- Bird-users - Mailing Lists

ospf: Socket error on ix0: Permission denied + a lot KIF: Received address message for unknown interface
by SC SCx 08 Dec '15

08 Dec '15

Hello. I have a FreeBSD x64 10.2-p7 system with Bird 1.5.0 acting as a PPPOE concentrator using MPD5 version 5.7 The system has 2 physical interfaces: ix0 ( a /30 connection to another freebsd router - ABR running Bird ) ix1 ( listening for PPPOE via MPD5 ) And many virtual interfaces when a PPPOE connection is established that follow this pattern: ng1, ng2, ng3 ... etc Here's my bird config (This router is running in a Totally Stubby Area 0.0.0.1): router id 172.16.116.5; protocol kernel { export all; } protocol direct { interface "ix0", "ng*"; } protocol device { scan time 10; } protocol static { } protocol ospf { tick 2; area 0.0.0.1 { stub yes; summary no; networks { 10.10.0.0/16; 125.40.44.0/22; }; interface "ix0" { dead count 4; type broadcast; }; interface "ng*" { stub yes; }; }; } This router also has a firewall enabled (ipfw) with the following rules: 00100 deny ip from any to not 125.40.44.0/22 out recv ng* xmit ng* 01000 pipe tablearg ip from any to table(2) out via ng* 01010 deny ip from any to any out via ng* 01020 pipe tablearg ip from table(1) to any in via ng* 01030 deny ip from any to any in via ng* 65534 allow ip from any to any 65535 deny ip from any to any What happens when I turn the system on and receive about 800 connections (e.g around 800 ng interfaces are created) is this in the logs: Dec 2 03:59:41 pppoe1 bird: ospf1: Socket error on ix0: Permission denied Dec 2 03:59:41 pppoe1 bird: KIF: Received address message for unknown interface 124 Dec 2 03:59:41 pppoe1 last message repeated 2 times Dec 2 03:59:41 pppoe1 bird: KIF: Received address message for unknown interface 123 Dec 2 03:59:41 pppoe1 last message repeated 2 times Dec 2 03:59:41 pppoe1 bird: KIF: Received address message for unknown interface 125 Dec 2 03:59:41 pppoe1 last message repeated 2 times Dec 2 03:59:41 pppoe1 bird: KIF: Received address message for unknown interface 126 Dec 2 03:59:41 pppoe1 last message repeated 2 times Dec 2 03:59:41 pppoe1 bird: KIF: Received address message for unknown interface 127 Dec 2 03:59:41 pppoe1 last message repeated 2 times Dec 2 03:59:41 pppoe1 bird: KIF: Received address message for unknown interface 128 Dec 2 03:59:41 pppoe1 last message repeated 2 times Dec 2 03:59:41 pppoe1 bird: KIF: Received address message for unknown interface 130 Dec 2 03:59:41 pppoe1 last message repeated 2 times Dec 2 03:59:41 pppoe1 bird: KIF: Received address message for unknown interface 129 Dec 2 03:59:41 pppoe1 last message repeated 2 times Dec 2 03:59:41 pppoe1 bird: KIF: Received address message for unknown interface 131 Dec 2 03:59:41 pppoe1 last message repeated 2 times Dec 2 03:59:41 pppoe1 bird: KIF: Received address message for unknown interface 133 Dec 2 03:59:41 pppoe1 last message repeated 2 times Dec 2 03:59:41 pppoe1 bird: KIF: Received address message for unknown interface 132 Dec 2 03:59:41 pppoe1 last message repeated 2 times Dec 2 03:59:41 pppoe1 bird: KIF: Received address message for unknown interface 134 Dec 2 03:59:41 pppoe1 last message repeated 2 times Dec 2 03:59:41 pppoe1 bird: KIF: Received address message for unknown interface 136 Dec 2 03:59:41 pppoe1 last message repeated 2 times Dec 2 03:59:41 pppoe1 bird: KIF: Received address message for unknown interface 135 Dec 2 03:59:41 pppoe1 last message repeated 2 times .... and much more As it can be seen I see tons of KIF: Received address message for unknown interface messages which I am not sure if it means anything serious. These happen anytime a ng interface is brought up/down. The worst is ospf1: Socket error on ix0: Permission denied because bird doesn't appear to listen and form any adjacency via ospf on this interface. At first I thought this may be due to a race condition, e.g Bird might load faster than the firewall rules and with ipfw the only loaded rule at startup is 'deny ip from any to any' which could explain the permission error. However if I manually stop bird and restart it after the system has fully booted I still receive the permission error, despite that there's now an 'allow ip from any to any' rule present. Interestingly I have an identical setup created with VirtualBox for this router and when I test with only 2 PPPOE connections it doesn't complain about any permission error. Same firewall rules and everything else. System starts up the same way, but no permission error. And the router forms adjacency.. I do still see of KIF: Received address message for unknown interface messages, though. Any ideas what can be the cause? Thank you.

