]> git.proxmox.com Git - mirror_frr.git/blame - bgpd/bgp_pbr.c
projects / mirror_frr.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
zebra: handle neighbor delete from kernel for ipv4 link-local
[mirror_frr.git] / bgpd / bgp_pbr.c
CommitLineData
bbe6ffd6
PG		 1/*
2 * BGP pbr
3 * Copyright (C) 6WIND
4 *
5 * FRR is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2, or (at your option) any
8 * later version.
9 *
10 * FRR is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 * General Public License for more details.
14 *
15 * You should have received a copy of the GNU General Public License along
16 * with this program; see the file COPYING; if not, write to the Free Software
17 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
18 */
19
20#include "zebra.h"
21#include "prefix.h"
22#include "zclient.h"
f3d32faa 23#include "jhash.h"
2e1f721e 24#include "pbr.h"
bbe6ffd6 25
f3d32faa 26#include "bgpd/bgpd.h"
bbe6ffd6 27#include "bgpd/bgp_pbr.h"
b46b6f1a 28#include "bgpd/bgp_debug.h"
45918cfb
PG		 29#include "bgpd/bgp_flowspec_util.h"
30#include "bgpd/bgp_ecommunity.h"
31#include "bgpd/bgp_route.h"
32#include "bgpd/bgp_attr.h"
d114b0d7 33#include "bgpd/bgp_zebra.h"
529efa23 34#include "bgpd/bgp_mplsvpn.h"
35703998 35#include "bgpd/bgp_flowspec_private.h"
4f3be667 36#include "bgpd/bgp_errors.h"
d114b0d7
PG		 37
38DEFINE_MTYPE_STATIC(BGPD, PBR_MATCH_ENTRY, "PBR match entry")
39DEFINE_MTYPE_STATIC(BGPD, PBR_MATCH, "PBR match")
40DEFINE_MTYPE_STATIC(BGPD, PBR_ACTION, "PBR action")
4762c213 41DEFINE_MTYPE_STATIC(BGPD, PBR, "BGP PBR Context")
f7b2e630 42DEFINE_MTYPE_STATIC(BGPD, PBR_VALMASK, "BGP PBR Val Mask Value")
4762c213
PG		 43
44RB_GENERATE(bgp_pbr_interface_head, bgp_pbr_interface,
45 id_entry, bgp_pbr_interface_compare);
46struct bgp_pbr_interface_head ifaces_by_name_ipv4 =
47 RB_INITIALIZER(&ifaces_by_name_ipv4);
d114b0d7
PG		 48
49static int bgp_pbr_match_counter_unique;
50static int bgp_pbr_match_entry_counter_unique;
51static int bgp_pbr_action_counter_unique;
52static int bgp_pbr_match_iptable_counter_unique;
b46b6f1a 53
1815c6fc
PG		 54struct bgp_pbr_match_iptable_unique {
55 uint32_t unique;
56 struct bgp_pbr_match *bpm_found;
57};
58
c5d429e1
PG		 59struct bgp_pbr_match_entry_unique {
60 uint32_t unique;
61 struct bgp_pbr_match_entry *bpme_found;
62};
63
70eabd12
PG		 64struct bgp_pbr_action_unique {
65 uint32_t unique;
66 struct bgp_pbr_action *bpa_found;
67};
68
69static int bgp_pbr_action_walkcb(struct hash_backet *backet, void *arg)
70{
71 struct bgp_pbr_action *bpa = (struct bgp_pbr_action *)backet->data;
72 struct bgp_pbr_action_unique *bpau = (struct bgp_pbr_action_unique *)
73 arg;
74 uint32_t unique = bpau->unique;
75
76 if (bpa->unique == unique) {
77 bpau->bpa_found = bpa;
78 return HASHWALK_ABORT;
79 }
80 return HASHWALK_CONTINUE;
81}
82
c5d429e1
PG		 83static int bgp_pbr_match_entry_walkcb(struct hash_backet *backet, void *arg)
84{
85 struct bgp_pbr_match_entry *bpme =
86 (struct bgp_pbr_match_entry *)backet->data;
87 struct bgp_pbr_match_entry_unique *bpmeu =
88 (struct bgp_pbr_match_entry_unique *)arg;
89 uint32_t unique = bpmeu->unique;
90
91 if (bpme->unique == unique) {
92 bpmeu->bpme_found = bpme;
93 return HASHWALK_ABORT;
94 }
95 return HASHWALK_CONTINUE;
96}
97
98struct bgp_pbr_match_ipsetname {
99 char *ipsetname;
100 struct bgp_pbr_match *bpm_found;
101};
102
103static int bgp_pbr_match_pername_walkcb(struct hash_backet *backet, void *arg)
104{
105 struct bgp_pbr_match *bpm = (struct bgp_pbr_match *)backet->data;
106 struct bgp_pbr_match_ipsetname *bpmi =
107 (struct bgp_pbr_match_ipsetname *)arg;
108 char *ipset_name = bpmi->ipsetname;
109
110 if (!strncmp(ipset_name, bpm->ipset_name,
111 ZEBRA_IPSET_NAME_SIZE)) {
112 bpmi->bpm_found = bpm;
113 return HASHWALK_ABORT;
114 }
115 return HASHWALK_CONTINUE;
116}
117
1815c6fc
PG		 118static int bgp_pbr_match_iptable_walkcb(struct hash_backet *backet, void *arg)
119{
120 struct bgp_pbr_match *bpm = (struct bgp_pbr_match *)backet->data;
121 struct bgp_pbr_match_iptable_unique *bpmiu =
122 (struct bgp_pbr_match_iptable_unique *)arg;
123 uint32_t unique = bpmiu->unique;
124
125 if (bpm->unique2 == unique) {
126 bpmiu->bpm_found = bpm;
127 return HASHWALK_ABORT;
128 }
129 return HASHWALK_CONTINUE;
130}
131
c5d429e1
PG		 132struct bgp_pbr_match_unique {
133 uint32_t unique;
134 struct bgp_pbr_match *bpm_found;
135};
136
137static int bgp_pbr_match_walkcb(struct hash_backet *backet, void *arg)
138{
139 struct bgp_pbr_match *bpm = (struct bgp_pbr_match *)backet->data;
140 struct bgp_pbr_match_unique *bpmu = (struct bgp_pbr_match_unique *)
141 arg;
142 uint32_t unique = bpmu->unique;
143
144 if (bpm->unique == unique) {
145 bpmu->bpm_found = bpm;
146 return HASHWALK_ABORT;
147 }
148 return HASHWALK_CONTINUE;
149}
150
b46b6f1a
PG		 151static int sprintf_bgp_pbr_match_val(char *str, struct bgp_pbr_match_val *mval,
152 const char *prepend)
153{
154 char *ptr = str;
155
156 if (prepend)
157 ptr += sprintf(ptr, "%s", prepend);
158 else {
159 if (mval->unary_operator & OPERATOR_UNARY_OR)
160 ptr += sprintf(ptr, ", or ");
161 if (mval->unary_operator & OPERATOR_UNARY_AND)
162 ptr += sprintf(ptr, ", and ");
163 }
164 if (mval->compare_operator & OPERATOR_COMPARE_LESS_THAN)
165 ptr += sprintf(ptr, "<");
166 if (mval->compare_operator & OPERATOR_COMPARE_GREATER_THAN)
167 ptr += sprintf(ptr, ">");
168 if (mval->compare_operator & OPERATOR_COMPARE_EQUAL_TO)
169 ptr += sprintf(ptr, "=");
170 if (mval->compare_operator & OPERATOR_COMPARE_EXACT_MATCH)
171 ptr += sprintf(ptr, "match");
172 ptr += sprintf(ptr, " %u", mval->value);
173 return (int)(ptr - str);
174}
175
176#define INCREMENT_DISPLAY(_ptr, _cnt) do { \
177 if (_cnt) \
178 (_ptr) += sprintf((_ptr), "; "); \
179 _cnt++; \
180 } while (0)
181
0e867886
PG		 182/* this structure can be used for port range,
183 * but also for other values range like packet length range
184 */
1de7dfff
PG		 185struct bgp_pbr_range_port {
186 uint16_t min_port;
187 uint16_t max_port;
188};
189
2da7d62e
PG		 190/* this structure can be used to filter with a mask
191 * for instance it supports not instructions like for
192 * tcpflags
193 */
194struct bgp_pbr_val_mask {
195 uint16_t val;
196 uint16_t mask;
197};
198
0e867886
PG		 199/* this structure is used to pass instructs
200 * so that BGP can create pbr instructions to ZEBRA
201 */
202struct bgp_pbr_filter {
203 vrf_id_t vrf_id;
204 struct prefix *src;
205 struct prefix *dst;
206 uint8_t protocol;
207 struct bgp_pbr_range_port *pkt_len;
208 struct bgp_pbr_range_port *src_port;
209 struct bgp_pbr_range_port *dst_port;
2da7d62e 210 struct bgp_pbr_val_mask *tcp_flags;
4977bd6c 211 struct bgp_pbr_val_mask *dscp;
cfaf18ce 212 struct bgp_pbr_val_mask *pkt_len_val;
6f5617d8 213 struct bgp_pbr_val_mask *fragment;
0e867886
PG		 214};
215
c5ee26cc
PG		 216/* this structure is used to contain OR instructions
217 * so that BGP can create multiple pbr instructions
218 * to ZEBRA
219 */
220struct bgp_pbr_or_filter {
221 struct list *tcpflags;
56707a36 222 struct list *dscp;
cfaf18ce 223 struct list *pkt_len;
6f5617d8 224 struct list *fragment;
da3fa383
PG		 225 struct list *icmp_type;
226 struct list *icmp_code;
c5ee26cc
PG		 227};
228
da3fa383 229static void bgp_pbr_policyroute_add_to_zebra_unit(struct bgp *bgp,
9b6d8fcf 230 struct bgp_path_info *path,
da3fa383
PG		 231 struct bgp_pbr_filter *bpf,
232 struct nexthop *nh,
233 float *rate);
6e288819 234
064a9d52
PG		 235static void bgp_pbr_dump_entry(struct bgp_pbr_filter *bpf, bool add);
236
6e288819
PG		 237static bool bgp_pbr_extract_enumerate_unary_opposite(
238 uint8_t unary_operator,
239 struct bgp_pbr_val_mask *and_valmask,
240 struct list *or_valmask, uint32_t value,
241 uint8_t type_entry)
242{
243 if (unary_operator == OPERATOR_UNARY_AND && and_valmask) {
244 if (type_entry == FLOWSPEC_TCP_FLAGS) {
245 and_valmask->mask |=
246 TCP_HEADER_ALL_FLAGS &
247 ~(value);
248 } else if (type_entry == FLOWSPEC_DSCP ||
249 type_entry == FLOWSPEC_PKT_LEN ||
250 type_entry == FLOWSPEC_FRAGMENT) {
251 and_valmask->val = value;
252 and_valmask->mask = 1; /* inverse */
253 }
254 } else if (unary_operator == OPERATOR_UNARY_OR && or_valmask) {
255 and_valmask = XCALLOC(MTYPE_PBR_VALMASK,
256 sizeof(struct bgp_pbr_val_mask));
257 if (type_entry == FLOWSPEC_TCP_FLAGS) {
258 and_valmask->val = TCP_HEADER_ALL_FLAGS;
259 and_valmask->mask |=
260 TCP_HEADER_ALL_FLAGS &
261 ~(value);
262 } else if (type_entry == FLOWSPEC_DSCP ||
263 type_entry == FLOWSPEC_FRAGMENT ||
264 type_entry == FLOWSPEC_PKT_LEN) {
265 and_valmask->val = value;
266 and_valmask->mask = 1; /* inverse */
267 }
268 listnode_add(or_valmask, and_valmask);
269 } else if (type_entry == FLOWSPEC_ICMP_CODE ||
270 type_entry == FLOWSPEC_ICMP_TYPE)
271 return false;
272 return true;
273}
274
2da7d62e
PG		 275/* TCP : FIN and SYN -> val = ALL; mask = 3
276 * TCP : not (FIN and SYN) -> val = ALL; mask = ALL & ~(FIN|RST)
6f5617d8
PG		 277 * other variables type: dscp, pkt len, fragment
278 * - value is copied in bgp_pbr_val_mask->val value
279 * - if negate form is identifierd, bgp_pbr_val_mask->mask set to 1
2da7d62e 280 */
f7b2e630
PG		 281static bool bgp_pbr_extract_enumerate_unary(struct bgp_pbr_match_val list[],
282 int num, uint8_t unary_operator,
35703998 283 void *valmask, uint8_t type_entry)
932404b7
PG		 284{
285 int i = 0;
f7b2e630
PG		 286 struct bgp_pbr_val_mask *and_valmask = NULL;
287 struct list *or_valmask = NULL;
6e288819 288 bool ret;
932404b7 289
f7b2e630
PG		 290 if (valmask) {
291 if (unary_operator == OPERATOR_UNARY_AND) {
292 and_valmask = (struct bgp_pbr_val_mask *)valmask;
293 memset(and_valmask, 0, sizeof(struct bgp_pbr_val_mask));
294 } else if (unary_operator == OPERATOR_UNARY_OR) {
295 or_valmask = (struct list *)valmask;
296 }
297 }
932404b7 298 for (i = 0; i < num; i++) {
2da7d62e
PG		 299 if (i != 0 && list[i].unary_operator !=
300 unary_operator)
932404b7 301 return false;
2da7d62e
PG		 302 if (!(list[i].compare_operator &
303 OPERATOR_COMPARE_EQUAL_TO) &&
304 !(list[i].compare_operator &
305 OPERATOR_COMPARE_EXACT_MATCH)) {
306 if ((list[i].compare_operator &
307 OPERATOR_COMPARE_LESS_THAN) &&
308 (list[i].compare_operator &
309 OPERATOR_COMPARE_GREATER_THAN)) {
6e288819
PG		 310 ret = bgp_pbr_extract_enumerate_unary_opposite(
311 unary_operator, and_valmask,
312 or_valmask, list[i].value,
313 type_entry);
314 if (ret == false)
315 return ret;
2da7d62e
PG		 316 continue;
317 }
318 return false;
319 }
35703998
PG		 320 if (unary_operator == OPERATOR_UNARY_AND && and_valmask) {
321 if (type_entry == FLOWSPEC_TCP_FLAGS)
322 and_valmask->mask |=
323 TCP_HEADER_ALL_FLAGS & list[i].value;
324 } else if (unary_operator == OPERATOR_UNARY_OR && or_valmask) {
f7b2e630
PG		 325 and_valmask = XCALLOC(MTYPE_PBR_VALMASK,
326 sizeof(struct bgp_pbr_val_mask));
35703998
PG		 327 if (type_entry == FLOWSPEC_TCP_FLAGS) {
328 and_valmask->val = TCP_HEADER_ALL_FLAGS;
329 and_valmask->mask |=
330 TCP_HEADER_ALL_FLAGS & list[i].value;
cfaf18ce 331 } else if (type_entry == FLOWSPEC_DSCP ||
da3fa383
PG		 332 type_entry == FLOWSPEC_ICMP_TYPE ||
333 type_entry == FLOWSPEC_ICMP_CODE ||
6f5617d8 334 type_entry == FLOWSPEC_FRAGMENT ||
cfaf18ce 335 type_entry == FLOWSPEC_PKT_LEN)
35703998 336 and_valmask->val = list[i].value;
f7b2e630
PG		 337 listnode_add(or_valmask, and_valmask);
338 }
932404b7 339 }
35703998
PG		 340 if (unary_operator == OPERATOR_UNARY_AND && and_valmask
341 && type_entry == FLOWSPEC_TCP_FLAGS)
342 and_valmask->val = TCP_HEADER_ALL_FLAGS;
932404b7
PG		 343 return true;
344}
345
f7b2e630
PG		 346/* if unary operator can either be UNARY_OR/AND/OR-AND.
