mirror of
https://git.proxmox.com/git/mirror_frr
synced 2025-08-05 02:46:37 +00:00
Merge pull request #4275 from ton31337/fix/move_outside_bgp_input_modifier
bgpd: Move inbound policy check outside bgp_input_modifier()
This commit is contained in:
commit
11056dd815
@ -1219,20 +1219,6 @@ static int bgp_input_modifier(struct peer *peer, struct prefix *p,
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
/* RFC 8212 to prevent route leaks.
|
|
||||||
* This specification intends to improve this situation by requiring the
|
|
||||||
* explicit configuration of both BGP Import and Export Policies for any
|
|
||||||
* External BGP (EBGP) session such as customers, peers, or
|
|
||||||
* confederation boundaries for all enabled address families. Through
|
|
||||||
* codification of the aforementioned requirement, operators will
|
|
||||||
* benefit from consistent behavior across different BGP
|
|
||||||
* implementations.
|
|
||||||
*/
|
|
||||||
if (peer->bgp->ebgp_requires_policy
|
|
||||||
== DEFAULT_EBGP_POLICY_ENABLED)
|
|
||||||
if (!bgp_inbound_policy_exists(peer, filter))
|
|
||||||
return RMAP_DENY;
|
|
||||||
|
|
||||||
/* Route map apply. */
|
/* Route map apply. */
|
||||||
if (rmap) {
|
if (rmap) {
|
||||||
memset(&rmap_path, 0, sizeof(struct bgp_path_info));
|
memset(&rmap_path, 0, sizeof(struct bgp_path_info));
|
||||||
@ -3049,6 +3035,22 @@ int bgp_update(struct peer *peer, struct prefix *p, uint32_t addpath_id,
|
|||||||
goto filtered;
|
goto filtered;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/* RFC 8212 to prevent route leaks.
|
||||||
|
* This specification intends to improve this situation by requiring the
|
||||||
|
* explicit configuration of both BGP Import and Export Policies for any
|
||||||
|
* External BGP (EBGP) session such as customers, peers, or
|
||||||
|
* confederation boundaries for all enabled address families. Through
|
||||||
|
* codification of the aforementioned requirement, operators will
|
||||||
|
* benefit from consistent behavior across different BGP
|
||||||
|
* implementations.
|
||||||
|
*/
|
||||||
|
if (peer->bgp->ebgp_requires_policy == DEFAULT_EBGP_POLICY_ENABLED)
|
||||||
|
if (!bgp_inbound_policy_exists(peer,
|
||||||
|
&peer->filter[afi][safi])) {
|
||||||
|
reason = "inbound policy missing";
|
||||||
|
goto filtered;
|
||||||
|
}
|
||||||
|
|
||||||
bgp_attr_dup(&new_attr, attr);
|
bgp_attr_dup(&new_attr, attr);
|
||||||
|
|
||||||
/* Apply incoming route-map.
|
/* Apply incoming route-map.
|
||||||
|
12
tests/topotests/bgp_ebgp_requires_policy/r1/bgpd.conf
Normal file
12
tests/topotests/bgp_ebgp_requires_policy/r1/bgpd.conf
Normal file
@ -0,0 +1,12 @@
|
|||||||
|
router bgp 65000
|
||||||
|
bgp ebgp-requires-policy
|
||||||
|
neighbor 192.168.255.2 remote-as 1000
|
||||||
|
neighbor 192.168.255.2 local-as 500
|
||||||
|
address-family ipv4 unicast
|
||||||
|
redistribute connected
|
||||||
|
neighbor 192.168.255.2 route-map outgoing out
|
||||||
|
!
|
||||||
|
ip prefix-list peer-out permit 172.16.255.254/32
|
||||||
|
route-map outgoing permit 10
|
||||||
|
match ip address prefix-list peer-out
|
||||||
|
!
|
9
tests/topotests/bgp_ebgp_requires_policy/r1/zebra.conf
Normal file
9
tests/topotests/bgp_ebgp_requires_policy/r1/zebra.conf
Normal file
@ -0,0 +1,9 @@
|
|||||||
|
!
|
||||||
|
interface lo
|
||||||
|
ip address 172.16.255.254/32
|
||||||
|
!
