- Bird-users - Mailing Lists

OSPF: Bad packet from ... - authentication failed
by Daniel Wendler 07 Mar '14

07 Mar '14

Hello List, we have at the moment an strange problem in our OSPF setup.

1 0

Blackholing: security considerations
by Alexander Shikov 07 Mar '14

07 Mar '14

Hi All, As usually IXPs do, we also perform route filtering with prefix lists. In prefix lists we include only those prefixes which have corresponding "route" objects in RADB/RIPE. We don't accept by default longer prefixes, i.e. in prefix list we include, for example, 10.0.0.0/21 but not 10.0.0.0/21+. With the purposes of blackholing sometimes there is need to accept more-specific prefixes, mostly /32, from BGP peers. The easiest way is just to accept /32 in filter. But the main problem is that any peer can announce /32 route to any network, even to unreachable one. Thus there is need to additionally check /32 routes. For the first look, we may include longer prefixes to prefix list, and then check incoming /32 prefix against it. Result will look like: bird> show route protocol ITCONS 109.68.40.20/32 via 193.25.181.253 on vlan777 [ITCONS 2014-03-06 22:02:42 from 193.25.180.17] * (100) [AS25372i] 109.68.40.0/21 via 193.25.180.17 on vlan777 [ITCONS 2014-03-06 21:45:24] * (100) [AS25372i] i.e. filtering against [ 109.68.40.0/21+ ]. Now let's assume that 109.68.40.0/21 is reachable via other peer, and we got new route, and it is better due to as-path length, and new peer does not want to blackhole 109.68.40.20. Then "109.68.40.0/21 via 193.25.180.17" will become inactive, but "109.68.40.20/32 via 193.25.181.253 from 193.25.180.17" will stay best, and new peer will lose traffic to 109.68.40.20. Thus, it'd be reasonable to compare received /32 against routing table, and accept it only if there is active less-specific route from same peer. Personally I was not able to find solution for bird. Now I'm wondering how do other IXPs perform such filtering? Any ideas or thoughts are kindly appreciated! Thanks in advance! -- Alexander Shikov Technical Staff, Digital Telecom IX http://dtel-ix.net/

4 4

bitwise operation in filters
by Daniel Wendler 03 Mar '14

03 Mar '14

Hello List, at the moment we try to implement an fine granulary filter mechanism in our Bird OSPF setup. We ask ourselfes if anyone has implementet bitwise operations in Bird filters which is not in official code. If not, are there any plans to implement such an feature in Bird filters or should we try it to implement on our own and contribute this to the mailing list? For better understanding i include an example: We use the ospf_tag attribute as an group identifier. at the moment we have 4 groups. There are routers which could belong to more than one group. So we would like to combine the groups in any way. The most efficient way to reach this is an bitwise operation. -- Mit freundlichen Grüßen --------------------------------- Daniel Wendler

3 3

Filter being ignored.
by Steve (Telsat Broadband) 02 Mar '14

02 Mar '14

Hi All, I've configured the following 'export' filter in my OSPF protocol: protocol ospf { import all; export filter { ospf_metric1 = 1000; if ( net = [ 192.168.0.0/16+ ] ) then reject; if ( source = RTS_STATIC ) then accept; else reject; }; Yet on my router, I'm still seeing the route coming in via OSPF: O 192.168.38.0/24 [110/1001] via xxx.xxx.xxx.xxx, 00:00:05, GigabitEthernet0/1 O 192.168.39.0/24 [110/1001] via xxx.xxx.xxx.xxx, 00:00:05, GigabitEthernet0/1 Is there something I'm missing? How can I get these network's excluded? Cheers. Steve.

2 3

Combining routes in BIRD OSPF export
by Steve (Telsat Broadband) 28 Feb '14

28 Feb '14

Hi All, I have a question which I can't seem to find the answer for. We allocate network ranges to our customers (both IPv4 and v6). All our v6 ranges (say /64's) get allocated out of a single larger /56 block. What I want to do is prevent BIRD from picking up the individual /64's assigned to customers and only 'export' the larger '/56' block to OSPF as this is really all that's required. What configuration would I need to alter to achieve this. This is the current (v6) config we're using: log syslog all; router id xxx.xxx.xxx.xxx; debug protocols all; protocol device { scan time 10; } protocol kernel { export all; scan time 15; } protocol static { import all; } protocol ospf { import all; export filter { ospf_metric1 = 1000; if source = RTS_STATIC then accept; else reject; }; area 0 { interface "eth0" { cost 5; type broadcast; hello 10; retransmit 5; wait 40; dead 40; authentication none; }; interface "*" { cost 1000; stub; }; }; } Cheers Steve

