- Bird-users - Mailing Lists

[PATCH] Add bgp's allowas-in feature.
by Milan Kocian 21 Oct '13

21 Oct '13

Sometimes its useful feature. So make it optional per bgp protocol. Based on hint http://permalink.gmane.org/gmane.network.bird.user/944 Signed-off-by: Milan Kocian <milon(a)wq.cz> --- proto/bgp/attrs.c | 5 +++-- proto/bgp/bgp.h | 1 + proto/bgp/config.Y | 4 +++- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/proto/bgp/attrs.c b/proto/bgp/attrs.c index c27a498..27a2694 100644 --- a/proto/bgp/attrs.c +++ b/proto/bgp/attrs.c @@ -1704,8 +1704,9 @@ bgp_decode_attrs(struct bgp_conn *conn, byte *attr, unsigned int len, struct lin bgp_remove_as4_attrs(bgp, a); /* If the AS path attribute contains our AS, reject the routes */ - if (bgp_as_path_loopy(bgp, a)) - goto withdraw; + if (!bgp->cf->allow_as_in) + if (bgp_as_path_loopy(bgp, a)) + goto withdraw; /* Two checks for IBGP loops caused by route reflection, RFC 4456 */ if (bgp_originator_id_loopy(bgp, a) || diff --git a/proto/bgp/bgp.h b/proto/bgp/bgp.h index 77a3671..f45c3aa 100644 --- a/proto/bgp/bgp.h +++ b/proto/bgp/bgp.h @@ -44,6 +44,7 @@ struct bgp_config { int passive; /* Do not initiate outgoing connection */ int interpret_communities; /* Hardwired handling of well-known communities */ int secondary; /* Accept also non-best routes (i.e. RA_ACCEPTED) */ + int allow_as_in; unsigned connect_retry_time; unsigned hold_time, initial_hold_time; unsigned keepalive_time; diff --git a/proto/bgp/config.Y b/proto/bgp/config.Y index d5e5aac..709f5dc 100644 --- a/proto/bgp/config.Y +++ b/proto/bgp/config.Y @@ -26,7 +26,7 @@ CF_KEYWORDS(BGP, LOCAL, NEIGHBOR, AS, HOLD, TIME, CONNECT, RETRY, PREFER, OLDER, MISSING, LLADDR, DROP, IGNORE, ROUTE, REFRESH, INTERPRET, COMMUNITIES, BGP_ORIGINATOR_ID, BGP_CLUSTER_LIST, IGP, TABLE, GATEWAY, DIRECT, RECURSIVE, MED, TTL, SECURITY, DETERMINISTIC, - SECONDARY) + SECONDARY, ALLOW, ALLOW_AS_IN) CF_GRAMMAR @@ -49,6 +49,7 @@ bgp_proto_start: proto_start BGP { BGP_CFG->advertise_ipv4 = 1; BGP_CFG->interpret_communities = 1; BGP_CFG->default_local_pref = 100; + BGP_CFG->allow_as_in = 0; } ; @@ -78,6 +79,7 @@ bgp_proto: | bgp_proto MULTIHOP expr ';' { BGP_CFG->multihop = $3; if (($3<1) || ($3>255)) cf_error("Multihop must be in range 1-255"); } | bgp_proto NEXT HOP SELF ';' { BGP_CFG->next_hop_self = 1; BGP_CFG->next_hop_keep = 0; } | bgp_proto NEXT HOP KEEP ';' { BGP_CFG->next_hop_keep = 1; BGP_CFG->next_hop_self = 0; } + | bgp_proto ALLOW AS IN ';' { BGP_CFG->allow_as_in = 1; } | bgp_proto MISSING LLADDR SELF ';' { BGP_CFG->missing_lladdr = MLL_SELF; } | bgp_proto MISSING LLADDR DROP ';' { BGP_CFG->missing_lladdr = MLL_DROP; } | bgp_proto MISSING LLADDR IGNORE ';' { BGP_CFG->missing_lladdr = MLL_IGNORE; } -- 1.8.4.rc3 -- Milan Kocian

