- Bird-users - Mailing Lists

duplicate device routes on linux
by ico 24 Mar '23

24 Mar '23

Hello all, Here at $work we are using bird for OSPF at some 30 linux boxes. Works great. But there is a thing that confuses me: Let's have some simple linux box: # ip addr 1: lo: ...rest of loopback output 2: eth0@if2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 86:37:65:15:fa:d9 brd ff:ff:ff:ff:ff:ff link-netns r2 inet 10.0.0.1/24 scope global eth0 valid_lft forever preferred_lft forever # ip route 10.0.0.0/24 dev eth0 proto kernel scope link src 10.0.0.1 As you can see, there is single interface with single address, single device route automatically generated by kernel. Simple bird config: # cat bird.conf # BEGIN bird config router id 10.0.0.1; protocol device { scan time 3; } protocol kernel krnl4 { ipv4 { table master4; import all; export all; }; learn; } protocol ospf ospf1 { ipv4 { table master4; import all; export all; }; area 0.0.0.0 { stub no; interface "eth0" { stub yes; }; }; } # END bird config When I run bird with this configuration, it inserts another route: # ip route 10.0.0.0/24 dev eth0 proto kernel scope link src 10.0.0.1 10.0.0.0/24 dev eth0 proto bird scope link metric 32 Is this expected/correct behaviour? Or should I somehow filter those device routes out? I want those device routes to be read by OSPF, of course, just not to output them back. What is the best way to get rid of them? Another unrelated question: When I run bird, it logs this: bird: KRT: Netlink strict checking failed, will scan all tables at once bird: Started Should I do something about that failed strict check? Is it important or only some info message I shouldn't worry about? Thank you ico

