- Bird-users - Mailing Lists

回覆: Question: ROA verification does not work properly on bird 2.0.11
by haima 23 Jan '23

23 Jan '23

Hi, Maria, Thanks for your reply, Line 59 reads as follows: if roa_check(roa_table4, net, bgp_path.last) = ROA_INVALID then return true; Thanks, Haima MoeBee Network 寄件者: Bird-users 代表 Maria Matejka via Bird-users 已傳送: 星期一, 2023 年 1 月 23 日 23:38 收件者: bird-users(a)network.cz 主旨: Re: Question: ROA verification does not work properly on bird 2.0.11 Hello! > bird will return the following error: /etc/bird/function.conf:59:22 Syntax error, unexpected CF_SYM_UNDEFINED, expecting CF_SYM_KNOWN The numbers 59:22 are actually the line:char index in that file. Could you please disclose what is in /etc/bird/function.conf around line 59 to let us help you find out what's the case? Thanks Maria

2 1

small fix of indenting
by Alexander Zubkov 23 Jan '23

23 Jan '23

Hello, I found some bad indenting of if/else statements. Please see the attached patch.

2 1

BIRD version 2.0.12
by Ondrej Filip 23 Jan '23

23 Jan '23

Dear users, happy new year for everyone. We just released first stable version of BIRD this year. Many thanks to my great colleagues and namely Santiago. This release fixes some important bugs, here is a list of the main improvements: Version 2.0.12 (2023-01-23) o Filter: New 'onlink' route attribute o Compile-time option to use 4-way tries instead of 16-way ones o BSD: Support for kernel route metric and other improvements o Important bugfixes Enjoy! Ondrej

1 0

[PATCH] Set PR_SET_DUMPABLE before switching uid to allow core dumps.
by Thomas Liske 22 Jan '23

22 Jan '23

Signed-off-by: Thomas Liske <liske(a)ibh.de> --- This patch sets the PR_SET_DUMPABLE capability before switching to a unprivileged user to allow core dumps (see also the paragraph about set-user-ID in `man 5 core`) Background: While debugging bird on Alpine we wonder why it was not possible to get a core dump when bird runs under a unprivileged user. Original Alpine Issue: https://gitlab.alpinelinux.org/alpine/aports/-/issues/14408 sysdep/linux/syspriv.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sysdep/linux/syspriv.h b/sysdep/linux/syspriv.h index 8b210f06..efb1fff0 100644 --- a/sysdep/linux/syspriv.h +++ b/sysdep/linux/syspriv.h @@ -73,6 +73,10 @@ drop_uid(uid_t uid) if (prctl(PR_SET_KEEPCAPS, 1) < 0) die("prctl: %m"); + /* allow core dumps after dropping root ID */ + if (prctl(PR_SET_DUMPABLE, 1) < 0) + die("prctl: %m"); + /* completely switch to the unprivileged user ID */ if (setresuid(uid, uid, uid) < 0) die("setresuid: %m"); -- 2.30.2

2 1

Limit OSPF interface pattern matching to VRFs
by Marcel Menzel 22 Jan '23

22 Jan '23

Hello list, Is there a way to instruct BIRD to only match OSPF interfaces that are enslaved to a certain VRF (or only the main VRF / not enslaved to any VRF)? Trying to set 'vrf default;' or 'vrf "vrf-as207781";' in an OSPF protocol block does not generate any error message at all, but seems to be ignored completely. Looking at "show ospf int" show BIRD picking up all interfaces (in my case xfrm and veth interfaces, because I match for "xfrm*" and "veth*") not belonging to the VRF specified. The config block for running OSPF in the main VRF looks like this: protocol ospf v3 o_home_ipv6 { vrf default; ipv6 { import all; export where source ~ [ RTS_DEVICE, RTS_STATIC ]; }; area 0 { interface "xfrm0", "xfrm2" { #interface "xfrm*" { hello 1; type pointopoint; }; interface "br0" { #interface "br*" { stub; }; }; } The config block for running OSPF in one VRF looks like this: protocol ospf v3 o_as207781_ipv6 { vrf "vrf-as207781"; ipv6 { table t_as207781_ipv6; import all; export where source ~ [ RTS_DEVICE ]; }; area 0 { #interface "xfrm1", "xfrm3" { interface "xfrm*" { hello 1; type pointopoint; }; #interface "veth0", "veth2", "dummy0" { interface "veth*", "dummy*" { stub; }; }; } Yet BIRD picks up all interfaces in all VRFs, although xfrm0 & xfrm2 are not enslaved, and xfrm1 & xfrm3 are VRF enslaved: root@r1-fra ~ # birdc sh ospf int o_home_ipv6 | grep xfrm Interface xfrm0 (IID 0) Interface xfrm2 (IID 0) Interface xfrm1 (IID 0) Interface xfrm3 (IID 0) root@r1-fra ~ # birdc sh ospf int o_as207781_ipv6 | grep xfrm Interface xfrm1 (IID 0) Interface xfrm3 (IID 0) Interface xfrm0 (IID 0) Interface xfrm2 (IID 0) I am running BIRD 2.0.11 on Kernel 6.1.7. My current workaround is to specify each interface directly in the OSPF blocks without using any globbing/patterns at all, but this is getting uncomfortable for an increasing amount of interfaces (as I am planning to move to LXD routed mode and match it's veth interfaces automatically). Thanks & kind regards, Marcel Menzel

