- Bird-users - Mailing Lists

On the possibility of updating BGP passwords without network disruption.
by Calvin Zachman 08 Aug '22

08 Aug '22

Hi BIRD users, Does anyone know whether a BGP shared secret can be rotated without incurring any network downtime? I did some testing with the BGP password functionality offered and it appears that any update to the BGP password configuration incurs a brief network outage with both existing/new connections. It seems like something about the way BIRD is restarting is leading to it pulling down learned routes immediately as opposed to letting them live according to the timeout setting. Does BIRD flush all routes it has learned when this configuration changes? Here is a brief excerpt to demonstrate the outage. Take note that the network disruption precisely matches the timestamp at which BIRD is reconfigured: # Logs from calico-node-4w4bv (10.95.14.104) 2022-06-29 18:26:18.836 [INFO][60] confd/client.go 1415: Trigger to recheck BGP peers following possible password update 2022-06-29 18:26:18.836 [INFO][60] confd/client.go 250: Recompute v1 BGP peerings 2022-06-29 18:26:18.836 [INFO][60] confd/client.go 949: Recompute BGP peerings: bird: Reconfiguration requested by SIGHUP 2022-06-29 18:26:18.844 [INFO][60] confd/resource.go 278: Target config /etc/calico/confd/config/bird.cfg has been updated due to change in key: /calico/bgp/v1/global bird: Reconfiguring bird: device1: Reconfigured bird: direct1: Reconfigured bird: Restarting protocol Mesh_10_95_14_105 bird: Mesh_10_95_14_105: Shutting down bird: Mesh_10_95_14_105: State changed to stop bird: Restarting protocol Mesh_10_95_14_110 bird: Mesh_10_95_14_110: Shutting down bird: Mesh_10_95_14_110: State changed to stop bird: Mesh_10_95_14_105: State changed to down bird: Mesh_10_95_14_105: Initializing bird: Mesh_10_95_14_105: Starting bird: Mesh_10_95_14_105: State changed to start bird: Mesh_10_95_14_110: State changed to down bird: Mesh_10_95_14_110: Initializing bird: Mesh_10_95_14_110: Starting bird: Mesh_10_95_14_110: State changed to start bird: Reconfigured bird: Mesh_10_95_14_110: Connected to table master bird: Mesh_10_95_14_110: State changed to feed bird: Mesh_10_95_14_110: State changed to up bird: Mesh_10_95_14_105: Connected to table master bird: Mesh_10_95_14_105: State changed to feed bird: Mesh_10_95_14_105: State changed to up 2022-06-29 18:26:36.079 [INFO][58] monitor-addresses/autodetection_methods.go 117: Using autodetected IPv4 address 10.95.14.104/26 on matching interface eth0 2022-06-29 18:26:54.537 [INFO][62] felix/summary.go 100: Summarising 9 dataplane reconciliation loops over 1m2.1s: avg=5ms longest=21ms (resync-filter-v4,resync-nat-v4) # Connection Tester Daemonset (hitting an echoserver twice a second or so) Wed Jun 29 18:26:17 UTC 2022 Successful echo server connection Wed Jun 29 18:26:17 UTC 2022 Wed Jun 29 18:26:18 UTC 2022 Successful echo server connection Wed Jun 29 18:26:18 UTC 2022 Wed Jun 29 18:26:18 UTC 2022 curl: (28) Connection timed out after 300 milliseconds Failed to connect to echo server Wed Jun 29 18:26:19 UTC 2022 Wed Jun 29 18:26:19 UTC 2022 curl: (28) Connection timed out after 300 milliseconds Failed to connect to echo server Wed Jun 29 18:26:20 UTC 2022 Wed Jun 29 18:26:20 UTC 2022 Successful echo server connection Wed Jun 29 18:26:20 UTC 2022 # For peer /host/10.95.14.81/ip_addr_v4 protocol bgp Mesh_10_95_14_81 from bgp_template { neighbor 10.95.14.81 as 64512; source address 10.95.14.82; # The local address we use for the TCP connection graceful restart time 1800; # This parameter seems to make no difference when changing BGP passwords password "LJiKASiglY+KafEwEn/cSmkiok0zHgpQq5EtYhYgoDcSQwKIpX22Tz7jOzX+"; } I have perused the RFCs for both BGP Graceful Restart (4724) & Secure BGP Sessions (2385) but haven't found a solid answer yet. When the password is changed it makes complete sense that any peers with the new password will refuse to accept any NEW routes received from peers using the old password and vice versa. I don't see the fundamental reason why TCP segments arriving with some unexpected hash necessitates that previously learned routes from that peer need to be flushed with no TTL, but the observance of the outage suggests that is what is happening. One would think that, in principle, it could wait to tear down existing routes until a configurable timeout (say the graceful restart) expires, providing a window in which we can change the password and maintain stable routing. I am relatively new to BGP and am using BIRD indirectly via Calico for container networking inside Kubernetes. I will of course take things up with the guys behind Calico, but is there anything in the BGP spec/BIRD implementation which fundamentally prevents network disruption free secret rotation? Let me know if there is any place I should look for more information on this or any debug logs which would be helpful. Thanks, Calvin

