- Bird-users - Mailing Lists

Decode BGP Shutdown Communication messages (RFC 8203)
by Job Snijders 28 Sep '17

28 Sep '17

Hi all, Here is a patch to decode received BGP shutdown communication messages as specified in RFC 8203. In the following example scenario I'm sending a shutdown communication with openbgpd: $ bgpctl neighbor 94.142.241.204 down "TICKET-2331 we are upgrading, back in 30 min" request processed And can subsequently observe the message via logging and via 'show protocols all': job@irime:~/source/bird$ sudo ./bird -s test.sock -d -c bird2.conf bird: Started bird: bgp1: Received: Administrative shutdown: "TICKET-2331 we are upgrading, back in 30 min" job@irime:~/source/bird$ sudo ./birdc -s test.sock show protocols all .... BGP state: Active Neighbor address: 165.254.255.26 Neighbor AS: 15562 Connect delay: 3/5 Last error: Received: Administrative shutdown Message: "TICKET-2331 we are upgrading, back in 30 min" As for the remaining RFC 8203 work: I could use some help with _sending_ bgp shutdown communication messages. It is not clear to me where I should hook the message into the config/cli infrastructure. Ideally you can do things like: $ birdc disable bgp1 "hi, we will upgrade to bird 1.6.4" or via the configuration (also during reconfigure): protocol bgp { disabled "shutdown due to maintenance ticket 2424"; description "My BGP uplink"; local 94.142.241.204 as 65000; neighbor 165.254.255.26 as 15562; } Thoughts? Kind regards, Job --- proto/bgp/bgp.c | 13 ++++++++++ proto/bgp/bgp.h | 2 ++ proto/bgp/packets.c | 73 ++++++++++++++++++++++++++++++++++------------------- 3 files changed, 62 insertions(+), 26 deletions(-) diff --git a/proto/bgp/bgp.c b/proto/bgp/bgp.c index f706e76..551b156 100644 --- a/proto/bgp/bgp.c +++ b/proto/bgp/bgp.c @@ -1487,6 +1487,16 @@ bgp_last_errmsg(struct bgp_proto *p) } static const char * +bgp_last_shutmsg(struct bgp_proto *p) +{ + unsigned len; + char *buf = calloc (128, sizeof (char)); + len = p->last_received_shutmsg[0]; + bsnprintf(buf, len, "%s", p->last_received_shutmsg+1); + return(buf); +} + +static const char * bgp_state_dsc(struct bgp_proto *p) { if (p->p.proto_state == PS_DOWN) @@ -1580,7 +1590,10 @@ bgp_show_proto_info(struct proto *P) { const char *err1 = bgp_err_classes[p->last_error_class]; const char *err2 = bgp_last_errmsg(p); + const char *msg = bgp_last_shutmsg(p); cli_msg(-1006, " Last error: %s%s", err1, err2); + if (p->last_received_shutmsg[0] > 0) + cli_msg(-1006, " Message: \"%s\"", msg); } } diff --git a/proto/bgp/bgp.h b/proto/bgp/bgp.h index e47a0eb..d958716 100644 --- a/proto/bgp/bgp.h +++ b/proto/bgp/bgp.h @@ -157,6 +157,8 @@ struct bgp_proto { u8 last_error_class; /* Error class of last error */ u32 last_error_code; /* Error code of last error. BGP protocol errors are encoded as (bgp_err_code << 16 | bgp_err_subcode) */ + byte