Rayhaan JaufeerallyandClaude Fable 5.1
9ca86ede2f
Three independent reviews (hijack resistance, reliability, code health) of the whole tree. This is what they found that could let a bad route in or take the daemon down. Hijacks: - A route had two paths on a two-octet session, AS_PATH and AS4_PATH, read in two places by two rules. A peer could make the origin checked on import differ from the one checked at revalidation, and get an RPKI-invalid route into the table. AS4_PATH is now merged into AS_PATH once, on receipt (RFC 6793 §4.2.3), and nothing else knows of it. - The next hop is judged on import: it must be usable, agreed on (RFC 8950), and by default the peer itself. - Our own originated prefixes are not taken from other networks. - A route for a network the machine is on is never put in the kernel. - Paths with an AS_SET are refused (RFC 9774). - A configured peer gets one session, not one per BGP Identifier. - More IPv6 special-purpose prefixes are bogons. Reliability: - A batch of requests the kernel refused could overflow the netlink socket and end the daemon. The socket has room now, a lost answer or a silent kernel means asking what is there, and neither is fatal. - Working the routes out again within the grace period after a restart no longer drops the routes being kept. - That work can no longer be put off for ever by interface changes. - Peers whose sessions keep failing are slowed down. - Unused attribute sets are swept when they pile up, not only each minute. - Log lines a peer can cause are said once in a while. - An RTR answer is bounded in size and time; data cannot expire between two refreshes. - The shard of a key is taken from a stirred hash: neighbouring bits of the hash proved alike for prefixes in a row. The test that showed it, failing one run in sixteen, is deterministic now. The lab has a phase, hijacks, in which FRR tries the first three. route::apply is a struct with methods instead of nested closures, and the kernel task's loop is shorter. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
25 lines
390 B
Rust
25 lines
390 B
Rust
pub mod address;
|
|
pub mod advertise;
|
|
pub mod collision;
|
|
pub mod config;
|
|
pub mod connection;
|
|
pub mod dialer;
|
|
pub mod error;
|
|
pub mod family;
|
|
pub mod fsm;
|
|
pub mod metrics;
|
|
mod panic;
|
|
pub mod policy;
|
|
pub mod refusals;
|
|
mod routes;
|
|
pub mod rpki;
|
|
pub mod server;
|
|
pub mod session;
|
|
mod sync;
|
|
mod throttle;
|
|
pub mod tracing;
|
|
|
|
pub mod proto {
|
|
include!(concat!(env!("OUT_DIR"), "/protos/mod.rs"));
|
|
}
|