- Bird-users - Mailing Lists

GTSM (TTL security)/RFC 5082 support?
by Henrique de Moraes Holschuh 16 Aug '11

16 Aug '11

Is anyone currently working on adding GTSM support to bird? It should be possible to support it for both Linux and FreeBSD where available as a kernel-level supported socket option, and I am considering trying my hand at it as a way to get to know the bird codebase a bit better before we decide to deploy it at work... -- "One disk to rule them all, One disk to find them. One disk to bring them all and in the darkness grind them. In the Land of Redmond where the shadows lie." -- The Silicon Valley Tarot Henrique Holschuh

3 9

Activate back learning from user-defined routes in kernel protocol?
by Benjamin Cama 14 Aug '11

14 Aug '11

Hi, I am currently evaluating BIRD, and stumbled on some difficulty, which looks quite similar to the one encountered by Łukasz here: http://www.mail-archive.com/bird-users@atrey.karlin.mff.cuni.cz/msg01039.ht… In my case, it's l2tpns [1] that generates additional routes on a tun interface, and that get ignored by BIRD. As Ondrej showed, the reason why BIRD does that is because Linux IPv6 supposedly don't distinguish between “native” device routes and user defined one. And, as the comment tells us, the best way to fix that is to set the protocol on the added routes to something correct when adding them (which wouldn't be static in my case, but rather something else like “l2tp” on a custom proto #). I'm working on patching l2tpns to do that. Still, I wondered why this comment was here, because on my linux 3.0 box, “native” routes are actually set as “proto kernel”. I tested on a 2.6.32, and it's also the case. But no luck on a 2.6.26. So, I searched in the kernel git, and found the culprit : commit 4f72427998b105392e60bae7a6798a0c96fe4f0a which can be viewed here http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h… This dates back to may 2009, and coincidentally was done to please quagga ;-) And it appeared juste before 2.6.30. On the BIRD side, it's commit ff2857b03db854f99902766ad842aaa5fa29ec3c that included the workaround to ignore all PROTO_BOOT routes. See here https://git.nic.cz/redmine/projects/bird/repository/revisions/ff2857b03db85… And it actually happened after the kernel charge, in february 2010! So, I was wondering if you would consider getting back to the “old” behavior of not ignoring PROTO_BOOT routes on kernel >= 2.6.30? It would be quite a change, still, and it may look strange that BIRD behave differently on kernel before and after 2.6.30. But it would help people like me who struggled to get their routes taken into account, just to find after a painful search that it's because of a kernel “bug”. I don't know what's the right answer to this, but I wanted to inform you of this change in Linux's behavior, in case you didn't notice it. Regard, Benjamin [1] http://sourceforge.net/projects/l2tpns/

2 1

bird filter fails after upgrade from 1.3.1 -> 1.3.2
by Matthew Whittaker-Williams 08 Aug '11

08 Aug '11

Hi, I am having some issues with a filter of mine since my last upgrade to 1.3.2. Aug 6 00:00:04 bird: filters, line 72: AS path expected Aug 6 00:00:04 bird: filters, line 72: AS path expected filter national int set asnums; { # Exceptions asnums = [ 286, 47377, 8514, 5430, 6848, 3300]; # Failes on this line below: if ( bgp_path.last ~ asnums) then { accept; } else { reject; } } Changing it to : if bgp_path.last ~ [ 286, 47377, 8514, 5430, 6848, 3300 ] then { accept; } Then its all fine, has the way on setting int changed? Thanks Kind regards, Matthew