2 4

BIRD 1.4.0 bugfixes [2/2]
by Pierluigi Rolando 26 Feb '14

26 Feb '14

Hi, This patch fixes a situation where a route that becomes unviable because of a configuration change (i.e. next hop of its new version is unreachable) is marked as not installed internally, but actually remains in the kernel routing table until a subsequent configuration change makes the next hop reachable again. The code that updates static routes seems to process changes as deletions + insertions, but if the insertion can't happen for any reason the deletion won't happen as well, even though the route is already marked as uninstalled by then. When that happens BIRD and the kernel get out of sync until BIRD tries to install the route again, which might be never. The patch is supposed to fix the problem by detecting routes that (a) have changed but (b) are not getting deleted because their updated version can't get installed, and deletes them anyway. There's also a quick sanity check to make sure we don't end up with 3 states for the installed flag (which should obviously be a base 2 boolean), even though 3 states are needed temporarily when processing updates. Thanks, Pierluigi diff -a -u -r a/proto/static/static.c b/proto/static/static.c --- a/proto/static/static.c 2013-04-29 14:41:58.000000000 -0700 +++ b/proto/static/static.c 2014-02-24 12:45:46.433136581 -0800 @@ -62,10 +62,15 @@ rta a, *aa; rte *e; - if (r->installed) + /* 3 cases here: + * (a) r->installed > 0: already installed, no op; + * (b) !r->installed: really really not installed, create; + * (c) r->installed < 0: needs update but it's there. + */ + if (r->installed > 0) return; - DBG("Installing static route %I/%d, rtd=%d\n", r->net, r->masklen, r->dest); + DBG("Installing static route %I/%d->%I, rtd=%d\n", r->net, r->masklen, r->via, r->dest); bzero(&a, sizeof(a)); a.proto = p; a.source = (r->dest == RTD_DEVICE) ? RTS_STATIC_DEVICE : RTS_STATIC; @@ -82,7 +87,7 @@ struct mpnh **nhp = &nhs; for (r2 = r->mp_next; r2; r2 = r2->mp_next) - if (r2->installed) + if (r2->installed > 0) { struct mpnh *nh = alloca(sizeof(struct mpnh)); nh->gw = r2->via; @@ -122,10 +127,17 @@ { net *n; + /* 3 cases here: + * (a) r->installed > 0: remove; + * (b) !r->installed: it's not there, don't remove; + * (c) r->installed < 0: update, needs removal even + * if new route can't be installed. + */ + if (!r->installed) return; - DBG("Removing static route %I/%d\n", r->net, r->masklen); + DBG("Removing static route %I/%d->%I\n", r->net, r->masklen, r->via); n = net_find(p->table, r->net, r->masklen); if (n) rte_update(p->table, n, p, p, NULL); @@ -410,6 +422,7 @@ static_match(struct proto *p, struct static_route *r, struct static_config *n) { struct static_route *t; + int new_installed = 0; /* * For given old route *r we find whether a route to the same @@ -422,17 +435,28 @@ r->neigh->data = NULL; WALK_LIST(t, n->iface_routes) if (static_same_net(r, t)) - { - t->installed = r->installed && static_same_dest(r, t); - return; - } + goto mark_for_deletion; WALK_LIST(t, n->other_routes) if (static_same_net(r, t)) - { - t->installed = r->installed && static_same_dest(r, t); - return; - } + goto mark_for_deletion; static_remove(p, r); + return; + +mark_for_deletion: + new_installed = r->installed && static_same_dest(r, t); + if(new_installed == 0 && r->installed) { + /* XXX: this will silently uninstall a route that changed even though its new + * version cannot be installed immediately. + * Without this the route won't be removed (as required by the change), since + * its new version cannot currently be installed. + * So what we want to do is to remove the route here for real. BIRD + * will worry about adding it again later after the next hop becomes + * reachable again. + */ + t->installed = -1; + } else + t->installed = new_installed; + return; } static inline rtable * @@ -467,6 +491,20 @@ WALK_LIST(r, n->other_routes) static_add(p, n, r); + /* route->installed has now 3 possible values: + * (a) > 0, route is installed; + * (b) == 0, route is not installed; + * (c) < 0, route was marked as not installed because it changed and it needs update. + * + * Beyond this point it's not legal to keep the < 0 case. It's actually a bug in the + * code. Any route that is < 0 needed to be removed. The proper thing to do + * would be asserting or so. + */ + WALK_LIST(r, n->iface_routes) + ASSERT(r->installed >= 0); + WALK_LIST(r, n->other_routes) + ASSERT(r->installed >= 0); + return 1; }

