summaryrefslogtreecommitdiff
path: root/usr.sbin/bgpd/session.h
AgeCommit message (Collapse)Author
2024-04-22Move setting of the shutdown reason to session_stop()Claudio Jeker
Also make sure that something is logged when a session is stopped. Part of a bigger diff which was OK tb@
2024-03-22Rework parse_notification() to use the ibuf API for everything.Claudio Jeker
While there fix the RFC5492 handling of ERR_OPEN_CAPA (the current code has the logic inversed). ERR_OPEN_CAPA is there to signal that a needed capability is missing in our OPEN message. Just add the handling of ERR_OPEN_CAPA to log_notification(). Also rework the handling of the shutdown reason and move the printing into log_notification(). OK tb@
2024-01-16Switch session_notification() over to use a struct ibuf to carry theClaudio Jeker
extra data. With this IMSG_UPDATE_ERR can use the new imsg API. Introduce session_notification_data() for the few cases where there is no ibuf readily available. OK tb@
2024-01-11rename field ibuf to imsgbuf in struct ctl_connClaudio Jeker
OK tb@
2024-01-10Update the control.c code to use the new imsg API.Claudio Jeker
OK tb@
2023-10-19Convert the session engine to use the new ibuf API.Claudio Jeker
OK tb@
2023-10-16Improve IPv6 link-local address handlingClaudio Jeker
When a session is established determine the possible interface scope of that session. The scope is only set when the remote address is directly connected. This interface scope is passed to the RDE that uses this information when link-local nexthops are received. Again checking that a link-local nexthop is actually acceptable. OK tb@
2023-03-28Introduce a semaphore to protect intermediate state from different RTRClaudio Jeker
sessions to leak into the RDE via rtr_recalc. Only run rtr_recalc when the last or only RTR session is done with the update. Run a new timer along to ensure that the semaphore is not hold forever. The timeout is currently a very generous 60sec, no RTR cache should be that slow. OK tb@
2023-03-09Implement ASPA support in RTR by following draft-ietf-sidrops-8210bis-10.Claudio Jeker
In rtr.c renamed rtr_aspa_merge_set() to rtr_aspa_insert() and move it close to rtr_roa_insert(). In rtr_proto.c most complexity comes from the version negotiation. The ASPA parser is reasonably streight forward. The version negotiation is fragile but that is mostly because of the protocol specification and the fact that RTR cache daemons sometimes fail to send errors. OK tb@
2023-03-09Major rework of RFC9234 support. My initial interpretation of the RFC wasClaudio Jeker
too conservative. Fixes and changes include: - add role output to bgpctl, also adjust the capability output. Note, this changes the JSON output of neighbors a bit. - adjust the config parser to enable the RFC9234 role capability when there is a role set. iBGP and sessions with no role will not announce the role capability. - adjust the role capability announcement to be only on sessions that use either AFI IPv4 or IPv6 and SAFI 1 (AID_INET, AID_INET6). - if there is an OPEN notification indicating that the role capability is bad only disable the capability if it is not enforced. - Adjust capability negotiation, store remote_role on the peer since the neighbors role is no longer needed by the RDE. - inject the OTC attribute on ingress only for AID_INET and AID_INET6. For other AIDs clear the F_ATTR_OTC_LOOP flag. - Adjust the role logic in the RDE and use the peer->role (local role of the system) for all checks. Also remove the check if the role capability was negotiated between peers. - In prefix_eligible() check also if the F_ATTR_OTC_LOOP flag is set. The RFC requires that prefixes must be considered ineligible (and not treat as withdraw as done before) - When generating an UPDATE include the OTC attribute unless the AID is neither AID_INET or AID_INET6. Fixes https://github.com/openbgpd-portable/openbgpd-portable/issues/51 Reported by Pier Carlo Chiodi OK tb@
2023-02-09Instead of relaying struct peer from the SE to the RDE to fill out 10Claudio Jeker
stat numbers, just send the peerid and have the RDE response with the stats. The control code will then merge these counters into the real peer struct and send that to bgpctl. This reduces the number of bytes sent around a fair bit. OK tb@
2022-08-29Export pending update and withdraw as part of struct peer_stats.Claudio Jeker
OK tb@
2022-07-28whitespace found during a read-thru; ok claudioTheo de Raadt
2022-06-27Add support for RFC 9234 - Route Leak Prevention and Detection Using RolesClaudio Jeker
With this it is possible to send a role in the OPEN message and if that was successful the RDE will add the new OTC attribute if necessary. OK tb@
2022-06-15Do not use defines from pfkeyv2.h in portable code.Claudio Jeker
Instead define our own algorithm enums for the IPsec code. OK tb@ sthen@
2022-02-06Switch from u_intX_t types to stdint.h uintX_t. Mostly mechanical withClaudio Jeker
a few reindents. OK florian@ tb@
2021-09-03Add add-path support in MRT dumps (RFC8050).Claudio Jeker
This works for table-v2 formats and also for the all and update dumps. For the latter the code needs to inspect the UPDATE message to guess if add-path is used in that message or not. Add-path can be enabled per AFI and alters the NLRI encoding without any way to detect. For table dumps we decided to dump RIB_GENERIC entires the same way as gobgp and not use the encoding from the RFC. The RFC specifies that RIB_GENERIC (non-IPv4/v6) entries in a way that is not only different but also against the normal codeflow. Only gobgp seems to implement RIB_GENERIC encoding (neither bird nor frr/quagga do) and so it makes sense to follow their way. OK benno@
2021-07-27Implement RFC9072: Extended Optional Parameters Length for BGP OPEN MessageClaudio Jeker
This allows to send more then 255 bytes of optional parameters. With this it is possible to send more capabilities. bgpd will switch automatically to the new extended lenght format if needed but by default the old 1 byte param length encoding is used to keep compatible with old systems. OK benno@
2021-05-27bgpd(8) will soon support ADD-PATH (RFC7911) and enhanced route refreshClaudio Jeker
(RFC7313). This is the frist step toward this. It adds the capability parsers for the two no capabilities, extends the capability struct and adds the capability negotiation bits. The route refresh message parser and generator are extended to support the BoRR and EoRR message. Also add the new NOTIFICATION type and subtype for the route refresh message.
