January 2021 - frog - lists.frrouting.org

Yocto Recipe for FRR
by Amol Lad 10 Aug '21

10 Aug '21

Hi, Please advise if there is any Yocto recipe for FRRouting? If not, how to go about creating one for FRR? Yocto Recipe for FRR will hugely simplify integrating FRR in Yocto based embedded linux distributions. So please advise if there are any plans to develop this recipe? Thanks Amol ________________________________ The information in this email communication (inclusive of attachments) is confidential to 4RF Limited and the intended recipient(s). If you are not the intended recipient(s), please note that any use, disclosure, distribution or copying of this information or any part thereof is strictly prohibited and that the author accepts no liability for the consequences of any action taken on the basis of the information provided. If you have received this email in error, please notify the sender immediately by return email and then delete all instances of this email from your system. 4RF Limited will not accept responsibility for any consequences associated with the use of this email (including, but not limited to, damages sustained as a result of any viruses and/or any action or lack of action taken in reliance on it).

4 10

Binding two IP addresses to bgpd
by Matt Riffle 04 Mar '21

04 Mar '21

Apologies if I’m missing something easy here — I think I’ve looked at this for too long. I want my bgpd process to listen to 2 IP addresses — one IPv4 and one IPv6. I cannot find a syntax that allows this to happen. I can listen to one or the other. I really don’t want to run two bgpd processes to accomplish it. (I could let it bind to the default 0.0.0.0 / :: and use a firewall, but, again, I’d rather just bind to the two addresses I need it on, if possible.) Thanks, -Matt

6 6

nhrpd event manager
by Joe Maimon 01 Mar '21

01 Mar '21

I have successfully gotten frr,nhrpd,strongswan,charon all running on another system for a dmvpn application. I am currently trying to do another setup, but without vpn/ipsec, just nhrp/gre. Its not working out well, debug logs show Netlink: Received msg_type 28 which if I recall correctly suggests that the neighbor entry isnt being installed correctly, trying it as root worked even less. So while poking around, I see there is an entire event manager unix sock structure. Perhaps I can parse that and do it myself? However, this is as far as I got. I am interacting with it via shell script. Mar 15 08:11:35 debian67 nhrpd[20977]: evmgr: sending event authorize-binding Mar 15 08:11:35 debian67 nhrpd[20977]: Send Registration-Reply(4) 192.168.241.129 -> 192.168.241.130 Mar 15 08:11:35 debian67 nhrpd[20977]: PACKET: Send 45.77.146.76 -> 209.51.164.27 Mar 15 08:11:35 debian67 nhrpd[20977]: evmgr: msg: eventid=214 Mar 15 08:11:35 debian67 nhrpd[20977]: evmgr: msg: result=accept Mar 15 08:11:35 debian67 nhrpd[20977]: evmgr: msg: Mar 15 08:11:35 debian67 nhrpd[20977]: evmgr: received: eventid=214 result= Mar 15 08:11:45 debian67 nhrpd[20977]: cache: t67 192.168.241.130: timeout Mar 15 08:11:46 debian67 nhrpd[20977]: Netlink: Received msg_type 28, msg_flags 0 I have looked at the source and I cant seem to convince the function to recognize that result should be "accept". Any advice appreciated. Joe For the interested, the below is the fledgling script #!/bin/bash PROGNAME=`basename $0` VERSION="0.0.1" usage() { echo "Usage: $PROGNAME -s nhrp-sock [-i interface-name] [-u user] [-g group] " echo "" echo "-s nhrp-sock file" echo "-i interface-name to execute on, may be repeated multiple times" echo "-u user to own the sock" echo "-g group to own the sock" exit 1 } SOCK="/var/run/frr/nhrp.sock" USER="frr" GROUP="frr" j=0 while getopts s:i:u:g: opt; do case "$opt" in s) SOCK="$OPTARG" ;; i) INTARR[((j++))]="$OPTARG" ;; u) USER="$OPTARG" ;; g) GROUP="$OPTARG" ;; esac; done coproc socat - UNIX-LISTEN:$SOCK,unlink-early,setuid-early=$USER || exit 1 OLDIFS="$IFS" while read -r S; do if [[ "$S" == "" ]]; then if [[ "$EVID" != "" ]]; then echo -e "eventid=$EVID\nresult=accept\n"; fi unset EVID unset EVINT continue; fi IFS="${IFS}=" SA=($S) IFS="$OLDIFS" case "${SA[0]}" in eventid) EVID="${SA[1]}" ;; interface) EVINT="${SA[1]}" esac done <&"${COPROC[0]}" >&"${COPROC[1]}" kill "$COPROC_PID"

