure simply consists of sending a retraction along with an acknowledgement request to all neighbours, and removing the blackhole route once all neighbours have acknowledged the retraction. As this usually happens pretty quickly, the hold time during which the route is blackholed is almost completely avoided. This patch implements the above behaviour. It adds a generic facility to the Babel protocol which allows for sending sequences of acknowledgement requests to a number of neighbours, and executing a callback function once all the requests have been ACKed. This facility is then used to implement the acknowledgement scheme when a route is lost. Signed-off-by: Toke Høiland-Jørgensen <toke(a)toke.dk> --- proto/babel/babel.c | 199 +++++++++++++++++++++++++++++++++++++++++++++++--- proto/babel/babel.h | 25 +++++++ proto/babel/packets.c | 71 +++++++++++++++++- 3 files changed, 283 insertions(+), 12 deletions(-) diff --git a/proto/babel/babel.c b/proto/babel/babel.c index 3cf8aaf0..3d235382 100644 --- a/proto/babel/babel.c +++ b/proto/babel/babel.c @@ -52,8 +52,10 @@ static void babel_select_route(struct babel_proto *p, struct babel_entry *e, str static inline void babel_announce_retraction(struct babel_proto *p, struct babel_entry *e); static void babel_send_route_request(struct babel_proto *p, struct babel_entry *e, struct babel_neighbor *n); static void babel_send_seqno_request(struct babel_proto *p, struct babel_entry *e, struct babel_seqno_request *sr); +static void babel_send_ack_sequence(struct babel_ack_sequence *seq); +static void babel_flush_outgoing_ack(struct babel_outgoing_ack_req *ack); static void babel_update_cost(struct babel_neighbor *n); -static inline void babel_kick_timer(struct babel_proto *p); +static inline void babel_kick_timer(struct babel_proto *p, btime interval); static inline void babel_iface_kick_timer(struct babel_iface *ifa); static inline void babel_lock_neighbor(struct babel_neighbor *nbr) @@ -428,6 +430,7 @@ babel_get_neighbor(struct babel_iface *ifa, ip_addr addr) nbr->txcost = BABEL_INFINITY; nbr->cost = BABEL_INFINITY; init_list(&nbr->routes); + init_list(&nbr->ack_reqs); babel_lock_neighbor(nbr); add_tail(&ifa->neigh_list, NODE nbr); @@ -438,6 +441,7 @@ static void babel_flush_neighbor(struct babel_proto *p, struct babel_neighbor *nbr) { struct babel_route *r; + struct babel_outgoing_ack_req *a; node *n; TRACE(D_EVENTS, "Removing neighbor %I on %s", nbr->addr, nbr->ifa->iface->name); @@ -449,6 +453,12 @@ babel_flush_neighbor(struct babel_proto *p, struct babel_neighbor *nbr) babel_flush_route(p, r); } + WALK_LIST_FIRST(n, nbr->ack_reqs) + { + a = SKIP_BACK(struct babel_outgoing_ack_req, neigh_ack, n); + babel_flush_outgoing_ack(a); + } + nbr->ifa = NULL; rem_node(NODE nbr); babel_unlock_neighbor(nbr); @@ -508,6 +518,69 @@ babel_expire_neighbors(struct babel_proto *p) } } +static void babel_flush_ack_seq(struct babel_ack_sequence *seq) +{ + struct babel_proto *p = seq->p; + struct babel_msg_node *msgn; + + rem_node(NODE seq); + + WALK_LIST_FIRST(msgn, seq->payload) + { + rem_node(NODE msgn); + sl_free(p->msg_slab, msgn); + } + + mb_free(seq); +} + +static int +babel_check_ack_seq(struct babel_ack_sequence *seq) +{ + if (EMPTY_LIST(seq->acks)) + { + seq->callback(seq); + babel_flush_ack_seq(seq); + return 1; + } + return 0; +} + +static void +babel_flush_outgoing_ack(struct babel_outgoing_ack_req *ack) +{ + struct babel_ack_sequence *seq = ack->seq; + rem_node(&ack->neigh_ack); + rem_node(NODE ack); + mb_free(ack); + babel_check_ack_seq(seq); +} + +static void +babel_expire_ack_seqs(struct babel_proto *p) +{ + struct babel_ack_sequence *seq, *nxt; + btime now_ = current_time(); + + WALK_LIST_DELSAFE(seq, nxt, p->ack_seqs) + { + if (now_ >= seq->expires) + { + if (seq->retries > 0) + { + babel_send_ack_sequence(seq); + seq->retries--; + seq->expires = now_ + BABEL_ACK_RETRY_INTERVAL; + babel_kick_timer(p, BABEL_ACK_RETRY_INTERVAL); + } + else + { + babel_flush_ack_seq(seq); + } + } + } +} + /* * Best route selection @@ -784,6 +857,40 @@ babel_send_ack(struct babel_iface *ifa, ip_addr dest, u16 nonce) babel_send_unicast(&msg, ifa, dest); } +static void +babel_send_ack_sequence(struct babel_ack_sequence *seq) +{ + struct babel_msg_node msgn = {}; + struct babel_outgoing_ack_req *ack; + + msgn.msg.type = BABEL_TLV_ACK_REQ; + msgn.msg.ack_req.interval = BABEL_ACK_RETRY_INTERVAL; + add_tail(&seq->payload, NODE &msgn); + + WALK_LIST(ack, seq->acks) { + DBG("Sending ACK request to %I with nonce %d\n", ack->nbr->addr, ack->nonce); + msgn.msg.ack_req.nonce = ack->nonce; + babel_send_unicast_list(&seq->payload, ack->nbr->ifa, ack->nbr->addr); + } + rem_node(NODE &msgn); +} + +static void +babel_retraction_ack_complete(struct babel_ack_sequence *seq) +{ + struct babel_proto *p = seq->p; + struct babel_msg_node *msgn = HEAD(seq->payload); + struct babel_entry *e = babel_find_entry(p, &msgn->msg.update.net) + + ASSERT(msgn->msg.type == BABEL_TLV_UPDATE); + + if (e && e->unreachable && e->valid == BABEL_ENTRY_STALE) + { + DBG("ACK sequence for retraction complete, retracting route: %N\n", e->n.addr); + babel_announce_retraction(p, e); + } +} + static void babel_build_ihu(union babel_msg *msg, struct babel_iface *ifa, struct babel_neighbor *n) { @@ -1020,7 +1127,7 @@ babel_send_retraction(struct babel_iface *ifa, net_addr *n) TRACE(D_PACKETS, "Sending retraction for %N seqno %d", n, p->update_seqno); msg.type = BABEL_TLV_UPDATE; - msg.update.interval = ifa->cf->update_interval; + msg.update.interval = BABEL_INFINITY; msg.update.seqno = p->update_seqno; msg.update.metric = BABEL_INFINITY; msg.update.net = *n; @@ -1028,6 +1135,54 @@ babel_send_retraction(struct babel_iface *ifa, net_addr *n) babel_enqueue(&msg, ifa); } +static void +babel_send_retraction_acked(struct babel_proto *p, net_addr *n) +{ + struct babel_ack_sequence *seq = mb_allocz(p->p.pool, sizeof(struct babel_ack_sequence)); + struct babel_msg_node *msgn = sl_alloc(p->msg_slab); + struct babel_iface *ifa; + struct babel_neighbor *nbr; + int i = 0; + + init_list(&seq->acks); + init_list(&seq->payload); + memset(msgn, 0, sizeof(*msgn)); + seq->callback = babel_retraction_ack_complete; + seq->expires = current_time() + BABEL_ACK_RETRY_INTERVAL; + seq->retries = BABEL_ACK_RETRIES; + seq->p = p; + add_tail(&p->ack_seqs, NODE seq); + + msgn->msg.type = BABEL_TLV_UPDATE; + msgn->msg.update.interval = BABEL_INFINITY; + msgn->msg.update.seqno = p->update_seqno; + msgn->msg.update.metric = BABEL_INFINITY; + msgn->msg.update.net = *n; + + add_tail(&seq->payload, NODE msgn); + + WALK_LIST(ifa, p->interfaces) { + WALK_LIST(nbr, ifa->neigh_list) { + struct babel_outgoing_ack_req *ack = mb_allocz(p->p.pool, sizeof(struct babel_outgoing_ack_req)); + ack->nbr = nbr; + ack->seq = seq; + ack->nonce = random(); + add_tail(&seq->acks, NODE ack); + add_tail(&nbr->ack_reqs, &ack->neigh_ack); + i++; + } + } + + DBG("Created ACK sequence for %N with %d requests\n", n, i); + + /* Sequence may be empty if we have no neighbors */ + if (!babel_check_ack_seq(seq)) + { + babel_send_ack_sequence(seq); + babel_kick_timer(p, BABEL_ACK_RETRY_INTERVAL); + } +} + static void babel_send_wildcard_retraction(struct babel_iface *ifa) { @@ -1096,11 +1251,35 @@ babel_update_hello_history(struct babel_neighbor *n, u16 seqno, uint interval) n->last_hello_int = interval; } - /* * TLV handlers */ +void +babel_handle_ack(union babel_msg *m, struct babel_iface *ifa) +{ + struct babel_proto *p = ifa->proto; + struct babel_msg_ack *msg = &m->ack; + node *n; + + TRACE(D_PACKETS, "Handling ACK nonce %d from %I", + msg->nonce, msg->sender); + + struct babel_neighbor *nbr = babel_find_neighbor(ifa, msg->sender); + if (!nbr) + return; + + WALK_LIST(n, nbr->ack_reqs) + { + struct babel_outgoing_ack_req *ack = SKIP_BACK(struct