2021-02-16Add RTR support to OpenBGPD. Add basic support for the protocol.Claudio Jeker
The RTR client runs in a new process where the protocol handling is done and when new data is available all sources are merged into one ROA set which is then loaded into the RDE. The roa-set from the config is also handled by the new RTR engine. Tested by and ok job@
2020-12-23BGP uses KEEPALIVE packets and the HOLD timer to detect stalled sessions.Claudio Jeker
The problem is that this timer only looks at the receive side of the TCP session. If for some reason the send side stalls the system fully depends on the remote BGP peer to reset the session. As seen in an ever growing OutQ and as a result important changes can get stalled and cause routing troubles. This change introduces a SEND HOLD timer. The timer is reset whenever the session engine was able to write data to the TCP socket. If the send hold timer expires bgpd was not able to send any data to that neighbor for at least 90 seconds and therefor the session is forcefully closed with a hold timer expired notification. The send hold timer acts as a last resort to detect faulty peers. On an idle session it can take a long time until this timer triggers but the main goal here is to reset a stuck session at some point which did not happen before. With and OK job@
2020-12-11Make the timer code independent of struct peer this way it can be usedClaudio Jeker
in other places as well. ok procter@
2020-11-05Refactor the control code to be more like a module.Claudio Jeker
Change control_dispatch_msg() to return the change of control connection count since the return value was not used before. Add control_fill_pfds() to replace the TAILQ_FOREACH loop in session.c. This allows to move the ctl_conns symbol to control.c (from session.h where it caused issues when compiled with -fno-common). OK benno@
2020-05-10In bgpctl argument parser, re-arrange 'reason' parsing ('nei action [reason]')Theo de Raadt
to be more generic, then change 'reload' to take take a '[reason]' also, which will be logged by bgpd. ok kn claudio
2020-02-12Move the code to figure out the alternate IP address (IPv6 addr for IPv4Claudio Jeker
sessions and vice versa) from the RDE to the SE. The SE is the right place for this since there getsockname(2) fetches the local address and so the alternate one can be fetched there as well. With this the route pledge is no longer needed in the RDE and the pledge is now just "stdio recvfd". OK benno@
2020-01-24Implement 'max-prefix NUM out' to limit the number of announced prefixes.Claudio Jeker
This is an easy safety switch to not leak full tables to upstreams and peers. If the limit is hit a Cease notification is sent and the session is closed. This implements most of https://tools.ietf.org/html/draft-sa-idr-maxprefix-00 OK job@
2020-01-21Add last_rcvd_errcode and last_rcvd_suberr to the peer_stats so thatClaudio Jeker
not only sent errors can be reported but also received ones. OK denis@ deraadt@
2020-01-09Convert last_updown and last_read from time(3) to use getmonotime()Claudio Jeker
which returns clock_gettime(2) with CLOCK_MONOTONIC. While doing that introduce last_write for symetry. OK denis@
2019-10-01Add some TCP MD5SUM specific calls needed by protable. On Linux systemsClaudio Jeker
there is no pfkey interface and instead the loading is done via setsockopts. To make this work correctly there are some additional functions needed when peers get reconfigured or when new listeners show up. OK benno@
2019-09-30Pass a struct listen_addr pointer to tcp_md5_listen and not just the fd,Claudio Jeker
the linux shim needs this.
