Rayhaan JaufeerallyandClaude Fable 5.1
9ca86ede2f
Three independent reviews (hijack resistance, reliability, code health) of the whole tree. This is what they found that could let a bad route in or take the daemon down. Hijacks: - A route had two paths on a two-octet session, AS_PATH and AS4_PATH, read in two places by two rules. A peer could make the origin checked on import differ from the one checked at revalidation, and get an RPKI-invalid route into the table. AS4_PATH is now merged into AS_PATH once, on receipt (RFC 6793 §4.2.3), and nothing else knows of it. - The next hop is judged on import: it must be usable, agreed on (RFC 8950), and by default the peer itself. - Our own originated prefixes are not taken from other networks. - A route for a network the machine is on is never put in the kernel. - Paths with an AS_SET are refused (RFC 9774). - A configured peer gets one session, not one per BGP Identifier. - More IPv6 special-purpose prefixes are bogons. Reliability: - A batch of requests the kernel refused could overflow the netlink socket and end the daemon. The socket has room now, a lost answer or a silent kernel means asking what is there, and neither is fatal. - Working the routes out again within the grace period after a restart no longer drops the routes being kept. - That work can no longer be put off for ever by interface changes. - Peers whose sessions keep failing are slowed down. - Unused attribute sets are swept when they pile up, not only each minute. - Log lines a peer can cause are said once in a while. - An RTR answer is bounded in size and time; data cannot expire between two refreshes. - The shard of a key is taken from a stirred hash: neighbouring bits of the hash proved alike for prefixes in a row. The test that showed it, failing one run in sixteen, is deterministic now. The lab has a phase, hijacks, in which FRR tries the first three. route::apply is a struct with methods instead of nested closures, and the kernel task's loop is shorter. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
33 lines
859 B
TOML
33 lines
859 B
TOML
[package]
|
|
name = "bgp-fib"
|
|
authors.workspace = true
|
|
edition.workspace = true
|
|
homepage.workspace = true
|
|
license.workspace = true
|
|
repository.workspace = true
|
|
version.workspace = true
|
|
|
|
[dependencies]
|
|
bgp-packet.workspace = true
|
|
bgp-primitives.workspace = true
|
|
bgp-rib.workspace = true
|
|
bytes.workspace = true
|
|
foldhash.workspace = true
|
|
prometheus.workspace = true
|
|
thiserror.workspace = true
|
|
tokio = { workspace = true, features = ["full"] }
|
|
tracing.workspace = true
|
|
|
|
# The socket to the kernel. Only Linux has it; everything else in this
|
|
# crate builds, and is tested, anywhere.
|
|
[target.'cfg(target_os = "linux")'.dependencies]
|
|
netlink-sys = { version = "0.8", features = ["tokio_socket"] }
|
|
# For a socket option netlink-sys has no name for.
|
|
nix = { workspace = true, features = ["socket"] }
|
|
|
|
[dev-dependencies]
|
|
proptest.workspace = true
|
|
|
|
[lints]
|
|
workspace = true
|