- Bird-users - Mailing Lists

"enable route refresh off" question
by Alexander Shikov 08 May '17

08 May '17

Hello! Today I ran in situation where I need to have Route Refresh capability (RFC 2918) to be turned on, while Enhanced Route Refresh capability (RFC 7313) to be turned off. Some customers' routers, when see no "Route Refresh" capability, just drops BGP refresh messages, for example, today's output from customer's router: minotaur@br1-gdr.ki# run show bgp neighbor 193.25.180.255 | match "State|Refresh" Type: External State: Established Flags: <Sync> Last State: OpenConfirm Last Event: RecvKeepAlive Options: <Preference PeerAS Refresh> Peer does not support Refresh capability ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Input messages: Total 7022958 Updates 6696784 Refreshes 0 Octets 467801961 ^^^^^^^^^^^^^^^ I realize I could set "enable route refresh on" to all of customers but I'm afraid to hit a bug described here: http://comments.gmane.org/gmane.network.bird.user/4158 According to docs, "enable route refresh off" disables both of them. So is there a way to work somehow around that ? Thanks in advance! -- Alexander Shikov Technical Staff, Digital Telecom IX Tel.: +380 44 201 14 07 http://dtel-ix.net/

2 1

Re: Bird dying on nl_get_reply
by Vincent Bernat 05 May '17

05 May '17

❦ 2 mai 2017 16:47 +0200, Ondrej Zajicek <santiago(a)crfreenet.org> : >> Or maybe we could just ignore the error and wait for >> the next kernel sync to catch up. Or the 8192 value could be configured >> at build-time. What's the best option? > > Well, you could try increase NL_RX_SIZE to say 64k. But the best solution > would be to have a proper error handling in nl_get_reply(). The main > question is why the buffer was full as it is not the buffer that get > async notifications, it just gets responses. On the hundreds BIRD running on our systems for a few months, it's the first occurrence I had. The server doesn't have that many routes (less than a hundred) either (we have servers with far more routes). I'll wait if it happens again. -- 10.0 times 0.1 is hardly ever 1.0. - The Elements of Programming Style (Kernighan & Plauger)

2 2

Version 2.0.0-pre1
by Ondrej Filip 02 May '17

02 May '17

Dear BIRD users, Let me announce a new addition to 2.0.x branch. Please note, 2.0.x will be an _experimental_ branch. We will not guarantee configuration stability etc. And today we release 2.0.0-pre1. So that's experimental version of experimental branch. Keep this in mind and DO NOT USE IT IN PRODUCTION ENVIRONMENT. On the other hand, testers are more than welcome. Please use it and report (either positive or negative)! We will not provide packages for any distribution. Ondrej Version 2.0.0-pre1 (2017-04-29) o Support for MPLS next hops o VPNv4 and VPNv6 network types o BGP with MPLS labels (RFC 3107) o BGP MPLS/VPN support (RFC 4364) o BGP 6PE - IPv6 NLRI over IPv4 MPLS (RFC 4798) o BGP IPv4 NLRI with an IPv6 Next Hop (RFC 5549) o BGP Confederations (RFC 5065) o BGP: Simplify igp table options o BGP: Allow exchanging LOCAL_PREF with eBGP peers o BGP: Allow to specify interface for regular sessions o Babel support restored o Static: Minor overhaul o Netlink: Default kernel metric changed to 32 o Flowspec: Limit tcp mask length to 12 bits o Update of show route command Notes: Definitions of OSPFv2, OSPFv3 and RIP NG protocols now use keywords 'ospf v2', 'ospf v3' and 'rip ng' instead of 'ospf2', 'ospf3' and 'ripng'. Flows and ROAs no longer use phony next hops, so there is no need to use 'drop' or 'unreachable' in their static route definitions. See doc/bird.conf.example2 for configuration examples.

4 4

Bird dying on nl_get_reply
by Vincent Bernat 02 May '17

02 May '17

Hey! Just got an instance of BIRD dying unexpectedly after displaying the following message: nl_get_reply: No buffer space available It's from netlink.c: int x = recvmsg(nl->fd, &m, 0); if (x < 0) die("nl_get_reply: %m"); Manpage for netlink(7) says an application should expect such a condition: However, reliable transmissions from kernel to user are impossible in any case. The kernel can't send a netlink message if the socket buffer is full: the message will be dropped and the kernel and the user-space process will no longer have the same view of kernel state. It is up to the application to detect when this happens (via the ENOBUFS error returned by recvmsg(2)) and resynchronize. Another possibility would be to use NETLINK_NO_ENOBUFS socket option: This flag can be used by unicast and broadcast listeners to avoid receiving ENOBUFS errors. I don't think using this flag is a good idea. I thought this problem has already been reported recently, but I didn't find the thread back. The receive buffer could be increased dynamically when this happens. Or maybe we could just ignore the error and wait for the next kernel sync to catch up. Or the 8192 value could be configured at build-time. What's the best option? -- 10.0 times 0.1 is hardly ever 1.0. - The Elements of Programming Style (Kernighan & Plauger)