4 5

ip rule cannot match based on the source IPv4 address
by Brandon Zhi 20 Mar '23

20 Mar '23

Hi guys, I'm doing a "split routing table" on my router, and I'm importing routes into specific kernel routing tables via bird. So I'm doing some strange routing by using ip rule. [root@archlinux ~]# ip -4 rule 0: from all lookup local 32751: from 134.195.121.118 lookup 101 32752: from all iif Tanuki_IX lookup 147 32753: from all iif ens19 lookup 147 32754: from all iif cu_gre6 lookup 247 32755: from all iif cu lookup 147 32756: from all iif openvpn_stuix.5 lookup 247 32757: from all iif openvpn_stuix lookup 147 32758: from all iif openvpn_c1v lookup 147 32759: from all iif openvpn_c1v.5 lookup 247 32760: from all iif openvpn_Eric.5 lookup 247 32761: from all iif openvpn_Eric lookup 147 32762: from all iif ll-ix lookup 147 32763: from all iif ll-ix_gre6 lookup 247 32764: from all iif KSKB lookup 147 32765: from all iif KSKB_gre6 lookup 247 32766: from all lookup main 32767: from all lookup default As you could see, IPv4 from 134.195.121.118/32 will using table 101 which only contain [root@archlinux ~]# ip -4 route show table 101 default via 33.0.0.6 dev openvpn_Eric [root@archlinux ~]# When I am mtr to 8.8.8.8, it still uses the main route table NOT table 101 which does not follow the ip rule. [root@archlinux ~]# mtr -a 134.195.121.118 8.8.8.8 [root@archlinux ~]# tcpdump -i any host 134.195.121.118 tcpdump: data link type LINUX_SLL2 tcpdump: verbose output suppressed, use -v[v]... for full protocol decode listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes 13:30:11.991460 ens18 Out IP archlinux > dns.google: ICMP echo request, id 65299, seq 33008, length 44 13:30:11.998947 openvpn_Eric Out IP archlinux.palace-2 > 172.17.0.1.palace-2: UDP, length 28 13:30:11.999059 openvpn_Eric Out IP archlinux.33915 > 172.17.0.1.palace-2: UDP, length 28 13:30:11.999384 openvpn_Eric Out IP archlinux.27004 > 172.17.0.1.palace-2: UDP, length 28 13:30:12.006020 openvpn_Eric Out IP archlinux.palace-2 > 59.200.0.1.palace-2: UDP, length 28 13:30:12.006096 openvpn_Eric Out IP archlinux.33915 > 59.200.0.1.palace-2: UDP, length 28 13:30:12.006136 openvpn_Eric Out IP archlinux.27004 > 59.200.0.1.palace-2: UDP, length 28 13:30:12.017489 openvpn_Eric Out IP archlinux.palace-2 > 208.99.49.1.palace-2: UDP, length 28 13:30:12.017628 openvpn_Eric Out IP archlinux.33915 > 208.99.49.1.palace-2: UDP, length 28 13:30:12.017650 openvpn_Eric Out IP archlinux.27004 > 208.99.49.1.palace-2: UDP, length 28 13:30:12.023034 openvpn_Eric Out IP archlinux.palace-2 > 172.23.89.1.palace-2: UDP, length 28 13:30:12.023147 openvpn_Eric Out IP archlinux.33915 > 172.23.89.1.palace-2: UDP, length 28 13:30:12.023202 openvpn_Eric Out IP archlinux.27004 > 172.23.89.1.palace-2: UDP, length 28 13:30:12.027182 openvpn_Eric Out IP archlinux.palace-2 > 172.17.0.1.24452: UDP, length 28 13:30:12.027203 openvpn_Eric Out IP archlinux.33915 > 172.17.0.1.24452: UDP, length 28 13:30:12.027212 openvpn_Eric Out IP archlinux.27004 > 172.17.0.1.24452: UDP, length 28 13:30:12.031218 openvpn_Eric Out IP archlinux.palace-2 > 59.200.0.1.24452: UDP, length 28 13:30:12.031235 openvpn_Eric Out IP archlinux.33915 > 59.200.0.1.24452: UDP, length 28 13:30:12.031243 openvpn_Eric Out IP archlinux.27004 > 59.200.0.1.24452: UDP, length 28 13:30:12.036170 openvpn_Eric Out IP archlinux.palace-2 > 208.99.49.1.24452: UDP, length 28 13:30:12.036192 openvpn_Eric Out IP archlinux.33915 > 208.99.49.1.24452: UDP, length 28 13:30:12.036200 openvpn_Eric Out IP archlinux.27004 > 208.99.49.1.24452: UDP, length 28 13:30:12.040852 openvpn_Eric Out IP archlinux.palace-2 > 172.23.89.1.24452: UDP, length 28 13:30:12.040873 openvpn_Eric Out IP archlinux.33915 > 172.23.89.1.24452: UDP, length 28 13:30:12.040881 openvpn_Eric Out IP archlinux.27004 > 172.23.89.1.24452: UDP, length 28 13:30:12.046089 openvpn_Eric Out IP archlinux.palace-2 > 172.17.0.1.24453: UDP, length 28 13:30:12.046119 openvpn_Eric Out IP archlinux.33915 > 172.17.0.1.24453: UDP, length 28 13:30:12.046138 openvpn_Eric Out IP archlinux.27004 > 172.17.0.1.24453: UDP, length 28 13:30:12.051427 openvpn_Eric Out IP archlinux.palace-2 > 59.200.0.1.24453: UDP, length 28 13:30:12.051453 openvpn_Eric Out IP archlinux.33915 > 59.200.0.1.24453: UDP, length 28 13:30:12.051467 openvpn_Eric Out IP archlinux.27004 > 59.200.0.1.24453: UDP, length 28 13:30:12.055046 openvpn_Eric Out IP archlinux.palace-2 > 208.99.49.1.24453: UDP, length 28 13:30:12.055075 openvpn_Eric Out IP archlinux.33915 > 208.99.49.1.24453: UDP, length 28 13:30:12.055085 openvpn_Eric Out IP archlinux.27004 > 208.99.49.1.24453: UDP, length 28 13:30:12.058847 openvpn_Eric Out IP archlinux.palace-2 > 172.23.89.1.24453: UDP, length 28 13:30:12.058874 openvpn_Eric Out IP archlinux.33915 > 172.23.89.1.24453: UDP, length 28 13:30:12.058886 openvpn_Eric Out IP archlinux.27004 > 172.23.89.1.24453: UDP, length 28 13:30:12.091913 ens18 Out IP archlinux > dns.google: ICMP echo request, id 65299, seq 33009, length 44 13:30:12.096047 openvpn_Eric Out IP archlinux.palace-2 > 7.254.0.1.palace-2: UDP, length 28 13:30:12.096081 openvpn_Eric Out IP archlinux.33915 > 7.254.0.1.palace-2: UDP, length 28 13:30:12.096092 openvpn_Eric Out IP archlinux.27004 > 7.254.0.1.palace-2: UDP, length 28 13:30:12.101389 openvpn_Eric Out IP archlinux.palace-2 > 7.254.0.1.24452: UDP, length 28 13:30:12.101409 openvpn_Eric Out IP archlinux.33915 > 7.254.0.1.24452: UDP, length 28 13:30:12.101422 openvpn_Eric Out IP archlinux.27004 > 7.254.0.1.24452: UDP, length 28 13:30:12.192666 ens18 Out IP archlinux > dns.google: ICMP echo request, id 65299, seq 33010, length 44 13:30:12.293006 ens18 Out IP archlinux > dns.google: ICMP echo request, id 65299, seq 33011, length 44 13:30:12.393416 ens18 Out IP archlinux > dns.google: ICMP echo request, id 65299, seq 33012, length 44 13:30:12.494029 ens18 Out IP archlinux > dns.google: ICMP echo request, id 65299, seq 33013, length 44 13:30:12.607660 ens18 Out IP archlinux > dns.google: ICMP echo request, id 65299, seq 33014, length 44 13:30:12.679414 ens18 Out IP archlinux > dns.google: ICMP echo request, id 65299, seq 33015, length 44 13:30:12.966665 ens18 Out IP archlinux > dns.google: ICMP echo request, id 65299, seq 33019, length 44 13:30:13.039053 ens18 Out IP archlinux > dns.google: ICMP echo request, id 65299, seq 33020, length 44 13:30:14.045371 ens18 Out IP archlinux > dns.google: ICMP echo request, id 65299, seq 33034, length 44 13:30:14.116878 ens18 Out IP archlinux > dns.google: ICMP echo request, id 65299, seq 33035, length 44 13:30:14.188702 ens18 Out IP archlinux > dns.google: ICMP echo request, id 65299, seq 33036, length 44 13:30:14.260455 ens18 Out IP archlinux > dns.google: ICMP echo request, id 65299, seq 33037, length 44 