babel_outgoing_ack_req, neigh_ack, n); + if (ack->nonce == msg->nonce) + { + babel_flush_outgoing_ack(ack); + return; + } + } +} + void babel_handle_ack_req(union babel_msg *m, struct babel_iface *ifa) { @@ -2044,13 +2223,14 @@ babel_timer(timer *t) babel_expire_routes(p); babel_expire_neighbors(p); + babel_expire_ack_seqs(p); } static inline void -babel_kick_timer(struct babel_proto *p) +babel_kick_timer(struct babel_proto *p, btime interval) { - if (p->timer->expires > (current_time() + 100 MS)) - tm_start(p->timer, 100 MS); + if (p->timer->expires > (current_time() + interval)) + tm_start(p->timer, interval); } @@ -2161,9 +2341,9 @@ babel_rt_notify(struct proto *P, struct channel *c UNUSED, struct network *net, e->valid = BABEL_ENTRY_STALE; e->metric = BABEL_INFINITY; - - babel_trigger_update(p); e->updated = current_time(); + + babel_send_retraction_acked(p, net->n.addr); } } @@ -2214,6 +2394,7 @@ babel_start(struct proto *P) OFFSETOF(struct babel_entry, n), 0, babel_init_entry); init_list(&p->interfaces); + init_list(&p->ack_seqs); p->timer = tm_new_init(P->pool, babel_timer, p, 1 S, 0); tm_start(p->timer, 1 S); p->update_seqno = 1; @@ -2269,7 +2450,7 @@ babel_reconfigure(struct proto *P, struct proto_config *CF) babel_reconfigure_ifaces(p, new); babel_trigger_update(p); - babel_kick_timer(p); + babel_kick_timer(p, 100 MS); return 1; } diff --git a/proto/babel/babel.h b/proto/babel/babel.h index 1128d261..684bad1b 100644 --- a/proto/babel/babel.h +++ b/proto/babel/babel.h @@ -56,6 +56,8 @@ #define BABEL_TIME_UNITS 10000 /* On-wire times are counted in centiseconds */ #define BABEL_MIN_INTERVAL (0x0001 * BABEL_TIME_UNITS) #define BABEL_MAX_INTERVAL (0xFFFF * BABEL_TIME_UNITS) +#define BABEL_ACK_RETRY_INTERVAL (1 S_) +#define BABEL_ACK_RETRIES 2 #define BABEL_OVERHEAD (IP6_HEADER_LENGTH+UDP_HEADER_LENGTH) #define BABEL_MIN_MTU (512 + BABEL_OVERHEAD) @@ -142,6 +144,7 @@ struct babel_proto { struct channel *ip6_channel; list interfaces; /* Interfaces we really know about (struct babel_iface) */ + list ack_seqs; /* Outstanding ACK sequences */ u64 router_id; u16 update_seqno; /* To be increased on request */ u8 update_seqno_inc; /* Request for update_seqno increase */ @@ -205,6 +208,7 @@ struct babel_neighbor { btime ihu_expiry; list routes; /* Routes this neighbour has sent us (struct babel_route) */ + list ack_reqs; /* Outstanding ack requests sent to this neighbor */ }; struct babel_source { @@ -263,6 +267,25 @@ struct babel_entry { #define BABEL_ENTRY_VALID 1 /* Valid outgoing route */ #define BABEL_ENTRY_STALE 2 /* Stale outgoing route, waiting for GC */ +struct babel_ack_sequence { + node n; + list acks; /* list of pending acks in sequence (babel_outgoing_ack_req) */ + btime expires; + u8 retries; + list payload; /* list of babel_msg_nodes in outgoing messages */ + + void (*callback)(struct babel_ack_sequence *); /* called when there are no more pending ACKs */ + struct babel_proto *p; +}; + +struct babel_outgoing_ack_req { + node n; /* in struct babel_ack_sequence->acks */ + node neigh_ack; /* in struct babel_neighbor->ack_reqs */ + u16 nonce; + struct babel_neighbor *nbr; + struct babel_ack_sequence *seq; +}; + /* * Internal TLV messages @@ -278,6 +301,7 @@ struct babel_msg_ack_req { struct babel_msg_ack { u8 type; u16 nonce; + ip_addr sender; }; struct babel_msg_hello { @@ -358,6 +382,7 @@ void babel_show_routes(struct proto *P); /* packets.c */ void babel_enqueue(union babel_msg *msg, struct babel_iface *ifa); void babel_send_unicast(union babel_msg *msg, struct babel_iface *ifa, ip_addr dest); +void babel_send_unicast_list(list *lst, struct babel_iface *ifa, ip_addr dest); int babel_open_socket(struct babel_iface *ifa); void babel_send_queue(void *arg); diff --git a/proto/babel/packets.c b/proto/babel/packets.c index dd86222a..5b4c4555 100644 --- a/proto/babel/packets.c +++ b/proto/babel/packets.c @@ -229,6 +229,7 @@ put_ip6_ll(void *p, ip6_addr addr) * TLV read/write functions */ +static int babel_read_ack(struct babel_tlv *hdr, union babel_msg *msg, struct babel_parse_state *state); static int babel_read_ack_req(struct babel_tlv *hdr, union babel_msg *msg, struct babel_parse_state *state); static int babel_read_hello(struct babel_tlv *hdr, union babel_msg *msg, struct babel_parse_state *state); static int babel_read_ihu(struct babel_tlv *hdr, union babel_msg *msg, struct babel_parse_state *state); @@ -239,6 +240,7 @@ static int babel_read_route_request(struct babel_tlv *hdr, union babel_msg *msg, static int babel_read_seqno_request(struct babel_tlv *hdr, union babel_msg *msg, struct babel_parse_state *state); static uint babel_write_ack(struct babel_tlv *hdr, union babel_msg *msg, struct babel_write_state *state, uint max_len); +static uint babel_write_ack_req(struct babel_tlv *hdr, union babel_msg *msg, struct babel_write_state *state, uint max_len); static uint babel_write_hello(struct babel_tlv *hdr, union babel_msg *msg, struct babel_write_state *state, uint max_len); static uint babel_write_ihu(struct babel_tlv *hdr, union babel_msg *msg, struct babel_write_state *state, uint max_len); static uint babel_write_update(struct babel_tlv *hdr, union babel_msg *msg, struct babel_write_state *state, uint max_len); @@ -256,14 +258,14 @@ static const struct babel_tlv_data tlv_data[BABEL_TLV_MAX] = { [BABEL_TLV_ACK_REQ] = { sizeof(struct babel_tlv_ack_req), babel_read_ack_req, - NULL, + babel_write_ack_req, babel_handle_ack_req }, [BABEL_TLV_ACK] = { sizeof(struct babel_tlv_ack), - NULL, + babel_read_ack, babel_write_ack, - NULL + babel_handle_ack }, [BABEL_TLV_HELLO] = { sizeof(struct babel_tlv_hello), @@ -327,6 +329,36 @@ babel_read_ack_req(struct babel_tlv *hdr, union babel_msg *m, return PARSE_SUCCESS; } +static uint +babel_write_ack_req(struct babel_tlv *hdr, union babel_msg *m, + struct babel_write_state *state UNUSED, uint max_len UNUSED) +{ + struct babel_tlv_ack_req *tlv = (void *) hdr; + struct babel_msg_ack_req *msg = &m->ack_req; + + TLV_HDR0(tlv, BABEL_TLV_ACK_REQ); + put_u16(&tlv->nonce, msg->nonce); + put_time16(&tlv->interval, msg->interval); + + return sizeof(struct babel_tlv_ack_req); +} + + +static int +babel_read_ack(struct babel_tlv *hdr, union babel_msg *m, + struct babel_parse_state *state) +{ + struct babel_tlv_ack *tlv = (void *) hdr; + struct babel_msg_ack *msg = &m->ack; + + msg->type = BABEL_TLV_ACK; + msg->nonce = get_u16(&tlv->nonce); + msg->sender = state->saddr; + + return PARSE_SUCCESS; +} + + static uint babel_write_ack(struct babel_tlv *hdr, union babel_msg *m, struct babel_write_state *state UNUSED, uint max_len UNUSED) @@ -1141,6 +1173,39 @@ babel_send_unicast(union babel_msg *msg, struct babel_iface *ifa, ip_addr dest) babel_kick_queue(ifa); } +/** + * babel_send_unicast_list - send a multi-TLV packet via unicast to a destination + * @lst: list of TLVs to send + * @ifa: Interface to send via + * @dest: Destination of the TLV + * + * This function is used to send a list of TLVs via unicast to a designated + * receiver. This is used for sending messages that comprise multiple TLVs, such + * as those that include an acknowledgement request. + */ +void +babel_send_unicast_list(list *lst, struct babel_iface *ifa, ip_addr dest) +{ + struct babel_proto *p = ifa->proto; + struct babel_msg_node *msgn, *msgn_copy; + list queue; + + init_list(&queue); + WALK_LIST(msgn, *lst) + { + msgn_copy = sl_alloc(p->msg_slab); + memcpy(msgn_copy, msgn, sizeof(*msgn_copy)); + + add_tail(&queue, NODE msgn_copy); + } + babel_write_queue(ifa, &queue); + babel_send_to(ifa, dest); + + /* We could overwrite waiting packet here, we may have to kick TX queue */ + if (!EMPTY_LIST(ifa->msg_queue)) + babel_kick_queue(ifa); +} + /** * babel_enqueue - enqueue a TLV for transmission on an interface * @msg: TLV to enqueue (in internal TLV format) -- 2.16.1