2 1

Merging bird and bird6
by Alexander V. Chernikov 07 Aug '11

07 Aug '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello list! Are there any plans to move from different daemons to single one? - From user point of view: We will live with both v4+v6 for the next 10+ years, having all dynamic routing in single place with single CLI is much more convenient. - From developer point of view: At the moment all code is based on ip_addr address type which is defined to be v4 OR v6 at compile time. FIBs API assume the same: IPv4 OR IPv6. Speaking about advanced (mostly MPLS-related) features (VPNv4, LDP, MP-BGP in general) - they all need fibs which are not bound to specific address family. At the moment developer has to implement such tables himself. using different processes for different AF makes some MP-BGP aspects very hard to implement. Protocols interaction is also bound to fibs. Even calling protocol hooks is bound to ip_addr and prefix. For example, I'm stuck in sending MPLS labels into kernel at the moment. Of course, I can add a custom hook to kernel protocol but than I will have to support another custom patch which should be avoided. Maybe it is time to start a discussion? I can supply patches if there is any chance for review/commit -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.14 (FreeBSD) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk4UzxwACgkQwcJ4iSZ1q2lJJQCfWNRQZF8/8Rtk1PmYVLZ2MhZl BJMAoKI1aYjuvafYnGP1rePFIZ7X1+ub =2/AD -----END PGP SIGNATURE-----

4 14

birdc: using command output in scripts
by Alexander V. Chernikov 31 Jul '11

31 Jul '11

Hello list! It is more or less useful to see 'BIRD X.X.X ready.' after cli starts. However, birdc is sometimes used in non-interactive way (like 'birdc configure' or 'birdc show route table XXXX for YYY'). Getting such string (in STDOUT, as other data) with command output is inconvenient. This behavior can be fixed with very trivial patch. Can someone consider getting it added to the tree?

2 1

"include" global option?
by Aris Lambrianidis 31 Jul '11

31 Jul '11

Greetings Ondrej and all, I was wondering whether an "include" general option could be implemented as to segment large BIRD configuration files to smaller parts, a lá BIND. This should be trivial to implement I suppose, and could really help with scripting and clarity. Thank you for your time, --Aris Lambrianidis

4 5

All protocols restarting on configure soft
by Stephen Holmes 28 Jul '11

28 Jul '11

BIRD Masters, BIRD 1.2.5 I recently updated my route server configuration to include a new set of BGP export filters when one peer wants to exclude routes to another peer. The filter is only applied to those selecting to exclude one another. When I pushed the new config with only two BGP sessions having the added filers, the rest untouched, and two new pipes were added, BIRD restarted all PIPE/BGP sessions after a 'configure soft'. Is this the expected behavior? Without export filter: protocol bgp RXXXXX { local as myas; neighbor xx.xx.xx.xx as XXXXX; import filter bgp_in_ASXXXXX; export all; route limit 500; table TXXXXX; rs client; start delay time 30; } With export filter: protocol bgp RYYYY { debug { filters }; local as myas; neighbor yy.yy.yy.yy as YYYY; import filter bgp_in_ASYYYY; export filter bgp_out_ASYYYY; route limit 1000; table TYYYY; rs client; start delay time 30; } Much Appreciated, Stephen

1 2

init script
by Ryan Whelan 27 Jul '11

27 Jul '11

Looking through the source, I don't see any init scripts for controlling the starting and stopping of Bird. Before I write something, I wanted to check if they already existed and I'm just missing them. Thanks

4 4

Advertising interface addresses via OSPF
by Ryan Whelan 27 Jul '11

27 Jul '11

I have 3 Linux machines connected to one another by point-to-point links. With the end point of each tunnel using a tun device, there are a total of 6 tun devices used on across the 3 machines. 2 per machine. Using OSPF, Bird is not advertising the addresses on the tun devices to the other nodes. This causes an issue because each device is unaware of the addresses on the tun devices on tunnels it is not connected to. In other words, node 'C' is unaware of the addresses on the tunnel between nodes 'A' and 'B'. Thats an issue because if the link between 'A' and 'B' fails, 'A' will get the routes 'B' knows about thru 'C', but 'B' does not know the tun address of 'A' thats connected to 'C' so all the traffic 'C' routes from 'A' to 'B' comes from an address 'B' can't route back too. (Sorry its so hard to follow) I've been able to alleviate it by adding a `stubnet` for each tun device on each machine, but I'm afraid that will become increasingly difficult to maintain as the number of nodes increases. Is there another way? I've been unsuccessful at getting bird to import (and advertise) the routes associated with the tun devices. (using the 'device' protocol I can get bird to import them, but ospf doesn't advertise them to the other nodes)

