Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

L3VPN exportation by using 'route-map vpn export' command instead of 'rt vpn export' command #14512

Merged
merged 6 commits into from
Nov 28, 2023

Conversation

pguibert6WIND
Copy link
Member

This pull request introduces a few fixes related to route-map and l3vpn usage.
This pull request also proposes to facilitate the L3VPN prefixes exportation by not solely relying on the 'rt vpn export ' command. That is to say that a route-map usage can also be used.

Copy link
Member

@ton31337 ton31337 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

qq: How would the exportation be accomplished if let's say neither rt vpn export ... is configured, nor route-map vpn export ... matches any criteria? Both commands are mutually exclusive or how it works?

bgpd/bgp_ecommunity.c Outdated Show resolved Hide resolved
bgpd/bgp_mplsvpn.c Outdated Show resolved Hide resolved
bgpd/bgp_mplsvpn.c Outdated Show resolved Hide resolved
bgpd/bgp_mplsvpn.c Show resolved Hide resolved
bgpd/bgp_mplsvpn.c Outdated Show resolved Hide resolved
bgpd/bgp_mplsvpn.h Outdated Show resolved Hide resolved
for (index = map->head; index; index = index->next) {
for (set = index->set_list.head; set; set = set->next) {
if (set->cmd && set->cmd->str &&
strmatch(set->cmd->str, "extcommunity rt"))
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure I understand this logic here. Don't say it's wrong, but in the long-term, we should have something like a custom enum for distinguishing a specific command for struct routemap_hook_context.

Copy link
Member Author

@pguibert6WIND pguibert6WIND Oct 2, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Today, the framework is only available for delete.
And if it had to be done, today, the framework does not distinguish between create and modify events.

that is why I chose this method.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I thought this would allow the operator to change the RT, not just delete it, right?

@NetDEF-CI
Copy link
Collaborator

Continuous Integration Result: FAILED

See below for issues.
CI System Testrun URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-14408/

This is a comment from an automated CI system.
For questions and feedback in regards to this CI system, please feel free to email
Martin Winter - mwinter (at) opensourcerouting.org.

Get source / Pull Request: Successful

Building Stage: Successful

Basic Tests: Failed

Topotests Ubuntu 18.04 i386 part 9: Failed (click for details)

Topology Test Results are at https://ci1.netdef.org/browse/FRR-PULLREQ2-TOPO9U18I386-14408/test

Topology Tests failed for Topotests Ubuntu 18.04 i386 part 9
see full log at https://ci1.netdef.org/browse/FRR-PULLREQ2-14408/artifact/TOPO9U18I386/TopotestLogs/log_topotests.txt
Topotests Ubuntu 18.04 i386 part 9: Unknown Log
URL: https://ci1.netdef.org/browse/FRR-PULLREQ2-14408/artifact/TOPO9U18I386/TopotestDetails/

Successful on other platforms/tests
  • Topotests Ubuntu 18.04 i386 part 1
  • Topotests Ubuntu 18.04 amd64 part 4
  • Topotests Ubuntu 18.04 i386 part 6
  • Addresssanitizer topotests part 2
  • Topotests Ubuntu 18.04 amd64 part 5
  • Topotests Ubuntu 18.04 arm8 part 6
  • Topotests Ubuntu 18.04 amd64 part 0
  • Topotests debian 10 amd64 part 6
  • Topotests Ubuntu 18.04 arm8 part 1
  • Addresssanitizer topotests part 9
  • Topotests Ubuntu 18.04 amd64 part 7
  • Topotests debian 10 amd64 part 0
  • Topotests Ubuntu 18.04 arm8 part 2
  • Addresssanitizer topotests part 3
  • Topotests Ubuntu 18.04 arm8 part 7
  • Topotests debian 10 amd64 part 5
  • Topotests Ubuntu 18.04 arm8 part 8
  • Topotests Ubuntu 18.04 i386 part 7
  • CentOS 7 rpm pkg check
  • Topotests Ubuntu 18.04 i386 part 2
  • Topotests Ubuntu 18.04 amd64 part 3
  • Addresssanitizer topotests part 6
  • Topotests debian 10 amd64 part 9
  • Topotests Ubuntu 18.04 amd64 part 2
  • Topotests debian 10 amd64 part 7
  • Topotests Ubuntu 18.04 i386 part 5
  • Topotests Ubuntu 18.04 i386 part 0
  • Topotests debian 10 amd64 part 8
  • Debian 10 deb pkg check
  • Topotests Ubuntu 18.04 arm8 part 4
  • Topotests debian 10 amd64 part 3
  • Topotests Ubuntu 18.04 amd64 part 6
  • Topotests Ubuntu 18.04 arm8 part 9
  • Topotests Ubuntu 18.04 amd64 part 1
  • Addresssanitizer topotests part 1
  • Ubuntu 20.04 deb pkg check
  • Topotests Ubuntu 18.04 i386 part 4
  • Ubuntu 18.04 deb pkg check
  • Topotests Ubuntu 18.04 i386 part 8
  • Debian 9 deb pkg check
  • Addresssanitizer topotests part 4
  • Topotests Ubuntu 18.04 amd64 part 9
  • Topotests Ubuntu 18.04 i386 part 3
  • Addresssanitizer topotests part 8
  • Addresssanitizer topotests part 7
  • Topotests debian 10 amd64 part 4
  • Topotests Ubuntu 18.04 arm8 part 5
  • Topotests Ubuntu 18.04 arm8 part 3
  • Addresssanitizer topotests part 5
  • Topotests debian 10 amd64 part 1
  • Topotests Ubuntu 18.04 amd64 part 8
  • Static analyzer (clang)
  • Topotests Ubuntu 18.04 arm8 part 0
  • Topotests debian 10 amd64 part 2
  • Addresssanitizer topotests part 0

@pguibert6WIND pguibert6WIND force-pushed the vpnv4_with_no_rt_export branch 2 times, most recently from 25a6cf0 to 131d8c3 Compare October 2, 2023 10:22
@pguibert6WIND
Copy link
Member Author

ci:rerun

Copy link
Member

@ton31337 ton31337 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How would the exportation be accomplished if let's say neither rt vpn export ... is configured, nor route-map vpn export ... matches any criteria? Both commands are mutually exclusive or how it works?