2 6

Can't Log information about a double
by Mattia Milani 04 Apr '18

04 Apr '18

Hello all, I'm trying to log some information during the bird process execution. I'm doing it in the bgp section. I used the command: log(L_INFO "** some text **"); with success, i added to the log some information about an integer variable with success, here it is the code: int a = 5; log(L_INFO "** some text ** %d", a); Now i'm trying to make the same with a double variable but without success double a = 5.5; log(L_INFO "** some text ** %lf", a); the output was: 2018-03-30 18:09:12.270 <INFO> ** some text ** %f I had already tried with %f instead of %lf but nothing changed in the output How can i log some double value? i need to use another function instead of log()? Thanks, Mattia

3 6

Opensource Virtual Network Topology builder (knet)
by knet solutions 03 Apr '18

03 Apr '18

All, I am glad to introduce the opensource virtual network topology builder (knet). Its built with docker and openvswitch. I am using "bird" for router node. we can build the complex routing topology in few seconds, General Intro about this tool: ----------------------------------------------- https://github.com/knetsolutions/knet/ http://knet-topology-builder.readthedocs.io/en/latest/ Quick video tutorial in youtube: ------------------------------------------------- https://www.youtube.com/watch?v=SmWmbAsiimI&list= PLSO7MDepKLNCrHGrRcAyUWWUEFCOrjC4B -- *Regards, * *Suresh* *Knet solutions.* https://github.com/knetsolutions/KNet http://knet-topology-builder.readthedocs.io/ http://knetsolutions.in/