347 * in the latter case, combinationf of both is not handled
348 */
349static bool bgp_pbr_extract_enumerate(struct bgp_pbr_match_val list[],
350 int num, uint8_t unary_operator,
35703998 351 void *valmask, uint8_t type_entry)
f7b2e630
PG		 352{
353 bool ret;
3f54c705 354 uint8_t unary_operator_val;
f7b2e630
PG		 355 bool double_check = false;
356
357 if ((unary_operator & OPERATOR_UNARY_OR) &&
358 (unary_operator & OPERATOR_UNARY_AND)) {
359 unary_operator_val = OPERATOR_UNARY_AND;
360 double_check = true;
361 } else
362 unary_operator_val = unary_operator;
363 ret = bgp_pbr_extract_enumerate_unary(list, num, unary_operator_val,
35703998 364 valmask, type_entry);
f7b2e630
PG		 365 if (!ret && double_check)
366 ret = bgp_pbr_extract_enumerate_unary(list, num,
367 OPERATOR_UNARY_OR,
35703998
PG		 368 valmask,
369 type_entry);
f7b2e630
PG		 370 return ret;
371}
372
373/* returns the unary operator that is in the list
374 * return 0 if both operators are used
375 */
376static uint8_t bgp_pbr_match_val_get_operator(struct bgp_pbr_match_val list[],
377 int num)
378
379{
380 int i;
381 uint8_t unary_operator = OPERATOR_UNARY_AND;
382
383 for (i = 0; i < num; i++) {
384 if (i == 0)
385 continue;
386 if (list[i].unary_operator & OPERATOR_UNARY_OR)
387 unary_operator = OPERATOR_UNARY_OR;
388 if ((list[i].unary_operator & OPERATOR_UNARY_AND
389 && unary_operator == OPERATOR_UNARY_OR) ||
390 (list[i].unary_operator & OPERATOR_UNARY_OR
391 && unary_operator == OPERATOR_UNARY_AND))
392 return 0;
393 }
394 return unary_operator;
395}
396
397
1de7dfff
PG		 398/* return true if extraction ok
399 */
400static bool bgp_pbr_extract(struct bgp_pbr_match_val list[],
401 int num,
402 struct bgp_pbr_range_port *range)
403{
404 int i = 0;
405 bool exact_match = false;
406
407 if (range)
408 memset(range, 0, sizeof(struct bgp_pbr_range_port));
409
410 if (num > 2)
411 return false;
412 for (i = 0; i < num; i++) {
413 if (i != 0 && (list[i].compare_operator ==
414 OPERATOR_COMPARE_EQUAL_TO))
415 return false;
416 if (i == 0 && (list[i].compare_operator ==
417 OPERATOR_COMPARE_EQUAL_TO)) {
418 if (range)
419 range->min_port = list[i].value;
420 exact_match = true;
421 }
422 if (exact_match == true && i > 0)
423 return false;
424 if (list[i].compare_operator ==
425 (OPERATOR_COMPARE_GREATER_THAN +
426 OPERATOR_COMPARE_EQUAL_TO)) {
427 if (range)
428 range->min_port = list[i].value;
429 } else if (list[i].compare_operator ==
430 (OPERATOR_COMPARE_LESS_THAN +
431 OPERATOR_COMPARE_EQUAL_TO)) {
432 if (range)
433 range->max_port = list[i].value;
434 } else if (list[i].compare_operator ==
435 OPERATOR_COMPARE_LESS_THAN) {
436 if (range)
437 range->max_port = list[i].value - 1;
438 } else if (list[i].compare_operator ==
439 OPERATOR_COMPARE_GREATER_THAN) {
440 if (range)
441 range->min_port = list[i].value + 1;
442 }
443 }
444 return true;
445}
446
b46b6f1a
PG		 447static int bgp_pbr_validate_policy_route(struct bgp_pbr_entry_main *api)
448{
932404b7
PG		 449 bool enumerate_icmp = false;
450
b46b6f1a
PG		 451 /* because bgp pbr entry may contain unsupported
452 * combinations, a message will be displayed here if
453 * not supported.
454 * for now, only match/set supported is
455 * - combination src/dst => redirect nexthop [ + rate]
456 * - combination src/dst => redirect VRF [ + rate]
457 * - combination src/dst => drop
1de7dfff 458 * - combination srcport + @IP
b46b6f1a 459 */
1de7dfff
PG		 460 if (api->match_protocol_num > 1) {
461 if (BGP_DEBUG(pbr, PBR))
462 zlog_debug("BGP: match protocol operations:"
463 "multiple protocols ( %d). ignoring.",
464 api->match_protocol_num);
465 return 0;
466 }
467 if (api->match_protocol_num == 1 &&
468 api->protocol[0].value != PROTOCOL_UDP &&
932404b7 469 api->protocol[0].value != PROTOCOL_ICMP &&
1de7dfff
PG		 470 api->protocol[0].value != PROTOCOL_TCP) {
471 if (BGP_DEBUG(pbr, PBR))
472 zlog_debug("BGP: match protocol operations:"
473 "protocol (%d) not supported. ignoring",
474 api->match_protocol_num);
475 return 0;
476 }
477 if (!bgp_pbr_extract(api->src_port, api->match_src_port_num, NULL)) {
478 if (BGP_DEBUG(pbr, PBR))
479 zlog_debug("BGP: match src port operations:"
480 "too complex. ignoring.");
481 return 0;
482 }
483 if (!bgp_pbr_extract(api->dst_port, api->match_dst_port_num, NULL)) {
484 if (BGP_DEBUG(pbr, PBR))
485 zlog_debug("BGP: match dst port operations:"
486 "too complex. ignoring.");
487 return 0;
488 }
2da7d62e
PG		 489 if (!bgp_pbr_extract_enumerate(api->tcpflags,
490 api->match_tcpflags_num,
c5ee26cc 491 OPERATOR_UNARY_AND |
35703998
PG		 492 OPERATOR_UNARY_OR, NULL,
493 FLOWSPEC_TCP_FLAGS)) {
2da7d62e
PG		 494 if (BGP_DEBUG(pbr, PBR))
495 zlog_debug("BGP: match tcp flags:"
496 "too complex. ignoring.");
497 return 0;
498 }
932404b7
PG		 499 if (!bgp_pbr_extract(api->icmp_type, api->match_icmp_type_num, NULL)) {
500 if (!bgp_pbr_extract_enumerate(api->icmp_type,
2da7d62e 501 api->match_icmp_type_num,
35703998
PG		 502 OPERATOR_UNARY_OR, NULL,
503 FLOWSPEC_ICMP_TYPE)) {
932404b7
PG		 504 if (BGP_DEBUG(pbr, PBR))
505 zlog_debug("BGP: match icmp type operations:"
506 "too complex. ignoring.");
507 return 0;
508 }
509 enumerate_icmp = true;
510 }
511 if (!bgp_pbr_extract(api->icmp_code, api->match_icmp_code_num, NULL)) {
512 if (!bgp_pbr_extract_enumerate(api->icmp_code,
2da7d62e 513 api->match_icmp_code_num,
35703998
PG		 514 OPERATOR_UNARY_OR, NULL,
515 FLOWSPEC_ICMP_CODE)) {
932404b7
PG		 516 if (BGP_DEBUG(pbr, PBR))
517 zlog_debug("BGP: match icmp code operations:"
518 "too complex. ignoring.");
519 return 0;
520 } else if (api->match_icmp_type_num > 1 &&
521 enumerate_icmp == false) {
522 if (BGP_DEBUG(pbr, PBR))
523 zlog_debug("BGP: match icmp code is enumerate"
524 ", and icmp type is not."
525 " too complex. ignoring.");
526 return 0;
527 }
528 }
1de7dfff
PG		 529 if (!bgp_pbr_extract(api->port, api->match_port_num, NULL)) {
530 if (BGP_DEBUG(pbr, PBR))
531 zlog_debug("BGP: match port operations:"
532 "too complex. ignoring.");
533 return 0;
534 }
cfaf18ce
PG		 535 if (api->match_packet_length_num) {
536 bool ret;
537
538 ret = bgp_pbr_extract(api->packet_length,
539 api->match_packet_length_num, NULL);
540 if (!ret)
541 ret = bgp_pbr_extract_enumerate(api->packet_length,
542 api->match_packet_length_num,
543 OPERATOR_UNARY_OR
544 | OPERATOR_UNARY_AND,
545 NULL, FLOWSPEC_PKT_LEN);
546 if (!ret) {
547 if (BGP_DEBUG(pbr, PBR))
548 zlog_debug("BGP: match packet length operations:"
83360720 549 "too complex. ignoring.");
cfaf18ce
PG		 550 return 0;
551 }
83360720 552 }
35703998
PG		 553 if (api->match_dscp_num) {
554 if (!bgp_pbr_extract_enumerate(api->dscp, api->match_dscp_num,
555 OPERATOR_UNARY_OR | OPERATOR_UNARY_AND,
556 NULL, FLOWSPEC_DSCP)) {
557 if (BGP_DEBUG(pbr, PBR))
558 zlog_debug("BGP: match DSCP operations:"
559 "too complex. ignoring.");
560 return 0;
561 }
4977bd6c 562 }
6f5617d8
PG		 563 if (api->match_fragment_num) {
564 char fail_str[64];
565 bool success;
566
567 success = bgp_pbr_extract_enumerate(api->fragment,
568 api->match_fragment_num,
569 OPERATOR_UNARY_OR
570 | OPERATOR_UNARY_AND,
571 NULL, FLOWSPEC_FRAGMENT);
572 if (success) {
573 int i;
574
575 for (i = 0; i < api->match_fragment_num; i++) {
576 if (api->fragment[i].value != 1 &&
577 api->fragment[i].value != 2 &&
578 api->fragment[i].value != 4 &&
579 api->fragment[i].value != 8) {
580 success = false;
581 sprintf(fail_str,
582 "Value not valid (%d) for this implementation",
583 api->fragment[i].value);
584 }
585 }
586 } else
587 sprintf(fail_str, "too complex. ignoring");
588 if (!success) {
589 if (BGP_DEBUG(pbr, PBR))
590 zlog_debug("BGP: match fragment operation (%d) %s",
591 api->match_fragment_num,
592 fail_str);
593 return 0;
594 }
595 }
596
1de7dfff
PG		 597 /* no combinations with both src_port and dst_port
598 * or port with src_port and dst_port
599 */
600 if (api->match_src_port_num + api->match_dst_port_num +
601 api->match_port_num > 3) {
602 if (BGP_DEBUG(pbr, PBR))
603 zlog_debug("BGP: match multiple port operations:"
604 " too complex. ignoring.");
605 return 0;
606 }
932404b7
PG		 607 if ((api->match_src_port_num || api->match_dst_port_num
608 || api->match_port_num) && (api->match_icmp_type_num
609 || api->match_icmp_code_num)) {
610 if (BGP_DEBUG(pbr, PBR))
611 zlog_debug("BGP: match multiple port/imcp operations:"
612 " too complex. ignoring.");
613 return 0;
614 }
b46b6f1a
PG		 615 if (!(api->match_bitmask & PREFIX_SRC_PRESENT) &&
616 !(api->match_bitmask & PREFIX_DST_PRESENT)) {
ac7c35f8 617 if (BGP_DEBUG(pbr, PBR)) {
b46b6f1a 618 bgp_pbr_print_policy_route(api);
ac7c35f8
PG		 619 zlog_debug("BGP: match actions without src"
620 " or dst address can not operate."