2 1

Re: KRT: Received route with strange next-hop
by Brian Rak 05 Dec '15

05 Dec '15

On 12/5/2015 9:54 AM, Ondrej Zajicek wrote: > On Sat, Nov 28, 2015 at 04:16:54PM -0500, Brian Rak wrote: >>> Sorry for late answer, 'device route' i call a route for directly >>> attached network prefix, with associated iface but without associated >>> gateway IP. Perhaps there is a better / more established term for such >>> routes. >>> >> Sorry, my spam filter was delaying this. >> >> That's what I have I think? I have the '45.63.4.188 dev veth0 scope link' >> route, I'm not aware of any other way to add this (and it doesn't use a >> gateway IP). > > Well, the recommended way is to add ptp address: > > ip addr add A.B.C.D peer 45.63.4.188 dev veth0 > > instead of just the route (when ptp address is added, the route is also > added by the kernel) > The host end of the interface does not have an IP address, so using 'ip addr add' won't really work. A peer address won't really work, this isn't a /30 (the 45.63.4.188 IP is assigned to a virtual machine, and is part of a bigger /23, we're using proxy ARP to get traffic to/from the VM).

1 0

OSPF export filter
by Anton Kiryushkin 05 Dec '15

05 Dec '15

Hello. I trying to use bird for export ospf route for Cisco Nexus with next config: router id 10.34.23.1; filter export_OSPF { if net = 77.71.22.23/32 then { ospf_metric1 = 20; ospf_metric2 = 20; print "net accepted:", net; accept; } if net = 77.71.22.24/32 then { ospf_metric1 = 10; ospf_metric2 = 10; print "net accepted:", net; accept; } reject; } protocol ospf server1 { export filter export_OSPF; #debug all; rfc1583compat yes; tick 2; area 0.0.0.0 { stub no; interface "bond0" { dead 10; neighbors { 10.0.16.1; }; type pointopoint; authentication none; }; interface "lo*" { stub yes; cost 10; priority 200; }; interface "dummy0" { stub yes; cost 15; priority 100; }; }; } But in birdc I didn't see any metrics. I have two server with same config and same addresses on interfaces lo and dummy0 with different priorities. Could you help me with export filter? -- Best regards, Anton Kiryushkin

3 6

Issue injecting network overlapping BGP next hop in bird6.
by João Taveira Araújo 05 Dec '15

05 Dec '15

Hi, I'm running into a difference in behaviour between bird and bird6, although admittedly it may come from netlink itself. I'm using bird 1.5.0, but have also tried with build from latest git head. Assume a connection to an upstream router over a link addressed with 10.0.0.0/31 or AAAA::0/127 for IPv4 and IPv6 respectively. For IPv4, the upstream announces the follow prefix: 10.0.0.0/31 via 10.0.0.0 on eth0 [session 22:14:01] ! (100) BGP.next_hop: 10.0.0.0 In this case the route fails to be injected into the FIB, because a route already exists from proto kernel, as the interface is addressed from that prefix. In IPv6, the same thing happens, but on restarting bird6 all routes fail to get injected, each with the following error: "Netlink: No route to host". If I filter out the route on clean boot, thereby avoiding every attempting to inject the overlapping route, this does not happen. Cheers, Joao

2 1

KRT: Received route with strange next-hop
by Brian Rak 05 Dec '15

05 Dec '15

I'm trying to figure out why BIRD is throwing this error every time it scans the kernel routing table: <ERR> KRT: Received route 216.155.132.254/32 with strange next-hop 45.63.4.188 <WARN> Netlink: File exists I have two routes relevant to this one: # ip route | grep 45.63.4.188 45.63.4.188 dev veth0 scope link 216.155.132.254 via 45.63.4.188 dev veth0 proto bird The 45.63.4.188 route was added by me (manually), the 216.155.132.254 was added via BIRD (BIRD learned it via BGP). So, to me this looks like bird adding the route to the kernel, then getting confused why the route exists. Aside from this warning, everything appears to be working fine. Linux routes the traffic properly, BIRD readvertises this route properly. Any thoughts here? I think I can probably suppress this warning by removing the 'ng->scope == SCOPE_HOST' check from netlink.c, but I'm not entirely sure why that's there to begin with.

