- frog - lists.frrouting.org

Re: [FROG] Distribution with FRRouting ?
by Jafar Al-Gharaibeh 08 Mar '21

08 Mar '21

FRR + UFW maybe? --Jafar On 3/6/21 12:22 PM, bsd--- via frog wrote: > _______________________________________________ > frog mailing list > frog(a)lists.frrouting.org > https://lists.frrouting.org/listinfo/frog

1 0

Announcing the 7.5.1 release of FRR
by Martin Winter 08 Mar '21

08 Mar '21

All, We are pleased to announce FRR 7.5.1. This is a maintenance release of FRR 7.5 with lots of bug fixes Debian Packaging - https://deb.frrouting.org/ RPM Packaging - https://rpm.frrouting.org/ Snap Packaging - https://snapcraft.io/frr This release contains the following fixes: BABEL Fix connected route leak on change BFD Session lookup was sometimes wrong Memory leak and handling cleanups In some situations handle vrf appropriately when receiving packets BGP Peer Group Inheritance Fixes Dissallow attempt to peer peers reachable via blackholes Send BMP down message when reachability fails Cleanup handling of aggregator data when the AGG AS is 0 Handle `neighbor <peer-group allowas-in` config changes properly Properly parse community and lcommunity values in some circumstances Allow peer-groups to configure `ttl-security hops` Prevent v6 routes with v4 nexthops from being installed Allow `default-originate` to be cleared from a peer group Fix evpn route-map vni filter at origin local routes were using non-default distance Properly track if the nexthop was updated in some circumstances Cleanup `show running` when running bgp with `-e X` values Various Memory leaks in show commands Properly withdraw exported routes when deleting a VRF Avoid resetting ebgp-multihop if peer setting is the same as peer-group Properly encode flowspec rules to zebra in some rare circumstances Generate statistics for routes in bgp when we have exactly 1 route Properly apply route-map for the default-originate command EIGRP Properly set MTU for eigrp packets sent Various memory leaks and using uninited data fixes ISIS When last area address is removed, resign if we were the DR Various memory leaks and using uninited data fixes LDP Various memory leaks and using uninited data fixes NHRP Use onlink routes when prefix == nh Shortcut routes are installed with proper nexthop OSPF Prevent duplicate packet read in multiple vrf situation Fix area removal at interface level Restore Point to MultiPoint interface types Correctly handle MTU change on startup Multi Instance initialization sometimes was not successful NSSA translate-always was not working properly OSPFv3 Don't send hellos on loopback interfaces Handle ECMP better when a sub-path is removed Memory leak and handling fixes Fix Link LSA not updating when router priority is modified Some output from show commands was wrong Intra area remote connected prefixes sometimes not installed PBR Various memory leaks and using uninited data fixes PIM SGRpt prune received during prune didn't override holdtime Various memory leaks and using uninited data fixes STATIC Fix VRF and usage on startup in some instances Tableid was being mishandled in some cases VTYSH Disable bracketed paste in readline. WATCHFRR Various memory leaks and using uninited data fixes ZEBRA Always install blackhole routes using kernel routes instead of nexthops Various memory leaks and using uninited data fixes Dissallow resolution to duplicate nexthops that created infinite nexthops Apply the route-map delay-timer globally Some routes were stuck in Queued state when using the FPM Better handle vrf creation when using namespaces Set NUD_NOARP on sticky mac entries in addtion to NTF_STICKY Allow `set src X` to work on startup FRR Library Fix a variety of memory leaks Fix VRF Creation in some instances RPKI context editing was not properly handled in reload situations routemap code was not properly handling modification of CLI in some instances SNAPCRAFT Update to using rtrlib 0.7.0 Fix passthrough path for Libyang 1.x ALPINE Remove old docker deps

1 0

Distribution with FRRouting ?
by bsd＠todoo.biz 06 Mar '21

06 Mar '21

Hello, We are looking for a solution to implement FRRouting for a routing / firewalling project with Overlay SDN with VxLAN, BGP-EVPN. We were first thinking of using pfSense, but the FreeBSD branch does not seem to have a support for SDN VxLAN overlay… and pfSense is no longer OpenSource ! So my question is the following : is there any packaged FRR that will have both a firewall and the complete FRR + SDN overlay ? Otherwise, what I came up with was to split the install of routing (for exemple on a Debian + FRR) and the firewalling stack. What do you think will be the best FRR + Firewall solution to your knowledge (and Open Source ;-) ? Sincerely yours. --- bsd(a)todoo.biz web: https://www.dynfi.com PGP_ID: 0x1BA3C2FD

1 0

Binding two IP addresses to bgpd
by Matt Riffle 04 Mar '21

04 Mar '21

Apologies if I’m missing something easy here — I think I’ve looked at this for too long. I want my bgpd process to listen to 2 IP addresses — one IPv4 and one IPv6. I cannot find a syntax that allows this to happen. I can listen to one or the other. I really don’t want to run two bgpd processes to accomplish it. (I could let it bind to the default 0.0.0.0 / :: and use a firewall, but, again, I’d rather just bind to the two addresses I need it on, if possible.) Thanks, -Matt

