From f730e5667dcbe6b2e937b35084c5825be44895bf Mon Sep 17 00:00:00 2001
From: Philippe Guibert <philippe.guibert@6wind.com>
Date: Fri, 30 Mar 2018 13:01:39 +0200
Subject: bgpd: add 3 fields to ipset_entry : src,dst port, and proto

Those 3 fields are read and written between zebra and bgpd.
This permits extending the ipset_entry structure.
Combinatories will be possible:
- filtering with one of the src/dst port.
- filtering with one of the range src/ range dst port
usage of src or dst is exclusive in a FS entry.
- filtering a port or a port range based on either src or dst port.

Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
---
 bgpd/bgp_pbr.h | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'bgpd/bgp_pbr.h')

diff --git a/bgpd/bgp_pbr.h b/bgpd/bgp_pbr.h
index 5129ada37..fd47ad6fb 100644
--- a/bgpd/bgp_pbr.h
+++ b/bgpd/bgp_pbr.h
@@ -189,6 +189,12 @@ struct bgp_pbr_match_entry {
 	struct prefix src;
 	struct prefix dst;
 
+	uint16_t src_port_min;
+	uint16_t src_port_max;
+	uint16_t dst_port_min;
+	uint16_t dst_port_max;
+	uint8_t proto;
+
 	bool installed;
 	bool install_in_progress;
 };
-- 
cgit v1.2.3


From 1de7dffff707058b6633a664920bdca3def27860 Mon Sep 17 00:00:00 2001
From: Philippe Guibert <philippe.guibert@6wind.com>
Date: Fri, 30 Mar 2018 12:25:03 +0200
Subject: bgpd: pbr support for port redirecting

Ability for BGP FS to convert some rules containining at least one
address and one port information into a pbr_match_entry rule.

Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
---
 bgpd/bgp_pbr.c | 258 ++++++++++++++++++++++++++++++++++++++++++++++++++-------
 bgpd/bgp_pbr.h |   6 ++
 2 files changed, 235 insertions(+), 29 deletions(-)

(limited to 'bgpd/bgp_pbr.h')

diff --git a/bgpd/bgp_pbr.c b/bgpd/bgp_pbr.c
index 04d6314fd..de94c0e03 100644
--- a/bgpd/bgp_pbr.c
+++ b/bgpd/bgp_pbr.c
@@ -169,7 +169,60 @@ static int sprintf_bgp_pbr_match_val(char *str, struct bgp_pbr_match_val *mval,
 		_cnt++; \
 	} while (0)
 
-/* return 1 if OK, 0 if validation should stop) */
+struct bgp_pbr_range_port {
+	uint16_t min_port;
+	uint16_t max_port;
+};
+
+/* return true if extraction ok
+ */
+static bool bgp_pbr_extract(struct bgp_pbr_match_val list[],
+			    int num,
+			    struct bgp_pbr_range_port *range)
+{
+	int i = 0;
+	bool exact_match = false;
+
+	if (range)
+		memset(range, 0, sizeof(struct bgp_pbr_range_port));
+
+	if (num > 2)
+		return false;
+	for (i = 0; i < num; i++) {
+		if (i != 0 && (list[i].compare_operator ==
+			       OPERATOR_COMPARE_EQUAL_TO))
+			return false;
+		if (i == 0 && (list[i].compare_operator ==
+			       OPERATOR_COMPARE_EQUAL_TO)) {
+			if (range)
+				range->min_port = list[i].value;
+			exact_match = true;
+		}
+		if (exact_match == true && i > 0)
+			return false;
+		if (list[i].compare_operator ==
+		    (OPERATOR_COMPARE_GREATER_THAN +
+		     OPERATOR_COMPARE_EQUAL_TO)) {
+			if (range)
+				range->min_port = list[i].value;
+		} else if (list[i].compare_operator ==
+			   (OPERATOR_COMPARE_LESS_THAN +
+			    OPERATOR_COMPARE_EQUAL_TO)) {
+			if (range)
+				range->max_port = list[i].value;
+		} else if (list[i].compare_operator ==
+			   OPERATOR_COMPARE_LESS_THAN) {
+			if (range)
+				range->max_port = list[i].value - 1;
+		} else if (list[i].compare_operator ==
+			   OPERATOR_COMPARE_GREATER_THAN) {
+			if (range)
+				range->min_port = list[i].value + 1;
+		}
+	}
+	return true;
+}
+
 static int bgp_pbr_validate_policy_route(struct bgp_pbr_entry_main *api)
 {
 	/* because bgp pbr entry may contain unsupported
@@ -179,18 +232,63 @@ static int bgp_pbr_validate_policy_route(struct bgp_pbr_entry_main *api)
 	 * - combination src/dst => redirect nexthop [ + rate]
 	 * - combination src/dst => redirect VRF [ + rate]
 	 * - combination src/dst => drop
+	 * - combination srcport + @IP
 	 */
-	if (api->match_src_port_num || api->match_dst_port_num
-	    || api->match_port_num || api->match_protocol_num
-	    || api->match_icmp_type_num || api->match_icmp_type_num
+	if (api->match_icmp_type_num || api->match_icmp_type_num
 	    || api->match_packet_length_num || api->match_dscp_num
 	    || api->match_tcpflags_num) {
 		if (BGP_DEBUG(pbr, PBR)) {
 			bgp_pbr_print_policy_route(api);
 			zlog_debug("BGP: some SET actions not supported by Zebra. ignoring.");
+			zlog_debug("BGP: case icmp or length or dscp or tcp flags");
 		}
 		return 0;
 	}
+
+	if (api->match_protocol_num > 1) {
+		if (BGP_DEBUG(pbr, PBR))
+			zlog_debug("BGP: match protocol operations:"
+				 "multiple protocols ( %d). ignoring.",
+				 api->match_protocol_num);
+		return 0;
+	}
+	if (api->match_protocol_num == 1 &&
+	    api->protocol[0].value != PROTOCOL_UDP &&
+	    api->protocol[0].value != PROTOCOL_TCP) {
+		if (BGP_DEBUG(pbr, PBR))
+			zlog_debug("BGP: match protocol operations:"
+				   "protocol (%d) not supported. ignoring",
+				   api->match_protocol_num);
+		return 0;
+	}
+	if (!bgp_pbr_extract(api->src_port, api->match_src_port_num, NULL)) {
+		if (BGP_DEBUG(pbr, PBR))
+			zlog_debug("BGP: match src port operations:"
+				   "too complex. ignoring.");
+		return 0;
+	}
+	if (!bgp_pbr_extract(api->dst_port, api->match_dst_port_num, NULL)) {
+		if (BGP_DEBUG(pbr, PBR))
+			zlog_debug("BGP: match dst port operations:"
+				   "too complex. ignoring.");
+		return 0;
+	}
+	if (!bgp_pbr_extract(api->port, api->match_port_num, NULL)) {
+		if (BGP_DEBUG(pbr, PBR))
+			zlog_debug("BGP: match port operations:"
+				 "too complex. ignoring.");
+		return 0;
+	}
+	/* no combinations with both src_port and dst_port
+	 * or port with src_port and dst_port
+	 */
+	if (api->match_src_port_num + api->match_dst_port_num +
+	    api->match_port_num > 3) {
+		if (BGP_DEBUG(pbr, PBR))
+			zlog_debug("BGP: match multiple port operations:"
+				 " too complex. ignoring.");
+		return 0;
+	}
 	if (!(api->match_bitmask & PREFIX_SRC_PRESENT) &&
 	    !(api->match_bitmask & PREFIX_DST_PRESENT)) {
 		if (BGP_DEBUG(pbr, PBR)) {
@@ -447,6 +545,11 @@ uint32_t bgp_pbr_match_entry_hash_key(void *arg)
 	pbme = (struct bgp_pbr_match_entry *)arg;
 	key = prefix_hash_key(&pbme->src);
 	key = jhash_1word(prefix_hash_key(&pbme->dst), key);
+	key = jhash(&pbme->dst_port_min, 2, key);
+	key = jhash(&pbme->src_port_min, 2, key);
+	key = jhash(&pbme->dst_port_max, 2, key);
+	key = jhash(&pbme->src_port_max, 2, key);
+	key = jhash(&pbme->proto, 1, key);
 