last_received_shutmsg[129]; /* RFC 8203 */ + #ifdef IPV6 byte *mp_reach_start, *mp_unreach_start; /* Multiprotocol BGP attribute notes */ unsigned mp_reach_len, mp_unreach_len; diff --git a/proto/bgp/packets.c b/proto/bgp/packets.c index ab87bdc..1a021dd 100644 --- a/proto/bgp/packets.c +++ b/proto/bgp/packets.c @@ -1460,9 +1460,9 @@ static struct { { 5, 3, "Unexpected message in Established state" }, { 6, 0, "Cease" }, /* Subcodes are according to [RFC4486] */ { 6, 1, "Maximum number of prefixes reached" }, - { 6, 2, "Administrative shutdown" }, + { 6, 2, "Administrative shutdown" }, /* RFC 8203 can follow */ { 6, 3, "Peer de-configured" }, - { 6, 4, "Administrative reset" }, + { 6, 4, "Administrative reset" }, /* RFC 8203 can follow */ { 6, 5, "Connection rejected" }, { 6, 6, "Other configuration change" }, { 6, 7, "Connection collision resolution" }, @@ -1497,35 +1497,56 @@ bgp_error_dsc(unsigned code, unsigned subcode) void bgp_log_error(struct bgp_proto *p, u8 class, char *msg, unsigned code, unsigned subcode, byte *data, unsigned len) { - const byte *name; - byte *t, argbuf[36]; - unsigned i; + const byte *name; + byte *t, argbuf[256]; + unsigned i; + unsigned shutdown_comm_length; - /* Don't report Cease messages generated by myself */ - if (code == 6 && class == BE_BGP_TX) - return; + /* Don't report Cease messages generated by myself */ + if (code == 6 && class == BE_BGP_TX) + return; + + name = bgp_error_dsc(code, subcode); + t = argbuf; + memset(p->last_received_shutmsg, 0, 129); // clear old RFC 8203 messages - name = bgp_error_dsc(code, subcode); - t = argbuf; - if (len) + if (len) { - *t++ = ':'; - *t++ = ' '; + *t++ = ':'; + *t++ = ' '; - if ((code == 2) && (subcode == 2) && ((len == 2) || (len == 4))) - { - /* Bad peer AS - we would like to print the AS */ - t += bsprintf(t, "%d", (len == 2) ? get_u16(data) : get_u32(data)); - goto done; - } - if (len > 16) - len = 16; - for (i=0; i<len; i++) - t += bsprintf(t, "%02x", data[i]); + if ((code == 2) && (subcode == 2) && ((len == 2) || (len == 4))) + { + /* Bad peer AS - we would like to print the AS */ + t += bsprintf(t, "%d", (len == 2) ? get_u16(data) : get_u32(data)); + goto done; + } + /* RFC 8203 */ + if ((code == 6) && ((subcode == 2 || subcode == 4)) && (len <= 129)) + { + shutdown_comm_length = data[0]; + if ((shutdown_comm_length <= 128) && (len == shutdown_comm_length + 1)) + { + t += bsprintf(t, "\""); + for (i=1; i<len; i++) + t += bsprintf(t, "%c", data[i]); + t += bsprintf(t, "\""); + memcpy(p->last_received_shutmsg, data, shutdown_comm_length + 1); + goto done; + } + } + else + { + if (len > 16) + len = 16; + for (i=0; i<len; i++) + t += bsprintf(t, "%02x", data[i]); + } } - done: - *t = 0; - log(L_REMOTE "%s: %s: %s%s", p->p.name, msg, name, argbuf); + + done: + *t = 0; + log(L_REMOTE "%s: %s: %s%s", p->p.name, msg, name, argbuf); } static void

