summaryrefslogtreecommitdiff
path: root/usr.sbin/bgpd
AgeCommit message (Collapse)Author
2023-01-24Implement ASPA validation and reload logic on ASPA set changes.Claudio Jeker
For this use the validation state (vstate) in struct prefix and struct filterstate to store both the ASPA and ROA validity. Introduce helper functions to set and get the various states for struct prefix and make sure struct filterstate is also setup properly. Change the ASPA state in rde_aspath to be AFI/AID and role independent by storing all 4 possible outcomes. Also add a ASPA generation count which is used to update the rde_aspath ASPA state cache on reloads. Rework the rde_aspa.c code to be AFI/AID and role independent. Doing this for roles is trivial but AFI switch goes deep and is so unnecessary. The reload is combined with the ROA reload logic and renamed to RPKI softreload. OK tb@
2023-01-20Document the aspa-set table. While there remove the superfluous 'allow'Claudio Jeker
keyword. OK tb@
2023-01-20comma space not space commaClaudio Jeker
2023-01-20Bad indentClaudio Jeker
2023-01-20remove extra tabClaudio Jeker
2023-01-18Use the vstate of the filterstate struct instead of passing an extra copyClaudio Jeker
to the various prefix update functions. While there fix a filterstate leak in up_generate_updates(). With and OK tb@
2023-01-18Improve pending checks in poll loop by ordering them by trigger frequencyClaudio Jeker
and by making peer_imsg_pending() a true O(1) function. OK tb@
2023-01-17Add the needed logic to load the ASPA table from the rtr process into theClaudio Jeker
RDE. The actual reload logic is missing to keep the diff small. OK tb@
2023-01-16Fix bad MP logic in the route refresh handling.Claudio Jeker
Found by and fix provided by Zenon Mousmoulas (@zmousm)
2023-01-12Split rde_filterstate_prep() into three functions.Claudio Jeker
- rde_filterstate_init(): initialize a filterstate to default values - rde_filterstate_copy(): copy from a filterstate into a new state object - rde_filterstate_prep(): set filtersate based on prefix passed as argument. This makes the code a bit easier to read. OK tb@
2023-01-11Add the validation state to the filterstate struct.Claudio Jeker
Removes vstate argument from rde_filter(). Rename prefix_vstate() to prefix_roa_vstate(). OK tb@
2023-01-11Add ASPA validation functions to the RDE.Claudio Jeker
This implements ASPA validation based on the current draft. Implementing this showed various weaknesses in the current ASPA draft which I hope to fix in the near future. Unlike the algorithm specified in the draft our version validates the AS_PATH attribute in a single path doing one or two lookups depending on the sessions BGP role. The code is not yet hooked up into the RDE (see the NOTYET blocks). Missing are reload logic, bgpctl integration and the loading of the merged ASPA set from the rtr process. OK tb@
2023-01-04Add a per eBGP session role to the config.Claudio Jeker
This somewhat replaces the RFC 9234 open policy role. This is done because ASPA requires the same role to be present to properly validate paths. For iBGP sessions the role is forced to ROLE_NONE. If no role is set on an ebgp session then 'announce policy' is forced to 'no'. Also make sure the the role capability is only added if the role is set. OK tb@
2022-12-28spelling fixes; from paul tagliamonteJason McIntyre
any parts of his diff not taken are noted on tech
2022-12-27Adjust handling of the RFC 9234 role capability for ibgp sessions:Claudio Jeker
- Exclude the role capability on ibgp sessions when sending an OPEN - Warn when a role capability is received on an iBGP session - Make sure the capability negotiation is skipped for ibgp sessions, this in turn disables the role capability on the session. OK tb@
2022-12-22Denote multiple arguments with 'arg ...' not 'args'Klemens Nanni
A few programs used the plural in their synopsis which doesn't read as clear as the obvious triple-dot notation. mdoc(7) .Ar defaults to "file ..." if no arguments are given and consistent use of 'arg ...' matches that behaviour. Cleanup a few markups of the same argument so the text keeps reading naturally; omit unhelpful parts like 'if optional arguments are given, they are passed along' for tools like time(1) and timeout(1) that obviously execute commands with whatever arguments where given -- just like doas(1) which doesn't mention arguments in its DESCRIPTION in the first place. For expr(1) the difference between 'expressions' and 'expression ...' is crucial, as arguments must be passed as individual words. Feedback millert jmc schwarze deraadt OK jmc
2022-12-14Do the IPv4 specific MP capability check only once per update/withdrawClaudio Jeker
instead of per prefix. OK sthen@
2022-12-14Move some basic accessors of aspath to rde.h and make them static inline.Claudio Jeker
OK tb@
2022-11-18Add plumbing for ASPA support. This implements the parser and part of theClaudio Jeker
logic in the rtr process. It does not implement the new RTR messages yet but it is possible to specify an aspa-set in the config. Also the validation code in the RDE is missing so this does not do anything. With this in it will be possible to extend rpki-client to publish an aspa-set as part of the openbgpd config file. OK tb@
2022-11-09Properly handle L3VPN routes in kroute. This got broken while reworkingClaudio Jeker
large part of the code. Issue reported and fix tested by Bars Bars tutbaranov (at) gmail.com OK tb@
2022-11-09Fix nlri parsing of L3VPN prefixes in withdrawals.Claudio Jeker
L3VPN NLRI have different encoding for updates and withdraws. The withdraw carries one dummy MPLS label that needs to be skipped. The code doing that did adjust the lenght but did not skip the the label in the buffer and so the parsed prefix was off by 3 bytes. OK tb@
2022-11-07Fix a memory leak in the error path of rde_dump_ctx_new.Moritz Buhl
