- Bird-users - Mailing Lists

Version 2.0.0pre0
by Ondrej Filip 23 Feb '17

23 Feb '17

Dear BIRD users, it took us a very long time, but we are moving towards 2.0.x branch. Main feature of this branch is IPv4 and IPv6 integration. Please note, 2.0.x will be an _experimental_ branch. We will not guarantee configuration stability etc. And today we release 2.0.0-pre0. So that's experimental version of experimental branch. Keep this in mind and DO NOT USE IT IN PRODUCTION ENVIRONMENT. On the other hand, testers are more than welcome. Please use it and report (either positive or negative)! We will not provide packages for any distribution. Version 2.0.0-pre0 (2016-12-07) o Integrated IPv4 + IPv6 design o Major BGP protocol redesign o BGP multicast support (SAFI 2) o BGP flowspec support (RFC 5575) o New RPKI-Router protocol o New build system o Unit tests Notes: Protocols and tables are now connected using explicit channels, most related protocol options (table, import, export, ...) are now channel options. See doc/bird.conf.example2 for configuration examples. Ondrej

8 11

[PATCH,RFC] Allow exchanging LOCAL_PREF with eBGP peers.
by Lennert Buytenhek 23 Feb '17

23 Feb '17

Hello! I've attached a patch that allows (selectively) exchanging LOCAL_PREF with eBGP peers. The BGP RFC (RFC4271) says that you shouldn't send LOCAL_PREF to eBGP peers, but most modern BGP implementations have an override to allow doing this anyway, and it is very useful in some scenarios, for example if you have a network topology a la RFC7938. This patch enables this functionality by the 'ebgp localpref' clause in a bgp protocol statement, for example: protocol bgp mypeer { [...]; ebgp localpref rx; } This option works like 'add paths', in that the possible arguments are "rx" or "tx" or a bool (where "yes" means both rx and tx). RFC4271 also specifies that if LOCAL_PREF is received from an eBGP speaker, it should be ignored (and you should not reply with a NOTIFICATION), so it should be safe to send LOCAL_PREF to eBGP peers that are not expecting it, and it's safe to send it to another bird -- but there are various reasons why you might not want to do that, of course. I'm not submitting this patch for inclusion yet at this point (which is why there is no documentation), but this kind of functionality is useful for us, and I'd like to hear from people whether they think this could be useful for them, too. And of course, there will have to be a lot of bikeshedding about the name of the config option! :-) Cheers, Lennert Signed-off-by: Lennert Buytenhek <lbuytenhek(a)fastly.com> diff --git a/proto/bgp/attrs.c b/proto/bgp/attrs.c index 9d23374..3730021 100644 --- a/proto/bgp/attrs.c +++ b/proto/bgp/attrs.c @@ -307,7 +307,7 @@ static struct attr_desc bgp_attr_table[] = { bgp_check_next_hop, bgp_format_next_hop }, { "med", 4, BAF_OPTIONAL, EAF_TYPE_INT, 1, /* BA_MULTI_EXIT_DISC */ NULL, NULL }, - { "local_pref", 4, BAF_TRANSITIVE, EAF_TYPE_INT, 0, /* BA_LOCAL_PREF */ + { "local_pref", 4, BAF_TRANSITIVE, EAF_TYPE_INT, 1, /* BA_LOCAL_PREF */ NULL, NULL }, { "atomic_aggr", 0, BAF_TRANSITIVE, EAF_TYPE_OPAQUE, 1, /* BA_ATOMIC_AGGR */ NULL, NULL }, @@ -822,8 +822,13 @@ bgp_get_bucket(struct bgp_proto *p, net *n, ea_list *attrs, int originate) code = EA_ID(a->id); if (ATTR_KNOWN(code)) { - if (!bgp_attr_table[code].allow_in_ebgp && !p->is_internal) - continue; + if (!p->is_internal) + { + if (!bgp_attr_table[code].allow_in_ebgp) + continue; + if (code == BA_LOCAL_PREF && !