2 3

NHRP multiple issues
by Volodymyr Litovka 29 Jan '21

29 Jan '21

Hi colleagues, I tried to implement NHRP using FRR 7.5 (Ubuntu 20) and facing so much issues, that I'm in doubts that NHRP is production-ready. Is it? My test topology is the following: + NHRP: 10.0.0.254 | +-----------+ | +------------+ | | | | | | HUB +-----+ | Spoke (S1) | | 10.9.8.53 | | | 10.9.8.241 | | | +------+ | +--+--------+ | +------------+ | | NHRP: 10.0.0.1 | + LAN: 10.2.1.241/24 | +---+-+ | | +-----+ | Routed | +---- network | | +-----+ +---+--+ | | +------+-----+ | | | Spoke (S2) | | 10.1.2.242 | | | +------------+ NHRP: 10.0.0.2 LAN: 10.2.2.242/24 At the moment, I'm trying to play without IPSec encryption (so no 'tunnel protection' on the gre interfaces) and configurations of nodes (HUB, S1; S2 is similar to S1) are: HUB (NBMA 10.9.8.53): nhrp nflog-group 1 ! ip route 10.0.0.0/24 Null0 ! interface gre1 description DMVPN Tunnel Interface ip address 10.0.0.254/32 ip nhrp map 10.0.0.1 10.9.8.241 ip nhrp map 10.0.0.2 10.1.2.242 ip nhrp network-id 1 ip nhrp redirect ip nhrp registration no-unique ip nhrp shortcut tunnel source eth1 ! router bgp 65000 bgp router-id 10.0.0.254 neighbor 10.0.0.1 remote-as 65000 neighbor 10.0.0.1 disable-connected-check neighbor 10.0.0.1 update-source 10.0.0.254 neighbor 10.0.0.2 remote-as 65000 neighbor 10.0.0.2 disable-connected-check neighbor 10.0.0.2 update-source 10.0.0.254 ! address-family ipv4 unicast network 10.0.0.0/24 redistribute nhrp neighbor 10.0.0.1 route-reflector-client neighbor 10.0.0.2 route-reflector-client exit-address-family S1 (NBMA 10.9.8.241): ip route 10.2.1.0/24 Null0 ! interface gre1 description DMVPN Tunnel Interface ip address 10.0.0.1/32 ip nhrp network-id 1 ip nhrp map 10.0.0.254 10.9.8.53 ip nhrp redirect ip nhrp registration no-unique ip nhrp shortcut tunnel source eth0 ! router bgp 65000 bgp router-id 10.0.0.1 no bgp ebgp-requires-policy neighbor 10.0.0.254 remote-as 65000 neighbor 10.0.0.254 disable-connected-check neighbor 10.0.0.254 update-source 10.0.0.1 ! address-family ipv4 unicast network 10.2.1.0/24 exit-address-family S2 is same as S1 except is has nbma address 10.1.2.242 and NHRP address is 10.0.0.2 On all hosts configuration of GRE intfs is same (except IP address): ip tunnel add gre1 mode gre key 42 ttl 64 ip addr add 10.0.0.xxx/32 dev gre1 ip link set gre1 up The issues are: - unlike all examples (incl. official), NHRP neighborhood is not established until I specify explicit mapping on Hub, using 'ip nhrp map ...' - though, if I do 'ip link set gre1 down' and then 'up', FRR loses 'ip nhrp map ...' config and, thus, loses connectivity - if, on spoke, I use instead 'ip nhrp nhs dynamic nbma 10.9.8.53' - it persists between interfaces down/up events, but, in fact, it never finds nhrp hub, keeping forever in the following state: s1# sh ip nhrp Iface Type Protocol NBMA Flags Identity gre1 local 10.0.0.1 - - - nevertheless, while using 'ip nhrp map' everywhere (incl. S2) and see established neighborship and BGP and, thus, LAN prefixes announces, I try to ping S1's LAN from S2: * before ping S2's RT shows the route: root@s2:~# ip route 10.2.1.0/24 nhid 32 via 10.0.0.254 dev gre1 proto bgp metric 20 onlink first two ping go through hub and then, after it signals to build the direct tunnel, connectivity passes away: root@s2:~# ping 10.2.1.241 PING 10.2.1.241 (10.2.1.241) 56(84) bytes of data. 64 bytes from 10.2.1.241: icmp_seq=1 ttl=64 time=2.31 ms 64 bytes from 10.2.1.241: icmp_seq=2 ttl=64 time=1.10 ms From 10.0.0.2 icmp_seq=3 Destination Host Unreachable From 10.0.0.2 icmp_seq=4 Destination Host Unreachable ^C but S2's RT is expanded with new entry (10.2.1.241): root@s2:~# ip route 10.2.1.0/24 nhid 38 via 10.0.0.1 dev gre1 proto bgp metric 20 onlink 10.2.1.241 nhid 29 dev gre1 proto nhrp metric 20 Questions are: 1) whether it's possible to keep as less as possible configuration on the Hub, avoiding direct mapping for every spoke? (here in tests I used BGP, but want to move to OSPF and get rid of any pre-spoke configuration on hubs) 2) disappearing of 'ip nhrp map' during interface up/down - whether it is bug or feature? If latter - what is rationale behind this? 3) 'ip nhrp nhs dynamic' do not establish NHRP neighborhood - what I'm doing wrong? 4) peer unreachability after NHRP redirect - is it case for 'tunnel protection' or another issue? Thank you. -- Volodymyr Litovka "Vision without Execution is Hallucination." -- Thomas Edison

