- Bird-users - Mailing Lists

bgp announce default route to lower router, what is the bird version of default-originate / default-information orginate?
by Gelderman, Richard 20 Oct '17

20 Oct '17

How can I announce a default route to a lower router who does not need a full table. What is de Bird equivalent of "default-orginitate" or "default-information originate". Currently I use a filter with a static blackhole route: protocol static { route 0.0.0.0/0 blackhole; } filter senddefault { if net = 0.0.0.0/0 then accept; reject; } template bgp local_as_ibgp_lowrouter { # export filter senddefault; }

3 2

Issues in Babel
by Ondrej Zajicek 19 Oct '17

19 Oct '17

Hi Toke (and others) I updated Babel to use microsecond timers [1] and during testing i noticed several unrelated issues. 1) Hello expiration was not properly implemented, as i understand RFC, it should reset the timer based on last packet hello interval and time-out repeatedly until hello map is zero. Fixed in [2]. 2) In some setups unicast seqno requests were sent repeatedly and seqno was increased indefinitely due to last case in babel_handle_update(), when the RFC specifies it should be done only if unfeasible route would otherwise become best. Fixed in [3], by this condition handling all unicast seqno requests: if (!feasible && (metric != BABEL_INFINITY) && (!best || (r == best) || (metric < best->metric))) babel_unicast_seqno_request(e, s, nbr); It also changes the behavior by sending seqno request when receiving infeasible update if there is no previous route from that neighbor. 3) Seems like the fix of hello expiration caused that when neighbor disappears, it is no longer removed timely and routes have to wait for route timeout, which is about a minute for 4 s hello interval. It seems that by RFC, we should recompute route metrics whanever rxcost reported by IHU is changed, so IHU expiration should be enough to make all related routes unreachable. Apparently, this is not done in BIRD. 4) Seems like we do not trigger updates when a route update with just increased seqno due to forwarded unicast request is received. That also slows convergence. IMHO we should do in babel_handle_update() something like: if (route_is_selected() && matching_entry_in_seqno_request_cache()) babel_trigger_update() Do you think that my interpretation of these issues and the fixes are correct? [1] https://gitlab.labs.nic.cz/labs/bird/commit/8a76785a6fb23a64fcc93f998336794… [2] https://gitlab.labs.nic.cz/labs/bird/commit/c7fa4efd701716a9c40620f2e3e8f06… [3] https://gitlab.labs.nic.cz/labs/bird/commit/c54526afeb4187d55993c3ab777fcfe… -- Elen sila lumenn' omentielvo Ondrej 'Santiago' Zajicek (email: santiago(a)crfreenet.org) OpenPGP encrypted e-mails preferred (KeyID 0x11DEADC3, wwwkeys.pgp.net) "To err is human -- to blame it on a computer is even more so."

2 3

Limit on how many neighbors
by Magnus Löfqvist 15 Oct '17

15 Oct '17

Hi, We are running Bird with OSPF between embedded routers (openwrt) (mobile routers). The routers are connected to our main server with openvpn, and we are using bird ontop on openvpn to deliver routes to the end routers. This have worked quite well, but today we notice some glitches. We had some routers that did not finish election (ie, stand in init instead of being full). When we count, there are exactly 100 devices that are in "full", and 3 in init. Are there any limit on how many neighbors/routers? Med vänlig hälsning / Best regards Magnus Löfqvist

4 6

OSPF routes not filtered
by Войнович Андрей Александрович 10 Oct '17

10 Oct '17

3 6

import where IPv6 BGP
by Robert Blayzor 09 Oct '17

09 Oct '17

When running IPv6 daemon, I have a BGP peer: protocol bgp bogon_1 from BH_SERVER { import where net.len < 33; import filter BLACKHOLE_IN; import limit 100000 action warn; } The filter is simply an “accept;”. The problem I’m seeing however is that I’m getting prefixes imported that are longer than 32. In fact, it looks like “import where” is completely ignored in IPv6 (at least for net.len?). If I put “import where net.len = 0” I still see all the longer prefixes getting imported. If I go into the filter and add a “if net.len < 33 then reject;” then I see it work. Is this the expected behavior, a bug or am I missing something? -- inoc.net!rblayzor XMPP: rblayzor.AT.inoc.net PGP: https://inoc.net/~rblayzor/

