From c429d4a4ba2cc8778634461e8adea33e0f0ae022 Mon Sep 17 00:00:00 2001 From: Ondrej Zajicek Date: Sun, 4 Apr 2010 15:41:31 +0200 Subject: [PATCH] Restrict export of device routes to the kernel protocol. In usual configuration, such export is already restricted with the aid of the direct protocol but there are some races that can circumvent it. This makes it harder to break kernel device routes. Also adds an option to disable this restriction. --- doc/bird.sgml | 60 ++++++++++++++++++++++++---------- nest/rt-table.c | 7 ---- sysdep/bsd/krt-sock.c | 8 ++--- sysdep/linux/netlink/netlink.c | 10 ++---- sysdep/unix/krt.Y | 3 +- sysdep/unix/krt.c | 22 +++++++++++-- sysdep/unix/krt.h | 1 + 7 files changed, 70 insertions(+), 41 deletions(-) diff --git a/doc/bird.sgml b/doc/bird.sgml index 43f0c9c6..6e696e3c 100644 --- a/doc/bird.sgml +++ b/doc/bird.sgml @@ -95,7 +95,7 @@ Czech Republic as a student project. It can be freely distributed under the term Public License.

BIRD has been designed to work on all UNIX-like systems. It has been developed and -tested under Linux 2.0 to 2.4, and then ported to FreeBSD and NetBSD, porting to other +tested under Linux 2.0 to 2.6, and then ported to FreeBSD, NetBSD and OpenBSD, porting to other systems (even non-UNIX ones) should be relatively easy due to its highly modular architecture. Installing BIRD @@ -454,16 +454,19 @@ to zero to disable it. An empty is equivalent to Remote control

You can use the command-line client birdc to talk with -a running BIRD. Communication is done using a - Type of destination the packets should be sent to (

There also exist some protocol-specific attributes which are described in the corresponding protocol sections. @@ -1273,10 +1276,15 @@ protocol device { directly connected networks according to the list of interfaces provided by the kernel via the Device protocol. -

It's highly recommended to include this protocol in your configuration -unless you want to use BIRD as a route server or a route reflector, that is -on a machine which doesn't forward packets itself and only participates in -distribution of routing information. +

The question is whether it is a good idea to have such device +routes in BIRD routing table. OS kernel usually handles device routes +for directly connected networks by itself so we don't need (and don't +want) to export these routes to the kernel protocol. OSPF protocol +creates device routes for its interfaces itself and BGP protocol is +usually used for exporting aggregate routes. Although there are some +use cases that use the direct protocol (like abusing eBGP as an IGP +routing protocol), in most cases it is not needed to have these device +routes in BIRD routing table and to use the direct protocol.

The only configurable thing about direct is what interfaces it watches: @@ -1302,14 +1310,24 @@ protocol direct { Kernel

