Commit graph

190 commits

Author SHA1 Message Date
Ondrej Zajicek (work)
596f2e32e3 Nest: Allow both 'password' and 'key' keywords for authentication keys 2021-06-09 19:54:01 +02:00
Ondrej Zajicek (work)
8eea396baf Nest: Fix password list parsing code
One of previous patches broke password list parsing code, fix that.
2021-06-06 19:10:33 +02:00
Toke Høiland-Jørgensen
589f7d1e4f Nest: Allow MAC algorithms to specify min/max key length
Add min/max key length fields to the MAC algorithm description and
validate configured keys before they are used.
2021-06-06 16:28:18 +02:00
Toke Høiland-Jørgensen
35f88b305a Nest: Allow specifying security keys as hex bytes as well as strings
Add support for specifying a password in hexadecimal format, The result
is the same whether a password is specified as a quoted string or a
hex-encoded byte string, this just makes it more convenient to input
high-entropy byte strings as MAC keys.
2021-06-06 16:28:18 +02:00
Toke Høiland-Jørgensen
725d9af94a Lib: Add Blake2s and Blake2b hash functions
The Babel MAC authentication RFC recommends implementing Blake2s as one of
the supported algorithms. In order to achieve do this, add the blake2b and
blake2s hash functions for MAC authentication. The hashing function
implementations are the reference implementations from blake2.net.

The Blake2 algorithms allow specifying an arbitrary output size, and the
Babel MAC spec says to implement Blake2s with 128-bit output. To satisfy
this, we add two different variants of each of the algorithms, one using
the default size (256 bits for Blake2s, 512 bits for Blake2b), and one
using half the default output size.

Update to BIRD coding style done by committer.
2021-06-06 16:26:58 +02:00
Ondrej Zajicek (work)
0a3db4c680 Minor fixes for restricted builds 2021-03-17 15:56:12 +01:00
Ondrej Zajicek (work)
d3782c72b9 Nest: Add option to control automatic RPKI reload
Also, no automatic reload for BGP channels without import/export table.
2021-02-12 05:05:18 +01:00
Vincent Bernat
714238716e BGP: Add support for BGP hostname capability
This is an implementation of draft-walton-bgp-hostname-capability-02.
It is implemented since quite some time for FRR and in datacenter, this
gives a nice output to avoid using IP addresses.

It is disabled by default. The hostname is retrieved from uname(2) and
can be overriden with "hostname" option. The domain name is never set
nor displayed.

Minor changes by committer.
2021-02-10 16:53:57 +01:00
Ondrej Zajicek (work)
61dae32b29 Nest: Per-channel debug flags
The patch add support for per-channel debug flags, currently just
'states', 'routes', and 'filters'. Flag 'states' is used for channel
state changes, remaining two for routes passed through the channel.
The per-protocol debug flags 'routes'/'filters' still enable reporting
of routes for all channels, to keep existing behavior.

The patch causes minor changes in some log messages.
2020-12-07 22:19:40 +01:00
Ondrej Zajicek (work)
30b8468269 Minor cleanups with cfg_allocz()
Also fixes some more failed asserts due to add_tail().
2020-11-24 04:09:11 +01:00
Ondrej Zajicek (work)
3b56bf8849 BFD: Better handling of BFD options in BGP configs
Merge multiple BFD option blocks in BGP configs instead of using the last
one. That is necessary for proper handling of templates when BFD options
are used both in a BGP template and in a BGP protocol derived from that
template.
2020-11-12 04:02:38 +01:00
Ondrej Zajicek (work)
9d3fc3062b BFD: Allow per-request session options
BFD session options are configured per interface in BFD protocol. This
patch allows to specify them also per-request in protocols requesting
sessions (currently limited to BGP).
2020-11-08 15:33:22 +01:00
Ondrej Zajicek (work)
1ca7665fa4 Nest: Allow key id 0
There is nothing in RFCs specifying that id 0 is not allowed. Some
implementations does not support it, while some other use key id 0 by
default. We allow it but start with key id 1 by default.

Thanks to Kenth Eriksson for the bugreport.
2020-05-19 02:50:47 +02:00
Ondrej Zajicek (work)
5ea39eaa96 Nest: Use bitmaps to keep track of exported routes
Use a hierarchical bitmap in a routing table to assign ids to routes, and
then use bitmaps (indexed by route id) in channels to keep track whether
routes were exported. This avoids unreliable and inefficient re-evaluation
of filters for old routes in order to determine whether they were exported.
2019-11-26 18:39:25 +01:00
Ondrej Zajicek (work)
0edf0c8cd9 Support for address family constants
We already had them defined on BGP level, but they are more general.
2019-11-03 22:25:44 +01:00
Fabrice Fontaine
f9eb9b4cab Nest: Fix build without protocols
(CHECK keyword added by commiter)
2019-10-19 12:50:27 +02:00
Ondrej Zajicek (work)
b7d7599ce3 BGP: implement Adj-RIB-Out
The patch implements optional internal export table to a channel and
hooks it to BGP so it can be used as Adj-RIB-Out. When enabled, all
exported (post-filtered) routes are stored there. An export table can be
examined using e.g. 'show route export table bgp1.ipv4'.
2019-08-14 06:02:33 +02:00
Maria Matejka
2de1e2062e Conf: Fixed symbol redefinition 2019-07-30 14:28:40 +02:00
Ondrej Zajicek (work)
cec40a7467 Merge remote-tracking branch 'origin/mq-filter-stack' 2019-07-24 15:38:32 +02:00
Ondrej Zajicek (work)
18f70a6229 Nest: VRF of protocol can be explicitly specified as 'default'
Protocol can have specified VRF, in such case it is restricted to a set
of ifaces associated with the VRF, otherwise it can use all interfaces.