 	return key;
 }
@@ -474,6 +577,21 @@ int bgp_pbr_match_entry_hash_equal(const void *arg1, const void *arg2)
 	if (!prefix_same(&r1->dst, &r2->dst))
 		return 0;
 
+	if (r1->src_port_min != r2->src_port_min)
+		return 0;
+
+	if (r1->dst_port_min != r2->dst_port_min)
+		return 0;
+
+	if (r1->src_port_max != r2->src_port_max)
+		return 0;
+
+	if (r1->dst_port_max != r2->dst_port_max)
+		return 0;
+
+	if (r1->proto != r2->proto)
+		return 0;
+
 	return 1;
 }
 
@@ -813,10 +931,13 @@ static int bgp_pbr_get_remaining_entry(struct hash_backet *backet, void *arg)
 }
 
 static void bgp_pbr_policyroute_remove_from_zebra(struct bgp *bgp,
-						  struct bgp_info *binfo,
-						  vrf_id_t vrf_id,
-						  struct prefix *src,
-						  struct prefix *dst)
+					  struct bgp_info *binfo,
+					  vrf_id_t vrf_id,
+					  struct prefix *src,
+					  struct prefix *dst,
+					  uint8_t protocol,
+					  struct bgp_pbr_range_port *src_port,
+					  struct bgp_pbr_range_port *dst_port)
 {
 	struct bgp_pbr_match temp;
 	struct bgp_pbr_match_entry temp2;
@@ -840,11 +961,35 @@ static void bgp_pbr_policyroute_remove_from_zebra(struct bgp *bgp,
 		prefix_copy(&temp2.dst, dst);
 	} else
 		temp2.dst.family = AF_INET;
-
-	if (src == NULL || dst == NULL)
-		temp.type = IPSET_NET;
-	else
-		temp.type = IPSET_NET_NET;
+	if (src_port) {
+		temp.flags |= MATCH_PORT_SRC_SET;
+		temp2.src_port_min = src_port->min_port;
+		if (src_port->max_port) {
+			temp.flags |= MATCH_PORT_SRC_RANGE_SET;
+			temp2.src_port_max = src_port->max_port;
+		}
+	}
+	if (dst_port) {
+		temp.flags |= MATCH_PORT_DST_SET;
+		temp2.dst_port_min = dst_port->min_port;
+		if (dst_port->max_port) {
+			temp.flags |= MATCH_PORT_DST_RANGE_SET;
+			temp2.dst_port_max = dst_port->max_port;
+		}
+	}
+	temp2.proto = protocol;
+
+	if (src == NULL || dst == NULL) {
+		if (temp.flags & (MATCH_PORT_DST_SET | MATCH_PORT_SRC_SET))
+			temp.type = IPSET_NET_PORT;
+		else
+			temp.type = IPSET_NET;
+	} else {
+		if (temp.flags & (MATCH_PORT_DST_SET | MATCH_PORT_SRC_SET))
+			temp.type = IPSET_NET_PORT_NET;
+		else
+			temp.type = IPSET_NET_NET;
+	}
 	if (vrf_id == VRF_UNKNOWN) /* XXX case BGP destroy */
 		temp.vrf_id = 0;
 	else
@@ -870,12 +1015,15 @@ static void bgp_pbr_policyroute_remove_from_zebra(struct bgp *bgp,
 }
 
