Commit graph

3923 commits

Author SHA1 Message Date
Maria Matejka
d471d5fc7c IGP metric getter refactoring to protocol callback
Direct protocol hooks for IGP metric inside nest/rt-table.c make the
protocol API unnecessarily complex. Instead, we use a proper callback.
2021-10-13 19:09:04 +02:00
Maria Matejka
a54f75f454 fixup! Multipage allocation 2021-10-13 19:08:35 +02:00
Maria Matejka
6cd3771378 Multipage allocation
We can also quite simply allocate bigger blocks. Anyway, we need these
blocks to be aligned to their size which needs one mmap() two times
bigger and then two munmap()s returning the unaligned parts.

The user can specify -B <N> on startup when <N> is the exponent of 2,
setting the block size to 2^N. On most systems, N is 12, anyway if you
know that your configuration is going to eat gigabytes of RAM, you are
almost forced to raise your block size as you may easily get into memory
fragmentation issues or you have to raise your maximum mapping count,
e.g. "sysctl vm.max_map_count=(number)".
2021-10-13 19:01:22 +02:00
Maria Matejka
3a31c3aad6 CLI socket accept() may also fail and should produce some message, not a coredump. 2021-10-13 19:00:36 +02:00
Maria Matejka
d322ee3d54 OSPF: explicitly stop the periodic tick on shutdown to avoid recalculation races 2021-10-13 19:00:36 +02:00
Maria Matejka
e5a8eec6d7 Linpools may use pages instead of xmalloc 2021-10-13 19:00:36 +02:00
Maria Matejka
bea582cbb5 fixup! Bound allocated pages to resource pools with page caches to avoid unnecessary syscalls 2021-10-13 18:59:45 +02:00
Ondrej Zajicek (work)
067f69a56d Filter: Add prefix trie benchmarks
Add trie tests intended as benchmarks that use external datasets
instead of generated prefixes. As datasets are not included, they
are commented out by default.
2021-09-25 16:06:43 +02:00
Ondrej Zajicek (work)
e709dc09e6 Filter: Improve prefix trie tests
Add tests explicitly matching insides and outsides of trie and update
tests to do testing of both IPv4 and IPv6 tries.
2021-09-25 16:06:43 +02:00
Ondrej Zajicek (work)
dd61278c9d Filter: Update trie documentation 2021-09-25 16:06:43 +02:00
Ondrej Zajicek (work)
562a2b8c29 Filter: Fix trie test
Generated prefixes must be valid.
2021-09-25 16:06:43 +02:00
Ondrej Zajicek (work)
13225f1dbf Filter: Faster prefix sets
Use 16-way (4bit) branching in prefix trie instead of basic binary
branching. The change makes IPv4 prefix sets almost 3x faster, but
with more memory consumption and much more complicated algorithm.

Together with a previous filter change, it makes IPv4 prefix sets
about ~4.3x faster and slightly smaller (on my test data).
2021-09-25 16:06:43 +02:00
Maria Matejka
7f0e598208 Bound allocated pages to resource pools with page caches to avoid unnecessary syscalls 2021-09-10 18:13:50 +02:00
Maria Matejka
2c13759136 Reducing filter stack size to allow for lesser thread stack size 2021-09-10 18:11:28 +02:00
Maria Matejka
ceef6de459 OSPF: Setting a list node NULL before use 2021-09-10 17:38:22 +02:00
Maria Matejka
923a6644b2 Fixed memory poisoning in slab 2021-09-10 17:38:22 +02:00
Maria Matejka
227e2d5541 Debug output uses local buffer to avoid clashes between threads. 2021-09-10 17:37:46 +02:00
Maria Matejka
eb20251655 Filter: Additional consistency checks 2021-09-10 17:37:46 +02:00
Ondrej Zajicek (work)
47d92d8f9d Nest: Clean up main channel handling
Remove assumption that main channel is the only channel.
2021-09-10 17:32:05 +02:00
Ondrej Zajicek (work)
f761be6b30 Nest: Clean up main channel handling
Remove assumption that main channel is the only channel.
2021-06-17 16:56:51 +02:00
Ondrej Zajicek (work)
1b9bf4e192 Nest: Fix export of tmpattrs through pipes
Pipes copy the original rte with old values, so they require rte to be
exported with stored tmpattrs. Other protocols access stored attributes
using eattr list, so they require rte to be exported with expanded
tmpattrs. This is temporary hack, we plan to remove whoe tmpattr mechanism.