3 3

Proposing a patch for bird
by Pierre Pfister 21 Oct '13

21 Oct '13

Hello, I am using bird as an OSPFv3 daemon and I encountered a bug while playing with the wires. Therefore, I would like to propose this correcting patch. If you have any more formal way to do it, please tell me. I looked at your gitlab, but couldn't find any way to propose a patch. Cheers, Pierre Pfister ---------------Here is my own commit's commentary that explains the patch--------- [DEBUG] Keep latest source address as neighbor's address In RFC5340, it is stated: "For all link types except virtual links, the Neighbor IP address is set to the IPv6 source address in the IPv6 header of the received OSPF Hello packet." It is not said which source address should be kept among all received Hello packets from the same neighbor. In current implementation, the first is used. In some cases, the neighbor's source address can change. But, in OSPFv3, neighbors are always identified by their IDs. If we don't keep the latest address as the neighbor's address, all HELLO packets will be correctly considered, but further unicast packet sent to the router that changed its address may not be received, making the link state blocking indefinitly. Cases where the source address can change are: - A wire's end is moved from one port to another. - For some reason, a router decides to change its Active Interface, which choice is implementation dependent. ---------------Here is the patch as provided by git-------------- diff --git a/proto/ospf/hello.c b/proto/ospf/hello.c index 58e87bb..0fbedc3 100644 --- a/proto/ospf/hello.c +++ b/proto/ospf/hello.c @@ -152,6 +152,12 @@ ospf_hello_receive(struct ospf_packet *ps_i, struct ospf_iface *ifa, n->iface_id = ntohl(ps->iface_id); #endif } +#ifdef OSPFv3 + else if (!ipa_equal(n->ip, faddr)) { + OSPF_TRACE(D_EVENTS, "Neighbor address changed from %I to %I", n->ip, faddr); + n->ip = faddr; + } +#endif ospf_neigh_sm(n, INM_HELLOREC); pnrid = (u32 *) ((struct ospf_hello_packet *) (ps + 1));

2 5

Strange MD5 Auth problem in BIRD 1.3.8
by Michael Vallaly 15 Oct '13

15 Oct '13

Hi, I recently had an interesting problem surrounding socket option buffers and its use in Bird on Linux 3.6 which I hope someone could shed some light on. Quite frequently see the following in our logs when enabling/starting BGP sessions when configured to use MD5 auth. <snip> Sep 24 23:12:46 rtr2 bird: sk_set_md5_auth_int: setsockopt: No such file or directory </snip> These never seem to cause any functionality problems, but seemed strange / maybe related to my new ongoing issue. ;) ## My functionality impacting problem ## Yesterday after some upstream BGP peers has connectivity issues (Hold timer expired), all of my previously working BGP sessions (using MD5 auth) attempted to reconnect and gave me the following in the logs: <snip> Oct 9 18:02:08 rtr2 bird: plxhq: Error: Hold timer expired Oct 9 18:02:08 rtr2 bird: plxhq: BGP session closed Oct 9 18:02:08 rtr2 bird: plxhq: State changed to flush Oct 9 18:02:08 rtr2 bird: plxhq: State changed to stop Oct 9 18:02:08 rtr2 bird: sk_set_md5_auth_int: setsockopt: No such file or directory Oct 9 18:02:08 rtr2 bird: plxhq: Down Oct 9 18:02:08 rtr2 bird: plxhq: Starting Oct 9 18:02:08 rtr2 bird: sk_set_md5_auth_int: setsockopt: Cannot allocate memory </snip> At which point the BGP session fails to establish/start, and all subsequent BGP sessions that are started (with MD5 Auth) also fail with the same message. Looking through the bird code it seems bird issues some socket control messages to update the TCP socket with MD5 parameters. And after digging around in the Linux system it seems I was running out of socket option memory buffers (duh!). Thusly I was able to "fix" this by issuing: <snip> echo 40960 > /proc/sys/net/core/optmem_max # Defaults to 20480 </snip> Is this expected? Any insight on how to properly size the socket option memory buffers used by bird? Is this some sort of a socket buffer leak? <snip> bird> show memory BIRD memory usage Routing tables: 307 MB Route attributes: 106 MB ROA tables: 192 B Protocols: 388 kB Total: 413 MB $ uptime 16:45:03 up 343 days, 1:23, 1 user, load average: 0.00, 0.03, 0.05 </snip> I have multiple identical machines running the same os/software/configuration and so far only one of them has shown this behavior. Thanks! -Mike -- Michael Vallaly <mvallaly(a)nolatency.com>

2 1

[PATCH] Force KRT rescan on syncer startup with multi syncer config
by Sergey Popovich 15 Oct '13

