summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
| * ospf6d: don't suppress empty router LSADinesh Dutt2013-11-071-29/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently in OSPFv3 implementation, if all the interfaces are down/loopback or are without any full adjacencies, the router LSA is suppressed. So for a router with only stub networks, no router LSA is generated. However, intra-prefix LSAs are generated for the stub networks and these intra-prefix LSAs will reference the router LSA. So the router LSA really should not be suppressed. It needs to be generated to be the starting vertex for SPF w.r.t the stub networks. Signed-off-by: James Li <jli at cumulusnetworks.com> Reviewed-by: Dinesh G Dutt <ddutt at cumulusnetworks.com> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
| * ospf6d: turn off expensive debuggingDinesh Dutt2013-11-072-5/+5
| | | | | | | | | | | | | | | | | | OSPF6 has very expensive LSDB and route debug on by default. This needs to be turned off for scaled performance. Signed-off-by: James Li <jli at cumulusnetworks.com> Reviewed-by: Dinesh G Dutt <ddutt at cumulusnetworks.com>Summary: Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
| * ospf6d: convert LSDB to use route_node, improve performanceDinesh Dutt2013-11-075-111/+78
| | | | | | | | | | | | | | | | | | | | | | the performance in the presence of a large number of LSAs. I also verified that the performance improvements stayed in the presence of a large number of peers (I tested upto 128). Signed-off-by: Dinesh G Dutt <ddutt at cumulusnetworks.com> Reviewed-by: Scott Feldman <sfeldma at cumulusnetworks.com>Summary: Reviewed-by: James Li <jli at cumulusnetworks.com> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
| * ospf6d: fix neighbor state machine (faster lsdb sync, RFC compliance)Dinesh Dutt2013-11-074-44/+88
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The OSPFv3 code doesn't do the following things right as part of an adjacency bringup: - Transmit DbDesc frames appropriately to ensure faster state transition to Loading state - Transmit LsReq frames when switching to exchange state and on receipt of an LS update in Loading state - Requesting LSAs multiple times in LsReq. It currently uses retransmit timer expiry to send the LsReq and DbDesc frames which significantly slows down large lsdb syncs. Signed-off-by: Dinesh G Dutt <ddutt at cumulusnetworks.com> Reviewed-by: Scott Feldman <sfeldma at cumulusnetworks.com> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
| * ospf6d: add p2p interface supportDinesh Dutt2013-11-078-100/+270
| | | | | | | | | | | | | | | | Signed-off-by: Dinesh G Dutt <ddutt at cumulusnetworks.com> Signed-off-by: Ayan Banerjee <ayabaner at gmail.com> Reviewed-by: Scott Feldman <sfeldma at cumulusnetworks.com> Reviewed-by: James Li <jli at cumulusnetworks.com> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
| * ospf6d: fix various bugs in installing and flooding LSAsDinesh Dutt2013-11-072-13/+10
| | | | | | | | | | | | | | Signed-off-by: Dinesh G Dutt <ddutt at cumulusnetworks.com> Reviewed-by: Pradosh Mohapatra <pmohapat at cumulusnetworks.com> Reviewed-by: Scott Feldman <sfeldma at cumulusnetworks.com> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
| * ospf6d: add more details to show ipv6 ospf6 dataDinesh Dutt2013-11-071-0/+5
| | | | | | | | | | | | | | | | | | Specifically, it displays the flags, lock and retransmission count fields. Signed-off-by: Dinesh G Dutt <ddutt at cumulusnetworks.com> Reviewed-by: JR Rivers <jrrivers at cumulusnetworks.com> Reviewed-by: Scott Feldman <sfeldma at cumulusnetworks.com> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
| * ospf6d: enable the commands to support detailed debugging of LSAs.Dinesh Dutt2013-11-071-146/+31
| | | | | | | | | | | | | | | | | | The code for the commands exists, but it hasn't been defined in the definition of the command itself. This patch fixes that. Signed-off-by: Dinesh G Dutt <ddutt at cumulusnetworks.com> Reviewed-by: Scott Feldman <sfeldma at cumulusnetworks.com> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
| * ospf6d: remove older version of LSA from neigbor retx list before ↵Dinesh Dutt2013-11-071-0/+23
| | | | | | | | | | | | | | | | | | | | prematurely aging it. See comment in code for very detailed issue and fix. Signed-off-by: Dinesh G Dutt <ddutt at cumulusnetworks.com> Reviewed-by: Scott Feldman <sfeldma at cumulusnetworks.com> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
| * ospf6d: reinvoke MaxAge remover thread if not all MaxAge LSAs were flushed.Dinesh Dutt2013-11-076-25/+51