Thanks to Paul Donohue for the bugreport.
2021-06-14 20:02:50 +02:00
Ondrej Zajicek (work)
3ebabab277 Revert "Nest: Fix export of tmpattrs through pipes"
This reverts commit f8e273b5e7.
2021-06-14 17:58:37 +02:00
Ondrej Zajicek (work)
f8e273b5e7 Nest: Fix export of tmpattrs through pipes
In most cases of export there is no need to store back temporary
attributes to rte, as receivers (protocols) access eattr list anyway.
But pipe copies the original rte with old values, so we should store
tmpattrs also during export.

Thanks to Paul Donohue for the bugreport.
2021-06-14 16:30:59 +02:00
Ondrej Zajicek (work)
3f19100f5a CI: Allow Babel tests 2021-06-11 01:31:10 +02:00
Ondrej Zajicek (work)
596f2e32e3 Nest: Allow both 'password' and 'key' keywords for authentication keys 2021-06-09 19:54:01 +02:00
Ondrej Zajicek (work)
6d26f85395 Babel: Simplify auth expiration
Just use hello_expiry for that, keep init_expiry for initial
unauthentized neighbors.
2021-06-09 19:31:55 +02:00
Ondrej Zajicek (work)
8eea396baf Nest: Fix password list parsing code
One of previous patches broke password list parsing code, fix that.
2021-06-06 19:10:33 +02:00
Ondrej Zajicek (work)
ee9516dbe8 Lib: Fix static assert macro 2021-06-06 17:23:45 +02:00
Ondrej Zajicek (work)
b174cc0abc Babel: Add MAC authentication support - update
Some cleanups and bugfixes to the previous patch, including:

 - Fix rate limiting in index mismatch check

 - Fix missing BABEL_AUTH_INDEX_LEN in auth_tx_overhead computation

 - Fix missing auth_tx_overhead recalculation during reconfiguration

 - Fix pseudoheader construction in babel_auth_sign() (sport vs fport)

 - Fix typecasts for ptrdiffs in log messages

 - Make auth log messages similar to corresponding RIP/OSPF ones

 - Change auth log messages for events that happen during regular
   operation to debug messages

 - Switch meaning of babel_auth_check*() functions for consistency
   with corresponding RIP/OSPF ones

 - Remove requirement for min/max key length, only those required by
   given MAC code are enforced
2021-06-06 16:28:18 +02:00
Toke Høiland-Jørgensen
b218a28f61 Babel: Add MAC authentication support
This implements support for MAC authentication in the Babel protocol, as
specified by RFC 8967. The implementation seeks to follow the RFC as close
as possible, with the only deliberate deviation being the addition of
support for all the HMAC algorithms already supported by Bird, as well as
the Blake2b variant of the Blake algorithm.

For description of applicability, assumptions and security properties,
see RFC 8967 sections 1.1 and 1.2.
2021-06-06 16:28:18 +02:00
Toke Høiland-Jørgensen
69d10132a6 Babel: Refactor TLV parsing code for easier reuse
In preparation for adding authentication checks, refactor the TLV
walking code so it can be reused for a separate pass of the packet
for authentication checks.
2021-06-06 16:28:18 +02:00
Toke Høiland-Jørgensen
589f7d1e4f Nest: Allow MAC algorithms to specify min/max key length
Add min/max key length fields to the MAC algorithm description and
validate configured keys before they are used.
2021-06-06 16:28:18 +02:00
Toke Høiland-Jørgensen
35f88b305a Nest: Allow specifying security keys as hex bytes as well as strings
Add support for specifying a password in hexadecimal format, The result
is the same whether a password is specified as a quoted string or a
hex-encoded byte string, this just makes it more convenient to input
high-entropy byte strings as MAC keys.
2021-06-06 16:28:18 +02:00
Toke Høiland-Jørgensen
f1a824190c Lib: Add tests for blake2s and blake2b
Import the blake2-kat.h header with test vector output from the blake
reference implementation, and add tests to mac_test.c to compare the
output of the Bird MAC algorithm implementations with that reference
output.

