Visitar URL original
virtual router: Add route-maps to BGP peers for Routed Mode (#9964) · apache/cloudstack@e6cd123 · GitHub
Skip to content

Commit e6cd123

Browse files
widowido
authored
virtual router: Add route-maps to BGP peers for Routed Mode (#9964)
* virtual router: Add route-maps to BGP peers for Routed Mode It is best practice, and mandatory in newer version of FRR, that route-maps should be applied to BGP peers. This is to prevent that mistakes can propogate through a network and cause outages. This change changes the route-maps where the VR will only accept IPv4 and IPv4 default gateways (0.0.0.0/0 and ::/0) to be sent by the upstream router to the VR. The other way around this change makes sure that FRR will not allow announcing anything else than the locally defined subnets to the upstream BGP router. * systemvm: ignore comment lines in BGP peer test configuration - Filter comment lines (starting with #) when comparing generated vs expected FRR config - Apply filtering to both generated config and expected config file - Allows keeping license headers in test fixtures while ignoring them in tests - All 11 BGP peer tests pass
1 parent 7ed0cec commit e6cd123

4 files changed

Lines changed: 323 additions & 1 deletion

File tree

‎pom.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1095,6 +1095,7 @@
10951095
<exclude>systemvm/agent/noVNC/**</exclude>
10961096
<exclude>systemvm/agent/packages/**</exclude>
10971097
<exclude>systemvm/debian/**</exclude>
1098+
<exclude>systemvm/test/frr-bgppeers-ipv4-ipv6.conf</exclude>
10981099
<exclude>test/integration/component/test_host_ha.sh</exclude>
10991100
<exclude>tools/appliance/*/template.json</exclude>
11001101
<exclude>tools/cli/cloudmonkey.egg-info/*</exclude>

‎systemvm/debian/opt/cloud/bin/cs/CsBgpPeers.py‎

Lines changed: 53 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,9 @@ def process(self):
5454
self.frr_conf = CsFile(FRR_CONFIG)
5555
self.frr_conf.repopulate()
5656
self._pre_set()
57+
self._access_list_set()
5758
self._process_peers()
59+
self._route_map_set()
5860
self._post_set()
5961
if self.frr_conf.commit():
6062
restart_frr = True
@@ -75,11 +77,31 @@ def _process_dbag_item(self, item):
7577
self.peers[as_number]['ip6_peers'].append(item)
7678

7779
def _pre_set(self):
78-
self.frr_conf.add("frr version 6.0")
7980
self.frr_conf.add("frr defaults traditional")
8081
self.frr_conf.add("hostname {}".format(CsHelper.get_hostname()))
8182
self.frr_conf.add("service integrated-vtysh-config")
8283
self.frr_conf.add("ip nht resolve-via-default")
84+
self.frr_conf.add("ipv6 nht resolve-via-default")
85+
return
86+
87+
def _access_list_set(self):
88+
self.frr_conf.add("ip prefix-list all-v4 seq 1 permit any")
89+
self.frr_conf.add("ip prefix-list default-v4 seq 1 permit 0.0.0.0/0")
90+
self.frr_conf.add("ipv6 prefix-list all-v6 seq 1 permit any")
91+
self.frr_conf.add("ipv6 prefix-list default-v6 seq 1 permit ::/0")
92+
93+
ip4_cidrs = set()
94+
ip6_cidrs = set()
95+
for as_number in self.peers.keys():
96+
ip4_cidrs.update(ip4_peer['guest_ip4_cidr'] for ip4_peer in self.peers[as_number]['ip4_peers'])
97+
ip6_cidrs.update(ip6_peer['guest_ip6_cidr'] for ip6_peer in self.peers[as_number]['ip6_peers'])
98+
99+
for seq, ip4_cidr in enumerate(sorted(ip4_cidrs), start=1):
100+
self.frr_conf.add("ip prefix-list local-v4 seq {} permit {}".format(seq, ip4_cidr))
101+
102+
for seq, ip6_cidr in enumerate(sorted(ip6_cidrs), start=1):
103+
self.frr_conf.add("ipv6 prefix-list local-v6 seq {} permit {}".format(seq, ip6_cidr))
104+
83105
return
84106

