- Bird-users - Mailing Lists

[OSPF3 IPv6] error "wrong authentication length" between Proxmox 8 (Debian 12) (bird2 2.13.1) and MikroTik RouterOS 7.11 (stable)
by Chriztoffer (bird-users) 17 Oct '23

17 Oct '23

Hello bird-users list, I am seeking input into if anyone can provide suggestions on how to debug the below described error message. Cheers, Chriztoffer ********************************************************** The two proxmox nodes are running bird2 2.13.1 (compiled using apkg) and are connected to a MikroTik Router running RouterOS 7.11 directly on the same L2 domain. All three nodes can talk directly to each other on the same L2 domain. When trying to establish the OSPFv3 IPv6 connections between the three nodes. The connection from the two Proxmox nodes to the MikroTik Router fails with error "wrong authentication length" when logged by bird2. The OSPFv2 (IPv4) connection succeeds between all three nodes. OSPFv2 and OSPFv3 and setup with the same auth type (hmac sha512; cryptographic) and auth-id (0). Looking at the bird2 source code [0] did not really give me any clue to what the error is. [0]: https://gitlab.nic.cz/labs/bird/-/blob/master/proto/ospf/packet.c#L219 From looking at the PCAP I do indeed see the auth-data is not of the same length. ## MikroTik (MAC OUI 4c:5e:0c) OSPF Authentication Trailer Authentication Type: HMAC Cryptographic Authentication (1) Authentication Data Length: **64** Reserved: 0x0000 Security Association Identifier (SA ID): 0x0000 Cryptographic Sequence Number: 71479 Authentication Data: 021d5635eac7b92d28bfad6507bcda7702a5f1e323197be18d42d436dcae998f5ae462da… ## Bird 2.13.1 (MAC OUI 70:54:d2) OSPF Authentication Trailer Authentication Type: HMAC Cryptographic Authentication (1) Authentication Data Length: **80** Reserved: 0x0000 Security Association Identifier (SA ID): 0x0000 Cryptographic Sequence Number: 405 Authentication Data: 95c0ecfcd54a50e0da70acbf242181d3f45fce7dd1d8b6ccdb783d96c319c49e0cb77e5e… In this instance. I assume the error is located with MikroTik RouterOS 7.11 (stable). But still wanting to solicit feedback via the bird-users list regardless. ********************************************************** # ASCII L2 Diagram MikroTik -- Proxmox-2 | / | / Proxmox-1 # ASCII L1 Diagram MikroTik -- Proxmox-2 | | Proxmox-1 ********************************************************** # Proxmox 8 node 1 2023-08-19 19:47:15.579Z <AUTH> ospf3_main: Authentication failed for nbr {{MikroTik}} on vmbr0 - wrong authentication length (64) # Proxmox 8 node 2 2023-08-19 19:46:55.581Z <AUTH> ospf3_main: Authentication failed for nbr {{MikroTik}} on vmbr0 - wrong authentication length (64) # MikroTik { version: 3 router-id: {{MikroTik}} } ospf3-backbone { 0.0.0.0 } interface { broadcast fe80::4e5e:cff:fexx:xxxx%bridge1 } corrupted auth trailer from fe80::7254:d2ff:fexx:xxxx%bridge1 ********************************************************** # MikroTik RouterOS 7.11 (stable) OSPFv6 IPv6 configuration /routing ospf instance add disabled=no in-filter-chain=v6private name=ospf3-main \ originate-default=if-installed out-filter-chain=ospf3-out redistribute=\ connected,static,dhcp router-id=loopback routing-table=main version=3 /routing ospf area add disabled=no instance=ospf3-main name=ospf3-backbone /routing ospf interface-template add area=ospf3-backbone auth=sha512 \ auth-id=0 auth-key=Zzma9IOrDa7pg9iJwi439nfIZ59oQsXeZBdNb-Upj631GG8 \ dead-interval=20s disabled=no \ hello-interval=5s interfaces=bridge1 retransmit-interval=2s ********************************************************** # Bird 2.13.1 OSPFv6 (IPv6) configuration on Proxmox 8.x (Debian 12) protocol ospf v3 ospf3_main { graceful restart on; graceful restart time 300; ipv6 { import all; export filter { if is_self_network_6() && source ~ [RTS_STATIC] then accept; else reject; }; }; area 0 { interface "vmbr0" { type broadcast; hello 5; retransmit 2; wait 10; dead 20; authentication cryptographic; password "Zzma9IOrDa7pg9iJwi439nfIZ59oQsXeZBdNb-Upj631GG8" { id 0; algorithm hmac sha512; }; check link on; }; interface "lo" { check link no; strict nonbroadcast yes; type pointopoint; }; interface "*" { stub; }; }; } ********************************************************** # PCAP https://drive.google.com/file/d/1wDimK0WppM6JvIJIEeEMmFfvllGjj54Q/view?usp=…