 static void bgp_pbr_policyroute_add_to_zebra(struct bgp *bgp,
-					     struct bgp_info *binfo,
-					     vrf_id_t vrf_id,
-					     struct prefix *src,
-					     struct prefix *dst,
-					     struct nexthop *nh,
-					     float *rate)
+				     struct bgp_info *binfo,
+				     vrf_id_t vrf_id,
+				     struct prefix *src,
+				     struct prefix *dst,
+				     struct nexthop *nh,
+				     float *rate,
+				     uint8_t protocol,
+				     struct bgp_pbr_range_port *src_port,
+				     struct bgp_pbr_range_port *dst_port)
 {
 	struct bgp_pbr_match temp;
 	struct bgp_pbr_match_entry temp2;
@@ -913,15 +1061,33 @@ static void bgp_pbr_policyroute_add_to_zebra(struct bgp *bgp,
 
 	/* then look for bpm */
 	memset(&temp, 0, sizeof(temp));
-	if (src == NULL || dst == NULL)
-		temp.type = IPSET_NET;
-	else
-		temp.type = IPSET_NET_NET;
+	if (src == NULL || dst == NULL) {
+		if ((src_port && src_port->min_port) ||
+		    (dst_port && dst_port->min_port))
+			temp.type = IPSET_NET_PORT;
+		else
+			temp.type = IPSET_NET;
+	} else {
+		if ((src_port && src_port->min_port) ||
+		    (dst_port && dst_port->min_port))
+			temp.type = IPSET_NET_PORT_NET;
+		else
+			temp.type = IPSET_NET_NET;
+	}
 	temp.vrf_id = vrf_id;
 	if (src)
 		temp.flags |= MATCH_IP_SRC_SET;
 	if (dst)
 		temp.flags |= MATCH_IP_DST_SET;
+
+	if (src_port && src_port->min_port)
+		temp.flags |= MATCH_PORT_SRC_SET;
+	if (dst_port && dst_port->min_port)
+		temp.flags |= MATCH_PORT_DST_SET;
+	if (src_port && src_port->max_port)
+		temp.flags |= MATCH_PORT_SRC_RANGE_SET;
+	if (dst_port && dst_port->max_port)
+		temp.flags |= MATCH_PORT_DST_RANGE_SET;
 	temp.action = bpa;
 	bpm = hash_get(bgp->pbr_match_hash, &temp,
 		       bgp_pbr_match_alloc_intern);
@@ -953,9 +1119,14 @@ static void bgp_pbr_policyroute_add_to_zebra(struct bgp *bgp,
 		prefix_copy(&temp2.dst, dst);
 	else
 		temp2.dst.family = AF_INET;
+	temp2.src_port_min = src_port ? src_port->min_port : 0;
+	temp2.dst_port_min = dst_port ? dst_port->min_port : 0;
+	temp2.src_port_max = src_port ? src_port->max_port : 0;
+	temp2.dst_port_max = dst_port ? dst_port->max_port : 0;
+	temp2.proto = protocol;
 	if (bpm)
 		bpme = hash_get(bpm->entry_hash, &temp2,
-			bgp_pbr_match_entry_alloc_intern);
+				bgp_pbr_match_entry_alloc_intern);
 	if (bpme && bpme->unique == 0) {
 		bpme->unique = ++bgp_pbr_match_entry_counter_unique;
 		/* 0 value is forbidden */
@@ -1021,6 +1192,9 @@ static void bgp_pbr_handle_entry(struct bgp *bgp,
 	int continue_loop = 1;
 	float rate = 0;
 	struct prefix *src = NULL, *dst = NULL;
+	uint8_t proto = 0;
+	struct bgp_pbr_range_port *srcp = NULL, *dstp = NULL;
+	struct bgp_pbr_range_port range;
 