4 7

BGP connection between two peers
by Александра Урошевска 27 Sep '17

27 Sep '17

Hi I want to make BGP bettwen two peers. I have made this configuration and I don't know what is wrong. Command show route, shows nothing. How can I check If it works? Do you have some remarks on the configuration files? What do I need to do? Please, any remark is welcomed. RS o------------------------------------------------------------------o IXP1 AS 900 AS 100 Loopback 10.9.9/32 Loopback 10.1.1.1/32 GATEWAY 10.0.0.9/24 GATEWAY 10.0.0.1/24 Two virtual machines RS and IXP1. I have install BIRD 1.6.3 on a Ubuntu 16.04 LTS on a VM Oracle Box and I want to accomplish BGP connection. RS log syslog all; router id 10.9.9.9; protocol device { scan time 10; } protocol kernel { export all; scan time 15; } protocol bgp peer1 { import all; export all; local as 900; neighbor 10.0.0.1 as 100; } IXP1 log syslog all; router id 10.1.1.1; protocol device { scan time 10; } protocol kernel { export all; scan time 15; } protocol bgp peer9 { import all; export all; local as 100; neighbor 10.0.0.9 as 900; } Thank you for your help. Aleksandra

3 3

Re: MTU mismatch with nbr
by Derek Andrew 25 Sep '17

25 Sep '17

I think there may be a bug in our Fortigate. It has the ability to disable the MTU check in IPv4 so I could get IPv4 up, but no joy on IPv6. Anyway, thank you, I have my answer. The way to solve this is to do the correct thing. d On Sun, Sep 24, 2017 at 10:01 AM, Ondrej Zajicek <santiago(a)crfreenet.org> wrote: > On Thu, Sep 21, 2017 at 11:08:47AM -0600, Derek Andrew wrote: > > We are running BIRD and BIRD6 to manage our BFD and OSPF relationship on > > our DNS servers. > > > > We moved the DNS servers onto a Fortigate firewall. I was able to get the > > BIRD daemon running, but BIRD6 is complaining about an MTU mismatch with > > the neighbour. > > > > Is there any way to tell BIRD to ignore the MTU? The OSPF status is > showing > > the neighbour is in the Exchange state. > > No, checking MTU is required by OSPF standard. Why do you have > inconsistent MTU? Also, it should be noticed by both IPv4 and IPv6 > versions. > > -- > Elen sila lumenn' omentielvo > > Ondrej 'Santiago' Zajicek (email: santiago(a)crfreenet.org) > OpenPGP encrypted e-mails preferred (KeyID 0x11DEADC3, wwwkeys.pgp.net) > "To err is human -- to blame it on a computer is even more so." > -- Copyright 2017 Derek Andrew (excluding quotations) +1 306 966 4808 Communication and Network Services Information and Communications Technology Infrastructure Services *University of Saskatchewan*Peterson 120; 54 Innovation Boulevard Saskatoon,Saskatchewan,Canada. S7N 2V3 Timezone GMT-6 Typed but not read.

1 0

MTU mismatch with nbr
by Derek Andrew 24 Sep '17

24 Sep '17

We are running BIRD and BIRD6 to manage our BFD and OSPF relationship on our DNS servers. We moved the DNS servers onto a Fortigate firewall. I was able to get the BIRD daemon running, but BIRD6 is complaining about an MTU mismatch with the neighbour. Is there any way to tell BIRD to ignore the MTU? The OSPF status is showing the neighbour is in the Exchange state. Thanks. d -- Copyright 2017 Derek Andrew (excluding quotations) +1 306 966 4808 Communication and Network Services Information and Communications Technology Infrastructure Services *University of Saskatchewan*Peterson 120; 54 Innovation Boulevard Saskatoon,Saskatchewan,Canada. S7N 2V3 Timezone GMT-6 Typed but not read.

2 1

Static routing
by Александра Урошевска 24 Sep '17

24 Sep '17

Hi all bird users, I have started with fresh configuration of BIRD. And I want to use a default routing table with static routing. Is there any template for configuration of protocol static, protocol kernel, protocol direct? Thank you very much. Kind regards, Aleksandra

2 1

Agregator protocol
by Luk 21 Sep '17

21 Sep '17

Hi, I'm trying to use aggregator protocol (patch from Alexander Chernikov). Can someone explain if I can use this patch to aggregate routes to upstream providers ? My goal is to not use "route x.x.x.x/xy reject;" syntax to announce routes to the internet, but rather use aggregation, which will be used only if there will be one or more more-specific-route within particular prefix from iBGP session. -- Regards, Luk

1 0

TCP md5 authentication failures for almost on all the server's BGP peering
by Harish Shetty 21 Sep '17