1 0

Problem with ECMP
by André Carlim 02 Apr '18

02 Apr '18

I'm trying to use ECMP, but without success, I'll leave my conf below, does anyone know where I'm going wrong? Q. I have two routers announcing the default route for this "client". conf: log syslog all; # Override router ID router id 10.192.0.2; # Turn on global debugging of all protocols debug protocols all; protocol direct { interface "-eth*", "*"; # Restrict network interfaces it works with } filter kernel_export { print "filter_name: ", "kernel_export", " protocol: ", proto, " net: ", net, " krt_metric: ", krt_metric; if net = 0.0.0.0/0 then { krt_metric = 100; } accept; } protocol kernel { learn; # Learn all alien routes from the kernel persist; # Don't remove routes on bird shutdown scan time 20; # Scan kernel routing table every 20 seconds import all; # Default is import all export filter kernel_export; # Default is export none } protocol device { scan time 10; # Scan interfaces every 10 seconds } protocol static { disabled; # Disable by default } filter ospf_import { print "router_id: ", ospf_router_id, " net: ", net, " ospf_metric1: ", ospf_metric1 ; if net = 0.0.0.0/0 then { ospf_metric1 = 1000; } accept; } protocol ospf { ecmp yes; import filter ospf_import; export all; tick 1; rfc1583compat yes; area 0.0.0.0 { networks { 10.192.0.0/29; }; interface "eth1" { type broadcast; authentication none; }; }; } output of 'show ospf state' in this host: area 0.0.0.0 router 10.192.0.1 distance 10 network 10.192.0.0/29 metric 10 external 0.0.0.0/0 metric2 10000 router 10.192.0.2 distance 0 network 10.192.0.0/29 metric 10 external 100.126.0.44/32 metric2 10000 router 10.192.0.3 distance 10 network 10.192.0.0/29 metric 10 external 0.0.0.0/0 metric2 10000 network 10.192.0.0/29 dr 10.192.0.3 distance 10 router 10.192.0.3 router 10.192.0.2 router 10.192.0.1 -- André Carlim StubNetwork

2 2

OSPF Create and Originate Default Route
by André Carlim 02 Apr '18

02 Apr '18

Hello! I use the OSPF module of the bird, however I use several different tables in both the module and the Linux kernel, and in general I need to create and distribute the default route. I saw in other discussions that the folks there are no problems in reading the route in the kernel table, and so redistribute it, I remember that this is not my case, I do not have the default route in these kernel tables. Does anyone have any idea how I will do this? -- André Carlim StubNetwork

3 6

Re: FreeBSD, BGP and md5
by Peter Andreev 23 Mar '18

23 Mar '18

Leo, Thanks for answer. As for 11.1 IPSEC is already enabled in GENERIC, so I had to add only TCP_SIGNATURE. After I'd installed new kernel, BGP auth started working without adding ipsec-related stuff to rc.conf or altering setkey.conf > On 23 Mar 2018, at 15:37, Leo Vandewoestijne <bird(a)dns.company> wrote: > > On Fri, 23 Mar 2018, Peter Andreev wrote: > >> Is it still necessary to build custom kernel to get md5 auth working? >> > I'm pretty sure, yes. > The only way I got it working in 11.1 i.c.w. 1.6.x was: > > # kernel config > options IPSEC > options TCP_SIGNATURE > > # /etc/rc.conf > ipsec_enable="YES" > ipsec_program="/sbin/setkey" > ipsec_file="/etc/setkey.conf" > > # /etc/setkey.conf > flush; # useful when running mutations manually > spdflush; # useful when running mutations manually > add -4 12.34.56.6 12.34.56.7 tcp 0x1000 -A tcp-md5 "teNp8XUrZtNteNjbep68jXgUGroZtUN"; > add -4 12.34.56.7 12.34.56.6 tcp 0x1000 -A tcp-md5 "teNp8XUrZtNteNjbep68jXgUGroZtUN"; > > And initially nothing in bird.conf (just like I did in OpenBGPd in the pre-Bird era). > But suddenly -about a year ago- at one Asian location I needed the password option in bird.conf. > > I however do see a setkey patch in the current 1.6.4 port, so I don't know what has changed there. > I have not used that, as I migrated to 2.0.x, which offered a password option in bird.conf: > > # bird.conf - at the BGP protocol: > password "teNp8XUrZtNteNjbep68jXgUGroZtUN"; > > So the intented design was to only need it in bird.conf, > but in reality I now only got it working when setting it both in setkey.conf and in bird.conf > > Clearly things have changed, somewhere in 11.1. > I already noticed IPSEC_NAT_T was removed (which was useful on vlan) > https://svnweb.freebsd.org/base/stable/11/sys/modules/tcp/tcpmd5/Makefile?v… > So this week I puzzled some more after having IPSEC_SUPPORT added to the kernel. > > But so far I did not witness any difference, so I'm still with the double config - not a real issue; it works fine. > > > So I continued with finding out the correct restrictions/permissions in PF. > For clarity; the double config "problem" is unrelated to firewalling - I did pretty much all of my testing without. > I don't wish to threadjack yet, with something in fact unrelated to Bird, but once your problem is solved I'd like to bring that question up. > > > Feel free to contact me off list in case you feel any need to. > > > -- > > Met vriendelijke groet, > With kind regards, > > > Leo Vandewoestijne > <%2A%2A%2A(a)dns.company> > <www.dns.company> -- Peter Andreev MSK-IX/RIPN +7 (495) 737-0685 DNS Network Operational Center +7 (499) 192-9179