ctx is leaked in case of an allocation in prefix_dump_new, prefix_dump_subtree, rib_dump_new, or rib_dump_subtree fails. Found by CodeChecker. OK claudio@
2022-11-07Fix theoretical access to garbage stack memory in pfkey_reply forMoritz Buhl
bgpd and ldpd. Found by CodeChecker. OK claudio@
2022-11-07Fix some spelling errors.Moritz Buhl
OK claudio@
2022-10-18Initalize last_updown in init_peer() so that it is reported correctlyClaudio Jeker
for peers that never managed to establish a connection. OK tb@
2022-10-18Fix some spelling errorsJob Snijders
Thanks Marco D'Itri for spotting them OK claudio@
2022-10-12use correct type with sizeofJonathan Gray
ok miod@ claudio@ tb@
2022-09-24OpenBGPD 7.7Claudio Jeker
2022-09-23Don't depend on RTLABEL_LEN but instead define our own ROUTELABEL_LEN.Claudio Jeker
With this bgpd.h no longer depends on net/route.h OK tb@
2022-09-23Implement a special update generator for add-path send all.Claudio Jeker
The generic add-path code up_generate_addpath() reevaluates everything since this is the simplest way to select the announced paths. For add-path all this is overkill since there is no dependency between prefixes and so individual prefixes can be handled more efficently. Extend rde_generate_updates() to pass the current newbest and oldbest prefixes (for the selected best path) but now also include newpath and oldpath (which is the prefix that is added/removed/modified). If newpath or oldpath is set then a single prefix was altered and up_generate_addpath_all() can just remove or add this prefix. If newpath and oldpath are NULL than the full list based on newbest needs to be inserted and any old path/prefix removed in the process. This improves update generation performance on big route collectors using add-path all substantially. OK tb@
2022-09-21The values for fib_priority are OS dependent. To help portability moveClaudio Jeker
the RTP_BGP and similar defines all into kroute.c and export them via kr_default_prio() and kr_check_prio(). OK tb@
2022-09-21Adjust pathid_assign() to be much faster in the common case.Claudio Jeker
Use a per peer path_id_tx to assign to paths received from none add-path enabled peers. This skips two extra walks of the RIB prefix list and is a big speed-up when there are many regular sessions. If the session uses add-path recv then the old way of assigning random path_ids needs to be used. With input and OK tb@
2022-09-15Make kroute_matchgw() also work with connected routes.Claudio Jeker
Connected routes have no gateway set but only have ifindex set. When an interface is deconfigured this makes sure the right route is removed. OK tb@
2022-09-12Bump version for upcoming -portable releaseClaudio Jeker
2022-09-12Introduce tree walkers that only walk a subtree of the RIB.Claudio Jeker
In some cases only a "small" part of the RIB needs to be looked at. Like bgpctl show rib 10/8 or-longer that only needs to travers nodes under 10/8 all other RIB entries do not matter. By setting the start node to the RB_NFIND(10/8) the all nodes below this point can be skipped. Using prefix_compare() while walking the tree with RB_NEXT() the walker know when it steps outside of the 10/8 subtree and stops. With this the or-longer commands become a lot faster. Looks good to tb@
2022-09-09Implement the F_SHORTER filter by doing explicit lookups for each possibleClaudio Jeker
prefixlen. Even for IPv6 this is much faster than a full table walk. OK tb@
2022-09-01Switch the rde_peer hashtable and peer list to a single RB tree.Claudio Jeker
Only the RDE used a hashtable for lookups while the session engine switched from a list to RB tree some time ago. Use peer_foreach() in the mrt code instead of passing the peer list as an argument. OK benno@ tb@
2022-09-01This code no longer needs siphash.h and also cleanup some leftoverClaudio Jeker
prototypes and members that were not removed in the previous RB tree conversions. OK benno@ tb@
2022-08-31Remove IMSG_CTL_SHOW_RIB_HASH and struct rde_hashstats which are noClaudio Jeker
longer used. Also cleanup some hash sizes which are also no longer used. OK tb@
2022-08-31Switch the generic attribute cache to an RB tree.Claudio Jeker
OK benno@ tb@
2022-08-31Make sure that only one roa softreconfig runner is run at any time.Claudio Jeker
If a run takes to long drop the current update and wait for the next update. OK benno@
2022-08-30Switch nexthop hash to a RB tree.Claudio Jeker
OK benno@
2022-08-30Add missing #include <sys/queue.h>Claudio Jeker
2022-08-30Reshuffle and cleanup the includes a little bit.Claudio Jeker
2022-08-29Instead of a global aspath cache copy the aspath attribute per rde_aspathClaudio Jeker
struct. It uses a bit more memory but improves performance a lot on really big systems because aspath_get() becomes a very hot function. OK tb@
2022-08-29Use fatal("%s", __func__); instead of fatal("function_name");Claudio Jeker
OK tb@
2022-08-29Switch the DB of communities collections to a RB tree instead of anClaudio Jeker
undersized hash table. OK tb@
2022-08-29Switch rde_aspath to a RB tree instead of a hash table.Claudio Jeker
OK tb@
2022-08-29Export pending update and withdraw as part of struct peer_stats.Claudio Jeker
OK tb@
2022-08-26Handle IMSG_SESSION_* messages immediatly when received and do not putClaudio Jeker
them on the per peer imsg queue. This is mainly for IMSG_SESSION_DOWN. Delaying the session down can race against IMSG_SESSION_ADD which is handled immediatly and as a result an establised connection may be removed in the RDE because of it. The various graceful restart imsgs need similar treatment for similar reasons. In the end when a session is reset/closed the RDE needs to stop all work and flush the per peer imsg queue. With this only update and route refresh messages are handled via the imsg queue. OK tb@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-23 13:54:44 +0000