The patch allows to specify VRF as 'default', in which case it is
restricted to a set of iface not associated with any VRF.
2019-07-24 15:08:03 +02:00
Maria Matejka
84ac62d396 Filter: CLI command to dump all the linearized filters 2019-07-03 08:27:56 +02:00
Maria Matejka
78976974e7 Dynamic attributes definition split whether it is bitmask or not. 2019-07-03 00:00:11 +02:00
Jan Maria Matejka
23e3b1e665 Filter: Some people can't pronounce "postfixify" correctly. Let's try "linearize" instead.
This is just a naming change.
2019-05-22 15:20:02 +00:00
Maria Matejka
9eef9c648c Lexer now returns known sym / unknown sym / keyword 2019-05-17 22:26:21 +02:00
Maria Matejka
0b39b1cbb7 Conf: Symbol implementation converted from void pointers to union
... and consted some declarations.
2019-02-20 22:30:55 +01:00
Maria Matejka
c0e958e022 Filter + Config: Fix bugs, tests and split symbols by type 2019-02-20 22:30:54 +01:00
Maria Matejka
4c553c5a5b Filter refactoring: dropped the recursion from the interpreter
This is a major change of how the filters are interpreted. If everything
works how it should, it should not affect you unless you are hacking the
filters themselves.

Anyway, this change should make a huge improvement in the filter performance
as previous benchmarks showed that our major problem lies in the
recursion itself.

There are also some changes in nest and protocols, related mostly to
spreading const declarations throughout the whole BIRD and also to
refactored dynamic attribute definitions. The need of these came up
during the whole work and it is too difficult to split out these
not-so-related changes.
2019-02-20 22:30:54 +01:00
Ondrej Zajicek (work)
682d3f7de0 BGP: implement Adj-RIB-In
The patch implements optional internal import table to a channel and
hooks it to BGP so it can be used as Adj-RIB-In. When enabled, all
received (pre-filtered) routes are stored there and import filters can
be re-evaluated without explicit route refresh. An import table can be
examined using e.g. 'show route import table bgp1.ipv4'.
2018-12-12 14:46:24 +01:00
Maria Matejka
265419a369 Custom route attributes
For local route marking purposes, local custom route attributes may be
defined. These attributes are seamlessly stripped after export filter to
every real protocol like Kernel, BGP or OSPF, they however pass through
pipes. We currently allow at most 256 custom attributes.

This should be much faster than currently used bgp communities
for marking routes.
2018-12-06 09:55:21 +01:00
Jan Maria Matejka
f851f0d7e3 Config: Dropping CF_ADDTO. 2018-06-26 14:29:03 +02:00
Ondrej Zajicek (work)
be17805c0b Add support for source-specific IPv6 routes to BIRD core
This patch adds support for source-specific IPv6 routes to BIRD core.
This is based on Dean Luga's original patch, with the review comments
addressed. SADR support is added to network address parsing in confbase.Y
and to the kernel protocol on Linux.

Currently there is no way to mix source-specific and non-source-specific
routes (i.e., SADR tables cannot be connected to non-SADR tables).

Thanks to Toke Hoiland-Jorgensen for the original patch.
Minor changes by Ondrej Santiago Zajicek.
2018-02-13 16:39:07 +01:00
Ondrej Zajicek (work)
a82f692e58 Nest: Trivial whitespace cleanup 2018-02-07 17:12:33 +01:00
Ondrej Zajicek (work)
72163bd5f3 Nest: Allow modification of channels inherited from templates
Multiple definitions of same channels are forbidden, but inherited
channel can be redefined. In such case channel options are merged.
2018-01-09 18:42:22 +01:00
Ondrej Zajicek (work)
66acbc8d7f Revive FIB and kernel MPLS code 2017-12-12 00:05:49 +01:00
Jan Maria Matejka
3e52d112d7 Docs: Update to v2.0 2017-12-08 16:27:19 +01:00
Ondrej Zajicek (work)
830ba75e6d Merge commit '1e8721e2aeccfbc3f533e8b8abc07582cee77e9a' into int-new 2017-12-07 21:54:47 +01:00
Ondrej Zajicek (work)
46434a3cad Merge commit '7b2c5f3d2826e3175bf31b1c36056c9efc587a2b' into int-new 2017-12-07 18:35:46 +01:00
Ondrej Zajicek (work)
f047271cb9 Timers: Parse and format functions for microsecond times
Date/time output (e.g. in logs, show commands) can use %f to specify
subsecond time. By default, millisecond precision is used in output.
2017-12-07 13:49:27 +01:00
Ondrej Zajicek (work)
cd1d99611e BGP: Shutdown communication (RFC 8203)
The patch implements BGP Administrative Shutdown Communication (RFC 8203)
allowing BGP operators to pass messages related to BGP session
administrative shutdown/restart. It handles both transmit and receive of
shutdown messages. Messages are logged and may be displayed by show
protocol all command.