 	if (api->match_bitmask & PREFIX_SRC_PRESENT)
 		src = &api->src_prefix;
@@ -1028,10 +1202,33 @@ static void bgp_pbr_handle_entry(struct bgp *bgp,
 		dst = &api->dst_prefix;
 	memset(&nh, 0, sizeof(struct nexthop));
 	nh.vrf_id = VRF_UNKNOWN;
-
+	if (api->match_protocol_num)
+		proto = (uint8_t)api->protocol[0].value;
+	/* if match_port is selected, then either src or dst port will be parsed
+	 * but not both at the same time
+	 */
+	if (api->match_port_num >= 1) {
+		bgp_pbr_extract(api->port,
+				api->match_port_num,
+				&range);
+		srcp = dstp = &range;
+	} else if (api->match_src_port_num >= 1) {
+		bgp_pbr_extract(api->src_port,
+				api->match_src_port_num,
+				&range);
+		srcp = &range;
+		dstp = NULL;
+	} else if (api->match_dst_port_num >= 1) {
+		bgp_pbr_extract(api->dst_port,
+				api->match_dst_port_num,
+				&range);
+		dstp = &range;
+		srcp = NULL;
+	}
 	if (!add)
 		return bgp_pbr_policyroute_remove_from_zebra(bgp, binfo,
-					     api->vrf_id, src, dst);
+					     api->vrf_id, src, dst,
+					     proto, srcp, dstp);
 	/* no action for add = true */
 	for (i = 0; i < api->action_num; i++) {
 		switch (api->actions[i].action) {
@@ -1042,7 +1239,8 @@ static void bgp_pbr_handle_entry(struct bgp *bgp,
 				nh.type = NEXTHOP_TYPE_BLACKHOLE;
 				bgp_pbr_policyroute_add_to_zebra(bgp, binfo,
 						    api->vrf_id, src, dst,
-						    &nh, &rate);
+						    &nh, &rate, proto,
+						    srcp, dstp);
 			} else {
 				/* update rate. can be reentrant */
 				rate = api->actions[i].u.r.rate;
@@ -1085,7 +1283,8 @@ static void bgp_pbr_handle_entry(struct bgp *bgp,
 			bgp_pbr_policyroute_add_to_zebra(bgp, binfo,
 							    api->vrf_id,
 							    src, dst,
-							    &nh, &rate);
+							    &nh, &rate, proto,
+							    srcp, dstp);
 			/* XXX combination with REDIRECT_VRF
 			 * + REDIRECT_NH_IP not done
 			 */
@@ -1097,7 +1296,8 @@ static void bgp_pbr_handle_entry(struct bgp *bgp,
 			bgp_pbr_policyroute_add_to_zebra(bgp, binfo,
 							 api->vrf_id,
 							 src, dst,
-							 &nh, &rate);
+							 &nh, &rate, proto,
+							 srcp, dstp);
 			continue_loop = 0;
 			break;
 		case ACTION_MARKING:
diff --git a/bgpd/bgp_pbr.h b/bgpd/bgp_pbr.h
index fd47ad6fb..212249295 100644
--- a/bgpd/bgp_pbr.h
+++ b/bgpd/bgp_pbr.h
@@ -123,6 +123,8 @@ struct bgp_pbr_entry_main {
 	struct prefix src_prefix;
 	struct prefix dst_prefix;
 
+#define PROTOCOL_UDP 17
+#define PROTOCOL_TCP 6
 	struct bgp_pbr_match_val protocol[BGP_PBR_MATCH_VAL_MAX];
 	struct bgp_pbr_match_val src_port[BGP_PBR_MATCH_VAL_MAX];
 	struct bgp_pbr_match_val dst_port[BGP_PBR_MATCH_VAL_MAX];
@@ -157,6 +159,10 @@ struct bgp_pbr_match {
 
 #define MATCH_IP_SRC_SET		(1 << 0)
 #define MATCH_IP_DST_SET		(1 << 1)
+#define MATCH_PORT_SRC_SET		(1 << 2)
+#define MATCH_PORT_DST_SET		(1 << 3)
+#define MATCH_PORT_SRC_RANGE_SET	(1 << 4)
+#define MATCH_PORT_DST_RANGE_SET	(1 << 5)
 	uint32_t flags;
 
 	vrf_id_t vrf_id;
-- 
cgit v1.2.3


From b588b642ce3d933394240f77879eb41f36959311 Mon Sep 17 00:00:00 2001
From: Philippe Guibert <philippe.guibert@6wind.com>
Date: Fri, 20 Apr 2018 11:41:54 +0200
Subject: bgpd: display if FS entry is installed in PBR or not

Once PBR rules installed, an information is printed in the main
show bgp ipv4 flowspec detail information.

Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
---
 bgpd/bgp_flowspec_vty.c | 23 ++++++++++++++++++++---
 bgpd/bgp_pbr.c          | 12 ++++++++++++
 bgpd/bgp_pbr.h          |  2 ++
 bgpd/bgp_route.h        |  2 ++
 bgpd/bgp_zebra.c        | 19 ++++++++++++++-----
 5 files changed, 50 insertions(+), 8 deletions(-)

(limited to 'bgpd/bgp_pbr.h')

diff --git a/bgpd/bgp_flowspec_vty.c b/bgpd/bgp_flowspec_vty.c
index 7bf11f12a..3ff452889 100644
--- a/bgpd/bgp_flowspec_vty.c
+++ b/bgpd/bgp_flowspec_vty.c
@@ -30,6 +30,7 @@
 #include "bgpd/bgp_flowspec_util.h"
 #include "bgpd/bgp_flowspec_private.h"
 #include "bgpd/bgp_debug.h"
+#include "bgpd/bgp_pbr.h"
 
 /* Local Structures and variables declarations
  * This code block hosts the struct declared that host the flowspec rules
@@ -318,16 +319,32 @@ void route_vty_out_flowspec(struct vty *vty, struct prefix *p,
 		XFREE(MTYPE_ECOMMUNITY_STR, s);
 	}
 	peer_uptime(binfo->uptime, timebuf, BGP_UPTIME_LEN, 0, NULL);
-	if (display == NLRI_STRING_FORMAT_LARGE)
-		vty_out(vty, "\tup for %8s\n", timebuf);
-	else if (json_paths) {
+	if (display == NLRI_STRING_FORMAT_LARGE) {
+		vty_out(vty, "\treceived for %8s\n", timebuf);
+	} else if (json_paths) {
 		json_time_path = json_object_new_object();
 		json_object_string_add(json_time_path,
 				       "time", timebuf);
 		if (display == NLRI_STRING_FORMAT_JSON)
 			json_object_array_add(json_paths, json_time_path);
 	}
+	if (display == NLRI_STRING_FORMAT_LARGE) {
+		struct bgp_info_extra *extra = bgp_info_extra_get(binfo);
 