2 2

BIRD 1.4.0 bugfixes [1/2]
by Pierluigi Rolando 26 Feb '14

26 Feb '14

Hi, This patch fixes a situation where an interface enters TMPDOWN state and doesn't leave it until a device scan is triggered by timer. This seems to happen whenever the interface is up but with no IP address configured. BIRD will then put the interface in TMPDOWN state (correctly), but the state is not left even though an IP address is assigned later. The problem in turn appears to be the way IF_UPDATE flags are used to pass state information between if_update and ifa_update calls. A scan will make it right, but simply processing RTM messages won't. A workaround to this issue is to scan devices frequently, which might be not acceptable if reactions to RTM_NEWADDR/RTM_DELADDR/etc. are expected to happen without much average delay. As you'll see, this patch is probably overkill. Thanks, Pierluigi diff -a -u -r a/sysdep/linux/netlink.c b/sysdep/linux/netlink.c --- a/sysdep/linux/netlink.c 2013-11-25 06:19:10.000000000 -0800 +++ b/sysdep/linux/netlink.c 2013-12-05 18:33:09.282768865 -0800 @@ -963,11 +963,24 @@ case RTM_DELLINK: DBG("KRT: Received async link notification (%d)\n", h->nlmsg_type); nl_parse_link(h, 0); + kif_do_scan(NULL); break; case RTM_NEWADDR: case RTM_DELADDR: DBG("KRT: Received async address notification (%d)\n", h->nlmsg_type); nl_parse_addr(h); + /* XXX: this (and the one above) are to get unstuck when the if comes up + * with no IP address, then a route gets installed, then an IP address + * gets configured. The crux of the problem is that async message processing + * apparently never gets the interface unstuck from TMPDOWN state, + * but the scan will fix it. + * + * I believe that the problem is that BOTH if_update AND ifa_update must + * be called within the same scan (IF_UPDATE flags are relevant). + * This will scan ALL interface which is overkill. The parameter (currently + * unused) might be used to indicate which one to scan. + */ + kif_do_scan(NULL); break; default: DBG("KRT: Received unknown async notification (%d)\n", h->nlmsg_type);

4 6

BIRD 1.4.0 bugfixes [0/2]
by Pierluigi Rolando 24 Feb '14

24 Feb '14

Hi, Over the course of the next few emails I'd like to post 2 bugfixes for your consideration. These derive from similar patches that my organization (www.embrane.com) has adopted (internally, at this time) to work around issues that we've encountered in BIRD 1.4.0 and 1.3.11 builds. Before I begin, let me be clear on one point. The patches I'm about to post are not intended to be included as-is in BIRD. I'm posting them in order to explain the problem a bit better than I could with words alone. You guys know BIRD much, much better than I do and you will probably be able to come up with cleaner ways to fix these issues. These are quick'n'dirty hacks. All patches should apply cleanly to 1.4.0, v4 and v6. They've been tested, in slightly different form, under Linux kernel version 3.2.14 or later. Their formatting might be a little messed up as I need to massage them a bit before posting to take out comments and debugging statements that are out of scope. What will follow is: [1/2] - fix for an interface never leaving TMPDOWN state unless a full interface scan is initiated by timer; [2/2] - fix for a situation where a static route change gets silently ignored if the new gateway for that route is unreachable. Both these problems seem present in released BIRD versions. I haven't been able to find anything about them on the ML so I'm assuming they're currently unpatched. If that's not the case please let me know. Since it's my first time posting patches here I apologize in advance for anything I might get wrong. Thanks, Pierluigi

1 0

OSFP LSA_MAXSEQNO problems
by Alexander V. Chernikov 23 Feb '14

23 Feb '14

Hello list! Currently bird performs LSA premature aging in very strange way which sometimes upsets quagga (up to SIGSEGV) and Cisco. Every time aging is done via setting seq number to LSA_MAXSEQNO. RFC 2328, on the opposite, shows us only 2 cases where MaxSequenceNumber is used in outgoing LSAs: 1) Self LSA originating with given seq num (very rare event) 2) [Premature] Aging of LSA from 1) because a) disappeared net and b) seq number increase (12.1.6) For all other cases seq number should be either increased or left intact. Bird, however, insist on setting LSA_MAXSEQNO while: 1) Receiving self-originating LSA which is not in local LSDB ( ospf_lsupd_receive ) which is not a special case according to 14.1 2) In all other places like handling if-down, external route disappear, etc... ( ospf_lsupd_flush_nlsa ) IT takes noticeable time (sometimes up to 5 seconds) for Cisco 65XX with ~40 neighbors to age given LSA (however it seems that problem is repeatable for ASR9k, too). And while such LSA is in database, every new update is ignored due to 13 step (8). (I've got full logs and pcap for given situation). Can we please consider applying attached patch to make it more compliant?

2 3

[PATCH 2/2] Remember sequence number for LSAs.
by Alexander V. Chernikov 23 Feb '14