Thanks to Job Snijders for the basic patch.
2017-09-19 19:57:52 +02:00
Ondrej Zajicek (work)
943478b00f Basic VRF support
Add basic VRF (virtual routing and forwarding) support. Protocols can be
associated with VRFs, such protocols will be restricted to interfaces
assigned to the VRF (as reported by Linux kernel) and will use sockets
bound to the VRF. E.g., different multihop BGP instances can use diffent
kernel routing tables to handle BGP TCP connections.

The VRF support is preliminary, currently there are several limitations:

- Recent Linux kernels (4.11) do not handle correctly sockets bound
to interaces that are part of VRF, so most protocols other than multihop
BGP do not work. This will be fixed by future kernel versions.

- Neighbor cache ignores VRFs. Breaks config with the same prefix on
local interfaces in different VRFs. Not much problem as single hop
protocols do not work anyways.

- Olock code ignores VRFs. Breaks config with multiple BGP peers with the
same IP address in different VRFs.

- Incoming BGP connections are not dispatched according to VRFs.
Breaks config with multiple BGP peers with the same IP address in
different VRFs. Perhaps we would need some kernel API to read VRF of
incoming connection? Or probably use multiple listening sockets in
int-new branch.

- We should handle master VRF interface up/down events and perhaps
disable associated protocols when VRF goes down. Or at least disable
associated interfaces.

- Also we should check if the master iface is really VRF iface and
not some other kind of master iface.

- BFD session request dispatch should be aware of VRFs.

- Perhaps kernel protocol should read default kernel table ID from VRF
iface so it is not necessary to configure it.

- Perhaps we should have per-VRF default table.
2017-09-06 17:38:48 +02:00
Ondrej Zajicek (work)
6aaaa63519 Change parser to handle numbers as unsigned
Lexer always parsed numbers as unsigned, but parser handled them as
signed and grammar contained many unnecessary checks for negativity.
2017-05-23 17:40:19 +02:00
Ondrej Zajicek (work)
1d21306785 Minor fixes 2017-04-29 01:24:30 +02:00
Ondrej Zajicek (work)
b29499996b Nest: Update of show route cmd
Some code cleanup, multiple bugfixes, allows to specify also channel
for 'show route export'. Interesting how such apparenty simple thing
like show route cmd has plenty of ugly corner cases.
2017-04-25 19:02:31 +02:00
Jan Moskyto Matejka
3484cb9a65 Client: separate config syntax structure for "show route for" 2017-04-18 13:45:50 +02:00
Jan Moskyto Matejka
2faf519cf9 Client: multitable version of show route 2017-04-12 16:04:22 +02:00
Jan Moskyto Matejka
8c9986d310 Filters: VPN Route Distinguishers, Prefix Type, Docs Update 2017-03-13 13:51:20 +01:00
Jan Moskyto Matejka
5b208e296f Removing (struct rta)->cast. Never used. 2016-12-22 13:09:59 +01:00
Jan Moskyto Matejka
4e276a8920 Merged multipath and single-path data structures.
Dropped struct mpnh and mpnh_*()
Now struct nexthop exists, nexthop_*(), and also included struct nexthop
into struct rta.

Also converted RTD_DEVICE and RTD_ROUTER to RTD_UNICAST. If it is needed
to distinguish between these two cases, RTD_DEVICE is equivalent to
IPA_ZERO(a->nh.gw), RTD_ROUTER is then IPA_NONZERO(a->nh.gw).

From now on, we also explicitely want C99 compatible compiler. We assume
that this 20-year norm should be known almost everywhere.
2016-12-22 13:01:06 +01:00
Ondrej Zajicek (work)
77234bbbde Basic flow specification support (RFC 5575)
Add flow4/flow6 network and rt-table type and operations, config grammar
and static protocol support.

Squashed flowspec branch from Pavel Tvrdik.
2016-12-07 15:54:19 +01:00
Ondrej Zajicek (work)
8860e991f6 Merge branch 'master' into int-new 2016-11-08 19:27:58 +01:00