2 6

strange behaviour with direct protocol if two interface has the same ip address
by csszep 25 Jul '11

25 Jul '11

Hello! Openswan with klips stack use ipsec* interface which is configured to the same ip address as the physical interface. If i use the direct protocol and starting ipsec daemon the physical interface's connected route disappears. If i stopping ipsec daemon any connected route is missing from direct protocol. Simple test: bird.conf: debug protocols all; protocol direct { } protocol kernel { learn; persist; scan time 20; export all; } protocol device { scan time 10; } protocol static { } Ipsec stopped and after that bird started: BIRD 1.3.2 ready. bird> show interfaces lo up (index=1) MultiAccess AdminUp LinkUp Loopback Ignored MTU=16436 127.0.0.1/8 (Primary, scope host) eth0 up (index=2) MultiAccess Broadcast Multicast AdminUp LinkUp MTU=1500 10.0.2.15/24 (Primary, scope site) eth1 up (index=3) MultiAccess Broadcast Multicast AdminUp LinkUp MTU=1500 192.168.56.3/24 (Primary, scope site) ipsec0 DOWN (index=7) MultiAccess AdminDown LinkDown MTU=16260 ipsec1 DOWN (index=8) MultiAccess AdminDown LinkDown MTU=0 mast0 DOWN (index=9) MultiAccess AdminDown LinkDown MTU=0 bird> sho route 0.0.0.0/0 via 10.0.2.2 on eth0 [kernel1 16:16] * (10) 10.0.2.0/24 dev eth0 [direct1 16:16] * (240) 192.168.56.0/24 dev eth1 [direct1 16:16] * (240) Ipsec started: bird> show interfaces lo up (index=1) MultiAccess AdminUp LinkUp Loopback Ignored MTU=16436 127.0.0.1/8 (Primary, scope host) eth0 up (index=2) MultiAccess Broadcast Multicast AdminUp LinkUp MTU=1500 10.0.2.15/24 (Primary, scope site) eth1 up (index=3) MultiAccess Broadcast Multicast AdminUp LinkUp MTU=1500 192.168.56.3/24 (Primary, scope site) ipsec0 up (index=7) MultiAccess AdminUp LinkUp MTU=16260 10.0.2.15/24 (Primary, scope site) ipsec1 DOWN (index=8) MultiAccess AdminDown LinkDown MTU=0 mast0 DOWN (index=9) MultiAccess AdminDown LinkDown MTU=0 bird> sho route 0.0.0.0/0 via 10.0.2.2 on eth0 [kernel1 16:16] * (10) 10.0.2.0/24 dev ipsec0 [direct1 16:19] * (240) <-------- connected route changed to ipsec0 192.168.56.0/24 dev eth1 [direct1 16:16] * (240) Ipsec stopped again: bird> show interfaces lo up (index=1) MultiAccess AdminUp LinkUp Loopback Ignored MTU=16436 127.0.0.1/8 (Primary, scope host) eth0 up (index=2) MultiAccess Broadcast Multicast AdminUp LinkUp MTU=1500 10.0.2.15/24 (Primary, scope site) eth1 up (index=3) MultiAccess Broadcast Multicast AdminUp LinkUp MTU=1500 192.168.56.3/24 (Primary, scope site) ipsec0 DOWN (index=7) MultiAccess AdminDown LinkDown MTU=16260 ipsec1 DOWN (index=8) MultiAccess AdminDown LinkDown MTU=0 mast0 DOWN (index=9) bird> show route 0.0.0.0/0 via 10.0.2.2 