Chris Caputo [Sat, 18 Jul 2009 05:44:03 +0000 (05:44 +0000)]
[bgpd] Stability fixes including bugs 397, 492
I've spent the last several weeks working on stability fixes to bgpd.
These patches fix all of the numerous crashes, assertion failures, memory
leaks and memory stomping I could find. Valgrind was used extensively.
Added new function bgp_exit() to help catch problems. If "debug bgp" is
configured and bgpd exits with status of 0, statistics on remaining
lib/memory.c allocations are printed to stderr. It is my hope that other
developers will use this to stay on top of memory issues.
Example questionable exit:
bgpd: memstats: Current memory utilization in module LIB:
bgpd: memstats: Link List : 6
bgpd: memstats: Link Node : 5
bgpd: memstats: Hash : 8
bgpd: memstats: Hash Bucket : 2
bgpd: memstats: Hash Index : 8
bgpd: memstats: Work queue : 3
bgpd: memstats: Work queue item : 2
bgpd: memstats: Work queue name string : 3
bgpd: memstats: Current memory utilization in module BGP:
bgpd: memstats: BGP instance : 1
bgpd: memstats: BGP peer : 1
bgpd: memstats: BGP peer hostname : 1
bgpd: memstats: BGP attribute : 1
bgpd: memstats: BGP extra attributes : 1
bgpd: memstats: BGP aspath : 1
bgpd: memstats: BGP aspath str : 1
bgpd: memstats: BGP table : 24
bgpd: memstats: BGP node : 1
bgpd: memstats: BGP route : 1
bgpd: memstats: BGP synchronise : 8
bgpd: memstats: BGP Process queue : 1
bgpd: memstats: BGP node clear queue : 1
bgpd: memstats: NOTE: If configuration exists, utilization may be expected.
Example clean exit:
bgpd: memstats: No remaining tracked memory utilization.
This patch fixes bug #397: "Invalid free in bgp_announce_check()".
This patch fixes bug #492: "SIGBUS in bgpd/bgp_route.c:
bgp_clear_route_node()".
My apologies for not separating out these changes into individual patches.
The complexity of doing so boggled what is left of my brain. I hope this
is all still useful to the community.
This code has been production tested, in non-route-server-client mode, on
a linux 32-bit box and a 64-bit box.
Release/reset functions, used by bgp_exit(), added to:
* bgpd/bgp_clist.c,h: Allow community_list_terminate() to be called from
bgp_exit().
* bgpd/bgp_filter.c: Fix aslist->name use without allocation check, and
also fix memory leak.
* bgpd/bgp_main.c: Created bgp_exit() exit routine. This function frees
allocations made as part of bgpd initialization and, to some extent,
configuration. If "debug bgp" is configured, memory stats are printed
as described above.
* bgpd/bgp_nexthop.c: zclient_new() already allocates stream for
ibuf/obuf, so bgp_scan_init() shouldn't do it too. Also, made it so
zlookup is global so bgp_exit() can use it.
* bgpd/bgp_packet.c: bgp_capability_msg_parse() call to bgp_clear_route()
adjusted to use new BGP_CLEAR_ROUTE_NORMAL flag.
* bgpd/bgp_route.h: Correct reference counter "lock" to be signed.
bgp_clear_route() now accepts a bgp_clear_route_type of either
BGP_CLEAR_ROUTE_NORMAL or BGP_CLEAR_ROUTE_MY_RSCLIENT.
* bgpd/bgp_route.c:
- bgp_process_rsclient(): attr was being zero'ed and then
bgp_attr_extra_free() was being called with it, even though it was
never filled with valid data.
- bgp_process_rsclient(): Make sure rsclient->group is not NULL before
use.
- bgp_processq_del(): Add call to bgp_table_unlock().
- bgp_process(): Add call to bgp_table_lock().
- bgp_update_rsclient(): memset clearing of new_attr not needed since
declarationw with "= { 0 }" does it. memset was already commented
out.
- bgp_update_rsclient(): Fix screwed up misleading indentation.
- bgp_withdraw_rsclient(): Fix screwed up misleading indentation.
- bgp_clear_route_node(): Support BGP_CLEAR_ROUTE_MY_RSCLIENT.