4 3

Filter OSPF to kernel routes
by Marcus Büttemeyer 08 Aug '22

08 Aug '22

Hello, I'm distributing my default route via OSPFv3 from my edge router. For testing purposes I would like to ignore that default route on one of my routers. Said router gets a default route via IPv6 router advertisements but the OSPF route is preferred. So I tried: filter default-reject { if ::/0 ~ net then reject; } [...] protocol ospf v3 ospfv3 { ipv6 { import filter default-reject; [...] and protocol kernel kernel6 { ipv6 { export filter default-reject; }; [...] The filter seems to be correct, "show route filter ..." works in birdc. But I still have the OSPF default route. So it seems I misunderstand filters in BIRD completely. Can anybody point me in the right direction? Thanks in advance, Marcus Büttemeyer

4 4

FW: use Bird as Route Server for Balcan-IX
by george.nicolae＠orange.com 25 Jul '22

25 Jul '22

Hello My name is George Nicolae and I work for Orange Romania Communications ( former Telekom Romania Communications). We operate an Internet Exchange : Balcan-IX , that is mainly present in Romania but have also point of presence in countries around us, and partner with IX-es from this countries. Now we have around 50 customers and 6500 prefixes exchanged. We now use Quagga for route servers and we analyze what is the best way to upgrade, both as hardware and software. As you developed Bird, that is used by most of the major players in the IX market, we want to ask you for information about usage BIRD as route-server in our IX. Following come in my mind at first hand * What hardware did we need for accommodate 2 Route Servers with Bird , taking into consideration following: o Double the number of prefixes and customers o We use the hardware for Route Servers and if possible for other tools that is related as reporting , looking glass and others if are available. Did you know about integrations of your software with other reporting/configuration tools ? o We have an mixed environment and we need to make customization of the service * Is bird Software free? Do you developed other tools related to usage of this software as Route Server. * What are requirements regarding Operating System and Hypervisor Also we appreciate any info regarding Bird and also comparison with other alternatives for this role. Thank you George Nicolae Orange Romania Communications _________________________________________________________________________________________________________________________ Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci. This message and its attachments may contain confidential or privileged information that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and delete this message and its attachments. As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified. Thank you.

5 4

[PATCH] Netlink: Propagate ecmp nexthop weight to kernel for inet6 routes
by Daniel Gröber 24 Jul '22

24 Jul '22

Previously nl_send_route would use plain nl_add_nexthop for ecmp ipv6 routes instead of adding RTA_MULTIPATH objects via nl_add_multipath. The former lacks support for the rtnh_hops field needed for setting the nexthop weight though. On the kernel side support for nexthop weights was introduced by commit 398958ae48 ("ipv6: Add support for non-equal-cost multipath") which landed in 4.16. Before this the weight will simply be ignored. Support for the ipv6 RTA_MULTIPATH attribute was added in 51ebd31815 ("ipv6: add support of equal cost multipath (ECMP)") which landed in 3.10. If this version bound isn't met installing the route will fail. --- sysdep/linux/netlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sysdep/linux/netlink.c b/sysdep/linux/netlink.c index 29b744cb..5e0b036d 100644 --- a/sysdep/linux/netlink.c +++ b/sysdep/linux/netlink.c @@ -1446,7 +1446,7 @@ dest: { case RTD_UNICAST: r->r.rtm_type = RTN_UNICAST; - if (nh->next && !krt_ecmp6(p)) + if (nh->next) nl_add_multipath(&r->h, rsize, nh, p->af, eattrs); else { -- 2.30.2

3 7

[PATCH] krt: Dump routing tables separetely on linux to avoid congestion
by Daniel Gröber 24 Jul '22

