1 /* BGP FlowSpec Utilities
3 * Copyright (C) 2017 ChinaTelecom SDN Group
4 * Copyright (C) 2018 6WIND
6 * FRRouting is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2, or (at your option) any
11 * FRRouting is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * General Public License for more details.
16 * You should have received a copy of the GNU General Public License along
17 * with this program; see the file COPYING; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
25 #include "bgp_table.h"
26 #include "bgp_flowspec_util.h"
27 #include "bgp_flowspec_private.h"
30 static void hex2bin(uint8_t *hex
, int *bin
)
35 while (remainder
>= 1 && i
< 8) {
36 bin
[7-i
] = remainder
% 2;
37 remainder
= remainder
/ 2;
44 static int hexstr2num(uint8_t *hexstr
, int len
)
49 for (i
= 0; i
< len
; i
++)
50 num
= hexstr
[i
] + 16*16*num
;
54 /* call bgp_flowspec_op_decode
57 static int bgp_flowspec_call_non_opaque_decode(uint8_t *nlri_content
, int len
,
58 struct bgp_pbr_match_val
*mval
,
59 uint8_t *match_num
, int *error
)
63 ret
= bgp_flowspec_op_decode(
64 BGP_FLOWSPEC_CONVERT_TO_NON_OPAQUE
,
69 zlog_err("%s: flowspec_op_decode error %d",
76 static bool bgp_flowspec_contains_prefix(struct prefix
*pfs
,
82 int ret
= 0, error
= 0;
83 uint8_t *nlri_content
= (uint8_t *)pfs
->u
.prefix_flowspec
.ptr
;
84 size_t len
= pfs
->u
.prefix_flowspec
.prefixlen
;
85 struct prefix compare
;
88 while (offset
< len
-1 && error
>= 0) {
89 type
= nlri_content
[offset
];
92 case FLOWSPEC_DEST_PREFIX
:
93 case FLOWSPEC_SRC_PREFIX
:
94 memset(&compare
, 0, sizeof(struct prefix
));
95 ret
= bgp_flowspec_ip_address(
96 BGP_FLOWSPEC_CONVERT_TO_NON_OPAQUE
,
103 compare
.prefixlen
!= input
->prefixlen
)
105 if (compare
.family
!= input
->family
)
107 if ((input
->family
== AF_INET
) &&
108 IPV4_ADDR_SAME(&input
->u
.prefix4
,
111 if ((input
->family
== AF_INET6
) &&
112 IPV6_ADDR_SAME(&input
->u
.prefix6
.s6_addr
,
113 &compare
.u
.prefix6
.s6_addr
))
116 case FLOWSPEC_IP_PROTOCOL
:
118 case FLOWSPEC_DEST_PORT
:
119 case FLOWSPEC_SRC_PORT
:
120 case FLOWSPEC_ICMP_TYPE
:
121 case FLOWSPEC_ICMP_CODE
:
122 ret
= bgp_flowspec_op_decode(BGP_FLOWSPEC_VALIDATE_ONLY
,
127 case FLOWSPEC_TCP_FLAGS
:
128 ret
= bgp_flowspec_tcpflags_decode(
129 BGP_FLOWSPEC_VALIDATE_ONLY
,
134 case FLOWSPEC_PKT_LEN
:
136 ret
= bgp_flowspec_op_decode(
137 BGP_FLOWSPEC_VALIDATE_ONLY
,
138 nlri_content
+ offset
,
142 case FLOWSPEC_FRAGMENT
:
143 ret
= bgp_flowspec_fragment_type_decode(
144 BGP_FLOWSPEC_VALIDATE_ONLY
,
145 nlri_content
+ offset
,
159 * handle the flowspec address src/dst or generic address NLRI
160 * return number of bytes analysed ( >= 0).
