On 6/1/25 8:46 PM, Matt Corallo wrote:

Oof. and just after I sent this I hit (several times in testing) a SEGFAULT when reconfiguring a session on both ends (to add bfd, note that this is  the 3.1.2-cznic.1~trixie release, hopefully that's enough to pull up the symbols for the positions here):

[2449561.935213] bird[576051]: segfault at d8 ip 000056552fb27f29 sp 00007fc2e82ff610 error 4 in bird[57f29,56552fae4000+fa000] likely on CPU 6 (core 3, socket 0) [2449561.935221] Code: 7b 28 48 8b 43 20 5b ff e0 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 83 ec 08 48 83 7e 20 00 74 67 31 c0 f0 48 0f b1 7e 38 75 4a <48> 8b 17 31 c9 48 89 c8 f0 48 0f b1 56 30 75 2c 48 89 d0 f0 48 0f [2449852.166876] bird[604662]: segfault at 3000000fe ip 000055a6f3935f29 sp 00007f6f50617610 error 4 in bird[57f29,55a6f38f2000+fa000] likely on CPU 4 (core 2, socket 0) [2449852.166898] Code: 7b 28 48 8b 43 20 5b ff e0 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 83 ec 08 48 83 7e 20 00 74 67 31 c0 f0 48 0f b1 7e 38 75 4a <48> 8b 17 31 c9 48 89 c8 f0 48 0f b1 56 30 75 2c 48 89 d0 f0 48 0f

At least once the same thing instead failed with

bird[617699]: Assertion 'e->hook' failed at lib/event.c:239

This one I managed to hit again by just blocking BFD with iptables making it go down.

And, finally, once only restarting bfd with `restart bfd1`:

[2451332.372865] bird[649541]: segfault at a0000018 ip 000055d8368bfd7f sp 00007ffe7643f230 error 4 in bird[57d7f,55d83687c000+fa000] likely on CPU 9 (core 4, socket 0) [2451332.372873] Code: 55 41 54 55 53 48 83 ec 08 4c 8b 67 38 4d 85 e4 75 11 48 83 c4 08 5b 5d 41 5c 41 5d c3 66 0f 1f 44 00 00 48 89 fb 48 8d 6f 38 <49> 8b 7c 24 18 e8 57 99 0a 00 84 c0 0f 84 f4 00 00 00 4d 8d 6c 24

On 6/1/25 6:14 PM, Matt Corallo wrote:

...

Tried to test 3.1.2 and it mostly seems to work okay, but after some runtime I got the above error and crash. Sadly don't have a lot more to help debug this, though it may have been during a reload.

Thanks, Matt

On 6/2/25 3:13 AM, Maria Matejka wrote:

Hello Matt,

[…] this is  the 3.1.2-cznic.1~trixie release, hopefully that’s enough to pull up the symbols for the positions here):

Without the corefile, we know nothing, sadly. The binaries are PIE and we need to know not only where they were mapped but also where glibc was mapped, how the stack(s) looked like and much more context.

OTOH, it looks like the corefile may be enough very soon, if our planned magic actually works. I’ll know hopefully at the end of this week.

Sadly, I don't have a corefile handy, but that shouldn't stop you! If you have symbols handy, both of the first two segfaults show a crash at instruction 278313 within the bird binary - (0x000056552fb27f29 minus the base address of the binary at 0x56552fae4000 and 0x000055a6f3935f29 minus the base address of the binary at 0x55a6f38f2000). That should suffice to turn up the line of code where the segfault happened, which presumably tells quite a lot, even if not as much as a corefile. The BFD restart shows a crash at instruction with offset 277887. Matt

Hello Łukasz, On Tue, 03 Jun 2025, Łukasz Trąbiński wrote:

Could You send me example of rpki config for Bird 3.x.x? In 2.x.x, I’m use something like below, but it’s not working with 3.x.x

I'm using the following with rpki-client. I guess you need to remove the if() for force_roa_table_update when using a TCP connection instead of an include. function reject_invalid_roa() { if (force_roa_table_update > 0) then { if (net.type = NET_IP4) then { case roa_check(ROAS4, net, bgp_path.last) { ROA_INVALID: print "Rejected invalid ROA IPv4 prefix: ", net, " ", bgp_path, ", (neighbour ", from, ")"; reject; ROA_VALID: print "Valid ROA IPv4 prefix: ", net, " ", bgp_path, ", (neighbour ", from, ")"; ROA_UNKNOWN: print "Unknown ROA IPv4 prefix: ", net, " ", bgp_path, ", (neighbour ", from, ")"; } } if (net.type = NET_IP6) then { case roa_check(ROAS6, net, bgp_path.last) { ROA_INVALID: print "Rejected invalid ROA IPv6 prefix: ", net, " ", bgp_path, ", (neighbour ", from, ")"; reject; ROA_VALID: print "Valid ROA IPv6 prefix: ", net, " ", bgp_path, ", (neighbour ", from, ")"; ROA_UNKNOWN: print "Unknown ROA IPv6 prefix: ", net, " ", bgp_path, ", (neighbour ", from, ")"; } } } } The main difference is that I reject inside the function without returning a boolean. Regards, Robert

Hello Łukasz, the warning lines are also for several latest versions of BIRD 2 and they just tell you that the return type of the function has been inferred from the return call, instead of you specifying "function foo() -> bool". More on that in docs: <https://bird.nic.cz/doc/bird-3.1.2.html#filters-intro> Also please note that 3.1.1 has some serious problems with channel reload when import table is not present, please try 3.1.2 instead. Maria On June 3, 2025 5:00:39 PM GMT+02:00, "Łukasz Trąbiński" <lukasz@trabinski.net> wrote:

Hello

Could You send me example of rpki config for Bird 3.x.x? In 2.x.x, I’m use something like below, but it’s not working with 3.x.x

Jun 2 23:29:16 peer bird[2100437]: bird: 2025-06-02 23:29:16.712 [0001] <WARN> /etc/bird.conf:67:71: Inferring function is_v4_rpki_invalid return type from its return value: bool Jun 2 23:29:16 peer bird[2100437]: bird: 2025-06-02 23:29:16.712 [0001] <WARN> /etc/bird.conf:71:71: Inferring function is_v6_rpki_invalid return type from its return value: bool Jun 2 23:29:16 peer bird[2100437]: /etc/bird.conf:67:71: Inferring function is_v4_rpki_invalid return type from its return value: bool Jun 2 23:29:16 peer bird[2100437]: /etc/bird.conf:71:71: Inferring function is_v6_rpki_invalid return type from its return value: bool

—snip--

roa4 table r4; roa6 table r6;

protocol rpki rpki1 { roa4 { table r4; }; roa6 { table r6; }; remote xx.xx.xx.xx port 3323; retry 300; }

function is_v4_rpki_invalid () { return roa_check(r4, net, bgp_path.last_nonaggregated) = ROA_INVALID; }

function is_v6_rpki_invalid () { return roa_check(r6, net, bgp_path.last_nonaggregated) = ROA_INVALID; }

filters bgp_import { if is_v4_rpki_invalid() then reject; accept; }

— snip —

-- Maria Matejka (she/her) | BIRD Team Leader | CZ.NIC, z.s.p.o.