Check validity of dest w.r.t. net_type

Allow to define static roa/flow routes without dest.
This commit is contained in:
Ondrej Zajicek (work) 2017-04-05 16:16:04 +02:00
parent 3484cb9a65
commit 4278abfe27
6 changed files with 71 additions and 35 deletions

View file

@ -124,7 +124,7 @@ include ^{WHITE}*include{WHITE}*\".*\"{WHITE}*;
} }
{DIGIT}+:{DIGIT}+ { {DIGIT}+:{DIGIT}+ {
unsigned long int l, len1, len2; unsigned long int l, len1 UNUSED, len2;
char *e; char *e;
errno = 0; errno = 0;

View file

@ -177,33 +177,29 @@ net_hash(const net_addr *n)
case NET_ROA6: return NET_HASH(n, roa6); case NET_ROA6: return NET_HASH(n, roa6);
case NET_FLOW4: return NET_HASH(n, flow4); case NET_FLOW4: return NET_HASH(n, flow4);
case NET_FLOW6: return NET_HASH(n, flow6); case NET_FLOW6: return NET_HASH(n, flow6);
case NET_MPLS: return NET_HASH(n, mpls);
default: bug("invalid type"); default: bug("invalid type");
} }
} }
#define NET_VALIDATE(a,t) net_validate_##t((const net_addr_##t *) a)
int int
net_validate(const net_addr *N) net_validate(const net_addr *n)
{ {
switch (N->type) switch (n->type)
{ {
case NET_IP4: case NET_IP4: return NET_VALIDATE(n, ip4);
case NET_VPN4: case NET_IP6: return NET_VALIDATE(n, ip6);
case NET_ROA4: case NET_VPN4: return NET_VALIDATE(n, vpn4);
case NET_FLOW4: case NET_VPN6: return NET_VALIDATE(n, vpn6);
return net_validate_ip4((net_addr_ip4 *) N); case NET_ROA4: return NET_VALIDATE(n, roa4);
case NET_ROA6: return NET_VALIDATE(n, roa6);
case NET_IP6: case NET_FLOW4: return NET_VALIDATE(n, flow4);
case NET_VPN6: case NET_FLOW6: return NET_VALIDATE(n, flow6);
case NET_ROA6: case NET_MPLS: return NET_VALIDATE(n, mpls);
case NET_FLOW6: default: return 0;
return net_validate_ip6((net_addr_ip6 *) N);
case NET_MPLS:
return net_validate_mpls((net_addr_mpls *) N);
default:
return 0;
} }
} }

View file

@ -37,6 +37,7 @@
#define NB_IP (NB_IP4 | NB_IP6) #define NB_IP (NB_IP4 | NB_IP6)
#define NB_VPN (NB_VPN4 | NB_VPN6) #define NB_VPN (NB_VPN4 | NB_VPN6)
#define NB_FLOW (NB_FLOW4 | NB_FLOW6) #define NB_FLOW (NB_FLOW4 | NB_FLOW6)
#define NB_DEST (NB_IP | NB_VPN | NB_MPLS)
#define NB_ANY 0xffffffff #define NB_ANY 0xffffffff
@ -457,23 +458,52 @@ static inline u32 net_hash_mpls(const net_addr_mpls *n)
u32 net_hash(const net_addr *a); u32 net_hash(const net_addr *a);
static inline int net_validate_ip4(const net_addr_ip4 *n) static inline int net_validate_px4(const ip4_addr prefix, uint pxlen)
{ {
return (n->pxlen <= IP4_MAX_PREFIX_LENGTH) && return (pxlen <= IP4_MAX_PREFIX_LENGTH) &&
ip4_zero(ip4_and(n->prefix, ip4_not(ip4_mkmask(n->pxlen)))); ip4_zero(ip4_and(prefix, ip4_not(ip4_mkmask(pxlen))));
} }
static inline int net_validate_px6(const ip6_addr prefix, uint pxlen)
{
return (pxlen <= IP6_MAX_PREFIX_LENGTH) &&
ip6_zero(ip6_and(prefix, ip6_not(ip6_mkmask(pxlen))));
}
static inline int net_validate_ip4(const net_addr_ip4 *n)
{ return net_validate_px4(n->prefix, n->pxlen); }
static inline int net_validate_ip6(const net_addr_ip6 *n) static inline int net_validate_ip6(const net_addr_ip6 *n)
{ return net_validate_px6(n->prefix, n->pxlen); }
static inline int net_validate_vpn4(const net_addr_vpn4 *n)
{ return net_validate_px4(n->prefix, n->pxlen); }
static inline int net_validate_vpn6(const net_addr_vpn6 *n)
{ return net_validate_px6(n->prefix, n->pxlen); }
static inline int net_validate_roa4(const net_addr_roa4 *n)
{ {
return (n->pxlen <= IP6_MAX_PREFIX_LENGTH) && return net_validate_px4(n->prefix, n->pxlen) &&
ip6_zero(ip6_and(n->prefix, ip6_not(ip6_mkmask(n->pxlen)))); (n->pxlen <= n->max_pxlen) && (n->max_pxlen <= IP4_MAX_PREFIX_LENGTH);
} }
static inline int net_validate_mpls(const net_addr_mpls *n) static inline int net_validate_roa6(const net_addr_roa6 *n)
{ {
return n->label < (1 << 20); return net_validate_px6(n->prefix, n->pxlen) &&
(n->pxlen <= n->max_pxlen) && (n->max_pxlen <= IP6_MAX_PREFIX_LENGTH);
} }
// FIXME: Better check, call flow_validate?
static inline int net_validate_flow4(const net_addr_flow4 *n)
{ return net_validate_px4(n->prefix, n->pxlen); }
static inline int net_validate_flow6(const net_addr_flow6 *n)
{ return net_validate_px6(n->prefix, n->pxlen); }
static inline int net_validate_mpls(const net_addr_mpls *n)
{ return n->label < (1 << 20); }
int net_validate(const net_addr *N); int net_validate(const net_addr *N);

