summaryrefslogtreecommitdiff
path: root/usr.sbin/bgpd
AgeCommit message (Collapse)Author
2024-09-10Be more careful with aspath that have 0 length (aka the empty AS_PATH).Claudio Jeker
Again malloc(0) is not portable and calling memcpy with a NULL pointer and a 0 length is not allowed by the C standard. OK tb@
2024-09-10community_copy needs to check if nentries is 0 and handle that specially.Claudio Jeker
Calling malloc / reallocarray with a 0 size is not portable and the memcpy with a possible NULL pointer as source and 0 len is seen as UB by newer C standards (grmbl). OK tb@
2024-09-10AID_VPN_IPv4 and AID_VPN_IPv6 require a labellen that is non-zero.Claudio Jeker
OK tb@
2024-09-10Enfroce proper encoding of ASPA announce/withdraw PDU.Claudio Jeker
An announce PDU requires at least one provider ASnum while a withdraw must not include any provider ASnums. The first is mandated by the ASPA profile and the 2nd by the 8210bis draft. Further cleanup some leftovers from the old per-AFI split of ASPA. OK tb@
2024-09-10Use reallocarray() instead of recallocarray(), this code does not need theClaudio Jeker
extra security measures of recallocarray() which adds a lot of overhead. OK tb@
2024-09-09Handle the CLUSTER_LIST attribute as described in RFC7606Claudio Jeker
Just drop the attribute if received from an external peer. Treat as withdraw if the len is 0 or not % 4. OK tb@
2024-09-09There is no need for an explicit size check for IMSG_RECONF_ASPA_TASClaudio Jeker
imsg_get_data() does the same and produces the same error. OK tb@
2024-09-09Use msgbuf_init() instead of hand initalizing the msgbuf.Claudio Jeker
OK tb@
2024-09-05Bump versionClaudio Jeker
2024-09-04Qualifying nexthops via BGP does not properly work since nexthops needClaudio Jeker
to be rechecked when a BGP route is added (or changed). We need to revalidate nexthops on inserts (kroute_insert) and on change (krX_change but only for AID_INET and AID_INET6 -- no nexthops in the other tables) the nexthop needs to be updated. Only validate nexthops if 'nexthop qualify via bgp' is enabled. For route changes the code can depend on the F_NEXTHOP flag. Fix for: https://github.com/openbgpd-portable/openbgpd-portable/issues/81 OK tb@
2024-09-04Call pfkey_remove() only after the Session Engine finished reloading itsClaudio Jeker
configuration. Doing so before could result in some messages being sent out without proper TCP-MD5 signature. Fix for: https://github.com/openbgpd-portable/openbgpd-portable/issues/82 OK tb@
2024-08-28Introduce peer_is_up() and use it instead of peer->state == PEER_UP checksClaudio Jeker
also enqueue update and rrfresh imsgs only if the peer is up and flush them once this is no longer the case. OK tb@
2024-08-28Check the max_prefix and max_out_prefix limit during config reload.Claudio Jeker
This is cheap and will trigger immediatly instead of waiting until the next UPDATE happens (which could happen a lot later). OK tb@ job@
2024-08-22inet_pton returns 0 and -1 for error.Florian Obser
Adjust the error check that is now wrong after the inet_aton -> inet_pton conversion. Noticed by & OK bluhm. OK tb
2024-08-21Use inet_pton to parse ext-communities with an IPv4 address.Florian Obser
No need for inet_aton's flexibility. OK claudio
2024-08-20Use msgbuf_queuelen() instead of accessing wbuf.queue for msgbuf structs.Claudio Jeker
Also export the msgbuf queue len as a stats member so bgpctl does not need to dig into the msgbuf structure inside struct peer. This skips imsg related msgbuf since that will be handled by a imsgbuf specific function. OK tb@
2024-08-14Introduce 'rde rib Loc-RIB include filtered' a feature that includesClaudio Jeker
filtered prefixes in the Loc-RIB This includes filtered prefixes into the Loc-RIB but they are marked ineligible so nothing will select them but it is possible to show them in bgpctl. So 'bppctl show rib filtered' will return all prefixes filtered out by the input filters. OK tb@
2024-08-12Add 'min-version' RTR config option and default to RTR version 1 by default.Claudio Jeker
The min-version pins a minimal required version for rtr session. This is needed if specific PDUs are required and it ensures that the session is not suddenly downgraded. This is important for ASPA where a minimum version of 2 is required. Only then the ASPA PDUs are transmitted. By default a RTR version of 1 is used but setting min-version to 2 will enable draft-ietf-sidrops-8210bis-14 support and enforce it at the same time. Right now defaulting to version 2 is not possible since draft-ietf-sidrops-8210bis failed to progress for a too long time resulting in split eco system with various incompatible RTR version 2 implementations. OK tb@
2024-08-09Remove the ibuf_size(pdu) % sizeof(uint32_t) == 0 since it is alreadyClaudio Jeker
done in rtr_parse_header(). No need to do it twice.