3 2

Transition from BIRD 1 to 2
by Robert Sander 17 Oct '23

17 Oct '23

Hi, please help me understand the configuration logic for BIRD2. In BIRD 1 we have a config file common.conf that gets included from bird.conf and bird6.conf. It holds common configuration applicable to both IPv4 and IPv6 like this: table bgpext; protocol pipe p_bgpext { table master; peer table bgpext; import all; export none; } For BIRD2 I seem to have to rewrite that simple configuration to: ipv4 table bgpext4; ipv6 table bgpext6; protocol pipe p_bgpext4 { table master4; peer table bgpext4; import all; export none; } protocol pipe p_bgpext6 { table master6; peer table bgpext6; import all; export none; } Why do I have to double the configuration now? Did I miss something? This is a quite simple example. There are more complex protocol templates and filter functions that all would have to be doubled. Kindest Regards -- Robert Sander Heinlein Consulting GmbH Schwedter Str. 8/9b, 10119 Berlin https://www.heinlein-support.de Tel: 030 / 405051-43 Fax: 030 / 405051-19 Amtsgericht Berlin-Charlottenburg - HRB 220009 B Geschäftsführer: Peer Heinlein - Sitz: Berlin

4 6

Low voltage server for bird.
by Mike Neo 15 Oct '23

15 Oct '23

Hello, I am looking for a 1U rack platform with 2x PSU with low power consumption for a bird-based bgp router (Ubuntu). The supported traffic is expected to be ~1-2Gbps. Can anyone recommend a tested solution? Thank you in advance. Mike

3 2

Use bgp_aigp instead of bgp_med to select the optimal route based on delay
by Brandon Zhi 13 Oct '23

13 Oct '23

Hi all, I plan to use bgp_aigp instead of bgp_med to find the optimal route based on incremental pings per node. For example, if the delay between one node and another node is 40, then bgp_aigp increases by 40 after passing this ibgp. void bgp_aigp [O] This attribute contains accumulated IGP metric, which is a total distance to the destination through multiple autonomous systems. Currently, the attribute is not accessible from filters. But it seems I can't modify this value? Best Regard, *Brandon Zhi* HUIZE LTD www.huize.asia <https://huize.asia/>| www.ixp.su | Twitter This e-mail and any attachments or any reproduction of this e-mail in whatever manner are confidential and for the use of the addressee(s) only. HUIZE LTD can’t take any liability and guarantee of the text of the email message and virus.

3 4

Question Verification regarding UDP port of BFD
by Irene Lalioti 10 Oct '23

10 Oct '23

Hello dear Maria, Marian, and BIrd community, I would like to ask you your feedback regarding an issue a member of us has indicated. That member has stumbled upon a non-RFC compliant BFD source port with result their CISCO router to drop the BFD packets. Is it that Bird does not or does change the code to use a different source port? We would need to see how to workaround this issue. Předem moc děkuji!! Hesky den! Irene -- Irene Lalioti Network Engineer Fondation RESTENA 2, avenue de l'Université L-4365 Esch/Alzette Tel: +352 424409 1 Fax: +352 422473 This email may contain information for limited distribution only, please treat accordingly.

2 2

BIRD 2.14
by Ondrej Filip 09 Oct '23

09 Oct '23

Dear BIRD users, we're releasing a new version 2.14. I thank my colleagues for this this. Version 2.14 o MPLS subsystem o L3VPN: BGP/MPLS VPNs (RFC 4364) o BGP: Access to unknown route attributes o RAdv: Custom options o Babel: RTT metric extension o BMP: Refactored route monitoring o BMP: Multiple instances of BMP protocol o BMP: Both pre-policy and post-policy monitoring o Experimental route aggregation o Filter: Method framework o Filter: Functions have return type statements o Filter: New bytestring data type o Kernel: Option to learn kernel routes o Many bugfixes and improvements Notes: User-defined filter functions that return values now should have return type statements. We still accept functions without such statement, if they could be properly typed. For loops allowed to use both existing iterator variables or ones defined in the for statement. We no longer support the first case, all iterator variables must be defined in the for statement (e.g. 'for int i in bgp_path ...'). Due to oversight, VRF interfaces were not included in respective VRFs, this is fixed now. Happy routing! Ondrej