| | | | | | | | | | | | | | | | | | | | | | MaxAge LSAs are being flushed out only on an event, unlike OSPFv2 where they're flushed out periodically. This causes certain LSAs to hang around forever, never getting flushed out. This patch makes flushing out MaxAge LSAs periodic, retriggered after a certain period if not all MaxAge LSAs were flushed out. Signed-off-by: Dinesh G Dutt <ddutt at cumulusnetworks.com> Reviewed-by: Scott Feldman <sfeldma at cumulusnetworks.com> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
| * ospf6d: schedule SPF to run on events rather than directly on each event.Dinesh Dutt2013-11-077-23/+245
| | | | | | | | | | | | | | | | | | | | | | | | | | | | OSPV3 SPF triggers on every SPF-able event instead of using timers the way OSPFv2 does. This patch makes SPF be triggered/throttled similar to OSPFv2. It adds a command to quagga identical to the OSPFv2 equivalent to configure these timers. Summary: Signed-off-by: Dinesh Dutt <ddutt at cumulusnetworks.com> Reviewed-by: Scott Feldman <sfeldma at cumulusnetworks.com> [DL: removed reference to oa->ts_spf for rebase] [DL: killed timeval_subtract] Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
| * ospf6d/ospfd: refactor some common definesDinesh Dutt2013-10-2216-107/+120
| | | | | | | | | | | | | | | | | | Rearranging common defs and structures for use betweeen OSPFv2 and OSPFv3. Created a new file called libospf.h under lib directory to hold defines that are common between OSPFv2 and OSPFv3 code bases. [DL: split of defines refactor from timer refactor] Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
* | security: Fix some typos and potential NULL-derefRemi Gacogne2014-02-115-4/+8
| | | | | | | | | | | | | | | | | | This patch against the git tree fixes minor typos, some of them possibily leading to NULL-pointer dereference in rare conditions. Signed-off-by: Remi Gacogne <rgacogne-github@coredump.fr> Signed-off-by: Joachim Nilsson <troglobit@gmail.com> Acked-by: Feng Lu <lu.feng@6wind.com>
* | zebra: log routes w/o gateway in rib_delete_ipv4Christian Franke2014-02-111-6/+14
| | | | | | | | | | | | Signed-off-by: Christian Franke <chris@opensourcerouting.org> Acked-by: Feng Lu <lu.feng@6wind.com> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
* | zebra: match gateway when deleting NEXTHOP_IPV4_IFINDEX routesChristian Franke2014-02-101-0/+1
| | | | | | | | | | Signed-off-by: Christian Franke <chris@opensourcerouting.org> Acked-by: Feng Lu <lu.feng@6wind.com>
* | ospfd: fixup log message in ospf_zebra_deleteChristian Franke2014-02-101-1/+1
| | | | | | | | | | Signed-off-by: Christian Franke <chris@opensourcerouting.org> Acked-by: Feng Lu <lu.feng@6wind.com>
* | bgpd: bgpd-set-v4-nexthop-for-v6-peering.patchPradosh Mohapatra2014-02-102-2/+32
|/ | | | | | | | | | | | | | | | | | | BGP: While advertising v4 prefixes over a v6 session, set the correct v4 nexthop. ISSUE: For an IPv6 peer, BGPd sets the local router-id as the next-hop's v4 address. This is incorrect as the router-id may not be a valid next-hop to be included in UPDATEs that contain v4 prefixes. PATCH: Set the v4 address in the next-hop field based on the interface that the peering is on (directly connected interface or loopback). Signed-off-by: Pradosh Mohapatra <pmohapat at cumulusnetworks.com> Reviewed-by: Scott Feldman <sfeldma at cumulusnetworks.com> Acked-by: Feng Lu <lu.feng@6wind.com>
* build: fix tests/prng.h missing from distDavid Lamparter2013-10-221-0/+2
| | | | | | | broken by fa713d9... "zebra: rework recursive route resolution", and I forgot to squash the fix into that. Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
* zebra: make rib_dump() compatible with IPv6 RIBVincent Bernat2013-10-222-9/+24
| | | | | | [DL: resolved conflicts in zebra_rib.c] [DL: fix usage with --disable-ipv6] Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
* zebra: apply route-maps for interface routesChristian Franke2013-09-191-0/+12
| | | | | Signed-off-by: Christian Franke <chris@opensourcerouting.org> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
* zebra: fix recursive-routes via ifindex routesChristian Franke2013-09-191-16/+49
| | | | | Signed-off-by: Christian Franke <chris@opensourcerouting.org> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
* zebra: implement NEXTHOP_FLAG_ONLINKChristian Franke2013-09-193-1/+18
| | | | | | | | | | | On Linux, the kernel will only allow for a route to be installed when its gateway is directly attached according the kernel fib. There are cases when this restriction by the kernel is too strong, in those cases, we deploy the RTNH_F_ONLINK netlink flag. Signed-off-by: Christian Franke <chris@opensourcerouting.org> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