621 " ignoring.");
622 }
b46b6f1a
PG		 623 return 0;
624 }
625 return 1;
626}
bbe6ffd6 627
45918cfb
PG		 628/* return -1 if build or validation failed */
629static int bgp_pbr_build_and_validate_entry(struct prefix *p,
40381db7 630 struct bgp_path_info *path,
45918cfb
PG		 631 struct bgp_pbr_entry_main *api)
632{
633 int ret;
634 int i, action_count = 0;
635 struct ecommunity *ecom;
636 struct ecommunity_val *ecom_eval;
637 struct bgp_pbr_entry_action *api_action;
638 struct prefix *src = NULL, *dst = NULL;
639 int valid_prefix = 0;
640 afi_t afi = AFI_IP;
641
642 /* extract match from flowspec entries */
643 ret = bgp_flowspec_match_rules_fill((uint8_t *)p->u.prefix_flowspec.ptr,
644 p->u.prefix_flowspec.prefixlen, api);
645 if (ret < 0)
646 return -1;
647 /* extract actiosn from flowspec ecom list */
40381db7
DS		 648 if (path && path->attr && path->attr->ecommunity) {
649 ecom = path->attr->ecommunity;
45918cfb
PG		 650 for (i = 0; i < ecom->size; i++) {
651 ecom_eval = (struct ecommunity_val *)
149d272b
PG		 652 (ecom->val + (i * ECOMMUNITY_SIZE));
653 action_count++;
45918cfb 654 if (action_count > ACTIONS_MAX_NUM) {
f146bb54 655 if (BGP_DEBUG(pbr, PBR_ERROR))
1c50c1c0
QY		 656 flog_err(
657 EC_BGP_FLOWSPEC_PACKET,
658 "%s: flowspec actions exceeds limit (max %u)",
659 __func__, action_count);
45918cfb
PG		 660 break;
661 }
149d272b 662 api_action = &api->actions[action_count - 1];
45918cfb
PG		 663
664 if ((ecom_eval->val[1] ==
665 (char)ECOMMUNITY_REDIRECT_VRF) &&
666 (ecom_eval->val[0] ==
667 (char)ECOMMUNITY_ENCODE_TRANS_EXP ||
668 ecom_eval->val[0] ==
669 (char)ECOMMUNITY_EXTENDED_COMMUNITY_PART_2 ||
670 ecom_eval->val[0] ==
671 (char)ECOMMUNITY_EXTENDED_COMMUNITY_PART_3)) {
672 struct ecommunity *eckey = ecommunity_new();
673 struct ecommunity_val ecom_copy;
674
675 memcpy(&ecom_copy, ecom_eval,
676 sizeof(struct ecommunity_val));
677 ecom_copy.val[0] &=
678 ~ECOMMUNITY_ENCODE_TRANS_EXP;
679 ecom_copy.val[1] = ECOMMUNITY_ROUTE_TARGET;
680 ecommunity_add_val(eckey, &ecom_copy);
681
682 api_action->action = ACTION_REDIRECT;
683 api_action->u.redirect_vrf =
684 get_first_vrf_for_redirect_with_rt(
685 eckey);
686 ecommunity_free(&eckey);
687 } else if ((ecom_eval->val[0] ==
688 (char)ECOMMUNITY_ENCODE_REDIRECT_IP_NH) &&
689 (ecom_eval->val[1] ==
690 (char)ECOMMUNITY_REDIRECT_IP_NH)) {
691 api_action->action = ACTION_REDIRECT_IP;
692 api_action->u.zr.redirect_ip_v4.s_addr =
40381db7 693 path->attr->nexthop.s_addr;
45918cfb
PG		 694 api_action->u.zr.duplicate = ecom_eval->val[7];
695 } else {
696 if (ecom_eval->val[0] !=
697 (char)ECOMMUNITY_ENCODE_TRANS_EXP)
698 continue;
699 ret = ecommunity_fill_pbr_action(ecom_eval,
700 api_action);
701 if (ret != 0)
702 continue;
703 }
704 api->action_num++;
705 }
706 }
707
708 /* validate if incoming matc/action is compatible
709 * with our policy routing engine
710 */
711 if (!bgp_pbr_validate_policy_route(api))
712 return -1;
713
714 /* check inconsistency in the match rule */
715 if (api->match_bitmask & PREFIX_SRC_PRESENT) {
716 src = &api->src_prefix;
717 afi = family2afi(src->family);
718 valid_prefix = 1;
719 }
720 if (api->match_bitmask & PREFIX_DST_PRESENT) {
721 dst = &api->dst_prefix;
722 if (valid_prefix && afi != family2afi(dst->family)) {
ac7c35f8 723 if (BGP_DEBUG(pbr, PBR)) {
45918cfb 724 bgp_pbr_print_policy_route(api);
ac7c35f8
PG		 725 zlog_debug("%s: inconsistency:"
726 " no match for afi src and dst (%u/%u)",
727 __func__, afi, family2afi(dst->family));
728 }
45918cfb
PG		 729 return -1;
730 }
731 }
732 return 0;
733}
734
a6b07429
PG		 735static void bgp_pbr_match_entry_free(void *arg)
736{
737 struct bgp_pbr_match_entry *bpme;
738
739 bpme = (struct bgp_pbr_match_entry *)arg;
740
741 if (bpme->installed) {
742 bgp_send_pbr_ipset_entry_match(bpme, false);
743 bpme->installed = false;
744 bpme->backpointer = NULL;
745 }
746 XFREE(MTYPE_PBR_MATCH_ENTRY, bpme);
747}
748
749static void bgp_pbr_match_free(void *arg)
750{
751 struct bgp_pbr_match *bpm;
752
753 bpm = (struct bgp_pbr_match *)arg;
754
755 hash_clean(bpm->entry_hash, bgp_pbr_match_entry_free);
756
757 if (hashcount(bpm->entry_hash) == 0) {
758 /* delete iptable entry first */
759 /* then delete ipset match */
760 if (bpm->installed) {
761 if (bpm->installed_in_iptable) {
762 bgp_send_pbr_iptable(bpm->action,
763 bpm, false);
764 bpm->installed_in_iptable = false;
765 bpm->action->refcnt--;
766 }
767 bgp_send_pbr_ipset_match(bpm, false);
768 bpm->installed = false;
769 bpm->action = NULL;
770 }
771 }
772 hash_free(bpm->entry_hash);
773
774 XFREE(MTYPE_PBR_MATCH, bpm);
775}
776
d114b0d7
PG		 777static void *bgp_pbr_match_alloc_intern(void *arg)
778{
779 struct bgp_pbr_match *bpm, *new;
780
781 bpm = (struct bgp_pbr_match *)arg;
782
783 new = XCALLOC(MTYPE_PBR_MATCH, sizeof(*new));
784 memcpy(new, bpm, sizeof(*bpm));
785
786 return new;
787}
788
a6b07429
PG		 789static void bgp_pbr_action_free(void *arg)
790{
791 struct bgp_pbr_action *bpa;
792
793 bpa = (struct bgp_pbr_action *)arg;
794
795 if (bpa->refcnt == 0) {
796 if (bpa->installed && bpa->table_id != 0) {
797 bgp_send_pbr_rule_action(bpa, false);
798 bgp_zebra_announce_default(bpa->bgp, &(bpa->nh),
799 AFI_IP,
800 bpa->table_id,
801 false);
6ee20355 802 bpa->installed = false;
a6b07429
PG		 803 }
804 }
805 XFREE(MTYPE_PBR_ACTION, bpa);
806}
807
d114b0d7
PG		 808static void *bgp_pbr_action_alloc_intern(void *arg)
809{
810 struct bgp_pbr_action *bpa, *new;
811
812 bpa = (struct bgp_pbr_action *)arg;
813
814 new = XCALLOC(MTYPE_PBR_ACTION, sizeof(*new));
815
816 memcpy(new, bpa, sizeof(*bpa));
817
818 return new;
819}
820
821static void *bgp_pbr_match_entry_alloc_intern(void *arg)
822{
823 struct bgp_pbr_match_entry *bpme, *new;
824
825 bpme = (struct bgp_pbr_match_entry *)arg;
826
827 new = XCALLOC(MTYPE_PBR_MATCH_ENTRY, sizeof(*new));
828
829 memcpy(new, bpme, sizeof(*bpme));
830
831 return new;
832}
833
f3d32faa
PG		 834uint32_t bgp_pbr_match_hash_key(void *arg)
835{
836 struct bgp_pbr_match *pbm = (struct bgp_pbr_match *)arg;
837 uint32_t key;
838
839 key = jhash_1word(pbm->vrf_id, 0x4312abde);
840 key = jhash_1word(pbm->flags, key);
9717d3e5
PG		 841 key = jhash(&pbm->pkt_len_min, 2, key);
842 key = jhash(&pbm->pkt_len_max, 2, key);
843 key = jhash(&pbm->tcp_flags, 2, key);
844 key = jhash(&pbm->tcp_mask_flags, 2, key);
845 key = jhash(&pbm->dscp_value, 1, key);
846 key = jhash(&pbm->fragment, 1, key);
f3d32faa
PG		 847 return jhash_1word(pbm->type, key);
848}
849
74df8d6d 850bool bgp_pbr_match_hash_equal(const void *arg1, const void *arg2)
f3d32faa
PG		 851{
852 const struct bgp_pbr_match *r1, *r2;
853
854 r1 = (const struct bgp_pbr_match *)arg1;
855 r2 = (const struct bgp_pbr_match *)arg2;
856
857 if (r1->vrf_id != r2->vrf_id)
74df8d6d 858 return false;
f3d32faa
PG		 859
860 if (r1->type != r2->type)
74df8d6d 861 return false;
f3d32faa
PG		 862
863 if (r1->flags != r2->flags)
74df8d6d 864 return false;
f3d32faa
PG		 865
866 if (r1->action != r2->action)
74df8d6d 867 return false;
f3d32faa 868
83360720 869 if (r1->pkt_len_min != r2->pkt_len_min)
74df8d6d 870 return false;
83360720
PG		 871
872 if (r1->pkt_len_max != r2->pkt_len_max)
74df8d6d 873 return false;
83360720 874
2da7d62e 875 if (r1->tcp_flags != r2->tcp_flags)
74df8d6d 876 return false;
2da7d62e
PG		 877
878 if (r1->tcp_mask_flags != r2->tcp_mask_flags)
74df8d6d 879 return false;
2da7d62e 880
4977bd6c 881 if (r1->dscp_value != r2->dscp_value)
74df8d6d 882 return false;
6f5617d8
PG		 883
884 if (r1->fragment != r2->fragment)
74df8d6d
DS		 885 return false;
886 return true;
f3d32faa
PG		 887}
888
889uint32_t bgp_pbr_match_entry_hash_key(void *arg)
890{
891 struct bgp_pbr_match_entry *pbme;
892 uint32_t key;
893
894 pbme = (struct bgp_pbr_match_entry *)arg;
895 key = prefix_hash_key(&pbme->src);
896 key = jhash_1word(prefix_hash_key(&pbme->dst), key);
1de7dfff
PG		 897 key = jhash(&pbme->dst_port_min, 2, key);
898 key = jhash(&pbme->src_port_min, 2, key);
899 key = jhash(&pbme->dst_port_max, 2, key);
900 key = jhash(&pbme->src_port_max, 2, key);
901 key = jhash(&pbme->proto, 1, key);
f3d32faa
PG		 902
903 return key;
904}
905
74df8d6d 906bool bgp_pbr_match_entry_hash_equal(const void *arg1, const void *arg2)
f3d32faa
PG		 907{
908 const struct bgp_pbr_match_entry *r1, *r2;
909
910 r1 = (const struct bgp_pbr_match_entry *)arg1;
911 r2 = (const struct bgp_pbr_match_entry *)arg2;
912
74df8d6d
DS		 913 /*
914 * on updates, comparing backpointer is not necessary
915 * unique value is self calculated
916 * rate is ignored for now
f3d32faa
PG		 917 */
918
919 if (!prefix_same(&r1->src, &r2->src))
74df8d6d 920 return false;
f3d32faa
PG		 921
922 if (!prefix_same(&r1->dst, &r2->dst))
74df8d6d 923 return false;
f3d32faa 924
1de7dfff 925 if (r1->src_port_min != r2->src_port_min)
74df8d6d 926 return false;
1de7dfff
PG		 927
928 if (r1->dst_port_min != r2->dst_port_min)
74df8d6d 929 return false;
1de7dfff
PG		 930
931 if (r1->src_port_max != r2->src_port_max)
74df8d6d 932 return false;
1de7dfff
PG		 933
934 if (r1->dst_port_max != r2->dst_port_max)
74df8d6d 935 return false;
1de7dfff
PG		 936
937 if (r1->proto != r2->proto)
74df8d6d 938 return false;