(p->cf->ebgp_local_pref & EBGP_LOCAL_PREF_TX)) + continue; + } /* The flags might have been zero if the attr was added by filters */ a->flags = (a->flags & BAF_PARTIAL) | bgp_attr_table[code].expected_flags; if (code < 32) @@ -1777,8 +1782,13 @@ bgp_decode_attrs(struct bgp_conn *conn, byte *attr, uint len, struct linpool *po { errcode = 5; goto err; } if ((desc->expected_flags ^ flags) & (BAF_OPTIONAL | BAF_TRANSITIVE)) { errcode = 4; goto err; } - if (!desc->allow_in_ebgp && !bgp->is_internal) - continue; + if (!bgp->is_internal) + { + if (!desc->allow_in_ebgp) + continue; + if (code == BA_LOCAL_PREF && !(bgp->cf->ebgp_local_pref & EBGP_LOCAL_PREF_RX)) + continue; + } if (desc->validate) { errcode = desc->validate(bgp, z, l); diff --git a/proto/bgp/bgp.c b/proto/bgp/bgp.c index 0f1c944..fae4be5 100644 --- a/proto/bgp/bgp.c +++ b/proto/bgp/bgp.c @@ -1556,7 +1556,7 @@ bgp_show_proto_info(struct proto *P) (c->peer_add_path & ADD_PATH_RX) ? " add-path-rx" : "", (c->peer_add_path & ADD_PATH_TX) ? " add-path-tx" : "", c->peer_ext_messages_support ? " ext-messages" : ""); - cli_msg(-1006, " Session: %s%s%s%s%s%s%s%s", + cli_msg(-1006, " Session: %s%s%s%s%s%s%s%s%s%s", p->is_internal ? "internal" : "external", p->cf->multihop ? " multihop" : "", p->rr_client ? " route-reflector" : "", @@ -1564,7 +1564,9 @@ bgp_show_proto_info(struct proto *P) p->as4_session ? " AS4" : "", p->add_path_rx ? " add-path-rx" : "", p->add_path_tx ? " add-path-tx" : "", - p->ext_messages ? " ext-messages" : ""); + p->ext_messages ? " ext-messages" : "", + (p->cf->ebgp_local_pref & EBGP_LOCAL_PREF_RX) ? " ebgp-localpref-rx" : "", + (p->cf->ebgp_local_pref & EBGP_LOCAL_PREF_TX) ? " ebgp-localpref-tx" : ""); cli_msg(-1006, " Source address: %I", p->source_addr); if (P->cf->in_limit) cli_msg(-1006, " Route limit: %d/%d", diff --git a/proto/bgp/bgp.h b/proto/bgp/bgp.h index d028bef..6e68d35 100644 --- a/proto/bgp/bgp.h +++ b/proto/bgp/bgp.h @@ -49,6 +49,7 @@ struct bgp_config { int interpret_communities; /* Hardwired handling of well-known communities */ int secondary; /* Accept also non-best routes (i.e. RA_ACCEPTED) */ int add_path; /* Use ADD-PATH extension [draft] */ + int ebgp_local_pref; /* Exchange LOCAL_PREF with eBGP peers */ int allow_local_as; /* Allow that number of local ASNs in incoming AS_PATHs */ int gr_mode; /* Graceful restart mode (BGP_GR_*) */ int setkey; /* Set MD5 password to system SA/SP database */ @@ -79,6 +80,9 @@ struct bgp_config { #define ADD_PATH_TX 2 #define ADD_PATH_FULL 3 +#define EBGP_LOCAL_PREF_RX 1 +#define EBGP_LOCAL_PREF_TX 2 + #define BGP_GR_ABLE 1 #define BGP_GR_AWARE 2 diff --git a/proto/bgp/config.Y b/proto/bgp/config.Y index 32ae88a..5db122d 100644 --- a/proto/bgp/config.Y +++ b/proto/bgp/config.Y @@ -27,7 +27,8 @@ CF_KEYWORDS(BGP, LOCAL, NEIGHBOR, AS, HOLD, TIME, CONNECT, RETRY, INTERPRET, COMMUNITIES, BGP_ORIGINATOR_ID, BGP_CLUSTER_LIST, IGP, TABLE, GATEWAY, DIRECT, RECURSIVE, MED, TTL, SECURITY, DETERMINISTIC, SECONDARY, ALLOW, BFD, ADD, PATHS, RX, TX, GRACEFUL, RESTART, AWARE, - CHECK, LINK, PORT, EXTENDED, MESSAGES, SETKEY, BGP_LARGE_COMMUNITY) + CHECK, LINK, PORT, EXTENDED, MESSAGES, SETKEY, BGP_LARGE_COMMUNITY, + EBGP, LOCALPREF) CF_GRAMMAR @@ -126,6 +127,9 @@ bgp_proto: | bgp_proto ADD PATHS RX ';' { BGP_CFG->add_path = ADD_PATH_RX; } | bgp_proto ADD PATHS TX ';' { BGP_CFG->add_path = ADD_PATH_TX; } | bgp_proto ADD PATHS bool ';' { BGP_CFG->add_path = $4 ? ADD_PATH_FULL : 0; } + | bgp_proto EBGP LOCALPREF RX ';' { BGP_CFG->ebgp_local_pref = EBGP_LOCAL_PREF_RX; } + | bgp_proto EBGP LOCALPREF TX ';' { BGP_CFG->ebgp_local_pref = EBGP_LOCAL_PREF_TX; } + | bgp_proto EBGP LOCALPREF bool ';' { BGP_CFG->ebgp_local_pref = $4 ? (EBGP_LOCAL_PREF_RX | EBGP_LOCAL_PREF_TX) : 0; } | bgp_proto ALLOW LOCAL AS ';' { BGP_CFG->allow_local_as = -1; } | bgp_proto ALLOW LOCAL AS expr ';' { BGP_CFG->allow_local_as = $5; } | bgp_proto GRACEFUL RESTART bool ';' { BGP_CFG->gr_mode = $4; }