15 Oct '13

It seems commit commit c6964c305b425b98aaf0492806a28b578d799d83 Author: Ondrej Zajicek <santiago(a)crfreenet.org> Date: Sat Jun 29 22:55:41 2013 +0200 Makes krt.c much more readable. introduces regression, so in configurations with more than one kernel syncer when kernel protocol added/enabled/or restarted (for example due to filter changes), no KRT scan is performed and BRT remains empty until next scan on regular interval specified scan time option). BIRD config: ------------ # Configure logging log stderr all; log syslog all; router id 172.16.1.1; protocol device devices { scan time 120; } ### KRT 10 table rt_10; protocol kernel kernel10 { table rt_10; debug all; persist no; scan time 120; learn yes; device routes yes; kernel table 10; import all; export none; } ### KRT 20 table rt_20; protocol kernel kernel20 { disabled yes; table rt_20; debug all; persist no; scan time 120; learn yes; device routes yes; kernel table 20; import all; export none; } System configuration: --------------------- # ip -4 addr sh dev lo255 6: lo255: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN inet 192.0.2.1/24 brd 192.0.2.255 scope global lo255 # ip -4 route show table 10 172.16.1.0/24 dev lo255 proto static scope link src 192.0.2.1 # ip -4 route show table 20 172.16.1.0/24 dev lo255 proto static scope link src 192.0.2.1 After BIRD starts: ------------------ # birdc 'show protocols' BIRD 1.3.11 ready. name proto table state since info devices Device master up 10:21 kernel10 Kernel rt_10 up 10:21 kernel20 Kernel rt_20 down 10:21 # birdc 'show route table rt_10' BIRD 1.3.11 ready. 172.16.1.0/24 dev lo255 [kernel10 10:21] * (10) # birdc 'show route table rt_20' BIRD 1.3.11 ready. Now enable kernel20: -------------------- # birdc 'enable kernel20' BIRD 1.3.11 ready. kernel20: enabled 10-10-2013 10:23:11 <INFO> Enabling protocol kernel20 Kicking kernel20 up 10-10-2013 10:23:11 <TRACE> kernel20: Starting Allocating FIB hash of order 10: 1024 entries, 0 low, 4096 high kernel20 reporting state transition HUNGRY/DOWN -> */UP kernel20: Scheduling meal Connecting protocol kernel20 to table rt_20 10-10-2013 10:23:11 <TRACE> kernel20: Connected to table rt_20 10-10-2013 10:23:11 <TRACE> kernel20: State changed to feed Feeding protocol kernel20 Feeding protocol kernel20 continued Announcing routes to new protocol kernel20 10-10-2013 10:23:11 <TRACE> kernel20: State changed to up Protocol kernel20 up and running And see no routes from kernel: ------------------------------ # birdc 'show route table rt_20' BIRD 1.3.11 ready. After less than scan time interval (120 sec in configuration): -------------------------------------------------------------- BIRD 1.3.11 ready. 172.16.1.0/24 dev lo255 [kernel20 10:25] * (10) 10-10-2013 10:25:06 <TRACE> kernel10: 172.16.1.0/24: [alien] seen KRT: Got 172.16.1.0/24, type=1, oif=6, table=20, prid=4, proto=kernel20 10-10-2013 10:25:06 <TRACE> kernel20: 172.16.1.0/24: [alien] created --- sysdep/unix/krt.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)