1de7dfff 939
74df8d6d 940 return true;
f3d32faa
PG		 941}
942
943uint32_t bgp_pbr_action_hash_key(void *arg)
944{
945 struct bgp_pbr_action *pbra;
946 uint32_t key;
947
948 pbra = (struct bgp_pbr_action *)arg;
949 key = jhash_1word(pbra->table_id, 0x4312abde);
950 key = jhash_1word(pbra->fwmark, key);
951 return key;
952}
953
74df8d6d 954bool bgp_pbr_action_hash_equal(const void *arg1, const void *arg2)
f3d32faa
PG		 955{
956 const struct bgp_pbr_action *r1, *r2;
957
958 r1 = (const struct bgp_pbr_action *)arg1;
959 r2 = (const struct bgp_pbr_action *)arg2;
960
961 /* unique value is self calculated
962 * table and fwmark is self calculated
e414819e 963 * rate is ignored
f3d32faa 964 */
f3d32faa 965 if (r1->vrf_id != r2->vrf_id)
74df8d6d 966 return false;
f3d32faa
PG		 967
968 if (memcmp(&r1->nh, &r2->nh, sizeof(struct nexthop)))
74df8d6d
DS		 969 return false;
970
971 return true;
f3d32faa 972}
bbe6ffd6 973
70eabd12
PG		 974struct bgp_pbr_action *bgp_pbr_action_rule_lookup(vrf_id_t vrf_id,
975 uint32_t unique)
bbe6ffd6 976{
70eabd12
PG		 977 struct bgp *bgp = bgp_lookup_by_vrf_id(vrf_id);
978 struct bgp_pbr_action_unique bpau;
979
980 if (!bgp || unique == 0)
981 return NULL;
982 bpau.unique = unique;
983 bpau.bpa_found = NULL;
984 hash_walk(bgp->pbr_action_hash, bgp_pbr_action_walkcb, &bpau);
985 return bpau.bpa_found;
bbe6ffd6
PG		 986}
987
988struct bgp_pbr_match *bgp_pbr_match_ipset_lookup(vrf_id_t vrf_id,
989 uint32_t unique)
990{
c5d429e1
PG		 991 struct bgp *bgp = bgp_lookup_by_vrf_id(vrf_id);
992 struct bgp_pbr_match_unique bpmu;
993
994 if (!bgp || unique == 0)
995 return NULL;
996 bpmu.unique = unique;
997 bpmu.bpm_found = NULL;
998 hash_walk(bgp->pbr_match_hash, bgp_pbr_match_walkcb, &bpmu);
999 return bpmu.bpm_found;
bbe6ffd6
PG		 1000}
1001
1002struct bgp_pbr_match_entry *bgp_pbr_match_ipset_entry_lookup(vrf_id_t vrf_id,
1003 char *ipset_name,
1004 uint32_t unique)
1005{
c5d429e1
PG		 1006 struct bgp *bgp = bgp_lookup_by_vrf_id(vrf_id);
1007 struct bgp_pbr_match_entry_unique bpmeu;
1008 struct bgp_pbr_match_ipsetname bpmi;
1009
1010 if (!bgp || unique == 0)
1011 return NULL;
1012 bpmi.ipsetname = XCALLOC(MTYPE_TMP, ZEBRA_IPSET_NAME_SIZE);
1013 snprintf(bpmi.ipsetname, ZEBRA_IPSET_NAME_SIZE, "%s", ipset_name);
1014 bpmi.bpm_found = NULL;
1015 hash_walk(bgp->pbr_match_hash, bgp_pbr_match_pername_walkcb, &bpmi);
1016 XFREE(MTYPE_TMP, bpmi.ipsetname);
1017 if (!bpmi.bpm_found)
1018 return NULL;
1019 bpmeu.bpme_found = NULL;
1020 bpmeu.unique = unique;
1021 hash_walk(bpmi.bpm_found->entry_hash,
1022 bgp_pbr_match_entry_walkcb, &bpmeu);
1023 return bpmeu.bpme_found;
bbe6ffd6
PG		 1024}
1025
1815c6fc
PG		 1026struct bgp_pbr_match *bgp_pbr_match_iptable_lookup(vrf_id_t vrf_id,
1027 uint32_t unique)
1028{
1029 struct bgp *bgp = bgp_lookup_by_vrf_id(vrf_id);
1030 struct bgp_pbr_match_iptable_unique bpmiu;
1031
1032 if (!bgp || unique == 0)
1033 return NULL;
1034 bpmiu.unique = unique;
1035 bpmiu.bpm_found = NULL;
1036 hash_walk(bgp->pbr_match_hash, bgp_pbr_match_iptable_walkcb, &bpmiu);
1037 return bpmiu.bpm_found;
1038}
1039
a6b07429
PG		 1040void bgp_pbr_cleanup(struct bgp *bgp)
1041{
1042 if (bgp->pbr_match_hash) {
1043 hash_clean(bgp->pbr_match_hash, bgp_pbr_match_free);
1044 hash_free(bgp->pbr_match_hash);
1045 bgp->pbr_match_hash = NULL;
1046 }
1047 if (bgp->pbr_action_hash) {
1048 hash_clean(bgp->pbr_action_hash, bgp_pbr_action_free);
1049 hash_free(bgp->pbr_action_hash);
1050 bgp->pbr_action_hash = NULL;
1051 }
4762c213
PG		 1052 if (bgp->bgp_pbr_cfg == NULL)
1053 return;
1054 bgp_pbr_reset(bgp, AFI_IP);
1055 XFREE(MTYPE_PBR, bgp->bgp_pbr_cfg);
1056 bgp->bgp_pbr_cfg = NULL;
a6b07429
PG		 1057}
1058
f3d32faa
PG		 1059void bgp_pbr_init(struct bgp *bgp)
1060{
1061 bgp->pbr_match_hash =
1062 hash_create_size(8, bgp_pbr_match_hash_key,
1063 bgp_pbr_match_hash_equal,
1064 "Match Hash");
1065 bgp->pbr_action_hash =
1066 hash_create_size(8, bgp_pbr_action_hash_key,
1067 bgp_pbr_action_hash_equal,
1068 "Match Hash Entry");
4762c213
PG		 1069
1070 bgp->bgp_pbr_cfg = XCALLOC(MTYPE_PBR, sizeof(struct bgp_pbr_config));
1071 bgp->bgp_pbr_cfg->pbr_interface_any_ipv4 = true;
f3d32faa 1072}
b46b6f1a
PG		 1073
1074void bgp_pbr_print_policy_route(struct bgp_pbr_entry_main *api)
1075{
1076 int i = 0;
1077 char return_string[512];
1078 char *ptr = return_string;
1079 char buff[64];
1080 int nb_items = 0;
1081
1082 ptr += sprintf(ptr, "MATCH : ");
1083 if (api->match_bitmask & PREFIX_SRC_PRESENT) {
1084 struct prefix *p = &(api->src_prefix);
1085
1086 ptr += sprintf(ptr, "@src %s", prefix2str(p, buff, 64));
1087 INCREMENT_DISPLAY(ptr, nb_items);
1088 }
1089 if (api->match_bitmask & PREFIX_DST_PRESENT) {
1090 struct prefix *p = &(api->dst_prefix);
1091
1092 INCREMENT_DISPLAY(ptr, nb_items);
1093 ptr += sprintf(ptr, "@dst %s", prefix2str(p, buff, 64));
1094 }
1095
1096 if (api->match_protocol_num)
1097 INCREMENT_DISPLAY(ptr, nb_items);
1098 for (i = 0; i < api->match_protocol_num; i++)
1099 ptr += sprintf_bgp_pbr_match_val(ptr, &api->protocol[i],
1100 i > 0 ? NULL : "@proto ");
1101
1102 if (api->match_src_port_num)
1103 INCREMENT_DISPLAY(ptr, nb_items);
1104 for (i = 0; i < api->match_src_port_num; i++)
1105 ptr += sprintf_bgp_pbr_match_val(ptr, &api->src_port[i],
1106 i > 0 ? NULL : "@srcport ");
1107
1108 if (api->match_dst_port_num)
1109 INCREMENT_DISPLAY(ptr, nb_items);
1110 for (i = 0; i < api->match_dst_port_num; i++)
1111 ptr += sprintf_bgp_pbr_match_val(ptr, &api->dst_port[i],
1112 i > 0 ? NULL : "@dstport ");
1113
1114 if (api->match_port_num)
1115 INCREMENT_DISPLAY(ptr, nb_items);
1116 for (i = 0; i < api->match_port_num; i++)
1117 ptr += sprintf_bgp_pbr_match_val(ptr, &api->port[i],
1118 i > 0 ? NULL : "@port ");
1119
1120 if (api->match_icmp_type_num)
1121 INCREMENT_DISPLAY(ptr, nb_items);
1122 for (i = 0; i < api->match_icmp_type_num; i++)
1123 ptr += sprintf_bgp_pbr_match_val(ptr, &api->icmp_type[i],
1124 i > 0 ? NULL : "@icmptype ");
1125
1126 if (api->match_icmp_code_num)
1127 INCREMENT_DISPLAY(ptr, nb_items);
1128 for (i = 0; i < api->match_icmp_code_num; i++)
1129 ptr += sprintf_bgp_pbr_match_val(ptr, &api->icmp_code[i],
1130 i > 0 ? NULL : "@icmpcode ");
1131
1132 if (api->match_packet_length_num)
1133 INCREMENT_DISPLAY(ptr, nb_items);
1134 for (i = 0; i < api->match_packet_length_num; i++)
1135 ptr += sprintf_bgp_pbr_match_val(ptr, &api->packet_length[i],
1136 i > 0 ? NULL : "@plen ");
1137
1138 if (api->match_dscp_num)
1139 INCREMENT_DISPLAY(ptr, nb_items);
1140 for (i = 0; i < api->match_dscp_num; i++)
1141 ptr += sprintf_bgp_pbr_match_val(ptr, &api->dscp[i],
1142 i > 0 ? NULL : "@dscp ");
1143
1144 if (api->match_tcpflags_num)
1145 INCREMENT_DISPLAY(ptr, nb_items);
1146 for (i = 0; i < api->match_tcpflags_num; i++)
1147 ptr += sprintf_bgp_pbr_match_val(ptr, &api->tcpflags[i],
1148 i > 0 ? NULL : "@tcpflags ");
1149
588ec356 1150 if (api->match_fragment_num)
b46b6f1a 1151 INCREMENT_DISPLAY(ptr, nb_items);
588ec356
PG		 1152 for (i = 0; i < api->match_fragment_num; i++)
1153 ptr += sprintf_bgp_pbr_match_val(ptr, &api->fragment[i],
1154 i > 0 ? NULL : "@fragment ");
b46b6f1a
PG		 1155 if (!nb_items)
1156 ptr = return_string;
1157 else
1158 ptr += sprintf(ptr, "; ");
1159 if (api->action_num)
1160 ptr += sprintf(ptr, "SET : ");
1161 nb_items = 0;
1162 for (i = 0; i < api->action_num; i++) {
1163 switch (api->actions[i].action) {
1164 case ACTION_TRAFFICRATE:
1165 INCREMENT_DISPLAY(ptr, nb_items);
1166 ptr += sprintf(ptr, "@set rate %f",
1167 api->actions[i].u.r.rate);
1168 break;
1169 case ACTION_TRAFFIC_ACTION:
1170 INCREMENT_DISPLAY(ptr, nb_items);
1171 ptr += sprintf(ptr, "@action ");
1172 if (api->actions[i].u.za.filter
1173 & TRAFFIC_ACTION_TERMINATE)
1174 ptr += sprintf(ptr,
1175 " terminate (apply filter(s))");
1176 if (api->actions[i].u.za.filter
1177 & TRAFFIC_ACTION_DISTRIBUTE)
1178 ptr += sprintf(ptr, " distribute");
1179 if (api->actions[i].u.za.filter
1180 & TRAFFIC_ACTION_SAMPLE)
1181 ptr += sprintf(ptr, " sample");
1182 break;
1183 case ACTION_REDIRECT_IP:
1184 INCREMENT_DISPLAY(ptr, nb_items);
1185 char local_buff[INET_ADDRSTRLEN];
1186
1187 if (inet_ntop(AF_INET,
1188 &api->actions[i].u.zr.redirect_ip_v4,
1189 local_buff, INET_ADDRSTRLEN) != NULL)
1190 ptr += sprintf(ptr,
1191 "@redirect ip nh %s", local_buff);
1192 break;
1193 case ACTION_REDIRECT:
1194 INCREMENT_DISPLAY(ptr, nb_items);
1195 ptr += sprintf(ptr, "@redirect vrf %u",
1196 api->actions[i].u.redirect_vrf);
1197 break;
1198 case ACTION_MARKING:
1199 INCREMENT_DISPLAY(ptr, nb_items);
1200 ptr += sprintf(ptr, "@set dscp %u",
1201 api->actions[i].u.marking_dscp);
1202 break;
1203 default:
1204 break;
1205 }
1206 }
1207 zlog_info("%s", return_string);
1208}
45918cfb 1209
d114b0d7
PG		 1210static void bgp_pbr_flush_entry(struct bgp *bgp, struct bgp_pbr_action *bpa,
1211 struct bgp_pbr_match *bpm,
1212 struct bgp_pbr_match_entry *bpme)
1213{
1214 /* if bpme is null, bpm is also null
1215 */
1216 if (bpme == NULL)
1217 return;
1218 /* ipset del entry */
1219 if (bpme->installed) {
1220 bgp_send_pbr_ipset_entry_match(bpme, false);
1221 bpme->installed = false;
1222 bpme->backpointer = NULL;
9b6d8fcf