21 Sep '17

Hi All I am using bird-1.4.5-1.el6, we are getting alerted for TCP md5 authentication failures for almost on all the server's BGP peering with switches. Error we are seeing as mentioned below. Jul 17 17:15:29 lca1-s1-csw02.nw.linkedin.com 2017 Jul 17 17:15:29 UTC: %NETSTACK-3-TCP_MD5_AUTH_FAILURE: netstack [3617] MD5_DIGEST_INVALID:Dropping packets from src:x.x.x.x.34987,dst:y.y.y.yy.179 Jul 17 07:24:28 lca1-e1-csw01-lo0.nw.linkedin.com 2017 Jul 17 07:24:28 UTC: %NETSTACK-3-TCP_MD5_AUTH_FAILURE: netstack [3640] MD5_DIGEST_INVALID:Dropping packets from src:yyyy.yyyy.yyyy.35088,dst:xxxx.xxxx.xxx.179 lca1-s1-csw01.nw.linkedin.com 2017 Jul 17 05:01:25 UTC: %NETSTACK-3-TCP_MD5_AUTH_FAILURE: netstack [3617] MD5_DIGEST_INVALID:Dropping packets from src:x.x.x.xx.55220,dst:1y.y.y.yy.179 we have raised a Case with Cisco and they are saying possible cause would be " If received packet has got modified in transit, so hash computed at origin is not matching at the destination". Does anyone have seen this type of error before? Is bird causing something to corrupt the packet? Any solution / way to check and confirm everything fine at bird is appreciated. Regards Harish Shetty

3 2

Set interfaces in BIRD
by Александра Урошевска 21 Sep '17

21 Sep '17

Hello everybody, I am a student from Macedonia at FINKI <https://www.finki.ukim.mk/en>. I am 24 years old. I just installed BIRD on a VM and I want to know how to set up interfaces and protocols. I am very new at this, want to try how it works. Can anybody help me? Thank you very much. Best regards, Aleksandra

2 1

Ignoring bogus route 240.0.0.0/4
by Alexander Demenshin 20 Sep '17

20 Sep '17

Hi, Any reason why 240.0.0.0/4+ routes are ignored by bird (1.6.3)? I have tried to blackhole this range in static protocol, but got this message. Attempts to manually add any kernel route from this range were silently ignored. -- With best regards, Alexander.