The Kernel protocol is not a real routing protocol. Instead of communicating -the with other routers in the network, it performs synchronization of BIRD's routing +with other routers in the network, it performs synchronization of BIRD's routing tables with the OS kernel. Basically, it sends all routing table updates to the kernel and from time to time it scans the kernel tables to see whether some routes have disappeared (for example due to unnoticed up/down transition of an interface) or whether an `alien' route has been added by someone else (depending on the -Unfortunately, there is one thing that makes the routing table +synchronization a bit more complicated. In the kernel routing table +there are also device routes for directly connected networks. These +routes are usually managed by OS itself (as a part of IP address +configuration) and we don't want to touch that. They are completely +ignored during the scan of the kernel tables and also the export of +device routes from BIRD tables to kernel routing tables is restricted +to prevent accidental interference. This restriction can be disabled using +If your OS supports only a single routing table, you can configure only one instance of the Kernel protocol. If it supports multiple tables (in order to allow policy routing; such an OS is for example Linux 2.2), you can run as many instances as you want, but each of @@ -1327,6 +1345,14 @@ kernel table. routing tables by other routing daemons or by the system administrator. This is possible only on systems which support identification of route authorship. + + device routes Enable export of device + routes to the kernel routing table. By default, such routes + are rejected (with the exception of explicitly configured + device routes from the static protocol) regardless of the + export filter to protect device routes in kernel routing table + (managed by OS itself) from accidental overwriting or erasing. + kernel table Select which kernel table should this particular instance of the Kernel protocol work with. Available only on systems supporting multiple routing tables. diff --git a/nest/rt-table.c b/nest/rt-table.c index 802ea5fd..87365742 100644 --- a/nest/rt-table.c +++ b/nest/rt-table.c @@ -167,8 +167,6 @@ do_rte_announce(struct announce_hook *a, int type UNUSED, net *net, rte *new, rt rte *old0 = old; int ok; - int fast_exit_hack = 0; - #ifdef CONFIG_PIPE /* The secondary direction of the pipe */ if (proto_is_pipe(p) && (p->table != a->table)) @@ -207,11 +205,6 @@ do_rte_announce(struct announce_hook *a, int type UNUSED, net *net, rte *new, rt else stats->exp_withdraws_received++; - /* Hack: This is here to prevent 'spurious withdraws' - for loopback addresses during reload. */ - if (fast_exit_hack) - return; - /* * This is a tricky part - we don't know whether route 'old' was * exported to protocol 'p' or was filtered by the export filter. diff --git a/sysdep/bsd/krt-sock.c b/sysdep/bsd/krt-sock.c index 32c269d4..d991ea13 100644 --- a/sysdep/bsd/krt-sock.c +++ b/sysdep/bsd/krt-sock.c @@ -40,10 +40,6 @@ krt_capable(rte *e) { rta *a = e->attrs; -#ifdef CONFIG_AUTO_ROUTES - if (a->source == RTS_DEVICE) - return 0; -#endif return a->cast == RTC_UNICAST && (a->dest == RTD_ROUTER @@ -163,7 +159,7 @@ krt_sock_send(int cmd, rte *e) #endif if(!i->addr) { - log(L_ERR "KIF: interface \"%s\" has no IP addess", i->name); + log(L_ERR "KRT: interface %s has no IP addess", i->name); return; } @@ -185,7 +181,7 @@ krt_sock_send(int cmd, rte *e) msg.rtm.rtm_msglen = l; if ((l = write(rt_sock, (char *)&msg, l)) < 0) { - log(L_ERR "KIF: Error sending route %I/%d to kernel", net->n.prefix, net->n.pxlen); + log(L_ERR "KRT: Error sending route %I/%d to kernel", net->n.prefix, net->n.pxlen); } } diff --git a/sysdep/linux/netlink/netlink.c b/sysdep/linux/netlink/netlink.c index b59b32f3..f31ef9f7 100644 --- a/sysdep/linux/netlink/netlink.c +++ b/sysdep/linux/netlink/netlink.c @@ -460,20 +460,14 @@ krt_capable(rte *e) { rta *a = e->attrs; - if (a->cast != RTC_UNICAST -#if 0 - && a->cast != RTC_ANYCAST -#endif - ) - return 0; - if (a->source == RTS_DEVICE) /* Kernel takes care of device routes itself */ + if (a->cast != RTC_UNICAST) return 0; + switch (a->dest) { case RTD_ROUTER: if (ipa_has_link_scope(a->gw) && (a->iface == NULL)) return 0; - case RTD_DEVICE: case RTD_BLACKHOLE: case RTD_UNREACHABLE: diff --git a/sysdep/unix/krt.Y b/sysdep/unix/krt.Y index 40f1af9f..0375a13b 100644 --- a/sysdep/unix/krt.Y +++ b/sysdep/unix/krt.Y @@ -17,7 +17,7 @@ CF_DEFINES CF_DECLS -CF_KEYWORDS(KERNEL, PERSIST, SCAN, TIME, LEARN, DEVICE) +CF_KEYWORDS(KERNEL, PERSIST, SCAN, TIME, LEARN, DEVICE, ROUTES) CF_GRAMMAR @@ -56,6 +56,7 @@ kern_item: cf_error("Learning of kernel routes not supported in this configuration"); #endif } + | DEVICE ROUTES bool { THIS_KRT->devroutes = $3; } ; /* Kernel interface protocol */ diff --git a/sysdep/unix/krt.c b/sysdep/unix/krt.c index c8887b72..419bdd94 100644 --- a/sysdep/unix/krt.c +++ b/sysdep/unix/krt.c @@ -734,6 +734,25 @@ krt_scan(timer *t UNUSED) /* * Updates */ +static int +krt_import_control(struct proto *P, rte **new, ea_list **attrs, struct linpool *pool) +{ + struct krt_proto *p = (struct krt_proto *) P; + rte *e = *new; + + if (e->attrs->proto == P) + return -1; + + if (!KRT_CF->devroutes && + (e->attrs->dest == RTD_DEVICE) && + (e->attrs->source != RTS_STATIC_DEVICE)) + return -1; + + if (!krt_capable(e)) + return -1; + + return 0; +} static void krt_notify(struct proto *P, struct rtable *table UNUSED, net *net, @@ -743,8 +762,6 @@ krt_notify(struct proto *P, struct rtable *table UNUSED, net *net, if (shutting_down) return; - if (new && (!krt_capable(new) || new->attrs->source == RTS_INHERIT)) - new = NULL; if (!(net->n.flags & KRF_INSTALLED)) old = NULL; if (new) @@ -871,6 +888,7 @@ krt_init(struct proto_config *c) struct krt_proto *p = proto_new(c, sizeof(struct krt_proto)); p->p.accept_ra_types = RA_OPTIMAL; + p->p.import_control = krt_import_control; p->p.rt_notify = krt_notify; return &p->p; } diff --git a/sysdep/unix/krt.h b/sysdep/unix/krt.h index 1d9e1448..ed61621f 100644 --- a/sysdep/unix/krt.h +++ b/sysdep/unix/krt.h @@ -47,6 +47,7 @@ struct krt_config { int persist; /* Keep routes when we exit */ int scan_time; /* How often we re-scan routes */ int learn; /* Learn routes from other sources */ + int devroutes; /* Allow export of device routes */ }; struct krt_proto {