+		if (extra->bgp_fs_pbr) {
+			struct bgp_pbr_match_entry *bpme;
+			struct bgp_pbr_match *bpm;
+
+			bpme = (struct bgp_pbr_match_entry *)extra->bgp_fs_pbr;
+			bpm = bpme->backpointer;
+			vty_out(vty, "\tinstalled in PBR");
+			if (bpm)
+				vty_out(vty, " (%s)\n", bpm->ipset_name);
+			else
+				vty_out(vty, "\n");
+		} else
+			vty_out(vty, "\tnot installed in PBR\n");
+	}
 }
 
 int bgp_show_table_flowspec(struct vty *vty, struct bgp *bgp, afi_t afi,
diff --git a/bgpd/bgp_pbr.c b/bgpd/bgp_pbr.c
index de94c0e03..646d58352 100644
--- a/bgpd/bgp_pbr.c
+++ b/bgpd/bgp_pbr.c
@@ -867,6 +867,16 @@ static void bgp_pbr_flush_entry(struct bgp *bgp, struct bgp_pbr_action *bpa,
 		bgp_send_pbr_ipset_entry_match(bpme, false);
 		bpme->installed = false;
 		bpme->backpointer = NULL;
+		if (bpme->bgp_info) {
+			struct bgp_info *bgp_info;
+			struct bgp_info_extra *extra;
+
+			/* unlink bgp_info to bpme */
+			bgp_info = (struct bgp_info *)bpme->bgp_info;
+			extra = bgp_info_extra_get(bgp_info);
+			extra->bgp_fs_pbr = NULL;
+			bpme->bgp_info = NULL;
+		}
 	}
 	hash_release(bpm->entry_hash, bpme);
 	if (hashcount(bpm->entry_hash) == 0) {
@@ -1133,6 +1143,8 @@ static void bgp_pbr_policyroute_add_to_zebra(struct bgp *bgp,
 		bpme->backpointer = bpm;
 		bpme->installed = false;
 		bpme->install_in_progress = false;
+		/* link bgp info to bpme */
+		bpme->bgp_info = (void *)binfo;
 	}
 
 	/* BGP FS: append entry to zebra
diff --git a/bgpd/bgp_pbr.h b/bgpd/bgp_pbr.h
index 212249295..e4117ffd0 100644
--- a/bgpd/bgp_pbr.h
+++ b/bgpd/bgp_pbr.h
@@ -201,6 +201,8 @@ struct bgp_pbr_match_entry {
 	uint16_t dst_port_max;
 	uint8_t proto;
 
+	void *bgp_info;
+
 	bool installed;
 	bool install_in_progress;
 };
diff --git a/bgpd/bgp_route.h b/bgpd/bgp_route.h
index 00e5677fe..250298f0d 100644
--- a/bgpd/bgp_route.h
+++ b/bgpd/bgp_route.h
@@ -140,6 +140,8 @@ struct bgp_info_extra {
 	 * Set nexthop_orig.family to 0 if not valid.
 	 */
 	struct prefix nexthop_orig;
+	/* presence of FS pbr entry */
+	void *bgp_fs_pbr;
 };
 
 struct bgp_info {
diff --git a/bgpd/bgp_zebra.c b/bgpd/bgp_zebra.c
index ecc6d1ee3..84a815580 100644
--- a/bgpd/bgp_zebra.c
+++ b/bgpd/bgp_zebra.c
@@ -2050,11 +2050,20 @@ static int ipset_entry_notify_owner(int command, struct zclient *zclient,
 		bgp_pbime->install_in_progress = false;
 		break;
 	case ZAPI_IPSET_ENTRY_INSTALLED:
-		bgp_pbime->installed = true;
-		bgp_pbime->install_in_progress = false;
-		if (BGP_DEBUG(zebra, ZEBRA))
-			zlog_debug("%s: Received IPSET_ENTRY_INSTALLED",
-				   __PRETTY_FUNCTION__);
+		{
+			struct bgp_info *bgp_info;
+			struct bgp_info_extra *extra;
+
+			bgp_pbime->installed = true;
+			bgp_pbime->install_in_progress = false;
+			if (BGP_DEBUG(zebra, ZEBRA))
+				zlog_debug("%s: Received IPSET_ENTRY_INSTALLED",
+					   __PRETTY_FUNCTION__);
+			/* link bgp_info to bpme */
+			bgp_info = (struct bgp_info *)bgp_pbime->bgp_info;
+			extra = bgp_info_extra_get(bgp_info);
+			extra->bgp_fs_pbr = (void *)bgp_pbime;
+		}
 		break;
 	case ZAPI_IPSET_ENTRY_REMOVED:
 		if (BGP_DEBUG(zebra, ZEBRA))
-- 
cgit v1.2.3


From 4762c2137de994b5b1054cc43c26efef04b27bbf Mon Sep 17 00:00:00 2001
From: Philippe Guibert <philippe.guibert@6wind.com>
Date: Wed, 25 Apr 2018 18:29:35 +0200
Subject: bgpd: add vty command to restrict FS policy routing to a defined
 interface

policy routing is configurable via address-family ipv4 flowspec
subfamily node. This is then possible to restrict flowspec operation
through the BGP instance, to a single or some interfaces, but not all.

