Re: Making a wish ... errr ... *four* wishes! 😳

[Clemens Schrimpe]

So, to follow up on this ... sorry for the long time it took for this response, but the "other life" called and demanded time.
(hence the full inclusion of the original texts to allow for easier re-sync on the topics)

> On 24. Jan 2018, at 14:51, Ondrej Zajicek <santiago at crfreenet.org> wrote:
> 
> On Wed, Jan 24, 2018 at 09:15:36AM +0100, Clemens Schrimpe wrote:
>> Gentlepeople (especially those from the BIRD development team) -
>> 
>> being an avid BIRD user for some time now I always kept a small list of
>> „it would be nice, if …“-things for BIRD 1.x, which I kept for myself, as
>> I knew BIRD 2.x was in the works (and thus people were busy already…),
>> but now I get the feeling, that 2.x is slowly stabilizing and I’d like to
>> put them on the table for open discussion:
> 
> Hello
> 
> First, i am glad for such feedback and feature suggestions. It is nice to
> get more user feedback than just bugreports (although i do not want to
> downplay importance of bugreports ;-)).

Oh. You shouldn't have said that. I have *tons* of wild ideas, but see below ;-)


>> Simple things, a.k.a. low hanging fruits:
>> 
>> (Optional) unicast replies to IPv6 RS
>> 
>> As one of my many uses for BIRD is in large wireless environments (i.e., IETF meetings) I am very interested in keeping the amount of multicast traffic as low as possible. The standards allow for a router to (immediately) respond with a unicast RA to an RS as an alternative to sending out a multicast RA „some (short, random) time“ after receiving an RS. Many others (Juniper, et.al.) have implemented this and I’d like to see this in BIRD too. The code changes are apparently very simple, so I almost did it myself, but then I didn’t want to interfere with ongoing 2.x developments.
>> (lame excuse, I know …)
> 
> Seems simple and makes perfect sense. Will do.

Thank you. That was easy.
(the next IETF meeting, where this could become be very useful, will be in mid-March ... :-) :-) :-)


>> Context dependent (global) „variables“ for functions/filters
>> 
>> I (and probably others too) would really enjoy having more global variables defined for use inside filters & functions, depending on the context within which the respective filter/function is being called. The most obvious ones would be the peer’s (and our own) AS number (in the context of BGP protocols), the filtering direction, the protocol (type and name), the next hop’s address (where applicable), and so on.
>> 
>> Yes, I know, most of these could be explicitly given (at least to a function) when calling it as the import/export filter for a protocol with a „where“ clause, but that would defeat the purpose of using templates (which I really do like and use a lot).
>> 
>> The general concept of having „globals“ inside functions/filters is already there - just presently only in the context of the route that is being evaluated. I’d like to see this expanded into other contexts as described above. 
> 
> That is an interesting idea and also seems simple, although there are
> some caveats, e.g. filters using such context-dependent-constants would
> probably work for 'show route filter'.

Yes, I had forgotten about this (very useful) feature. However, the syntax for this could be easily amended to allow the definition of such variables via the command line, i.e.,

	show route filter foo(a=1, b="bla", ...)

> It may be useful if you could make
> a list of suggested constants.

Well ... here is what comes to mind easily:
(NB: these are not the "names" of the variables I propose; we should come up with a good naming scheme once we settled on an initial list of variables)

router id
protocol name
protocol type
address family / channel-type
local as
remote as
local interface name (outbound interface)
local address (outbound interface)
remote address 
external variables (see below)

Variables, of course, only have values inside "useful" contexts, i.e, AS number inside BGP, etc. and are otherwise "undefined".

I'l also like to propose the introduction of global variables (vs. existing constants), which can be set in the configuration file, via the command-line (i.e., "bird -D foo=42" and at runtime via birdc. Again, naming conventions have to be observed, etc. and the manual must emphasize on when exactly filters are evaluated and such.

But this would allow to build a config, whose behavior could be altered at runtime, i.e., start-up in "test-mode" and then later be switched over to "production-mode" through birdc (or any other tool using the API), among many other possibilities. It would also be nice, if variables could hold lists, most notably prefix-lists of all sorts and AS/community lists. In this case the birdc interface would require add, remove, list functions in addition to set and delete.
(yeah, I know ... way more things to specify here, like uniqueness, order, etc. -- I'll hold back until you promise not to shoot down this idea completely ;-)
Also: Can filters/functions set,add,remove,delete variables too ... oh, my /o\ ...) - would be nice, so one could easily implement one's own status counters ...