162 int bgp_flowspec_ip_address(enum bgp_flowspec_util_nlri_t type
,
165 void *result
, int *error
)
167 char *display
= (char *)result
; /* for return_string */
168 struct prefix
*prefix
= (struct prefix
*)result
;
170 struct prefix prefix_local
;
174 memset(&prefix_local
, 0, sizeof(struct prefix
));
175 /* read the prefix length */
176 prefix_local
.prefixlen
= nlri_ptr
[offset
];
177 psize
= PSIZE(prefix_local
.prefixlen
);
179 /* TODO Flowspec IPv6 Support */
180 prefix_local
.family
= AF_INET
;
181 /* Prefix length check. */
182 if (prefix_local
.prefixlen
> prefix_blen(&prefix_local
) * 8)
184 /* When packet overflow occur return immediately. */
185 if (psize
+ offset
> max_len
)
187 /* Defensive coding, double-check
188 * the psize fits in a struct prefix
190 if (psize
> (ssize_t
)sizeof(prefix_local
.u
))
192 memcpy(&prefix_local
.u
.prefix
, &nlri_ptr
[offset
], psize
);
195 case BGP_FLOWSPEC_RETURN_STRING
:
196 prefix2str(&prefix_local
, display
,
197 BGP_FLOWSPEC_STRING_DISPLAY_MAX
);
199 case BGP_FLOWSPEC_CONVERT_TO_NON_OPAQUE
:
200 PREFIX_COPY_IPV4(prefix
, &prefix_local
)
202 case BGP_FLOWSPEC_VALIDATE_ONLY
:
210 * handle the flowspec operator NLRI
211 * return number of bytes analysed
212 * if there is an error, the passed error param is used to give error:
213 * -1 if decoding error,
214 * if result is a string, its assumed length
215 * is BGP_FLOWSPEC_STRING_DISPLAY_MAX
217 int bgp_flowspec_op_decode(enum bgp_flowspec_util_nlri_t type
,
220 void *result
, int *error
)
223 int len
, value
, value_size
;
225 char *ptr
= (char *)result
; /* for return_string */
227 int len_string
= BGP_FLOWSPEC_STRING_DISPLAY_MAX
;
229 struct bgp_pbr_match_val
*mval
= (struct bgp_pbr_match_val
*)result
;
233 if (loop
> BGP_PBR_MATCH_VAL_MAX
)
235 hex2bin(&nlri_ptr
[offset
], op
);
238 value_size
= 1 << len
;
239 value
= hexstr2num(&nlri_ptr
[offset
], value_size
);
240 /* can not be < and > at the same time */
241 if (op
[5] == 1 && op
[6] == 1)
243 /* if first element, AND bit can not be set */
244 if (op
[1] == 1 && loop
== 0)
247 case BGP_FLOWSPEC_RETURN_STRING
:
249 len_written
= snprintf(ptr
, len_string
,
251 len_string
-= len_written
;
255 len_written
= snprintf(ptr
, len_string
,
257 len_string
-= len_written
;
261 len_written
= snprintf(ptr
, len_string
,
263 len_string
-= len_written
;
267 len_written
= snprintf(ptr
, len_string
,
269 len_string
-= len_written
;
272 len_written
= snprintf(ptr
, len_string
,
274 len_string
-= len_written
;
277 case BGP_FLOWSPEC_CONVERT_TO_NON_OPAQUE
:
278 /* limitation: stop converting */
283 mval
->compare_operator
|=
284 OPERATOR_COMPARE_LESS_THAN
;
286 mval
->compare_operator
|=
287 OPERATOR_COMPARE_GREATER_THAN
;
289 mval
->compare_operator
|=
290 OPERATOR_COMPARE_EQUAL_TO
;
292 mval
->unary_operator
= OPERATOR_UNARY_AND
;
294 mval
->unary_operator
= OPERATOR_UNARY_OR
;
297 case BGP_FLOWSPEC_VALIDATE_ONLY
:
302 offset
+= value_size
;
304 } while (op
[0] == 0 && offset
< max_len
- 1);
305 if (offset
> max_len
)