2 1

Re: Version 2.0.0-pre1
by Job Snijders 02 May '17

02 May '17

On Mon, May 01, 2017 at 11:45:58AM +0200, Ondrej Zajicek wrote: > On Sun, Apr 30, 2017 at 10:42:19AM +0200, Job Snijders wrote: > > On Sun, Apr 30, 2017 at 12:46:04AM +0200, Ondrej Filip wrote: > > > Let me announce a new addition to 2.0.x branch. > > > > Congratulations! > > > > Does this 2.0.0-pre1 version follow draft-ietf-grow-bgp-reject ? > > No, like 1.6.x, it has default policy of import all, export none. > > While i see that it is a good idea to have export none as default, i > do not see much advantage to have import none as default. I'd argue this is insecure behaviour and I'm disappointed you do not see an advantage. The default of "import all" fully relies on the EBGP neighbor not announcing crap to you. Relying on others to do the right thing means you are operating from a position of weakness rather then strength. And while today your peering partner may announce a pristine set of routes, tomorrow that might be different. Your EBGP peer could update their configuration, upgrade the software, or swap out their implementation for something with poor defaults. This can lead to surprises (outages) to both parties if they are not incentivized to ensure that both sides of the EBGP session make a conscience decision what to accept and what to reject. You may want to align with feela@ since it appears you have different opinions on the matter. Ondrej Filip told me that 2.0.x would be the right place for a change like this and earlier on committed to support this secure default behaviour. Kind regards, Job

5 4

Filters based on communities from other peer
by Przemyslaw Bromber 02 May '17

02 May '17

Hi Everyone I'm not sure if this is a proper group for asking about an issue I have. I'm new to BIRD and decided to build POC where I have a bunch of servers (SRV1, SRV2, SRVxx) with BIRD and the same /32 prefixes on loopback interfaces. Those prefixes are sent to RT-MAIN. To have only one active server with designated IP prefix I decided to prepend the prefix on other servers n times. This configuration works fine. Failovers work perfectly but with infrastructure I have with a lot of changes I have to use an agent to refresh BIRD configuration files very often. To get rid of this problem I came with an idea to use a management routers connected to all servers sending the same prefixes as on my servers but with communities, e.g. (65000,n) where n means how many times prefix should be prepended on server. Topology would look like this: NET | | RT-MAIN --- SRV2 | | || SRV1 --- RT-MGMT This is an idea but I have a problem with implementation. Is it possible with BIRD to write an export filter which will be able to use communities received prom other peer? For example, if SRV1 receives prefix 10.1.1.1/32 with community (65000,3) form RT-MGMT and this prefix is configured on interface lo then it should be send to RT-MAIN prepended three times

1 0

RE: Bird blackhole, example config
by Krzysztof Puchała 01 May '17

01 May '17

>> On Apr 30, 2017, at 8:47 AM, Krzysztof Puchała TriplmeMedia <kpuchala at triplemedia.org> wrote: >> >> Hi, You once added an example of a blackhole configuration in the birde on the mailing list: >> http://bird.network.cz/pipermail/bird-users/2012-March/007671.html >> I'm trying to implement this in my setup and when I'm overloading the configuration I have an error >> bird> configure check >> Reading configuration from /etc/bird/bird.conf >> /etc/bird/bird.conf, line 49: syntax error >> >> 49 lines of code: >> protocol kernel blackhole { >> >> Maybe you have an idea why it does not work? >> thanks in advance for your answer. > Hi, I'm replying to list for relevant benefit/discussion. > > Wow, my example config is over 5 years old now...something probably changed in syntax requirements over the years, as this is what >we currently have in place (note that a pipe isn't used, as we now leverage "ip rule" to separately include the blacklist table): > > table blackholes; > ... > protocol kernel kblackholes { > table blackholes; > kernel table 10; > scan time 10; > learn; > import all; > export all; > } > ... > filter bgp_out_upstream { > if (proto = "kblackholes" ) then > { > if net.len = 32 then { > bgp_community.add((64665,666)); # Replace 64665,666 with your upstream's community designation...if needed, otherwise >delete this line > printn "Blackhole nulling "; > print net; > accept; > } > } > if net ~ [192.168.0.0/16] then accept; ...replace this with your own netblocks, one netblock per entry > reject; > } > ... > protocol bgp upstream { > ... > export filter bgp_out_upstream; > ... > } > > HTH, > Gregg Berkholtz > Datacenter consulting, hosting & support since 1995 > www.tocici.com [1] | 503-488-5461 | AS14613 Thank you for your answer, almost everything is working. I have another question, my ddos attack detection system has a BGP session with BIRD and if it detects an attack it sends an IP address as prefix / 32. How can I make such a prefix automatically add to the blackhole? Links: ------ [1] http://www.tocici.com