2 1

Graceful BGP session shutdown
by Johannes Moos 09 Oct '17

09 Oct '17

Hi BIRD team and fellow BIRD users, are there any plans to implement Graceful BGP session shutdown (https://tools.ietf.org/html/draft-ietf-grow-bgp-gshut) in future releases? Ingress is pretty easy and only needs to be implemented once by the user: Check for BGP Community 65535:0 and set local pref to 0 on match Egress is also simple, but more effortful. It also needs a config change in every maintenance window: - Modify egress filter to add 65535:0 - Reload config and egress filter BIRD could automate this by offering a command like "birdc disable bgp1 graceful 15" which would send 65535:0 immediately and then disable the session after a configurable time, in this case 15 minutes. What do you think? Regards, Johannes -- Johannes Moos Systems Engineer DE-CIX Management GmbH | Lindleystr. 12 | 60314 Frankfurt am Main | Germany | www.de-cix.net Phone +49 69 1730902 45 | Mobile +49 160 97997723 | Fax +49 69 4056 2716 | johannes.moos(a)de-cix.net Geschaeftsfuehrer Harald A. Summa | Registergericht AG Koeln HRB 51135

1 0

Bird for RTBH trigger
by Robert Blayzor 04 Oct '17

04 Oct '17

I am attempting to setup Bird on a VM to act as a RTBH trigger… Bird 1.6.0 on FreeBSD 11.1 Is there a alternative way to advertise null routes from Bird rather than using a kernel table? I have tried using static routes, but because assuming the next hop is not reachable, the routes do not export. I guess I’m looking for a way you would normally do something like a null route in Cisco and get that route into BGP. Using the kernel table at the moment is not desirable… Also other than other routing protocol peering sessions or the kernel, is there another way to get a static null route into Bird? protocol static trig1 { route 192.0.2.0/24 blackhole; route 192.168.255.254/32 via 192.0.2.1; import none; export all; } bird> show static 192.0.2.0/24 blackhole 192.168.255.254/32 via 192.0.2.1 (dormant) name proto table state since info trig1 Static master up 00:02:27 Preference: 200 Input filter: REJECT Output filter: ACCEPT Routes: 0 imported, 0 exported, 0 preferred Route change stats: received rejected filtered ignored accepted Import updates: 1 0 1 0 0 Import withdraws: 0 0 --- 1 0 Export updates: 0 0 0 --- 0 Export withdraws: 0 --- --- — 0 -- inoc.net!rblayzor XMPP: rblayzor.AT.inoc.net PGP: https://inoc.net/~rblayzor/