Two commands available:
[no] local-install [IFNAME]

Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
---
 bgpd/bgp_flowspec.h     |   3 ++
 bgpd/bgp_flowspec_vty.c | 103 ++++++++++++++++++++++++++++++++++++++++++++++++
 bgpd/bgp_pbr.c          |  50 +++++++++++++++++++++++
 bgpd/bgp_pbr.h          |  25 ++++++++++++
 bgpd/bgp_zebra.c        |  42 +++++++++++++++++++-
 bgpd/bgpd.c             |   3 ++
 bgpd/bgpd.h             |   3 ++
 7 files changed, 228 insertions(+), 1 deletion(-)

(limited to 'bgpd/bgp_pbr.h')

diff --git a/bgpd/bgp_flowspec.h b/bgpd/bgp_flowspec.h
index 392b32153..5dd2c3931 100644
--- a/bgpd/bgp_flowspec.h
+++ b/bgpd/bgp_flowspec.h
@@ -47,4 +47,7 @@ extern void bgp_fs_nlri_get_string(unsigned char *nlri_content, size_t len,
 extern void route_vty_out_flowspec(struct vty *vty, struct prefix *p,
 				   struct bgp_info *binfo,
 				   int display, json_object *json_paths);
+extern int bgp_fs_config_write_pbr(struct vty *vty, struct bgp *bgp,
+				   afi_t afi, safi_t safi);
+
 #endif /* _FRR_BGP_FLOWSPEC_H */
diff --git a/bgpd/bgp_flowspec_vty.c b/bgpd/bgp_flowspec_vty.c
index 3ff452889..b21e5ae0d 100644
--- a/bgpd/bgp_flowspec_vty.c
+++ b/bgpd/bgp_flowspec_vty.c
@@ -425,10 +425,113 @@ DEFUN (no_debug_bgp_flowspec,
 	return CMD_SUCCESS;
 }
 
+int bgp_fs_config_write_pbr(struct vty *vty, struct bgp *bgp,
+			    afi_t afi, safi_t safi)
+{
+	struct bgp_pbr_interface *pbr_if;
+	bool declare_node = false;
+	struct bgp_pbr_config *bgp_pbr_cfg = bgp->bgp_pbr_cfg;
+	struct bgp_pbr_interface_head *head;
+	bool bgp_pbr_interface_any;
+
+	if (!bgp_pbr_cfg || safi != SAFI_FLOWSPEC || afi != AFI_IP)
+		return 0;
+	head = &(bgp_pbr_cfg->ifaces_by_name_ipv4);
+	bgp_pbr_interface_any = bgp_pbr_cfg->pbr_interface_any_ipv4;
+	if (!RB_EMPTY(bgp_pbr_interface_head, head) ||
+	     !bgp_pbr_interface_any)
+		declare_node = true;
+	RB_FOREACH (pbr_if, bgp_pbr_interface_head, head) {
+		vty_out(vty, "  local-install %s\n", pbr_if->name);
+	}
+	if (!bgp_pbr_interface_any)
+		vty_out(vty, "  no local-install any\n");
+	return declare_node ? 1 : 0;
+}
+
+static int bgp_fs_local_install_interface(struct bgp *bgp,
+					  const char *no, const char *ifname)
+{
+	struct bgp_pbr_interface *pbr_if;
+	struct bgp_pbr_config *bgp_pbr_cfg = bgp->bgp_pbr_cfg;
+	struct bgp_pbr_interface_head *head;
+	bool *bgp_pbr_interface_any;
+
+	if (!bgp_pbr_cfg)
+		return CMD_SUCCESS;
+	head = &(bgp_pbr_cfg->ifaces_by_name_ipv4);
+	bgp_pbr_interface_any = &(bgp_pbr_cfg->pbr_interface_any_ipv4);
+	if (no) {
+		if (!ifname) {
+			if (*bgp_pbr_interface_any) {
+				*bgp_pbr_interface_any = false;
+				/* remove all other interface list */
+				bgp_pbr_reset(bgp, AFI_IP);
+			}
+			return CMD_SUCCESS;
+		}
+		pbr_if = bgp_pbr_interface_lookup(ifname, head);
+		if (!pbr_if)
+			return CMD_SUCCESS;
+		RB_REMOVE(bgp_pbr_interface_head, head, pbr_if);
+		return CMD_SUCCESS;
+	}
+	if (ifname) {
+		pbr_if = bgp_pbr_interface_lookup(ifname, head);
+		if (pbr_if)
+			return CMD_SUCCESS;
+		pbr_if = XCALLOC(MTYPE_TMP,
+				 sizeof(struct bgp_pbr_interface));
+		strlcpy(pbr_if->name, ifname, INTERFACE_NAMSIZ);
+		RB_INSERT(bgp_pbr_interface_head, head, pbr_if);
+		*bgp_pbr_interface_any = false;
+	} else {
+		/* set to default */
+		if (!*bgp_pbr_interface_any) {
+			/* remove all other interface list
+			 */
+			bgp_pbr_reset(bgp, AFI_IP);
+			*bgp_pbr_interface_any = true;
+		}
+	}
+	return CMD_SUCCESS;
+}
+
+DEFUN (bgp_fs_local_install_ifname,
+	bgp_fs_local_install_ifname_cmd,
+	"[no] local-install INTERFACE",
+	NO_STR
+	"Apply local policy routing\n"
+	"Interface name\n")
+{
+	struct bgp *bgp = VTY_GET_CONTEXT(bgp);
+	int idx = 0;
+	const char *no = strmatch(argv[0]->text, (char *)"no") ? "no" : NULL;
+	char *ifname = argv_find(argv, argc, "INTERFACE", &idx) ?
+		argv[idx]->arg : NULL;
+
+	return bgp_fs_local_install_interface(bgp, no, ifname);
+}
+
+DEFUN (bgp_fs_local_install_any,
+	bgp_fs_local_install_any_cmd,
+	"[no] local-install any",
+	NO_STR
+	"Apply local policy routing\n"
+	"Any Interface\n")
+{
+	struct bgp *bgp = VTY_GET_CONTEXT(bgp);
+	const char *no = strmatch(argv[0]->text, (char *)"no") ? "no" : NULL;
+
+	return bgp_fs_local_install_interface(bgp, no, NULL);
+}
+
 void bgp_flowspec_vty_init(void)
 {
 	install_element(ENABLE_NODE, &debug_bgp_flowspec_cmd);
 	install_element(CONFIG_NODE, &debug_bgp_flowspec_cmd);
 	install_element(ENABLE_NODE, &no_debug_bgp_flowspec_cmd);
 	install_element(CONFIG_NODE, &no_debug_bgp_flowspec_cmd);
+	install_element(BGP_FLOWSPECV4_NODE, &bgp_fs_local_install_any_cmd);
+	install_element(BGP_FLOWSPECV4_NODE, &bgp_fs_local_install_ifname_cmd);
 }
diff --git a/bgpd/bgp_pbr.c b/bgpd/bgp_pbr.c
index 646d58352..343a928ad 100644
--- a/bgpd/bgp_pbr.c
+++ b/bgpd/bgp_pbr.c
@@ -35,6 +35,12 @@
 DEFINE_MTYPE_STATIC(BGPD, PBR_MATCH_ENTRY, "PBR match entry")
 DEFINE_MTYPE_STATIC(BGPD, PBR_MATCH, "PBR match")
 DEFINE_MTYPE_STATIC(BGPD, PBR_ACTION, "PBR action")
+DEFINE_MTYPE_STATIC(BGPD, PBR, "BGP PBR Context")
+
+RB_GENERATE(bgp_pbr_interface_head, bgp_pbr_interface,
+	    id_entry, bgp_pbr_interface_compare);
+struct bgp_pbr_interface_head ifaces_by_name_ipv4 =
+	RB_INITIALIZER(&ifaces_by_name_ipv4);
 
