[mirror_frr.git] / bgpd / bgp_flowspec.c

/* BGP FlowSpec for packet handling
 * Portions:
 *     Copyright (C) 2017 ChinaTelecom SDN Group
 *     Copyright (C) 2018 6WIND
 *
 * FRRouting is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
 * Free Software Foundation; either version 2, or (at your option) any
 * later version.
 *
 * FRRouting is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License along
 * with this program; see the file COPYING; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
 */

#include "math.h"

#include <zebra.h>
#include "prefix.h"

#include "bgpd/bgpd.h"
#include "bgpd/bgp_route.h"
#include "bgpd/bgp_flowspec.h"
#include "bgpd/bgp_flowspec_util.h"
#include "bgpd/bgp_flowspec_private.h"

static int bgp_fs_nlri_validate(uint8_t *nlri_content, uint32_t len)
{
	uint32_t offset = 0;
	int type;
	int ret = 0, error = 0;

	while (offset < len-1) {
		type = nlri_content[offset];
		offset++;
		switch (type) {
		case FLOWSPEC_DEST_PREFIX:
		case FLOWSPEC_SRC_PREFIX:
			ret = bgp_flowspec_ip_address(
						BGP_FLOWSPEC_VALIDATE_ONLY,
						nlri_content + offset,
						len - offset, NULL, &error);
			break;
		case FLOWSPEC_IP_PROTOCOL:
		case FLOWSPEC_PORT:
		case FLOWSPEC_DEST_PORT:
		case FLOWSPEC_SRC_PORT:
		case FLOWSPEC_ICMP_TYPE:
		case FLOWSPEC_ICMP_CODE:
			ret = bgp_flowspec_op_decode(BGP_FLOWSPEC_VALIDATE_ONLY,
						   nlri_content + offset,
						   len - offset, NULL, &error);
			break;
		case FLOWSPEC_TCP_FLAGS:
			ret = bgp_flowspec_tcpflags_decode(
						   BGP_FLOWSPEC_VALIDATE_ONLY,
						   nlri_content + offset,
						   len - offset, NULL, &error);
			break;
		case FLOWSPEC_PKT_LEN:
		case FLOWSPEC_DSCP:
			ret = bgp_flowspec_op_decode(
						BGP_FLOWSPEC_VALIDATE_ONLY,
						nlri_content + offset,
						len - offset, NULL, &error);
			break;
		case FLOWSPEC_FRAGMENT:
			ret = bgp_flowspec_fragment_type_decode(
						BGP_FLOWSPEC_VALIDATE_ONLY,
						nlri_content + offset,
						len - offset, NULL, &error);
			break;
		default:
			error = -1;
			break;
		}
		offset += ret;
		if (error < 0)
			break;
	}
	return error;
}

int bgp_nlri_parse_flowspec(struct peer *peer, struct attr *attr,
			    struct bgp_nlri *packet, int withdraw)
{
	uint8_t *pnt;
	uint8_t *lim;
	afi_t afi;
	safi_t safi;
	int psize = 0;
	uint8_t rlen;
	struct prefix p;
	int ret;
	void *temp;

	/* Start processing the NLRI - there may be multiple in the MP_REACH */
	pnt = packet->nlri;
	lim = pnt + packet->length;
	afi = packet->afi;
	safi = packet->safi;

	if (afi == AFI_IP6) {
		zlog_err("BGP flowspec IPv6 not supported");
		return -1;
	}

	if (packet->length >= FLOWSPEC_NLRI_SIZELIMIT) {
		zlog_err("BGP flowspec nlri length maximum reached (%u)",
			 packet->length);
		return -1;
	}

	for (; pnt < lim; pnt += psize) {
		/* Clear prefix structure. */
		memset(&p, 0, sizeof(struct prefix));

		/* All FlowSpec NLRI begin with length. */
		if (pnt + 1 > lim)
			return -1;

		psize = rlen = *pnt++;