3 6

Decode BGP Shutdown Communication messages (RFC 8203)
by Job Snijders 28 Sep '17

28 Sep '17

Hi all, Here is a patch to decode received BGP shutdown communication messages as specified in RFC 8203. In the following example scenario I'm sending a shutdown communication with openbgpd: $ bgpctl neighbor 94.142.241.204 down "TICKET-2331 we are upgrading, back in 30 min" request processed And can subsequently observe the message via logging and via 'show protocols all': job@irime:~/source/bird$ sudo ./bird -s test.sock -d -c bird2.conf bird: Started bird: bgp1: Received: Administrative shutdown: "TICKET-2331 we are upgrading, back in 30 min" job@irime:~/source/bird$ sudo ./birdc -s test.sock show protocols all .... BGP state: Active Neighbor address: 165.254.255.26 Neighbor AS: 15562 Connect delay: 3/5 Last error: Received: Administrative shutdown Message: "TICKET-2331 we are upgrading, back in 30 min" As for the remaining RFC 8203 work: I could use some help with _sending_ bgp shutdown communication messages. It is not clear to me where I should hook the message into the config/cli infrastructure. Ideally you can do things like: $ birdc disable bgp1 "hi, we will upgrade to bird 1.6.4" or via the configuration (also during reconfigure): protocol bgp { disabled "shutdown due to maintenance ticket 2424"; description "My BGP uplink"; local 94.142.241.204 as 65000; neighbor 165.254.255.26 as 15562; } Thoughts? Kind regards, Job --- proto/bgp/bgp.c | 13 ++++++++++ proto/bgp/bgp.h | 2 ++ proto/bgp/packets.c | 73 ++++++++++++++++++++++++++++++++++------------------- 3 files changed, 62 insertions(+), 26 deletions(-) diff --git a/proto/bgp/bgp.c b/proto/bgp/bgp.c index f706e76..551b156 100644 --- a/proto/bgp/bgp.c +++ b/proto/bgp/bgp.c @@ -1487,6 +1487,16 @@ bgp_last_errmsg(struct bgp_proto *p) } static const char * +bgp_last_shutmsg(struct bgp_proto *p) +{ + unsigned len; + char *buf = calloc (128, sizeof (char)); + len = p->last_received_shutmsg[0]; + bsnprintf(buf, len, "%s", p->last_received_shutmsg+1); + return(buf); +} + +static const char * bgp_state_dsc(struct bgp_proto *p) { if (p->p.proto_state == PS_DOWN) @@ -1580,7 +1590,10 @@ bgp_show_proto_info(struct proto *P) { const char *err1 = bgp_err_classes[p->last_error_class]; const char *err2 = bgp_last_errmsg(p); + const char *msg = bgp_last_shutmsg(p); cli_msg(-1006, " Last error: %s%s", err1, err2); + if (p->last_received_shutmsg[0] > 0) + cli_msg(-1006, " Message: \"%s\"", msg); } } diff --git a/proto/bgp/bgp.h b/proto/bgp/bgp.h index e47a0eb..d958716 100644 --- a/proto/bgp/bgp.h +++ b/proto/bgp/bgp.h @@ -157,6 +157,8 @@ struct bgp_proto { u8 last_error_class; /* Error class of last error */ u32 last_error_code; /* Error code of last error. BGP protocol errors are encoded as (bgp_err_code << 16 | bgp_err_subcode) */ + byte last_received_shutmsg[129]; /* RFC 8203 */ + #ifdef IPV6 byte *mp_reach_start, *mp_unreach_start; /* Multiprotocol BGP attribute notes */ unsigned mp_reach_len, mp_unreach_len; diff --git a/proto/bgp/packets.c b/proto/bgp/packets.c index ab87bdc..1a021dd 100644 --- a/proto/bgp/packets.c +++ b/proto/bgp/packets.c @@ -1460,9 +1460,9 @@ static struct { { 5, 3, "Unexpected message in Established state" }, { 6, 0, "Cease" }, /* Subcodes are according to [RFC4486] */ { 6, 1, "Maximum number of prefixes reached" }, - { 6, 2, "Administrative shutdown" }, + { 6, 2, "Administrative shutdown" }, /* RFC 8203 can follow */ { 6, 3, "Peer de-configured" }, - { 6, 4, "Administrative reset" }, + { 6, 4, "Administrative reset" }, /* RFC 8203 can follow */ { 6, 5, "Connection rejected" }, { 6, 6, "Other configuration change" }, { 6, 7, "Connection collision resolution" }, @@ -1497,35 +1497,56 @@ bgp_error_dsc(unsigned code, unsigned subcode) void bgp_log_error(struct bgp_proto *p, u8 class, char *msg, unsigned code, unsigned subcode, byte *data, unsigned len) { - const byte *name; - byte *t, argbuf[36]; - unsigned i; + const byte *name; + byte *t, argbuf[256]; + unsigned i; + unsigned shutdown_comm_length; - /* Don't report Cease messages generated by myself */ - if (code == 6 && class == BE_BGP_TX) - return; + /* Don't report Cease messages generated by myself */ + if (code == 6 && class == BE_BGP_TX) + return; + + name = bgp_error_dsc(code, subcode); + t = argbuf; + memset(p->last_received_shutmsg, 0, 129); // clear old RFC 8203 messages - name = bgp_error_dsc(code, subcode); - t = argbuf; - if (len) + if (len) { - *t++ = ':'; - *t++ = ' '; + *t++ = ':'; + *t++ = ' '; - if ((code == 2) && (subcode == 2) && ((len == 2) || (len == 4))) - { - /* Bad peer AS - we would like to print the AS */ - t += bsprintf(t, "%d", (len == 2) ? get_u16(data) : get_u32(data)); - goto done; - } - if (len > 16) - len = 16; - for (i=0; i<len; i++) - t += bsprintf(t, "%02x", data[i]); + if ((code == 2) && (subcode == 2) && ((len == 2) || (len == 4))) + { + /* Bad peer AS - we would like to print the AS */ + t += bsprintf(t, "%d", (len == 2) ? get_u16(data) : get_u32(data)); + goto done; + } + /* RFC 8203 */ + if ((code == 6) && ((subcode == 2 || subcode == 4)) && (len <= 129)) + { + shutdown_comm_length = data[0]; + if ((shutdown_comm_length <= 128) && (len == shutdown_comm_length + 1)) + { + t += bsprintf(t, "\""); + for (i=1; i<len; i++) + t += bsprintf(t, "%c", data[i]); + t += bsprintf(t, "\""); + memcpy(p->last_received_shutmsg, data, shutdown_comm_length + 1); + goto done; + } + } + else + { + if (len > 16) + len = 16; + for (i=0; i<len; i++) + t += bsprintf(t, "%02x", data[i]); + } } - done: - *t = 0; - log(L_REMOTE "%s: %s: %s%s", p->p.name, msg, name, argbuf); + + done: + *t = 0; + log(L_REMOTE "%s: %s: %s%s", p->p.name, msg, name, argbuf); } static void