Since the reference implementation only has test vectors for the full
output size, there are no tests for the smaller-sized output variants.
2021-06-06 16:28:09 +02:00
Toke Høiland-Jørgensen
725d9af94a Lib: Add Blake2s and Blake2b hash functions
The Babel MAC authentication RFC recommends implementing Blake2s as one of
the supported algorithms. In order to achieve do this, add the blake2b and
blake2s hash functions for MAC authentication. The hashing function
implementations are the reference implementations from blake2.net.

The Blake2 algorithms allow specifying an arbitrary output size, and the
Babel MAC spec says to implement Blake2s with 128-bit output. To satisfy
this, we add two different variants of each of the algorithms, one using
the default size (256 bits for Blake2s, 512 bits for Blake2b), and one
using half the default output size.

Update to BIRD coding style done by committer.
2021-06-06 16:26:58 +02:00
Ondrej Zajicek (work)
e5724f71d2 sysdep: Add wrapper to get random bytes - update
Simplify the code and fix an issue with getentropy() return value.
2021-06-06 16:26:06 +02:00
Toke Høiland-Jørgensen
c48ebde5ce sysdep: Add wrapper to get random bytes
Add a wrapper function in sysdep to get random bytes, and required checks
in configure.ac to select how to do it. The configure script tries, in
order, getrandom(), getentropy() and reading from /dev/urandom.
2021-06-06 16:26:06 +02:00
Ondrej Zajicek (work)
91d0458389 BGP: Ensure that freed neighbor entry is not accessed
Routes from downed protocols stay in rtable (until next rtable prune
cycle ends) and may be even exported to another protocol. In BGP case,
source BGP protocol is examined, although dynamic parts (including
neighbor entries) are already freed. That may lead to crash under some
race conditions. Ensure that freed neighbor entry is not accessed to
avoid this issue.
2021-06-01 02:20:26 +02:00
Maria Matejka
ebd5751cde Babel: Seqno requests are properly decoupled from neighbors when the underlying interface disappears
When an interface disappears, all the neighbors are freed as well. Seqno
requests were anyway not decoupled from them, leading to strange
segfaults. This fix adds a proper seqno request list inside neighbors to
make sure that no pointer to neighbor is kept after free.
2021-05-30 13:29:21 +02:00
Ondrej Zajicek (work)
10498b8e89 OSPF: Fix OSPFv3 in IPv4 mode with multiple areas
Some area handling code got confused by IPv4 setup in OSPFv3 mode.
2021-05-26 18:57:32 +02:00
Ondrej Zajicek (work)
8650e26dd1 CI: Try different locale for Centos 7 2021-05-20 15:02:48 +02:00
Matous Holinka
0c4dca7ffd CI: Package build for more platforms
.gitlab-ci.yml:
+ pkg targets for some distros added
+ artifacts added
- some distros were commented out (due to errors).

misc/docker/*:
+ Dockerfiles updated with the necessary packages.
2021-05-20 04:21:26 +02:00
Ondrej Zajicek (work)
98ef34c0c7 CI: Try utf-8 locale to workaround apkg issue 2021-05-19 17:22:12 +02:00
Ondrej Zajicek (work)
445d0e699f CI: Build documentation where tools are available 2021-05-19 17:22:12 +02:00
Ondrej Zajicek (work)
656c744080 CI: Update docker images for building of documentation 2021-05-19 17:22:12 +02:00
Ondrej Zajicek (work)
5ea3c5bfee Pkg: Enable docs subpackage for Debian 2021-05-19 17:22:12 +02:00
Ondrej Zajicek (work)
81666d2f12 CI: Test of apkg build
Also temporarily disable cf-ospf-auth, as there is some problem with it.
2021-05-19 17:22:12 +02:00
Ondrej Zajicek (work)
312aeda393 Tools: Improve make-dev-archive
Use git-archive to avoid unrelated and temporary files and fix some
minor issues (e.g. dependency on bash as system shell).
2021-05-19 17:22:12 +02:00
Jakub Ružička
280d133a9b ubuntu: use any init-system-helpers
init-system-helpers (>= 1.56~) can't be satisfied on:

* Ubuntu 18.04 (1.51)
* Ubuntu 16.04 (1.29)
* Debian 9 (1.48)

Remove the specific version requirement in order to enable build on
older platforms.
2021-05-19 17:22:11 +02:00
Jakub Ružička
53cabf94f8 suse: fix bird.spec to work on SUSE
SUSE is more strict about .spec.

* use SPDX license id
* add missing %ghost file directive
2021-05-19 17:22:11 +02:00