* zebra: handle blackholes encountered in recursive resolutionChristian Franke2013-09-191-0/+12
| | | | | Signed-off-by: Christian Franke <chris@opensourcerouting.org> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
* zebra: rework recursive route resolutionChristian Franke2013-09-1916-718/+1046
| | | | | | | | | | | | | | | Change the datastructure for recursive routes. This brings the following benefits: By using struct nexthop also to store nexthops obtained by recursive resolution, we can get rid of quite a bit of code duplication in the fib management. (rt_netlink, rt_socket, ...) With the new datastructure we can make use of all available paths when recursive routes are resolved with multipath routes. Signed-off-by: Christian Franke <chris@opensourcerouting.org> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
* zebra: improve interface shutdown behaviourChristian Franke2013-09-192-18/+49
| | | | | | | | | | | | | | Linux removes IPv6 addresses when the interface is set down. Those addresses need to be readded when the interface is set up again. Also, an interface should not be reactivated from shutdown by configuring an ip address. Finally, remove the three-state logic for the shutdown setting as its sole current use may be mild confusion. Signed-off-by: Christian Franke <chris@opensourcerouting.org> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
* zebra: don't change connected state from zebra/interface.cChristian Franke2013-09-192-106/+69
| | | | | | | | | | Try to avoid changing connected state from zebra/interface.c as this means making assumptions about kernel behaviour which may be or may become wrong. This state should rather be updated by events from the kernel. Signed-off-by: Christian Franke <chris@opensourcerouting.org> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
* zebra: add ZEBRA_IFC_QUEUED to keep track of kernel stateChristian Franke2013-09-193-6/+29
| | | | | | | | | | | | | | | | | As there are timeframes when we don't get a notification from the kernel about new addresses. (e.g. while Linux performs IPv6 DAD), we need to have some information whether an address has been sent to the kernel or not. One case where this is relevant would be a user adding an IPv6 address, but deleting it before DAD has been complete. With the next patch which removes some (ill assuming) synchronous parts in address setup, ipv6_address_uninstall would not know whether or not it has to actually delete the prefix from the kernel. Resolving these windows where we lack information is what the flag ZEBRA_IFC_QUEUED is intended for. Signed-off-by: Christian Franke <chris@opensourcerouting.org> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
* zebra: warn if advertising connected with _REAL unsetChristian Franke2013-09-191-0/+3
| | | | | | | | | | | | | The implementation in zebra and the zclient protocol allow to communicate addresses to clients which are not yet in the kernel. This is usually not done and most clients seem to expect an address to be configured in the kernel when they receive it. Therefore, it seems reasonable to issue a warning when advertising an address to the clients that is not yet in the kernel. Signed-off-by: Christian Franke <chris@opensourcerouting.org> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
* zebra: consolidate connected_implicit_withdrawChristian Franke2013-09-191-21/+14
| | | | | | | | | connected_implicit_withdraw is used at two places and followed by exactly the same code. Move that code into connected_implicit_withdraw and give that function a more descriptive name. Signed-off-by: Christian Franke <chris@opensourcerouting.org> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
* zebra: clear ZEBRA_IFC_CONFIGURED on "no ipv6 addr"Christian Franke2013-09-191-0/+2
| | | | | | | | | To match the semantics of IPv4, the ZEBRA_IFC_CONFIGURED flag should be cleared when an IPv6 connected is uninstalled via vty. Signed-off-by: Christian Franke <chris@opensourcerouting.org> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
* zebra: make if_subnet_delete a bit more strictChristian Franke2013-09-192-3/+19
| | | | | | | | | Enhance if_subnet_delete so it will complain about improper use. Also, fix one occurence of improper use where it was called for IPv6 as well. Signed-off-by: Christian Franke <chris@opensourcerouting.org> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
* zebra: process information about new addresses (BZ#486)Christian Franke2013-09-191-2/+5