In general, I don't understand the whole idea of this (what is the real gain). In both ways, you have to configure the RT list. Or do you mean that on specific criteria, you can set different RT export lists?

tests/topotests/bgp_vpnv4_ebgp/r1/bgpd.conf Show resolved Hide resolved
@pguibert6WIND
Copy link
Member Author

How would the exportation be accomplished if let's say neither rt vpn export ... is configured, nor route-map vpn export ... matches any criteria? Both commands are mutually exclusive or how it works?

In general, I don't understand the whole idea of this (what is the real gain). In both ways, you have to configure the RT list. Or do you mean that on specific criteria, you can set different RT export lists?

rt vpn export .. and route-map vpn export .. commands are cumulative.
using route-map instead of rt vpn export .. gives the ability to precisely export any prefix with any outgoing rt.
if you have 2 prefixes P1 and P2 to export, you may want to export P1 with export RTa, and P2 with export RTb. Today, this is not possible without explicitly adding 'export RT0' in the rt vpn export .. command.

@ton31337
Copy link
Member

ton31337 commented Oct 4, 2023

Could it also be documented?

@github-actions
Copy link

This pull request has conflicts, please resolve those before we can evaluate the pull request.

@pguibert6WIND pguibert6WIND force-pushed the vpnv4_with_no_rt_export branch from 38d55bb to 77b0534 Compare October 18, 2023 15:59
@pguibert6WIND pguibert6WIND force-pushed the vpnv4_with_no_rt_export branch from 77b0534 to ef49b01 Compare October 20, 2023 11:31
Copy link
Member

@riw777 riw777 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

a couple of minor comments ... I'm still a little confused by the use case here :-)

for (index = map->head; index; index = index->next) {
for (set = index->set_list.head; set; set = set->next) {
if (set->cmd && set->cmd->str &&
strmatch(set->cmd->str, "extcommunity rt"))
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I thought this would allow the operator to change the RT, not just delete it, right?

doc/user/bgp.rst Outdated Show resolved Hide resolved
@pguibert6WIND pguibert6WIND force-pushed the vpnv4_with_no_rt_export branch from ef49b01 to 14868b6 Compare November 20, 2023 20:15
Copy link
Member

@riw777 riw777 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks good

The following route-map set rules events are destroyed with
the 'match_destroy' API whereas there is a 'set_destroy' API
available.
Fix this for the following set commands:
> set distance
> set extcommunity rt
> set extcommunity nt
> set extcommunity color
> set extcommunity soo

Fixes: 48cb7ea ("bgpd: North-bound implementation for bgp rmaps")
Fixes: c9a2561 ("bgpd: Implement Node Target Extended Communities")
Fixes: b80ebc2 ("bgpd: add colored extended communities support")

Signed-off-by: Philippe Guibert <[email protected]>
When exporting BGP prefixes, it is necessary to configure
the route target extended communities with the following
command:

> rt vpn export <RouteTarget>

But the customer may need to configure the route-target to
apply to bgp updates, solely based on a route-map criterium.
by using the below route-map configured like that:

> route-map vpn export <routemapname>

Fix this by allowing to export bgp updates based on the
presence of route-targets on either route-map or vpn
configured rt. the exportation process is stopped
if no route target is available in the ecommunity list.

Fixes: ddb5b48 ("bgpd: vpn-vrf route leaking")
Signed-off-by: Philippe Guibert <[email protected]>
The prefixes unexportation triggers an attempt to create
the VPN prefix node if that prefix was not already present.

For instance, if a given prefix is not exported because of
a route-map filtering, the withdraw process will try to
create the node with the 'bgp_afi_node_get()' command.

Fix this by replacing this call by the 'bgp_safi_node_lookup()'
function.

Fixes: ddb5b48 ("bgpd: vpn-vrf route leaking")
Signed-off-by: Philippe Guibert <[email protected]>
Add a test to check that the presence of a route-map at
exportation with a 'set extcommunity rt' is enough to allow
the prefix to be exported.

Signed-off-by: Philippe Guibert <[email protected]>
Explain that an export route target list can be configured
alternatively by using route-maps.

Signed-off-by: Philippe Guibert <[email protected]>
A route-map can be programmed to remove the route-target which
has been set with 'rt vpn export' command, but fails to remove
it.

Fix this by applying the route-map, then considering the resulting
extended community-list.
Add some tests to catch this issue.

Signed-off-by: Philippe Guibert <[email protected]>
@pguibert6WIND pguibert6WIND force-pushed the vpnv4_with_no_rt_export branch from 14868b6 to fc1177f Compare November 21, 2023 17:22
@riw777 riw777 merged commit e854c43 into FRRouting:master Nov 28, 2023
78 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants