1. 12 Aug, 2019 1 commit
  2. 06 Sep, 2017 1 commit
    • Ondřej Zajíček's avatar
      Basic VRF support · 943478b0
      Ondřej Zajíček authored
      Add basic VRF (virtual routing and forwarding) support. Protocols can be
      associated with VRFs, such protocols will be restricted to interfaces
      assigned to the VRF (as reported by Linux kernel) and will use sockets
      bound to the VRF. E.g., different multihop BGP instances can use diffent
      kernel routing tables to handle BGP TCP connections.
      
      The VRF support is preliminary, currently there are several limitations:
      
      - Recent Linux kernels (4.11) do not handle correctly sockets bound
      to interaces that are part of VRF, so most protocols other than multihop
      BGP do not work. This will be fixed by future kernel versions.
      
      - Neighbor cache ignores VRFs. Breaks config with the same prefix on
      local interfaces in different VRFs. Not much problem as single hop
      protocols do not work anyways.
      
      - Olock code ignores VRFs. Breaks config with multiple BGP peers with the
      same IP address in different VRFs.
      
      - Incoming BGP connections are not dispatched according to VRFs.
      Breaks config with multiple BGP peers with the same IP address in
      different VRFs. Perhaps we would need some kernel API to read VRF of
      incoming connection? Or probably use multiple listening sockets in
      int-new branch.
      
      - We should handle master VRF interface up/down events and perhaps
      disable associated protocols when VRF goes down. Or at least disable
      associated interfaces.
      
      - Also we should check if the master iface is really VRF iface and
      not some other kind of master iface.
      
      - BFD session request dispatch should be aware of VRFs.
      
      - Perhaps kernel protocol should read default kernel table ID from VRF
      iface so it is not necessary to configure it.
      
      - Perhaps we should have per-VRF default table.
      943478b0
  3. 07 Dec, 2016 2 commits
    • Jan Moskyto Matejka's avatar
      af62c0f9
    • Pavel Tvrdík's avatar
      RPKI protocol with one cache server per protocol · 65d2a88d
      Pavel Tvrdík authored
      The RPKI protocol (RFC 6810) using the RTRLib
      (http://rpki.realmv6.org/) that is integrated inside
      the BIRD's code.
      
      Implemeted transports are:
       - unprotected transport over TCP
       - secure transport over SSHv2
      
      Example configuration of bird.conf:
        ...
        roa4 table r4;
        roa6 table r6;
      
        protocol rpki {
          debug all;
      
          # Import both IPv4 and IPv6 ROAs
          roa4 { table r4; };
          roa6 { table r6; };
      
          # Set cache server (validator) address,
          # overwrite default port 323
          remote "rpki-validator.realmv6.org" port 8282;
      
          # Overwrite default time intervals
          retry   10;         # Default 600 seconds
          refresh 60;         # Default 3600 seconds
          expire 600;         # Default 7200 seconds
        }
      
        protocol rpki {
          debug all;
      
          # Import only IPv4 routes
          roa4 { table r4; };
      
          # Set cache server address to localhost,
          # use default ports tcp => 323 or ssh => 22
          remote 127.0.0.1;
      
          # Use SSH transport instead of unprotected transport over TCP
          ssh encryption {
            bird private key "/home/birdgeek/.ssh/id_rsa";
            remote public key "/home/birdgeek/.ssh/known_hosts";
            user "birdgeek";
          };
        }
        ...
      65d2a88d
  4. 01 Nov, 2016 1 commit
  5. 17 May, 2016 1 commit
  6. 13 Apr, 2016 1 commit
    • Ondřej Zajíček's avatar
      BSD: Add the IPsec SA/SP database entries control · a7baa098
      Ondřej Zajíček authored
      Add code for manipulation with TCP-MD5 keys in the IPsec SA/SP database
      at FreeBSD systems. Now, BGP MD5 authentication (RFC 2385) keys are
      handled automatically on both Linux and FreeBSD.
      