- bgp_clear_node_queue_del(): Add call to bgp_table_unlock() and also
free struct bgp_clear_node_queue used for work item.
- bgp_clear_node_complete(): Do peer_unlock() after BGP_EVENT_ADD() in
case peer is released by peer_unlock() call.
- bgp_clear_route_table(): Support BGP_CLEAR_ROUTE_MY_RSCLIENT. Use
struct bgp_clear_node_queue to supply data to worker. Add call to
bgp_table_lock().
- bgp_clear_route(): Add support for BGP_CLEAR_ROUTE_NORMAL or
BGP_CLEAR_ROUTE_MY_RSCLIENT.
- bgp_clear_route_all(): Use BGP_CLEAR_ROUTE_NORMAL.
Bug 397 fixes:
- bgp_default_originate()
- bgp_announce_table()
* bgpd/bgp_table.h:
- struct bgp_table: Added reference count. Changed type of owner to be
"struct peer *" rather than "void *".
- struct bgp_node: Correct reference counter "lock" to be signed.
- bgp_table_free(): Fixed cleanup code. Call peer_unlock() on owner if
set.
- bgp_unlock_node(): Added assertion.
- bgp_node_get(): Added call to bgp_lock_node() to code path that it was
missing from.
* bgpd/bgp_vty.c:
- peer_rsclient_set_vty(): Call peer_lock() as part of peer assignment
to owner. Handle failure gracefully.
- peer_rsclient_unset_vty(): Add call to bgp_clear_route() with
BGP_CLEAR_ROUTE_MY_RSCLIENT purpose.
* bgpd/bgp_zebra.c: Made it so zclient is global so bgp_exit() can use it.
* bgpd/bgpd.c:
- peer_lock(): Allow to be called when status is "Deleted".
- peer_deactivate(): Supply BGP_CLEAR_ROUTE_NORMAL purpose to
bgp_clear_route() call.
- peer_delete(): Common variable listnode pn. Fix bug in which rsclient
was only dealt with if not part of a peer group. Call
bgp_clear_route() for rsclient, if appropriate, and do so with
BGP_CLEAR_ROUTE_MY_RSCLIENT purpose.
- peer_group_get(): Use XSTRDUP() instead of strdup() for conf->host.
- peer_group_bind(): Call bgp_clear_route() for rsclient, and do so with
BGP_CLEAR_ROUTE_MY_RSCLIENT purpose.
- bgp_create(): Use XSTRDUP() instead of strdup() for peer_self->host.
- bgp_delete(): Delete peers before groups, rather than after. And then
rather than deleting rsclients, verify that there are none at this
point.
- bgp_unlock(): Add assertion.
- bgp_free(): Call bgp_table_finish() rather than doing XFREE() itself.
* lib/command.c,h: Compiler warning fixes. Add cmd_terminate(). Fixed
massive leak in install_element() in which cmd_make_descvec() was being
called more than once for the same cmd->strvec/string/doc.
* lib/log.c: Make closezlog() check fp before calling fclose().
* lib/memory.c: Catch when alloc count goes negative by using signed
counts. Correct #endif comment. Add log_memstats_stderr().
* lib/memory.h: Add log_memstats_stderr().
* lib/thread.c: thread->funcname was being accessed in thread_call() after
it had been freed. Rearranged things so that thread_call() frees
funcname. Also made it so thread_master_free() cleans up cpu_record.
* lib/vty.c,h: Use global command_cr. Add vty_terminate().
Chris Caputo [Sat, 18 Jul 2009 05:42:34 +0000 (05:42 +0000)]
[bgpd] Fix compiler warnings related to MD5
This patch fixes:
bgp_network.c: In function 'bgp_md5_set':
bgp_network.c:107: warning: cast from pointer to integer of different size
bgp_network.c: In function 'bgp_socket':
bgp_network.c:447: warning: cast to pointer from integer of different size
Paul Jakma [Sun, 19 Jul 2009 16:33:21 +0000 (17:33 +0100)]
[build] fix default CFLAGS and squish warning
* configure.ac: Move down the AC_SYS_LARGEFILE test - it was setting CFLAGS
and so disabling the default CFLAGS setting section.
Squish warning by adding AC_CONFIG_MACRO_DIR on the reccommendation of
autoreconf.
