- Bird-users - Mailing Lists

Re: BIRD is not prepending ASN on EBGP export.
by Ochalski, Radoslaw 10 Oct '24

10 Oct '24

Thanks Ondrej, So for the routes originating in AS20940, downstream will not be aware of AS20940 in the as-path it will only know private AS4290006033. Kind Regards, Radek On 10/8/24, 5:18 PM, "Ondrej Zajicek" <santiago(a)crfreenet.org <mailto:santiago@crfreenet.org>> wrote: !-------------------------------------------------------------------| This Message Is From an External Sender This message came from outside your organization. |-------------------------------------------------------------------! On Tue, Oct 08, 2024 at 04:46:07PM +0200, Alexander Zubkov via Bird-users wrote: > Hi Radoslaw, > > Do I get it right, that you have 2 bgp peerings here. First your route > passes this peering: > AS8075 <-> AS20940 > then it passes other peering: > AS4290006033 <-> AS4290006002 > > Then it is an expected behaviour. Because the ASN is prepended when > route is exported over eBGP session. And the local ASN is prepended. > So you see that when you receive the route over the first peering, it > is prepended with AS8075. Then it goes over the second peering, where > it is prepended with AS4290006033. Yes, that is true. I would add that one is not supposed to have different local ASNs for different BGP instances that form coherent BGP router, unless it is configured as BGP confederation or manually patched by filters. -- Elen sila lumenn' omentielvo Ondrej 'Santiago' Zajicek (email: santiago(a)crfreenet.org <mailto:santiago@crfreenet.org>) "To err is human -- to blame it on a computer is even more so."

3 5

FW: BIRD is not prepending ASN on EBGP export.
by Ochalski, Radoslaw 08 Oct '24

08 Oct '24

Hi, We have observed strange behavior where BIRD is not adding ASN on EBGP export. Route is received on IBGP session within AS20940: r04.border01.lon03.fab > bird show config template bgp 4INTERECOR_ROUTERS template bgp '4INTERECOR_ROUTERS' { local as 20940; neighbor as 20940; r04.border01.lon03.fab> show route protocol 23.210.49.60__r24.lon02.ien for 20.135.0.0/16 all Executing "/usr/sbin/birdc show route protocol '23.210.49.60__r24.lon02.ien' for 20.135.0.0/16 all" Table master4: 20.135.0.0/16 unicast [23.210.49.60__r24.lon02.ien 2024-10-07] (100) [AS8075i] via 23.210.49.60 on ae1 Type: BGP univ BGP.origin: IGP BGP.as_path: 8075 BGP.next_hop: 23.210.49.60 BGP.med: 4294967294 BGP.local_pref: 350 Route ASPATH: 8075 which is expected. We are exporting this route on EBGP session from private ASN 4290006033 <-> to private ASN: 4290006002: r04.border01.lon03.fab> show route export 2a02:26f0:1880:3702::1__r01.stem01 for 20.135.0.0/16 all Executing "/usr/sbin/birdc show route export '2a02:26f0:1880:3702::1__r01.stem01' for 20.135.0.0/16 all" Table master4: 20.135.0.0/16 unicast [2.22.144.250__r01.sdn 2024-10-07 from 2.22.144.250] * (100) [AS8075i] via 23.210.49.60 on ae1 Type: BGP univ BGP.origin: IGP BGP.as_path: 8075 BGP.next_hop: 23.210.49.60 BGP.med: 4294967294 BGP.local_pref: 777 Route is received on 4290006002: r01.stem01.lon03.fab> show route protocol 2a02:26f0:1880:3702::__r04.border01 for 20.135.0.0/16 all Executing "/usr/sbin/birdc show route protocol '2a02:26f0:1880:3702::__r04.border01' for 20.135.0.0/16 all" Table master4: 20.135.0.0/16 unicast [2a02:26f0:1880:3702::__r04.border01 2024-10-07] * (100) [AS8075i] via 2a02:26f0:1880:3702:: on ae4 Type: BGP univ BGP.origin: IGP BGP.as_path: 4290006033 8075 BGP.next_hop: 2a02:26f0:1880:3702:: fe80::b6db:91ff:fe8b:1eb4 BGP.local_pref: 100 ASPATH: 4290006033 8075 We are missing AS 20940 on which essentially this prefix is received in our network!? Is this behavior expected? Kind Regards, Radek Ochalski

3 2

Link-local address change in Blackhole routing
by ushiroz＠ate-mahoroba.jp 05 Oct '24

05 Oct '24

Hi I am aware that IPv4 next-hop / IPv6 next-hop global can be achieved by changing bgp_next_hop when Blackhole Community is applied. I believe that if we notify the next-hop of only global, the link-local in the FIB will remain the same as the peer's address even though the RIB has changed, resulting in unintended behavior, and I believe that the link-local address needs to be changed. Is it possible to change the link-local address in Bird?

