Commit graph

3744 commits

Author SHA1 Message Date
Toke Høiland-Jørgensen
b218a28f61 Babel: Add MAC authentication support
This implements support for MAC authentication in the Babel protocol, as
specified by RFC 8967. The implementation seeks to follow the RFC as close
as possible, with the only deliberate deviation being the addition of
support for all the HMAC algorithms already supported by Bird, as well as
the Blake2b variant of the Blake algorithm.

For description of applicability, assumptions and security properties,
see RFC 8967 sections 1.1 and 1.2.
2021-06-06 16:28:18 +02:00
Toke Høiland-Jørgensen
69d10132a6 Babel: Refactor TLV parsing code for easier reuse
In preparation for adding authentication checks, refactor the TLV
walking code so it can be reused for a separate pass of the packet
for authentication checks.
2021-06-06 16:28:18 +02:00
Toke Høiland-Jørgensen
589f7d1e4f Nest: Allow MAC algorithms to specify min/max key length
Add min/max key length fields to the MAC algorithm description and
validate configured keys before they are used.
2021-06-06 16:28:18 +02:00
Toke Høiland-Jørgensen
35f88b305a Nest: Allow specifying security keys as hex bytes as well as strings
Add support for specifying a password in hexadecimal format, The result
is the same whether a password is specified as a quoted string or a
hex-encoded byte string, this just makes it more convenient to input
high-entropy byte strings as MAC keys.
2021-06-06 16:28:18 +02:00
Toke Høiland-Jørgensen
f1a824190c Lib: Add tests for blake2s and blake2b
Import the blake2-kat.h header with test vector output from the blake
reference implementation, and add tests to mac_test.c to compare the
output of the Bird MAC algorithm implementations with that reference
output.

Since the reference implementation only has test vectors for the full
output size, there are no tests for the smaller-sized output variants.
2021-06-06 16:28:09 +02:00
Toke Høiland-Jørgensen
725d9af94a Lib: Add Blake2s and Blake2b hash functions
The Babel MAC authentication RFC recommends implementing Blake2s as one of
the supported algorithms. In order to achieve do this, add the blake2b and
blake2s hash functions for MAC authentication. The hashing function
implementations are the reference implementations from blake2.net.

The Blake2 algorithms allow specifying an arbitrary output size, and the
Babel MAC spec says to implement Blake2s with 128-bit output. To satisfy
this, we add two different variants of each of the algorithms, one using
the default size (256 bits for Blake2s, 512 bits for Blake2b), and one
using half the default output size.

Update to BIRD coding style done by committer.
2021-06-06 16:26:58 +02:00
Ondrej Zajicek (work)
e5724f71d2 sysdep: Add wrapper to get random bytes - update
Simplify the code and fix an issue with getentropy() return value.
2021-06-06 16:26:06 +02:00
Toke Høiland-Jørgensen
c48ebde5ce sysdep: Add wrapper to get random bytes
Add a wrapper function in sysdep to get random bytes, and required checks
in configure.ac to select how to do it. The configure script tries, in
order, getrandom(), getentropy() and reading from /dev/urandom.
2021-06-06 16:26:06 +02:00
Ondrej Zajicek (work)
91d0458389 BGP: Ensure that freed neighbor entry is not accessed
Routes from downed protocols stay in rtable (until next rtable prune
cycle ends) and may be even exported to another protocol. In BGP case,
source BGP protocol is examined, although dynamic parts (including
neighbor entries) are already freed. That may lead to crash under some
race conditions. Ensure that freed neighbor entry is not accessed to
avoid this issue.
2021-06-01 02:20:26 +02:00
Maria Matejka
ebd5751cde Babel: Seqno requests are properly decoupled from neighbors when the underlying interface disappears
When an interface disappears, all the neighbors are freed as well. Seqno
requests were anyway not decoupled from them, leading to strange
segfaults. This fix adds a proper seqno request list inside neighbors to
make sure that no pointer to neighbor is kept after free.
2021-05-30 13:29:21 +02:00
Ondrej Zajicek (work)
10498b8e89 OSPF: Fix OSPFv3 in IPv4 mode with multiple areas
Some area handling code got confused by IPv4 setup in OSPFv3 mode.
2021-05-26 18:57:32 +02:00
Ondrej Zajicek (work)
8650e26dd1 CI: Try different locale for Centos 7 2021-05-20 15:02:48 +02:00
Matous Holinka
0c4dca7ffd CI: Package build for more platforms
.gitlab-ci.yml:
+ pkg targets for some distros added
+ artifacts added
- some distros were commented out (due to errors).