13:30:14.332277 ens18 Out IP archlinux > dns.google: ICMP echo request, id 65299, seq 33038, length 44 13:30:14.404019 ens18 Out IP archlinux > dns.google: ICMP echo request, id 65299, seq 33039, length 44 13:30:14.475861 ens18 Out IP archlinux > dns.google: ICMP echo request, id 65299, seq 33040, length 44 13:30:14.547705 ens18 Out IP archlinux > dns.google: ICMP echo request, id 65299, seq 33041, length 44 13:30:14.619529 ens18 Out IP archlinux > dns.google: ICMP echo request, id 65299, seq 33042, length 44 13:30:14.691361 ens18 Out IP archlinux > dns.google: ICMP echo request, id 65299, seq 33043, length 44 13:30:14.763157 ens18 Out IP archlinux > dns.google: ICMP echo request, id 65299, seq 33044, length 44 13:30:14.834959 ens18 Out IP archlinux > dns.google: ICMP echo request, id 65299, seq 33045, length 44 13:30:14.906978 ens18 Out IP archlinux > dns.google: ICMP echo request, id 65299, seq 33046, length 44 13:30:14.978577 ens18 Out IP archlinux > dns.google: ICMP echo request, id 65299, seq 33047, length 44 13:30:15.050371 ens18 Out IP archlinux > dns.google: ICMP echo request, id 65299, seq 33048, length 44 13:30:15.122227 ens18 Out IP archlinux > dns.google: ICMP echo request, id 65299, seq 33049, length 44 13:30:15.193915 ens18 Out IP archlinux > dns.google: ICMP echo request, id 65299, seq 33050, length 44 13:30:15.265629 ens18 Out IP archlinux > dns.google: ICMP echo request, id 65299, seq 33051, length 44 13:30:15.325557 openvpn_Eric Out IP archlinux.palace-2 > root-mia-01.zerotier.com.palace-2: UDP, length 137 13:30:15.325578 openvpn_Eric Out IP archlinux.33915 > root-mia-01.zerotier.com.palace-2: UDP, length 137 13:30:15.325586 openvpn_Eric Out IP archlinux.27004 > root-mia-01.zerotier.com.palace-2: UDP, length 137 13:30:15.328638 openvpn_Eric Out IP archlinux.palace-2 > root-zrh-01.zerotier.com.palace-2: UDP, length 137 13:30:15.328657 openvpn_Eric Out IP archlinux.33915 > root-zrh-01.zerotier.com.palace-2: UDP, length 137 13:30:15.328667 openvpn_Eric Out IP archlinux.27004 > root-zrh-01.zerotier.com.palace-2: UDP, length 137 13:30:15.329981 openvpn_Eric Out IP archlinux.palace-2 > root-sgp-01.zerotier.com.palace-2: UDP, length 137 13:30:15.329998 openvpn_Eric Out IP archlinux.33915 > root-sgp-01.zerotier.com.palace-2: UDP, length 137 13:30:15.330007 openvpn_Eric Out IP archlinux.27004 > root-sgp-01.zerotier.com.palace-2: UDP, length 137 13:30:15.332916 openvpn_Eric Out IP archlinux.palace-2 > 104.194.8.134.palace-2: UDP, length 137 13:30:15.332934 openvpn_Eric Out IP archlinux.33915 > 104.194.8.134.palace-2: UDP, length 137 13:30:15.332941 openvpn_Eric Out IP archlinux.27004 > 104.194.8.134.palace-2: UDP, length 137 As you could see, the package still using the default route table not table 101. This happens on Debian at the same time, and I think it's a problem about Linux, not just ArchLinux. I also tested passing ip -6 rule add from some ipv6 address table 101. It can work normally, that is to say, there is a matching problem with ipv4 in ip rule, but this phenomenon does not exist in ipv6. Best, *Brandon Zhi* HUIZE LTD www.huize.asia <https://huize.asia/>| www.ixp.su | Twitter This e-mail and any attachments or any reproduction of this e-mail in whatever manner are confidential and for the use of the addressee(s) only. HUIZE LTD can’t take any liability and guarantee of the text of the email message and virus.