2 2

[patch] Add TCP-MD5 authentication option for RPKI protocol
by Job Snijders 03 Oct '24

03 Oct '24

Dear BIRD community, I think many of us use good ole' TCP-MD5 to authenticate IBGP sessions, even if TCP-MD5 is imperfect from key rolling perspective. TCP-MD5 is easy to configure, and supported on a broad range of platforms, and beats doing nothing. RPKI-To-Router (RTR) sessions seem to be similar security-sensitivity as IBGP sessions, but at the moment of writing BIRD offers a choice of either "plain TCP" (meh) or "SSH" (secure, albeit a bit more hassle to set up than TCP-MD5). I'd like to add TCP-MD5 as another option. TCP-MD5 for RTR is specified through RFC 6810 section 7.3 and RFC 8210 section 9.3. Minimal bird.conf: router id 10.0.0.1; roa4 table r4; roa6 table r6; protocol rpki rpki1 { roa4 { table r4; }; roa6 { table r6; }; remote 165.254.255.17 port 8282; transport tcp password "test"; /* password keyword is new here! */ debug all; } This config was tested on Linux against a WIP based on StayRTR, tcpdump suggests this works as expected. job@josephine:~/bird$ ./birdc -s /tmp/bird show protocols all BIRD v2.15.1-29-g35f74c4b-x ready. Name Proto Table State Since Info rpki1 RPKI --- up 15:16:41.677 Established Cache server: 165.254.255.17 Cache port: 8282 Status: Established Transport: TCP-MD5 I can leave the server at 165.254.255.17 port 8282 with TCP-MD5 authentication password "test" running for a bit so others can more easily test the below patch without having to compile/run StayRTR. Below is a changeset for your consideration! Feedback is welcome. Kind regards, Job ps. It seems TCP-MD5 for BGP doesn't work out-of-the-box on OpenBSD, downstream porters apply a few minimal patches: https://github.com/openbsd/ports/tree/master/net/bird/2/patches perhaps these can be upstreamed so that we can work towards TCP-MD5 RTR support in BIRD on OpenBSD as well? :-) Author: Job Snijders <job(a)fastly.com> Date: Wed Sep 18 10:46:06 2024 +0000 Add RTR TCP-MD5 authentication support diff --git a/doc/bird.sgml b/doc/bird.sgml index e2050c13..07bedef9 100644 --- a/doc/bird.sgml +++ b/doc/bird.sgml @@ -5735,7 +5735,7 @@ protocol rpki [<name>] { refresh [keep] <num>; retry [keep] <num>; expire [keep] <num>; - transport tcp; + transport tcp [password <m/string/]; transport ssh { bird private key "</path/to/id_rsa>"; remote public key "</path/to/known_host>"; @@ -5791,9 +5791,10 @@ specify both channels. instead. This may be useful for implementing loose RPKI check for blackholes. Default: disabled. - <tag>transport tcp</tag> Unprotected transport over TCP. It's a default - transport. Should be used only on secure private networks. - Default: tcp + <tag>transport tcp [password <m/string/]</tag> transport over TCP. It's + the default transport. Should be used only on secure private networks. + If a password is specified, the session is authenticated using TCP-MD5 + (<rfc id="2385">). Default: tcp, no authentication. <tag>transport ssh { <m/SSH transport options.../ }</tag> It enables a SSHv2 transport encryption. Cannot be combined with a TCP transport. diff --git a/proto/rpki/config.Y b/proto/rpki/config.Y index 769ebb2c..a0b678be 100644 --- a/proto/rpki/config.Y +++ b/proto/rpki/config.Y @@ -32,7 +32,8 @@ rpki_check_unused_transport(void) CF_DECLS CF_KEYWORDS(RPKI, REMOTE, BIRD, PRIVATE, PUBLIC, KEY, TCP, SSH, TRANSPORT, USER, - RETRY, REFRESH, EXPIRE, KEEP, IGNORE, MAX, LENGTH, LOCAL, ADDRESS) + RETRY, REFRESH, EXPIRE, KEEP, IGNORE, MAX, LENGTH, LOCAL, ADDRESS, + PASSWORD) %type <i> rpki_keep_interval @@ -109,6 +110,7 @@ rpki_cache_addr: text_or_ipa rpki_transport: TCP rpki_transport_tcp_init + | TCP PASSWORD text rpki_transport_tcp_init { RPKI_CFG->password = $3; } | SSH rpki_transport_ssh_init '{' rpki_transport_ssh_opts '}' rpki_transport_ssh_check ; diff --git a/proto/rpki/rpki.c b/proto/rpki/rpki.c index 4ec48e3b..d793ee56 100644 --- a/proto/rpki/rpki.c +++ b/proto/rpki/rpki.c @@ -673,6 +673,12 @@ rpki_reconfigure_cache(struct rpki_proto *p UNUSED, struct rpki_cache *cache, st return NEED_RESTART; } + if (old->password != new->password) + { + CACHE_TRACE(D_EVENTS, cache, "MD5 authentication changed"); + return NEED_RESTART; + } + if (old->tr_config.type != new->tr_config.type) { CACHE_TRACE(D_EVENTS, cache, "Transport type changed"); @@ -843,7 +849,10 @@ rpki_show_proto_info(struct proto *P) break; #endif case RPKI_TR_TCP: - transport_name = "Unprotected over TCP"; + if (cf->password == NULL) + transport_name = "Unprotected over TCP"; + else + transport_name = "TCP-MD5"; default_port = RPKI_TCP_PORT; break; }; diff --git a/proto/rpki/rpki.h b/proto/rpki/rpki.h index e67eb0e3..d8fd72ce 100644 --- a/proto/rpki/rpki.h +++ b/proto/rpki/rpki.h @@ -127,6 +127,7 @@ struct rpki_config { u8 keep_retry_interval:1; /* Do not overwrite retry interval by cache server update */ u8 keep_expire_interval:1; /* Do not overwrite expire interval by cache server update */ u8 ignore_max_length:1; /* Ignore received max length and use MAX_PREFIX_LENGTH instead */ + const char *password; /* Password used for MD5 authentication */ }; void rpki_check_config(struct rpki_config *cf); diff --git a/proto/rpki/transport.c b/proto/rpki/transport.c index 26571977..46b00822 100644 --- a/proto/rpki/transport.c +++ b/proto/rpki/transport.c @@ -88,6 +88,9 @@ rpki_tr_open(struct rpki_tr_sock *tr) sk->tos = IP_PREC_INTERNET_CONTROL; sk->vrf = cache->p->p.vrf; + if (cf->tr_config.type == RPKI_TR_TCP && cf->password != NULL) + sk->password = cf->password; + if (ipa_zero(sk->daddr) && sk->host) { const char *err_msg;