misc/docker/*:
+ Dockerfiles updated with the necessary packages.
2021-05-20 04:21:26 +02:00
Ondrej Zajicek (work)
98ef34c0c7 CI: Try utf-8 locale to workaround apkg issue 2021-05-19 17:22:12 +02:00
Ondrej Zajicek (work)
445d0e699f CI: Build documentation where tools are available 2021-05-19 17:22:12 +02:00
Ondrej Zajicek (work)
656c744080 CI: Update docker images for building of documentation 2021-05-19 17:22:12 +02:00
Ondrej Zajicek (work)
5ea3c5bfee Pkg: Enable docs subpackage for Debian 2021-05-19 17:22:12 +02:00
Ondrej Zajicek (work)
81666d2f12 CI: Test of apkg build
Also temporarily disable cf-ospf-auth, as there is some problem with it.
2021-05-19 17:22:12 +02:00
Ondrej Zajicek (work)
312aeda393 Tools: Improve make-dev-archive
Use git-archive to avoid unrelated and temporary files and fix some
minor issues (e.g. dependency on bash as system shell).
2021-05-19 17:22:12 +02:00
Jakub Ružička
280d133a9b ubuntu: use any init-system-helpers
init-system-helpers (>= 1.56~) can't be satisfied on:

* Ubuntu 18.04 (1.51)
* Ubuntu 16.04 (1.29)
* Debian 9 (1.48)

Remove the specific version requirement in order to enable build on
older platforms.
2021-05-19 17:22:11 +02:00
Jakub Ružička
53cabf94f8 suse: fix bird.spec to work on SUSE
SUSE is more strict about .spec.

* use SPDX license id
* add missing %ghost file directive
2021-05-19 17:22:11 +02:00
Jakub Ružička
60167856af docs: disable docs subpackage to fix FTBFS
Adressing following FTBFS on all older debian/ubuntu distros:

    Can't locate LinuxDocTools/Data/Latin1ToSgml.pm in @INC (you may need to install the LinuxDocTools::Data::Latin1ToSgml module)
2021-05-19 17:22:11 +02:00
Jakub Ružička
329d6e3fbc add apkg-powered upstream packaging for deb, rpm
Files in a single new distro/ dir allow apkg to build BIRD packages for
various distros directly from upstream sources as well as from upstream
archives.

Please see distro/README.md for more detail as well as apkg docs:

https://apkg.rtfd.io

I've used these files to build bird-2.0.8 on all currently supported
releases of following distros:

* Debian
* Ubuntu
* Fedora
* CentOS
* openSUSE

Please note that latest apkg with accumulated fixes for bird is needed:
https://gitlab.nic.cz/packaging/apkg/-/merge_requests/35
2021-05-19 17:22:11 +02:00
Ondrej Zajicek (work)
c3c691e95c Flowspec: Documentation update 2021-05-18 20:41:01 +02:00
Ondrej Zajicek (work)
abc9ccc5cb Flowspec: Label field should use numeric operator and not bitmask operator 2021-05-18 20:23:08 +02:00
Ondrej Zajicek (work)
dd8481cc1c Flowspec: Do not use comma for bitmask operators
For numeric operators, comma is used for disjunction in expressions like
"10, 20, 30..40". But for bitmask operators, comma is used for
conjunction in a way that does not really make much sense. Use always
explicit logical operators (&& and ||) to connect bitmask operators.