307 /* use error parameter to count the number of entries */
315 * handle the flowspec tcpflags field
316 * return number of bytes analysed
317 * if there is an error, the passed error param is used to give error:
318 * -1 if decoding error,
319 * if result is a string, its assumed length
320 * is BGP_FLOWSPEC_STRING_DISPLAY_MAX
322 int bgp_flowspec_tcpflags_decode(enum bgp_flowspec_util_nlri_t type
,
325 void *result
, int *error
)
328 int len
, value_size
, loop
= 0, value
;
329 char *ptr
= (char *)result
; /* for return_string */
330 struct bgp_pbr_match_val
*mval
= (struct bgp_pbr_match_val
*)result
;
332 int len_string
= BGP_FLOWSPEC_STRING_DISPLAY_MAX
;
337 if (loop
> BGP_PBR_MATCH_VAL_MAX
)
339 hex2bin(&nlri_ptr
[offset
], op
);
340 /* if first element, AND bit can not be set */
341 if (op
[1] == 1 && loop
== 0)
344 len
= 2 * op
[2] + op
[3];
345 value_size
= 1 << len
;
346 value
= hexstr2num(&nlri_ptr
[offset
], value_size
);
348 case BGP_FLOWSPEC_RETURN_STRING
:
349 if (op
[1] == 1 && loop
!= 0) {
350 len_written
= snprintf(ptr
, len_string
,
352 len_string
-= len_written
;
354 } else if (op
[1] == 0 && loop
!= 0) {
355 len_written
= snprintf(ptr
, len_string
,
357 len_string
-= len_written
;
360 len_written
= snprintf(ptr
, len_string
,
362 len_string
-= len_written
;
365 ptr
+= snprintf(ptr
, len_string
,
367 len_string
-= len_written
;
371 ptr
+= snprintf(ptr
, len_string
,
373 len_string
-= len_written
;
376 ptr
+= snprintf(ptr
, len_string
,
378 len_string
-= len_written
;
381 case BGP_FLOWSPEC_CONVERT_TO_NON_OPAQUE
:
382 /* limitation: stop converting */
388 mval
->compare_operator
|=
389 OPERATOR_COMPARE_LESS_THAN
;
390 mval
->compare_operator
|=
391 OPERATOR_COMPARE_GREATER_THAN
;
393 mval
->compare_operator
|=
394 OPERATOR_COMPARE_EQUAL_TO
;
396 mval
->compare_operator
|=
397 OPERATOR_COMPARE_EXACT_MATCH
;
399 mval
->unary_operator
=
402 mval
->unary_operator
=
406 case BGP_FLOWSPEC_VALIDATE_ONLY
:
411 offset
+= value_size
;
413 } while (op
[0] == 0 && offset
< max_len
- 1);
414 if (offset
> max_len
)
416 /* use error parameter to count the number of entries */
423 * handle the flowspec fragment type field
424 * return error (returned values are invalid) or number of bytes analysed
425 * -1 if error in decoding
426 * >= 0 : number of bytes analysed (ok).
428 int bgp_flowspec_fragment_type_decode(enum bgp_flowspec_util_nlri_t type
,
431 void *result
, int *error
)
434 int len
, value
, value_size
, loop
= 0;
435 char *ptr
= (char *)result
; /* for return_string */
436 struct bgp_pbr_fragment_val
*mval
=
437 (struct bgp_pbr_fragment_val
*)result
;
439 int len_string
= BGP_FLOWSPEC_STRING_DISPLAY_MAX
;
444 hex2bin(&nlri_ptr
[offset
], op
);
446 len
= 2 * op
[2] + op
[3];
447 value_size
= 1 << len
;
448 value
= hexstr2num(&nlri_ptr
[offset
], value_size
);
449 if (value
!= 1 && value
!= 2 && value
!= 4 && value
!= 8)
451 offset
+= value_size
;
452 /* TODO : as per RFC5574 : first Fragment bits are Reserved
453 * does that mean that it is not possible
454 * to handle multiple occurences ?