2 1

Re: Bird blackhole, example config
by Gregg Berkholtz 01 May '17

01 May '17

> > On Apr 30, 2017, at 8:47 AM, Krzysztof Puchała TriplmeMedia <kpuchala(a)triplemedia.org> wrote: > > Hi, You once added an example of a blackhole configuration in the birde on the mailing list: > http://bird.network.cz/pipermail/bird-users/2012-March/007671.html > I'm trying to implement this in my setup and when I'm overloading the configuration I have an error > bird> configure check > Reading configuration from /etc/bird/bird.conf > /etc/bird/bird.conf, line 49: syntax error > > 49 lines of code: > protocol kernel blackhole { > > Maybe you have an idea why it does not work? > thanks in advance for your answer. > > > Krzysztof Puchała, członek zarządu > mob. 507364853 / mail. kpuchala(a)triplemedia.org > TripleMedia sp.z.o.o. Biuro: 91 852 21 51 > ul. Dworcowa 9/212 73-110 Stargard > www.TripleMedia.org > > TripleMedia sp.z.o.o. Spółka wpisana do Rejestru Przedsiębiorców prowadzonego przez Sąd Rejonowy Szczecin Centrum w Szczecinie. XIII Wydział Gospodarczy Krajowego Rejestru Sądowego pod nr. KRS: 0000378029. Wysokość kapitału zakładowego: 5000 PLN. Wysokość kapitału wpłaconego: 5000 PLN. > Hi, I’m replying to list for relevant benefit/discussion. Wow, my example config is over 5 years old now…something probably changed in syntax requirements over the years, as this is what we currently have in place (note that a pipe isn’t used, as we now leverage "ip rule" to separately include the blacklist table): table blackholes; … protocol kernel kblackholes { table blackholes; kernel table 10; scan time 10; learn; import all; export all; } ... filter bgp_out_upstream { if (proto = "kblackholes" ) then { if net.len = 32 then { bgp_community.add((64665,666)); # Replace 64665,666 with your upstream's community designation…if needed, otherwise delete this line printn “Blackhole nulling "; print net; accept; } } if net ~ [192.168.0.0/16] then accept; …replace this with your own netblocks, one netblock per entry reject; } ... protocol bgp upstream { ... export filter bgp_out_upstream; ... } HTH, Gregg Berkholtz Datacenter consulting, hosting & support since 1995 www.tocici.com | 503-488-5461 | AS14613

2 1

Socket error: invalid argument
by Dean 28 Apr '17

28 Apr '17

Hi, I'm running some scalability tests for OSPFv3 using Bird in docker containers. I'm getting some error messages in the logs if I run too many instances. 2017-04-20 21:59:57 <ERR> ospf1: Socket error on ln971_if1: Invalid argument I have 1000 nodes connected linearly (each node connects to two neighbors except the two end nodes that connect to only one neighbor). I'm running Bird 1.6.2 with a kernel version 4.9.0. Is this a memory limitation? Kernel bug? I'll attach the first few lines of the log file.

1 0

Simple BGP with two operators, one advertisement and prepending
by Wojciech Bajorek 27 Apr '17

27 Apr '17

Hi, I have a pretty simple BGP configuration with two ISP and one static subnet to advertise. There is also one prepending configured but I'm not sure if it's working. The thing is that for some reason when I connect both ISP peers, traffic to the advertised ISP#2 networks (with shorter path) stops working after a couple of seconds. Tracert shows the last hop as ISP#2 border router. Similar configuration on Juniper router works without any problem, so I'm afraid that there is an error within my Bird config. Can you please help me out? PS. Without prepending situation is exactly the same. OS: Debian 8 Bird: 1.4.5-1+deb8u1 router id 90.90.90.1; protocol kernel { persist; scan time 15; import all; export all; } protocol device { scan time 10; } filter bgp_isp1_out { if net = 90.90.90.0/24 then { accept; } else reject; } filter bgp_isp2_out { if net = 90.90.90.0/24 then { bgp_path.prepend(12345); bgp_path.prepend(12345); accept; } else reject; } protocol bgp bgp_isp1 { import all; export filter bgp_isp1_out; local as 12345; neighbor 2.3.4.5 as 2345; } protocol bgp bgp_isp2 { import all; export filter bgp_isp2_out; local as 12345; neighbor 3.4.5.6 as 3456; } Thank you. Regards, Wojciech Bajorek

3 5