2024-08-09Adjust RTR ASPA pdu parser to draft-ietf-sidrops-8210bis-14 which finallyClaudio Jeker
adjusted the pdu to follow the other ASPA drafts. OK tb@
2024-07-03Fix typoJob Snijders
Reported by Marco D'Itri
2024-06-26Bump versionClaudio Jeker
2024-06-25When filling prefixes with pt_writebuf() keep 2 bytes reserved in theClaudio Jeker
withdraw case. Those bytes are needed for the attribute length field. Without this withdraw messages can become overfull and are dropped without notice. Problem found and fix tested by denis@ OK denis@ tb@
2024-06-10In get_alternate_addr() consider sessions to IPv6 link-local addressesClaudio Jeker
as connected (they are so by definition). Issue reported by Jason Tubnor ( Jason.Tubnor (at) lchs.com.au ) OK tb@
2024-05-30Fix copy-paste error in last commit. Fixes lladdr and l3vpn regress.Claudio Jeker
Noticed by anton@
2024-05-29Handle IPvX only interfaces with IPvY sessions more gracefully.Claudio Jeker
In up_get_nexthop() check that the local_vX_addr is actually valid before using it. In the UPDATE generation functions check that the nexthop is valid before adding it and fail hard if it does not exist. You can't announce an IPv4 prefix/gateway over an IPv6 only link. OK henning@ sthen@
2024-05-29Only fall back to the default IPv4 unicast mode if there was no MPClaudio Jeker
capability neither from our side not the remote end. Also track unknown AFI/SAFI combos for the remote end in AID_UNSPEC this way even unknown combos will prevent a fall back. OK henning@ sthen@
2024-05-29Remove nexthop_compare() prototype.Claudio Jeker
OK henning@ sthen@
2024-05-29Rename nexthop_compare to nexthop_cmp and make it static inline.Claudio Jeker
OK henning@ sthen@
2024-05-29Introduce a ring buffer for log_sockaddr() this way log_addr() can beClaudio Jeker
used more then once in a log message (e.g. log_peer_warnx + log_addr. OK henning@ sthen@
2024-05-22Convert bgpid, remote_bgpid and clusterid to host byte order.Claudio Jeker
Before the RDE used host byte order for remote_bgpid but all the other code used network byte order. The reason for that was that bgpid was initially an IPv4 address but since RFC 6286 in 2011 this is much more relaxed and so it makes more sense to just treat them as numbers and so host byte order. OK tb@
2024-05-20Convert more of the session engine parsers to the new ibuf APIClaudio Jeker
This converts OPEN and it capability parser and RREFRESH and with that all packet parser are kind of converted. There is still parse_header() and the general packet handling that needs some work now so that all the ugly ibuf_from_buffer() can be dropped. OK tb@
2024-05-20Tabs on empty lineClaudio Jeker
2024-05-19remove prototypes with no matching functionJonathan Gray
2024-05-18remove prototypes with no matching function; ok claudio@Jonathan Gray
2024-05-16Simplify the code to clamp the TCP send and recv buffer to 64k.Claudio Jeker
We don't really care if it works or not and we don't want to clamp it down further then 64k. So just call setsockopt() once and ignore the error. OK tb@ sthen@
2024-05-15Mark RTR and IPv6 BGP packets with DSCP CS6 (network control)Job Snijders
Additionally, set TCP_NODELAY on the RTR socket, there is no need to queue up messages towards the RTR server. OK claudio@
2024-04-24Remove 'announce capabilities' as neighbor config stanza.Claudio Jeker
