summaryrefslogtreecommitdiff
path: root/usr.sbin/bgpd
AgeCommit message (Collapse)Author
2018-10-06some minor fixes;Jason McIntyre
2018-10-04Rework man page a bit. Add 2 new sections for Set Configuration andClaudio Jeker
Network Announcements. Move stuff accordingly and add some missing bits. Input and OK sthen@ OK benno@ just push ahead jmc@
2018-10-03add filter option based on origin validation statedenis
OK claudio@
2018-10-03Update manual to reflect ROA changesdenis
With input from claudio@, sthen@ and jmc@ OK claudio@ sthen@
2018-10-01Expose BGP Origin Validation state in bgpctl show commandsjob
OK denis@ claudio@
2018-09-30vstate might be used uninitializeddenis
OK claudio@
2018-09-29Fix problems with redistribution of routes by route label.Sebastian Benoit
Bug report from Jon Williams, jon AT jonwillia DOT ms, thanks. ok claudio@
2018-09-29Implement origin validation in bgpd. This introduces two new tables, theClaudio Jeker
roa-set for RPKI based origin validation and a origin-set which allows to lookup a source-as / prefix pair. For RPKI a config can be built like this: roa-set { 165.254.255.0/24 source-as 15562 193.0.0.0/21 maxlen 24 source-as 3333 } deny from any ovs invalid match from any ovs valid set community local-as:42 match from any ovs not-found set community local-as:43 Origin sets are similar but only match when the source-as / prefix pair is valid. match from any origin-set ARINDB set community local-as:44 Committing this now so that further work can be done in tree. OK benno@, job@
2018-09-29With the introduction of sets the config that is shipped to the RDE gotClaudio Jeker
potentially much bigger. In bad cases the SE activated the config way before the RDE which is not ideal. Introduce IMSG_RECONF_DRAIN which acts as a barrier and ensures that both childs got all the config. Only after that the IMSG_RECONF_DONE message is sent activating the config in the childs more or less simultaneous. OK benno@
2018-09-29Introduce minimal tracking of announced prefixes. A per peer RB tree tracksClaudio Jeker
which prefixes were sent out as UPDATE. At withdraw time the RB tree can be consulted to know if the withdraw actually needs to be sent to the peer. This replaces the faulty heuristic that was used before and caused either that unneeded withdraw to be sent or in the worst case failing to send a necessary withdraw resulting in stuck routes. OK benno@
2018-09-27Add some extra curlies to make code more legible.Claudio Jeker
2018-09-27unbreak "inet" and "inet6" aliases in filters after rev. 1.333Sebastian Benoit
ok claudio@
2018-09-26Rename AS_NONE to AS_UNDEF, AS_NONE will be reused for a different purposeClaudio Jeker
soon. OK compiler and grep
2018-09-26Switching bgpd to a default deny policy had one bad side-effect. SomeClaudio Jeker
withdraw were suddenly filtered out because the filter ran into the default deny. So for this case (state == NULL) change action to default allow. This bug was haunting bgpd for a while now causing prefixes to be stuck for no obvious reason. OK benno@, sthen@
2018-09-26Use the same logic in trie_roa_check_v4 as in trie_roa_check_v6 whenClaudio Jeker
checking that a source_as / maxlen combo actually fits. Fixes regress test.
2018-09-26Instead of checking that a segement is not of type AS_SET do the checkClaudio Jeker
that it is actually AS_SEQUENCE. No functional change those are the only two types bgpd supports here.
2018-09-26Indent issue. No functional changeClaudio Jeker
2018-09-25Fix loading of roa-sets in the RDE. From a much bigger diff but thisClaudio Jeker
goes in now since it fixes a real issue.
2018-09-25When sending set_tables in the imsg use the right size. Currently theClaudio Jeker
number of elements is used as size which is always wrong.
2018-09-21sync host*() changes from pfctlkn
This simplifies host() and merges host_v{4,6}() into host_ip() as recently done for pfctl and ntpd. Tested and OK denis, OK deraadt, "go ahead" benno
2018-09-21Both AS 23456 and AS 0 are reserved and can nor be used. Extend check forClaudio Jeker
AS 0 and adjust yyerror message to print the right number. With input and OK denis@
2018-09-21better yyerror messages. "syntax error" is generally not very helpful.Claudio Jeker
OK denis@
2018-09-21Move setting of the PREFIXSET_FLAG_OPS higher up since prefixset_item ruleClaudio Jeker
is now also used by roa-set. Also set the prefix operation for roa-set items to OP_NONE since that what it actually needs to be.
