From c429d4a4ba2cc8778634461e8adea33e0f0ae022 Mon Sep 17 00:00:00 2001 From: Ondrej Zajicek Date: Sun, 4 Apr 2010 15:41:31 +0200 Subject: Restrict export of device routes to the kernel protocol. In usual configuration, such export is already restricted with the aid of the direct protocol but there are some races that can circumvent it. This makes it harder to break kernel device routes. Also adds an option to disable this restriction. --- doc/bird.sgml | 60 ++++++++++++++++++++++++++++++++++++++++++----------------- 1 file changed, 43 insertions(+), 17 deletions(-) (limited to 'doc') diff --git a/doc/bird.sgml b/doc/bird.sgml index 43f0c9c..6e696e3 100644 --- a/doc/bird.sgml +++ b/doc/bird.sgml @@ -95,7 +95,7 @@ Czech Republic as a student project. It can be freely distributed under the term Public License.

BIRD has been designed to work on all UNIX-like systems. It has been developed and -tested under Linux 2.0 to 2.4, and then ported to FreeBSD and NetBSD, porting to other +tested under Linux 2.0 to 2.6, and then ported to FreeBSD, NetBSD and OpenBSD, porting to other systems (even non-UNIX ones) should be relatively easy due to its highly modular architecture. Installing BIRD @@ -454,16 +454,19 @@ to zero to disable it. An empty is equivalent to Remote control

You can use the command-line client birdc to talk with -a running BIRD. Communication is done using a - Type of destination the packets should be sent to (

There also exist some protocol-specific attributes which are described in the corresponding protocol sections. @@ -1273,10 +1276,15 @@ protocol device { directly connected networks according to the list of interfaces provided by the kernel via the Device protocol. -

It's highly recommended to include this protocol in your configuration -unless you want to use BIRD as a route server or a route reflector, that is -on a machine which doesn't forward packets itself and only participates in -distribution of routing information. +

The question is whether it is a good idea to have such device +routes in BIRD routing table. OS kernel usually handles device routes +for directly connected networks by itself so we don't need (and don't +want) to export these routes to the kernel protocol. OSPF protocol +creates device routes for its interfaces itself and BGP protocol is +usually used for exporting aggregate routes. Although there are some +use cases that use the direct protocol (like abusing eBGP as an IGP +routing protocol), in most cases it is not needed to have these device +routes in BIRD routing table and to use the direct protocol.

The only configurable thing about direct is what interfaces it watches: @@ -1302,14 +1310,24 @@ protocol direct { Kernel

The Kernel protocol is not a real routing protocol. Instead of communicating -the with other routers in the network, it performs synchronization of BIRD's routing +with other routers in the network, it performs synchronization of BIRD's routing tables with the OS kernel. Basically, it sends all routing table updates to the kernel and from time to time it scans the kernel tables to see whether some routes have disappeared (for example due to unnoticed up/down transition of an interface) or whether an `alien' route has been added by someone else (depending on the -Unfortunately, there is one thing that makes the routing table +synchronization a bit more complicated. In the kernel routing table +there are also device routes for directly connected networks. These +routes are usually managed by OS itself (as a part of IP address +configuration) and we don't want to touch that. They are completely +ignored during the scan of the kernel tables and also the export of +device routes from BIRD tables to kernel routing tables is restricted +to prevent accidental interference. This restriction can be disabled using +If your OS supports only a single routing table, you can configure only one instance of the Kernel protocol. If it supports multiple tables (in order to allow policy routing; such an OS is for example Linux 2.2), you can run as many instances as you want, but each of @@ -1327,6 +1345,14 @@ kernel table. routing tables by other routing daemons or by the system administrator. This is possible only on systems which support identification of route authorship. + + device routes Enable export of device + routes to the kernel routing table. By default, such routes + are rejected (with the exception of explicitly configured + device routes from the static protocol) regardless of the + export filter to protect device routes in kernel routing table + (managed by OS itself) from accidental overwriting or erasing. + kernel table Select which kernel table should this particular instance of the Kernel protocol work with. Available only on systems supporting multiple routing tables. -- cgit v1.2.3