6 6

Route-map lets through unwanted routes
by jimc 04 Mar '21

04 Mar '21

@Frank Kardel, thanks very much for the hint that "distribute-list" and "redistribute" are sub-commands of "router $protocol". I would never have figured that out on my own; I completely missed traces of that relation when trying to understand the code for the Quagga parser. Now rip[ng]d are emitting packets. However, those packets advertise all routes on the host, including the default route, the next-hop's link local address, and the prefix route for the uplink, whereas I'm trying to advertise just the route to a VM on this host, which others need to connect to. Here's output from tcpdump -v with lines refolded; * indicates the wanted route: ``` 21:28:46.097311 IP (tos 0xc0, ttl 1, id 12993, offset 0, flags [DF], proto UDP (17), length 112) xenaeth.cft.ca.us.router > rip2-routers.mcast.net.router: RIPv2, Response, length: 84, routes: 4 or less Auth header: Packet Len 64, Key-ID 1, Auth Data Len 20, SeqNo 1614490126, MBZ 0, MBZ 0 AFI IPv4, 0.0.0.0/0, tag 0x0, metric: 1, next-hop: 192.9.200.193 AFI IPv4, 192.9.200.176/29, tag 0x0000, metric: 1, next-hop: self * Auth trailer: 0x0000: f848 b3d5 929a 8a0f ccfa cd6f 4e8b fe4b 21:28:46.296453 IP6 (class 0xc0, flowlabel 0x58655, hlim 255, next-header UDP (17) payload length: 92) fe80::d237:45ff:febe:5a05.ripng > ff02::9.ripng: ripng-resp 4: 2600:3c01:e000:306::/112 (1) [uplink prefix] 2600:3c01:e000:306::7:0/112 (1) [hosted VM] * fe80::5054:ff:fe09:c8c1/0 (255) [link local addr of default nexthop] ::/0 (1) [default route] ``` Here's the current conf file. This time I've removed most comments, and I split it with separate sections for ripd and ripngd. ``` password redacted#1 enable password redacted#2 log file /var/log/frr/frr.log ip prefix-list xenanet4 permit 192.9.200.176/29 ge 29 ip prefix-list xenanet4 deny any route-map cnmap4 permit 1 # route-map cnmap4 deny 2 -- Making this explicit didn't help. match ip address prefix-list xenanet4 router rip version 2 network 192.9.200.192/26 distribute-list xenanet4 in distribute-list xenanet4 out redistribute kernel redistribute static redistribute connected ip protocol rip route-map cnmap4 ipv6 prefix-list xenanet6 permit 2600:3c01:e000:306::7:0/112 ge 112 ipv6 prefix-list xenanet6 deny any route-map cnmap6 permit 1 match ipv6 address prefix-list xenanet6 route-map cnmap deny 6 # Duplicating the distribute-list and redistribute subcommands for ripng router ripng network 2600:3c01:e000:306::/112 distribute-list xenanet6 in distribute-list xenanet6 out redistribute kernel redistribute static redistribute connected ip protocol ripng route-map cnmap6 # Turn on authentication (RIP v2 only and not for RIPng). key chain CouchNet key 1 key-string 4mGwyf$NWla interface en0 ip rip authentication mode md5 ip rip authentication key-chain CouchNet interface br0 ip rip authentication mode md5 ip rip authentication key-chain CouchNet interface rad0 ip rip authentication mode md5 ip rip authentication key-chain CouchNet interface tun0 ip rip authentication mode md5 ip rip authentication key-chain CouchNet interface tun1 ip rip authentication mode md5 ip rip authentication key-chain CouchNet interface tun9 ip rip authentication mode md5 ip rip authentication key-chain CouchNet ``` Does anyone have any idea why the various filtering lists are not restricting the routes being sent out? -- James F. Carter Email: jimc(a)jfcarter.net Web: http://www.math.ucla.edu/~jimc (q.v. for PGP key)

3 2

route-map set metric
by Joe Maimon 02 Mar '21

02 Mar '21

set metric shows -metric and +metric I have no idea how to use that, with IOS you can use the + or - with the metric number to either add to the existing metric or subtract I cant seem to duplicate that effect using the available syntax, in any event, I would think that configuration syntax compatibility in this instant would be a plus.