2018-09-21Implement code to parse, print and reload roa-set tables.Claudio Jeker
This is sharing a lot of code with prefixset which makes all a bit easier. A roa-set is defined like this: roa-set "test2" { 1.2.3.0/24 source-as 1, 1.2.8.0/22 maxlen 24 source-as 3 } No support for acting on this data yet. Put it in deraadt@, OK benno@, input and OK denis@
2018-09-20Split up as_set into a set_table and an as_set. The first is what doesClaudio Jeker
the lookup and will now also be used in roa-set tries. The as_set is glue to add the name and dirty flag. Add an accessor to get the set data so that the imsg sending and printing can be moved into the right places. This is done mainly because roa-sets need similar but slightly different versions and making the code more generic is the best way fixing this. OK benno@
2018-09-20whitespace cleanup, ok claudio@Sebastian Benoit
2018-09-20Switch prefixset to an RB_TREE instead of a SIMPLEQ. This allows to triggerClaudio Jeker
on duplicates (which are only reported) but is needed as a preparation step for roa-sets. OK benno@ denis@
2018-09-20Fix the empty aspath segments check. seg_size is never 0, this needs to useClaudio Jeker
seg_len instead. Since seg_len is known early move the check up. Found while hunting for the other bug in aspath_verify.
2018-09-20Fix an out of bound read that could crash the RDE because it touchedClaudio Jeker
unallocated memory while looking for AS 0. Found by and debugged with Aaron A. Glenn. Thanks a lot.
2018-09-19Wrap sending imsg to the RDE in a function and make sure that the ibufClaudio Jeker
to the RDE is valid. The SE is stopping all sessions on exit and so session_stop() is called which will send an imsg to the RDE which is no longer there. Instead of fixing just one call fix all. Now the SE should no longer crash when the RDE crashes. OK sthen@
2018-09-18s/mulitprotocol/multiprotocol/ in error textStuart Henderson
2018-09-18Backend for roa-sets. This combines as_sets and prefix-set tries to doClaudio Jeker
proper ROA checking. There is a new match function trie_roa_check which does a trie traversal and looks for candidates and matches. If prefix is not covered then ROA_UNKNOWN is returned, if prefix is covered by an entry it will return ROA_INVALID unless the source-as / maxlen combo is matching (ROA_VALID). OK and input sthen@
2018-09-17typo in commentStuart Henderson
2018-09-14Extend as_set to allow for different sized objects to be added. The onlyClaudio Jeker
requirement is that the first value of the struct is a 32bit ID which is used in the bsearch. This allows to add more than just as numbers to a set. as_set_match now returns a pointer to this data or NULL if not found. OK benno@
2018-09-13Noticed that the equal case is a bit wrong while adjusting the regress tests.Claudio Jeker
This is better. There is no need to check for the prefix length p->len.
2018-09-13Similar to as-set factor out the code to create a prefix-set into a function.Claudio Jeker
Makes all a bit nicer and as an added bonus fixes a memory leak. OK phessler@
2018-09-13ROA entires are allowing to define a prefix with a maxlen.Claudio Jeker
In the end this is just another way to specify a prefixlen range and kind of an or-longer case with an upper limit. So these two prefix statements are equivalent: prefix 10.0.0.0/8 prefixlen 8 - 24 prefix 10.0.0.0/8 maxlen 24 While there also make 'prefixlen = 17' a OP_RANGE and because of that also usable in prefix-set tables. Finally adjust printconf.c for those to changes to print them nicely. OK phessler@
2018-09-10fix typosdenis
OK claudio@
2018-09-10use filterset_move() like all other network statements. It checks forSebastian Benoit
source == NULL, avoiding a possible crash introduced yesterday. ok claudio@
2018-09-10remove some empty lines from printconf output. ok claudio@Sebastian Benoit
2018-09-09Allow for empty as-set and prefix-set definitions by adding explicit rulesClaudio Jeker
for those because shift/reduce issues in the list with optional commas. OK benno@
2018-09-09missing Xc;Jason McIntyre
2018-09-09Shut up a gcc warning about uninitialized use of min & max by adding a defaultClaudio Jeker
case in the switch statement. Found by denis@ and fix proposed by sthen@
2018-09-09use rib_valid() to check if a rib is useable. ok claudio@Sebastian Benoit
2018-09-09Can not allow empty as-set and prefix-set blocks right now. This producesClaudio Jeker
shit/reduce confilcts which need to be resolved first.
2018-09-09use TAILQ_CONCAT in filterset_move(). ok claudio@Sebastian Benoit
2018-09-09Remove another optnl. In general we no longer support a newline betweenClaudio Jeker
the keyword and "{". In this case it is 'set {'. Newlines afterwards are accepted.
2018-09-09Bad merge, change a optnl to comma since that is what we want there.Claudio Jeker
2018-09-09Rework the parser a bit to be more sane when it comes to newline and commaClaudio Jeker
handling. In expansion lists we want that commas and newlines are allowed but optional. In the neighbor, group and rdomain blocks statements need to be newline separated but neighbor 192.0.2.3 { descr "test-peer" } is allowed. OK sthen@ benno@
2018-09-09Write asset as as_set since the other word is already used in English.Claudio Jeker
benno@ agrees, OK compiler
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-19 04:14:31 +0000