DS		 1223 if (bpme->path) {
1224 struct bgp_path_info *path;
4b7e6066 1225 struct bgp_path_info_extra *extra;
b588b642 1226
18ee8310 1227 /* unlink bgp_path_info to bpme */
9b6d8fcf
DS		 1228 path = (struct bgp_path_info *)bpme->path;
1229 extra = bgp_path_info_extra_get(path);
c26edcda
PG		 1230 if (extra->bgp_fs_pbr)
1231 listnode_delete(extra->bgp_fs_pbr, bpme);
9b6d8fcf 1232 bpme->path = NULL;
b588b642 1233 }
d114b0d7
PG		 1234 }
1235 hash_release(bpm->entry_hash, bpme);
1236 if (hashcount(bpm->entry_hash) == 0) {
1237 /* delete iptable entry first */
1238 /* then delete ipset match */
1239 if (bpm->installed) {
1240 if (bpm->installed_in_iptable) {
1241 bgp_send_pbr_iptable(bpm->action,
1242 bpm, false);
1243 bpm->installed_in_iptable = false;
a6b07429 1244 bpm->action->refcnt--;
d114b0d7
PG		 1245 }
1246 bgp_send_pbr_ipset_match(bpm, false);
1247 bpm->installed = false;
1248 bpm->action = NULL;
1249 }
1250 hash_release(bgp->pbr_match_hash, bpm);
1251 /* XXX release pbr_match_action if not used
1252 * note that drop does not need to call send_pbr_action
1253 */
1254 }
a6b07429
PG		 1255 if (bpa->refcnt == 0) {
1256 if (bpa->installed && bpa->table_id != 0) {
1257 bgp_send_pbr_rule_action(bpa, false);
1258 bgp_zebra_announce_default(bpa->bgp, &(bpa->nh),
1259 AFI_IP,
1260 bpa->table_id,
1261 false);
6ee20355 1262 bpa->installed = false;
a6b07429
PG		 1263 }
1264 }
d114b0d7
PG		 1265}
1266
1267struct bgp_pbr_match_entry_remain {
1268 struct bgp_pbr_match_entry *bpme_to_match;
1269 struct bgp_pbr_match_entry *bpme_found;
1270};
1271
1272static int bgp_pbr_get_remaining_entry(struct hash_backet *backet, void *arg)
1273{
1274 struct bgp_pbr_match *bpm = (struct bgp_pbr_match *)backet->data;
1275 struct bgp_pbr_match_entry_remain *bpmer =
1276 (struct bgp_pbr_match_entry_remain *)arg;
1277 struct bgp_pbr_match *bpm_temp;
1278 struct bgp_pbr_match_entry *bpme = bpmer->bpme_to_match;
1279
1280 if (!bpme->backpointer ||
1281 bpm == bpme->backpointer ||
1282 bpme->backpointer->action == bpm->action)
1283 return HASHWALK_CONTINUE;
1284 /* ensure bpm other characteristics are equal */
1285 bpm_temp = bpme->backpointer;
1286 if (bpm_temp->vrf_id != bpm->vrf_id ||
1287 bpm_temp->type != bpm->type ||
836b6953
PG		 1288 bpm_temp->flags != bpm->flags ||
1289 bpm_temp->tcp_flags != bpm->tcp_flags ||
1290 bpm_temp->tcp_mask_flags != bpm->tcp_mask_flags ||
1291 bpm_temp->pkt_len_min != bpm->pkt_len_min ||
1292 bpm_temp->pkt_len_max != bpm->pkt_len_max ||
1293 bpm_temp->dscp_value != bpm->dscp_value ||
1294 bpm_temp->fragment != bpm->fragment)
d114b0d7
PG		 1295 return HASHWALK_CONTINUE;
1296
1297 /* look for remaining bpme */
1298 bpmer->bpme_found = hash_lookup(bpm->entry_hash, bpme);
1299 if (!bpmer->bpme_found)
1300 return HASHWALK_CONTINUE;
1301 return HASHWALK_ABORT;
1302}
1303
9b6d8fcf
DS		 1304static void bgp_pbr_policyroute_remove_from_zebra_unit(
1305 struct bgp *bgp, struct bgp_path_info *path, struct bgp_pbr_filter *bpf)
d114b0d7
PG		 1306{
1307 struct bgp_pbr_match temp;
1308 struct bgp_pbr_match_entry temp2;
1309 struct bgp_pbr_match *bpm;
1310 struct bgp_pbr_match_entry *bpme;
1311 struct bgp_pbr_match_entry_remain bpmer;
0e867886
PG		 1312 struct bgp_pbr_range_port *src_port;
1313 struct bgp_pbr_range_port *dst_port;
1314 struct bgp_pbr_range_port *pkt_len;
1315
1316 if (!bpf)
1317 return;
1318 src_port = bpf->src_port;
1319 dst_port = bpf->dst_port;
1320 pkt_len = bpf->pkt_len;
d114b0d7 1321
064a9d52
PG		 1322 if (BGP_DEBUG(zebra, ZEBRA))
1323 bgp_pbr_dump_entry(bpf, false);
1324
d114b0d7
PG		 1325 /* as we don't know information from EC
1326 * look for bpm that have the bpm
1327 * with vrf_id characteristics
1328 */
1329 memset(&temp2, 0, sizeof(temp2));
1330 memset(&temp, 0, sizeof(temp));
0e867886 1331 if (bpf->src) {
d114b0d7 1332 temp.flags |= MATCH_IP_SRC_SET;
0e867886 1333 prefix_copy(&temp2.src, bpf->src);
d114b0d7
PG		 1334 } else
1335 temp2.src.family = AF_INET;
0e867886 1336 if (bpf->dst) {
d114b0d7 1337 temp.flags |= MATCH_IP_DST_SET;
0e867886 1338 prefix_copy(&temp2.dst, bpf->dst);
d114b0d7
PG		 1339 } else
1340 temp2.dst.family = AF_INET;
3bed2363
PG		 1341 if (src_port && (src_port->min_port || bpf->protocol == IPPROTO_ICMP)) {
1342 if (bpf->protocol == IPPROTO_ICMP)
1343 temp.flags |= MATCH_ICMP_SET;
1de7dfff
PG		 1344 temp.flags |= MATCH_PORT_SRC_SET;
1345 temp2.src_port_min = src_port->min_port;
1346 if (src_port->max_port) {
1347 temp.flags |= MATCH_PORT_SRC_RANGE_SET;
1348 temp2.src_port_max = src_port->max_port;
1349 }
1350 }
3bed2363
PG		 1351 if (dst_port && (dst_port->min_port || bpf->protocol == IPPROTO_ICMP)) {
1352 if (bpf->protocol == IPPROTO_ICMP)
1353 temp.flags |= MATCH_ICMP_SET;
1de7dfff
PG		 1354 temp.flags |= MATCH_PORT_DST_SET;
1355 temp2.dst_port_min = dst_port->min_port;
1356 if (dst_port->max_port) {
1357 temp.flags |= MATCH_PORT_DST_RANGE_SET;
1358 temp2.dst_port_max = dst_port->max_port;
1359 }
1360 }
0e867886 1361 temp2.proto = bpf->protocol;
1de7dfff 1362
cfaf18ce 1363 if (pkt_len) {
83360720 1364 temp.pkt_len_min = pkt_len->min_port;
cfaf18ce
PG		 1365 if (pkt_len->max_port)
1366 temp.pkt_len_max = pkt_len->max_port;
1367 } else if (bpf->pkt_len_val) {
1368 if (bpf->pkt_len_val->mask)
1369 temp.flags |= MATCH_PKT_LEN_INVERSE_SET;
1370 temp.pkt_len_min = bpf->pkt_len_val->val;
1371 }
2da7d62e
PG		 1372 if (bpf->tcp_flags) {
1373 temp.tcp_flags = bpf->tcp_flags->val;
1374 temp.tcp_mask_flags = bpf->tcp_flags->mask;
1375 }
4977bd6c
PG		 1376 if (bpf->dscp) {
1377 if (bpf->dscp->mask)
1378 temp.flags |= MATCH_DSCP_INVERSE_SET;
1379 else
1380 temp.flags |= MATCH_DSCP_SET;
1381 temp.dscp_value = bpf->dscp->val;
1382 }
6f5617d8
PG		 1383 if (bpf->fragment) {
1384 if (bpf->fragment->mask)
1385 temp.flags |= MATCH_FRAGMENT_INVERSE_SET;
1386 temp.fragment = bpf->fragment->val;
1387 }
83360720 1388
0e867886 1389 if (bpf->src == NULL || bpf->dst == NULL) {
1de7dfff
PG		 1390 if (temp.flags & (MATCH_PORT_DST_SET | MATCH_PORT_SRC_SET))
1391 temp.type = IPSET_NET_PORT;
1392 else
1393 temp.type = IPSET_NET;
1394 } else {
1395 if (temp.flags & (MATCH_PORT_DST_SET | MATCH_PORT_SRC_SET))
1396 temp.type = IPSET_NET_PORT_NET;
1397 else
1398 temp.type = IPSET_NET_NET;
1399 }
0e867886 1400 if (bpf->vrf_id == VRF_UNKNOWN) /* XXX case BGP destroy */
d114b0d7
PG		 1401 temp.vrf_id = 0;
1402 else
0e867886 1403 temp.vrf_id = bpf->vrf_id;
d114b0d7
PG		 1404 bpme = &temp2;
1405 bpm = &temp;
1406 bpme->backpointer = bpm;
1407 /* right now, a previous entry may already exist
1408 * flush previous entry if necessary
1409 */
1410 bpmer.bpme_to_match = bpme;
1411 bpmer.bpme_found = NULL;
1412 hash_walk(bgp->pbr_match_hash, bgp_pbr_get_remaining_entry, &bpmer);
1413 if (bpmer.bpme_found) {
1414 static struct bgp_pbr_match *local_bpm;
1415 static struct bgp_pbr_action *local_bpa;
1416
1417 local_bpm = bpmer.bpme_found->backpointer;
1418 local_bpa = local_bpm->action;
1419 bgp_pbr_flush_entry(bgp, local_bpa,
1420 local_bpm, bpmer.bpme_found);
1421 }
1422}
1423
e45aea59
PG		 1424static uint8_t bgp_pbr_next_type_entry(uint8_t type_entry)
1425{
1426 if (type_entry == FLOWSPEC_TCP_FLAGS)
1427 return FLOWSPEC_DSCP;
1428 if (type_entry == FLOWSPEC_DSCP)
1429 return FLOWSPEC_PKT_LEN;
1430 if (type_entry == FLOWSPEC_PKT_LEN)
1431 return FLOWSPEC_FRAGMENT;
da3fa383
PG		 1432 if (type_entry == FLOWSPEC_FRAGMENT)
1433 return FLOWSPEC_ICMP_TYPE;
e45aea59
PG		 1434 return 0;
1435}
1436
9b6d8fcf 1437static void bgp_pbr_icmp_action(struct bgp *bgp, struct bgp_path_info *path,
4b7e6066
DS		 1438 struct bgp_pbr_filter *bpf,
1439 struct bgp_pbr_or_filter *bpof, bool add,
1440 struct nexthop *nh, float *rate)
da3fa383
PG		 1441{
1442 struct bgp_pbr_range_port srcp, dstp;
1443 struct bgp_pbr_val_mask *icmp_type, *icmp_code;
1444 struct listnode *tnode, *cnode;
1445
1446 if (!bpf)
1447 return;
1448 if (bpf->protocol != IPPROTO_ICMP)
1449 return;
1450 bpf->src_port = &srcp;
1451 bpf->dst_port = &dstp;
1452 /* parse icmp type and lookup appropriate icmp code
1453 * if no icmp code found, create as many entryes as
1454 * there are listed icmp codes for that icmp type
1455 */
1456 if (!bpof->icmp_type) {
1457 srcp.min_port = 0;
1458 srcp.max_port = 255;
1459 for (ALL_LIST_ELEMENTS_RO(bpof->icmp_code, cnode, icmp_code)) {
1460 dstp.min_port = icmp_code->val;
1461 if (add)
9b6d8fcf
DS		 1462 bgp_pbr_policyroute_add_to_zebra_unit(
1463 bgp, path, bpf, nh, rate);
da3fa383
PG		 1464 else
1465 bgp_pbr_policyroute_remove_from_zebra_unit(
9b6d8fcf 1466 bgp, path, bpf);
da3fa383
PG		 1467 }
1468 return;
1469 }
1470 for (ALL_LIST_ELEMENTS_RO(bpof->icmp_type, tnode, icmp_type)) {
1471 srcp.min_port = icmp_type->val;
1472 srcp.max_port = 0;
1473 dstp.max_port = 0;
1474 /* only icmp type. create an entry only with icmp type */
1475 if (!bpof->icmp_code) {
1476 /* icmp type is not one of the above
1477 * forge an entry only based on the icmp type
1478 */
1479 dstp.min_port = 0;
1480 dstp.max_port = 255;
1481 if (add)
1482 bgp_pbr_policyroute_add_to_zebra_unit(
9b6d8fcf 1483 bgp, path, bpf, nh, rate);
da3fa383 1484 else
9b6d8fcf
DS		 1485 bgp_pbr_policyroute_remove_from_zebra_unit(
1486 bgp, path, bpf);