 static int bgp_pbr_match_counter_unique;
 static int bgp_pbr_match_entry_counter_unique;
@@ -705,6 +711,11 @@ void bgp_pbr_cleanup(struct bgp *bgp)
 		hash_free(bgp->pbr_action_hash);
 		bgp->pbr_action_hash = NULL;
 	}
+	if (bgp->bgp_pbr_cfg == NULL)
+		return;
+	bgp_pbr_reset(bgp, AFI_IP);
+	XFREE(MTYPE_PBR, bgp->bgp_pbr_cfg);
+	bgp->bgp_pbr_cfg = NULL;
 }
 
 void bgp_pbr_init(struct bgp *bgp)
@@ -717,6 +728,9 @@ void bgp_pbr_init(struct bgp *bgp)
 		hash_create_size(8, bgp_pbr_action_hash_key,
 				 bgp_pbr_action_hash_equal,
 				 "Match Hash Entry");
+
+	bgp->bgp_pbr_cfg = XCALLOC(MTYPE_PBR, sizeof(struct bgp_pbr_config));
+	bgp->bgp_pbr_cfg->pbr_interface_any_ipv4 = true;
 }
 
 void bgp_pbr_print_policy_route(struct bgp_pbr_entry_main *api)
@@ -1350,3 +1364,39 @@ void bgp_pbr_update_entry(struct bgp *bgp, struct prefix *p,
 	}
 	bgp_pbr_handle_entry(bgp, info, &api, nlri_update);
 }
+
+int bgp_pbr_interface_compare(const struct bgp_pbr_interface *a,
+			  const struct bgp_pbr_interface *b)
+{
+	return strcmp(a->name, b->name);
+}
+
+struct bgp_pbr_interface *bgp_pbr_interface_lookup(const char *name,
+					   struct bgp_pbr_interface_head *head)
+{
+	struct bgp_pbr_interface pbr_if;
+
+	strlcpy(pbr_if.name, name, sizeof(pbr_if.name));
+	return (RB_FIND(bgp_pbr_interface_head,
+			head, &pbr_if));
+}
+
+/* this function resets to the default policy routing
+ * go back to default status
+ */
+void bgp_pbr_reset(struct bgp *bgp, afi_t afi)
+{
+	struct bgp_pbr_config *bgp_pbr_cfg = bgp->bgp_pbr_cfg;
+	struct bgp_pbr_interface_head *head;
+	struct bgp_pbr_interface *pbr_if;
+
+	if (!bgp_pbr_cfg || afi != AFI_IP)
+		return;
+	head = &(bgp_pbr_cfg->ifaces_by_name_ipv4);
+
+	while (!RB_EMPTY(bgp_pbr_interface_head, head)) {
+		pbr_if = RB_ROOT(bgp_pbr_interface_head, head);
+		RB_REMOVE(bgp_pbr_interface_head, head, pbr_if);
+		XFREE(MTYPE_TMP, pbr_if);
+	}
+}
diff --git a/bgpd/bgp_pbr.h b/bgpd/bgp_pbr.h
index e4117ffd0..20edaf30b 100644
--- a/bgpd/bgp_pbr.h
+++ b/bgpd/bgp_pbr.h
@@ -150,6 +150,25 @@ struct bgp_pbr_entry_main {
 	vrf_id_t vrf_id;
 };
 