2 5

Paths Limit for Multiple Paths in BGP
by Donatas Abraitis 02 Oct '24

02 Oct '24

Hi, I hope this is the right place to ask for feature requests. Would you mind adding this [1]draft to your TODO (/ feature) list? I've heard some [2]people are already missing (= would benefit) this draft. Thanks! [1] - https://datatracker.ietf.org/doc/html/draft-abraitis-idr-addpath-paths-limit [2] - https://ripe88.ripe.net/wp-content/uploads/presentations/23-RIPE88-Communit… -- Donatas

3 5

router_id or source neighbor in import/export filter for dynamic BGP peers
by Mikhail Mayorov 27 Sep '24

27 Sep '24

Hi! I use dynamic BGP peers in my RR. It's very simple and comfortable. import/export filters are same for all dynamic neighbors. How to determine a neighbor? Using what variables? I will plan use filters likes that, but I can't find what I need send to function "getneighbortype"..... function getneighbortype(ip neighbor) -> int { case neighbor { 1.1.1.1 : return 1; # router with big RIR 1.1.1.2 : return 3; # router with small RIR else: return 0; # unknown router } } filter fromclientrr { int nt = getneighbortype(*router id / src neighbor*); if nt = 0 then reject; bgp_large_community.add((0,1,nt)); accept; } filter toclientrr { int nt = getneighbortype(*router id / src neighbor*); if net.len = 0 && nt ~ [0, 3] then accept; if nt ~ [1] then accept; reject; } -- Regards, Mikhail Mayorov

4 5

Info about eBGP/iBGP
by Ponikierski, Grzegorz 20 Sep '24

20 Sep '24

Hi all! Am I blind (possible) or Bird doesn’t show if route is eBGP or iBGP? If it shows it, then can you please help me to see it? Regards, Grzegorz

4 4

interface to BGP
by alpha_one_x86 19 Sep '24

19 Sep '24

Hi, I try export 192.0.2.0/24 to BGP into a test env. Why not work? I attach my config file root@fake-asn1:~# birdc show protocol all BIRD 1.6.8 ready. name proto table state since info kernel1 Kernel master up 20:08:35 Preference: 10 Input filter: ACCEPT Output filter: ACCEPT Routes: 0 imported, 0 exported, 0 preferred Route change stats: received rejected filtered ignored accepted Import updates: 0 0 0 0 0 Import withdraws: 0 0 --- 0 0 Export updates: 0 0 0 --- 0 Export withdraws: 0 --- --- --- 0 device1 Device master up 20:08:35 Preference: 240 Input filter: ACCEPT Output filter: REJECT Routes: 0 imported, 0 exported, 0 preferred Route change stats: received rejected filtered ignored accepted Import updates: 0 0 0 0 0 Import withdraws: 0 0 --- 0 0 Export updates: 0 0 0 --- 0 Export withdraws: 0 --- --- --- 0 IXP BGP master up 20:08:40 Established Preference: 100 Input filter: (unnamed) Output filter: (unnamed) Routes: 0 imported, 0 exported, 0 preferred Route change stats: received rejected filtered ignored accepted Import updates: 0 0 0 0 0 Import withdraws: 0 0 --- 0 0 Export updates: 0 0 0 --- 0 Export withdraws: 0 --- --- --- 0 BGP state: Established Neighbor address: 172.23.0.1 Neighbor AS: 65501 Neighbor ID: 172.23.0.1 Neighbor caps: refresh enhanced-refresh restart-aware llgr-aware AS4 Session: external AS4 Source address: 172.23.1.0 Hold timer: 128/240 Keepalive timer: 8/80 root@fake-asn1:~# route -n -4 Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 172.23.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0 192.0.2.0 0.0.0.0 255.255.255.0 U 0 0 0 ethFAKE -- alpha_one_x86/BRULE Herman<alpha_one_x86(a)first-world.info> Main developer of Supercopier/Ultracopier/CatchChallenger, Esourcing and server management IT, OS, technologies, research & development, security and business department

2 1

Using bfd {} casues error messages
by Nico Schottelius 16 Sep '24

16 Sep '24

Salut fellow bird users, we recently tried to simplify the bfd configuration and replaced our existing configuration with the following: -------------------------------------------------------------------------------- # Using BFD virtually everywhere, enable it globally protocol bfd { } ... protocol bgp incoming_r3ge { local as myas; direct; bfd on; ... -------------------------------------------------------------------------------- And now bird repots every second the following message: -------------------------------------------------------------------------------- 2024-08-08 11:00:15.727 <ERR> bfd1: Socket error: Destination address required -------------------------------------------------------------------------------- The router has various interfaces, some tunnel, some wireguard tunnel, some bridges, etc. and I have a bit trouble to spot, what is causing the error message. All interfaces that are used for BGP obviously have an IP address , but many bfd sessions are actually down that I'd expect to be up: -------------------------------------------------------------------------------- bird> show bfd sessions bfd1: IP address Interface State Since Interval Timeout 2a0a:e5c0:10:1:fa5e:3cff:fe2d:eb04 eth0 Down 2024-08-06 1.000 0.000 2a0a:5480:5:2::1 or3ge Down 2024-08-06 1.000 0.000 2a0a:e5c0:10:1::123 eth0 Up 2024-08-06 0.100 0.500 2a0a:e5c0:10:1:fa5e:3cff:fe2d:eafc eth0 Down 2024-08-06 1.000 0.000 2a0a:e5c0:32:1::1 oserver121 Down 2024-08-06 1.000 0.000 2a0a:e5c0:142:2::2 iserver138 Down 2024-08-06 1.000 0.000 2a0a:e5c0:142:3::2 iapured2 Down 2024-08-06 1.000 0.000 2a0a:e5c0:43:2::1 oserver138 Down 2024-08-06 1.000 0.000 2a0a:e5c0:142:1::2 ir3ge Down 2024-08-06 1.000 0.000 2a0a:e5c0:10:1::141 eth0 Up 2024-08-06 0.100 0.500 2a0a:e5c0:10:1::122 eth0 Up 2024-08-06 0.100 0.500 bird> -------------------------------------------------------------------------------- (excluding the two 2a0a:e5c0:10:1:.. ones, they don't have bfd enabled at the moment) Is using protocol bfd {} actually *not* supported? Best regards, Nico -- Sustainable and modern Infrastructures by ungleich.ch

4 4

How can I build / download the documentation?
by Marek Küthe 13 Sep '24

13 Sep '24

Hello, I would like to download or build the HTML (not the PDF) documentation. I have therefore cloned the Git repo and run `make docs` as described in the README, but I do not get any html or pdf files. I have attached my attempt. (I have tried to build it on a Debian 12 installation). How exactly do I build the documentation? Regards Marek Küthe -- Marek Küthe m.k(a)mk16.de er/ihm he/him

1 1