2 3

Re: Run bird from a container
by Nell Jerram 20 Jan '23

20 Jan '23

Resending to the list because I was not subscribed with my recently updated email address... On Fri, Jan 20, 2023 at 10:19 AM Nell Jerram <nell(a)tigera.io> wrote: > Hi, I'm from Tigera and responsible for that calico/bird image, so just > adding a few more details in case they are of interest. > > Probably the most important thing is that it's using BIRD 1.6.8 (plus some > deltas as Hugo pointed out); I guess Billy that you will probably prefer > something based on the latest BIRD code. > > It doesn't contain any peering config, but its config file includes > > include "/etc/bird/*.conf"; > > So when we use this for our own network modelling, we start the container > with docker run, then inject the peering config with code like > > cat <<EOF | docker exec -i bird-a1 sh -c "cat > > /etc/bird/peer-rb1.conf" > protocol bgp rb1 { > description "Connection to BGP peer"; > local as 65001; > ... > } > EOF > docker exec bird-a1 birdcl configure > > The code for the fork and image building can be found at > https://github.com/projectcalico/bird. > > Best wishes, > Nell > > > On Fri, Jan 20, 2023 at 4:09 AM Hugo Slabbert via Bird-users < > bird-users(a)network.cz> wrote: > >> If you're looking for vanilla BIRD, I'd package something myself, rather, >> or https://hub.docker.com/r/pierky/bird/ if you want something >> pre-packaged. The repo for that calico/bird image explicitly calls out: >> >> > This is a fork of the BIRD internet routing daemon which provides the >> following additional function used by Calico: >> > * Support for routing using IP-in-IP >> >> Its Dockerfile calls a /opt/bird-wrapper.sh entrypoint ( >> https://github.com/projectcalico/bird/blob/feature-ipinip/dist/amd64/birdy/…) >> which runs split IPv4/IPv6 daemons in bird 1.x style. >> >> My previous gig ran BIRD in a custom container in a large distributed >> environment for heavy production services. >> >> On Thu, Jan 19, 2023 at 2:59 PM Matt Griswold <grizz(a)20c.com> wrote: >> >>> On Thu, Jan 19, 2023 at 10:23:04PM +0000, Billy R Ridgway wrote: >>> > I am interested in running Bird from within a docker container to act >>> as a BGP router. I see that https://hub.docker.com/r/calico/bird exists >>> but when I deploy it it doesn’t seem to have anything inside of it. Maybe I >>> am not using this calico bird container properly? If this is the wrong >>> direction, I can just yum install a bird rpm into a ubi container and move >>> forward that way. Any suggestions would be much appreciated. >>> >>> I have no idea on the calico container, but we run it in production with >>> podman using an image that builds from source on ubi8. We didn't use the >>> yum version because we have specific needs. but I'm sure it would work >>> fine as well. >>> >>> Cheers >>> >>

1 0

Run bird from a container
by Billy R Ridgway 20 Jan '23

20 Jan '23

I am interested in running Bird from within a docker container to act as a BGP router. I see that https://hub.docker.com/r/calico/bird exists but when I deploy it it doesn’t seem to have anything inside of it. Maybe I am not using this calico bird container properly? If this is the wrong direction, I can just yum install a bird rpm into a ubi container and move forward that way. Any suggestions would be much appreciated. Thanks, Billy

3 2

ospf type 4 LSA:s generated by bird
by Kenth Eriksson 19 Jan '23

19 Jan '23

Is there any way to control if bird generates type 4 LSAs? If bird originates type 4 LSA:s, does that mean that bird has taken the role as an ASBR?

2 2

[PATCH] allow setting the 'onlink' route attribute in filters
by Radu CARPA 17 Jan '23

17 Jan '23

Hi bird users, I recently came across the following thread [1] when trying to build an IP-in-IP overlay network with bird. Unfortunately, those patches where never merged upstream. Calico still uses a very old fork of bird with those patches applied [2]. I decided to try the path that Ondrej proposed in the thread from 2016. I made the small change from the attached patch and it worked wonderfully for building a dynamically routed IP-in-IP overlay network. Do you think it will take a lot of work to pass, from this proof of concept, to a patch which could be accepted into bird? Is setting "onlink" this way a good idea? I'd be happy to work on improving the patch. Regards, Radu [1] https://bird.network.cz/pipermail/bird-users/2016-September/010633.html [2] https://github.com/projectcalico/bird

2 1

List-ID and FROM address of the list changed around October 17th
by Andreas Rammhold 17 Jan '23

17 Jan '23

Hi, I just noticed that some of my mail search filters wouldn't apply anymore for this list. It turns out that the List-Id for messages has changed around October the 17th 2022. The list is also sending mails from bird-users(a)trubka.network.cz while the lists address is the same. Mails received since then have the following List-Id header set: List-Id: Discussion of users of BIRD Internet Routing Daemon <bird-users.trubka.network.cz> It used to be: List-Id: Discussion of users of BIRD Internet Routing Daemon <bird-users.network.cz> Not a huge deal for me just thought it would be worth mentioning in case this isn't intentional. Regards, Andi

4 3