View file

@ -900,7 +900,6 @@ rte_validate(rte *e)
int c; int c;
net *n = e->net; net *n = e->net;
// (n->n.pxlen > BITS_PER_IP_ADDRESS) || !ip_is_prefix(n->n.prefix,n->n.pxlen))
if (!net_validate(n->n.addr)) if (!net_validate(n->n.addr))
{ {
log(L_WARN "Ignoring bogus prefix %N received via %s", log(L_WARN "Ignoring bogus prefix %N received via %s",
@ -916,12 +915,19 @@ rte_validate(rte *e)
return 0; return 0;
} }
if (net_type_match(n->n.addr, NB_DEST) == !e->attrs->dest)
{
log(L_WARN "Ignoring route %N with invalid dest %d received via %s",
n->n.addr, e->attrs->dest, e->sender->proto->name);
return 0;
}
if ((e->attrs->dest == RTD_UNICAST) && !nexthop_is_sorted(&(e->attrs->nh))) if ((e->attrs->dest == RTD_UNICAST) && !nexthop_is_sorted(&(e->attrs->nh)))
{ {
log(L_WARN "Ignoring unsorted multipath route %N received via %s", log(L_WARN "Ignoring unsorted multipath route %N received via %s",
n->n.addr, e->sender->proto->name); n->n.addr, e->sender->proto->name);
return 0; return 0;
} }
return 1; return 1;
} }

View file

@ -903,7 +903,7 @@ rpki_postconfig(struct proto_config *CF)
} }
static void static void
rpki_copy_config(struct proto_config *dest, struct proto_config *src) rpki_copy_config(struct proto_config *dest UNUSED, struct proto_config *src UNUSED)
{ {
/* FIXME: Should copy transport */ /* FIXME: Should copy transport */
} }

View file

@ -36,7 +36,10 @@ static_nexthop_new(void)
static void static void
static_route_finish(void) static_route_finish(void)
{ } {
if (net_type_match(this_srt->net, NB_DEST) == !this_srt->dest)
cf_error("Unexpected or missing nexthop/type");
}
CF_DECLS CF_DECLS
@ -119,6 +122,7 @@ stat_route:
this_srt->via = $3; this_srt->via = $3;
this_srt->mls = $5; this_srt->mls = $5;
} }
| stat_route0 { this_srt->dest = RTD_NONE; }
| stat_route0 DROP { this_srt->dest = RTD_BLACKHOLE; } | stat_route0 DROP { this_srt->dest = RTD_BLACKHOLE; }
| stat_route0 REJECT { this_srt->dest = RTD_UNREACHABLE; } | stat_route0 REJECT { this_srt->dest = RTD_UNREACHABLE; }
| stat_route0 BLACKHOLE { this_srt->dest = RTD_BLACKHOLE; } | stat_route0 BLACKHOLE { this_srt->dest = RTD_BLACKHOLE; }