23 Feb '14

--- proto/ospf/iface.c | 2 +- proto/ospf/lsalib.c | 5 +- proto/ospf/lsupd.c | 15 +-- proto/ospf/lsupd.h | 2 +- proto/ospf/ospf.c | 8 ++ proto/ospf/ospf.h | 4 + proto/ospf/topology.c | 306 +++++++++++++++++++++++++++++++++++++++++++------- proto/ospf/topology.h | 17 +++ 8 files changed, 301 insertions(+), 58 deletions(-) diff --git a/proto/ospf/iface.c b/proto/ospf/iface.c index f4d9be5..171cf7e 100644 --- a/proto/ospf/iface.c +++ b/proto/ospf/iface.c @@ -318,7 +318,7 @@ ospf_iface_chstate(struct ospf_iface *ifa, u8 state) { ifa->net_lsa->lsa.age = LSA_MAXAGE; if (state >= OSPF_IS_WAITING) - ospf_lsupd_flush_nlsa(po, ifa->net_lsa); + ospf_lsupd_flush_nlsa(po, ifa->oa, ifa->net_lsa); if (can_flush_lsa(po)) flush_lsa(ifa->net_lsa, po); diff --git a/proto/ospf/lsalib.c b/proto/ospf/lsalib.c index bcf7bcd..2b238e3 100644 --- a/proto/ospf/lsalib.c +++ b/proto/ospf/lsalib.c @@ -69,10 +69,7 @@ ospf_age(struct proto_ospf *po) { OSPF_TRACE(D_EVENTS, "Refreshing my LSA: Type: %u, Id: %R, Rt: %R", en->lsa.type, en->lsa.id, en->lsa.rt); - en->lsa.sn++; - en->lsa.age = 0; - en->inst_t = now; - en->ini_age = 0; + update_lsa_seq(po, en, en->lsa.sn + 1); /* XXX: LSA_MAXSEQNO */ lsasum_calculate(&en->lsa, en->lsa_body); ospf_lsupd_flood(po, NULL, NULL, &en->lsa, en->domain, 1); continue; diff --git a/proto/ospf/lsupd.c b/proto/ospf/lsupd.c index 8f65c53..65c9ae4 100644 --- a/proto/ospf/lsupd.c +++ b/proto/ospf/lsupd.c @@ -600,20 +600,14 @@ ospf_lsupd_receive(struct ospf_packet *ps_i, struct ospf_iface *ifa, if (lsadb) { OSPF_TRACE(D_EVENTS, "Reflooding new self-originated LSA with newer sequence number"); - lsadb->lsa.sn = lsatmp.sn + 1; - lsadb->lsa.age = 0; - lsadb->inst_t = now; - lsadb->ini_age = 0; - lsasum_calculate(&lsadb->lsa, lsadb->lsa_body); + update_lsa_seq(po, lsadb, lsatmp.sn + 1); /* XXX: lsatmp.sn == LSA_MAXSEQNO - 1 */ ospf_lsupd_flood(po, NULL, NULL, &lsadb->lsa, domain, 1); } else { OSPF_TRACE(D_EVENTS, "Premature aging it"); lsatmp.age = LSA_MAXAGE; - lsatmp.sn = LSA_MAXSEQNO; lsa->age = htons(LSA_MAXAGE); - lsa->sn = htonl(LSA_MAXSEQNO); lsasum_check(lsa, (lsa + 1)); /* It also calculates chsum! */ lsatmp.checksum = ntohs(lsa->checksum); ospf_lsupd_flood(po, NULL, lsa, &lsatmp, domain, 0); @@ -749,14 +743,13 @@ ospf_lsupd_receive(struct ospf_packet *ps_i, struct ospf_iface *ifa, } void -ospf_lsupd_flush_nlsa(struct proto_ospf *po, struct top_hash_entry *en) +ospf_lsupd_flush_nlsa(struct proto_ospf *po, struct ospf_area *oa, struct top_hash_entry *en) { struct ospf_lsa_header *lsa = &en->lsa; struct proto *p = &po->proto; - lsa->age = LSA_MAXAGE; - lsa->sn = LSA_MAXSEQNO; - lsasum_calculate(lsa, en->lsa_body); + flush_lsa_seq(po, oa, en); + OSPF_TRACE(D_EVENTS, "Premature aging self originated lsa!"); OSPF_TRACE(D_EVENTS, "Type: %04x, Id: %R, Rt: %R", lsa->type, lsa->id, lsa->rt); ospf_lsupd_flood(po, NULL, NULL, lsa, en->domain, 0); diff --git a/proto/ospf/lsupd.h b/proto/ospf/lsupd.h index 8bacfe6..780ba9d 100644 --- a/proto/ospf/lsupd.h +++ b/proto/ospf/lsupd.h @@ -18,7 +18,7 @@ void ospf_lsupd_receive(struct ospf_packet *ps_i, int ospf_lsupd_flood(struct proto_ospf *po, struct ospf_neighbor *n, struct ospf_lsa_header *hn, struct ospf_lsa_header *hh, u32 domain, int rtl); -void ospf_lsupd_flush_nlsa(struct proto_ospf *po, struct top_hash_entry *en); +void ospf_lsupd_flush_nlsa(struct proto_ospf *po, struct ospf_area *oa, struct top_hash_entry *en); int ospf_lsa_flooding_allowed(struct ospf_lsa_header *lsa, u32 domain, struct ospf_iface *ifa); diff --git a/proto/ospf/ospf.c b/proto/ospf/ospf.c index e751f7c..0684de9 100644 --- a/proto/ospf/ospf.c +++ b/proto/ospf/ospf.c @@ -178,6 +178,8 @@ ospf_area_add(struct proto_ospf *po, struct ospf_area_config *ac, int reconf) if (oa_is_nssa(oa) && ((struct ospf_config *) (p->cf))->abr) po->ebit = 1; + init_seq_fib(po, oa); + if (reconf) ospf_ifaces_reconfigure(oa, ac); } @@ -198,6 +200,8 @@ ospf_area_remove(struct ospf_area *oa) if (oa->translator_timer) rfree(oa->translator_timer); + free_seq_fib(oa->po, oa); + oa->po->areano--; rem_node(NODE oa); mb_free(oa); @@ -265,6 +269,8 @@ ospf_start(struct proto *p) WALK_LIST(ic, c->vlink_list) ospf_iface_new_vlink(po, ic); + init_seq_fib(po, NULL); + return PS_UP; } @@ -563,6 +569,8 @@ ospf_shutdown(struct proto *p) } FIB_WALK_END; + free_seq_fib(po, NULL); + return PS_DOWN; } diff --git a/proto/ospf/ospf.h b/proto/ospf/ospf.h index 66719e3..44b3344 100644 --- a/proto/ospf/ospf.h +++ b/proto/ospf/ospf.h @@ -756,6 +756,8 @@ struct ospf_area timer *translator_timer; /* For NSSA translator switch */ struct proto_ospf *po; struct fib rtr; /* Routing tables for routers */ + struct fib seq_fib; /* Sequence number storage for LSAs */ + timer *seq_timer; /* Timer for seq_fib pruning */ }; #define TRANS_OFF 0 @@ -786,6 +788,8 @@ struct proto_ospf sock *vlink_sk; /* IP socket used for vlink TX */ u32 router_id; u32 last_vlink_id; /* Interface IDs for vlinks (starts at 0x80000000) */ + struct fib seq_fib; /* Sequence number storage for external LSAs */ + timer *seq_timer; /* Timer for seq_fib pruning */ }; struct ospf_iface_patt diff --git a/proto/ospf/topology.c b/proto/ospf/topology.c index 6498585..cc4c97a 100644 --- a/proto/ospf/topology.c +++ b/proto/ospf/topology.c @@ -27,6 +27,9 @@ void flush_prefix_net_lsa(struct ospf_iface *ifa); static void fill_lsa_header(struct proto_ospf *po, struct ospf_area *oa, struct ospf_lsa_header *lsa, struct fib_node *fn, struct ospf_iface *ifa); +static s32 get_lsa_seq(struct proto_ospf *po, struct ospf_area *oa, struct ospf_lsa_header *lsa); +static void check_seq_fibs(struct timer *timer); + #ifdef OSPFv2 #define ipa_to_rid(x) _I(x) #else /* OSPFv3 */ @@ -141,23 +144,6 @@ lsab_end(struct proto_ospf *po) return ((byte *) po->lsab) + po->lsab_used; } -static s32 -get_seqnum(struct top_hash_entry *en) -{ - if (!en) - return LSA_INITSEQNO; - - if (en->lsa.sn == LSA_MAXSEQNO) - { - log(L_WARN "OSPF: Premature origination of LSA (Type: %04x, Id: %R, Rt: %R)", - en->lsa.type, en->lsa.id, en->lsa.rt); - return LSA_INITSEQNO; - } - - return en->lsa.sn + 1; -} - - static int configured_stubnet(struct ospf_area *oa, struct ifa *a) { @@ -490,7 +476,7 @@ originate_rt_lsa(struct ospf_area *oa) lsa.type = LSA_T_RT; fill_lsa_header(po, oa, &lsa, NULL, NULL); - lsa.sn = get_seqnum(oa->rt); + lsa.sn = get_lsa_seq(po, oa, &lsa); u32 dom = oa->areaid; body = originate_rt_lsa_body(oa, &lsa.length); @@ -594,7 +580,7 @@ originate_net_lsa(struct ospf_iface *ifa) lsa.type = LSA_T_NET; fill_lsa_header(po, ifa->oa, &lsa, NULL, ifa); - lsa.sn = get_seqnum(ifa->net_lsa); + lsa.sn = get_lsa_seq(po, ifa->oa, &lsa); body = originate_net_lsa_body(ifa, &lsa.length, po); lsasum_calculate(&lsa, body); @@ -613,9 +599,7 @@ flush_net_lsa(struct ospf_iface *ifa) return; OSPF_TRACE(D_EVENTS, "Flushing network-LSA for iface %s", ifa->ifname); - ifa->net_lsa->lsa.sn += 1; - ifa->net_lsa->lsa.age = LSA_MAXAGE; - lsasum_calculate(&ifa->net_lsa->lsa, ifa->net_lsa->lsa_body); + flush_lsa_seq(po, ifa->oa, ifa->net_lsa); ospf_lsupd_flood(po, NULL, NULL, &ifa->net_lsa->lsa, dom, 0); flush_lsa(ifa->net_lsa, po); ifa->net_lsa = NULL; @@ -684,7 +668,7 @@ check_sum_lsa_same(struct top_hash_entry *en, u32 metric) { /* Netmask already checked in check_sum_net_lsaid_collision() */ struct ospf_lsa_sum *sum = en->lsa_body; - return (en->lsa.sn != LSA_MAXSEQNO) && (sum->metric == metric); + return (en->lsa.age != LSA_MAXAGE) && (sum->metric == metric); } #define check_sum_net_lsa_same(en,metric) \ @@ -727,7 +711,7 @@ check_sum_net_lsa_same(struct top_hash_entry *en, u32 metric) { /* Prefix already checked in check_sum_net_lsaid_collision() */ struct ospf_lsa_sum_net *sum = en->lsa_body; - return (en->lsa.sn != LSA_MAXSEQNO) && (sum->metric == metric); + return (en->lsa.age != LSA_MAXAGE) && (sum->metric == metric); } static inline void * @@ -747,7 +731,7 @@ static inline int check_sum_rt_lsa_same(struct top_hash_entry *en, u32 drid, u32 metric, u32 options) { struct ospf_lsa_sum_rt *sum = en->lsa_body; - return (en->lsa.sn != LSA_MAXSEQNO) && (sum->options == options) && + return (en->lsa.age != LSA_MAXAGE) && (sum->options == options) && (sum->metric == metric) && (sum->drid == drid); } @@ -781,7 +765,7 @@ originate_sum_net_lsa(struct ospf_area *oa, struct fib_node *fn, int metric) if (check_sum_net_lsa_same(en, metric)) return; } - lsa.sn = get_seqnum(en); + lsa.sn = get_lsa_seq(po, oa, &lsa); body = originate_sum_net_lsa_body(po, &lsa.length, fn, metric); lsasum_calculate(&lsa, body); @@ -813,7 +797,7 @@ originate_sum_rt_lsa(struct ospf_area *oa, struct fib_node *fn, int metric, u32 if (check_sum_rt_lsa_same(en, lsa.id, metric, options)) return; } - lsa.sn = get_seqnum(en); + lsa.sn = get_lsa_seq(po, oa, &lsa); body = originate_sum_rt_lsa_body(po, &lsa.length, lsa.id, metric, options); lsasum_calculate(&lsa, body); @@ -844,10 +828,7 @@ flush_sum_lsa(struct ospf_area *oa, struct fib_node *fn, int type) return; } - struct ospf_lsa_sum *sum = en->lsa_body; - en->lsa.age = LSA_MAXAGE; - en->lsa.sn = LSA_MAXSEQNO; - lsasum_calculate(&en->lsa, sum); + flush_lsa_seq(po, oa, en); ospf_lsupd_flood(po, NULL, NULL, &en->lsa, oa->areaid, 1); if (can_flush_lsa(po)) flush_lsa(en, po); } @@ -893,7 +874,7 @@ check_ext_lsa(struct top_hash_entry *en, struct fib_node *fn, u32 metric, ip_add if (fn->pxlen != ipa_mklen(ext->netmask)) return -1; - return (en->lsa.sn != LSA_MAXSEQNO) && (ext->metric == metric) && + return (en->lsa.age != LSA_MAXAGE) && (ext->metric == metric) && (ext->tag == tag) && ipa_equal(ext->fwaddr,fwaddr); } @@ -946,7 +927,7 @@ check_ext_lsa(struct top_hash_entry *en, struct fib_node *fn, u32 metric, ip_add if ((fn->pxlen != pxlen) || !ipa_equal(fn->prefix, prefix)) return -1; - if (en->lsa.sn == LSA_MAXSEQNO) + if (en->lsa.age == LSA_MAXAGE) return 0; u32 rt_metric = ext->metric & METRIC_MASK; @@ -1081,7 +1062,7 @@ originate_ext_lsa(struct ospf_area *oa, struct fib_node *fn, int src, if (rv > 0) return; } - lsa.sn = get_seqnum(en); + lsa.sn = get_lsa_seq(po, NULL, &lsa); body = originate_ext_lsa_body(po, &lsa.length, fn, metric, fwaddr, tag, pbit); lsasum_calculate(&lsa, body); @@ -1126,7 +1107,7 @@ flush_ext_lsa(struct ospf_area *oa, struct fib_node *fn, int nssa) } fn->x1 = 0; - ospf_lsupd_flush_nlsa(po, en); + ospf_lsupd_flush_nlsa(po, NULL, en); } } @@ -1216,6 +1197,251 @@ fill_lsa_header(struct proto_ospf *po, struct ospf_area *oa, struct ospf_lsa_hea lsa->id = lsid; } +static struct seq_data * +find_seq(struct proto_ospf *po, struct ospf_area *oa, struct ospf_lsa_header *lsa, int create) +{ + struct seq_fib_data *sfd; + struct fib *seq_fib; + ip_addr addr; + + memset(&addr, 0, sizeof(addr)); +#ifdef IPV6 + _I3(addr) = lsa->id; +#else + addr = _I(lsa->id); +#endif + + if (oa != NULL) + seq_fib = &oa->seq_fib; + else + seq_fib = &po->seq_fib; + + if (create != 0) + sfd = (struct seq_fib_data *)fib_get(seq_fib, &addr, BITS_PER_IP_ADDRESS); + else + sfd = (struct seq_fib_data *)fib_find(seq_fib, &addr, BITS_PER_IP_ADDRESS); + + if (sfd == NULL) + return