[mirror_frr.git] / bgpd / bgp_flowspec.c

/* BGP FlowSpec for packet handling
 * Portions:
 *     Copyright (C) 2017 ChinaTelecom SDN Group
 *     Copyright (C) 2018 6WIND
 *
 * FRRouting is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
 * Free Software Foundation; either version 2, or (at your option) any
 * later version.
 *
 * FRRouting is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License along
 * with this program; see the file COPYING; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
 */

#include <zebra.h>
#include <math.h>

#include "prefix.h"
#include "lib_errors.h"

#include "bgpd/bgpd.h"
#include "bgpd/bgp_route.h"
#include "bgpd/bgp_flowspec.h"
#include "bgpd/bgp_flowspec_util.h"
#include "bgpd/bgp_flowspec_private.h"
#include "bgpd/bgp_ecommunity.h"
#include "bgpd/bgp_debug.h"
#include "bgpd/bgp_errors.h"

static int bgp_fs_nlri_validate(uint8_t *nlri_content, uint32_t len,
				afi_t afi)
{
	uint32_t offset = 0;
	int type;
	int ret = 0, error = 0;

	while (offset < len-1) {
		type = nlri_content[offset];
		offset++;
		switch (type) {
		case FLOWSPEC_DEST_PREFIX:
		case FLOWSPEC_SRC_PREFIX:
			ret = bgp_flowspec_ip_address(
						BGP_FLOWSPEC_VALIDATE_ONLY,
						nlri_content + offset,
						len - offset, NULL, &error,
						afi, NULL);
			break;
		case FLOWSPEC_FLOW_LABEL:
			if (afi == AFI_IP)
				return -1;
			ret = bgp_flowspec_op_decode(BGP_FLOWSPEC_VALIDATE_ONLY,
						   nlri_content + offset,
						   len - offset, NULL, &error);
			break;
		case FLOWSPEC_IP_PROTOCOL:
		case FLOWSPEC_PORT:
		case FLOWSPEC_DEST_PORT:
		case FLOWSPEC_SRC_PORT:
		case FLOWSPEC_ICMP_TYPE:
		case FLOWSPEC_ICMP_CODE:
			ret = bgp_flowspec_op_decode(BGP_FLOWSPEC_VALIDATE_ONLY,
						   nlri_content + offset,
						   len - offset, NULL, &error);
			break;
		case FLOWSPEC_TCP_FLAGS:
		case FLOWSPEC_FRAGMENT:
			ret = bgp_flowspec_bitmask_decode(
						   BGP_FLOWSPEC_VALIDATE_ONLY,
						   nlri_content + offset,
						   len - offset, NULL, &error);
			break;
		case FLOWSPEC_PKT_LEN:
		case FLOWSPEC_DSCP:
			ret = bgp_flowspec_op_decode(
						BGP_FLOWSPEC_VALIDATE_ONLY,
						nlri_content + offset,
						len - offset, NULL, &error);
			break;
		default:
			error = -1;
			break;
		}
		offset += ret;
		if (error < 0)
			break;
	}
	return error;
}

int bgp_nlri_parse_flowspec(struct peer *peer, struct attr *attr,
			    struct bgp_nlri *packet, int withdraw)
{
	uint8_t *pnt;
	uint8_t *lim;
	afi_t afi;
	safi_t safi;
	int psize = 0;
	struct prefix p;
	int ret;
	void *temp;

	/* Start processing the NLRI - there may be multiple in the MP_REACH */
	pnt = packet->nlri;
	lim = pnt + packet->length;
	afi = packet->afi;
	safi = packet->safi;

	if (packet->length >= FLOWSPEC_NLRI_SIZELIMIT_EXTENDED) {
		flog_err(EC_BGP_FLOWSPEC_PACKET,
			 "BGP flowspec nlri length maximum reached (%u)",
			 packet->length);
		return BGP_NLRI_PARSE_ERROR_FLOWSPEC_NLRI_SIZELIMIT;
	}

	for (; pnt < lim; pnt += psize) {
		/* Clear prefix structure. */
		memset(&p, 0, sizeof(p));