|
||||||
|
interface r1-eth0
|
||||||
|
ip address 192.168.255.1/24
|
||||||
|
!
|
||||||
|
ip forwarding
|
||||||
|
!
|
2
tests/topotests/bgp_ebgp_requires_policy/r2/bgpd.conf
Normal file
2
tests/topotests/bgp_ebgp_requires_policy/r2/bgpd.conf
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
router bgp 1000
|
||||||
|
neighbor 192.168.255.1 remote-as 500
|
6
tests/topotests/bgp_ebgp_requires_policy/r2/zebra.conf
Normal file
6
tests/topotests/bgp_ebgp_requires_policy/r2/zebra.conf
Normal file
@ -0,0 +1,6 @@
|
|||||||
|
!
|
||||||
|
interface r2-eth0
|
||||||
|
ip address 192.168.255.2/24
|
||||||
|
!
|
||||||
|
ip forwarding
|
||||||
|
!
|
6
tests/topotests/bgp_ebgp_requires_policy/r3/bgpd.conf
Normal file
6
tests/topotests/bgp_ebgp_requires_policy/r3/bgpd.conf
Normal file
@ -0,0 +1,6 @@
|
|||||||
|
router bgp 65000
|
||||||
|
bgp ebgp-requires-policy
|
||||||
|
neighbor 192.168.255.2 remote-as 1000
|
||||||
|
neighbor 192.168.255.2 local-as 500
|
||||||
|
address-family ipv4 unicast
|
||||||
|
redistribute connected
|
9
tests/topotests/bgp_ebgp_requires_policy/r3/zebra.conf
Normal file
9
tests/topotests/bgp_ebgp_requires_policy/r3/zebra.conf
Normal file
@ -0,0 +1,9 @@
|
|||||||
|
!
|
||||||
|
interface lo
|
||||||
|
ip address 172.16.255.254/32
|
||||||
|
!
|
||||||
|
interface r3-eth0
|
||||||
|
ip address 192.168.255.1/24
|
||||||
|
!
|
||||||
|
ip forwarding
|
||||||
|
!
|
2
tests/topotests/bgp_ebgp_requires_policy/r4/bgpd.conf
Normal file
2
tests/topotests/bgp_ebgp_requires_policy/r4/bgpd.conf
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
router bgp 1000
|
||||||
|
neighbor 192.168.255.1 remote-as 500
|
6
tests/topotests/bgp_ebgp_requires_policy/r4/zebra.conf
Normal file
6
tests/topotests/bgp_ebgp_requires_policy/r4/zebra.conf
Normal file
@ -0,0 +1,6 @@
|
|||||||
|
!
|
||||||
|
interface r4-eth0
|
||||||
|
ip address 192.168.255.2/24
|
||||||
|
!
|
||||||
|
ip forwarding
|
||||||
|
!
|
@ -0,0 +1,113 @@
|
|||||||
|
#!/usr/bin/env python
|
||||||
|
|
||||||
|
#
|
||||||
|
# bgp_ebgp_requires_policy.py
|
||||||
|
# Part of NetDEF Topology Tests
|
||||||
|
#
|
||||||
|
# Copyright (c) 2019 by
|
||||||
|
# Network Device Education Foundation, Inc. ("NetDEF")
|
||||||
|
#
|
||||||
|
# Permission to use, copy, modify, and/or distribute this software
|
||||||
|
# for any purpose with or without fee is hereby granted, provided
|
||||||
|
# that the above copyright notice and this permission notice appear
|
||||||
|
# in all copies.
|
||||||
|
#
|
||||||
|
# THE SOFTWARE IS PROVIDED "AS IS" AND NETDEF DISCLAIMS ALL WARRANTIES
|
||||||
|
# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
||||||
|
# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL NETDEF BE LIABLE FOR
|
||||||
|
# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY
|
||||||
|
# DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
|
||||||
|
# WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
|
||||||
|
# ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
|
||||||
|
# OF THIS SOFTWARE.
|
||||||
|
#
|
||||||
|
|
||||||
|
"""
|
||||||
|
bgp_ebgp_requires_policy.py:
|
||||||
|
|
||||||
|
Test if eBGP sender without a filter applied to the peer is allowed
|
||||||
|
to send advertisements.