* bgpd.c: Removal of (struct bgp *) from the master list was being left to
bgp_free time. This meant there was a window of time between bgp_delete
and refcounts hitting 0 (e.g. routes to be processed) where bgp_lookup's
could return a deleted (struct bgp *).
(bgp_delete) This is the logical place where a (struct bgp *) should lose
its visibility, so move the deletion from the bgp-master list to here,
from bgp_free.
Many thanks to Fritz Reichmann for his thorough debugging of the problem
and testing of fixes and Chris Caputo for his further analysis.
* lib/sockunion.c: (sockunion_normalise_mapped) The code to normalize
address was not copying port value - probably reason why IPV4 in IPV6
never worked right.
Should a self originated Network/Router LSA with higher
LS seq. nr. be received we should flood and install it in
the LSDB but we cannot use it for our internal calculations
as it is stale.
Reorginate an new LSA to replace the stale one as soon
as possible.
Paul Jakma [Thu, 25 Jun 2009 17:06:31 +0000 (18:06 +0100)]
[bgpd] Log a debug/update warning if filters are configured but don't exist
* bgp_route.c: (bgp_{input,output}_filter) Log a debug warning if a route is
received or sent and a filter name is configured for a prefix, as or
distribute list but none is found - guaranteed configuration mistake.
Add 2 impl. of the Internet Checksum. One new optimized nad
one form RFC 1071. Turns out that the current Quagga in_cksum()
is buggy. On Big Endian routers it miscalculates odd sized buffers.
Joakim Tjernlund [Mon, 16 Feb 2009 08:40:39 +0000 (09:40 +0100)]
[doc] Add "--disable-doc" to configure
Configure option "--disable-doc" will prevent building
the documents under doc. Saves build time and the need to
have document building tools installed. Useful when your build
machine is different from your development machine.
Joakim Tjernlund [Wed, 24 Jun 2009 17:15:36 +0000 (19:15 +0200)]
zebra: Static route does not reach kernel.
A static route like below: ip route 172.16.1.0/30 192.168.101.162 11
does not move properly to a new interface when the
interface used goes down. Zebra reports that it have
moved but kernel isn't informed so the route is lost.
* zebra_rib.c: (nexthop_active_update) if ifindex has changed, then the
route should be considered to have changed.
Mathieu Goessens [Tue, 23 Jun 2009 14:59:45 +0000 (15:59 +0100)]
[zebra] linux policy routing support with ipv6
Quagga support linux policy routing (ip route ... table $X) with zebra.conf
table $X option. It works fine on ipv4. On ipv6 the parameter is ignored
(table 0 is used).
* zebra/...: Pass appropriate table arg to rib_{add,delete}_ipv6
Chris Caputo [Tue, 23 Jun 2009 06:06:49 +0000 (06:06 +0000)]
Fix "show ip bgp dampened-paths" garbage output.
* bgpd/bgp_damp.c: Make bgp_damp_reuse_time_vty() accept a buffer and
length, rather than returning a local var buffer whose contents can get
trounced. Remove duplicate BGP_UPTIME_LEN define.
* bgpd/bgp_damp.h: bgp_damp_reuse_time_vty() prototype change.
* bgpd/bgp_route.c: Provide bgp_damp_reuse_time_vty() with a buffer and
length. Remove duplicate BGP_UPTIME_LEN define.
Chris Caputo [Tue, 23 Jun 2009 05:55:57 +0000 (05:55 +0000)]
Fix vtysh based "write term" output.
* vtysh/vtysh.c: "end" should be printed at the bottom, not the top.
* vtysh/vtysh_config.c: PROTOCOL_NODE was not being handled, and thus was
being displayed at the top of a config, rather than in its rightful
place near the bottom.
Chris Caputo [Tue, 23 Jun 2009 05:34:29 +0000 (05:34 +0000)]
Fixes to RFC2385/MD5 BGP
* bgpd/bgp_network.c: Fix MD5 listen in IPv4 version of bgp_socket() by
adding listen socket to listen_sockets list so that MD5 passwords can
get set.
* lib/sockopt.c: (sockopt_tcp_signature) Fix bogus "% Error while applying
TCP-Sig to session(s)" / "can't set TCP_MD5SIG option" startup error
messages by not returning error when there isn't one.
