Rayhaan JaufeerallyandClaude Fable 5.1
cbf0df1eef
A new crate, bgp-policy, runs functions of a script on routes: on their
way in, after the general checks of a peer's import and before the
checks that can change (RPKI, next hop reachability); and on their way
out to a peer. A function is given the route and the peer, may refuse
the route, and may change its communities, large communities,
LOCAL_PREF and MED, and on the way out prepend our AS:
fn from_peer(route, peer) {
if route.has_community("65535:666") { return false; }
route.add_community(LEARNED_FROM[peer.role]);
route.local_pref = PREFERENCE[peer.role];
true
}
Configuration: policy { path | source, import_function, export_function }
and, for a peer, import { function } and export { function }. The script
is compiled at startup; `bgp --check` reads it and says which function
is whose. A function that fails on a route has refused it. Scripts have
no files, network or clock, and are stopped after 200,000 steps.
Route selection now goes by a LOCAL_PREF on a route from an external
peer: the decoder never lets a peer's own through, so one that is there
was set by policy.
What it costs was measured before it was built on (benches/policy.rs):
a call that tests a few communities and changes two takes 1 to 3
microseconds, some two hundred times what Rust would. So a function is
asked once for the routes of an UPDATE, which share their attributes,
unless it asks for the prefix. One peer sending 1.23 M routes over a
session: 0.37 s without a function, 0.80 s with one that marks and
ranks every route, 3.4 s if it also looks at the prefix.
Export applies to what is announced, which today is what the daemon
originates; learned routes are not passed on yet.
Tested by unit tests of the crate, sessions end to end, a fuzz target on
the example script (testdata/policy.rhai), and a lab phase in which a
script changes which of FRR's and BIRD's route is chosen and what each
of them is told.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
116 lines
3.9 KiB
Rust
116 lines
3.9 KiB
Rust
//! Who may connect: only the addresses of configured peers, and each of
|
|
//! them only so many times at once.
|
|
|
|
use std::net::{Ipv4Addr, SocketAddr};
|
|
use std::time::Duration;
|
|
|
|
use bgp_integration_tests::test_peer::TestPeer;
|
|
use bgp_integration_tests::test_server::TestServer;
|
|
use bgp_server::config::PeerConfig;
|
|
use bgp_server::family::FamilySet;
|
|
use bgp_server::policy::ImportPolicy;
|
|
use eyre::Result;
|
|
use tokio::net::TcpListener;
|
|
|
|
const LOCAL_ASN: u32 = 65000;
|
|
const PEER_ASN: u32 = 65001;
|
|
const TIMEOUT: Duration = Duration::from_secs(5);
|
|
|
|
fn peer_at(endpoint: SocketAddr) -> PeerConfig {
|
|
PeerConfig {
|
|
name: "r1".into(),
|
|
endpoint: endpoint.into(),
|
|
remote_asn: PEER_ASN,
|
|
hold_time_secs: 90,
|
|
local_address: None,
|
|
families: FamilySet::supported(),
|
|
add_path: None,
|
|
import: ImportPolicy::permissive(),
|
|
role: None,
|
|
require_role: false,
|
|
import_hook: None,
|
|
export_hook: None,
|
|
}
|
|
}
|
|
|
|
/// Whether the server closed the connection without sending anything.
|
|
async fn closed_unanswered(peer: &mut TestPeer) -> bool {
|
|
matches!(tokio::time::timeout(TIMEOUT, peer.recv()).await, Ok(Err(_)))
|
|
}
|
|
|
|
/// A host that is not a configured peer gets nothing: no OPEN to answer,
|
|
/// no session, no routes taken from it. Any host used to be able to open a
|
|
/// session as any AS it named.
|
|
#[tokio::test]
|
|
async fn test_a_host_that_is_not_a_configured_peer_is_refused() -> Result<()> {
|
|
// The only peer configured is somewhere else (documentation space).
|
|
let server = TestServer::start_with(LOCAL_ASN, |c| {
|
|
c.accept_unconfigured_peers = false;
|
|
c.peers = vec![peer_at("192.0.2.9:179".parse().unwrap())];
|
|
})
|
|
.await?;
|
|
|
|
let mut stranger = TestPeer::connect(server.addr).await?;
|
|
assert!(closed_unanswered(&mut stranger).await);
|
|
assert!(server.registry.list().is_empty());
|
|
Ok(())
|
|
}
|
|
|
|
/// The address of a configured peer is let in, and held to what is
|
|
/// configured for that peer.
|
|
#[tokio::test]
|
|
async fn test_a_configured_peer_is_let_in() -> Result<()> {
|
|
// Somewhere for the server's own dialling to go; never answered.
|
|
let listener = TcpListener::bind((Ipv4Addr::LOCALHOST, 0)).await?;
|
|
let endpoint = listener.local_addr()?;
|
|
let server = TestServer::start_with(LOCAL_ASN, |c| {
|
|
c.accept_unconfigured_peers = false;
|
|
c.peers = vec![peer_at(endpoint)];
|
|
})
|
|
.await?;
|
|
|
|
let mut peer = TestPeer::connect(server.addr).await?;
|
|
peer.handshake(PEER_ASN, Ipv4Addr::new(10, 0, 0, 2), 90)
|
|
.await?;
|
|
tokio::time::timeout(TIMEOUT, async {
|
|
while server.registry.list().is_empty() {
|
|
tokio::time::sleep(Duration::from_millis(10)).await;
|
|
}
|
|
})
|
|
.await?;
|
|
assert_eq!(server.registry.list()[0].name.as_deref(), Some("r1"));
|
|
Ok(())
|
|
}
|
|
|
|
/// One address may hold only a few connections at a time, so that one host
|
|
/// cannot use up the server's sockets with connections that never get as
|
|
/// far as a session.
|
|
#[tokio::test]
|
|
async fn test_one_address_may_open_only_a_few_connections() -> Result<()> {
|
|
let server = TestServer::start(LOCAL_ASN).await?;
|
|
|
|
// Four that say nothing: each is sent the server's OPEN and waited on.
|
|
let mut held = Vec::new();
|
|
for _ in 0..4 {
|
|
let mut peer = TestPeer::connect(server.addr).await?;
|
|
tokio::time::timeout(TIMEOUT, peer.recv_open()).await??;
|
|
held.push(peer);
|
|
}
|
|
let mut one_too_many = TestPeer::connect(server.addr).await?;
|
|
assert!(closed_unanswered(&mut one_too_many).await);
|
|
|
|
// When one of them goes, there is room again.
|
|
held.pop();
|
|
tokio::time::timeout(TIMEOUT, async {
|
|
loop {
|
|
let mut peer = TestPeer::connect(server.addr).await?;
|
|
if peer.recv_open().await.is_ok() {
|
|
return Ok::<_, eyre::Report>(());
|
|
}
|
|
tokio::time::sleep(Duration::from_millis(20)).await;
|
|
}
|
|
})
|
|
.await??;
|
|
Ok(())
|
|
}
|