2 5

need some help with filters
by D.Wesołowski 05 Dec '15

05 Dec '15

Hi, I made bird.conf based on examples http://wklej.org/id/1862384/ import: ARPNET - full BGP table EPIX - IX openpeerint EP_GLOBAL - full BGP table export: ARPNET full BGP table EPIX - only statc_bgp, ARPNET prefix EP_GLOBAL - only static, bgp, ARPNET prefix I want to export to other bgp session prefix from ARPNET only when path is direct function rt_export() { if proto = "static_bgp" then return true; if source != RTS_BGP then return false; if net_martian() then return false; if bgp_path.len > 64 then return false; #return bgp_next_hop ~ [ 193.151.48.18 ]; return (bgp_path.first ~ [ 51931, 51944 ]); #if bgp_path.first ~ [ 51931, 51944 ] then return true; } the last two line don't works. I'm looking for some hint to make it work as I want ;) TIA -- D.Wesolowski

2 1

help
by Rohrmann Sascha 03 Dec '15

03 Dec '15

1 0

looking for some help with bgp extended communities
by Warren Turkal 01 Dec '15

01 Dec '15

Hi networkers, I'd like to use bgp extended communities instead of communities for my routing policy so that I can use the 4-octet ASN. However, I am a bit confused by the route target vs route origin (and not having other kinds). Would it be appropriate to use the route origin (as opposed to the route target) kind of ECs to hold the community data that I will use for routing policies? Or maybe is there a way to use the generic 0x04 sub type instead of ro and rt kinds? Also, is it legitimate to use some private ASN for global communities that can be set by any of my routers when talking to one another? Thanks, wt

2 1

RR reflects customer routes, the route is not delivered to the forwarding table.
by 曾小小 01 Dec '15

01 Dec '15

Hi All, I have 3 routers connected like this. R1 （RR） / \ / \ （AS100） / \ R2 R3 (client_1） (client_2） I am using Ubuntu 14.04, bird version is 1.5.0 Between the R1, R2, R3 OSPF establish IGP full mesh. R1 is configured as RR, R1 and R2, R1 and R3 establish IBGP connections . R2 redistribute static routes via BGP, to AS100, R3 can receive routing information from R2, and R1 (RR) can also receive R2 advertised routing information, and delivered to the forwarding. If this routes by the R1 will be sent to the forwarding, it will directly affect the business. How to use the BIRD in BGP configuration commands let R1 is not delivered to the forwarding? another question: Also on the use of “next hop self”, and what is the use in BGP as well? I know that within an AS, if learned from EBGP routing information, you can modify the next hop address of the border router interface. ===== about r3 routeing information link this: 6.6.6.6/32 via 192.168.1.68 on vlan2 [bgp_r1 07:27:16 from 192.168.10.126] * (100/?) [i] Type: BGP unicast univ BGP.origin: IGP BGP.as_path: BGP.next_hop: 192.168.1.68 BGP.local_pref: 100 BGP.originator_id: 192.168.1.68 BGP.cluster_list: 1.1.1.1 all configuration information is as follows R1： ==== ##template about rr template bgp rr_client { debug { states,interfaces,events }; description "ibgp-rr1"; local 192.168.10.126 as 64600; multihop; rr client; rr cluster id 1.1.1.1; } filter bgp_out_r1 { if net ~ [ 6.6.6.6/32, 7.7.7.7/32 ] then accept; reject; } protocol bgp rr_r2 from rr_client { neighbor 192.168.1.68 as 64600; export filter bgp_out_r1; import all; #next hop self; } protocol bgp rr_r3 from rr_client { neighbor 192.168.2.69 as 64600; export filter bgp_out_r1; import all; #next hop self; } ==== R2： filter bgp_out_r2 { if net ~ [ 6.6.6.6/32, 7.7.7.7/32 ] then accept; reject; } protocol bgp bgp_r2 { debug { states,interfaces,events }; description "ibgp-rr1"; import all; export filter bgp_out_r2; local as 64600; neighbor 192.168.10.126 as 64600; source address 192.168.1.68; next hop self; } === R3: protocol bgp bgp_r3 { debug { states,interfaces,events }; description "ibgp-rr1"; import all; export all; local as 64600; neighbor 192.168.10.126 as 64600; source address 192.168.2.69; next hop self; }

2 1

pattern matching for bgp communities
by Job Snijders 25 Nov '15

25 Nov '15

Hi all, Is there a way to do pattern matching or regex matching on the BGP communities associated with a prefix? The use-case I have: an eBGP peer attaches communties which inform me both about the geographical point of origin and the type of relation my eBGP peer has with the remote network adjacent to them. In their scheme they treat the lower 16 bits of the BGP community as a string of sorts, where the first digit represents continent and the second digit the type of relation: so "65535:12" might mean (after removnig the '65535' part, "12" remains), the "1" signifies the continent (say europe), the "2" signifies the relation (say 'peering'). Should I want to accept all routes where the relation is equals say "3", I'd have to either create a list of all possible communities matching where relation is "3", you'd end up with something like this: function filter_rel_type() clist l; { l = [(65535, 3), (65535, 13), (65535, 23), (65535, 33), (65535, 43), (65535, 53), (65535, 63), (65535, 73), (65535, 83), (65535, 93)]; if l ~ bgp_community then return true; return false; } You can imagine that with more complex informational scheme's 'clist l' would grow to rather large proportions. Is there a more elegant way to accomplish this style of matching? Kind regards, Job

2 1