2 1

BIRD 1.3.11 (ports) on FreeBSD 9.1-p7
by Markus Grundmann 09 Oct '13

09 Oct '13

Good morning! My name is Markus and I have an issue with the BIRD 1.3.11. Since I had switched from Quagga 0.9x.x to BIRD 1.3.11 I have more and more trouble in my network with OSPFv2. After some minutes or hours the ARP resolution doesn't work and tons of messages are logged by BIRD and the "kernel". All FreeBSD 9.1-p7 servers sending messages to their syslog (see below). Virtual servers are no longer reachable. What's the problem? The same messages are generated by OSPFv3 processes. --- Some Logs --- arpresolve: can't allocate llinfo for 8X.2X.32.211 arpresolve: can't allocate llinfo for 8X.2X.32.211 arpresolve: can't allocate llinfo for 8X.2X.32.211 arpresolve: can't allocate llinfo for 8X.2X.32.211 arpresolve: can't allocate llinfo for 8X.2X.32.211 arpresolve: can't allocate llinfo for 8X.2X.32.211 arpresolve: can't allocate llinfo for 8X.2X.32.211 arpresolve: can't allocate llinfo for 8X.2X.32.211 [..] arpresolve: can't allocate llinfo for 8X.2X.32.211 arpresolve: can't allocate llinfo for 8X.2X.32.211 arpresolve: can't allocate llinfo for 8X.2X.32.211 arpresolve: can't allocate llinfo for 8X.2X.32.211 arpresolve: can't allocate llinfo for 8X.2X.32.211 arpresolve: can't allocate llinfo for 8X.2X.32.197 arpresolve: can't allocate llinfo for 8X.2X.32.211 arpresolve: can't allocate llinfo for 8X.2X.32.211 arpresolve: can't allocate llinfo for 8X.2X.32.211 arpresolve: can't allocate llinfo for 8X.2X.32.211 [..] arpresolve: can't allocate llinfo for 8X.2X.32.211 arpresolve: can't allocate llinfo for 8X.2X.32.211 arpresolve: can't allocate llinfo for 8X.2X.32.211 arpresolve: can't allocate llinfo for 8X.2X.32.211 arpresolve: can't allocate llinfo for 8X.2X.32.211 ### The server with the NFS service is running BIRD 1.3.11 (FreeBSD ports). ### Over 1000 messages will be logged. $ dmesg | grep arpresolve | wc -l 1189 ### After a while some servers are not longer available because ARP resolution failed. Oct 9 00:55:39 clarion kernel: newnfs server trinitron:/archiv/clarion: not responding ### When I restart BIRD the ARP resolution will work again. Custom Kernel: 9.1-RELEASE-p7 FreeBSD 9.1-RELEASE-p7 #4: Tue Sep 10 14:31:40 CEST 2013 amd64 ### All OSPF neighbors sending tons of warnings! :-( Oct 9 08:30:35 j bird: OSPF: LSA disappeared (Type: 0005, Id: 10.82.206.193, Rt: 8X.2X.32.210) Oct 9 08:30:35 j bird: OSPF: LSA disappeared (Type: 0005, Id: 8X.2X.1.33, Rt: 8X.2X.32.210) Oct 9 08:30:35 j bird: OSPF: LSA disappeared (Type: 0005, Id: 8X.2X.32.210, Rt: 8X.2X.32.210) Oct 9 08:30:35 j bird: OSPF: LSA disappeared (Type: 0005, Id: 8X.2X.32.216, Rt: 8X.2X.32.210) Oct 9 08:30:35 j bird: OSPF: LSA disappeared (Type: 0005, Id: 8X.2X.32.217, Rt: 8X.2X.32.210) Oct 9 08:30:35 j bird: OSPF: LSA disappeared (Type: 0002, Id: 8X.2X.1.33, Rt: 8X.2X.32.210) Oct 9 08:30:35 j bird: OSPF: LSA disappeared (Type: 0002, Id: 8X.2X.32.210, Rt: 8X.2X.32.210) Oct 9 08:30:40 j bird: OSPF: LSA disappeared (Type: 0005, Id: 10.82.206.193, Rt: 8X.2X.32.210) Oct 9 08:30:40 j bird: OSPF: LSA disappeared (Type: 0005, Id: 8X.2X.1.33, Rt: 8X.2X.32.210) Oct 9 08:30:40 j bird: OSPF: LSA disappeared (Type: 0005, Id: 8X.2X.32.210, Rt: 8X.2X.32.210) Oct 9 08:30:40 j bird: OSPF: LSA disappeared (Type: 0005, Id: 8X.2X.32.216, Rt: 8X.2X.32.210) Oct 9 08:30:40 j bird: OSPF: LSA disappeared (Type: 0005, Id: 8X.2X.32.217, Rt: 8X.2X.32.210) Oct 9 08:30:40 j bird: OSPF: LSA disappeared (Type: 0002, Id: 82.2X.1.33, Rt: 8X.2X.32.210) Oct 9 08:30:40 j bird: OSPF: LSA disappeared (Type: 0002, Id: 8X.2X.32.210, Rt: 8X.2X.32.210) ### It's a little bit too much ;-) grep "LSA disappeared" /var/log/messages|wc -l 3585 ### /var/log/messages on a other machine :-( [..] Oct 9 05:02:19 clarion bird: OSPF: LSA disappeared (Type: 0005, Id: 0.0.0.0, Rt: 82.2X.32.193) Oct 9 05:02:24 clarion bird: OSPF: LSA disappeared (Type: 0002, Id: 8X.2X.32.193, Rt: 8X.2X.32.193) Oct 9 05:02:24 clarion bird: OSPF: LSA disappeared (Type: 0005, Id: 0.0.0.0, Rt: 82.2X.32.193) Oct 9 05:02:28 clarion bird: OSPF: LSA disappeared (Type: 0002, Id: 8X.2X.32.193, Rt: 8X.2X.32.193) Oct 9 05:02:59 clarion last message repeated 6 times Oct 9 05:05:04 clarion last message repeated 25 times Oct 9 05:15:08 clarion last message repeated 121 times Oct 9 05:25:09 clarion last message repeated 120 times Oct 9 05:35:08 clarion last message repeated 120 times Oct 9 05:45:10 clarion last message repeated 120 times Oct 9 05:55:11 clarion last message repeated 120 times Oct 9 06:05:10 clarion last message repeated 120 times Oct 9 06:15:10 clarion last message repeated 120 times Oct 9 06:25:10 clarion last message repeated 120 times Oct 9 06:35:10 clarion last message repeated 120 times Oct 9 06:45:11 clarion last message repeated 120 times Oct 9 06:55:12 clarion last message repeated 120 times Oct 9 07:05:12 clarion last message repeated 120 times Oct 9 07:15:13 clarion last message repeated 120 times Oct 9 07:25:14 clarion last message repeated 120 times Oct 9 07:35:15 clarion last message repeated 120 times Oct 9 07:45:14 clarion last message repeated 120 times Oct 9 07:55:15 clarion last message repeated 120 times Oct 9 08:05:13 clarion last message repeated 119 times [..]

