proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-08-05 16:57:44 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

bgpd: upon bgp fs study, determine if iprule can be used

Browse Source 
instead of using ipset based mechanism to forward packets, there are
cases where it is possible to use ip rule based mechanisms (without
ipset). Here, this applies to simple fs rules with only 'from any' or
'to any'.

Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
This commit is contained in:
Philippe Guibert 2018-11-29 15:04:52 +01:00
parent ce239ce000
commit 5fa779c968
3 changed files with 26 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
bgpd/bgp_flowspec_util.c
View File

@ -456,8 +456,7 @@ int bgp_flowspec_match_rules_fill(uint8_t *nlri_content, int len,
*/
if (prefix->family == AF_INET
&& prefix->u.prefix4.s_addr == 0)
memset(prefix, 0,
sizeof(struct prefix));
bpem->match_bitmask_iprule |= bitmask;
else
bpem->match_bitmask |= bitmask;
}
@ -580,6 +579,22 @@ int bgp_flowspec_match_rules_fill(uint8_t *nlri_content, int len,
__func__, type);
}
}
if (bpem->match_packet_length_num || bpem->match_fragment_num ||
bpem->match_tcpflags_num || bpem->match_dscp_num ||
bpem->match_packet_length_num || bpem->match_icmp_code_num ||
bpem->match_icmp_type_num || bpem->match_port_num ||
bpem->match_src_port_num || bpem->match_dst_port_num ||
bpem->match_protocol_num || bpem->match_bitmask)
bpem->type = BGP_PBR_IPSET;
else if ((bpem->match_bitmask_iprule & PREFIX_SRC_PRESENT) ||
(bpem->match_bitmask_iprule & PREFIX_DST_PRESENT))
/* the extracted policy rule may not need an
* iptables/ipset filtering. check this may not be
* a standard ip rule : permit any to any ( eg)
*/
bpem->type = BGP_PBR_IPRULE;
else
bpem->type = BGP_PBR_UNDEFINED;
return error;
}

5
bgpd/bgp_pbr.c
View File

@ -448,6 +448,11 @@ static int bgp_pbr_validate_policy_route(struct bgp_pbr_entry_main *api)
{
bool enumerate_icmp = false;
if (api->type == BGP_PBR_UNDEFINED) {
if (BGP_DEBUG(pbr, PBR))
zlog_debug("BGP: pbr entry undefined. cancel.");
return 0;
}
/* because bgp pbr entry may contain unsupported
* combinations, a message will be displayed here if
* not supported.

4
bgpd/bgp_pbr.h
View File

@ -87,6 +87,9 @@ struct bgp_pbr_entry_action {
/* BGP Policy Route structure */
struct bgp_pbr_entry_main {
#define BGP_PBR_UNDEFINED 0
#define BGP_PBR_IPSET 1
#define BGP_PBR_IPRULE 2
uint8_t type;
/*
@ -98,6 +101,7 @@ struct bgp_pbr_entry_main {
#define PREFIX_SRC_PRESENT (1 << 0)
#define PREFIX_DST_PRESENT (1 << 1)
uint8_t match_bitmask_iprule;
uint8_t match_bitmask;
uint8_t match_src_port_num;