- Bird-users - Mailing Lists

Compiling from source with --enable-ipv6
by Anand Buddhdev 08 Mar '15

08 Mar '15

I'm trying to build BIRD from sources. If I build without any options, then I end up with a binary called "bird" and its associated control programs, "bird" and "birdcl". This build is only capable of IPv4. So far I understand it. If I configure with the option --enable-ipv6, and build it, I end up with the binary "bird6", and the control programs, "birdc6" and "birdcl6". My question is: is bird6 only able to handle IPv6, or will it also handle IPv4? If it will only handle IPv6, then I would need both bird and bird6. Is there any way to get the build process to build both bird and bird6 without having to "make clean" and reconfigure? Is there any reason why a single bird binary won't just handle both IPv4 and IPv6? The documentation isn't clear about any of this, and could do with some improvement. Regards, Anand

3 2

[PATCH] Security hardening compiler and linker flags
by David Jorm 06 Mar '15

06 Mar '15

Hi All The attached patch adds security hardening compiler and linker flags. These flags are only applied if --enable-secflags is on, and I've made --enable-secflags on by default. I totally understand if the maintainers may prefer for it to be off by default, at least initially. Here is a brief explanation/justification of each of the flags added by this patch. Compiler flags: -Wformat -Wformat-security -Werror=format-security: Protection against format string vulnerabilities at compile time, no impact to the compiled binaries. -fPIE: Build position independent executable (PIE) binaries. Enables a form of address space layout randomization (ASLR), which makes exploitation of memory corruption vulnerabilities significantly more difficult. This does incur a small performance cost, but this is minimal and I believe an acceptable price to pay for the protection PIE provides. For more details on the performance cost, see [0]. -fstack-protector-strong: Stack-smashing protection at runtime, thwarting many buffer overflow exploits. This does incur a small performance cost. -fstack-protector-strong is designed to incur a minimal performance cost, compared to the more comprehensive -fstack-protector-all. -D_FORTIFY_SOURCE=2: Protection against static sized buffer overflows at compile time, no impact to compiled binaries. Linker flags: -fPIE -pie: To enable PIE as noted above. -Wl,-z,relro: Prevents some memory corruption exploits that overwrite the global offset table (GOT). For more details see [1]. -Wl,-z,now: Part of GOT overwrite protection. Can incur an extremely minimal performance hit at startup time as symbols are resolved. -Wl,-z,noexecstack: Prevents some memory corruption exploits by marking the stack as non-executable. Not all of these flags are available on some architectures and processors, but they should be automatically omitted from the configure script if not supported. Thanks David [0] https://securityblog.redhat.com/2012/12/12/position-independent-executable-… [1] https://isisblogs.poly.edu/2011/06/01/relro-relocation-read-only/

3 4

Re: OSPF type broadcast over GRE for NRHP
by Clint Armstrong 05 Mar '15

05 Mar '15

Thanks, that patch is working perfectly for me. I look forward to seeing this in the next release. On Tue, Mar 3, 2015 at 10:11 AM, Ondrej Zajicek <santiago(a)crfreenet.org> wrote: > On Tue, Mar 03, 2015 at 09:48:41AM -0500, Clint Armstrong wrote: > > So I have briefly tested a change that should allow OSPF broadcast over > GRE > > so long as the multicast flag is set on the GRE interface, enabling the > > behavior you were initially expecting. I'd love to hear feedback on this, > > especially if anyone is aware of problems this might cause. > > > > diff --git sysdep/linux/netlink.c sysdep/linux/netlink.c > > index 860c860..4b543a0 100644 > > --- sysdep/linux/netlink.c > > +++ sysdep/linux/netlink.c > > @@ -431,7 +431,7 @@ nl_parse_link(struct nlmsghdr *h, int scan) > > f.flags |= IF_MULTIACCESS | IF_LOOPBACK | IF_IGNORE; > > else if (fl & IFF_POINTOPOINT) /* PtP */ > > f.flags |= IF_MULTICAST; > > - else if (fl & IFF_BROADCAST) /* Broadcast */ > > + else if (fl & (IFF_BROADCAST || IFF_MULTICAST)) /* Broadcast */ > > f.flags |= IF_MULTIACCESS | IF_BROADCAST | IF_MULTICAST; > > else > > f.flags |= IF_MULTIACCESS; /* NBMA */ > > This would work most likely without problems. > > I would use just this one: > > diff --git a/sysdep/linux/netlink.c b/sysdep/linux/netlink.c > index 860c860..48dd8ba 100644 > --- a/sysdep/linux/netlink.c > +++ b/sysdep/linux/netlink.c > @@ -436,6 +436,9 @@ nl_parse_link(struct nlmsghdr *h, int scan) > else > f.flags |= IF_MULTIACCESS; /* NBMA */ > > + if (fl & IFF_MULTICAST) > + f.flags |= IF_MULTICAST; > + > ifi = if_update(&f); > > if (!scan) > > -- > Elen sila lumenn' omentielvo > > Ondrej 'Santiago' Zajicek (email: santiago(a)crfreenet.org) > OpenPGP encrypted e-mails preferred (KeyID 0x11DEADC3, wwwkeys.pgp.net) > "To err is human -- to blame it on a computer is even more so." >

