bgpd/bgp_flowspec.c

   1 /* BGP FlowSpec for packet handling
   2  * Portions:
   3  *     Copyright (C) 2017 ChinaTelecom SDN Group
   4  *     Copyright (C) 2018 6WIND
   5  *
   6  * FRRouting is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2, or (at your option) any
   9  * later version.
  10  *
  11  * FRRouting is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License along
  17  * with this program; see the file COPYING; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
  19  */
  20
  21 #include "math.h"
  22
  23 #include <zebra.h>
  24 #include "prefix.h"
  25
  26 #include "bgpd/bgpd.h"
  27 #include "bgpd/bgp_route.h"
  28 #include "bgpd/bgp_flowspec.h"
  29 #include "bgpd/bgp_flowspec_util.h"
  30 #include "bgpd/bgp_flowspec_private.h"
  31 #include "bgpd/bgp_ecommunity.h"
  32 #include "bgpd/bgp_debug.h"
  33
  34 static int bgp_fs_nlri_validate(uint8_t *nlri_content, uint32_t len)
  35 {
  36         uint32_t offset = 0;
  37         int type;
  38         int ret = 0, error = 0;
  39
  40         while (offset < len-1) {
  41                 type = nlri_content[offset];
  42                 offset++;
  43                 switch (type) {
  44                 case FLOWSPEC_DEST_PREFIX:
  45                 case FLOWSPEC_SRC_PREFIX:
  46                         ret = bgp_flowspec_ip_address(
  47                                                 BGP_FLOWSPEC_VALIDATE_ONLY,
  48                                                 nlri_content + offset,
  49                                                 len - offset, NULL, &error);
  50                         break;
  51                 case FLOWSPEC_IP_PROTOCOL:
  52                 case FLOWSPEC_PORT:
  53                 case FLOWSPEC_DEST_PORT:
  54                 case FLOWSPEC_SRC_PORT:
  55                 case FLOWSPEC_ICMP_TYPE:
  56                 case FLOWSPEC_ICMP_CODE:
  57                         ret = bgp_flowspec_op_decode(BGP_FLOWSPEC_VALIDATE_ONLY,
  58                                                    nlri_content + offset,
  59                                                    len - offset, NULL, &error);
  60                         break;
  61                 case FLOWSPEC_TCP_FLAGS:
  62                         ret = bgp_flowspec_tcpflags_decode(
  63                                                    BGP_FLOWSPEC_VALIDATE_ONLY,
  64                                                    nlri_content + offset,
  65                                                    len - offset, NULL, &error);
  66                         break;
  67                 case FLOWSPEC_PKT_LEN:
  68                 case FLOWSPEC_DSCP:
  69                         ret = bgp_flowspec_op_decode(
  70                                                 BGP_FLOWSPEC_VALIDATE_ONLY,
  71                                                 nlri_content + offset,
  72                                                 len - offset, NULL, &error);
  73                         break;
  74                 case FLOWSPEC_FRAGMENT:
  75                         ret = bgp_flowspec_fragment_type_decode(
  76                                                 BGP_FLOWSPEC_VALIDATE_ONLY,
  77                                                 nlri_content + offset,
  78                                                 len - offset, NULL, &error);
  79                         break;
  80                 default:
  81                         error = -1;
  82                         break;
  83                 }
  84                 offset += ret;
  85                 if (error < 0)
  86                         break;
  87         }
  88         return error;
  89 }
  90
  91 int bgp_nlri_parse_flowspec(struct peer *peer, struct attr *attr,
  92                             struct bgp_nlri *packet, int withdraw)
  93 {
  94         uint8_t *pnt;
  95         uint8_t *lim;
  96         afi_t afi;
  97         safi_t safi;
  98         int psize = 0;
  99         uint8_t rlen;
 100         struct prefix p;
 101         int ret;
 102         void *temp;
 103
 104         /* Start processing the NLRI - there may be multiple in the MP_REACH */
 105         pnt = packet->nlri;
 106         lim = pnt + packet->length;
 107         afi = packet->afi;
 108         safi = packet->safi;
 109
 110         if (afi == AFI_IP6) {
 111                 zlog_err("BGP flowspec IPv6 not supported");