455 * as of today, we only grab the first TCP fragment
463 case BGP_FLOWSPEC_RETURN_STRING
:
466 len_written
= snprintf(ptr
, len_string
,
468 len_string
-= len_written
;
472 len_written
= snprintf(ptr
, len_string
,
474 len_string
-= len_written
;
478 len_written
= snprintf(ptr
, len_string
,
480 len_string
-= len_written
;
484 len_written
= snprintf(ptr
, len_string
,
486 len_string
-= len_written
;
493 case BGP_FLOWSPEC_CONVERT_TO_NON_OPAQUE
:
494 mval
->bitmask
= (uint8_t)value
;
496 case BGP_FLOWSPEC_VALIDATE_ONLY
:
502 } while (op
[0] == 0 && offset
< max_len
- 1);
503 if (offset
> max_len
)
508 int bgp_flowspec_match_rules_fill(uint8_t *nlri_content
, int len
,
509 struct bgp_pbr_entry_main
*bpem
)
511 int offset
= 0, error
= 0;
512 struct prefix
*prefix
;
513 struct bgp_pbr_match_val
*mval
;
518 while (offset
< len
- 1 && error
>= 0) {
519 type
= nlri_content
[offset
];
522 case FLOWSPEC_DEST_PREFIX
:
523 case FLOWSPEC_SRC_PREFIX
:
525 if (type
== FLOWSPEC_DEST_PREFIX
) {
526 bitmask
|= PREFIX_DST_PRESENT
;
527 prefix
= &bpem
->dst_prefix
;
529 bitmask
|= PREFIX_SRC_PRESENT
;
530 prefix
= &bpem
->src_prefix
;
532 ret
= bgp_flowspec_ip_address(
533 BGP_FLOWSPEC_CONVERT_TO_NON_OPAQUE
,
534 nlri_content
+ offset
,
538 zlog_err("%s: flowspec_ip_address error %d",
541 bpem
->match_bitmask
|= bitmask
;
544 case FLOWSPEC_IP_PROTOCOL
:
545 match_num
= &(bpem
->match_protocol_num
);
546 mval
= (struct bgp_pbr_match_val
*)
548 offset
+= bgp_flowspec_call_non_opaque_decode(
549 nlri_content
+ offset
,
555 match_num
= &(bpem
->match_port_num
);
556 mval
= (struct bgp_pbr_match_val
*)
558 offset
+= bgp_flowspec_call_non_opaque_decode(
559 nlri_content
+ offset
,
564 case FLOWSPEC_DEST_PORT
:
565 match_num
= &(bpem
->match_dst_port_num
);
566 mval
= (struct bgp_pbr_match_val
*)
568 offset
+= bgp_flowspec_call_non_opaque_decode(
569 nlri_content
+ offset
,
574 case FLOWSPEC_SRC_PORT
:
575 match_num
= &(bpem
->match_src_port_num
);
576 mval
= (struct bgp_pbr_match_val
*)
578 offset
+= bgp_flowspec_call_non_opaque_decode(
579 nlri_content
+ offset
,
584 case FLOWSPEC_ICMP_TYPE
:
585 match_num
= &(bpem
->match_icmp_type_num
);
586 mval
= (struct bgp_pbr_match_val
*)
588 offset
+= bgp_flowspec_call_non_opaque_decode(
589 nlri_content
+ offset
,
594 case FLOWSPEC_ICMP_CODE
:
595 match_num
= &(bpem
->match_icmp_code_num
);
596 mval
= (struct bgp_pbr_match_val
*)
598 offset
+= bgp_flowspec_call_non_opaque_decode(
599 nlri_content
+ offset
,
604 case FLOWSPEC_PKT_LEN
:
606 &(bpem
->match_packet_length_num
);
607 mval
= (struct bgp_pbr_match_val
*)
608 &(bpem
->packet_length
);
609 offset
+= bgp_flowspec_call_non_opaque_decode(
610 nlri_content
+ offset
,
616 match_num
= &(bpem
->match_dscp_num
);
617 mval
= (struct bgp_pbr_match_val
*)
619 offset
+= bgp_flowspec_call_non_opaque_decode(
620 nlri_content
+ offset
,
625 case FLOWSPEC_TCP_FLAGS
:
626 ret
= bgp_flowspec_tcpflags_decode(
627 BGP_FLOWSPEC_CONVERT_TO_NON_OPAQUE
,
628 nlri_content
+ offset
,
630 &bpem
->tcpflags
, &error
);
632 zlog_err("%s: flowspec_tcpflags_decode error %d",
635 bpem
->match_tcpflags_num
= error
;
636 /* contains the number of slots used */
639 case FLOWSPEC_FRAGMENT
:
640 ret
= bgp_flowspec_fragment_type_decode(
641 BGP_FLOWSPEC_CONVERT_TO_NON_OPAQUE
,
642 nlri_content
+ offset
,
643 len
- offset
, &bpem
->fragment
,
646 zlog_err("%s: flowspec_fragment_type_decode error %d",
649 bpem
->match_bitmask
|= FRAGMENT_PRESENT
;
653 zlog_err("%s: unknown type %d\n", __func__
, type
);
660 struct bgp_node
*bgp_flowspec_get_match_per_ip(afi_t afi
,
661 struct bgp_table
*rib
,
662 struct prefix
*match
,
666 struct prefix
*prefix
;
668 for (rn
= bgp_table_top(rib
); rn
; rn
= bgp_route_next(rn
)) {
671 if (prefix
->family
!= AF_FLOWSPEC
)
674 if (bgp_flowspec_contains_prefix(prefix
, match
, prefix_check
))