on eth0 [kernel1 16:16] * (10) 192.168.56.0/24 dev eth1 [direct1 16:16] * (240) Connected route from eth0 is missing. Log: Jul 23 16:31:19 debianvm1 ipsec_setup: Starting Openswan IPsec 2.6.28... Jul 23 16:31:19 debianvm1 ipsec_setup: Using KLIPS/legacy stack Jul 23 16:31:20 debianvm1 ipsec_setup: KLIPS debug `none' Jul 23 16:31:20 debianvm1 ipsec_setup: KLIPS ipsec0 on eth0 10.0.2.15/255.255.255.0 broadcast 10.0.2.255 Jul 23 16:31:20 debianvm1 bird: static1 < interface ipsec0 goes up Jul 23 16:31:20 debianvm1 bird: direct1 < primary address 10.0.0.0/8 on interface ipsec0 added Jul 23 16:31:20 debianvm1 bird: direct1 > added [best] 10.0.0.0/8 dev ipsec0 Jul 23 16:31:20 debianvm1 bird: kernel1 < rejected by protocol 10.0.0.0/8 dev ipsec0 Jul 23 16:31:20 debianvm1 bird: direct1 < primary address 10.0.0.0/8 on interface ipsec0 removed Jul 23 16:31:20 debianvm1 bird: direct1 > removed [sole] 10.0.0.0/8 dev ipsec0 Jul 23 16:31:20 debianvm1 bird: static1 < interface ipsec0 goes down Jul 23 16:31:20 debianvm1 ipsec_setup: ...Openswan IPsec started Jul 23 16:31:20 debianvm1 ipsec__plutorun: adjusting ipsec.d to /etc/ipsec.d Jul 23 16:31:20 debianvm1 ipsec__plutorun: 003 NAT-Traversal: Trying new style NAT-T Jul 23 16:31:22 debianvm1 bird: device1: Scanning interfaces Jul 23 16:31:22 debianvm1 bird: static1 < interface ipsec0 goes up Jul 23 16:31:22 debianvm1 bird: direct1 < primary address 10.0.2.0/24 on interface ipsec0 added Jul 23 16:31:22 debianvm1 bird: direct1 > added 10.0.2.0/24 dev ipsec0 Jul 23 16:31:22 debianvm1 bird: kernel1 < rejected by protocol 10.0.2.0/24 dev ipsec0 Jul 23 16:31:32 debianvm1 bird: device1: Scanning interfaces Jul 23 16:31:32 debianvm1 bird: kernel1: Scanning routing table Jul 23 16:31:32 debianvm1 bird: kernel1: 0.0.0.0/0: [alien] seen Jul 23 16:31:32 debianvm1 bird: kernel1: Pruning table master Jul 23 16:31:32 debianvm1 bird: kernel1: Pruning inherited routes Jul 23 16:31:35 debianvm1 ipsec_setup: Stopping Openswan IPsec... Jul 23 16:31:37 debianvm1 bird: direct1 < primary address 10.0.2.0/24 on interface ipsec0 removed Jul 23 16:31:37 debianvm1 bird: direct1 > removed [sole] 10.0.2.0/24 dev ipsec0 Jul 23 16:31:37 debianvm1 bird: static1 < interface ipsec0 goes down Jul 23 16:31:37 debianvm1 ipsec_setup: ...Openswan IPsec stopped Jul 23 16:31:41 debianvm1 bird: device1: Scanning interfaces Jul 23 16:31:51 debianvm1 bird: device1: Scanning interfaces Jul 23 16:31:51 debianvm1 bird: kernel1: Scanning routing table Jul 23 16:31:51 debianvm1 bird: kernel1: 0.0.0.0/0: [alien] seen Jul 23 16:31:51 debianvm1 bird: kernel1: Pruning table master Jul 23 16:31:51 debianvm1 bird: kernel1: Pruning inherited routes thx Csszep

2 1