 112                 return -1;
 113         }
 114
 115         if (packet->length >= FLOWSPEC_NLRI_SIZELIMIT) {
 116                 zlog_err("BGP flowspec nlri length maximum reached (%u)",
 117                          packet->length);
 118                 return -1;
 119         }
 120
 121         for (; pnt < lim; pnt += psize) {
 122                 /* Clear prefix structure. */
 123                 memset(&p, 0, sizeof(struct prefix));
 124
 125                 /* All FlowSpec NLRI begin with length. */
 126                 if (pnt + 1 > lim)
 127                         return -1;
 128
 129                 psize = rlen = *pnt++;
 130
 131                 /* When packet overflow occur return immediately. */
 132                 if (pnt + psize > lim) {
 133                         zlog_err("Flowspec NLRI length inconsistent ( size %u seen)",
 134                                  psize);
 135                         return -1;
 136                 }
 137                 if (bgp_fs_nlri_validate(pnt, psize) < 0) {
 138                         zlog_err("Bad flowspec format or NLRI options not supported");
 139                         return -1;
 140                 }
 141                 p.family = AF_FLOWSPEC;
 142                 p.prefixlen = 0;
 143                 /* Flowspec encoding is in bytes */
 144                 p.u.prefix_flowspec.prefixlen = psize;
 145                 temp = XCALLOC(MTYPE_TMP, psize);
 146                 memcpy(temp, pnt, psize);
 147                 p.u.prefix_flowspec.ptr = (uintptr_t) temp;
 148
 149                 if (BGP_DEBUG(flowspec, FLOWSPEC)) {
 150                         char return_string[BGP_FLOWSPEC_NLRI_STRING_MAX];
 151                         char local_string[BGP_FLOWSPEC_NLRI_STRING_MAX];
 152                         char ec_string[BGP_FLOWSPEC_NLRI_STRING_MAX];
 153                         char *s = NULL;
 154
 155                         bgp_fs_nlri_get_string((unsigned char *)
 156                                                p.u.prefix_flowspec.ptr,
 157                                                p.u.prefix_flowspec.prefixlen,
 158                                                return_string,
 159                                                NLRI_STRING_FORMAT_MIN, NULL);
 160                         snprintf(ec_string, BGP_FLOWSPEC_NLRI_STRING_MAX,
 161                                  "EC{none}");
 162                         if (attr && attr->ecommunity) {
 163                                 s = ecommunity_ecom2str(attr->ecommunity,
 164                                                 ECOMMUNITY_FORMAT_ROUTE_MAP, 0);
 165                                 snprintf(ec_string,
 166                                          BGP_FLOWSPEC_NLRI_STRING_MAX,
 167                                          "EC{%s}",
 168                                         s == NULL ? "none" : s);
 169
 170                                 if (s)
 171                                         ecommunity_strfree(&s);
 172                         }
 173                         snprintf(local_string, BGP_FLOWSPEC_NLRI_STRING_MAX,
 174                                  "FS Rx %s %s %s %s", withdraw ?
 175                                  "Withdraw":"Update",
 176                                  afi2str(afi), return_string,
 177                                  attr != NULL ? ec_string : "");
 178                         zlog_info("%s", local_string);
 179                 }
 180                 /* Process the route. */
 181                 if (!withdraw)
 182                         ret = bgp_update(peer, &p, 0, attr,
 183                                          afi, safi,
 184                                          ZEBRA_ROUTE_BGP, BGP_ROUTE_NORMAL,
 185                                          NULL, NULL, 0, 0, NULL);
 186                 else
 187                         ret = bgp_withdraw(peer, &p, 0, attr,
 188                                            afi, safi,
 189                                            ZEBRA_ROUTE_BGP, BGP_ROUTE_NORMAL,
 190                                            NULL, NULL, 0, NULL);
 191                 if (ret) {
 192                         zlog_err("Flowspec NLRI failed to be %s.",
 193                                  attr ? "added" : "withdrawn");
 194                         return -1;
 195                 }
 196         }
 197         return 0;
 198 }