| | | | | | | | | | | Because of a change of semantics in the Linux kernel, information about changes made by zebra itself was not considered for updates. This change should fix this by accounting for the new semantics. It is based on a patch by lich posted to the bugzilla #486 Signed-off-by: Christian Franke <chris@opensourcerouting.org> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
* ospfd: protect vs. VU#229804 (malformed Router-LSA)David Lamparter2013-08-061-0/+21
| | | | | | | | | | | | | | | | | | | | | | VU#229804 reports that, by injecting Router LSAs with the Advertising Router ID different from the Link State ID, OSPF implementations can be tricked into retaining and using invalid information. Quagga is not vulnerable to this because it looks up Router LSAs by (Router-ID, LS-ID) pair. The relevant code is in ospf_lsa.c l.3140. Note the double "id" parameter at the end. Still, we can provide an improvement here by discarding such malformed LSAs and providing a warning to the administrator. While we cannot prevent such malformed LSAs from entering the OSPF domain, we can certainly try to limit their distribution. cf. http://www.kb.cert.org/vuls/id/229804 for the vulnerability report. This issue is a specification issue in the OSPF protocol that was discovered by Dr. Gabi Nakibly. Reported-by: CERT Coordination Center <cert@cert.org> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
* bgpd, zebra: support NEXTHOP_IPV4_IFINDEX in bgp import checkChristian Franke2013-08-062-5/+15
| | | | | Signed-off-by: Christian Franke <chris@opensourcerouting.org> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
* bgpd, zebra: Support NEXTHOP_IPV4_IFINDEX in nexthop_lookup apiChristian Franke2013-08-062-0/+25
| | | | | | | | | | | | Since commit ba281d3d040, ospfd uses NEXTHOP_IPV4_IFINDEX routes. The API between zebra and bgpd which is used to query nexthops for recursive routes did not support this nexthop type and therefore, ospf changes (or any other IGP changes which use NEXTHOP_IPV4_IFINDEX) would never trigger any recursive route update. Signed-off-by: Christian Franke <chris@opensourcerouting.org> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
* zebra: improve display of NEXTHOP_IPV4_IFINDEX in show ip routeChristian Franke2013-08-061-2/+9
| | | | | Signed-off-by: Christian Franke <chris@opensourcerouting.org> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
* bgpd: honor PEER_FLAG_DISABLE_CONNECTED_CHECK on bgp_scanChristian Franke2013-07-311-1/+2
| | | | | | | | | | When neighbor disable-connected-check was used, bgpd would accept routes with unconnected nexthop as indended, however those routes would be invalidated on the next bgp_scan run as that function did not know about disable-connected-check. Signed-off-by: Christian Franke <chris@opensourcerouting.org> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
* isisd, ospf6d: use bug-report information from autoconfChristian Franke2013-07-312-2/+2
| | | | | Signed-off-by: Christian Franke <chris@opensourcerouting.org> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
* zebra: don't printf to stdout on ZEBRA_IPV6_NEXTHOP_LOOKUPChristian Franke2013-07-311-1/+3
| | | | | Signed-off-by: Christian Franke <chris@opensourcerouting.org> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
* vtysh: don't append superflous spaces (BZ#750)Christian Franke2013-07-311-5/+3
| | | | | | | | | | | | | | | rl_completion_append_character is reset to space every time the completion function is entered. So we would have to set it to '\0' every time new_completion() is called. We can make this conditional and avoid using rl_pending_input. This code path is most relevant when there are multiple completion matches with the same prefix, e.g. in router bgp context: "neighbor 1.2.3.4 pa"<ssive|ssword> would have been completed to "neighbor 1.2.3.4 pass " instead of "neighbor 1.2.3.4 pass". Signed-off-by: Christian Franke <chris@opensourcerouting.org> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
* bgpd: write NOTIFY non-blockinglyDavid Lamparter2013-07-311-4/+5
| | | | | | | | | | | | | | | switching the socket to blocking may well block the entire bgpd process for some time if our peer is overloaded (which may well be the original reason for the NOTIFY) The error handling is slightly different from the previous ML discussion on this; buffer exhaustion isn't technically a fatal TCP error, and we should probably proceed with FSM actions according to a sent NOTIFY (adjusting timers) even if we didn't manage to get the NOTIFY onto the wire. Acked-by: Leonid Rosenboim <lrosenbo@wrs.com> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
* bgpd: prevent double address delete on shutdownRakesh Garimella2013-07-301-0/+4