3 8

BIRD 1.3.11 (ports) on FreeBSD 9.1-p7 :: Additional information
by Markus Grundmann 09 Oct '13

09 Oct '13

Hi! The host is running up to two VirtualBox instances with the IP addresses 8X.2X.32.197 and .195 Both VMs are running BIRD 1.3.11 with OSPFv2. When I use OSPFv3 on all neighbors the trouble is more bigger ("LSA disappeared" messages). The server with IP .211 running BIRD 1.3.11. All OSPF neighbors have a Cisco IOS based OSPF neighbor with OSPFv2 and OSPFv3. I hope this are enough information about my environment. Formerly the servers working with Quagga and I have not any issues with ARP and OSPF. Interface "re0" has two VLANs. VLAN2 has multiple IPs in the same network. --- Host .211 --- re0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500 options=820db<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,POLLING,VLAN_HWCSUM,WOL_MAGIC,LINKSTATE> ether f4:6d:04:94:0c:30 inet6 fe80::f66d:4ff:fe94:c30%re0 prefixlen 64 scopeid 0x3 nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL> media: Ethernet autoselect (1000baseT <full-duplex>) status: active fxp0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500 options=2049<RXCSUM,VLAN_MTU,POLLING,WOL_MAGIC> ether 00:90:27:8f:d6:08 inet6 fe80::290:27ff:fe8f:d608%fxp0 prefixlen 64 scopeid 0x4 nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL> media: Ethernet autoselect (none) status: no carrier plip0: flags=8810<POINTOPOINT,SIMPLEX,MULTICAST> metric 0 mtu 1500 nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL> ipfw0: flags=8801<UP,SIMPLEX,MULTICAST> metric 0 mtu 65536 nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL> lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384 options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6> inet6 2001:XXXX:1002:1002::1 prefixlen 128 inet6 ::1 prefixlen 128 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x8 inet 127.0.0.1 netmask 0xff000000 inet 10.255.255.10 netmask 0xffffffff nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL> vlan2: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500 options=3<RXCSUM,TXCSUM> ether f4:6d:04:94:0c:30 inet6 fe80::f66d:4ff:fe94:c30%vlan2 prefixlen 64 scopeid 0x9 inet 8X.2X.32.210 netmask 0xffffffe0 broadcast 82.2X.32.223 inet6 2001:XXXX:1002:1::2 prefixlen 48 inet 8X.2X.32.216 netmask 0xffffffe0 broadcast 8X.2X.32.223 inet 8X.2X.32.217 netmask 0xffffffe0 broadcast 8X.2X.32.223 nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL> media: Ethernet autoselect (1000baseT <full-duplex>) status: active vlan: 2 parent interface: re0 vlan3: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500 options=3<RXCSUM,TXCSUM> ether f4:6d:04:94:0c:30 inet6 fe80::f66d:4ff:fe94:c30%vlan3 prefixlen 64 scopeid 0xa inet 8X.2X.1.33 netmask 0xfffffffc broadcast 8X.2X.1.35 inet 10.8X.2X.193 netmask 0xffffffc0 broadcast 10.8X.2X.255 nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL> media: Ethernet autoselect (1000baseT <full-duplex>) status: active vlan: 3 parent interface: re0 ### All loaded kernel modules (has BIRD trouble with the vbox drivers?) $ kldstat Id Refs Address Size Name 1 48 0xffffffff80200000 135c780 kernel 2 1 0xffffffff8155d000 3008 splash_bmp.ko 3 1 0xffffffff817a1000 4f18 if_gre.ko 4 1 0xffffffff817a6000 77d0 if_tap.ko 5 1 0xffffffff817ae000 f7a8 if_lagg.ko 6 1 0xffffffff817be000 b468 ng_netflow.ko 7 4 0xffffffff817ca000 15330 netgraph.ko 8 1 0xffffffff817e0000 f4d8 aio.ko 9 1 0xffffffff817f0000 a80 accf_data.ko 10 1 0xffffffff817f1000 17d8 accf_http.ko 11 1 0xffffffff817f4000 1a5c0 pefs.ko 12 3 0xffffffff8180f000 2b4a8 crypto.ko 13 2 0xffffffff8183b000 dde0 zlib.ko 14 1 0xffffffff81849000 4a30 aesni.ko 15 1 0xffffffff8184e000 2970 snp.ko 16 3 0xffffffff81851000 59a60 vboxdrv.ko 17 1 0xffffffff81a12000 13436d zfs.ko 18 1 0xffffffff81b47000 2fb1 opensolaris.ko 19 1 0xffffffff81b4a000 a9bb fuse.ko 20 2 0xffffffff81b55000 2b11 vboxnetflt.ko 21 1 0xffffffff81b58000 1579 ng_ether.ko 22 1 0xffffffff81b5a000 3fea vboxnetadp.ko ### Additional options in my custom kernel. All other options are from the GENERIC file. options IPFIREWALL options IPFIREWALL_VERBOSE options IPFIREWALL_VERBOSE_LIMIT=0 options IPFIREWALL_DEFAULT_TO_ACCEPT options IPDIVERT options IPFIREWALL_FORWARD options IPFIREWALL_NAT options LIBALIAS options DUMMYNET options ROUTETABLES=2 // Configured but not used in production. options DEVICE_POLLING options HZ=1000 Best regards, Markus