85107
def _process_peers(self):
@@ -104,16 +126,46 @@ def _process_peers(self):
104126
self.frr_conf.add(" neighbor {} ebgp-multihop {}".format(ip6_peer['ip6_address'], ip6_peer['details']['EBGP_MultiHop']))
105127
if self.peers[as_number]['ip4_peers']:
106128
self.frr_conf.add(" address-family ipv4 unicast")
129+
for ip4_peer in self.peers[as_number]['ip4_peers']:
130+
self.frr_conf.add(" neighbor {} route-map upstream-v4-in in".format(ip4_peer['ip4_address']))
131+
self.frr_conf.add(" neighbor {} route-map upstream-v4-out out".format(ip4_peer['ip4_address']))
132+
self.frr_conf.add(" neighbor {} soft-reconfiguration inbound".format(ip4_peer['ip4_address']))
107133
ip4_cidrs = set({ip4_peer['guest_ip4_cidr'] for ip4_peer in self.peers[as_number]['ip4_peers']})
108134
for ip4_cidr in ip4_cidrs:
109135
self.frr_conf.add(" network {}".format(ip4_cidr))
110136
self.frr_conf.add(" exit-address-family")
111137
if self.peers[as_number]['ip6_peers']:
112138
self.frr_conf.add(" address-family ipv6 unicast")
139+
for ip6_peer in self.peers[as_number]['ip6_peers']:
140+
self.frr_conf.add(" neighbor {} route-map upstream-v6-in in".format(ip6_peer['ip6_address']))
141+
self.frr_conf.add(" neighbor {} route-map upstream-v6-out out".format(ip6_peer['ip6_address']))
142+
self.frr_conf.add(" neighbor {} soft-reconfiguration inbound".format(ip6_peer['ip6_address']))
113143
ip6_cidrs = set({ip6_peer['guest_ip6_cidr'] for ip6_peer in self.peers[as_number]['ip6_peers']})
114144
for ip6_cidr in ip6_cidrs:
115145
self.frr_conf.add(" network {}".format(ip6_cidr))
116146
self.frr_conf.add(" exit-address-family")
117147

148+
def _route_map_set(self):
149+
self.frr_conf.add("route-map upstream-v4-in permit 10")
150+
self.frr_conf.add(" match ip address prefix-list default-v4")
151+
self.frr_conf.add("route-map upstream-v4-in deny 1000")
152+
self.frr_conf.add(" match ip address prefix-list all-v4")
153+
154+
self.frr_conf.add("route-map upstream-v4-out permit 10")
155+
self.frr_conf.add(" match ip address prefix-list local-v4")
156+
self.frr_conf.add("route-map upstream-v4-out deny 1000")
157+
self.frr_conf.add(" match ip address prefix-list all-v4")
158+
159+
self.frr_conf.add("route-map upstream-v6-in permit 10")
160+
self.frr_conf.add(" match ipv6 address prefix-list default-v6")
161+
self.frr_conf.add("route-map upstream-v6-in deny 1000")
162+
self.frr_conf.add(" match ipv6 address prefix-list all-v6")
163+
164+
self.frr_conf.add("route-map upstream-v6-out permit 10")
165+
self.frr_conf.add(" match ipv6 address prefix-list local-v6")
166+
self.frr_conf.add("route-map upstream-v6-out deny 1000")
167+
self.frr_conf.add(" match ipv6 address prefix-list all-v6")
168+
return
169+
118170
def _post_set(self):
119171
self.frr_conf.add("line vty")