2019-05-27Switch the peer TAILQ to a RB tree indexed by the peer id. This wayClaudio Jeker
getpeerbyid() gets a lot quicker at finding the peer when many peers are configured. In my test case the difference is around 20% runtime. OK denis@
2019-05-24Change timer_nextisdue() and timer_nextduein() to take the current timeClaudio Jeker
as an argument. This way getmonotime() can be called once at the start of looping over all peers instead of twice during the loop. Makes a big difference with many peers. OK florian@ sthen@
2019-05-08Rework the TCP md5sig and IKE handling. Move the pfkey socket to the parentClaudio Jeker
process in this process. The refreshing of the keys is done whenever the session state is changes to state IDLE or ACTIVE. This should behave better when reloading configs with auth changes. OK benno@
2019-04-07Be more careful when setting timeout to 0 because there is pending workClaudio Jeker
on a peer. Just checking the peer read buffer size is not enough since the data present could be a partial message and so the SE should sleep until a new POLLIN event fires. Adjust the logic by adding a rpending flag that is only set if reading the session buffer was exited early because MSG_PROCESS_LIMIT was hit. OK benno@
2019-03-31Move the struct peer into bgpd_config and switch it to a TAILQ instead ofClaudio Jeker
the hand-rolled list. This changes the way peers are reloaded since now both parent and session engine are now merging the lists. OK denis@
2019-03-07Do a better job at cleaning up the config on shutdown. Remove bits thatClaudio Jeker
were missed before (e.g. network related objects). This helps to detect memory leaks. Start using new_config() and free_config() in all places where bgpd_config structure are used. This way the struct is properly initialised and cleaned up. Introduce copy_config() to only copy the values into the other struct leaving the pointers as they were. Looks good to benno@
2019-02-27Convert the remote and local addresses in struct peer to be bgpd_addrsClaudio Jeker
instead of sockaddr_storage. This again helps protability and simplifies some code. sa2addr now takes an optional pointer to return the port of the sockaddr. OK benno@
2019-02-19Convert some (u_)int64_t to (unsigned) long long. Makes portability a bitClaudio Jeker
nicer since it requires less casts. sigh deraadt@
2019-02-18Move get_mpe_config() to kroute.c so that config.c does not depend onClaudio Jeker
system specific code.
2019-02-18Do not depend on the length field of struct sockaddr instead pass theClaudio Jeker
length to the various functions needing it. Helps portability. OK benno@
2019-02-11The definition of VPNs in bgpd was never super elegant. The 'depend onClaudio Jeker
mpeX' config was a bit redundant. Also to make it more flexible (e.g. having more than one mpeX interface per rdomain the syntax was changed. To make this possible especially the network distribution logic had to be adjusted and cleaned up. This should in general make network statements well defined and conflicts between 'network A.B.C.D/N' and e.g. 'network static' are handled in a well defined way ('network A.B.C.D/N' has preference). With and OK dlg@, OK denis@
2019-01-20Support group descriptions in control messages that accept a neighborClaudio Jeker
description. With this it is possible to show rib a group of peers, to show or signal a group of peers all at once. OK sthen@ benno@
2018-12-27Check if a control socket or address is already in use befor using it.remi
If it is used abort startup or let a reload fail. Sockets are now not unlinked anymore on regular shutdown. This helps a lot when one tries to do a config check without -n. Inputs and OK claudio@
2018-12-22bgpctl can cause bgpd to do a lot of work (e.g. dumping all of the RIB)Claudio Jeker
but then bgpctl can quickly exit and bgpd still has to do all the work. Instead introduce a terminate imsg to stop such long running commands if bgpctl closes the connection before the run is over. OK benno@, sthen@, deraadt@
2018-10-24Major refactoring of the RIB handling code. Mainly change how the RIB isClaudio Jeker
walked. rib_dump_r() is now an internal function and instead the code gets an additional callback for throttling the rib_dump code. This removes a lot of similar code used to make sure the RDE is not walking to fast and replaces it with simpler callbacks. The other big change is the removal of struct rib pointers in other data structures. The rib pointers are not stable because of a realloc() call happening when extending the array so instead use the RIB ID as a reference. Tested and OK denis@ and benno@
2018-09-20whitespace cleanup, ok claudio@Sebastian Benoit
2017-05-28Implement an XON/XOFF protocol between the RDE and the SE to throttleClaudio Jeker
per control session and peer the generation of imsg in the RDE. This reduces the memory pressure in the SE substantially and also a bit in the RDE. Makes the RDE more responsive for bgpctl commands. Tested by me with 100 peers * 2000 prefixes and by phessler@ on an AMS-IX border router with 200+ session. Convergance time got quite a bit better. OK phessler@
2017-01-13Add support for draft-ietf-idr-shutdownPeter Hessler
BGP state = Idle, marked down with shutdown reason "goodbye, we are upgrading to openbsd 6.1", down for 00:00:17 developed by Peter van Dijk <peter.van.dijk@powerdns.com> and Job Snijders <job@ntt.net>, thank you! OK benno@
2015-10-25Rename imsg_compose_parent and imsg_compose_rde to imsg_ctl_parent andClaudio Jeker
imsg_ctl_rde since these function should only be used by the control code. Also switch ibuf_rde to ibuf_rde_ctl so that the control imsgs don't need to queue behind all the incoming bgp UPDATES. This speeds up 'bgpctl show' from taking minutes to a few seconds. The RDE was doing this since a very long time but it seems the SE was not adjusted. Yikes
2015-10-11some peers are following an expired draft RFC and are sending "unknown"Peter Hessler
error codes to OPEN messages. make them "known", and show them. OK benno@, claudio@, sthen@
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-23 16:49:22 +0000