1 0

FreeBSD, firewall patch in port of 1.6.x branche
by Leo Vandewoestijne 23 Mar '18

23 Mar '18

Hi, Yesterday I've submitted patches to upgrade Bird 1.6.x and 2.0.x to yesterdays releases. Now at the 1.6.x there used to be a firewall patch, made by Alexander V. Chernikov. But it's a stuggle to not break that option. So now I wonder, is this only used by few people, or are thousands of routers depending on this option? Further the 2.0.2 branche may become the default, and 1.6.5 will be -legacy https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=226859 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=226860 -- Met vriendelijke groet, With kind regards, Leo Vandewoestijne <%2A%2A%2A(a)dns.company> <www.dns.company>

1 0

Re: FreeBSD, BGP and md5
by Leo Vandewoestijne 23 Mar '18

23 Mar '18

On Fri, 23 Mar 2018, Peter Andreev wrote: > Is it still necessary to build custom kernel to get md5 auth working? > I'm pretty sure, yes. The only way I got it working in 11.1 i.c.w. 1.6.x was: # kernel config options IPSEC options TCP_SIGNATURE # /etc/rc.conf ipsec_enable="YES" ipsec_program="/sbin/setkey" ipsec_file="/etc/setkey.conf" # /etc/setkey.conf flush; # useful when running mutations manually spdflush; # useful when running mutations manually add -4 12.34.56.6 12.34.56.7 tcp 0x1000 -A tcp-md5 "teNp8XUrZtNteNjbep68jXgUGroZtUN"; add -4 12.34.56.7 12.34.56.6 tcp 0x1000 -A tcp-md5 "teNp8XUrZtNteNjbep68jXgUGroZtUN"; And initially nothing in bird.conf (just like I did in OpenBGPd in the pre-Bird era). But suddenly -about a year ago- at one Asian location I needed the password option in bird.conf. I however do see a setkey patch in the current 1.6.4 port, so I don't know what has changed there. I have not used that, as I migrated to 2.0.x, which offered a password option in bird.conf: # bird.conf - at the BGP protocol: password "teNp8XUrZtNteNjbep68jXgUGroZtUN"; So the intented design was to only need it in bird.conf, but in reality I now only got it working when setting it both in setkey.conf and in bird.conf Clearly things have changed, somewhere in 11.1. I already noticed IPSEC_NAT_T was removed (which was useful on vlan) https://svnweb.freebsd.org/base/stable/11/sys/modules/tcp/tcpmd5/Makefile?v… So this week I puzzled some more after having IPSEC_SUPPORT added to the kernel. But so far I did not witness any difference, so I'm still with the double config - not a real issue; it works fine. So I continued with finding out the correct restrictions/permissions in PF. For clarity; the double config "problem" is unrelated to firewalling - I did pretty much all of my testing without. I don't wish to threadjack yet, with something in fact unrelated to Bird, but once your problem is solved I'd like to bring that question up. Feel free to contact me off list in case you feel any need to. -- Met vriendelijke groet, With kind regards, Leo Vandewoestijne <%2A%2A%2A(a)dns.company> <www.dns.company>