2 1

ospfd: duplicate configuration shown when multiple instances of ospf running
by Amol Lad 25 Jan '21

25 Jan '21

Hi, 1. I'm testing this in FRR master. 2. /etc/frr/frr.conf is deleted so per daemon configuration file can be used 3. enabled ospfd_instances=2,3,4,5 in /etc/frr/daemons ospfd=yes ospfd_instances=2,3,4,5 Now, do "no router instance-id" for all instances and then "router ospf" and add below statements: ospf router-id 1.1.1.1 network 20.20.20.0/24 area 0 Please notice that configuration is "replicated" and if I save the configuration then above conf is written to all conf files. Please advise === amol@amol-Virtual-Machine:~/frr$ sudo vtysh % Can't open configuration file /etc/frr/vtysh.conf due to 'No such file or directory'. Hello, this is FRRouting (version 7.6-dev-MyOwnFRRVersion-g82b844d8d). Copyright 1996-2005 Kunihiro Ishiguro, et al. This is a git build of frr-7.4-dev-1400-g82b844d8d Associated branch(es): local:master github/FRRouting/frr.git/master amol-Virtual-Machine# sh run Building configuration... Current configuration: ! frr version 7.6-dev-MyOwnFRRVersion frr defaults traditional hostname amol-Virtual-Machine no ip forwarding no ipv6 forwarding ! router ospf 2 ! router ospf 3 ! router ospf 4 ! router ospf 5 ! line vty ! end amol-Virtual-Machine# conf term amol-Virtual-Machine(config)# no router ospf 2 amol-Virtual-Machine(config)# no router ospf 3 amol-Virtual-Machine(config)# no router ospf 4 amol-Virtual-Machine(config)# no router ospf 5 amol-Virtual-Machine(config)# router ospf amol-Virtual-Machine(config-router)# ospf router-id 1.1.1.1 amol-Virtual-Machine(config-router)# network 20.20.20.0/24 area 0 amol-Virtual-Machine(config-router)# do sh run Building configuration... Current configuration: ! frr version 7.6-dev-MyOwnFRRVersion frr defaults traditional hostname amol-Virtual-Machine no ip forwarding no ipv6 forwarding ! router ospf ospf router-id 1.1.1.1 network 20.20.20.0/24 area 0 ospf router-id 1.1.1.1 network 20.20.20.0/24 area 0 ospf router-id 1.1.1.1 network 20.20.20.0/24 area 0 ospf router-id 1.1.1.1 network 20.20.20.0/24 area 0 ! line vty ! end ====

