]> git.proxmox.com Git - mirror_frr.git/blob - bgpd/bgp_flowspec.c
*: Fixup to use proper list_cmp functions
[mirror_frr.git] / bgpd / bgp_flowspec.c
1 /* BGP FlowSpec for packet handling
2 * Portions:
3 * Copyright (C) 2017 ChinaTelecom SDN Group
4 * Copyright (C) 2018 6WIND
5 *
6 * FRRouting is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2, or (at your option) any
9 * later version.
10 *
11 * FRRouting is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License along
17 * with this program; see the file COPYING; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
19 */
20
21 #include <zebra.h>
22 #include <math.h>
23
24 #include "prefix.h"
25 #include "lib_errors.h"
26
27 #include "bgpd/bgpd.h"
28 #include "bgpd/bgp_route.h"
29 #include "bgpd/bgp_flowspec.h"
30 #include "bgpd/bgp_flowspec_util.h"
31 #include "bgpd/bgp_flowspec_private.h"
32 #include "bgpd/bgp_ecommunity.h"
33 #include "bgpd/bgp_debug.h"
34 #include "bgpd/bgp_errors.h"
35
36 static int bgp_fs_nlri_validate(uint8_t *nlri_content, uint32_t len)
37 {
38 uint32_t offset = 0;
39 int type;
40 int ret = 0, error = 0;
41
42 while (offset < len-1) {
43 type = nlri_content[offset];
44 offset++;
45 switch (type) {
46 case FLOWSPEC_DEST_PREFIX:
47 case FLOWSPEC_SRC_PREFIX:
48 ret = bgp_flowspec_ip_address(
49 BGP_FLOWSPEC_VALIDATE_ONLY,
50 nlri_content + offset,
51 len - offset, NULL, &error);
52 break;
53 case FLOWSPEC_IP_PROTOCOL:
54 case FLOWSPEC_PORT:
55 case FLOWSPEC_DEST_PORT:
56 case FLOWSPEC_SRC_PORT:
57 case FLOWSPEC_ICMP_TYPE:
58 case FLOWSPEC_ICMP_CODE:
59 ret = bgp_flowspec_op_decode(BGP_FLOWSPEC_VALIDATE_ONLY,
60 nlri_content + offset,
61 len - offset, NULL, &error);
62 break;
63 case FLOWSPEC_TCP_FLAGS:
64 case FLOWSPEC_FRAGMENT:
65 ret = bgp_flowspec_bitmask_decode(
66 BGP_FLOWSPEC_VALIDATE_ONLY,
67 nlri_content + offset,
68 len - offset, NULL, &error);
69 break;
70 case FLOWSPEC_PKT_LEN:
71 case FLOWSPEC_DSCP:
72 ret = bgp_flowspec_op_decode(
73 BGP_FLOWSPEC_VALIDATE_ONLY,
74 nlri_content + offset,
75 len - offset, NULL, &error);
76 break;
77 default:
78 error = -1;
79 break;
80 }
81 offset += ret;
82 if (error < 0)
83 break;
84 }
85 return error;
86 }
87
88 int bgp_nlri_parse_flowspec(struct peer *peer, struct attr *attr,
89 struct bgp_nlri *packet, int withdraw)
90 {
91 uint8_t *pnt;
92 uint8_t *lim;
93 afi_t afi;
94 safi_t safi;
95 int psize = 0;
96 struct prefix p;
97 int ret;
98 void *temp;
99
100 /* Start processing the NLRI - there may be multiple in the MP_REACH */
101 pnt = packet->nlri;
102 lim = pnt + packet->length;
103 afi = packet->afi;
104 safi = packet->safi;
105
106 if (afi == AFI_IP6) {
107 flog_err(EC_LIB_DEVELOPMENT, "BGP flowspec IPv6 not supported");
108 return -1;
109 }
110
111 if (packet->length >= FLOWSPEC_NLRI_SIZELIMIT) {
112 flog_err(EC_BGP_FLOWSPEC_PACKET,
113 "BGP flowspec nlri length maximum reached (%u)",
114 packet->length);
115 return -1;
116 }
117
118 for (; pnt < lim; pnt += psize) {
119 /* Clear prefix structure. */
120 memset(&p, 0, sizeof(struct prefix));
121
122 /* All FlowSpec NLRI begin with length. */
123 if (pnt + 1 > lim)
124 return -1;
125
126 psize = *pnt++;
127
128 /* When packet overflow occur return immediately. */
129 if (pnt + psize > lim) {
130 flog_err(
131 EC_BGP_FLOWSPEC_PACKET,
132 "Flowspec NLRI length inconsistent ( size %u seen)",
133 psize);
134 return -1;
135 }
136 if (bgp_fs_nlri_validate(pnt, psize) < 0) {
137 flog_err(
138 EC_BGP_FLOWSPEC_PACKET,
139 "Bad flowspec format or NLRI options not supported");
140 return -1;
141 }
142 p.family = AF_FLOWSPEC;
143 p.prefixlen = 0;
144 /* Flowspec encoding is in bytes */
145 p.u.prefix_flowspec.prefixlen = psize;
146 temp = XCALLOC(MTYPE_TMP, psize);
147 memcpy(temp, pnt, psize);
148 p.u.prefix_flowspec.ptr = (uintptr_t) temp;
149
150 if (BGP_DEBUG(flowspec, FLOWSPEC)) {
151 char return_string[BGP_FLOWSPEC_NLRI_STRING_MAX];
152 char local_string[BGP_FLOWSPEC_NLRI_STRING_MAX*2+16];
153 char ec_string[BGP_FLOWSPEC_NLRI_STRING_MAX];
154 char *s = NULL;
155
156 bgp_fs_nlri_get_string((unsigned char *)
157 p.u.prefix_flowspec.ptr,
158 p.u.prefix_flowspec.prefixlen,
159 return_string,
160 NLRI_STRING_FORMAT_MIN, NULL);
161 snprintf(ec_string, sizeof(ec_string),
162 "EC{none}");
163 if (attr && attr->ecommunity) {
164 s = ecommunity_ecom2str(attr->ecommunity,
165 ECOMMUNITY_FORMAT_ROUTE_MAP, 0);
166 snprintf(ec_string, sizeof(ec_string),
167 "EC{%s}",
168 s == NULL ? "none" : s);
169
170 if (s)
171 ecommunity_strfree(&s);
172 }
173 snprintf(local_string, sizeof(local_string),
174 "FS Rx %s %s %s %s", withdraw ?
175 "Withdraw":"Update",
176 afi2str(afi), return_string,
177 attr != NULL ? ec_string : "");
178 zlog_info("%s", local_string);
179 }
180 /* Process the route. */
181 if (!withdraw)
182 ret = bgp_update(peer, &p, 0, attr,
183 afi, safi,
184 ZEBRA_ROUTE_BGP, BGP_ROUTE_NORMAL,
185 NULL, NULL, 0, 0, NULL);
186 else
187 ret = bgp_withdraw(peer, &p, 0, attr,
188 afi, safi,
189 ZEBRA_ROUTE_BGP, BGP_ROUTE_NORMAL,
190 NULL, NULL, 0, NULL);
191 if (ret) {
192 flog_err(EC_BGP_FLOWSPEC_INSTALLATION,
193 "Flowspec NLRI failed to be %s.",
194 attr ? "added" : "withdrawn");
195 return -1;
196 }
197 }
198 return 0;
199 }