| | | | | | | | | | bgp_interface_down() and bgp_exit() both proceed to delete the address from bgpd's interface representation, so the second call gets a NULL result from the hash lookup and subsequently crashes. Signed-off-by: Rakesh Garimella <rakesh.garimella@sophos.com> [reformatted] Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
* bgpd: stricter packet handling in OpenSentLeonid Rosenboim2013-07-301-18/+41
| | | | | | | | | | | Keepalives and updates are not expected in OpenSent, prior to receiving the peer's open message. Terminate the session with the proper notification. From: Leonid Rosenboim <lrosenbo@wrs.com> [split off FSM changes, some reordering & cleanup. read handling needs to be separately addressed] Signed-off-by: David Lamparter <equinox@diac24.net>
* lib: unconditionally include stddef.hDavid Lamparter2013-07-301-1/+1
| | | | | | | | | | | | I've used offsetof() in the previous commit to paper over the security problems in ospf_api.c. This blows the build on FreeBSD 7.0, missing offsetof(). Let's add that to zebra's generally used includes. stddef.h (and offsetof) is defined in C89 section 4.1.5 (and not deprecated/removed by any later standard). If this causes problems, the bug report should go against the host OS/compiler... Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
* ospfd: CVE-2013-2236, stack overrun in apiserverDavid Lamparter2013-07-281-7/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | the OSPF API-server (exporting the LSDB and allowing announcement of Opaque-LSAs) writes past the end of fixed on-stack buffers. This leads to an exploitable stack overflow. For this condition to occur, the following two conditions must be true: - Quagga is configured with --enable-opaque-lsa - ospfd is started with the "-a" command line option If either of these does not hold, the relevant code is not executed and the issue does not get triggered. Since the issue occurs on receiving large LSAs (larger than 1488 bytes), it is possible for this to happen during normal operation of a network. In particular, if there is an OSPF router with a large number of interfaces, the Router-LSA of that router may exceed 1488 bytes and trigger this, leading to an ospfd crash. For an attacker to exploit this, s/he must be able to inject valid LSAs into the OSPF domain. Any best-practice protection measure (using crypto authentication, restricting OSPF to internal interfaces, packet filtering protocol 89, etc.) will prevent exploitation. On top of that, remote (not on an OSPF-speaking network segment) attackers will have difficulties bringing up the adjacency needed to inject a LSA. This patch only performs minimal changes to remove the possibility of a stack overrun. The OSPF API in general is quite ugly and needs a rewrite. Reported-by: Ricky Charlet <ricky.charlet@hp.com> Cc: Florian Weimer <fweimer@redhat.com> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
* doc: Modernize INSTALL.quagga.txt.Greg Troxel2013-07-151-2/+7
| | | | | | | | Note that list of prereq versions is out of date. Add DejaGnu for testing. Change references to CVS to git. Signed-off-by: Greg Troxel <gdt@ir.bbn.com>
* tests: don't build tests unless make check is runChristian Franke2013-07-151-1/+1
| | | | | | | Use check_PROGRAMS instead of noinst_PROGRAMS in tests/Makefile.am to build the tests only when make check is actually run. Signed-off-by: Christian Franke <chris@opensourcerouting.org>
* tests: fix Makefile.am so it works with BSD makeChristian Franke2013-07-091-1/+0
| | | | | | | | The export statement is specific to GNU make and breaks the build with BSD make. I couldn't observe any difference in behaviour between having the export present and absent, therefore, just remove it. Signed-off-by: Christian Franke <chris@opensourcerouting.org>
* ospfd: fix flooding procedureChristian Franke2013-04-203-3/+3
| | | | | | | | | | | An ospf router should accept a new maxage LSA into its lsdb if it has any neighbors in state Exchange or Loading. ospfd would however only account for neighbors on the same interface which does not seem to be a valid optimization. Signed-off-by: Christian Franke <chris@opensourcerouting.org> Signed-off-by: Joachim Nilsson <troglobit@gmail.com> Signed-off-by: David Lamparter <equinox@diac24.net>
* ospfd: make ospf_maxage_lsa_remover actually yieldChristian Franke2013-04-201-1/+7
| | | | | | | | | ospf_maxage_lsa_remover whould check whether to yield, but run on anyway. Signed-off-by: Christian Franke <chris@opensourcerouting.org> Signed-off-by: Joachim Nilsson <troglobit@gmail.com> Signed-off-by: David Lamparter <equinox@diac24.net>
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-04 09:56:35 +0000