Dmitry Tejblum [Tue, 23 Jun 2009 13:16:32 +0000 (17:16 +0400)]
[ospfd] cancel OSPF timer hack in nsm_change_state
This piece of code causes all Quagga routers on a broadcast link to
send a HELLO packet simultaneously if they see a new neighbor. It also
resets the HELLO timer, so all the quagga routers will continue to
send HELLO packets simultaneously in the future. This is not good
(especially on networks with a lot of Quagga routers connected), and
is explicitly discouraged by the OSPF standard, RFC 2328 (chapter
4.4.Timers).
I suggest to remove the code snippet, it does not provide much benefit
anyway.
Paul Jakma [Mon, 22 Jun 2009 10:30:47 +0000 (11:30 +0100)]
[bgpd] Fix 'update-source' command: It doesn't accept interface names
* bgp_vty.c: BGP_UPDATE_SOURCE_STR define should only specify IP addresses,
the underlying mechanisms won't do anything useful with interface names.
Fix bug #527.
Jeremy Jackson [Fri, 23 Jan 2009 20:48:10 +0000 (15:48 -0500)]
[ospfd/BSD] add missing UINT16_MAX - picked up from FreeBSD ports patch
Should probably have AC_TYPE_UINT16_T in configure.ac to make it really
clean... and a fresh import of gnulib, the existing copy of gnulib seems to
be manually put some stuff in zebra.h. I'm leaving that alone for now,
since a fresh import will probably clean up a lot of cruft and it would be a
duplicated effort to fix some things now.
The FreeBSD port 0.99.11_1 files/patch-ospfd-ospfd.h can probably go away
after this is applied.
It wasn't used, and the code wasn't printing progress or the result in some
cases. the test uses minimal resources, so it's probably better to not
cache so as to avoid inconsistencies if --with-prefix or directory variables
are changed between ./configure runs.
It looks like someone tried to make this cached, but it was being ignored at
least on autoconf 2.6.1. 2.6.2 now gives a warning about the situation,
hence this fix.
Although they are just warnings, it's dangerous to leave them as-is, because
someone not diligent in reading the autoconf manual might just stick _cv_ in
the name, with the effect that running a ./configure --config-cache would
fail horribly, since variables are being set inside the AC_CACHE_CHECK()
block that would not be seen when the variable's value was read from cache.
Also added m4 quotes [] to macro arguments as autoconf manual
suggests.
Jeremy Jackson [Wed, 21 Jan 2009 21:35:51 +0000 (16:35 -0500)]
[configure] remote support for AIX, it conflicts on newer autoconf
AC_AIX and AC_GNU_SOURCE conflict > autoconf 2.53 or so,
but the replacement AC_USE_SYSTEM_EXTENSIONS isn't available
until later versions. So either we narrow the supported
autconf version range, or disable AIX (if it has any effect),
or determin that AC_AIX doesn't do anything useful anyhow.
Jeremy Jackson [Wed, 21 Jan 2009 19:15:44 +0000 (14:15 -0500)]
[build] cleanup low-hanging autoreconf warnings
Some uses of GNU make extensions were not necessary. There are still some,
but they might exist as workarounds for older versions of autoconf that have
since been solved.
Lesson learned: implicit target rules have opposite order to pattern target
rules.
Paul Jakma [Thu, 18 Jun 2009 16:38:01 +0000 (17:38 +0100)]
[configure] Refine CLOCK_MONOTONIC test
* configure.ac: Check for the actual CLOCK_MONOTONIC symbol, as clock_gettime
need not imply that clock type is supported
* lib/zebra.h: use the method given in autoconf docs for sys/time.h
inclusion
Quagga has code to support monotonic clock to avoid issues where
time of day changes. The support was incomplete since it was not being
detected by autoconf.
When a BGP instance is deleted with lots of routes and neighbors
it is possible for the peer rsclient queue to run after
bgp_delete has been called. This would lead to bgpd crashing,
see https://bugzilla.vyatta.com/show_bug.cgi?id=3436
The fix is to add reference counting to the BGP instance and defer
actual freeing until all references are gone.
This patch also fixes a memory leak where the self-reference
peer instance was being created but never freed.
