- Bird-users - Mailing Lists

on mrt support
by Evelio VILA 19 Mar '15

19 Mar '15

Hi, Does bird dump mrt rib entries? as per rfc rfc6396 ? i see it has support for bgp messages and states but not the rib. How exactly does the dump routes command works? thanks Evelio Vila

2 1

BIRD ignored routes
by Nat J 12 Mar '15

12 Mar '15

Hi All, I’m having an issue with bird ignoring some prefixes it’s receiving. I'm new to bird and may be overlooking something simple. The config is essentially this [1] Exabpg1:AS_X < — > BIRD:AS_Y (route-server) [2] Exabgp2:AS_X < — > BIRD:AS_Y (route-server) [3] BIRD:AS_Y < — > BIRD:AS_Z [1] & [2] behave as expected, however when the route-server exports to the 2nd BIRD instance the routes are ignored. The debug file unfortunately makes no mention of the routes being ignored. Any suggestions on how I can find the cause for those being ignored. Attached are the configs and outputs from BIRD Thanks -nat

2 2

BGP export connected or static prefixes
by Anand Buddhdev 09 Mar '15

09 Mar '15

Dear BIRD users, I'm setting up BIRD 1.4.5 as a router for an AS112 anycast instance. I've got the router running and creating peering sessions with peers, and also importing prefixes from them into the kernel. However, it's not exporting my prefix, and I'm afraid I don't understand why. I'm quite new to BIRD, so please bear with me if my question looks naive. I would appreciate any clues. My configuration looks like this: list bgp address <myaddr>; router id <myaddr>; tabe anycast; filter as112 { if net = 192.75.48.0/24 then accept; reject; } protocol direct { interface "dummy0*"; } protocol device { } protocol kernel { export all; kernel table 10; table anycast; } protocol bgp { export filter as112; local <myaddr> as 112; neighbor <peeraddr> as <peeras>; table anycast; }

2 6

Re: Compiling from source with --enable-ipv6
by Anand Buddhdev 08 Mar '15

08 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 08/03/15 20:13, Jay Turner wrote: > You're going to need both binaries and to configure both bird.conf > and bird6.conf. There are both positives and negatives to this > design implementation, but the ability to separately configure and > control the two protocols has a lot of upside. Thank you Ondrej and Jay for your explanation. Regards, Anand -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iEYEARECAAYFAlT8wiMACgkQi+U8Q0SwlCsBtQCfeQv9m9+8PS3mV8dBvt4pTiKD 4bkAn0cEpstR2WJxAkgqzYlZD5dPcqeD =M23w -----END PGP SIGNATURE-----

1 0

Compiling from source with --enable-ipv6
by Anand Buddhdev 08 Mar '15

08 Mar '15

I'm trying to build BIRD from sources. If I build without any options, then I end up with a binary called "bird" and its associated control programs, "bird" and "birdcl". This build is only capable of IPv4. So far I understand it. If I configure with the option --enable-ipv6, and build it, I end up with the binary "bird6", and the control programs, "birdc6" and "birdcl6". My question is: is bird6 only able to handle IPv6, or will it also handle IPv4? If it will only handle IPv6, then I would need both bird and bird6. Is there any way to get the build process to build both bird and bird6 without having to "make clean" and reconfigure? Is there any reason why a single bird binary won't just handle both IPv4 and IPv6? The documentation isn't clear about any of this, and could do with some improvement. Regards, Anand

3 2

[PATCH] Security hardening compiler and linker flags
by David Jorm 06 Mar '15

06 Mar '15

Hi All The attached patch adds security hardening compiler and linker flags. These flags are only applied if --enable-secflags is on, and I've made --enable-secflags on by default. I totally understand if the maintainers may prefer for it to be off by default, at least initially. Here is a brief explanation/justification of each of the flags added by this patch. Compiler flags: -Wformat -Wformat-security -Werror=format-security: Protection against format string vulnerabilities at compile time, no impact to the compiled binaries. -fPIE: Build position independent executable (PIE) binaries. Enables a form of address space layout randomization (ASLR), which makes exploitation of memory corruption vulnerabilities significantly more difficult. This does incur a small performance cost, but this is minimal and I believe an acceptable price to pay for the protection PIE provides. For more details on the performance cost, see [0]. -fstack-protector-strong: Stack-smashing protection at runtime, thwarting many buffer overflow exploits. This does incur a small performance cost. -fstack-protector-strong is designed to incur a minimal performance cost, compared to the more comprehensive -fstack-protector-all. -D_FORTIFY_SOURCE=2: Protection against static sized buffer overflows at compile time, no impact to compiled binaries. Linker flags: -fPIE -pie: To enable PIE as noted above. -Wl,-z,relro: Prevents some memory corruption exploits that overwrite the global offset table (GOT). For more details see [1]. -Wl,-z,now: Part of GOT overwrite protection. Can incur an extremely minimal performance hit at startup time as symbols are resolved. -Wl,-z,noexecstack: Prevents some memory corruption exploits by marking the stack as non-executable. Not all of these flags are available on some architectures and processors, but they should be automatically omitted from the configure script if not supported. Thanks David [0] https://securityblog.redhat.com/2012/12/12/position-independent-executable-… [1] https://isisblogs.poly.edu/2011/06/01/relro-relocation-read-only/

3 4

Re: OSPF type broadcast over GRE for NRHP
by Clint Armstrong 05 Mar '15

05 Mar '15

Thanks, that patch is working perfectly for me. I look forward to seeing this in the next release. On Tue, Mar 3, 2015 at 10:11 AM, Ondrej Zajicek <santiago(a)crfreenet.org> wrote: > On Tue, Mar 03, 2015 at 09:48:41AM -0500, Clint Armstrong wrote: > > So I have briefly tested a change that should allow OSPF broadcast over > GRE > > so long as the multicast flag is set on the GRE interface, enabling the > > behavior you were initially expecting. I'd love to hear feedback on this, > > especially if anyone is aware of problems this might cause. > > > > diff --git sysdep/linux/netlink.c sysdep/linux/netlink.c > > index 860c860..4b543a0 100644 > > --- sysdep/linux/netlink.c > > +++ sysdep/linux/netlink.c > > @@ -431,7 +431,7 @@ nl_parse_link(struct nlmsghdr *h, int scan) > > f.flags |= IF_MULTIACCESS | IF_LOOPBACK | IF_IGNORE; > > else if (fl & IFF_POINTOPOINT) /* PtP */ > > f.flags |= IF_MULTICAST; > > - else if (fl & IFF_BROADCAST) /* Broadcast */ > > + else if (fl & (IFF_BROADCAST || IFF_MULTICAST)) /* Broadcast */ > > f.flags |= IF_MULTIACCESS | IF_BROADCAST | IF_MULTICAST; > > else > > f.flags |= IF_MULTIACCESS; /* NBMA */ > > This would work most likely without problems. > > I would use just this one: > > diff --git a/sysdep/linux/netlink.c b/sysdep/linux/netlink.c > index 860c860..48dd8ba 100644 > --- a/sysdep/linux/netlink.c > +++ b/sysdep/linux/netlink.c > @@ -436,6 +436,9 @@ nl_parse_link(struct nlmsghdr *h, int scan) > else > f.flags |= IF_MULTIACCESS; /* NBMA */ > > + if (fl & IFF_MULTICAST) > + f.flags |= IF_MULTICAST; > + > ifi = if_update(&f); > > if (!scan) > > -- > Elen sila lumenn' omentielvo > > Ondrej 'Santiago' Zajicek (email: santiago(a)crfreenet.org) > OpenPGP encrypted e-mails preferred (KeyID 0x11DEADC3, wwwkeys.pgp.net) > "To err is human -- to blame it on a computer is even more so." >

1 0

6in4 tunnel example configuration
by Andre Nathan 04 Mar '15

04 Mar '15

Hello Does anyone have an example Bird BGP configuration for a 6in4 tunnel? I'm in the process of establishing a tunnel with HE's tunnelbroker.net and have only been able to find example Quagga configurations. Thanks in advance, Andre

1 0

Query regarding BGP/MPLS L3VPN support in BIRD
by Vikram Choudhary 04 Mar '15

04 Mar '15

Hi All, Does any of the BIRD release supports BGP/MPLS L3VPN (i.e. RFC-4364) functionality? Thanks Vikram

2 4

[PATCH] RPM spec file with systemd integration
by David Jorm 04 Mar '15

04 Mar '15

Hi All The attached patch provides an RPM spec file with systemd integration, rather than sysv init. I have tested it on Fedora 20 and 21. Note that this spec file includes: %global _hardened_build 1 Which automatically adds security hardening compiler flags. Thanks David

2 6