da3fa383
PG		 1487 continue;
1488 }
1489 for (ALL_LIST_ELEMENTS_RO(bpof->icmp_code, cnode, icmp_code)) {
1490 dstp.min_port = icmp_code->val;
1491 if (add)
1492 bgp_pbr_policyroute_add_to_zebra_unit(
9b6d8fcf 1493 bgp, path, bpf, nh, rate);
da3fa383
PG		 1494 else
1495 bgp_pbr_policyroute_remove_from_zebra_unit(
9b6d8fcf 1496 bgp, path, bpf);
da3fa383
PG		 1497 }
1498 }
1499}
1500
4b7e6066 1501static void bgp_pbr_policyroute_remove_from_zebra_recursive(
9b6d8fcf
DS		 1502 struct bgp *bgp, struct bgp_path_info *path, struct bgp_pbr_filter *bpf,
1503 struct bgp_pbr_or_filter *bpof, uint8_t type_entry)
56707a36
PG		 1504{
1505 struct listnode *node, *nnode;
1506 struct bgp_pbr_val_mask *valmask;
1507 uint8_t next_type_entry;
1508 struct list *orig_list;
1509 struct bgp_pbr_val_mask **target_val;
1510
d90b788e
A		 1511 if (type_entry == 0) {
1512 bgp_pbr_policyroute_remove_from_zebra_unit(bgp, path, bpf);
1513 return;
1514 }
e45aea59 1515 next_type_entry = bgp_pbr_next_type_entry(type_entry);
56707a36 1516 if (type_entry == FLOWSPEC_TCP_FLAGS && bpof->tcpflags) {
56707a36
PG		 1517 orig_list = bpof->tcpflags;
1518 target_val = &bpf->tcp_flags;
1519 } else if (type_entry == FLOWSPEC_DSCP && bpof->dscp) {
56707a36
PG		 1520 orig_list = bpof->dscp;
1521 target_val = &bpf->dscp;
cfaf18ce 1522 } else if (type_entry == FLOWSPEC_PKT_LEN && bpof->pkt_len) {
cfaf18ce
PG		 1523 orig_list = bpof->pkt_len;
1524 target_val = &bpf->pkt_len_val;
6f5617d8 1525 } else if (type_entry == FLOWSPEC_FRAGMENT && bpof->fragment) {
6f5617d8
PG		 1526 orig_list = bpof->fragment;
1527 target_val = &bpf->fragment;
da3fa383
PG		 1528 } else if (type_entry == FLOWSPEC_ICMP_TYPE &&
1529 (bpof->icmp_type || bpof->icmp_code)) {
1530 /* enumerate list for icmp - must be last one */
9b6d8fcf 1531 bgp_pbr_icmp_action(bgp, path, bpf, bpof, false, NULL, NULL);
da3fa383 1532 return;
56707a36 1533 } else {
d90b788e 1534 bgp_pbr_policyroute_remove_from_zebra_recursive(
9b6d8fcf 1535 bgp, path, bpf, bpof, next_type_entry);
d90b788e 1536 return;
56707a36
PG		 1537 }
1538 for (ALL_LIST_ELEMENTS(orig_list, node, nnode, valmask)) {
1539 *target_val = valmask;
9b6d8fcf
DS		 1540 bgp_pbr_policyroute_remove_from_zebra_recursive(
1541 bgp, path, bpf, bpof, next_type_entry);
56707a36
PG		 1542 }
1543}
1544
4b7e6066 1545static void bgp_pbr_policyroute_remove_from_zebra(
9b6d8fcf
DS		 1546 struct bgp *bgp, struct bgp_path_info *path, struct bgp_pbr_filter *bpf,
1547 struct bgp_pbr_or_filter *bpof)
9bba1455 1548{
d90b788e
A		 1549 if (!bpof) {
1550 bgp_pbr_policyroute_remove_from_zebra_unit(bgp, path, bpf);
1551 return;
1552 }
56707a36 1553 if (bpof->tcpflags)
9b6d8fcf
DS		 1554 bgp_pbr_policyroute_remove_from_zebra_recursive(
1555 bgp, path, bpf, bpof, FLOWSPEC_TCP_FLAGS);
56707a36 1556 else if (bpof->dscp)
9b6d8fcf
DS		 1557 bgp_pbr_policyroute_remove_from_zebra_recursive(
1558 bgp, path, bpf, bpof, FLOWSPEC_DSCP);
cfaf18ce 1559 else if (bpof->pkt_len)
9b6d8fcf
DS		 1560 bgp_pbr_policyroute_remove_from_zebra_recursive(
1561 bgp, path, bpf, bpof, FLOWSPEC_PKT_LEN);
6f5617d8 1562 else if (bpof->fragment)
9b6d8fcf
DS		 1563 bgp_pbr_policyroute_remove_from_zebra_recursive(
1564 bgp, path, bpf, bpof, FLOWSPEC_FRAGMENT);
da3fa383 1565 else if (bpof->icmp_type || bpof->icmp_code)
9b6d8fcf
DS		 1566 bgp_pbr_policyroute_remove_from_zebra_recursive(
1567 bgp, path, bpf, bpof, FLOWSPEC_ICMP_TYPE);
56707a36 1568 else
9b6d8fcf 1569 bgp_pbr_policyroute_remove_from_zebra_unit(bgp, path, bpf);
56707a36
PG		 1570 /* flush bpof */
1571 if (bpof->tcpflags)
1572 list_delete_all_node(bpof->tcpflags);
1573 if (bpof->dscp)
1574 list_delete_all_node(bpof->dscp);
cfaf18ce
PG		 1575 if (bpof->pkt_len)
1576 list_delete_all_node(bpof->pkt_len);
6f5617d8
PG		 1577 if (bpof->fragment)
1578 list_delete_all_node(bpof->fragment);
9bba1455
PG		 1579}
1580
064a9d52
PG		 1581static void bgp_pbr_dump_entry(struct bgp_pbr_filter *bpf, bool add)
1582{
1583 struct bgp_pbr_range_port *src_port;
1584 struct bgp_pbr_range_port *dst_port;
1585 struct bgp_pbr_range_port *pkt_len;
1586 char bufsrc[64], bufdst[64];
1587 char buffer[64];
1588 int remaining_len = 0;
1589 char protocol_str[16];
1590
1591 if (!bpf)
1592 return;
1593 src_port = bpf->src_port;
1594 dst_port = bpf->dst_port;
1595 pkt_len = bpf->pkt_len;
1596
1597 protocol_str[0] = '\0';
1598 if (bpf->tcp_flags && bpf->tcp_flags->mask)
1599 bpf->protocol = IPPROTO_TCP;
1600 if (bpf->protocol)
1601 snprintf(protocol_str, sizeof(protocol_str),
1602 "proto %d", bpf->protocol);
1603 buffer[0] = '\0';
1604 if (bpf->protocol == IPPROTO_ICMP && src_port && dst_port)
1605 remaining_len += snprintf(buffer, sizeof(buffer),
1606 "type %d, code %d",
1607 src_port->min_port,
1608 dst_port->min_port);
1609 else if (bpf->protocol == IPPROTO_UDP ||
1610 bpf->protocol == IPPROTO_TCP) {
1611
1612 if (src_port && src_port->min_port)
1613 remaining_len += snprintf(buffer,
1614 sizeof(buffer),
1615 "from [%u:%u]",
1616 src_port->min_port,
1617 src_port->max_port ?
1618 src_port->max_port :
1619 src_port->min_port);
1620 if (dst_port && dst_port->min_port)
1621 remaining_len += snprintf(buffer +
1622 remaining_len,
1623 sizeof(buffer)
1624 - remaining_len,
1625 "to [%u:%u]",
1626 dst_port->min_port,
1627 dst_port->max_port ?
1628 dst_port->max_port :
1629 dst_port->min_port);
1630 }
1631 if (pkt_len && (pkt_len->min_port || pkt_len->max_port)) {
1632 remaining_len += snprintf(buffer + remaining_len,
1633 sizeof(buffer)
1634 - remaining_len,
1635 " len [%u:%u]",
1636 pkt_len->min_port,
1637 pkt_len->max_port ?
1638 pkt_len->max_port :
1639 pkt_len->min_port);
1640 } else if (bpf->pkt_len_val) {
1641 remaining_len += snprintf(buffer + remaining_len,
1642 sizeof(buffer)
1643 - remaining_len,
1644 " %s len %u",
1645 bpf->pkt_len_val->mask
1646 ? "!" : "",
1647 bpf->pkt_len_val->val);
1648 }
1649 if (bpf->tcp_flags) {
1650 remaining_len += snprintf(buffer + remaining_len,
1651 sizeof(buffer)
1652 - remaining_len,
1653 "tcpflags %x/%x",
1654 bpf->tcp_flags->val,
1655 bpf->tcp_flags->mask);
1656 }
1657 if (bpf->dscp) {
1658 snprintf(buffer + remaining_len,
1659 sizeof(buffer)
1660 - remaining_len,
1661 "%s dscp %d",
1662 bpf->dscp->mask
1663 ? "!" : "",
1664 bpf->dscp->val);
1665 }
45837bc4 1666 zlog_debug("BGP: %s FS PBR from %s to %s, %s %s",
064a9d52
PG		 1667 add ? "adding" : "removing",
1668 bpf->src == NULL ? "<all>" :
1669 prefix2str(bpf->src, bufsrc, sizeof(bufsrc)),
1670 bpf->dst == NULL ? "<all>" :
1671 prefix2str(bpf->dst, bufdst, sizeof(bufdst)),
1672 protocol_str, buffer);
1673
1674}
1675
9bba1455 1676static void bgp_pbr_policyroute_add_to_zebra_unit(struct bgp *bgp,
9b6d8fcf 1677 struct bgp_path_info *path,
4b7e6066
DS		 1678 struct bgp_pbr_filter *bpf,
1679 struct nexthop *nh,
1680 float *rate)
d114b0d7
PG		 1681{
1682 struct bgp_pbr_match temp;
1683 struct bgp_pbr_match_entry temp2;
1684 struct bgp_pbr_match *bpm;
1685 struct bgp_pbr_match_entry *bpme = NULL;
1686 struct bgp_pbr_action temp3;
1687 struct bgp_pbr_action *bpa = NULL;
1688 struct bgp_pbr_match_entry_remain bpmer;
0e867886
PG		 1689 struct bgp_pbr_range_port *src_port;
1690 struct bgp_pbr_range_port *dst_port;
1691 struct bgp_pbr_range_port *pkt_len;
c26edcda 1692 bool bpme_found = false;
0e867886
PG		 1693
1694 if (!bpf)
1695 return;
1696 src_port = bpf->src_port;
1697 dst_port = bpf->dst_port;
1698 pkt_len = bpf->pkt_len;
d114b0d7 1699
064a9d52
PG		 1700 if (BGP_DEBUG(zebra, ZEBRA))
1701 bgp_pbr_dump_entry(bpf, true);
1702
d114b0d7
PG		 1703 /* look for bpa first */
1704 memset(&temp3, 0, sizeof(temp3));
1705 if (rate)
1706 temp3.rate = *rate;
1707 if (nh)
1708 memcpy(&temp3.nh, nh, sizeof(struct nexthop));
0e867886 1709 temp3.vrf_id = bpf->vrf_id;
d114b0d7
PG		 1710 bpa = hash_get(bgp->pbr_action_hash, &temp3,
1711 bgp_pbr_action_alloc_intern);
1712
1713 if (bpa->fwmark == 0) {
d114b0d7
PG		 1714 /* drop is handled by iptable */
1715 if (nh && nh->type == NEXTHOP_TYPE_BLACKHOLE) {
1716 bpa->table_id = 0;
1717 bpa->installed = true;
1718 } else {
31c28cd7
PG		 1719 bpa->fwmark = bgp_zebra_tm_get_id();
1720 bpa->table_id = bpa->fwmark;
d114b0d7
PG		 1721 bpa->installed = false;
1722 }
a6b07429 1723 bpa->bgp = bgp;
d114b0d7
PG		 1724 bpa->unique = ++bgp_pbr_action_counter_unique;
1725 /* 0 value is forbidden */
1726 bpa->install_in_progress = false;
1727 }
1728
1729 /* then look for bpm */
1730 memset(&temp, 0, sizeof(temp));
0e867886
PG		 1731 temp.vrf_id = bpf->vrf_id;
1732 if (bpf->src)
d114b0d7 1733 temp.flags |= MATCH_IP_SRC_SET;
0e867886 1734 if (bpf->dst)
d114b0d7 1735 temp.flags |= MATCH_IP_DST_SET;
1de7dfff 1736
3bed2363
PG		 1737 if (src_port && (src_port->min_port || bpf->protocol == IPPROTO_ICMP)) {
1738 if (bpf->protocol == IPPROTO_ICMP)
1739 temp.flags |= MATCH_ICMP_SET;
1de7dfff 1740 temp.flags |= MATCH_PORT_SRC_SET;
3bed2363
PG		 1741 }
1742 if (dst_port && (dst_port->min_port || bpf->protocol == IPPROTO_ICMP)) {
1743 if (bpf->protocol == IPPROTO_ICMP)
1744 temp.flags |= MATCH_ICMP_SET;
1de7dfff 1745 temp.flags |= MATCH_PORT_DST_SET;
3bed2363 1746 }
1de7dfff
PG		 1747 if (src_port && src_port->max_port)
1748 temp.flags |= MATCH_PORT_SRC_RANGE_SET;