6 9

kernel: does not learn routes with RTPROT_KERNEL
by Pavel Šorejs 08 Oct '23

08 Oct '23

Hi i have following problem - the kernel protocol ignores routes with RTPROT_KERNEL source. Is there some particular reason why this is so? Why am i asking? I use BIRD in linux container orchestration context (Kubernetes) in conjunction with cilium project (https://cilium.io/) Lately they discovered, that systemd likes to mess with their routes and did a change to insert their routes with RTPROT_KERNEL source flag. This way, systemd doesn't try to mess with their routes. Side effect of this is that my installation got broken as BIRD ignores such routes. Now i don't know where to start - either they are wrong with using RTPROT_KERNEL flag in the first place, or BIRD is wrong by ignoring such routes. So i am trying here first. Also there was some discussion in the past https://bird.network.cz/pipermail/bird-users/2013-August/008519.html, which just died. Do anybody have some suggestions? Thank You Pavel Sorejs

3 7

bird rip question
by Miklós Máté 07 Oct '23

07 Oct '23

Hi, I'm trying to set up BIRD to demonstrate RIP in a Mininet environment, but it doesn't seem to work. I'm using the attached configs. The OSPF one works properly, but with RIP it only sends a Request message on startup, and then nothing. According to the log the Request is received properly, but no Response is sent, and the periodic timer doesn't do anything either. This is the stderr log on node B when I start BIRD on the neighboring node A: 2023-10-06 15:50:03.951 <TRACE> rip1: New neighbor 10.0.1.1 on ethBA 2023-10-06 15:50:03.951 <TRACE> rip1: Request received from 10.0.1.1 on ethBA 2023-10-06 15:50:12.156 <TRACE> rip1: Interface timer fired for ethBA 2023-10-06 15:50:12.156 <TRACE> rip1: Sending regular updates for ethBA 2023-10-06 15:50:12.453 <TRACE> rip1: Interface timer fired for ethBC 2023-10-06 15:50:12.453 <TRACE> rip1: Sending regular updates for ethBC 2023-10-06 15:50:13.163 <TRACE> device1: Scanning interfaces 2023-10-06 15:50:18.163 <TRACE> device1: Scanning interfaces 2023-10-06 15:50:18.163 <TRACE> kernel1: Scanning routing table 2023-10-06 15:50:18.163 <TRACE> kernel1: Pruning table master4 2023-10-06 15:50:18.163 <TRACE> kernel1: Pruning inherited routes 2023-10-06 15:50:22.156 <TRACE> rip1: Interface timer fired for ethBA 2023-10-06 15:50:22.156 <TRACE> rip1: Sending regular updates for ethBA 2023-10-06 15:50:22.453 <TRACE> rip1: Interface timer fired for ethBC 2023-10-06 15:50:22.453 <TRACE> rip1: Sending regular updates for ethBC I'm completely out of ideas. The sample configs don't have anything that is not in my config. What am I missing? Regards, Miklós Máté -- #!/usr/bin/perl m:[A-Z]:?@;:@?=(@;=>$_)for(split$,,[A-Z]);push@@,lc(pack( q=c*==>ord($;[$[+1])-chr(ord@;)));$_?${@}[++$#{@}]:$,=chr (ord($@[$^W])-($#{y-++--;qq,;,}>>$_))for(0,1);print@@=>$/

2 2

Possibly a way to match Kernel.source field?
by Nigel Kukard 30 Sep '23

30 Sep '23

Hi there fellow BIRD users, Does anyone perhaps know if there is a way to match this field? I'm trying to create a filter to prevent these from being imported into my one table which I feed into OSPF6. I've tried, Kernel.source and kernel.source sadly with no luck. This item corresponds to the "ip route" protocol field. Kind Regards Nigel