5 12

Fwd: Bird / OpenBSD / BGP MD5 authentication walkthrough
by Darren Marshall 23 Feb '17

23 Feb '17

I'm googling like crazy and can't seem to find an example of how to configure MD5 authentication between BGP peers using Bird running on OpenBSD, does someone out there have a guide for this? The Bird config is straightforward but I'm missing the 'glue' at the OS level! Also does anyone know if the stock Generic kernel supports TCP MD5 signatures out of the box (OpenBSD 6.0) , looking at the kernel config file it would appear it has the option compiled in , anyone know how to check?. Many thanks in advance! daz

2 5

kernel dropped netlink messages
by Erwin Lubbers 23 Feb '17

23 Feb '17

Hi, Since we upgraded our Bird installation to 1.6.3 (from 1.6.0), we do get some "bird: Kernel dropped some netlink messages, will resync on next scan." messages in our syslogs. What does this message mean and how can we prevent it? Regards, Erwin

1 0

Re: Bird / OpenBSD / BGP MD5 authentication walkthrough
by Darren Marshall 21 Feb '17

21 Feb '17

Thanks Pawel, Yeah I have this working on FreeBSD and Quagga but Bird / OpenBSD I am struggling with :( . Anyone out there got a working example of the steps required from MD5 authentication for BGP neighbours using Bird on OpenBSD?. Thanks daz On 21 February 2017 at 17:43, Paweł Nastachowski < Pawel.Nastachowski(a)eu.equinix.com> wrote: > Hi, > > sorry my fault, I use setkey on freebsd. Maybe You can try > http://man.openbsd.org/ipsec.conf.5 > > Wiadomość napisana przez Darren Marshall <darren(a)tuff.org.uk> w dniu > 21.02.2017, o godz. 18:35: > > Hi Pawel, > > Thanks for this , much appreciated , do you know what package set key is > part of , I don't have it on my system at the moment! > > Cheers daz > > On 21 February 2017 at 17:00, Paweł Nastachowski <Pawel.Nastachowski@eu. > equinix.com> wrote: > >> >> Wiadomość napisana przez Darren Marshall <darren(a)tuff.org.uk> w dniu >> 21.02.2017, o godz. 17:01: >> >> >> I'm googling like crazy and can't seem to find an example of how to >> configure MD5 authentication between BGP peers using Bird running on >> OpenBSD, does someone out there have a guide for this? The Bird config is >> straightforward but I'm missing the 'glue' at the OS level! Also does >> anyone know if the stock Generic kernel supports TCP MD5 signatures out of >> the box (OpenBSD 6.0) , looking at the kernel config file it would appear >> it has the option compiled in , anyone know how to check?. >> >> You can use setkey. For example: >> >> cat bgp-md5.conf >> flush; >> add 195.182.218.100 195.182.218.39 tcp 0x1000 -A tcp-md5 „password” >> >> and >> >> setkey -f bgp-mf5.conf >> >> >> — >> Paweł Nastachowski >> Technical Manager >> >> EQUINIX | Al. Jerozolimskie 65/79 Warsaw 00-697 Warszawa, Poland >> E pawel.nastachowski(a)eu.equinix.com | T +48 22 427 39 98 | M +48 667 383 >> 108 <+48%20667%20383%20108> >> >> HOW ARE WE DOING? <http://www.customersat3.com/csc/equinix> Please >> click here to Tell Equinix - We're Listening >> >> Equinix.com <http://www.equinix.com/> | Twitter >> <https://twitter.com/equinix> | LinkedIn >> <http://www.linkedin.com/company/equinix> | Facebook >> <http://www.facebook.com/Equinix> | YouTube >> <http://www.youtube.com/user/equinixvideos> >> Equinix (Poland) Sp. z o.o. jest wpisana do Rejestru Przedsiębiorców >> Krajowego Rejestru Sądowego prowadzonego przez Sąd Rejonowy dla m. st. >> Warszawy w Warszawie, XII Wydział Gospodarczy, pod numerem KRS 0000295130, >> NIP 7010109699, REGON 141274596. Kapitał zakładowy spółki wynosi 530.000zł. >> Equinix (Poland) Sp. z o.o. is entered into the National Court Register >> maintained by the District Court for the Capital City of Warsaw, XII >> Economic Department in Warsaw, under KRS number 0000295130, VAT-ID >> PL7010109699, REGON 141274596.The share capital is PLN 530,000 >> >> >> >> >> > > — > Paweł Nastachowski > Technical Manager > > EQUINIX | Al. Jerozolimskie 65/79 Warsaw 00-697 Warszawa, Poland > E pawel.nastachowski(a)eu.equinix.com | T +48 22 427 39 98 | M +48 667 383 > 108 <+48%20667%20383%20108> > > HOW ARE WE DOING? <http://www.customersat3.com/csc/equinix> Please click > here to Tell Equinix - We're Listening > > Equinix.com <http://www.equinix.com/> | Twitter > <https://twitter.com/equinix> | LinkedIn > <http://www.linkedin.com/company/equinix> | Facebook > <http://www.facebook.com/Equinix> | YouTube > <http://www.youtube.com/user/equinixvideos> > Equinix (Poland) Sp. z o.o. jest wpisana do Rejestru Przedsiębiorców > Krajowego Rejestru Sądowego prowadzonego przez Sąd Rejonowy dla m. st. > Warszawy w Warszawie, XII Wydział Gospodarczy, pod numerem KRS 0000295130, > NIP 7010109699, REGON 141274596. Kapitał zakładowy spółki wynosi 530.000zł. > Equinix (Poland) Sp. z o.o. is entered into the National Court Register > maintained by the District Court for the Capital City of Warsaw, XII > Economic Department in Warsaw, under KRS number 0000295130, VAT-ID > PL7010109699, REGON 141274596.The share capital is PLN 530,000 > > > > >

1 0

FreeBSD ECMP Bird OSPF
by Cassiano Peixoto 21 Feb '17

21 Feb '17

Hi guys, Anyone knows if Bird OSPF supports FreeBSD ECMP (RADIX_MPATH kernel option)? I heard there is no compatibility. Please anyone who is running ou had success can confirm? Thanks.