4 7

BGP connection between two peers
by Александра Урошевска 27 Sep '17

27 Sep '17

Hi I want to make BGP bettwen two peers. I have made this configuration and I don't know what is wrong. Command show route, shows nothing. How can I check If it works? Do you have some remarks on the configuration files? What do I need to do? Please, any remark is welcomed. RS o------------------------------------------------------------------o IXP1 AS 900 AS 100 Loopback 10.9.9/32 Loopback 10.1.1.1/32 GATEWAY 10.0.0.9/24 GATEWAY 10.0.0.1/24 Two virtual machines RS and IXP1. I have install BIRD 1.6.3 on a Ubuntu 16.04 LTS on a VM Oracle Box and I want to accomplish BGP connection. RS log syslog all; router id 10.9.9.9; protocol device { scan time 10; } protocol kernel { export all; scan time 15; } protocol bgp peer1 { import all; export all; local as 900; neighbor 10.0.0.1 as 100; } IXP1 log syslog all; router id 10.1.1.1; protocol device { scan time 10; } protocol kernel { export all; scan time 15; } protocol bgp peer9 { import all; export all; local as 100; neighbor 10.0.0.9 as 900; } Thank you for your help. Aleksandra

3 3

Re: MTU mismatch with nbr
by Derek Andrew 25 Sep '17

25 Sep '17

I think there may be a bug in our Fortigate. It has the ability to disable the MTU check in IPv4 so I could get IPv4 up, but no joy on IPv6. Anyway, thank you, I have my answer. The way to solve this is to do the correct thing. d On Sun, Sep 24, 2017 at 10:01 AM, Ondrej Zajicek <santiago(a)crfreenet.org> wrote: > On Thu, Sep 21, 2017 at 11:08:47AM -0600, Derek Andrew wrote: > > We are running BIRD and BIRD6 to manage our BFD and OSPF relationship on > > our DNS servers. > > > > We moved the DNS servers onto a Fortigate firewall. I was able to get the > > BIRD daemon running, but BIRD6 is complaining about an MTU mismatch with > > the neighbour. > > > > Is there any way to tell BIRD to ignore the MTU? The OSPF status is > showing > > the neighbour is in the Exchange state. > > No, checking MTU is required by OSPF standard. Why do you have > inconsistent MTU? Also, it should be noticed by both IPv4 and IPv6 > versions. > > -- > Elen sila lumenn' omentielvo > > Ondrej 'Santiago' Zajicek (email: santiago(a)crfreenet.org) > OpenPGP encrypted e-mails preferred (KeyID 0x11DEADC3, wwwkeys.pgp.net) > "To err is human -- to blame it on a computer is even more so." > -- Copyright 2017 Derek Andrew (excluding quotations) +1 306 966 4808 Communication and Network Services Information and Communications Technology Infrastructure Services *University of Saskatchewan*Peterson 120; 54 Innovation Boulevard Saskatoon,Saskatchewan,Canada. S7N 2V3 Timezone GMT-6 Typed but not read.

1 0