3 3

Doing something wrong with VRF's
by Nigel Kukard 28 Sep '23

28 Sep '23

Hi there, I'm wondering if someone could point out what I'm doing wrong here? all my routes are being added to the system main table and not my VRF. I could swear I had this working 100% (I took my config and added vrf "vrf0" to each protocol), i then regenerated my config file using my software, rebooted and its not worked since. I can't seem to find what I broke. Here is my interfaces... the t0p0 and t0p1 are ip6gretap's, dummy0 is just a loopback dummy interface. All are slave to vrf0. lgtm. 4: dummy0: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue master vrf0 state UNKNOWN mode DEFAULT group default qlen 1000 link/ether fe:dc:20:04:15:27 brd ff:ff:ff:ff:ff:ff 5: vrf0: <NOARP,MASTER,UP,LOWER_UP> mtu 65575 qdisc noqueue state UP mode DEFAULT group default qlen 1000 link/ether 8a:8e:21:3d:c4:c9 brd ff:ff:ff:ff:ff:ff 8: t0p0@e0p0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1430 qdisc fq_codel master vrf0 state UNKNOWN mode DEFAULT group default qlen 1000 link/ether b2:da:ee:78:04:1f brd ff:ff:ff:ff:ff:ff 9: t0p1@e0p0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1430 qdisc fq_codel master vrf0 state UNKNOWN mode DEFAULT group default qlen 1000 link/ether fa:61:19:72:65:d8 brd ff:ff:ff:ff:ff:ff the output from ip rule is this... lgtm. 1000: from all lookup [l3mdev-table] The routes within the VRF look like this, lgtm ... ip route show vrf vrf0 X/30 dev t0p0 proto kernel scope link src A Y/30 dev t0p1 proto kernel scope link src B Z/27 dev dummy0 proto kernel scope link src C My main routing table looks like this... lgtm, I don't even have the interfaces or anything configured for them in the main table outside the VRF. default via 169.254.1.1 dev e0p0 proto static metric 1000 169.254.1.1 dev e0p0 proto kernel scope link src D metric 256 E dev e0p0 proto kernel metric 256 pref medium F via fe80::1 dev e0p0 proto static metric 300 pref medium G via fe80::1 dev e0p0 proto static metric 300 pref medium fe80::/64 dev e0p0 proto kernel metric 256 pref medium default via fe80::1 dev e0p0 proto static metric 1000 pref medium My bird config is below ... I made sure to add vrf "vrf0" to all protocols. I searched the mailing list and I can't see what I did wrong here. OSPF comes up fine, I can ping inside the VRF fine, but all my routes are being added to the main system table. I cut out the filters, they're not doing anything interesting. Despite BGP being mentioned in the config below, I don't have it configured atm. # Kernel Table ipv4 table t_kernel4; ipv6 table t_kernel6; # Direct Tables: ipv4 table t_direct4; ipv6 table t_direct6; # OSPF Tables ipv4 table t_ospf4; ipv6 table t_ospf6; ... protocol kernel kernel4 { vrf "vrf0"; description "Kernel protocol for IPv4"; metric 600; # Set the BIRD metric to be used when creating kernel routes to fall in line with our OS learn; # Learn routes from the kernel persist; # Dont remove routes on BIRD shutdown merge paths on; # Merge similar BGP paths into a multi-hop ipv4 { table t_kernel4; export all; import all; }; }; protocol kernel kernel6 { vrf "vrf0"; description "Kernel protocol for IPv6"; metric 600; # Set the BIRD metric to be used when creating kernel routes to fall in line with our OS learn; # Learn routes from the kernel persist; # Dont remove routes on BIRD shutdown merge paths on; # Merge similar BGP paths into a multi-hop ipv6 { table t_kernel6; export all; import all; }; }; protocol pipe p_master4_to_kernel4 { vrf "vrf0"; description "Pipe from master4 to t_kernel4"; table master4; peer table t_kernel4; export filter f_master4_kernel4_export; import filter f_master4_kernel4_import; }; protocol pipe p_master6_to_kernel6 { vrf "vrf0"; description "Pipe from master6 to t_kernel6"; table master6; peer table t_kernel6; export filter f_master6_kernel6_export; import filter f_master6_kernel6_import; }; protocol device { vrf "vrf0"; description "Device protocol"; scan time 10; }; protocol direct direct4 { vrf "vrf0"; description "Direct protocol for IPv4"; ipv4 { table t_direct4; export none; import all; }; }; protocol direct direct6 { vrf "vrf0"; description "Direct protocol for IPv6"; ipv6 { table t_direct6; export none; import all; }; }; protocol pipe p_master4_to_direct4 { vrf "vrf0"; description "Pipe from master4 to t_direct4"; table master4; peer table t_direct4; export none; import all; }; protocol pipe p_master6_to_direct6 { vrf "vrf0"; description "Pipe from master6 to t_direct6"; table master6; peer table t_direct6; export none; import all; }; protocol ospf v2 ospf4 { vrf "vrf0"; description "OSPF protocol for IPv4"; ipv4 { table t_ospf4; export filter f_ospf_export; import filter f_ospf_import; }; area 0 { interface "dummy0" { cost 10; ecmp weight 1; stub; }; interface "t0p0" { cost 1000; ecmp weight 1; }; interface "t0p1" { cost 1000; ecmp weight 1; }; }; }; protocol ospf v3 ospf6 { vrf "vrf0"; description "OSPF protocol for IPv6"; ipv6 { table t_ospf6; export filter f_ospf_export; import filter f_ospf_import; }; area 0 { interface "dummy0" { cost 10; ecmp weight 1; stub; }; interface "t0p0" { cost 1000; ecmp weight 1; }; interface "t0p1" { cost 1000; ecmp weight 1; }; }; }; protocol pipe p_ospf4_to_master4 { vrf "vrf0"; description "Pipe from t_ospf4 to master4"; table t_ospf4; peer table master4; export filter f_ospf_master_export; import filter f_ospf_master_import; }; protocol pipe p_ospf6_to_master6 { vrf "vrf0"; description "Pipe from t_ospf6 to master6"; table t_ospf6; peer table master6; export filter f_ospf_master_export; import filter f_ospf_master_import; }; Kind Regards Nigel

3 4