1 0

IPV6 RA, RS, NS
by Amjad Ali 18 Jan '21

18 Jan '21

Hi All, So I'm looking at FRR for testing some IPV6 features, in the code I see the router advertisement part implemented but was wondering where is the NS and NA part implemented. If anyone can shed some light, thanks in advance. Ali

2 1

migration issues frr6 to frr7 on FreeBSD11
by mike tancsa 16 Jan '21

16 Jan '21

Ran into a strange issue when I upgraded frr6 to frr7 on a FreeBSD 11 box. We have a LOT of bgp peers terminated (650 -- not all established) with a routing table less than 500 prefixes. Everything was working just fine on 6, but upgrading to 7, bgp would sig6 a few min after startup. Not much in the logs. Jan 16 12:25:33 kit-b zebra[88629]: [EC 4043309122] Client 'bgp' encountered an error and is shutting down. Jan 16 12:25:33 kit-b zebra[88629]: [EC 4043309122] Client 'vnc' encountered an error and is shutting down. Jan 16 12:25:33 kit-b zebra[88629]: release_daemon_table_chunks: Released 0 table chunks Jan 16 12:25:33 kit-b zebra[88629]: zebra/zebra_ptm.c:1348 failed to find process pid registration Jan 16 12:25:33 kit-b zebra[88629]: client 11 disconnected 66 bgp routes removed from the rib Jan 16 12:25:33 kit-b zebra[88629]: release_daemon_table_chunks: Released 0 table chunks Jan 16 12:25:33 kit-b zebra[88629]: client 24 disconnected 0 vnc routes removed from the rib Jan 16 12:25:33 kit-b zebra[88629]: [EC 100663303] kernel_rtm: 0.0.0.0/0: rtm_write() unexpectedly returned -4 for command RTM_DELETE It would also generate a lot of kernel messages while the daemon was running such as Jan 16 16:00:59 kit-b kernel: sonewconn: pcb 0xfffff801e65123a0: Listen queue overflow: 193 already in queue awaiting acceptance (622 occurrences) Jan 16 16:01:59 kit-b kernel: sonewconn: pcb 0xfffff801e65123a0: Listen queue overflow: 193 already in queue awaiting acceptance (557 occurrences) Jan 16 16:02:59 kit-b kernel: sonewconn: pcb 0xfffff801e65123a0: Listen queue overflow: 193 already in queue awaiting acceptance (622 occurrences) Jan 16 16:03:59 kit-b kernel: sonewconn: pcb 0xfffff801e65123a0: Listen queue overflow: 193 already in queue awaiting acceptance (556 occurrences) that are not generated when running frr6. The problem version was built from the ports. 7.5_1. The only I option I used was build vtysh. In case it was some memory issue, I tried a version with tcmalloc, however it was failing as well. We use frr7 elsewhere with a lot less peers and all works just fine, but those are on RELENG_12. As this is a production box, I cant do much experimenting on it. Not sure how to recreate in the lab easily. Do these problems ring a bell with anyone ? the box is pretty quiet. There are no memory nor CPU pressures on it. It doesnt seem to be a "thundering herd" problem as I tried shutting half the peers at startup to no avail. ---Mike

1 0

ipv6 router advertisement
by Amjad Ali 13 Jan '21

13 Jan '21

Hi All, Just starting with FRR so a simple question if someone can answer. Does FRR uses radvd daemon for RS and RA or is there some other mechanism? Thanks, Ali

2 1