2 2

First Time Bird - Failing To Start
by support＠orcacomputers.com 18 Mar '23

18 Mar '23

Hello, I am setting up bird daemon for the first time. I have built a BGP Neighborship in /etc/bird6.conf and now attempting to start the bird daemon but unsuccessful and do not know why. When I "systemctl start bird" I get failed start. | I am uncertain if I am supposed to have a file in /usr/lib/systemd/system/ for bird. The guidance I've been given so far says no file in /usr/lib/systemd/system/. I have /etc/bird.conf6 file created

3 3

[PATCH] Add missing reference to "show route in" in cli-help and doc
by Johannes Moos 18 Mar '23

18 Mar '23

Hi, please find a patch attached that adds missing references to "show route in" (introduced with v2.0.9) in the cli-help and doc. Johannes

2 1

BIRD 3 STATUS
by Marcelo Balbinot 17 Mar '23

17 Mar '23

Hi BIRD dev team, Any news for bird 3 (multithreaded version)?

2 1

Route attributes available when using export tables
by Hugo Slabbert 17 Mar '23

17 Mar '23

Hi folks, On bird 2.0.7. We've been debugging some export behaviour (ref subject "BIRD continues exporting routes but reports no exports"), and enabled export tables on ipv4 and ipv6 channels for some of our BGP sessions. When we did that, we found that the MED we were applying in our export filters were no longer being stamped on export. We're setting route preference on locally defined static routes, and then setting MED at export based on that route preference. Since the preference order is flipped between MED and BIRD's route preference (higher preference is better; lower MED is better), we transform that and bank it around 100, e.g. preference 100 -> MED 100; preference 99 -> MED 110, etc: ``` function preference_to_med () int tier; { tier = 100 - preference; return 100 + (tier * 10); } ``` Best I can tell, it appears that the `preference` attribute is not available on routes when they're passed through export tables. I tried instead to just stamp igp_metric on the static routes right when they are defined, to the same value as we would have for the MED, and then just doing `bgp_med = igp_metric` in the export filter, but that also did not work as MED was still not being stamped on export. We can and do also set `bgp_med` on the static routes right at their initial definition time. But, they are defined in a different table and being pulled into the source table for the exports through a pipe (so e.g. defined in MY_CUSTOM_TABLE with bgp_med set, then imported via pipe to master4, and exported from master4 via BGP), and it appears that operation means the initial MED defined on the route is not retained on export after passing through the pipe and needing to be set again explicitly. Are these types of BIRD "internal" route attributes, e.g. preference, igp_metric, not present on routes when they're passed through export tables? I suppose we could instead use BGP communities on the route, and extract the value portion of the community, but we were trying to keep things to a native metric type value. I.e. we want to just pass this across the BGP session as something like MED rather than making the far end apply a function to extract a value from a community. We could still use communities purely *within* the local BIRD instance for that, using the function only locally and still stamping MED on export; I'm just trying to determine if that's the best path, as it feels a bit clunky to need to use communities for something that is only locally significant within the local BIRD instance.

5 7

BIRD continues exporting routes but reports no exports
by Hugo Slabbert 15 Mar '23

15 Mar '23

Hi folks, We're seeing an issue where BIRD is reporting one thing for BGP route exports (via `show route export <protocol>`) but actually doing something different. We see this when we change some of the conditions around export. Our export filters include a function that evaluates as either true or false, for a global toggle of whether we should proceed on with any exports to relevant peers. Roughly it looks like this: ``` function do_export () bool DRAIN_NODE; bool HEALTHY; { DRAIN_NODE = false; HEALTHY = false; include "includes/birdwatch/*"; return HEALTHY && !DRAIN_NODE; } ``` That function is then included as the first term in relevant export filters, e.g.: ``` filter PUBLIC_EXPORT_v4 { if !do_export() then reject; # other export terms here } ``` We have external programs that monitor for whether the host is indicated as drained, or if the process that's handling traffic for the box is healthy. If those conditions change, they add or remove config snippets at the ` includes/birdwatch/` directory to change the values of the DRAIN_NODE or HEALTHY bools, and we then call `birdc configure` to reload the config and pick up the change to either stop exports or proceed on with them. Doing the common trick of adding/removing /32s from loopbacks or such for DIRECT export don't fit our use case, so this method provides external programs control over global export state for those filters. This has worked cleanly for us so far. But, recently we've hit an issue. Assuming we start in a "non-drained" state where DRAIN_NODE is false and HEALTHY is true, so we're exporting routes as expected, we then: * toggle DRAIN_NODE to be true * execute `birdc configure` to reload the configuration When we look at exported routes, e.g. `show route export <bgp peer protocol>`, BIRD shows no routes exported, as expected. However, those BGP peers definitely do still see routes advertised from BIRD. We are also using https://github.com/czerwonk/bird_exporter, and the `bird_protocol_prefix_export_count` metrics for exported routes for the drained host remain at their previous levels. In other words: * birdc says nothing is being exported * but peers still are seeing prefixes from BIRD * and bird_exporter still shows prefixes being exported from BIRD Effectively, the `birdc show route export` output is lying. We've tried adding a sleep between when the include snippet that changes the DRAIN_NODE value is written and when we hit `birdc configure`, but that doesn't appear to make any difference. If we execute `birdc configure` *twice*, though, everything's fine: The actual exports are stopped. That's true without any sleep or break between running configure as well; literally just `birdc configure` back to back in the script that manages this. We do not see any indication of issues in the `birdc configure` runs or in BIRD's logs. The reverse also does occur, where if we start with the DRAIN_NODE set to true and are exporting nothing, then unset DRAIN_NODE and hit `birdc configure`: `show route export` shows things being exported, but neighbours actually don't hear any routes. We have not seen this occur in our smaller dev environment, but it has shown up in our more scaled environment. The relevant hosts have a couple of upstream v4 and v6 peers feeding them defaults, with: Import: * 1x IPv4 default route per BGP upstream peer, 2x total * 1x IPv6 default route per BGP upstream peer, 2x total Export: * 1-5 IPv4 /24s per BGP upstream peer * 0-1 IPv6 /48s per BGP upstream peer They have a larger number of downstream BGP peers, currently around 138 but that number can fluctuate. Each of those peers have an IPv4 and IPv6 channel, running over an IPv6 transport (`extended next hop on` for the ipv4 channel). At the moment those have: Import: * 2x IPv6 routes per peer (one /48, one /128) * 63x IPv4 routes per peer (all /24s) Export: * 21x IPv6 routes per peer (all /128s) * 1-5x IPv6 routes per peer (all /24s) So this does end up with the boxes have ~290 BGP "protocols", between v4 and v6 channels combined, ~9300 routes imported (between v4 and v6, multiplied by peers), and ~3,100 routes exported (between v4 and v6, multiplied by peers). Any thoughts on what could be causing BIRD to fail to apply the policy properly on the first `birdc configure` but succeeding on the second? Or why the route export output is incorrect after the first `birdc configure` but the metrics exporter being correct? Is `show route export` showing what BIRD *thinks* should be exported based on current filters, or what it's actively sending to those peers? Or any thoughts on how we can further debug or trace this to figure out what's confusing BIRD?