24 Jul '22

When dumping the routing table bird currently doesn't set the rtm_table netlink field to select any particular one but rather wants to get all at once. This can be problematic when multiple routing daemons are running on a system as the kernel's route modification performance goes down drasticly (by a factor of 20-200ish) when the table is being modified while it's being dumped. To avoid this situation we make bird do dumps on a per-kernel-table basis. This then allows the administrator to have multiple routing daemons use different kernel tables which sidesteps the problem. See also this discussion on the babel-users mailing list: https://alioth-lists.debian.net/pipermail/babel-users/2022-April/003902.html --- sysdep/cf/linux.h | 2 +- sysdep/linux/netlink.c | 7 ++++--- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/sysdep/cf/linux.h b/sysdep/cf/linux.h index 047d3764..d6211d16 100644 --- a/sysdep/cf/linux.h +++ b/sysdep/cf/linux.h @@ -9,7 +9,7 @@ #define CONFIG_AUTO_ROUTES #define CONFIG_SELF_CONSCIOUS #define CONFIG_MULTIPLE_TABLES -#define CONFIG_ALL_TABLES_AT_ONCE +#undef CONFIG_ALL_TABLES_AT_ONCE #define CONFIG_IP6_SADR_KERNEL #define CONFIG_MC_PROPER_SRC diff --git a/sysdep/linux/netlink.c b/sysdep/linux/netlink.c index 29b744cb..003b7939 100644 --- a/sysdep/linux/netlink.c +++ b/sysdep/linux/netlink.c @@ -256,7 +256,7 @@ nl_request_dump_addr(int af) } static void -nl_request_dump_route(int af) +nl_request_dump_route(int af, int table_id) { struct { struct nlmsghdr nh; @@ -267,6 +267,7 @@ nl_request_dump_route(int af) .nh.nlmsg_flags = NLM_F_REQUEST | NLM_F_DUMP, .nh.nlmsg_seq = ++(nl_scan.seq), .rtm.rtm_family = af, + .rtm.rtm_table = table_id, }; send(nl_scan.fd, &req, sizeof(req), 0); @@ -1976,13 +1977,13 @@ nl_parse_route(struct nl_parse_state *s, struct nlmsghdr *h) } void -krt_do_scan(struct krt_proto *p UNUSED) /* CONFIG_ALL_TABLES_AT_ONCE => p is NULL */ +krt_do_scan(struct krt_proto *p) { struct nlmsghdr *h; struct nl_parse_state s; nl_parse_begin(&s, 1); - nl_request_dump_route(AF_UNSPEC); + nl_request_dump_route(AF_UNSPEC, KRT_CF->sys.table_id); while (h = nl_get_scan()) if (h->nlmsg_type == RTM_NEWROUTE || h->nlmsg_type == RTM_DELROUTE) nl_parse_route(&s, h); -- 2.30.2

3 4

BGP session local capabilities / announced AF
by Robert Blayzor 20 Jul '22

20 Jul '22

Bird 2.0.10 I have BGP neighbors I only want to advertise ipv4 or ipv6 to, not both. It appears BIRD assumes both even though I only have either a ipv4 or ipv6 channel configured for the protocol. (not both) Is v4 implicit? If so, is there a way to negate that? Local capabilities Multiprotocol AF announced: ipv4 ipv6 -- inoc.net!rblayzor XMPP: rblayzor.AT.inoc.net PGP: https://pgp.inoc.net/rblayzor/

2 1

[RFC] Automatic MP peering with IPv6 link local peers
by Nico Schottelius 15 Jul '22

15 Jul '22

Good morning^2, as virtually all parts in our datacenters have become IPv6 only, I was wondering if it was easy to add a feature to bird to automatically BGP peer with all alive link local neighbours? Motivation and situation ------------------------ Every node has an IPv6 link local address on every network interface. Bird already supports dynamic peers, including whitelisting of ranges. Instead of specifying specific ranges, it would be great if two or more routers could be placed in the same layer 2 segment and would automatically BGP peer with each other, thus removing any configuration needs. OSPF does a similar job already, however it is not suitable for transferring the BGP attributes. Implementation sketch -------------------------------------------------------------------------------- The idea would be for each router have something on the line of protocol bgp fe80auto { local as 65532; neighbor range fe80::/12 as 65534; dynamic name "link_local_"; # New option, similar to the OSPF option auto_fe80_interfaces "eth1.*"; ipv6 { }; ipv4 { }; } If bird had the stanza auto_fe80_interfaces in it, it would a) ping ff02::2 and record all results b) For each result, excluding our own address, connect to the other nodes c) On expiry or regular interal, go back to (a) and clear peers -------------------------------------------------------------------------------- Maybe this is already possible in current bird, but I haven't found a direct way to dynamically solve this. Looking forward to your thoughts, Nico -- Sustainable and modern Infrastructures by ungleich.ch

