Open Source

Patches and bug reports I have sent to other people's projects. Most of these came out of hitting something while building my own, which is usually the only reason anyone reads someone else's daemon closely.

FRRouting

BFD daemon (bfdd)

16 merged

  • #23453mergedSends no echo interval to a data plane when the peer says it can’t receive echo.Read the write-up
  • #23495mergedSends IPv6 echo with the same traffic class as the rest of BFD, so a congested switch doesn’t drop it first.Read the write-up
Show 14 more
  • #23496mergedOpens the echo sockets for a session enabled after bfdd starts. Since FRR 10.7.0 those sessions got no sockets and kept flapping.Read the write-up
  • #23463mergedLets a data plane tell bfdd what it supports, so authenticated sessions only go to one that can handle them.Read the write-up
  • #23464mergedForgets the peer’s discriminator after a detection time, fixing a case where a restarted peer stayed down.Read the write-up
  • #23331mergedSends authentication keys and their lifetimes to the data plane. Before this, an offloaded session with a keychain went out unauthenticated while the CLI said auth was on.Read the write-up
  • #23282mergedA keychain with no usable key no longer runs the session unauthenticated. SHA1 keys of 17 to 20 bytes were being rejected and the session quietly fell back to no auth.Read the write-up
  • #23281mergedMade keyed SHA1 sequence number checking actually run. It never did, so replayed packets were accepted.Read the write-up
  • #23284mergedChecks the packet’s state, not the local session’s, when Your Discriminator is zero. In demand mode the old check left a restarted peer locked out.Read the write-up
  • #23023mergedImplemented demand mode (RFC 5880 section 6.6), which bfdd declared but never did anything with.Read the write-up
  • #22694mergedFixed "show bfd peers counters" dropping the data plane connection every second run, and added a fake data plane to FRR’s test tree so this path can be tested.Read the write-up
  • #22692mergedSession delete messages queued on shutdown are now actually sent, instead of being freed with the buffer.Read the write-up
  • #22920mergedIPv6 echo is sent from the session’s own address. The kernel could pick one the peer rejects, so turning on echo took the session down.Read the write-up
  • #22805mergedOffloaded sessions now negotiate the echo interval with the peer, instead of sending at whatever was configured locally.Read the write-up
  • #22645mergedWith more than 40 to 58 sessions, depending on config, the extra sessions were silently lost when the data plane registration burst overflowed an 8KB buffer. They now register, or fall back to software BFD if they can’t.Read the write-up
  • #22621mergedFixed the UNIX socket data plane transport, which failed every connect because bfdd passed the size of an address union instead of the real address length.Read the write-up

all PRs on GitHub

Linux kernel

MPTCP

queued for stable

  • stablequeuedFixes a stable backport that put a check in the wrong place, so servers on 6.12, 6.6 and 6.1 refused new subflows (MP_JOIN). Reviewed by the MPTCP maintainer and queued for all three.
  • mptcp-netin reviewWith fullmesh endpoints, a link carrying the first subflow never rejoined after its endpoint was deleted and re-added. The fix skips closed subflows, with a selftest.

Ignition

CoreOS, Butane

merged

  • #2343mergedButane accepted gzip compression on inline file contents without checking they were really gzip, so a config validated cleanly and then failed at first boot. It now checks the contents and reports the mistake when the config is built. I had reported it first, in coreos/butane#730.

mqvpn

mqvpn and xquic

3 merged

  • mqvpn #409mergedUses the new 1436-byte packet cap on a 1500-byte path, which raises the tunnel MTU from 1402 to 1418. Tested at about 1.3 Gbit/s with zero fragmentation.
  • mqvpn #391mergedAdds a PathMTU setting, so the QUIC packet size and tunnel MTU follow the real path instead of a fixed size.
  • xquic #86mergedxquic let an ACK frame spill past its packet size cap, so packets meant to fit a 1500-byte path came out at around 1458 bytes and got fragmented. The fix keeps a spilled ACK within the cap.

ngx-http-auth-jwt-module

TeslaGov

merged in v2.4.0

  • #152mergedEnables integration with the nginx geo and map modules, for cases such as VPN subnet allowlisting and selective authentication bypass. It runs in production as the reverse proxy image on my own cluster.Read the write-up

Proxmox VE

Bugzilla

diagnostics contributed

  • #6224reportedTraced the hang through the Perl disk-management API to blocking SMART queries against USB-attached SSDs with no timeout handling, and supplied reproduction steps for the timeout patch.Read the write-up