1749 if (dst_port && dst_port->max_port)
1750 temp.flags |= MATCH_PORT_DST_RANGE_SET;
3bed2363
PG		 1751
1752 if (bpf->src == NULL || bpf->dst == NULL) {
1753 if (temp.flags & (MATCH_PORT_DST_SET | MATCH_PORT_SRC_SET))
1754 temp.type = IPSET_NET_PORT;
1755 else
1756 temp.type = IPSET_NET;
1757 } else {
1758 if (temp.flags & (MATCH_PORT_DST_SET | MATCH_PORT_SRC_SET))
1759 temp.type = IPSET_NET_PORT_NET;
1760 else
1761 temp.type = IPSET_NET_NET;
1762 }
cfaf18ce 1763 if (pkt_len) {
83360720 1764 temp.pkt_len_min = pkt_len->min_port;
cfaf18ce
PG		 1765 if (pkt_len->max_port)
1766 temp.pkt_len_max = pkt_len->max_port;
1767 } else if (bpf->pkt_len_val) {
1768 if (bpf->pkt_len_val->mask)
1769 temp.flags |= MATCH_PKT_LEN_INVERSE_SET;
1770 temp.pkt_len_min = bpf->pkt_len_val->val;
1771 }
2da7d62e
PG		 1772 if (bpf->tcp_flags) {
1773 temp.tcp_flags = bpf->tcp_flags->val;
1774 temp.tcp_mask_flags = bpf->tcp_flags->mask;
1775 }
4977bd6c
PG		 1776 if (bpf->dscp) {
1777 if (bpf->dscp->mask)
1778 temp.flags |= MATCH_DSCP_INVERSE_SET;
1779 else
1780 temp.flags |= MATCH_DSCP_SET;
1781 temp.dscp_value = bpf->dscp->val;
1782 }
6f5617d8
PG		 1783 if (bpf->fragment) {
1784 if (bpf->fragment->mask)
1785 temp.flags |= MATCH_FRAGMENT_INVERSE_SET;
1786 temp.fragment = bpf->fragment->val;
1787 }
d114b0d7
PG		 1788 temp.action = bpa;
1789 bpm = hash_get(bgp->pbr_match_hash, &temp,
1790 bgp_pbr_match_alloc_intern);
1791
1792 /* new, then self allocate ipset_name and unique */
5a430eee 1793 if (bpm->unique == 0) {
d114b0d7
PG		 1794 bpm->unique = ++bgp_pbr_match_counter_unique;
1795 /* 0 value is forbidden */
1796 sprintf(bpm->ipset_name, "match%p", bpm);
1797 bpm->entry_hash = hash_create_size(8,
1798 bgp_pbr_match_entry_hash_key,
1799 bgp_pbr_match_entry_hash_equal,
1800 "Match Entry Hash");
1801 bpm->installed = false;
1802
1803 /* unique2 should be updated too */
1804 bpm->unique2 = ++bgp_pbr_match_iptable_counter_unique;
1805 bpm->installed_in_iptable = false;
1806 bpm->install_in_progress = false;
1807 bpm->install_iptable_in_progress = false;
1808 }
1809
1810 memset(&temp2, 0, sizeof(temp2));
0e867886
PG		 1811 if (bpf->src)
1812 prefix_copy(&temp2.src, bpf->src);
d114b0d7
PG		 1813 else
1814 temp2.src.family = AF_INET;
0e867886
PG		 1815 if (bpf->dst)
1816 prefix_copy(&temp2.dst, bpf->dst);
d114b0d7
PG		 1817 else
1818 temp2.dst.family = AF_INET;
1de7dfff
PG		 1819 temp2.src_port_min = src_port ? src_port->min_port : 0;
1820 temp2.dst_port_min = dst_port ? dst_port->min_port : 0;
1821 temp2.src_port_max = src_port ? src_port->max_port : 0;
1822 temp2.dst_port_max = dst_port ? dst_port->max_port : 0;
0e867886 1823 temp2.proto = bpf->protocol;
5a430eee
PG		 1824 bpme = hash_get(bpm->entry_hash, &temp2,
1825 bgp_pbr_match_entry_alloc_intern);
1826 if (bpme->unique == 0) {
d114b0d7
PG		 1827 bpme->unique = ++bgp_pbr_match_entry_counter_unique;
1828 /* 0 value is forbidden */
1829 bpme->backpointer = bpm;
1830 bpme->installed = false;
1831 bpme->install_in_progress = false;
b588b642 1832 /* link bgp info to bpme */
9b6d8fcf 1833 bpme->path = (void *)path;
c26edcda
PG		 1834 } else
1835 bpme_found = true;
d114b0d7 1836
c26edcda 1837 /* already installed */
5a430eee 1838 if (bpme_found) {
18ee8310 1839 struct bgp_path_info_extra *extra =
9b6d8fcf 1840 bgp_path_info_extra_get(path);
c26edcda
PG		 1841
1842 if (extra && extra->bgp_fs_pbr &&
1843 listnode_lookup(extra->bgp_fs_pbr, bpme)) {
1844 if (BGP_DEBUG(pbr, PBR_ERROR))
9b6d8fcf
DS		 1845 zlog_err(
1846 "%s: entry %p/%p already installed in bgp pbr",
1847 __func__, path, bpme);
c26edcda
PG		 1848 return;
1849 }
1850 }
d114b0d7
PG		 1851 /* BGP FS: append entry to zebra
1852 * - policies are not routing entries and as such
1853 * route replace semantics don't necessarily follow
1854 * through to policy entries
1855 * - because of that, not all policing information will be stored
1856 * into zebra. and non selected policies will be suppressed from zebra
1857 * - as consequence, in order to bring consistency
1858 * a policy will be added, then ifan ecmp policy exists,
1859 * it will be suppressed subsequently
1860 */
1861 /* ip rule add */
1a1f4a4c 1862 if (!bpa->installed && !bpa->install_in_progress) {
d114b0d7 1863 bgp_send_pbr_rule_action(bpa, true);
f7df1907
PG		 1864 bgp_zebra_announce_default(bgp, nh,
1865 AFI_IP, bpa->table_id, true);
1866 }
d114b0d7
PG		 1867
1868 /* ipset create */
6ea591c7 1869 if (!bpm->installed)
d114b0d7
PG		 1870 bgp_send_pbr_ipset_match(bpm, true);
1871 /* ipset add */
6ea591c7 1872 if (!bpme->installed)
d114b0d7
PG		 1873 bgp_send_pbr_ipset_entry_match(bpme, true);
1874
1875 /* iptables */
6ea591c7 1876 if (!bpm->installed_in_iptable)
d114b0d7
PG		 1877 bgp_send_pbr_iptable(bpa, bpm, true);
1878
1879 /* A previous entry may already exist
1880 * flush previous entry if necessary
1881 */
1882 bpmer.bpme_to_match = bpme;
1883 bpmer.bpme_found = NULL;
1884 hash_walk(bgp->pbr_match_hash, bgp_pbr_get_remaining_entry, &bpmer);
1885 if (bpmer.bpme_found) {
1886 static struct bgp_pbr_match *local_bpm;
1887 static struct bgp_pbr_action *local_bpa;
1888
1889 local_bpm = bpmer.bpme_found->backpointer;
1890 local_bpa = local_bpm->action;
1891 bgp_pbr_flush_entry(bgp, local_bpa,
1892 local_bpm, bpmer.bpme_found);
1893 }
1894
1895
1896}
1897
4b7e6066 1898static void bgp_pbr_policyroute_add_to_zebra_recursive(
9b6d8fcf
DS		 1899 struct bgp *bgp, struct bgp_path_info *path, struct bgp_pbr_filter *bpf,
1900 struct bgp_pbr_or_filter *bpof, struct nexthop *nh, float *rate,
1901 uint8_t type_entry)
56707a36
PG		 1902{
1903 struct listnode *node, *nnode;
1904 struct bgp_pbr_val_mask *valmask;
1905 uint8_t next_type_entry;
1906 struct list *orig_list;
1907 struct bgp_pbr_val_mask **target_val;
1908
d90b788e
A		 1909 if (type_entry == 0) {
1910 bgp_pbr_policyroute_add_to_zebra_unit(bgp, path, bpf, nh, rate);
1911 return;
1912 }
e45aea59 1913 next_type_entry = bgp_pbr_next_type_entry(type_entry);
56707a36 1914 if (type_entry == FLOWSPEC_TCP_FLAGS && bpof->tcpflags) {
56707a36
PG		 1915 orig_list = bpof->tcpflags;
1916 target_val = &bpf->tcp_flags;
1917 } else if (type_entry == FLOWSPEC_DSCP && bpof->dscp) {
56707a36
PG		 1918 orig_list = bpof->dscp;
1919 target_val = &bpf->dscp;
cfaf18ce 1920 } else if (type_entry == FLOWSPEC_PKT_LEN && bpof->pkt_len) {
cfaf18ce
PG		 1921 orig_list = bpof->pkt_len;
1922 target_val = &bpf->pkt_len_val;
6f5617d8 1923 } else if (type_entry == FLOWSPEC_FRAGMENT && bpof->fragment) {
6f5617d8
PG		 1924 orig_list = bpof->fragment;
1925 target_val = &bpf->fragment;
da3fa383
PG		 1926 } else if (type_entry == FLOWSPEC_ICMP_TYPE &&
1927 (bpof->icmp_type || bpof->icmp_code)) {
1928 /* enumerate list for icmp - must be last one */
9b6d8fcf 1929 bgp_pbr_icmp_action(bgp, path, bpf, bpof, true, nh, rate);
da3fa383 1930 return;
56707a36 1931 } else {
d90b788e 1932 bgp_pbr_policyroute_add_to_zebra_recursive(
9b6d8fcf 1933 bgp, path, bpf, bpof, nh, rate, next_type_entry);
d90b788e 1934 return;
56707a36
PG		 1935 }
1936 for (ALL_LIST_ELEMENTS(orig_list, node, nnode, valmask)) {
1937 *target_val = valmask;
9b6d8fcf
DS		 1938 bgp_pbr_policyroute_add_to_zebra_recursive(
1939 bgp, path, bpf, bpof, nh, rate, next_type_entry);
56707a36
PG		 1940 }
1941}
1942
9bba1455 1943static void bgp_pbr_policyroute_add_to_zebra(struct bgp *bgp,
9b6d8fcf 1944 struct bgp_path_info *path,
4b7e6066
DS		 1945 struct bgp_pbr_filter *bpf,
1946 struct bgp_pbr_or_filter *bpof,
1947 struct nexthop *nh, float *rate)
9bba1455 1948{
d90b788e
A		 1949 if (!bpof) {
1950 bgp_pbr_policyroute_add_to_zebra_unit(bgp, path, bpf, nh, rate);
1951 return;
1952 }
56707a36 1953 if (bpof->tcpflags)
9b6d8fcf
DS		 1954 bgp_pbr_policyroute_add_to_zebra_recursive(
1955 bgp, path, bpf, bpof, nh, rate, FLOWSPEC_TCP_FLAGS);
56707a36 1956 else if (bpof->dscp)
9b6d8fcf
DS		 1957 bgp_pbr_policyroute_add_to_zebra_recursive(
1958 bgp, path, bpf, bpof, nh, rate, FLOWSPEC_DSCP);
cfaf18ce 1959 else if (bpof->pkt_len)
9b6d8fcf
DS		 1960 bgp_pbr_policyroute_add_to_zebra_recursive(
1961 bgp, path, bpf, bpof, nh, rate, FLOWSPEC_PKT_LEN);
6f5617d8 1962 else if (bpof->fragment)
9b6d8fcf
DS		 1963 bgp_pbr_policyroute_add_to_zebra_recursive(
1964 bgp, path, bpf, bpof, nh, rate, FLOWSPEC_FRAGMENT);
da3fa383 1965 else if (bpof->icmp_type || bpof->icmp_code)
9b6d8fcf
DS		 1966 bgp_pbr_policyroute_add_to_zebra_recursive(
1967 bgp, path, bpf, bpof, nh, rate, FLOWSPEC_ICMP_TYPE);
56707a36 1968 else
9b6d8fcf 1969 bgp_pbr_policyroute_add_to_zebra_unit(bgp, path, bpf, nh, rate);
56707a36
PG		 1970 /* flush bpof */
1971 if (bpof->tcpflags)
1972 list_delete_all_node(bpof->tcpflags);
1973 if (bpof->dscp)
1974 list_delete_all_node(bpof->dscp);
cfaf18ce
PG		 1975 if (bpof->pkt_len)
1976 list_delete_all_node(bpof->pkt_len);
6f5617d8
PG		 1977 if (bpof->fragment)
1978 list_delete_all_node(bpof->fragment);
da3fa383
PG		 1979 if (bpof->icmp_type)
1980 list_delete_all_node(bpof->icmp_type);
1981 if (bpof->icmp_code)
1982 list_delete_all_node(bpof->icmp_code);
932404b7
PG		 1983}
1984
9b6d8fcf 1985static void bgp_pbr_handle_entry(struct bgp *bgp, struct bgp_path_info *path,
4b7e6066 1986 struct bgp_pbr_entry_main *api, bool add)