Thanks to Matt Corallo for the bugreport.
2021-05-18 19:54:18 +02:00
Trisha Biswas
e5468d1685 Filter: Add MPLS label route attribute
Add support to set or read outgoing MPLS labels using filters. Currently
this supports the addition of one label per route for the first next hop.

Minor changes by committer.
2021-05-17 17:50:04 +02:00
Ondrej Zajicek (work)
d114959e3a Flowspec: Fix values for true/false operators
RFC 8955 is pretty clear that 000 is false and 111 is true.
2021-05-14 18:44:52 +02:00
Ondrej Zajicek (work)
69a33c92ff Flowspec: Add code for conversion of flowspec parts to interval lists
Implement function flow_explicate_part() to convert flowspec numeric
expressions to a simple list of (disjoint, sorted) intervals. That could
be used in filters to build f_tree-based int-sets from them.
2021-05-14 18:33:15 +02:00
Ondrej Zajicek (work)
c1511b92cc Babel: Log the reason when refusing to run on an interface
The babel protocol code checks whether iface supports multicast, and
whether it has a link-local address assigned. However, it doesn not give
any feedback if any of those checks fail, it just silently ignores the
interface. Fix this by explicitly logging when multicast check fails.

Based on patch from Toke Høiland-Jørgensen, thanks!
2021-05-10 20:09:31 +02:00
Toke Høiland-Jørgensen
b17adf0735 BSD: Propagate OS-level IFF_MULTICAST to internal IF_MULTICAST flag
The BSD code did not propagate the OS-level IFF_MULTICAST flag to the
Bird-internal IF_MULTICAST flag, which causes problems with Wireguard
interfaces on FreeBSD. The Linux sysdep code does propagate the flag
already, so just copy over the same check and flag update.
2021-05-10 19:49:43 +02:00
Ondrej Zajicek (work)
2a0af925b8 OSPF: Allow ifaces with host address as unnumbered PtP or PtMP ifaces
Ifaces with host address (/32) were forced to be stubby, but now they
can be used as PtP or PtMP. For these ifaces we need to:

 - Do not force stub mode
 - Accept packets from any IP as local
 - Accept any configured neighbor as local
 - Detect ifaces properly as unnumbered
 - Use ONLINK flag for nexthops
2021-05-10 13:39:55 +02:00
Ondrej Zajicek (work)
bc591061f6 OSPF: Packets on PtP networks should be always sent to AllSPFRouters
As specified in RFC 2328 8.1: "On physical point-to-point networks,
the IP destination is always set to the address AllSPFRouters."

Note that this likely break setups with multiple neighbors on a network
configured as PtP, which worked before. These should be configured as
PtMP.

Thanks to Senthil Kumar Nagappan for the original patch and to Joakim
Tjernlund for suggestions.
2021-05-09 15:26:13 +02:00
Ondrej Zajicek (work)
1647923bd8 OSPF: Minor refactoring of packet sending code
Common behavior for LSupd and delayed LSack moved to ospf_send_to_iface()
and other minor changes.
2021-05-09 14:51:39 +02:00
Ondrej Zajicek (work)
255722e0fc CI: Fix debian-10-i386 docker file 2021-04-25 02:34:46 +02:00
Ondrej Zajicek (work)
58510024be Doc: Include full LinuxDocTools code
BIRD uses hacked LinuxDocTools for building documentation, keeping some
parts locally and using remaining parts from system-installed one. This
setup breaks when LinuxDocTools makes some internal changes and is hard
to keep consistent.