3 9

nhrpd event manager
by Joe Maimon 01 Mar '21

01 Mar '21

I have successfully gotten frr,nhrpd,strongswan,charon all running on another system for a dmvpn application. I am currently trying to do another setup, but without vpn/ipsec, just nhrp/gre. Its not working out well, debug logs show Netlink: Received msg_type 28 which if I recall correctly suggests that the neighbor entry isnt being installed correctly, trying it as root worked even less. So while poking around, I see there is an entire event manager unix sock structure. Perhaps I can parse that and do it myself? However, this is as far as I got. I am interacting with it via shell script. Mar 15 08:11:35 debian67 nhrpd[20977]: evmgr: sending event authorize-binding Mar 15 08:11:35 debian67 nhrpd[20977]: Send Registration-Reply(4) 192.168.241.129 -> 192.168.241.130 Mar 15 08:11:35 debian67 nhrpd[20977]: PACKET: Send 45.77.146.76 -> 209.51.164.27 Mar 15 08:11:35 debian67 nhrpd[20977]: evmgr: msg: eventid=214 Mar 15 08:11:35 debian67 nhrpd[20977]: evmgr: msg: result=accept Mar 15 08:11:35 debian67 nhrpd[20977]: evmgr: msg: Mar 15 08:11:35 debian67 nhrpd[20977]: evmgr: received: eventid=214 result= Mar 15 08:11:45 debian67 nhrpd[20977]: cache: t67 192.168.241.130: timeout Mar 15 08:11:46 debian67 nhrpd[20977]: Netlink: Received msg_type 28, msg_flags 0 I have looked at the source and I cant seem to convince the function to recognize that result should be "accept". Any advice appreciated. Joe For the interested, the below is the fledgling script #!/bin/bash PROGNAME=`basename $0` VERSION="0.0.1" usage() { echo "Usage: $PROGNAME -s nhrp-sock [-i interface-name] [-u user] [-g group] " echo "" echo "-s nhrp-sock file" echo "-i interface-name to execute on, may be repeated multiple times" echo "-u user to own the sock" echo "-g group to own the sock" exit 1 } SOCK="/var/run/frr/nhrp.sock" USER="frr" GROUP="frr" j=0 while getopts s:i:u:g: opt; do case "$opt" in s) SOCK="$OPTARG" ;; i) INTARR[((j++))]="$OPTARG" ;; u) USER="$OPTARG" ;; g) GROUP="$OPTARG" ;; esac; done coproc socat - UNIX-LISTEN:$SOCK,unlink-early,setuid-early=$USER || exit 1 OLDIFS="$IFS" while read -r S; do if [[ "$S" == "" ]]; then if [[ "$EVID" != "" ]]; then echo -e "eventid=$EVID\nresult=accept\n"; fi unset EVID unset EVINT continue; fi IFS="${IFS}=" SA=($S) IFS="$OLDIFS" case "${SA[0]}" in eventid) EVID="${SA[1]}" ;; interface) EVINT="${SA[1]}" esac done <&"${COPROC[0]}" >&"${COPROC[1]}" kill "$COPROC_PID"

2 3

route-map continue
by Joe Maimon 28 Feb '21

28 Feb '21

route-map contains the command continue Since it also contains the commands on-match goto and on-match next, I suppose that continue is there for syntax compatibility with IOS. IOS allows the continue command to be used with or without a next clause number, frr does not. Joe

2 2

Re: [FROG] How to test ipv6 anycast address with frr routing?
by Chriztoffer Hansen 27 Feb '21

27 Feb '21

On Sat, 27 Feb 2021 at 01:09, yan via frog <frog(a)lists.frrouting.org> wrote: > does frr routing support ipv6 anycast address configuration? Anycast routing in the essence of things is "just" announcing the same prefix from multiple locations. > How could I test ipv6 anycast address with frr routing? In the simplest of set-ups, configure multiple hosts to originate the same prefix (e.g. /32, /128) That would be anycast at the most basic level. (What services you will want to host from the anycast IP(s) is at your own descretion.) > Is there a tutorial about this? The official docs https://docs.frrouting.org does not contain such a tutorial. Thou I suspect more than one blogpost, conference talk has been given on the topic over the years (not being FRRouting specific). But most always this will be a generalized one. Skipping any in-depth (SW specific) tutorial content. And "just" explaining the concept. -- Chriztoffer

2 1

Re: [FROG] How to test ipv6 anycast address with frr routing?
by Chriztoffer Hansen 27 Feb '21

27 Feb '21

York, On Sat, 27 Feb 2021 at 01:09, yan via frog <frog(a)lists.frrouting.org> wrote: > I want to test ipv6 anycast address with frr routing with several linux PC host. However, I cannot find a way to setup ipv6 address on my linux host which is Ubuntu 12.04. I also cannot find a way to config ipv6 address on frr routing suite. > > So does linux support ipv6 anycast address? Or does frr routing support ipv6 anycast address configuration? How could I test ipv6 anycast address with frr routing? Is there a tutorial about this? Ubuntu 12.04 from 9y ago? Have you at least tried with a more recent and (still) supported LTS version of Ubuntu? Asking, since little to no support can be expected to be given/provided if using non-supported OS releases. Also, can you specify what FRR version you are using in your set-up? -- Chriztoffer

1 0