1 0

6in4 tunnel example configuration
by Andre Nathan 04 Mar '15

04 Mar '15

Hello Does anyone have an example Bird BGP configuration for a 6in4 tunnel? I'm in the process of establishing a tunnel with HE's tunnelbroker.net and have only been able to find example Quagga configurations. Thanks in advance, Andre

1 0

Query regarding BGP/MPLS L3VPN support in BIRD
by Vikram Choudhary 04 Mar '15

04 Mar '15

Hi All, Does any of the BIRD release supports BGP/MPLS L3VPN (i.e. RFC-4364) functionality? Thanks Vikram

2 4

[PATCH] RPM spec file with systemd integration
by David Jorm 04 Mar '15

04 Mar '15

Hi All The attached patch provides an RPM spec file with systemd integration, rather than sysv init. I have tested it on Fedora 20 and 21. Note that this spec file includes: %global _hardened_build 1 Which automatically adds security hardening compiler flags. Thanks David

2 6

Problem with interfaces and routes on _one_ Debian sid system
by jimpenny＠ykk-usa.com 03 Mar '15

03 Mar '15

I have bird installed on 7 Debian Sid systems with 3.16.0-4 kernel. On 6 of these systems it works fine. On the last, running bird -d shows every non-kernel route with a message that looks like: bird: KRT: Receive route ... with unknown ifindex ... When I go into birdc and do show interfaces, I receive an empty list. ip link and ip route show the expected interfaces and routes. So, can you give me any hints on how to debug this? Where does bird get its interfaces and routes from on linux? Thanks jim

2 1

OSPF type broadcast over GRE for NRHP
by Clint Armstrong 03 Mar '15

03 Mar '15

I am trying to use BIRD to run OSPF inside a Phase 3 DMVPN using OpenNHRP. The problem I'm seeing is that it appears to be impossible to force type broadcast on a GRE interface. When I try, the message "Cannot use interface gre1 as broadcast, forcing nbma" is logged. This may normally make sense, but the OpenNHRP daemon captures multicast traffic on it's interface and forwards it appropriately. A configuration parameter to bypass this protection and allow broadcast on a GRE interface would be very helpful.

3 3

Bird hangs on startup (MIPS, EdgeOS 1.6.0, Debian wheezy)
by Joel Brunenberg 27 Feb '15

27 Feb '15

Hi, I am new to this list so please excuse, if I do look a little bit clumsy. I have a problem with bird 1.3.7 (debian wheezy 1.3.7-1) on mips, namingly EdgeOS 1.6.0 on an EdgeRouter Lite. I am trying to set up Bird to be able to use OSPF on Interfaces that are not supported by EdgeOS natively. Before you let me burn in hell for having that idea, please let me explain my problems. 1) On my platform does not start but hangs forever before the fork can take place - this is, if I have the "device" protocol enabled which I of cause need. I can reproduce that on several devices using the following minimal config (given another config without the device proto, bird starts) (given another config without the device proto, bird starts) (given another config without the device proto, bird starts) (given another config without the device proto, bird starts) (given another config without the device proto, bird starts) (given another config without the device proto, bird starts) (given another config without the device proto, bird starts) (given another config without the device proto, bird starts): ### bird.conf log syslog { warning, error, auth, fatal, bug, info, debug}; router id 10.24.1.104; debug protocols all; protocol device device0 { scan time 10; } ### end of bird.conf (I fixed problem 2 before trying this) I get no error messages or any indication whatsoever why or where it is hanging. Strace shows the last syscall to be the last one completing. recvmsg(5, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"\0\0\0\24\0\3\0\2\0\0\21\345\377\377\357\236\0\0\0\0\0\0\0\1\0\10\0\1\177\0\0\1"..., 8192}], msg_controllen=0, msg_flags=0}, 0) = 20 ltrace seems to be unavailable on MIPS with debian wheezy. I have no idea where to look right now. I am not that good with gdb, but I could try something, given instructions. I saw this Post in the mailinglist from 2013: http://comments.gmane.org/gmane.network.bird.user/2371 bit I am not sure if the two issues are related. I have no toolchain installed on this machine and I would rather not install one. I am not that good with crosscompiling either, but if someone could point me in the right direction, I would be glad to try a self-compiled version. 2) I use DHCP to get an IP on my WAN interface (cable modem) and the broadcast address on the interface after configuration is 255.255.255.255, which is not the right broadcast address for the IP assigned. If I do not fix that before starting bird, I get the following error Feb 27 16:16:14 bel bird: KIF: Invalid broadcast address \ 255.255.255.255 for eth1 Of cause, bird is right and the interface broadcast address is wrong. My question is: Is this a fatal error? The interface eth1 is not relevant to me. Can I leave the Broadcast address as it is or will this break bird even if not "using" this interface anywhere? Thank you for looking into this and sorry for the long post, /jbn -- Joel Brunenberg - Troisdorf PGP: 0xAD25981C

2 2

Introduction
by David Jorm 26 Feb '15

26 Feb '15

Hi All I am a security engineer based in Brisbane, Australia. I'm starting to work on a large-scale deployment of BIRD, and look forward to engaging with the BIRD community. I have created a couple of patches which I will send to this list shortly. Thanks David

1 0