Just include full LinuxDocTools code (both hacked and unmodified parts)
to avoid consistency issues. Note that we still need some binaries from
LinuxDocTools, so it still needs to be installed to build documentation.
2021-04-25 02:21:05 +02:00
Matous
b646c00981 CI/CD: some latest releases added.
/misc/docker/:
+ debian 11 (i386+amd64) added,
+ fedora 32 added,
+ fedora 33 added,
+ fedora 34 added,
+ opensuse 15.2 added,
+ opensuse 15.3 added,
+ ubuntu 20.04 added,
+ ubuntu 20.10 added,
+ ubuntu 21.04 added,
- ubuntu 19.10 removed.

/.gitlab-ci.yml:
+ stages 'image' and 'build' updated.
2021-04-21 13:22:23 +02:00
Maria Matejka
3d90241f62 Internal route tables have a reduced cleanup routine
This fixes an internal table cleanup bug introduced
in ff397df7ed.
2021-04-19 15:14:55 +02:00
Stefan Haller
a7c9515ebc BSD: Fix invalid pointer derefence in logging code
For logging purposes a stack allocated net_addr struct was passed by
value as vararg (instead of the expected pointer). This resulted in
a segfault when the specific error condition got logged.
2021-04-19 15:06:42 +02:00
Ondrej Zajicek (work)
9c41e1ca3e Lib: Fix handling of buffers in timestamp formatting
The code in tm_format_real_time() mixed up two buffers and their
sizes, which may cause crash in MRT dumping code.

Thanks to Piotr Wydrych for the bugreport.
2021-04-12 17:01:31 +02:00
Ondrej Zajicek (work)
a2277975d7 Unix: Expand accepted ranges of iproute2 constants
We support 32bit table and realm/flow ids, we should also accept them as
constants.

Thanks to Patrick Hemmer for the bugreport.
2021-04-07 16:14:20 +02:00
Ondrej Zajicek (work)
5caf32efa2 Doc: Fix flowspec example
Thanks to Matt Corallo for the bugreport.
2021-04-03 20:09:32 +02:00
Maria Matejka
7c8b7649f9 Allocation of ea_list in one contiguous memory block
This saves some bytes of memory for complex ea's.
2021-03-30 21:56:08 +02:00
Maria Matejka
ff397df7ed Routing table is now a resource allocated from its own pool
This also fixes memory leaks from import/export tables being never
cleaned up and freed.
2021-03-30 21:56:08 +02:00
Maria Matejka
a9938b1792 Resources: added mb_move() to complement rmove() for memory blocks 2021-03-30 21:56:08 +02:00
Maria Matejka
4635314cef Routing tables list iteration should use explicit node struct position 2021-03-30 21:56:08 +02:00
Ondrej Zajicek (work)
7a74ad5a61 BGP: Do not keep BAF_EXT_LEN flag internally
The flag makes sense just in external representation. It is reset during
BGP export, but keeping it internally broke MRT dumps for short attributes
that used it anyways.

Thanks to Simon Marsh for the bugreport and the patch.
2021-03-30 16:59:11 +02:00
Maria Matejka
a06469d9fc Dropping automatic tests for Debian 7 Wheezy.
Debian 7 Wheezy has been superseded by Debian 8 Jessie on Apr 25, 2015,
with LTS support ending on May 31, 2018.

Debian 7 Wheezy's default GCC doesn't fully support C11. It should
anyway still be possible to build BIRD for Debian 7 if you backport
a C11-capable compiler there.
2021-03-25 20:51:23 +01:00
Maria Matejka
886dd92eee Slab: head now uses bitmask for used/free nodes info instead of lists
From now, there are no auxiliary pointers stored in the free slab nodes.
This led to strange debugging problems if use-after-free happened in
slab-allocated structures, especially if the structure's first member is
a next pointer.

This also reduces the memory needed by 1 pointer per allocated object.
OTOH, we now rely on pages being aligned to their size's multiple, which
is quite common anyway.
2021-03-25 16:47:48 +01:00
Ondrej Zajicek (work)
82f19ba95e NEWS and version update 2021-03-18 20:18:38 +01:00