>> More „controversial“ things:
>> 
>> Maintain interface addresses (Linux et.al.)
>> 
>> It would be nice, if BIRD could be „enhanced“ [sic] to take care of addresses assigned to interfaces, i.e. establish them in the first place and afterwards maintain them, i.e., re-install static, global IPv6 addresses on interfaces, which have suffered a link-state bounce.
>> The latter is particularly interesting, since Linux -by design- removes global IPv6 addresses from an interface during a link-down state transition.
>> 
>> Rationale: The various Linux distributions have all sorts of (different and sometimes „funky“) implementations of how to establish addresses to interfaces in the first place and then „deal with them“ during link-state state changes. I would like to have BIRD take care of this relatively simple task as well as the way more complicated task of maintaining millions of routes. If only to have a clean way to define „a router“ within one system (BIRD) as opposed to „get the addresses onto the interfaces with a bunch of iproute2 commands and then start BIRD to take care of the rest“-approach I’ll have to use now. A simple „boot the machine and fire up BIRD - done“ one-stop-shopping solution, if you may.
>> 
>> This is particularly interesting to smaller, dedicated routers, like (former) OpenWRT platforms, Raspberry Pis - or (my application) Ubiquiti routers of all shapes and sizes, where I presently replace the built-in Quagga Version with BIRD. Speaking of Quagga: It takes care of interface addresses too, you know … ;-)
> 
> I have mixed feelings about that. On one hand, i would like such
> functionality, on the other hand, it is hard to defend a reason to
> integrate it to BIRD instead of being completely independent daemon,
> so it seems like creeping featurism. On the third hand, the same
> could be said for RAdv and it is still part of 'network management'
> domain.

You took one of my strongest arguments from me with the RAdv part. ;-)


> Also i would say that while it may seem like a relatively simple task
> compared to maintaining of kernel routing tables, the later one is more
> well-bounded, while the former may expand to more and more feature
> requests. It starts with setting the addressess to interfaces, continues
> with ifrename-like functionality and interface creation (as all these
> VLANs and bridges do not create themselves) and ends with DHCP/SLAAC
> clients and hooks for external commands.

I have to admit, that this could indeed become a can of worms you may not want to open. Ok.

One can draw a simple line (initially ...), though: Creation(!) of interfaces is left to other deities, like the kernel or VPN daemons, etc. - I was just worried about maintaining addresses, which are essential to making routing-protocols work in the first place. So some start-script would create the interfaces and/or add VLANs to them, build bridges, attach interfaces to them, bring up the zoo of daemons needed to create all sorts of virtual interfaces - and heck: Maybe even initially address them, but BIRD could(?) not only read those (as it already does), but by configuration maintain them too.

Yes, it's a cludge, I agree - but I really have to jump through many (fiery) hoops to prevent my Linux interfaces loose their IPv6 addresses each time the link-state bounces (which Bird also already notices, btw.)


> I though about this feature in the past and over time, i changed my
> optinion about it from 'probably no' to 'perhaps sometimes'.

Ok. Whew ... 


>> An „ipset“ protocol for Linux
>> 
>> It would be tremendously helpful to have a protocol, which would maintain given (named) „ipset <http://ipset.netfilter.org/ <http://ipset.netfilter.org/>>“ tables on Linux. This would allow for very easy interactions with iptables-based ACLs on Linux platforms. It should/could be treated like a Linux route-table, just with less/different attributes. So it should „sync“, could possibly „import“ items from the ipset, could be made „persistent“, etc.
>> 
>> Applications are numerous: From fully automatic BCP38 handling at border interfaces to (again, fully automated) suppression of bogon traffic, to statistical analysis, to … whatever. It would be a single, well defined tool to interact with the whole world of capabilities the iptables/ipsets world offers.
> 
> That is something i would have but not yet managed to get to implement it.

As others commented, there are -of course- other existing means of maintaining tables with addresses/prefixes in various OS-types and kernels, so if you chose to go down this road, others will come and demand support for those too ... 

How about: Provide a simple(!) "API" or interface to have a general means of having Bird interact with "external" types of "tables" ... (geez, it really puts a strain on my "-key to tread so lightly and as generic as possible ... :-)

What I mean is a socket-based interface to $script with a well-defined, yet simple protocol (ASCII/UTF8-based?) with the few primitives needed by Bird, like query/list/learn, set, add, delete, flush. Bird could connect to an existing daemon via Unix-Domain- or IP-Sockets or (cooler) spawn a sub-process with a given script/program and interact with it via STDIN and STDOUT (STDERR → logging) - similar to how "FCGI" used to work. This could become the Swiss-Army-Knife to interact with Bird in oh-so-many ways, among which to implement my initial idea with ipsets. 

All the basic ingredients are already contained within Bird: Opening sockets, re-trying, re-starting, sending "info" asynchronously into a potential blocking socket, waiting for input from the peer, parsing, error-handling, etc.

I'll happily work an an initial specification for such an interface, if this would be of interest!


Nuff for now - feedback very welcome!

	Clemens



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://trubka.network.cz/pipermail/bird-users/attachments/20180210/d5437799/attachment.html>