1 0

OSPF not advertising tun IPs with OpenVPN
by Thomas Johnson 08 Oct '13

08 Oct '13

I am having some difficulty getting my OSPF configuration to play nicely with OpenVPN tunnels on FreeBSD. I have a number of point-to-point tunnels between sites, with a BIRD instance running on each tunnel endpoint. Endpoint addresses for a tunnel use a logical /31. Initially, the BIRD instances would talk to each other, but the endpoint addresses were not advertised by OSPF, making them unreachable. I remedied this by adding stubnet declarations (/32) for each of the tunnel endpoints. This has the effect of making all of my endpoint addresses reachable, but causes another issue. In this configuration, if I restart one of my OpenVPN tunnels, it fails to set addressing on the tunnel, because the host route already exists in the routing table (due to the stubnet). I have attached my OSPF configuration below. Is there some better way of configuring this, to make my tunnel endpoints advertise properly without declaring them as stubnets? Thanks! protocol ospf { tick 2; area 0 { stub no; stubnet 10.70.0.3/32; stubnet 172.26.26.5/32; stubnet 1.2.3.221/32; interface "re0" { stub; cost 100; hello 2; dead 10; authentication cryptographic; password "password"; }; interface "tun*" { type ptp; hello 2; dead 10; authentication cryptographic; password "password"; }; }; }

2 2

filters: strange protocol restarts
by Sergey Popovich 03 Oct '13

03 Oct '13

Hello community!! And again I need to spread some light on BIRD behavior: why bird restarts protocol instead of just reloading it when no filter changes in configuration when using prefix set constant? There is simple configuration and steps to reproduce this ------------------------------------------------------------------------- # Configure logging log syslog all; log stderr all; router id 172.16.1.1; protocol device devices { scan time 15; } ### KRT 10 table rt_10; # This function does not forces "kernel" protocol to reload. function f1(prefix pfx) { if pfx ~ [ 192.168.0.0/16+ ] then return false; return true; } protocol kernel kernel10 { table rt_10; persist no; scan time 15; learn yes; device routes yes; kernel table 10; import where f1(net); export none; } ### KRT 20 table rt_20; # And this does, "kernel" protocol restarts without changing PS_1. define PS_1 = [ 192.168.0.0/16+ ]; function f2(prefix pfx) { if pfx ~ PS_1 then return false; return true; } There is nothing difficult in config: 2 functions f1() and f2() that do same thing except f2() matches specified as parameter prefix to a defined constant of type prefix set (PS_1). Starting bird, and invoking three times on console command to reconfigure bird (birdc configure) without altering configuration file I get following in my syslog: -------------------------------------------------------------------------------- Aug 21 18:50:54 gw1 bird: Started Aug 21 18:50:59 gw1 bird: Reconfiguring Aug 21 18:50:59 gw1 bird: Reloading protocol kernel20 Aug 21 18:50:59 gw1 bird: Restarting protocol kernel20 Aug 21 18:50:59 gw1 bird: Reconfigured Aug 21 18:51:08 gw1 bird: Reconfiguring Aug 21 18:51:08 gw1 bird: Reloading protocol kernel20 Aug 21 18:51:08 gw1 bird: Restarting protocol kernel20 Aug 21 18:51:08 gw1 bird: Reconfigured Aug 21 18:51:08 gw1 bird: Reconfiguring Aug 21 18:51:08 gw1 bird: Reloading protocol kernel20 Aug 21 18:51:08 gw1 bird: Restarting protocol kernel20 Aug 21 18:51:08 gw1 bird: Reconfigured Same thing can be reproduced with other protocols. This is not wery good to restart protocol when no REAL things changed in its filter, as it purges all routes from kernel table, and reinstalls them again causing flap when huge number of routes needed to be reinstalled. Can some one explain to me this behavior of BIRD? Does this mean that usage of constats with type prefix set is not recommended? Thanks for your support. -- SP5474-RIPE Sergey Popovich