There is no need to have an easy knob to get outdated or crappy implementations to limp along. Instead the various default on capabilities just need to be disabled (e.g. announce as-4byte no). OK tb@
2024-04-22In state IDLE handle EVNT_STOP and stop the IdleHold timer. This wayClaudio Jeker
a down of an idle connection will properly stop the session. OK tb@ (as part of larger diff)
2024-04-22Move setting of the shutdown reason to session_stop()Claudio Jeker
Also make sure that something is logged when a session is stopped. Part of a bigger diff which was OK tb@
2024-04-22No longer fall back to no capabilities when there is an OPEN/optionalClaudio Jeker
attribute error. BGP more and more relies on capabilities, automatically clearing them all no longer seems the right choice. Now operators need to adjust the config explicitly to allow such connections. From a larger diff which is OK tb@
2024-04-11Remove repeated type declaration that makes bison unhappyTheo Buehler
Fixes: https://github.com/openbgpd-portable/openbgpd-portable/issues/77 ok claudio
2024-04-11Use != NULL for pointer check. No binary change.Claudio Jeker
2024-04-10Rework the logic to not send double notifications in session_notification().Claudio Jeker
last_sent_errcode is now cleared late (when state changes to ESTABLISHED) and so notifications sent in the OPEN phase would be dropped after the first incident. Using the session state to know if sending a message is possible seems more robust and is what session_stop() uses as well. For now log the notification which are not sent as 'dropping' to see how often this happens. OK tb@
2024-04-09Limit the number of provider ASnumbers to MAX_ASPA_SPAS_COUNT (10'000)Claudio Jeker
in the parser as well. OK tb@
2024-04-09Increase RTR PDU limit to 48k and limit number of SPAS to 10'000.Claudio Jeker
PDU larger then 48k will result in a session reset while ASPA records with more than 10'000 entries will be implicitly withdrawn. Also truncate RTR error PDUs to only include 256 bytes of the faulty PDU. It makes no sense to include more to identify the issue. OK tb@
2024-04-09Check that the ASPA tas array fits in an IMSG before sending the ASPAClaudio Jeker
record over to RTR or the RDE. The long term goal is to increase the IMSG size considerably but that requires some additional API changes to the imsg API. OK tb@
2024-04-09Allow operators to enforce the presence of certain capabilities on sessions.Claudio Jeker
For simple capabilities this just adds enforce to the yes/no option of the announce statement. For multi-protocol capabilities and add-path there is an extra keyword. On top of this for add-path the enforcement requires the neighbor to send a matching capability, e.g 'announce add-path recv enforce' requires the other side to send any 'announce add-path send XYZ' capability. This is mainly to enforce as-4byte and extra multi-protocol capabilities. OK denis@ tb@
2024-04-03Rewrite str2key() to not use strtoul() to convert 2 hexdigits into oneClaudio Jeker
char. Instead use a simple function to do the conversion per nibble. OK deraadt@ tb@
2024-03-26Move the SendHoldTimer code into start_timer_sendholdtime() and ensureClaudio Jeker
the timer is stopped if HoldTime is 0. OK tb@
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-26 09:49:51 +0000