summaryrefslogtreecommitdiffstats
path: root/pimd/pim_msdp_packet.c
diff options
context:
space:
mode:
Diffstat (limited to 'pimd/pim_msdp_packet.c')
-rw-r--r--pimd/pim_msdp_packet.c164
1 files changed, 140 insertions, 24 deletions
diff --git a/pimd/pim_msdp_packet.c b/pimd/pim_msdp_packet.c
index 4324a96b..27f4966a 100644
--- a/pimd/pim_msdp_packet.c
+++ b/pimd/pim_msdp_packet.c
@@ -6,7 +6,9 @@
#include <zebra.h>
#include <lib/log.h>
+#include <lib/filter.h>
#include <lib/network.h>
+#include <lib/prefix.h>
#include <lib/stream.h>
#include "frrevent.h"
#include <lib/vty.h>
@@ -322,8 +324,8 @@ void pim_msdp_pkt_ka_tx(struct pim_msdp_peer *mp)
pim_msdp_pkt_send(mp, s);
}
-static void pim_msdp_pkt_sa_push_to_one_peer(struct pim_instance *pim,
- struct pim_msdp_peer *mp)
+static void pim_msdp_pkt_sa_push(struct pim_instance *pim,
+ struct pim_msdp_peer *mp)
{
struct stream *s;
@@ -338,25 +340,6 @@ static void pim_msdp_pkt_sa_push_to_one_peer(struct pim_instance *pim,
}
}
-/* push the stream into the obuf fifo of all the peers */
-static void pim_msdp_pkt_sa_push(struct pim_instance *pim,
- struct pim_msdp_peer *mp)
-{
- struct listnode *mpnode;
-
- if (mp) {
- pim_msdp_pkt_sa_push_to_one_peer(pim, mp);
- } else {
- for (ALL_LIST_ELEMENTS_RO(pim->msdp.peer_list, mpnode, mp)) {
- if (PIM_DEBUG_MSDP_INTERNAL) {
- zlog_debug("MSDP peer %s pim_msdp_pkt_sa_push",
- mp->key_str);
- }
- pim_msdp_pkt_sa_push_to_one_peer(pim, mp);
- }
- }
-}
-
static int pim_msdp_pkt_sa_fill_hdr(struct pim_instance *pim, int local_cnt,
struct in_addr rp)
{
@@ -384,6 +367,90 @@ static void pim_msdp_pkt_sa_fill_one(struct pim_msdp_sa *sa)
stream_put_ipv4(sa->pim->msdp.work_obuf, sa->sg.src.s_addr);
}
+static bool msdp_cisco_match(const struct filter *filter,
+ const struct in_addr *source,
+ const struct in_addr *group)
+{
+ const struct filter_cisco *cfilter = &filter->u.cfilter;
+ uint32_t source_addr;
+ uint32_t group_addr;
+
+ group_addr = group->s_addr & ~cfilter->mask_mask.s_addr;
+
+ if (cfilter->extended) {
+ source_addr = source->s_addr & ~cfilter->addr_mask.s_addr;
+ if (group_addr == cfilter->mask.s_addr &&
+ source_addr == cfilter->addr.s_addr)
+ return true;
+ } else if (group_addr == cfilter->addr.s_addr)
+ return true;
+
+ return false;
+}
+
+static enum filter_type msdp_access_list_apply(struct access_list *access,
+ const struct in_addr *source,
+ const struct in_addr *group)
+{
+ struct filter *filter;
+ struct prefix group_prefix;
+
+ if (access == NULL)
+ return FILTER_DENY;
+
+ for (filter = access->head; filter; filter = filter->next) {
+ if (filter->cisco) {
+ if (msdp_cisco_match(filter, source, group))
+ return filter->type;
+ } else {
+ group_prefix.family = AF_INET;
+ group_prefix.prefixlen = IPV4_MAX_BITLEN;
+ group_prefix.u.prefix4.s_addr = group->s_addr;
+ if (access_list_apply(access, &group_prefix))
+ return filter->type;
+ }
+ }
+
+ return FILTER_DENY;
+}
+
+bool msdp_peer_sa_filter(const struct pim_msdp_peer *mp,
+ const struct pim_msdp_sa *sa)
+{
+ struct access_list *acl;
+
+ /* No output filter configured, just quit. */
+ if (mp->acl_out == NULL)
+ return false;
+
+ /* Find access list and test it. */
+ acl = access_list_lookup(AFI_IP, mp->acl_out);
+ if (msdp_access_list_apply(acl, &sa->sg.src, &sa->sg.grp) == FILTER_DENY)
+ return true;
+
+ return false;
+}
+
+/** Count the number of SAs to be sent for a specific peer. */