3 27

Redundant / High available BIRD
by Robert Scheck 02 Oct '13

02 Oct '13

Hello list, even I spent some time to BGP and BIRD, I am somehow still a newbie with the goal to set up a redundant/high available BGP using BIRD in the future. Initially I thought about putting BIRD onto a Linux system with Corosync and Pacemaker for high availability. The two machines would be connected also directly for heartbeat communication. This would be an active/standby setup - but I'm not sure if this is a good idea (physical layout): ISP1 ---+ +--- BIRD 1 --- Switch | | | \ / Switch | X | | | / \ ISP2 ---+ +--- BIRD 2 --- Switch Note that the "X" is just intersected not connected. This brings obviously a single point of failure: The first switch. My next idea was doubling the switch which requires of course two physical cables per ISP: ISP 1 --- Switch 1 --- BIRD 1 --- Switch \ / \ / | \ / X X | X / \ / \ | / \ ISP 2 --- Switch 2 --- BIRD 2 --- Switch This seems to be...expensive. Even this idea left me with an active/standby setup at BIRD. So Pacemaker would start BIRD on one of the two servers and stop it on the other. During maintainance of the servers the active/standby would be changed to standby/active - but resets all BGP sessions and seems to be especially disliked by eventually later peering partners. Correct me, if I am wrong here, please. I also thought about this setup: ISP 1 --- BIRD 1 --- Switch | \ / | X | / \ ISP 2 --- BIRD 2 --- Switch This actually requires two running BIRDs but leaves me with the question how to deal with the IP address on the internal side. So in theory I would have two virtual standard gateways for connected internal equipment?! Maybe I'm also totally on the wrong road. The basic plan is two different ISP connections, two Linux systems running BIRD and Corosync with Pacemaker to achive high availability - and later some peering partners. I would like to see a fast automated failover in case a link or a hardware breaks down. Searching on the Internet brings lots of BSD-based setups with CARP/pfsync but only less Linux-based ones, somebody noticed keepalived. So is Corosync and Pacemaker just the wrong attempt? Are there some recommendations or best practices on physical and software structure? Do you run similar setups and how do they look like? What are you using on the software level - except BIRD? And how long does a failover take for you? Are you running active/active or active/standby? I am also looking for hardware recommendations: If I am not completely mis- taken, above requires (depending on the configuration) up to two full BGP tables in memory...how much is that for IPv4 and IPv6? How about the CPU? I can read in various documents that BIRD requires less CPU than others, but what does less mean in a rough absolute value in GiB for above situation? Thank you for reading my long e-mail and sorry for taking your time! Feel also free to just send me some pointers in case I missed some documentation or other useful links. Greetings, Robert