      Based on patches from Pavel Tvrdik.
      a7baa098
  7. 06 Apr, 2016 1 commit
    • Ondřej Zajíček's avatar
      IO: Replace RX priority heuristic with explicit mark · 9e7b3ebd
      Ondřej Zajíček authored
      In BIRD, RX has lower priority than TX with the exception of RX from
      control socket. The patch replaces heuristic based on socket type with
      explicit mark and uses it for both control socket and BGP session waiting
      to be established.
      
      This should avoid an issue when during heavy load, outgoing connection
      could connect (TX event), send open, but then failed to receive OPEN /
      establish in time, not sending notifications between and therefore
      got hold timer expired error from the neighbor immediately after it
      finally established the connection.
      9e7b3ebd
  8. 11 Jan, 2016 1 commit
  9. 22 Dec, 2015 1 commit
  10. 21 Dec, 2015 2 commits
  11. 08 Jun, 2015 1 commit
  12. 22 Feb, 2015 1 commit
  13. 24 Oct, 2014 1 commit
  14. 18 May, 2014 1 commit
  15. 06 Feb, 2014 1 commit
    • Ondřej Zajíček's avatar
      Many changes in I/O and OSPF sockets and packet handling. · 48e5f32d
      Ondřej Zajíček authored
      I/O:
       - BSD: specify src addr on IP sockets by IP_HDRINCL
       - BSD: specify src addr on UDP sockets by IP_SENDSRCADDR
       - Linux: specify src addr on IP/UDP sockets by IP_PKTINFO
       - IPv6: specify src addr on IP/UDP sockets by IPV6_PKTINFO
       - Alternative SKF_BIND flag for binding to IP address
       - Allows IP/UDP sockets without tx_hook, on these
         sockets a packet is discarded when TX queue is full
       - Use consistently SOL_ for socket layer values.
      
      OSPF:
       - Packet src addr is always explicitly set
       - Support for secondary addresses in BSD
       - Dynamic RX/TX buffers
       - Fixes some minor buffer overruns
       - Interface option 'tx length'
       - Names for vlink pseudoifaces (vlinkX)
       - Vlinks use separate socket for TX
       - Vlinks do not use fixed associated iface
       - Fixes TTL for direct unicast packets
       - Fixes DONTROUTE for OSPF sockets
       - Use ifa->ifname instead of ifa->iface->name
      48e5f32d
  16. 10 Sep, 2013 1 commit
  17. 25 Jun, 2013 1 commit
  18. 24 Jun, 2013 1 commit
  19. 18 Jul, 2012 1 commit
  20. 08 Jan, 2012 1 commit
  21. 16 Aug, 2011 1 commit
  22. 13 Mar, 2011 1 commit
  23. 21 Feb, 2010 1 commit
  24. 11 Feb, 2010 2 commits
  25. 08 Jan, 2010 1 commit
  26. 09 Nov, 2009 1 commit
  27. 11 Oct, 2009 1 commit
    • Ondřej Zajíček's avatar
      Workaround for stupid callback scheduler. · ea89da38
      Ondřej Zajíček authored
      There is no reak callback scheduler and previous behavior causes
      bad things during hard congestion (like BGP hold timeouts).
      
      Smart callback scheduler is still missing, but main loop was
      changed such that it first processes all tx callbacks (which
      are fast enough) (but max 4* per socket) + rx callbacks for CLI,
      and in the second phase it processes one rx callback per
      socket up to four sockets (as rx callback can be slow when
      there are too many protocols, because route redistribution
      is done synchronously inside rx callback). If there is event
      callback ready, second phase is skipped in 90% of iterations
      (to speed up CLI during congestion).
      ea89da38
  28. 04 Sep, 2009 1 commit
  29. 18 Jun, 2009 1 commit
  30. 01 Nov, 2008 1 commit
  31. 26 Oct, 2008 1 commit
  32. 04 Jun, 2004 1 commit
  33. 31 May, 2004 1 commit
  34. 30 Mar, 2000 1 commit
  35. 29 Oct, 1999 1 commit
  36. 31 May, 1999 1 commit
  37. 12 Apr, 1999 1 commit