d114b0d7
PG		 1987{
1988 struct nexthop nh;
1989 int i = 0;
1990 int continue_loop = 1;
1991 float rate = 0;
1992 struct prefix *src = NULL, *dst = NULL;
1de7dfff
PG		 1993 uint8_t proto = 0;
1994 struct bgp_pbr_range_port *srcp = NULL, *dstp = NULL;
932404b7 1995 struct bgp_pbr_range_port range, range_icmp_code;
83360720 1996 struct bgp_pbr_range_port pkt_len;
0e867886 1997 struct bgp_pbr_filter bpf;
c5ee26cc
PG		 1998 uint8_t kind_enum;
1999 struct bgp_pbr_or_filter bpof;
9bba1455 2000 struct bgp_pbr_val_mask bpvm;
d114b0d7 2001
8cda9106 2002 memset(&nh, 0, sizeof(struct nexthop));
0e867886 2003 memset(&bpf, 0, sizeof(struct bgp_pbr_filter));
c5ee26cc 2004 memset(&bpof, 0, sizeof(struct bgp_pbr_or_filter));
d114b0d7
PG		 2005 if (api->match_bitmask & PREFIX_SRC_PRESENT)
2006 src = &api->src_prefix;
2007 if (api->match_bitmask & PREFIX_DST_PRESENT)
2008 dst = &api->dst_prefix;
2009 memset(&nh, 0, sizeof(struct nexthop));
2010 nh.vrf_id = VRF_UNKNOWN;
1de7dfff
PG		 2011 if (api->match_protocol_num)
2012 proto = (uint8_t)api->protocol[0].value;
2013 /* if match_port is selected, then either src or dst port will be parsed
2014 * but not both at the same time
2015 */
2016 if (api->match_port_num >= 1) {
2017 bgp_pbr_extract(api->port,
2018 api->match_port_num,
2019 &range);
2020 srcp = dstp = &range;
2021 } else if (api->match_src_port_num >= 1) {
2022 bgp_pbr_extract(api->src_port,
2023 api->match_src_port_num,
2024 &range);
2025 srcp = &range;
2026 dstp = NULL;
2027 } else if (api->match_dst_port_num >= 1) {
2028 bgp_pbr_extract(api->dst_port,
2029 api->match_dst_port_num,
2030 &range);
2031 dstp = &range;
2032 srcp = NULL;
2033 }
932404b7
PG		 2034 if (api->match_icmp_type_num >= 1) {
2035 proto = IPPROTO_ICMP;
da3fa383
PG		 2036 if (bgp_pbr_extract(api->icmp_type,
2037 api->match_icmp_type_num,
2038 &range))
932404b7 2039 srcp = &range;
da3fa383
PG		 2040 else {
2041 bpof.icmp_type = list_new();
2042 bgp_pbr_extract_enumerate(api->icmp_type,
2043 api->match_icmp_type_num,
2044 OPERATOR_UNARY_OR,
2045 bpof.icmp_type,
2046 FLOWSPEC_ICMP_TYPE);
932404b7
PG		 2047 }
2048 }
2049 if (api->match_icmp_code_num >= 1) {
2050 proto = IPPROTO_ICMP;
da3fa383
PG		 2051 if (bgp_pbr_extract(api->icmp_code,
2052 api->match_icmp_code_num,
2053 &range_icmp_code))
932404b7 2054 dstp = &range_icmp_code;
da3fa383
PG		 2055 else {
2056 bpof.icmp_code = list_new();
2057 bgp_pbr_extract_enumerate(api->icmp_code,
2058 api->match_icmp_code_num,
2059 OPERATOR_UNARY_OR,
2060 bpof.icmp_code,
2061 FLOWSPEC_ICMP_CODE);
932404b7
PG		 2062 }
2063 }
2da7d62e 2064
c5ee26cc
PG		 2065 if (api->match_tcpflags_num) {
2066 kind_enum = bgp_pbr_match_val_get_operator(api->tcpflags,
2067 api->match_tcpflags_num);
2068 if (kind_enum == OPERATOR_UNARY_AND) {
9bba1455 2069 bpf.tcp_flags = &bpvm;
c5ee26cc
PG		 2070 bgp_pbr_extract_enumerate(api->tcpflags,
2071 api->match_tcpflags_num,
35703998
PG		 2072 OPERATOR_UNARY_AND,
2073 bpf.tcp_flags,
2074 FLOWSPEC_TCP_FLAGS);
c5ee26cc
PG		 2075 } else if (kind_enum == OPERATOR_UNARY_OR) {
2076 bpof.tcpflags = list_new();
2077 bgp_pbr_extract_enumerate(api->tcpflags,
2078 api->match_tcpflags_num,
35703998
PG		 2079 OPERATOR_UNARY_OR,
2080 bpof.tcpflags,
2081 FLOWSPEC_TCP_FLAGS);
c5ee26cc
PG		 2082 }
2083 }
cfaf18ce
PG		 2084 if (api->match_packet_length_num) {
2085 bool ret;
2086
2087 ret = bgp_pbr_extract(api->packet_length,
2088 api->match_packet_length_num,
2089 &pkt_len);
2090 if (ret)
2091 bpf.pkt_len = &pkt_len;
2092 else {
2093 bpof.pkt_len = list_new();
2094 bgp_pbr_extract_enumerate(api->packet_length,
2095 api->match_packet_length_num,
2096 OPERATOR_UNARY_OR,
2097 bpof.pkt_len,
2098 FLOWSPEC_PKT_LEN);
2099 }
2da7d62e 2100 }
4977bd6c 2101 if (api->match_dscp_num >= 1) {
35703998
PG		 2102 bpof.dscp = list_new();
2103 bgp_pbr_extract_enumerate(api->dscp, api->match_dscp_num,
2104 OPERATOR_UNARY_OR,
2105 bpof.dscp, FLOWSPEC_DSCP);
4977bd6c 2106 }
6f5617d8
PG		 2107 if (api->match_fragment_num) {
2108 bpof.fragment = list_new();
2109 bgp_pbr_extract_enumerate(api->fragment,
2110 api->match_fragment_num,
2111 OPERATOR_UNARY_OR,
2112 bpof.fragment,
2113 FLOWSPEC_FRAGMENT);
2114 }
0e867886
PG		 2115 bpf.vrf_id = api->vrf_id;
2116 bpf.src = src;
2117 bpf.dst = dst;
2118 bpf.protocol = proto;
0e867886
PG		 2119 bpf.src_port = srcp;
2120 bpf.dst_port = dstp;
d90b788e
A		 2121 if (!add) {
2122 bgp_pbr_policyroute_remove_from_zebra(bgp, path, &bpf, &bpof);
2123 return;
2124 }
d114b0d7
PG		 2125 /* no action for add = true */
2126 for (i = 0; i < api->action_num; i++) {
2127 switch (api->actions[i].action) {
2128 case ACTION_TRAFFICRATE:
2129 /* drop packet */
2130 if (api->actions[i].u.r.rate == 0) {
2131 nh.vrf_id = api->vrf_id;
2132 nh.type = NEXTHOP_TYPE_BLACKHOLE;
9b6d8fcf
DS		 2133 bgp_pbr_policyroute_add_to_zebra(
2134 bgp, path, &bpf, &bpof, &nh, &rate);
d114b0d7
PG		 2135 } else {
2136 /* update rate. can be reentrant */
2137 rate = api->actions[i].u.r.rate;
ac7c35f8 2138 if (BGP_DEBUG(pbr, PBR)) {
d114b0d7 2139 bgp_pbr_print_policy_route(api);
ac7c35f8
PG		 2140 zlog_warn("PBR: ignoring Set action rate %f",
2141 api->actions[i].u.r.rate);
2142 }
d114b0d7
PG		 2143 }
2144 break;
2145 case ACTION_TRAFFIC_ACTION:
2146 if (api->actions[i].u.za.filter
2147 & TRAFFIC_ACTION_SAMPLE) {
ac7c35f8 2148 if (BGP_DEBUG(pbr, PBR)) {
d114b0d7 2149 bgp_pbr_print_policy_route(api);
ac7c35f8
PG		 2150 zlog_warn("PBR: Sample action Ignored");
2151 }
d114b0d7
PG		 2152 }
2153#if 0
2154 if (api->actions[i].u.za.filter
2155 & TRAFFIC_ACTION_DISTRIBUTE) {
ac7c35f8 2156 if (BGP_DEBUG(pbr, PBR)) {
d114b0d7 2157 bgp_pbr_print_policy_route(api);
ac7c35f8
PG		 2158 zlog_warn("PBR: Distribute action Applies");
2159 }
d114b0d7
PG		 2160 continue_loop = 0;
2161 /* continue forwarding entry as before
2162 * no action
2163 */
2164 }
2165#endif /* XXX to confirm behaviour of traffic action. for now , ignore */
2166 /* terminate action: run other filters
2167 */
2168 break;
2169 case ACTION_REDIRECT_IP:
2170 nh.type = NEXTHOP_TYPE_IPV4;
2171 nh.gate.ipv4.s_addr =
2172 api->actions[i].u.zr.redirect_ip_v4.s_addr;
2173 nh.vrf_id = api->vrf_id;
9b6d8fcf 2174 bgp_pbr_policyroute_add_to_zebra(bgp, path, &bpf, &bpof,
da3fa383 2175 &nh, &rate);
d114b0d7
PG		 2176 /* XXX combination with REDIRECT_VRF
2177 * + REDIRECT_NH_IP not done
2178 */
2179 continue_loop = 0;
2180 break;
2181 case ACTION_REDIRECT:
2182 nh.vrf_id = api->actions[i].u.redirect_vrf;
2183 nh.type = NEXTHOP_TYPE_IPV4;
9b6d8fcf 2184 bgp_pbr_policyroute_add_to_zebra(bgp, path, &bpf, &bpof,
da3fa383 2185 &nh, &rate);
d114b0d7
PG		 2186 continue_loop = 0;
2187 break;
2188 case ACTION_MARKING:
ac7c35f8 2189 if (BGP_DEBUG(pbr, PBR)) {
d114b0d7 2190 bgp_pbr_print_policy_route(api);
ac7c35f8
PG		 2191 zlog_warn("PBR: Set DSCP %u Ignored",
2192 api->actions[i].u.marking_dscp);
2193 }
d114b0d7
PG		 2194 break;
2195 default:
2196 break;
2197 }
2198 if (continue_loop == 0)
2199 break;
2200 }
2201}
2202
45918cfb 2203void bgp_pbr_update_entry(struct bgp *bgp, struct prefix *p,
4b7e6066
DS		 2204 struct bgp_path_info *info, afi_t afi, safi_t safi,
2205 bool nlri_update)
45918cfb
PG		 2206{
2207 struct bgp_pbr_entry_main api;
2208
2209 if (afi == AFI_IP6)
2210 return; /* IPv6 not supported */
2211 if (safi != SAFI_FLOWSPEC)
2212 return; /* not supported */
2213 /* Make Zebra API structure. */
2214 memset(&api, 0, sizeof(api));
2215 api.vrf_id = bgp->vrf_id;
2216 api.afi = afi;
2217
6818e7e5 2218 if (!bgp_zebra_tm_chunk_obtained()) {
f146bb54 2219 if (BGP_DEBUG(pbr, PBR_ERROR))
e50f7cfd 2220 flog_err(EC_BGP_TABLE_CHUNK,
1c50c1c0 2221 "%s: table chunk not obtained yet", __func__);
6818e7e5
PG		 2222 return;
2223 }
6818e7e5
PG		 2224
2225 if (bgp_pbr_build_and_validate_entry(p, info, &api) < 0) {
2226 if (BGP_DEBUG(pbr, PBR_ERROR))
e50f7cfd 2227 flog_err(EC_BGP_FLOWSPEC_INSTALLATION,
1c50c1c0
QY		 2228 "%s: cancel updating entry %p in bgp pbr",
2229 __func__, info);
45918cfb
PG		 2230 return;
2231 }
d114b0d7 2232 bgp_pbr_handle_entry(bgp, info, &api, nlri_update);
45918cfb 2233}
4762c213
PG		 2234
2235int bgp_pbr_interface_compare(const struct bgp_pbr_interface *a,
2236 const struct bgp_pbr_interface *b)
2237{
2238 return strcmp(a->name, b->name);
2239}
2240
2241struct bgp_pbr_interface *bgp_pbr_interface_lookup(const char *name,
2242 struct bgp_pbr_interface_head *head)
2243{
2244 struct bgp_pbr_interface pbr_if;
2245
2246 strlcpy(pbr_if.name, name, sizeof(pbr_if.name));
2247 return (RB_FIND(bgp_pbr_interface_head,
2248 head, &pbr_if));
2249}
2250
2251/* this function resets to the default policy routing
2252 * go back to default status
2253 */
2254void bgp_pbr_reset(struct bgp *bgp, afi_t afi)
2255{
2256 struct bgp_pbr_config *bgp_pbr_cfg = bgp->bgp_pbr_cfg;
2257 struct bgp_pbr_interface_head *head;
2258 struct bgp_pbr_interface *pbr_if;
2259
2260 if (!bgp_pbr_cfg || afi != AFI_IP)
2261 return;
2262 head = &(bgp_pbr_cfg->ifaces_by_name_ipv4);
2263
2264 while (!RB_EMPTY(bgp_pbr_interface_head, head)) {
2265 pbr_if = RB_ROOT(bgp_pbr_interface_head, head);
2266 RB_REMOVE(bgp_pbr_interface_head, head, pbr_if);
2267 XFREE(MTYPE_TMP, pbr_if);
2268 }
2269}
FRRouting mirror