1 0

Making a wish ... errr ... *four* wishes! 😳
by Clemens Schrimpe 23 Mar '18

23 Mar '18

Gentlepeople (especially those from the BIRD development team) - being an avid BIRD user for some time now I always kept a small list of „it would be nice, if …“-things for BIRD 1.x, which I kept for myself, as I knew BIRD 2.x was in the works (and thus people were busy already…), but now I get the feeling, that 2.x is slowly stabilizing and I’d like to put them on the table for open discussion: Simple things, a.k.a. low hanging fruits: (Optional) unicast replies to IPv6 RS As one of my many uses for BIRD is in large wireless environments (i.e., IETF meetings) I am very interested in keeping the amount of multicast traffic as low as possible. The standards allow for a router to (immediately) respond with a unicast RA to an RS as an alternative to sending out a multicast RA „some (short, random) time“ after receiving an RS. Many others (Juniper, et.al.) have implemented this and I’d like to see this in BIRD too. The code changes are apparently very simple, so I almost did it myself, but then I didn’t want to interfere with ongoing 2.x developments. (lame excuse, I know …) Context dependent (global) „variables“ for functions/filters I (and probably others too) would really enjoy having more global variables defined for use inside filters & functions, depending on the context within which the respective filter/function is being called. The most obvious ones would be the peer’s (and our own) AS number (in the context of BGP protocols), the filtering direction, the protocol (type and name), the next hop’s address (where applicable), and so on. Yes, I know, most of these could be explicitly given (at least to a function) when calling it as the import/export filter for a protocol with a „where“ clause, but that would defeat the purpose of using templates (which I really do like and use a lot). The general concept of having „globals“ inside functions/filters is already there - just presently only in the context of the route that is being evaluated. I’d like to see this expanded into other contexts as described above. Discuss! 😉😜 More „controversial“ things: Maintain interface addresses (Linux et.al.) It would be nice, if BIRD could be „enhanced“ [sic] to take care of addresses assigned to interfaces, i.e. establish them in the first place and afterwards maintain them, i.e., re-install static, global IPv6 addresses on interfaces, which have suffered a link-state bounce. The latter is particularly interesting, since Linux -by design- removes global IPv6 addresses from an interface during a link-down state transition. Rationale: The various Linux distributions have all sorts of (different and sometimes „funky“) implementations of how to establish addresses to interfaces in the first place and then „deal with them“ during link-state state changes. I would like to have BIRD take care of this relatively simple task as well as the way more complicated task of maintaining millions of routes. If only to have a clean way to define „a router“ within one system (BIRD) as opposed to „get the addresses onto the interfaces with a bunch of iproute2 commands and then start BIRD to take care of the rest“-approach I’ll have to use now. A simple „boot the machine and fire up BIRD - done“ one-stop-shopping solution, if you may. 😉 This is particularly interesting to smaller, dedicated routers, like (former) OpenWRT platforms, Raspberry Pis - or (my application) Ubiquiti routers of all shapes and sizes, where I presently replace the built-in Quagga Version with BIRD. Speaking of Quagga: It takes care of interface addresses too, you know … ;-) An „ipset“ protocol for Linux It would be tremendously helpful to have a protocol, which would maintain given (named) „ipset <http://ipset.netfilter.org/>“ tables on Linux. This would allow for very easy interactions with iptables-based ACLs on Linux platforms. It should/could be treated like a Linux route-table, just with less/different attributes. So it should „sync“, could possibly „import“ items from the ipset, could be made „persistent“, etc. Applications are numerous: From fully automatic BCP38 handling at border interfaces to (again, fully automated) suppression of bogon traffic, to statistical analysis, to … whatever. It would be a single, well defined tool to interact with the whole world of capabilities the iptables/ipsets world offers. If there is any interest in discussing the latter two any further I’d be very happy to spec them out in more detail, of course. Looking forward to hear what people think about these … 😳 Clemens

3 5