‎systemvm/test/TestCsBgpPeers.py‎

Lines changed: 208 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,208 @@
1+
# Licensed to the Apache Software Foundation (ASF) under one
2+
# or more contributor license agreements. See the NOTICE file
3+
# distributed with this work for additional information
4+
# regarding copyright ownership. The ASF licenses this file
5+
# to you under the Apache License, Version 2.0 (the
6+
# "License"); you may not use this file except in compliance
7+
# with the License. You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing,
12+
# software distributed under the License is distributed on an
13+
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
# KIND, either express or implied. See the License for the
15+
# specific language governing permissions and limitations
16+
# under the License.
17+
18+
import os
19+
import unittest
20+
try:
21+
import mock
22+
except ImportError:
23+
from unittest import mock
24+
from cs.CsBgpPeers import CsBgpPeers
25+
from cs.CsFile import CsFile
26+
import merge
27+
28+
29+
class TestCsBgpPeers(unittest.TestCase):
30+
31+
def setUp(self):
32+
merge.DataBag.DPATH = "."
33+
self.csbgppeers = CsBgpPeers("bgppeers", {})
34+
self.csbgppeers.peers = {}
35+
self.csbgppeers.public_ip = "100.64.0.10"
36+
self.csbgppeers.frr_conf = CsFile("frr.conf.test")
37+
self.csbgppeers.frr_conf.repopulate()
38+
39+
def _peer(self, **kwargs):
40+
peer = {
41+
'peer_id': 1,
42+
'network_id': 100,
43+
'network_as_number': 64512,
44+
'peer_as_number': 64496
45+
}
46+
peer.update(kwargs)
47+
return peer
48+
49+
def _frr_conf(self):
50+
return [line.rstrip('\n') for line in self.csbgppeers.frr_conf.new_config if not line.strip().startswith("#")]
51+
52+
def test_init(self):
53+
self.assertTrue(self.csbgppeers is not None)
54+
55+
def test_process_dbag_item(self):
56+
self.csbgppeers._process_dbag_item(self._peer(ip4_address='100.64.0.1',
57+
guest_ip4_cidr='10.1.1.0/24'))
58+
self.csbgppeers._process_dbag_item(self._peer(ip6_address='2001:db8::1',
59+
guest_ip6_cidr='2001:db8:100::/64'))
60+
self.csbgppeers._process_dbag_item(self._peer(network_as_number=64513,
61+
ip4_address='100.64.1.1',
62+
guest_ip4_cidr='10.2.1.0/24'))
63+
64+
self.assertEqual(sorted(self.csbgppeers.peers.keys()), [64512, 64513])
65+
self.assertEqual(len(self.csbgppeers.peers[64512]['ip4_peers']), 1)
66+
self.assertEqual(len(self.csbgppeers.peers[64512]['ip6_peers']), 1)
67+
self.assertEqual(len(self.csbgppeers.peers[64513]['ip4_peers']), 1)
68+
self.assertEqual(len(self.csbgppeers.peers[64513]['ip6_peers']), 0)
69+
70+
def test_process_dbag_item_dual_stack(self):
71+
self.csbgppeers._process_dbag_item(self._peer(ip4_address='100.64.0.1',
72+
guest_ip4_cidr='10.1.1.0/24',
73+
ip6_address='2001:db8::1',
74+
guest_ip6_cidr='2001:db8:100::/64'))
75+
76+
self.assertEqual(len(self.csbgppeers.peers[64512]['ip4_peers']), 1)
77+
self.assertEqual(len(self.csbgppeers.peers[64512]['ip6_peers']), 1)
78+
79+
def test_access_list_set(self):
80+
self.csbgppeers._process_dbag_item(self._peer(ip4_address='100.64.0.1',
81+
guest_ip4_cidr='10.1.1.0/24',
82+
ip6_address='2001:db8::1',
83+
guest_ip6_cidr='2001:db8:100::/64'))
84+
self.csbgppeers._access_list_set()
85+
86+
config = self._frr_conf()
87+
self.assertIn("ip prefix-list all-v4 seq 1 permit any", config)
88+
self.assertIn("ip prefix-list default-v4 seq 1 permit 0.0.0.0/0", config)
89+
self.assertIn("ipv6 prefix-list all-v6 seq 1 permit any", config)
90+
self.assertIn("ipv6 prefix-list default-v6 seq 1 permit ::/0", config)
91+
self.assertIn("ip prefix-list local-v4 seq 1 permit 10.1.1.0/24", config)
92+
self.assertIn("ipv6 prefix-list local-v6 seq 1 permit 2001:db8:100::/64", config)
93+
94+
def test_access_list_set_deduplicates_cidrs(self):
95+
# Two peers announcing the same guest CIDR should only result in a single prefix-list entry
96+
self.csbgppeers._process_dbag_item(self._peer(ip4_address='100.64.0.1',
97+
guest_ip4_cidr='10.1.1.0/24'))
98+
self.csbgppeers._process_dbag_item(self._peer(peer_id=2,
99+
ip4_address='100.64.0.2',
100+
guest_ip4_cidr='10.1.1.0/24'))
101+
self.csbgppeers._access_list_set()
102+
103+
config = self._frr_conf()
104+
local_v4 = [line for line in config if line.startswith("ip prefix-list local-v4")]
105+
self.assertEqual(local_v4, ["ip prefix-list local-v4 seq 1 permit 10.1.1.0/24"])
106+
107+
def test_access_list_set_multiple_as_numbers(self):
108+
# Sequence numbers may not collide when there are peers for multiple AS numbers,
109+