NULL; + + return &sfd->type[lsa->type % SEQ_DATA_MAX]; +} + +static s32 +get_lsa_seq(struct proto_ospf *po, struct ospf_area *oa, struct ospf_lsa_header *lsa) +{ + struct seq_data *sd; + + sd = find_seq(po, oa, lsa, 1); + + if (sd->active == 0) + { + /* New entry */ + sd->seq = LSA_INITSEQNO; + } + else + { + if (++sd->seq == LSA_MAXSEQNO) + { + /* + * According to 12.1.6 in 2338 RFC + * we need to ensure that previous version + * is flushed: + * + * 'As soon as this flood has been acknowledged by + * all adjacent neighbors, a new instance can be + * originated with sequence number of InitialSequenceNumber.' + * + * XXX: We're currently not controlling if our adjacent neighbors + * acknowledge LSA flush. However, since this is VERY rare case, + * simply set seq to InitialSequenceNumber. + */ + sd->seq = LSA_INITSEQNO; + } + } + + sd->active = 1; + sd->last = now; + + return sd->seq; +} + +/** + * update_lsa_seq - updates age/seq/checksum for given LSA. + * @po: OSPF protocol + * @oa: OSPF area + * @en: LSA base + * @sn: new checksum + */ +void +update_lsa_seq(struct proto_ospf *po, struct top_hash_entry *en, s32 sn) +{ + struct ospf_lsa_header *lsa = &en->lsa; + struct ospf_area *oa = NULL; + struct seq_data *sd; + + lsa->sn = sn; + lsa->age = 0; + en->inst_t = now; + en->ini_age = 0; + lsasum_calculate(lsa, en->lsa_body); + + /* + * Get area to search into. + * Treat LSA_SCOPE_LINK as AREA and + * LSA_SCOPE_RES (if any) as AS + */ + switch (LSA_SCOPE(lsa)) + { +#ifndef OSPFv2 + case LSA_SCOPE_LINK: +#endif + case LSA_SCOPE_AREA: + oa = ospf_find_area(po, en->domain); + break; + } + + if ((sd = find_seq(po, oa, lsa, 0)) == NULL) + { + log(L_WARN "Unable to find LSA sequence for LSA (id=%R type %d)", lsa->id, lsa->type); + return; + } + + sd->seq = lsa->sn; + sd->last = now; +} + +/** + * flush_lsa_seq - notify we're not using given LSA anymore. Updates LSA age/checksum. + * @po: OSPF protocol + * @oa: OSPF area + * @en: LSA base + */ +void +flush_lsa_seq(struct proto_ospf *po, struct ospf_area *oa, struct top_hash_entry *en) +{ + struct ospf_lsa_header *lsa = &en->lsa; + struct seq_data *sd; + + lsa->age = LSA_MAXAGE; + lsasum_calculate(lsa, en->lsa_body); + + if ((sd = find_seq(po, oa, lsa, 0)) == NULL) + { + log(L_WARN "Unable to flush LSA sequence for LSA (id=%R type %d)", lsa->id, lsa->type); + return; + } + + sd->active = -1; + sd->last = now; +} + +/** + * check_seq_fib - remove unused prefixes from fib + * @po: OSPF protocol + * @seq_fib: fib put prune + */ +static void +check_seq_fib(struct proto_ospf *po, struct fib *seq_fib) +{ + struct fib_iterator fit; + struct seq_fib_data *sfd; + struct seq_data *sd; + int i, keep; + + FIB_ITERATE_INIT(&fit, seq_fib); +again: + FIB_ITERATE_START(seq_fib, &fit, nftmp) + { + sfd = (struct seq_fib_data *) nftmp; + + /* + * Check if we need purge "old" prefixes. + * + * RFC 2328, 14 tells us: + * + * A MaxAge LSA must be removed immediately from the router's link + * state database as soon as both a) it is no longer contained on any + * neighbor Link state retransmission lists and b) none of the router's + * neighbors are in states Exchange or Loading. + * + * This basically means we have no guaranteed timing on MaxAge LSA + * removal, so we keep entries for considerably long amount of time. + */ + keep = 0; + for (i = 0; i < SEQ_DATA_MAX; i++) + { + sd = &sfd->type[i]; + if (sd->active == 1 || sd->last + 3600 >= now) + keep = 1; + } + if (keep == 0) + { + FIB_ITERATE_PUT(&fit, nftmp); + fib_delete(seq_fib, nftmp); + goto again; + } + } + FIB_ITERATE_END(nftmp); +} + +/** + * check_seq_fib - remove unused prefixes from fib + * @timer: timer + */ +static void +check_seq_fibs(timer *timer) +{ + struct proto_ospf *po = timer->data; + struct ospf_area *oa; + + /* Check protocol fib first */ + check_seq_fib(po, &po->seq_fib); + + WALK_LIST(oa, po->area_list) + check_seq_fib(po, &oa->seq_fib); +} + + +/** + * init_seq_fib - Initialize fib for sequence storage + * @po: OSPF protocol + * @oa: OSPF area, if set + */ +void +init_seq_fib(struct proto_ospf *po, struct ospf_area *oa) +{ + timer *t; + struct fib *seq_fib = (oa == NULL) ? &po->seq_fib : &oa->seq_fib; + + fib_init(seq_fib, po->proto.pool, sizeof(struct seq_fib_data), 0, NULL); + + if (oa == NULL) + { + t = tm_new(po->proto.pool); + t->data = po; + t->randomize = 0; + t->hook = check_seq_fibs; + t->recurrent = 3600 / 3; + po->seq_timer = t; + tm_start(t, t->recurrent); + } +} + +/** + * free_seq_fib - iFree sequence storage fib + * @po: OSPF protocol + */ +void +free_seq_fib(struct proto_ospf *po, struct ospf_area *oa) +{ + struct fib *seq_fib = (oa == NULL) ? &po->seq_fib : &oa->seq_fib; + + fib_free(seq_fib); + if (oa != NULL) + rfree(oa->seq_timer); +} + #ifdef OSPFv3 static void * @@ -1267,7 +1493,7 @@ originate_link_lsa(struct ospf_iface *ifa) lsa.type = LSA_T_LINK; fill_lsa_header(po, ifa->oa, &lsa, NULL, ifa); - lsa.sn = get_seqnum(ifa->link_lsa); + lsa.sn = get_lsa_seq(po, ifa->oa, &lsa); u32 dom = ifa->iface_id; body = originate_link_lsa_body(ifa, &lsa.length); @@ -1411,7 +1637,7 @@ originate_prefix_rt_lsa(struct ospf_area *oa) lsa.type = LSA_T_PREFIX; fill_lsa_header(po, oa, &lsa, NULL, NULL); - lsa.sn = get_seqnum(oa->pxr_lsa); + lsa.sn = get_lsa_seq(po, oa, &lsa); u32 dom = oa->areaid; body = originate_prefix_rt_lsa_body(oa, &lsa.length); @@ -1548,7 +1774,7 @@ originate_prefix_net_lsa(struct ospf_iface *ifa) lsa.type = LSA_T_PREFIX; fill_lsa_header(po, ifa->oa, &lsa, NULL, ifa); - lsa.sn = get_seqnum(ifa->pxn_lsa); + lsa.sn = get_lsa_seq(po, ifa->oa, &lsa); u32 dom = ifa->oa->areaid; body = originate_prefix_net_lsa_body(ifa, &lsa.length); @@ -1570,9 +1796,7 @@ flush_prefix_net_lsa(struct ospf_iface *ifa) OSPF_TRACE(D_EVENTS, "Flushing network prefix-LSA for iface %s", ifa->ifname); - en->lsa.sn += 1; - en->lsa.age = LSA_MAXAGE; - lsasum_calculate(&en->lsa, en->lsa_body); + flush_lsa_seq(po, ifa->oa, en); ospf_lsupd_flood(po, NULL, NULL, &en->lsa, dom, 0); flush_lsa(en, po); ifa->pxn_lsa = NULL; diff --git a/proto/ospf/topology.h b/proto/ospf/topology.h index cb87648..5cc64c9 100644 --- a/proto/ospf/topology.h +++ b/proto/ospf/topology.h @@ -47,6 +47,19 @@ struct top_graph unsigned int hash_entries_min, hash_entries_max; }; +struct seq_data { + int active; + s32 seq; + bird_clock_t last; +}; +#define SEQ_DATA_MAX 16 + +struct seq_fib_data +{ + struct fib_node fn; + struct seq_data type[SEQ_DATA_MAX]; /* One for each possible LSA types */ +}; + struct top_graph *ospf_top_new(pool *); void ospf_top_free(struct top_graph *); void ospf_top_dump(struct top_graph *, struct proto *); @@ -73,6 +86,10 @@ void originate_sum_rt_lsa(struct ospf_area *oa, struct fib_node *fn, int metric, void flush_sum_lsa(struct ospf_area *oa, struct fib_node *fn, int type); void originate_ext_lsa(struct ospf_area *oa, struct fib_node *fn, int src, u32 metric, ip_addr fwaddr, u32 tag, int pbit); void flush_ext_lsa(struct ospf_area *oa, struct fib_node *fn, int nssa); +void flush_lsa_seq(struct proto_ospf *po, struct ospf_area *oa, struct top_hash_entry *en); +void update_lsa_seq(struct proto_ospf *po, struct top_hash_entry *en, s32 sn); +void init_seq_fib(struct proto_ospf *po, struct ospf_area *oa); +void free_seq_fib(struct proto_ospf *po, struct ospf_area *oa); #ifdef OSPFv2 -- 1.7.11.5 --------------000206050504040902070200--

1 0