4 10

Extended communities ASN wildcard.
by Ochalski, Radoslaw 13 Mar '23

13 Mar '23

Hi, I was wondering if there is a way to match extended communities via all ASNs wildcard? As per https://bird.network.cz/?get_doc&v=16&f=bird-5.html, it’s not possible: EC sets use similar expressions like pair sets, e.g. (rt, 123, 10..20) or (ro, 123, *). Expressions requiring the translation (like (rt, *, 3)) are not allowed (as they usually have 4B range for ASNs). This is kind a surprising, however maybe I am missing something? Cheers, Radek

2 1

Re: Radv proto sending adverts on wrong interface
by Daniel Gröber 13 Mar '23

13 Mar '23

Hi Kees, On Mon, Mar 13, 2023 at 07:23:17AM +0100, Kees Meijs | Nefos wrote: > About VLAN configuration: I guess one should never ever use VLAN_DEFAULT > c.q. VLAN 1 at all. Vendors often think differently about this case, > sometimes allowing to have a .1Q tag, sometimes not. Or sort of "both" as > well. In combination with protocols such as LACP or (variations on) STP > resulting in great fun, which of course is very sarcastic. I changed the default using `default-vlan-id 4095` for that very reason. Perhaps this is still a default vid related bug. I'll see if I can reproduce this with some other vid. > My two cents after opening up a box with a new switch, starting your > configuration: explicitly disable VLAN1 and continue using others. Same goes > for VLAN > 4090 by the way. These numbers are sometimes "reserved". The brocade docs list the reserved vlans (4091, 4092) explicitly and allow to change them like the default vid. The 4095 default vid I'm using is the example they use in the docs so I'd be surprised if that's broken. Using such low vlan ids is a holdover from using some ath9k wifi APs that only supported 4-bit vids so we had to make every number count ;) I'll definetly reconsider that in the future haha. Thanks, --Daniel

1 0

Radv proto sending adverts on wrong interface
by Daniel Gröber 13 Mar '23

13 Mar '23

Hi, I'm using bird as a replacement for radvd since the latter has a longstanding issue with sending adverts on unconfigured interfaces under complex conditions. Turns out bird has a similar issue :) Looking at the code, when opening the socket for an interface in radv_sk_open we set sk->iface as you'd expect, which should cause packets to be sent directly via this interface. However radv sends packets to the all-nodes multicasts address for periodic adverts, see radv_send_ra. This then calls sk_send_to which (eventually) calls sockaddr_fill6. Here rther we find this code: if (ifa && ipa_is_link_local(a)) sa->sin6_scope_id = ifa->index; This would seem to be the problem to me, since a=ff02::1 doesn't pass this check so the sendmsg call goes out without the interface-index being communicated to the kernel. It looks like that causes it to just pick a random interface though I would expect it to just multicast this. Not sure why that is but it's broken on our side either way. I'd add a check here for whether the saddr is link-local too. That should cover this case. Any comments/objections? Thanks, --Daniel

5 7