+static size_t pim_msdp_peer_sa_count(const struct pim_instance *pim,
+ const struct pim_msdp_peer *peer)
+{
+ const struct pim_msdp_sa *sa;
+ const struct listnode *node;
+ size_t sa_count = 0;
+
+ for (ALL_LIST_ELEMENTS_RO(pim->msdp.sa_list, node, sa)) {
+ if (!CHECK_FLAG(sa->flags, PIM_MSDP_SAF_LOCAL))
+ continue;
+ if (msdp_peer_sa_filter(peer, sa))
+ continue;
+
+ sa_count++;
+ }
+
+ return sa_count;
+}
+
static void pim_msdp_pkt_sa_gen(struct pim_instance *pim,
struct pim_msdp_peer *mp)
{
@@ -393,7 +460,7 @@ static void pim_msdp_pkt_sa_gen(struct pim_instance *pim,
struct prefix group_all;
struct in_addr rp;
int sa_count;
- int local_cnt = pim->msdp.local_cnt;
+ int local_cnt = pim_msdp_peer_sa_count(pim, mp);
sa_count = 0;
if (PIM_DEBUG_MSDP_INTERNAL) {
@@ -418,6 +485,15 @@ static void pim_msdp_pkt_sa_gen(struct pim_instance *pim,
* peers */
continue;
}
+
+ if (msdp_peer_sa_filter(mp, sa)) {
+ if (PIM_DEBUG_MSDP_EVENTS)
+ zlog_debug("MSDP peer %pI4 filter SA out %s",
+ &mp->peer, sa->sg_str);
+
+ continue;
+ }
+
/* add sa into scratch pad */
pim_msdp_pkt_sa_fill_one(sa);
++sa_count;
@@ -457,15 +533,32 @@ static void pim_msdp_pkt_sa_tx_done(struct pim_instance *pim)
void pim_msdp_pkt_sa_tx(struct pim_instance *pim)
{
- pim_msdp_pkt_sa_gen(pim, NULL /* mp */);
+ struct pim_msdp_peer *mp;
+ struct listnode *node;
+
+ for (ALL_LIST_ELEMENTS_RO(pim->msdp.peer_list, node, mp))
+ pim_msdp_pkt_sa_gen(pim, mp);
+
pim_msdp_pkt_sa_tx_done(pim);
}
void pim_msdp_pkt_sa_tx_one(struct pim_msdp_sa *sa)
{
+ struct pim_msdp_peer *mp;
+ struct listnode *node;
+
pim_msdp_pkt_sa_fill_hdr(sa->pim, 1 /* cnt */, sa->rp);
pim_msdp_pkt_sa_fill_one(sa);
- pim_msdp_pkt_sa_push(sa->pim, NULL);
+ for (ALL_LIST_ELEMENTS_RO(sa->pim->msdp.peer_list, node, mp)) {
+ if (msdp_peer_sa_filter(mp, sa)) {
+ if (PIM_DEBUG_MSDP_EVENTS)
+ zlog_debug("MSDP peer %pI4 filter SA out %s",
+ &mp->peer, sa->sg_str);
+ continue;
+ }
+
+ pim_msdp_pkt_sa_push(sa->pim, mp);
+ }
pim_msdp_pkt_sa_tx_done(sa->pim);
}
@@ -487,6 +580,15 @@ void pim_msdp_pkt_sa_tx_one_to_one_peer(struct pim_msdp_peer *mp,
/* Fills the message contents. */
sa.pim = mp->pim;
sa.sg = sg;
+
+ /* Don't push it if filtered. */
+ if (msdp_peer_sa_filter(mp, &sa)) {
+ if (PIM_DEBUG_MSDP_EVENTS)
+ zlog_debug("MSDP peer %pI4 filter SA out (%pI4, %pI4)",
+ &mp->peer, &sa.sg.src, &sa.sg.grp);
+ return;
+ }
+
pim_msdp_pkt_sa_fill_one(&sa);
/* Pushes the message. */
@@ -511,6 +613,7 @@ static void pim_msdp_pkt_ka_rx(struct pim_msdp_peer *mp, int len)
static void pim_msdp_pkt_sa_rx_one(struct pim_msdp_peer *mp, struct in_addr rp)
{
+ struct access_list *acl;
int prefix_len;
pim_sgaddr sg;
struct listnode *peer_node;
@@ -534,6 +637,19 @@ static void pim_msdp_pkt_sa_rx_one(struct pim_msdp_peer *mp, struct in_addr rp)
if (PIM_DEBUG_MSDP_PACKETS) {
zlog_debug(" sg %pSG", &sg);
}
+
+ /* Filter incoming SA with configured access list. */
+ if (mp->acl_in) {
+ acl = access_list_lookup(AFI_IP, mp->acl_in);
+ if (msdp_access_list_apply(acl, &sg.src, &sg.grp) ==
+ FILTER_DENY) {
+ if (PIM_DEBUG_MSDP_EVENTS)
+ zlog_debug("MSDP peer %pI4 filter SA in (%pI4, %pI4)",
+ &mp->peer, &sg.src, &sg.grp);
+ return;
+ }
+ }
+
pim_msdp_sa_ref(mp->pim, mp, &sg, rp);
/* Forwards the SA to the peers that are not in the RPF to the RP nor in
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-18 08:41:45 +0100