		/* When packet overflow occur return immediately. */
		if (pnt + psize > lim) {
			zlog_err("Flowspec NLRI length inconsistent ( size %u seen)",
				 psize);
			return -1;
		}
		if (bgp_fs_nlri_validate(pnt, psize) < 0) {
			zlog_err("Bad flowspec format or NLRI options not supported");
			return -1;
		}
		p.family = AF_FLOWSPEC;
		p.prefixlen = 0;
		/* Flowspec encoding is in bytes */
		p.u.prefix_flowspec.prefixlen = psize;
		temp = XCALLOC(MTYPE_TMP, psize);
		memcpy(temp, pnt, psize);
		p.u.prefix_flowspec.ptr = (uintptr_t) temp;
		/* Process the route. */
		if (!withdraw)
			ret = bgp_update(peer, &p, 0, attr,
					 afi, safi,
					 ZEBRA_ROUTE_BGP, BGP_ROUTE_NORMAL,
					 NULL, NULL, 0, 0, NULL);
		else
			ret = bgp_withdraw(peer, &p, 0, attr,
					   afi, safi,
					   ZEBRA_ROUTE_BGP, BGP_ROUTE_NORMAL,
					   NULL, NULL, 0, NULL);
		if (ret) {
			zlog_err("Flowspec NLRI failed to be %s.",
				 attr ? "added" : "withdrawn");
			return -1;
		}
	}
	return 0;
}
Commit	Line	Data
7c40bf39	1	/* BGP FlowSpec for packet handling
	2	* Portions:
	3	* Copyright (C) 2017 ChinaTelecom SDN Group
	4	* Copyright (C) 2018 6WIND
	5	*
	6	* FRRouting is free software; you can redistribute it and/or modify it
	7	* under the terms of the GNU General Public License as published by the
	8	* Free Software Foundation; either version 2, or (at your option) any
	9	* later version.
	10	*
	11	* FRRouting is distributed in the hope that it will be useful, but
	12	* WITHOUT ANY WARRANTY; without even the implied warranty of
	13	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
	14	* General Public License for more details.
	15	*
	16	* You should have received a copy of the GNU General Public License along
	17	* with this program; see the file COPYING; if not, write to the Free Software
	18	* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
	19	*/
	20
	21	#include "math.h"
	22
	23	#include <zebra.h>
	24	#include "prefix.h"
	25
	26	#include "bgpd/bgpd.h"
	27	#include "bgpd/bgp_route.h"
	28	#include "bgpd/bgp_flowspec.h"
fc836540	29	#include "bgpd/bgp_flowspec_util.h"
7c40bf39	30	#include "bgpd/bgp_flowspec_private.h"
7c40bf39	31
fc836540 PG	32	static int bgp_fs_nlri_validate(uint8_t *nlri_content, uint32_t len)
	33	{
	34	uint32_t offset = 0;
	35	int type;
	36	int ret = 0, error = 0;
	37
	38	while (offset < len-1) {
	39	type = nlri_content[offset];
	40	offset++;
	41	switch (type) {
	42	case FLOWSPEC_DEST_PREFIX:
	43	case FLOWSPEC_SRC_PREFIX:
	44	ret = bgp_flowspec_ip_address(
	45	BGP_FLOWSPEC_VALIDATE_ONLY,
	46	nlri_content + offset,
	47	len - offset, NULL, &error);
	48	break;
	49	case FLOWSPEC_IP_PROTOCOL:
	50	case FLOWSPEC_PORT:
	51	case FLOWSPEC_DEST_PORT:
	52	case FLOWSPEC_SRC_PORT:
	53	case FLOWSPEC_ICMP_TYPE:
	54	case FLOWSPEC_ICMP_CODE:
	55	ret = bgp_flowspec_op_decode(BGP_FLOWSPEC_VALIDATE_ONLY,