		/* All FlowSpec NLRI begin with length. */
		if (pnt + 1 > lim)
			return BGP_NLRI_PARSE_ERROR_PACKET_OVERFLOW;

		psize = *pnt++;
		if (psize >= FLOWSPEC_NLRI_SIZELIMIT) {
			psize &= 0x0f;
			psize = psize << 8;
			psize |= *pnt++;
		}
		/* When packet overflow occur return immediately. */
		if (pnt + psize > lim) {
			flog_err(
				EC_BGP_FLOWSPEC_PACKET,
				"Flowspec NLRI length inconsistent ( size %u seen)",
				psize);
			return BGP_NLRI_PARSE_ERROR_PACKET_OVERFLOW;
		}
		if (bgp_fs_nlri_validate(pnt, psize, afi) < 0) {
			flog_err(
				EC_BGP_FLOWSPEC_PACKET,
				"Bad flowspec format or NLRI options not supported");
			return BGP_NLRI_PARSE_ERROR_FLOWSPEC_BAD_FORMAT;
		}
		p.family = AF_FLOWSPEC;
		p.prefixlen = 0;
		/* Flowspec encoding is in bytes */
		p.u.prefix_flowspec.prefixlen = psize;
		p.u.prefix_flowspec.family = afi2family(afi);
		temp = XCALLOC(MTYPE_TMP, psize);
		memcpy(temp, pnt, psize);
		p.u.prefix_flowspec.ptr = (uintptr_t) temp;

		if (BGP_DEBUG(flowspec, FLOWSPEC)) {
			char return_string[BGP_FLOWSPEC_NLRI_STRING_MAX];
			char local_string[BGP_FLOWSPEC_NLRI_STRING_MAX*2+16];
			char ec_string[BGP_FLOWSPEC_NLRI_STRING_MAX];
			char *s = NULL;

			bgp_fs_nlri_get_string((unsigned char *)
					       p.u.prefix_flowspec.ptr,
					       p.u.prefix_flowspec.prefixlen,
					       return_string,
					       NLRI_STRING_FORMAT_MIN, NULL,
					       afi);
			snprintf(ec_string, sizeof(ec_string),
				 "EC{none}");
			if (attr && bgp_attr_get_ecommunity(attr)) {
				s = ecommunity_ecom2str(
					bgp_attr_get_ecommunity(attr),
					ECOMMUNITY_FORMAT_ROUTE_MAP, 0);
				snprintf(ec_string, sizeof(ec_string),
					 "EC{%s}",
					s == NULL ? "none" : s);