# otherwise entries overwrite each other in the shared local-v4/local-v6 prefix-lists
110+
self.csbgppeers._process_dbag_item(self._peer(ip4_address='100.64.0.1',
111+
guest_ip4_cidr='10.1.1.0/24'))
112+
self.csbgppeers._process_dbag_item(self._peer(peer_id=2,
113+
network_as_number=64513,
114+
ip4_address='100.64.1.1',
115+
guest_ip4_cidr='10.2.1.0/24'))
116+
self.csbgppeers._access_list_set()
117+
118+
config = self._frr_conf()
119+
local_v4 = [line for line in config if line.startswith("ip prefix-list local-v4")]
120+
self.assertEqual(local_v4, ["ip prefix-list local-v4 seq 1 permit 10.1.1.0/24",
121+
"ip prefix-list local-v4 seq 2 permit 10.2.1.0/24"])
122+
123+
def test_process_peers_ip4(self):
124+
self.csbgppeers._process_dbag_item(self._peer(ip4_address='100.64.0.1',
125+
guest_ip4_cidr='10.1.1.0/24'))
126+
self.csbgppeers._process_peers()
127+
128+
config = self._frr_conf()
129+
self.assertIn("router bgp 64512", config)
130+
self.assertIn(" bgp router-id 100.64.0.10", config)
131+
self.assertIn(" neighbor 100.64.0.1 remote-as 64496", config)
132+
self.assertIn(" neighbor 100.64.0.1 route-map upstream-v4-in in", config)
133+
self.assertIn(" neighbor 100.64.0.1 route-map upstream-v4-out out", config)
134+
self.assertIn(" neighbor 100.64.0.1 soft-reconfiguration inbound", config)
135+
self.assertIn(" network 10.1.1.0/24", config)
136+
self.assertNotIn(" bgp default ipv6-unicast", config)
137+
self.assertNotIn(" neighbor 100.64.0.1 route-map upstream-v4-in in", config)
138+
self.assertNotIn(" neighbor 100.64.0.1 route-map upstream-v4-out out", config)
139+
140+
def test_process_peers_ip6(self):
141+
self.csbgppeers._process_dbag_item(self._peer(ip6_address='2001:db8::1',
142+
guest_ip6_cidr='2001:db8:100::/64'))
143+
self.csbgppeers._process_peers()
144+
145+
config = self._frr_conf()
146+
self.assertIn(" bgp default ipv6-unicast", config)
147+
self.assertIn(" neighbor 2001:db8::1 remote-as 64496", config)
148+
self.assertIn(" neighbor 2001:db8::1 route-map upstream-v6-in in", config)
149+
self.assertIn(" neighbor 2001:db8::1 route-map upstream-v6-out out", config)
150+
self.assertIn(" neighbor 2001:db8::1 soft-reconfiguration inbound", config)
151+
self.assertIn(" network 2001:db8:100::/64", config)
152+
self.assertNotIn(" neighbor 2001:db8::1 route-map upstream-v6-in in", config)
153+
self.assertNotIn(" neighbor 2001:db8::1 route-map upstream-v6-out out", config)
154+
155+
def test_process_peers_password_and_multihop(self):
156+
self.csbgppeers._process_dbag_item(self._peer(ip4_address='100.64.0.1',
157+
guest_ip4_cidr='10.1.1.0/24',
158+
peer_password='S3cr3t!',
159+
details={'EBGP_MultiHop': 2}))
160+
self.csbgppeers._process_peers()
161+
162+
config = self._frr_conf()
163+
self.assertIn(" neighbor 100.64.0.1 password S3cr3t!", config)
164+
self.assertIn(" neighbor 100.64.0.1 ebgp-multihop 2", config)
165+
166+
def test_route_map_set(self):
167+
self.csbgppeers._route_map_set()
168+
169+
expected = [
170+
"route-map upstream-v4-in permit 10",
171+
" match ip address prefix-list default-v4",
172+
"route-map upstream-v4-in deny 1000",
173+
" match ip address prefix-list all-v4",
174+
"route-map upstream-v4-out permit 10",
175+
" match ip address prefix-list local-v4",
176+
"route-map upstream-v4-out deny 1000",
177+
" match ip address prefix-list all-v4",
178+
"route-map upstream-v6-in permit 10",
179+
" match ipv6 address prefix-list default-v6",
180+
"route-map upstream-v6-in deny 1000",
181+
" match ipv6 address prefix-list all-v6",
182+
"route-map upstream-v6-out permit 10",
183+
" match ipv6 address prefix-list local-v6",
184+
"route-map upstream-v6-out deny 1000",
185+
" match ipv6 address prefix-list all-v6"
186+
]
187+
self.assertEqual(self._frr_conf(), expected)
188+
189+
@mock.patch('cs.CsBgpPeers.CsHelper.get_hostname')
190+
def test_full_frr_conf(self, mock_hostname):
191+
mock_hostname.return_value = "r-1001-VM"
192+
self.csbgppeers._process_dbag_item(self._peer(ip4_address='100.64.0.1',
193+
guest_ip4_cidr='10.1.1.0/24',
194+
ip6_address='2001:db8::1',
195+
guest_ip6_cidr='2001:db8:100::/64'))
196+
self.csbgppeers._pre_set()
197+
self.csbgppeers._access_list_set()
198+
self.csbgppeers._process_peers()
199+
self.csbgppeers._route_map_set()
200+
self.csbgppeers._post_set()
201+
202+
with open(os.path.join(os.path.dirname(os.path.abspath(__file__)), "frr-bgppeers-ipv4-ipv6.conf")) as f:
203+
expected = [line.rstrip('\n') for line in f if not line.strip().startswith("#")]
204+
self.assertEqual(self._frr_conf(), expected)
205+
206+
207+
if __name__ == '__main__':
208+
unittest.main()