|
||||||
|
"""
|
||||||
|
|
||||||
|
import os
|
||||||
|
import sys
|
||||||
|
import json
|
||||||
|
import time
|
||||||
|
import pytest
|
||||||
|
|
||||||
|
CWD = os.path.dirname(os.path.realpath(__file__))
|
||||||
|
sys.path.append(os.path.join(CWD, '../'))
|
||||||
|
|
||||||
|
# pylint: disable=C0413
|
||||||
|
from lib import topotest
|
||||||
|
from lib.topogen import Topogen, TopoRouter, get_topogen
|
||||||
|
from lib.topolog import logger
|
||||||
|
from mininet.topo import Topo
|
||||||
|
|
||||||
|
class TemplateTopo(Topo):
|
||||||
|
def build(self, *_args, **_opts):
|
||||||
|
tgen = get_topogen(self)
|
||||||
|
|
||||||
|
for routern in range(1, 5):
|
||||||
|
tgen.add_router('r{}'.format(routern))
|
||||||
|
|
||||||
|
switch = tgen.add_switch('s1')
|
||||||
|
switch.add_link(tgen.gears['r1'])
|
||||||
|
switch.add_link(tgen.gears['r2'])
|
||||||
|
|
||||||
|
switch = tgen.add_switch('s2')
|
||||||
|
switch.add_link(tgen.gears['r3'])
|
||||||
|
switch.add_link(tgen.gears['r4'])
|
||||||
|
|
||||||
|
def setup_module(mod):
|
||||||
|
tgen = Topogen(TemplateTopo, mod.__name__)
|
||||||
|
tgen.start_topology()
|
||||||
|
|
||||||
|
router_list = tgen.routers()
|
||||||
|
|
||||||
|
for i, (rname, router) in enumerate(router_list.iteritems(), 1):
|
||||||
|
router.load_config(
|
||||||
|
TopoRouter.RD_ZEBRA,
|
||||||
|
os.path.join(CWD, '{}/zebra.conf'.format(rname))
|
||||||
|
)
|
||||||
|
router.load_config(
|
||||||
|
TopoRouter.RD_BGP,
|
||||||
|
os.path.join(CWD, '{}/bgpd.conf'.format(rname))
|
||||||
|
)
|
||||||
|
|
||||||
|
tgen.start_router()
|
||||||
|
|
||||||
|
def teardown_module(mod):
|
||||||
|
tgen = get_topogen()
|
||||||
|
tgen.stop_topology()
|
||||||
|
|
||||||
|
def test_bgp_remove_private_as():
|
||||||
|
tgen = get_topogen()
|
||||||
|
|
||||||
|
if tgen.routers_have_failure():
|
||||||
|
pytest.skip(tgen.errors)
|
||||||
|
|
||||||
|
def _bgp_converge(router):
|
||||||
|
while True:
|
||||||
|
cmd = "show ip bgp neighbor 192.168.255.1 json"
|
||||||
|
output = json.loads(tgen.gears[router].vtysh_cmd(cmd))
|
||||||
|
if output['192.168.255.1']['bgpState'] == 'Established':
|
||||||
|
time.sleep(3)
|
||||||
|
return True
|
||||||
|
|
||||||
|
def _bgp_ebgp_requires_policy(router):
|
||||||
|
cmd = "show ip bgp 172.16.255.254/32 json"
|
||||||
|
output = json.loads(tgen.gears[router].vtysh_cmd(cmd))
|
||||||
|
if 'prefix' in output:
|
||||||
|
return True
|
||||||
|
return False
|
||||||
|
|
||||||
|
if _bgp_converge('r2'):
|
||||||
|
assert _bgp_ebgp_requires_policy('r2') == True
|
||||||
|
|
||||||
|
if _bgp_converge('r4'):
|
||||||
|
assert _bgp_ebgp_requires_policy('r4') == False
|
||||||
|
|
||||||
|
if __name__ == '__main__':
|
||||||
|
args = ["-s"] + sys.argv[1:]
|
||||||
|
sys.exit(pytest.main(args))
|
Loading…
Reference in New Issue
Block a user