	56	nlri_content + offset,
	57	len - offset, NULL, &error);
	58	break;
	59	case FLOWSPEC_TCP_FLAGS:
	60	ret = bgp_flowspec_tcpflags_decode(
	61	BGP_FLOWSPEC_VALIDATE_ONLY,
	62	nlri_content + offset,
	63	len - offset, NULL, &error);
	64	break;
	65	case FLOWSPEC_PKT_LEN:
	66	case FLOWSPEC_DSCP:
	67	ret = bgp_flowspec_op_decode(
	68	BGP_FLOWSPEC_VALIDATE_ONLY,
	69	nlri_content + offset,
	70	len - offset, NULL, &error);
	71	break;
	72	case FLOWSPEC_FRAGMENT:
	73	ret = bgp_flowspec_fragment_type_decode(
	74	BGP_FLOWSPEC_VALIDATE_ONLY,
	75	nlri_content + offset,
	76	len - offset, NULL, &error);
	77	break;
	78	default:
	79	error = -1;
	80	break;
	81	}
	82	offset += ret;
	83	if (error < 0)
	84	break;
	85	}
	86	return error;
	87	}
	88
7c40bf39	89	int bgp_nlri_parse_flowspec(struct peer peer, struct attr attr,
	90	struct bgp_nlri *packet, int withdraw)
	91	{
	92	uint8_t *pnt;
	93	uint8_t *lim;
	94	afi_t afi;
fc836540	95	safi_t safi;
7c40bf39	96	int psize = 0;
	97	uint8_t rlen;
	98	struct prefix p;
fc836540 PG	99	int ret;
fc836540 PG	100	void *temp;
7c40bf39	101
	102	/* Start processing the NLRI - there may be multiple in the MP_REACH */
	103	pnt = packet->nlri;
	104	lim = pnt + packet->length;
	105	afi = packet->afi;
fc836540	106	safi = packet->safi;
7c40bf39	107
	108	if (afi == AFI_IP6) {
	109	zlog_err("BGP flowspec IPv6 not supported");
	110	return -1;
	111	}
	112
	113	if (packet->length >= FLOWSPEC_NLRI_SIZELIMIT) {
	114	zlog_err("BGP flowspec nlri length maximum reached (%u)",
	115	packet->length);
	116	return -1;
	117	}
	118
	119	for (; pnt < lim; pnt += psize) {
	120	/* Clear prefix structure. */
	121	memset(&p, 0, sizeof(struct prefix));
	122
	123	/* All FlowSpec NLRI begin with length. */
	124	if (pnt + 1 > lim)
	125	return -1;
	126
	127	psize = rlen = *pnt++;
	128
	129	/* When packet overflow occur return immediately. */
	130	if (pnt + psize > lim) {
	131	zlog_err("Flowspec NLRI length inconsistent ( size %u seen)",
	132	psize);
	133	return -1;
	134	}
fc836540 PG	135	if (bgp_fs_nlri_validate(pnt, psize) < 0) {
	136	zlog_err("Bad flowspec format or NLRI options not supported");
	137	return -1;
	138	}
	139	p.family = AF_FLOWSPEC;
	140	p.prefixlen = 0;
	141	/* Flowspec encoding is in bytes */
	142	p.u.prefix_flowspec.prefixlen = psize;
	143	temp = XCALLOC(MTYPE_TMP, psize);
	144	memcpy(temp, pnt, psize);
	145	p.u.prefix_flowspec.ptr = (uintptr_t) temp;
	146	/* Process the route. */
	147	if (!withdraw)
	148	ret = bgp_update(peer, &p, 0, attr,
	149	afi, safi,
	150	ZEBRA_ROUTE_BGP, BGP_ROUTE_NORMAL,
	151	NULL, NULL, 0, 0, NULL);
	152	else
	153	ret = bgp_withdraw(peer, &p, 0, attr,
	154	afi, safi,
	155	ZEBRA_ROUTE_BGP, BGP_ROUTE_NORMAL,
	156	NULL, NULL, 0, NULL);
	157	if (ret) {
	158	zlog_err("Flowspec NLRI failed to be %s.",
	159	attr ? "added" : "withdrawn");
	160	return -1;
	161	}
7c40bf39	162	}
	163	return 0;
	164	}