				if (s)
					ecommunity_strfree(&s);
			}
			snprintf(local_string, sizeof(local_string),
				 "FS Rx %s %s %s %s", withdraw ?
				 "Withdraw":"Update",
				 afi2str(afi), return_string,
				 attr != NULL ? ec_string : "");
			zlog_info("%s", local_string);
		}
		/* Process the route. */
		if (!withdraw)
			ret = bgp_update(peer, &p, 0, attr,
					 afi, safi,
					 ZEBRA_ROUTE_BGP, BGP_ROUTE_NORMAL,
					 NULL, NULL, 0, 0, NULL);
		else
			ret = bgp_withdraw(peer, &p, 0, attr,
					   afi, safi,
					   ZEBRA_ROUTE_BGP, BGP_ROUTE_NORMAL,
					   NULL, NULL, 0, NULL);
		if (ret) {
			flog_err(EC_BGP_FLOWSPEC_INSTALLATION,
				 "Flowspec NLRI failed to be %s.",
				 attr ? "added" : "withdrawn");
			return BGP_NLRI_PARSE_ERROR;
		}
	}
	return BGP_NLRI_PARSE_OK;
}
Commit	Line	Data
7c40bf39	1	/* BGP FlowSpec for packet handling
	2	* Portions:
	3	* Copyright (C) 2017 ChinaTelecom SDN Group
	4	* Copyright (C) 2018 6WIND
	5	*
	6	* FRRouting is free software; you can redistribute it and/or modify it
	7	* under the terms of the GNU General Public License as published by the
	8	* Free Software Foundation; either version 2, or (at your option) any
	9	* later version.
	10	*
	11	* FRRouting is distributed in the hope that it will be useful, but
	12	* WITHOUT ANY WARRANTY; without even the implied warranty of
	13	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
	14	* General Public License for more details.
	15	*
	16	* You should have received a copy of the GNU General Public License along
	17	* with this program; see the file COPYING; if not, write to the Free Software
	18	* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
	19	*/
	20
7c40bf39	21	#include <zebra.h>
b45ac5f5 DL	22	#include <math.h>
b45ac5f5 DL	23
7c40bf39	24	#include "prefix.h"
02705213	25	#include "lib_errors.h"
7c40bf39	26
	27	#include "bgpd/bgpd.h"
	28	#include "bgpd/bgp_route.h"
	29	#include "bgpd/bgp_flowspec.h"
fc836540	30	#include "bgpd/bgp_flowspec_util.h"
7c40bf39	31	#include "bgpd/bgp_flowspec_private.h"
268e1b9b PG	32	#include "bgpd/bgp_ecommunity.h"
268e1b9b PG	33	#include "bgpd/bgp_debug.h"
4f3be667	34	#include "bgpd/bgp_errors.h"
7c40bf39	35
1840384b PG	36	static int bgp_fs_nlri_validate(uint8_t *nlri_content, uint32_t len,
1840384b PG	37	afi_t afi)
fc836540 PG	38	{
	39	uint32_t offset = 0;
	40	int type;
	41	int ret = 0, error = 0;
	42
	43	while (offset < len-1) {
	44	type = nlri_content[offset];
	45	offset++;
	46	switch (type) {
	47	case FLOWSPEC_DEST_PREFIX:
	48	case FLOWSPEC_SRC_PREFIX:
	49	ret = bgp_flowspec_ip_address(
	50	BGP_FLOWSPEC_VALIDATE_ONLY,
	51	nlri_content + offset,
1840384b	52	len - offset, NULL, &error,
9cec4121	53	afi, NULL);
fc836540	54	break;
40881800 PG	55	case FLOWSPEC_FLOW_LABEL:
	56	if (afi == AFI_IP)
	57	return -1;
	58	ret = bgp_flowspec_op_decode(BGP_FLOWSPEC_VALIDATE_ONLY,
	59	nlri_content + offset,
	60	len - offset, NULL, &error);
	61	break;
fc836540 PG	62	case FLOWSPEC_IP_PROTOCOL:
	63	case FLOWSPEC_PORT:
	64	case FLOWSPEC_DEST_PORT:
	65	case FLOWSPEC_SRC_PORT:
	66	case FLOWSPEC_ICMP_TYPE:
	67	case FLOWSPEC_ICMP_CODE:
	68	ret = bgp_flowspec_op_decode(BGP_FLOWSPEC_VALIDATE_ONLY,
	69	nlri_content + offset,
	70	len - offset, NULL, &error);
	71	break;
	72	case FLOWSPEC_TCP_FLAGS:
588ec356 PG	73	case FLOWSPEC_FRAGMENT:
588ec356 PG	74	ret = bgp_flowspec_bitmask_decode(
fc836540 PG	75	BGP_FLOWSPEC_VALIDATE_ONLY,
	76	nlri_content + offset,
	77	len - offset, NULL, &error);
	78	break;
	79	case FLOWSPEC_PKT_LEN:
	80	case FLOWSPEC_DSCP:
	81	ret = bgp_flowspec_op_decode(
	82	BGP_FLOWSPEC_VALIDATE_ONLY,
	83	nlri_content + offset,
	84	len - offset, NULL, &error);
	85	break;
fc836540 PG	86	default:
	87	error = -1;
	88	break;
	89	}
	90	offset += ret;
	91	if (error < 0)
	92	break;
	93	}
	94	return error;
	95	}
	96
7c40bf39	97	int bgp_nlri_parse_flowspec(struct peer peer, struct attr attr,