4 6

[RFC,PATCH 1/2] BGP: Implement iebgp_peer mode.
by Lennert Buytenhek 20 Sep '17

20 Sep '17

Implement an 'internal eBGP' peer mode, where the remote peer uses a different AS number than we do, as if it were an eBGP peer, but we treat the peer as if were an AS-internal peer. This enables implementing a network setup according to the model documented in RFC7938. This makes two changes to the BGP route propagation logic: * When we are propagating a route to or from an internal eBGP peer, we will avoid resetting the MED attribute. * When comparing BGP-learned routes, we will consider routes learned from an 'internal eBGP' peer as iBGP routes as far as the RFC 4271 9.1.2.2. d) check (Prefer external peers) is concerned. --- proto/bgp/attrs.c | 22 ++++++++++++++++------ proto/bgp/bgp.h | 1 + proto/bgp/config.Y | 4 +++- 3 files changed, 20 insertions(+), 7 deletions(-) diff --git a/proto/bgp/attrs.c b/proto/bgp/attrs.c index b9e2490d..478c805c 100644 --- a/proto/bgp/attrs.c +++ b/proto/bgp/attrs.c @@ -1100,15 +1100,21 @@ bgp_update_attrs(struct bgp_proto *p, rte *e, ea_list **attrs, struct linpool *p if (!p->is_internal && !p->rs_client) { + struct bgp_proto *new_bgp = (e->attrs->src->proto->proto == &proto_bgp) ? + (struct bgp_proto *) e->attrs->src->proto : NULL; + bgp_path_prepend(e, attrs, pool, p->local_as); /* The MULTI_EXIT_DISC attribute received from a neighboring AS MUST NOT be * propagated to other neighboring ASes. * Perhaps it would be better to undefine it. */ - a = ea_find(e->attrs->eattrs, EA_CODE(EAP_BGP, BA_MULTI_EXIT_DISC)); - if (a) - bgp_attach_attr(attrs, pool, BA_MULTI_EXIT_DISC, 0); + if (!p->cf->iebgp_peer && (new_bgp == NULL || !new_bgp->cf->iebgp_peer)) + { + a = ea_find(e->attrs->eattrs, EA_CODE(EAP_BGP, BA_MULTI_EXIT_DISC)); + if (a) + bgp_attach_attr(attrs, pool, BA_MULTI_EXIT_DISC, 0); + } } /* iBGP -> keep next_hop, eBGP multi-hop -> use source_addr, @@ -1317,9 +1323,11 @@ bgp_rte_better(rte *new, rte *old) } /* RFC 4271 9.1.2.2. d) Prefer external peers */ - if (new_bgp->is_internal > old_bgp->is_internal) + n = !!(new_bgp->is_internal || new_bgp->cf->iebgp_peer); + o = !!(old_bgp->is_internal || old_bgp->cf->iebgp_peer); + if (n > o) return 0; - if (new_bgp->is_internal < old_bgp->is_internal) + if (n < o) return 1; /* RFC 4271 9.1.2.2. e) Compare IGP metrics */ @@ -1424,7 +1432,9 @@ bgp_rte_mergable(rte *pri, rte *sec) } /* RFC 4271 9.1.2.2. d) Prefer external peers */ - if (pri_bgp->is_internal != sec_bgp->is_internal) + p = !!(pri_bgp->is_internal || pri_bgp->cf->iebgp_peer); + s = !!(sec_bgp->is_internal || sec_bgp->cf->iebgp_peer); + if (p != s) return 0; /* RFC 4271 9.1.2.2. e) Compare IGP metrics */ diff --git a/proto/bgp/bgp.h b/proto/bgp/bgp.h index e47a0eb1..8652fae8 100644 --- a/proto/bgp/bgp.h +++ b/proto/bgp/bgp.h @@ -51,6 +51,7 @@ struct bgp_config { int add_path; /* Use ADD-PATH extension [RFC7911] */ int allow_local_as; /* Allow that number of local ASNs in incoming AS_PATHs */ int allow_local_pref; /* Allow LOCAL_PREF in EBGP sessions */ + int iebgp_peer; /* Peer has different AS but should be treated as internal peer */ int gr_mode; /* Graceful restart mode (BGP_GR_*) */ int setkey; /* Set MD5 password to system SA/SP database */ unsigned gr_time; /* Graceful restart timeout */ diff --git a/proto/bgp/config.Y b/proto/bgp/config.Y index 55c602f1..f01a6fb6 100644 --- a/proto/bgp/config.Y +++ b/proto/bgp/config.Y @@ -27,7 +27,8 @@ CF_KEYWORDS(BGP, LOCAL, NEIGHBOR, AS, HOLD, TIME, CONNECT, RETRY, INTERPRET, COMMUNITIES, BGP_ORIGINATOR_ID, BGP_CLUSTER_LIST, IGP, TABLE, GATEWAY, DIRECT, RECURSIVE, MED, TTL, SECURITY, DETERMINISTIC, SECONDARY, ALLOW, BFD, ADD, PATHS, RX, TX, GRACEFUL, RESTART, AWARE, - CHECK, LINK, PORT, EXTENDED, MESSAGES, SETKEY, BGP_LARGE_COMMUNITY) + CHECK, LINK, PORT, EXTENDED, MESSAGES, SETKEY, BGP_LARGE_COMMUNITY, + IEBGP_PEER) CF_GRAMMAR @@ -129,6 +130,7 @@ bgp_proto: | bgp_proto ALLOW BGP_LOCAL_PREF bool ';' { BGP_CFG->allow_local_pref = $4; } | bgp_proto ALLOW LOCAL AS ';' { BGP_CFG->allow_local_as = -1; } | bgp_proto ALLOW LOCAL AS expr ';' { BGP_CFG->allow_local_as = $5; } + | bgp_proto IEBGP_PEER bool ';' { BGP_CFG->iebgp_peer = $3; } | bgp_proto GRACEFUL RESTART bool ';' { BGP_CFG->gr_mode = $4; } | bgp_proto GRACEFUL RESTART AWARE ';' { BGP_CFG->gr_mode = BGP_GR_AWARE; } | bgp_proto GRACEFUL RESTART TIME expr ';' { BGP_CFG->gr_time = $5; } -- 2.13.4

3 3