6 9

Dynamic reconfigurations of bird - how?
by Nico Schottelius 14 Jul '22

14 Jul '22

Good morning fellow bird users, I was wondering how you handle "dynamic reconfigurations" such as rerouting, adding filters, changing the priority of routes in case of attacks? In particular I wonder if there is a "good way" to tell bird to lower or raise a certain route temporarily, i.e. something that would be reset on a reload? Or to tell bird to forget about specific routes that you want to filter for blackholing certain parts? So far in case of attacks we usually edit bird.conf, reload bird and after the attacks are done, purge/overwrite the config with our config management (cdist in our case). This works, but has a bit of a write-reload instead of a set-and-forget behaviour, and I was more looking to something like "set on a switch, but don't issue the write command"-mode. Any thoughts on this? Best regards, Nico -- Sustainable and modern Infrastructures by ungleich.ch

3 2

[PATCH] Free interfaces in shutdown state
by Lorenz Brun 13 Jul '22

13 Jul '22

When interfaces are created and destroyed by automated systems, a potentially unbounded amount of interfaces exist. This results in bird consuming ever-increasing amounts of memory and CPU time for the list of known interfaces. This change frees the interface after it is in shutdown state and all notifications for it have been processed. --- nest/iface.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/nest/iface.c b/nest/iface.c index 682340c5..b4c65512 100644 --- a/nest/iface.c +++ b/nest/iface.c @@ -324,7 +324,7 @@ if_update(struct iface *new) if_copy(i, new); if (c) if_notify_change(c, i); - + i->flags |= IF_UPDATED; return i; } @@ -365,10 +365,10 @@ if_end_partial_update(struct iface *i) void if_end_update(void) { - struct iface *i; + struct iface *i, *x; struct ifa *a, *b; - WALK_LIST(i, iface_list) + WALK_LIST_DELSAFE(i, x, iface_list) { if (!(i->flags & IF_UPDATED)) if_change_flags(i, (i->flags & ~IF_ADMIN_UP) | IF_SHUTDOWN); @@ -379,6 +379,11 @@ if_end_update(void) ifa_delete(a); if_end_partial_update(i); } + if ((i->flags & IF_SHUTDOWN)) { + WALK_LIST_DELSAFE(a, b, i->addrs) + ifa_delete(a); + rem_node(&i->n); + } } } -- 2.36.1

2 2

Let packets from different BGP go to different routing tables
by Brandon Zhi 13 Jul '22

13 Jul '22

Hello fellow birdies, I'm having some difficulty connecting the nodes. Our network provides free IP Transit service so we need to carry downstream. We use OpenVPN/Wireguard connection between our nodes. We plan to use VLAN on OpenVPN or use GRE on Wireguard. This way, we have 2 interfaces tunnel1 and tunnel2 between each node. We created a bgp_v6 (IBGP) session on tunnel1 that allows downstream BGP sessions like HE(Hurricane Electric) and put the routing table into table 147. Create bgp_v6_own(IBGP) on tunnel2 to transmit those routing tables from BGP that cannot carry downstream to Table 247 Then we use ip rule Direct traffic to the correct routing table based on the interface. My English is not very good so I drew a picture for a description. link : https://i.postimg.cc/dtBDC4kh/photo-2022-07-12-12-54-28.jpg [image: image.png] The problem I'm having is that in IXP all BGP sessions differ only by IP or MAC. For instance: We have only one interface for BGP: ens18 And our IP Address is: 2a0f:5707:ffe3::57 AS141011 Our customers assume is: 2a0f:5707:ffe3::1 AS1 Our upstream which allowed downstream:2a0f:5707:ffe3::30 AS6939 Therefore we have a BGP session with AS1 and a BGP session with AS6939 AS6939 > Table 147 How should we get traffic from our downstream AS1 into Table 147? We have discussed using VLANs, but VLANs are usually not allowed in IXPs. The second solution is to use the ip rule to put every prefix from the downstream into Table 147, which is very inefficient. Do you have a better solution? Thanks -- *Brandon Zhi* HUIZE LTD www.huize.asia <https://huize.asia/>| www.ixp.su | Twitter <https://twitter.com/zhihuiyuze> This e-mail and any attachments or any reproduction of this e-mail in whatever manner are confidential and for the use of the addressee(s) only. HUIZE LTD can’t take any liability and guarantee the text of the email message and virus.

2 3