	98	struct bgp_nlri *packet, int withdraw)
	99	{
	100	uint8_t *pnt;
	101	uint8_t *lim;
	102	afi_t afi;
fc836540	103	safi_t safi;
7c40bf39	104	int psize = 0;
7c40bf39	105	struct prefix p;
fc836540 PG	106	int ret;
fc836540 PG	107	void *temp;
7c40bf39	108
	109	/* Start processing the NLRI - there may be multiple in the MP_REACH */
	110	pnt = packet->nlri;
	111	lim = pnt + packet->length;
	112	afi = packet->afi;
fc836540	113	safi = packet->safi;
7c40bf39	114
3255e756	115	if (packet->length >= FLOWSPEC_NLRI_SIZELIMIT_EXTENDED) {
e50f7cfd	116	flog_err(EC_BGP_FLOWSPEC_PACKET,
1c50c1c0 QY	117	"BGP flowspec nlri length maximum reached (%u)",
1c50c1c0 QY	118	packet->length);
513386b5	119	return BGP_NLRI_PARSE_ERROR_FLOWSPEC_NLRI_SIZELIMIT;
7c40bf39	120	}
	121
	122	for (; pnt < lim; pnt += psize) {
	123	/* Clear prefix structure. */
6006b807	124	memset(&p, 0, sizeof(p));
7c40bf39	125
	126	/* All FlowSpec NLRI begin with length. */
	127	if (pnt + 1 > lim)
513386b5	128	return BGP_NLRI_PARSE_ERROR_PACKET_OVERFLOW;
7c40bf39	129
3f54c705	130	psize = *pnt++;
3255e756 PG	131	if (psize >= FLOWSPEC_NLRI_SIZELIMIT) {
	132	psize &= 0x0f;
	133	psize = psize << 8;
	134	psize \|= *pnt++;
	135	}
7c40bf39	136	/* When packet overflow occur return immediately. */
7c40bf39	137	if (pnt + psize > lim) {
1c50c1c0 QY	138	flog_err(
	139	EC_BGP_FLOWSPEC_PACKET,
	140	"Flowspec NLRI length inconsistent ( size %u seen)",
	141	psize);
513386b5	142	return BGP_NLRI_PARSE_ERROR_PACKET_OVERFLOW;
7c40bf39	143	}
1840384b	144	if (bgp_fs_nlri_validate(pnt, psize, afi) < 0) {
1c50c1c0 QY	145	flog_err(
	146	EC_BGP_FLOWSPEC_PACKET,
	147	"Bad flowspec format or NLRI options not supported");
513386b5	148	return BGP_NLRI_PARSE_ERROR_FLOWSPEC_BAD_FORMAT;
fc836540 PG	149	}
	150	p.family = AF_FLOWSPEC;
	151	p.prefixlen = 0;
	152	/* Flowspec encoding is in bytes */
	153	p.u.prefix_flowspec.prefixlen = psize;
1840384b	154	p.u.prefix_flowspec.family = afi2family(afi);
fc836540 PG	155	temp = XCALLOC(MTYPE_TMP, psize);
	156	memcpy(temp, pnt, psize);
	157	p.u.prefix_flowspec.ptr = (uintptr_t) temp;
268e1b9b PG	158
	159	if (BGP_DEBUG(flowspec, FLOWSPEC)) {
	160	char return_string[BGP_FLOWSPEC_NLRI_STRING_MAX];
a2dc7057	161	char local_string[BGP_FLOWSPEC_NLRI_STRING_MAX*2+16];
268e1b9b PG	162	char ec_string[BGP_FLOWSPEC_NLRI_STRING_MAX];
	163	char *s = NULL;
	164
	165	bgp_fs_nlri_get_string((unsigned char *)
	166	p.u.prefix_flowspec.ptr,
	167	p.u.prefix_flowspec.prefixlen,
	168	return_string,
1840384b PG	169	NLRI_STRING_FORMAT_MIN, NULL,
1840384b PG	170	afi);
ff44f570	171	snprintf(ec_string, sizeof(ec_string),
268e1b9b	172	"EC{none}");
b53e67a3 DA	173	if (attr && bgp_attr_get_ecommunity(attr)) {
	174	s = ecommunity_ecom2str(
	175	bgp_attr_get_ecommunity(attr),
	176	ECOMMUNITY_FORMAT_ROUTE_MAP, 0);
ff44f570	177	snprintf(ec_string, sizeof(ec_string),
268e1b9b PG	178	"EC{%s}",
268e1b9b PG	179	s == NULL ? "none" : s);
c7ee6c35 DS	180
	181	if (s)
	182	ecommunity_strfree(&s);
268e1b9b	183	}
ff44f570	184	snprintf(local_string, sizeof(local_string),
268e1b9b PG	185	"FS Rx %s %s %s %s", withdraw ?
	186	"Withdraw":"Update",
	187	afi2str(afi), return_string,
	188	attr != NULL ? ec_string : "");
	189	zlog_info("%s", local_string);
	190	}
fc836540 PG	191	/* Process the route. */
	192	if (!withdraw)
	193	ret = bgp_update(peer, &p, 0, attr,
	194	afi, safi,
	195	ZEBRA_ROUTE_BGP, BGP_ROUTE_NORMAL,
	196	NULL, NULL, 0, 0, NULL);
	197	else
	198	ret = bgp_withdraw(peer, &p, 0, attr,
	199	afi, safi,
	200	ZEBRA_ROUTE_BGP, BGP_ROUTE_NORMAL,
	201	NULL, NULL, 0, NULL);
	202	if (ret) {
e50f7cfd	203	flog_err(EC_BGP_FLOWSPEC_INSTALLATION,
1c50c1c0 QY	204	"Flowspec NLRI failed to be %s.",
1c50c1c0 QY	205	attr ? "added" : "withdrawn");
513386b5	206	return BGP_NLRI_PARSE_ERROR;
fc836540	207	}
7c40bf39	208	}
513386b5	209	return BGP_NLRI_PARSE_OK;
7c40bf39	210	}