4 5

Remove Private As Example
by Darren Marshall 20 Feb '17

20 Feb '17

Hi guys, Does anyone have an example bird configuration for remove private-as numbers , looking for same functionaility as the Cisco remove-private-AS knob. Thanks daz

3 4

filter & filter function
by Борис Коваленко 19 Feb '17

19 Feb '17

Hello! A little question I haven't found an answer in docs. When I use filter I use accept or reject for prefixes. But what if I use import/export where construction? May I use accept and reject too instead of return true/false? Regards, Boris -- С уважением, Борис Коваленко

1 0

bit operators
by Борис Коваленко 19 Feb '17

19 Feb '17

Hello! I have an idea to write common filters like define RF_REDISTRIBUTE_CONNECTED 0x10 define RF_REDISTRIBUTE_STATIC 0x20 ..... protocol ospf main_ospf { export where f_main_ospf_e(RF_REDISTRIBUTE_CONNECTED | RF_REDISTRIBUTE_STATIC); ..... } function f_main_ospf_e(int flags) { if(source ~ [RTS_STATIC, RTS_STATIC_DEVICE] && (flags & RF_REDISTRIBUTE_STATIC) ........ } Unfortunatelly there are not bit operators :( But may be there is another way? Regards, Boris -- С уважением, Борис Коваленко

2 2

Route attributes overwritten during reconfiguration
by João Taveira Araújo 17 Feb '17

17 Feb '17

Hi, I've run into a bug which manifests itself during reconfiguration. Unfortunately, the bird config in question is extremely large and I can't easily cut it down to something replicable. I'm running into this particular issue in bird6, but have no reason to believe IPv4 would fair any better. All results are using bird 1.6.2. My setup is as follows: - a static protocol, in which the import stanza adds extended communities: route 2001:db8::/48 via "lo" { bgp_ext_community.add((ro, 2, 0)); bgp_ext_community.add((ro, 3, 0)); ... } - based on these communities, the static route makes its way through a pipe from the master table, to an external table Typically all is fine - we export the route to our transits. Since we have multiple egress devices, a "show route" will show our local, static route, as well as the same route learnt through our providers: sudo birdc6 show route for 2001:db8::/48 BIRD 1.6.2 ready. 2001:db8::/48 dev lo [static_protocol 04:42:26] * (200) via xxx on et1 [transit_1 03:44:07] (100) via xxx on et2 [transit_2 03:44:07] (100) We actually have three transits, but one of our transits does not export any routes we happen to be exporting to them. Such a case happens on reconfiguring BIRD. During a reconfiguration, the static protocol gets reloaded: <TRACE> static_protocol > 2001:db8::/48 added [best] dev lo in this brief moment, a window of opportunity arises for our thus far silent transit to make an unwanted appearance: sudo birdc6 show route for 2001:db8::/48 BIRD 1.6.2 ready. 2001:db8::/48 dev lo [static_protocol 05:44:07] * (200) via xxx on et3 [transit_3 05:44:07] (100) via xxx on et1 [transit_1 03:44:07] (100) via xxx on et2 [transit_2 03:44:07] (100) This, it turns out, is tragic, because somehow the extended communities we apply to the route learnt from transit_3 clobber the ones we apply in static_protocol. I'm pretty sure something screws up the rta associated to the static route, but I'm also confused as to why the static protocol seems to get reloaded at all given there is no configuration change in the first place. We definitely want to allow local as: since the routes are potentially anycast, it is useful to have an alternate route in case we shut down the static announcement. Thanks, - j

3 7