The check in bgp_clear_route is no longer valid because it is possible
for it to be called when peer is in Deleted state during cleanup.
Jon [Thu, 12 Feb 2009 01:30:44 +0000 (17:30 -0800)]
[ospf6d] Fix ospf6d crash if removing interface with no area
ospf6d will crash if attempting to remove interface when no areas have been
defined Check if any areas have been defined. Should prevent use of empty
pointer.
Jon [Thu, 12 Feb 2009 01:27:06 +0000 (17:27 -0800)]
[ospf6d] Fix ospf6d crash in show border routers
ospf6d will crash if this command is executed on a non-border-router.
Included test to verify that any routes are defined, preventing empty
pointer from being used.
Jon [Thu, 12 Feb 2009 01:19:07 +0000 (17:19 -0800)]
[ospf6] Add no router ospf6
Suggestion: Makes no sense to me that the statement to remove ospf6
configuration is located in OSPF6D_NODE.
Moved to CONFIG_NODE next to matching define command.
Jon [Thu, 12 Feb 2009 01:22:03 +0000 (17:22 -0800)]
[ospf6d] Fix ospf6d crash if range defined twice
ospf6d will crash if the same range is defined twice.
There was no check if the same range had previously been defined,
thereby causing a later assert to fail.
Do some cleanup work on recently added meta-queue code:
* use table rather than switch
* indent with quagga standard indentation
* since meta_queue_new is only used at initialization
allocation failure should be fatal.
Paul Jakma [Fri, 12 Jun 2009 13:21:02 +0000 (14:21 +0100)]
[bgpd] Add support for the old Linux 2.4, TCP_MD5_AUTH RFC2385 patch
* configure.ac: Add a --enable-linux24-tcp-md5 argument, to compile in
support for the old TCP-MD5 patch for Linux 2.4 systems. This overrides
auto-detection of TCP-MD5 supported by the target system.
* lib/sockopt.c: (sockopt_tcp_signature) add in a variant for the old
Linux 2.4, TCP_MD5_AUTH variant of TCP-MD5 support, conditional
on the previous configure arg.
Denis Ovsienko [Tue, 9 Jun 2009 11:15:33 +0000 (15:15 +0400)]
[bgpd] Fixed as-path prepend/exclude ASN handling
- aspath_gettoken(): use as_t to fix 4-byte ASN scanning (bug #484)
- set_aspath_prepend_cmd(): use CMD_AS_RANGE in message to match
actual range
- no_set_aspath_prepend_val_cmd(): idem
- set_aspath_exclude_cmd(): idem
- no_set_aspath_exclude_val_cmd(): idem
Chris Caputo [Tue, 2 Jun 2009 17:37:11 +0000 (18:37 +0100)]
[smux] 64-bit fix for lib/smux.h SNMP_INTEGER() macro
Macro SNMP_INTEGER() prepares data which is eventually processed
by asn_build_int(). SNMP_INTEGER() was using "int32_t" whereas
asn_build_int() uses "long". On 32-bit systems these are the
same, both 4 bytes, but on x86 64-bit systems "long" is 8 bytes.
asn_build_int()'s reaction to an improperly sized value is to return
a NULL pointer. Quagga's smux.c would eventually get this NULL
pointer and use it in calculations to determine how much data to send
over the smux connection, resulting in garbage being sent to the
SNMP agent.
Corrected SNMP_INTEGER() to use "long".
Tested on 32-bit and 64-bit x86 Linux 2.6.27.10 systems running
Quagga 0.99.11 with bgpd smux.
[ripd] Fix metrix in call to rip_zebra_ipv4_delete
Fix a potential problem (most probably not triggering a real problem, at
least on Linux). When an interface goes down and ripd tries to delete the
corresponding route it errorneously passes the interface's index instead of
the metric to zebra.
Steve Hill [Tue, 2 Jun 2009 13:28:16 +0000 (14:28 +0100)]
[bgp] Fix crash on SIGHUP, deref of freed workqueues
* lib/workqueue.c: free-ing workqueues had never been tested obviously,
queue's thread was not being stopped
* bgpd/bgpd.c: null out freed workqueues, to prevent acting on freed
workqueues
projects / mirror_frr.git / log