Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Firewall Precedence #98

Draft
wants to merge 14 commits into
base: master
Choose a base branch
from
Prev Previous commit
Next Next commit
Possible fix to intending
Honigeintopf committed Nov 6, 2024
commit 6886efc8c063cef34449a2ff461c3ff0fcb8aeb2
87 changes: 43 additions & 44 deletions pkg/netconf/routemap.go
Original file line number Diff line number Diff line change
@@ -283,56 +283,55 @@ func byName(prefixLists []IPPrefixList) map[string]IPPrefixList {
}

func (i *importRule) routeMaps(asn int64, distance uint8) []RouteMap {
var result []RouteMap
var result []RouteMap

order := RouteMapOrderSeed
byName := byName(i.prefixLists())
order := RouteMapOrderSeed
byName := byName(i.prefixLists())

names := []string{}
for n := range byName {
names = append(names, n)
}
sort.Sort(sort.Reverse(sort.StringSlice(names)))
names := []string{}
for n := range byName {
names = append(names, n)
}
sort.Sort(sort.Reverse(sort.StringSlice(names)))

for _, n := range names {
prefixList := byName[n]
for _, n := range names {
prefixList := byName[n]

matchVrf := fmt.Sprintf("match source-vrf %s", prefixList.SourceVRF)
matchPfxList := fmt.Sprintf("match %s address prefix-list %s", prefixList.AddressFamily, n)
matchVrf := fmt.Sprintf("match source-vrf %s", prefixList.SourceVRF)
matchPfxList := fmt.Sprintf("match %s address prefix-list %s", prefixList.AddressFamily, n)
// Using the distance we extend the path of a firewall by adding asn to its as-path prepend
numAsns := int(2 + distance)
asnList := make([]string, numAsns)
for i := 0; i < numAsns; i++ {
asnList[i] = fmt.Sprintf("%d", asn)
}
asPathPrepend := fmt.Sprintf("set as-path prepend %s", strings.Join(asnList, " "))
entries := []string{matchVrf, matchPfxList, asPathPrepend}
if strings.HasSuffix(n, IPPrefixListNoExportSuffix) {
entries = append(entries, "set community additive no-export")
}

routeMap := RouteMap{
Name: routeMapName(i.TargetVRF),
Policy: Permit.String(),
Order: order,
Entries: entries,
}
order += RouteMapOrderSeed

result = append(result, routeMap)
}

routeMap := RouteMap{
Name: routeMapName(i.TargetVRF),
Policy: Deny.String(),
Order: order,
}

result = append(result, routeMap)

return result
}
numAsns := int(2 + distance)
asnList := make([]string, numAsns)
for i := 0; i < numAsns; i++ {
asnList[i] = fmt.Sprintf("%d", asn)
}
asPathPrepend := fmt.Sprintf("set as-path prepend %s", strings.Join(asnList, " "))
entries := []string{matchVrf, matchPfxList, asPathPrepend}
if strings.HasSuffix(n, IPPrefixListNoExportSuffix) {
entries = append(entries, "set community additive no-export")
}

routeMap := RouteMap{
Name: routeMapName(i.TargetVRF),
Policy: Permit.String(),
Order: order,
Entries: entries,
}
order += RouteMapOrderSeed

result = append(result, routeMap)
}

routeMap := RouteMap{
Name: routeMapName(i.TargetVRF),
Policy: Deny.String(),
Order: order,
}

result = append(result, routeMap)

return result
}

func routeMapName(vrfName string) string {
return vrfName + "-import-map"