+struct bgp_pbr_interface {
+	RB_ENTRY(bgp_pbr_interface) id_entry;
+	char name[INTERFACE_NAMSIZ];
+};
+
+RB_HEAD(bgp_pbr_interface_head, bgp_pbr_interface);
+RB_PROTOTYPE(bgp_pbr_interface_head, bgp_pbr_interface, id_entry,
+	     bgp_pbr_interface_compare);
+
+extern int bgp_pbr_interface_compare(const struct bgp_pbr_interface *a,
+				     const struct bgp_pbr_interface *b);
+
+struct bgp_pbr_config {
+	struct bgp_pbr_interface_head ifaces_by_name_ipv4;
+	bool pbr_interface_any_ipv4;
+};
+
+extern struct bgp_pbr_config *bgp_pbr_cfg;
+
 struct bgp_pbr_match {
 	char ipset_name[ZEBRA_IPSET_NAME_SIZE];
 
@@ -267,4 +286,10 @@ extern void bgp_pbr_update_entry(struct bgp *bgp, struct prefix *p,
 				afi_t afi, safi_t safi,
 				bool nlri_update);
 
+/* bgp pbr utilities */
+extern struct bgp_pbr_interface *pbr_interface_lookup(const char *name);
+extern void bgp_pbr_reset(struct bgp *bgp, afi_t afi);
+extern struct bgp_pbr_interface *bgp_pbr_interface_lookup(const char *name,
+				   struct bgp_pbr_interface_head *head);
+
 #endif /* __BGP_PBR_H__ */
diff --git a/bgpd/bgp_zebra.c b/bgpd/bgp_zebra.c
index 84a815580..641861a28 100644
--- a/bgpd/bgp_zebra.c
+++ b/bgpd/bgp_zebra.c
@@ -2574,12 +2574,49 @@ void bgp_send_pbr_ipset_entry_match(struct bgp_pbr_match_entry *pbrime,
 		pbrime->install_in_progress = true;
 }
 
+static void bgp_encode_pbr_interface_list(struct bgp *bgp, struct stream *s)
+{
+	struct bgp_pbr_config *bgp_pbr_cfg = bgp->bgp_pbr_cfg;
+	struct bgp_pbr_interface_head *head;
+	struct bgp_pbr_interface *pbr_if;
+	struct interface *ifp;
+
+	if (!bgp_pbr_cfg)
+		return;
+	head = &(bgp_pbr_cfg->ifaces_by_name_ipv4);
+
+	RB_FOREACH (pbr_if, bgp_pbr_interface_head, head) {
+		ifp = if_lookup_by_name(pbr_if->name, bgp->vrf_id);
+		if (ifp)
+			stream_putl(s, ifp->ifindex);
+	}
+}
+
+static int bgp_pbr_get_ifnumber(struct bgp *bgp)
+{
+	struct bgp_pbr_config *bgp_pbr_cfg = bgp->bgp_pbr_cfg;
+	struct bgp_pbr_interface_head *head;
+	struct bgp_pbr_interface *pbr_if;
+	int cnt = 0;
+
+	if (!bgp_pbr_cfg)
+		return 0;
+	head = &(bgp_pbr_cfg->ifaces_by_name_ipv4);
+
+	RB_FOREACH (pbr_if, bgp_pbr_interface_head, head) {
+		if (if_lookup_by_name(pbr_if->name, bgp->vrf_id))
+			cnt++;
+	}
+	return cnt;
+}
+
 void bgp_send_pbr_iptable(struct bgp_pbr_action *pba,
 			  struct bgp_pbr_match *pbm,
 			  bool install)
 {
 	struct stream *s;
 	int ret = 0;
+	int nb_interface;
 
 	if (pbm->install_iptable_in_progress)
 		return;
@@ -2594,7 +2631,10 @@ void bgp_send_pbr_iptable(struct bgp_pbr_action *pba,
 			      VRF_DEFAULT);
 
 	bgp_encode_pbr_iptable_match(s, pba, pbm);
-
+	nb_interface = bgp_pbr_get_ifnumber(pba->bgp);
+	stream_putl(s, nb_interface);
+	if (nb_interface)
+		bgp_encode_pbr_interface_list(pba->bgp, s);
 	stream_putw_at(s, 0, stream_get_endp(s));
 	ret = zclient_send_message(zclient);
 	if (install) {
diff --git a/bgpd/bgpd.c b/bgpd/bgpd.c
index 71707b6af..ab13a37d9 100644
--- a/bgpd/bgpd.c
+++ b/bgpd/bgpd.c
@@ -7266,6 +7266,9 @@ static void bgp_config_write_family(struct vty *vty, struct bgp *bgp, afi_t afi,
 	if (safi == SAFI_EVPN)
 		bgp_config_write_evpn_info(vty, bgp, afi, safi);
 
+	if (safi == SAFI_FLOWSPEC)
+		bgp_fs_config_write_pbr(vty, bgp, afi, safi);
+
 	if (safi == SAFI_UNICAST) {
 		bgp_vpn_policy_config_write_afi(vty, bgp, afi);
 		if (CHECK_FLAG(bgp->af_flags[afi][safi],
diff --git a/bgpd/bgpd.h b/bgpd/bgpd.h
index 340851e8d..f663df162 100644
--- a/bgpd/bgpd.h
+++ b/bgpd/bgpd.h
@@ -47,6 +47,7 @@
 
 struct update_subgroup;
 struct bpacket;
+struct bgp_pbr_config;
 
 /*
  * Allow the neighbor XXXX remote-as to take internal or external
@@ -531,6 +532,8 @@ struct bgp {
 
 	struct vpn_policy vpn_policy[AFI_MAX];
 
+	struct bgp_pbr_config *bgp_pbr_cfg;
+
 	QOBJ_FIELDS
 };
 DECLARE_QOBJ_TYPE(bgp)
-- 
cgit v1.2.3