‎systemvm/test/frr-bgppeers-ipv4-ipv6.conf‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
# Licensed to the Apache Software Foundation (ASF) under one
2+
# or more contributor license agreements. See the NOTICE file
3+
# distributed with this work for additional information
4+
# regarding copyright ownership. The ASF licenses this file
5+
# to you under the Apache License, Version 2.0 (the
6+
# "License"); you may not use this file except in compliance
7+
# with the License. You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing,
12+
# software distributed under the License is distributed on an
13+
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
# KIND, either express or implied. See the License for the
15+
# specific language governing permissions and limitations
16+
# under the License.
17+
frr defaults traditional
18+
hostname r-1001-VM
19+
service integrated-vtysh-config
20+
ip nht resolve-via-default
21+
ipv6 nht resolve-via-default
22+
ip prefix-list all-v4 seq 1 permit any
23+
ip prefix-list default-v4 seq 1 permit 0.0.0.0/0
24+
ipv6 prefix-list all-v6 seq 1 permit any
25+
ipv6 prefix-list default-v6 seq 1 permit ::/0
26+
ip prefix-list local-v4 seq 1 permit 10.1.1.0/24
27+
ipv6 prefix-list local-v6 seq 1 permit 2001:db8:100::/64
28+
router bgp 64512
29+
bgp router-id 100.64.0.10
30+
bgp default ipv6-unicast
31+
neighbor 100.64.0.1 remote-as 64496
32+
neighbor 2001:db8::1 remote-as 64496
33+
address-family ipv4 unicast
34+
neighbor 100.64.0.1 route-map upstream-v4-in in
35+
neighbor 100.64.0.1 route-map upstream-v4-out out
36+
neighbor 100.64.0.1 soft-reconfiguration inbound
37+
network 10.1.1.0/24
38+
exit-address-family
39+
address-family ipv6 unicast
40+
neighbor 2001:db8::1 route-map upstream-v6-in in
41+
neighbor 2001:db8::1 route-map upstream-v6-out out
42+
neighbor 2001:db8::1 soft-reconfiguration inbound
43+
network 2001:db8:100::/64
44+
exit-address-family
45+
route-map upstream-v4-in permit 10
46+
match ip address prefix-list default-v4
47+
route-map upstream-v4-in deny 1000
48+
match ip address prefix-list all-v4
49+
route-map upstream-v4-out permit 10
50+
match ip address prefix-list local-v4
51+
route-map upstream-v4-out deny 1000
52+
match ip address prefix-list all-v4
53+
route-map upstream-v6-in permit 10
54+
match ipv6 address prefix-list default-v6
55+
route-map upstream-v6-in deny 1000
56+
match ipv6 address prefix-list all-v6
57+
route-map upstream-v6-out permit 10
58+
match ipv6 address prefix-list local-v6
59+
route-map upstream-v6-out deny 1000
60+
match ipv6 address prefix-list all-v6
61+
line vty

0 commit comments

Comments
 (0)