2 1

OSPF dont import routes from LSAdb
by 1 Игорь 30 Sep '13

30 Sep '13

Hi everyone. I have a problem with OSPF. In my topology Core router (Area0) connected to 2 routers (Area1), which intrconnected with their own link. Core redistributes 0/0 and things works normal. Core router ID is 10.0.0.0, R1 - 10.0.1.1, R2 - 10.0.1.2. But, when I drop one of links between Core router and Area1 router, I expect that 0/0 route pass through second Area 1 router and all reveal on first, on wich i drop link to core. In LSA DB I see LSA Type 5, wich generates from core router: bird> show ospf lsadb Global Type LS ID Router Age Sequence Checksum 0005 0.0.0.0 10.0.0.0 616 80000002 72f0 Area 0.0.0.0 Type LS ID Router Age Sequence Checksum 0001 10.0.1.2 10.0.1.2 0 80000002 594e 0003 10.16.0.0 10.0.1.2 29 80000001 e258 Area 0.0.0.1 Type LS ID Router Age Sequence Checksum 0003 10.0.0.0 10.0.1.1 943 80000001 6d75 0004 10.0.0.0 10.0.1.1 943 80000001 5f82 0001 10.0.1.1 10.0.1.1 23 8000000a 2103 0003 10.0.1.1 10.0.1.1 962 80000001 6cd8 0003 10.2.1.3 10.0.1.1 962 80000001 1ac5 0002 10.31.12.1 10.0.1.1 23 80000001 847a 0002 10.31.21.1 10.0.1.1 23 80000001 21d4 0001 10.0.1.2 10.0.1.2 13 80000009 3be5 0003 10.0.1.2 10.0.1.2 29 80000001 5ce6 0003 10.2.1.4 10.0.1.2 29 80000001 0ad3 But in master table I have no this route: bird> show route 10.0.1.2/32 dev lo [C1 11:46] * I (150/0) [10.0.1.2] 10.2.1.4/30 dev bond0.4002 [C1 11:46] * I (150/100) [10.0.1.2] 10.31.21.0/24 dev bond0.4021 [C1 11:47] * I (150/10) [10.0.1.1] 10.31.12.0/24 dev bond0.4012 [C1 11:47] * I (150/10) [10.0.1.1] (bond0.4012 and bond0.4021 - links which interconnect R1 and R2, bond0.4002 - link to Core, which disabled there) Config of R1 and R2 is same (exept Router ID): # Configure logging #log syslog { debug, trace, info, remote, warning, error, auth, fatal, bug }; log stderr all; log "/var/log/bird.log" { info,remote,warning,error,auth,fatal,bug}; #log "/var/log/debug_bird.log" all; filter OSPF_in { if ( net=0.0.0.0/0 || net ~ 10.0.0.0/8 ) then accept; else reject; }; filter OSPF_out { if (net ~ 10.16.0.0/12 ) then accept; else reject; }; # This pseudo-protocol performs synchronization between BIRD's routing # tables and the kernel. If your kernel supports multiple routing tables # (as Linux 2.2.x does), you can run multiple instances of the kernel # protocol and synchronize different kernel tables with different BIRD tables. protocol kernel { # learn; # Learn all alien routes from the kernel debug {states,routes,filters,interfaces}; persist; # Don't remove routes on bird shutdown scan time 20; # Scan kernel routing table every 20 seconds import all; # Default is import all export all; # Default is export none # kernel table 5; # Kernel table to synchronize with (default: main) } # This pseudo-protocol watches all interface up/down events. protocol device { scan time 10; # Scan interfaces every 10 seconds } protocol ospf C1{ # rfc1583compat yes; router id 10.0.1.2; ecmp; import keep filtered yes; # import filter OSPF_in; import all; # export filter OSPF_out; # export none; # debug {states,routes,filters,interfaces}; debug all; area 0{ stub no; interface "bond0.4002"{ type bcast; cost 100; hello 1; dead count 3; retransmit 6; transmit delay 5; wait 30; authentication cryptographic; password "xxx"; }; interface 10.0.1.2/32 { stub 1; }; }; area 1{ stub no; interface "bond0.4012", "bond0.4021" { rx buffer large; type bcast; cost 10; hello 1; dead count 3; retransmit 6; transmit delay 5; wait 30; authentication cryptographic; password "aaa"; }; interface 10.16.0.0/12 { stub 1; cost 10; }; }; } Config of Core router: # Configure logging #log syslog { debug, trace, info, remote, warning, error, auth, fatal, bug }; #log stderr all; #log "tmp" all; filter OSPF_in { if (net ~ 10.0.0.0/8 ) then accept; else reject; }; # Redistribute 0/0 only from BRAS!!! filter OSPF_redistribute { if ( net = 0.0.0.0/0) then { #ospf_metric1=200; ospf_metric2=100; accept; } else reject; }; # This pseudo-protocol performs synchronization between BIRD's routing # tables and the kernel. If your kernel supports multiple routing tables # (as Linux 2.2.x does), you can run multiple instances of the kernel # protocol and synchronize different kernel tables with different BIRD tables. protocol kernel { learn; # Learn all alien routes from the kernel persist; # Don't remove routes on bird shutdown scan time 10; # Scan kernel routing table every 20 seconds import all; # Default is import all export all; # Default is export none # kernel table 5; # Kernel table to synchronize with (default: main) } # This pseudo-protocol watches all interface up/down events. protocol device { scan time 10; # Scan interfaces every 10 seconds } # Static routes (again, there can be multiple instances, so that you # can disable/enable various groups of static routes on the fly). protocol static { # disabled; # Disable by default route 123.123.123.0/24 via "eth0"; } protocol ospf CORE{ tick 2; ecmp; # rfc1583compat yes; router id 10.0.0.0; import filter OSPF_in; export filter OSPF_redistribute; # export none; area 0 { stub no; interface "eth0.4001", "eth0.4002" { # "To corp1"; hello 1; retransmit 6; cost 10; transmit delay 5; dead count 3; wait 50; type broadcast; authentication cryptographic; password "corp1_pass"; }; interface "lo" { stub yes; }; }; }

1 1