bgp: more validations for route leaks-RFC 9234

Add BGP leak coverage mechanisms as specified in RFC 9234 Chapter 5.

A few hacks added, since this requires a lot of interaction of both
the attrs on the BaseAttr and the 'remote_role' field in Neighbor, some
adjustments had to be made. Such hacks have been represented by 'FIXIT:'
keyword. These should be removed after this commit.

Signed-off-by: Paul Wekesa <paul1tw1@gmail.com>

Author: Paul-weqe

holo-bgp/src/af.rs

@@ -6,7 +6,7 @@
 
 use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
 
-use holo_utils::bgp::AfiSafi;
+use holo_utils::bgp::{AfiSafi, RoleName};
 use holo_utils::ip::{IpAddrKind, IpNetworkKind, Ipv4AddrExt, Ipv6AddrExt};
 use ipnetwork::{Ipv4Network, Ipv6Network};
 use itertools::Itertools;
@@ -52,7 +52,10 @@ pub trait AddressFamily: Sized {
     fn nexthop_tx_change(nbr: &Neighbor, local: bool, attrs: &mut BaseAttrs);
 
     // Build BGP UPDATE messages based on the provided update queue.
-    fn build_updates(queue: &mut NeighborUpdateQueue<Self>) -> Vec<Message>;
+    fn build_updates(
+        queue: &mut NeighborUpdateQueue<Self>,
+        role: Option<RoleName>,
+    ) -> Vec<Message>;
 }
 
 #[derive(Debug)]
@@ -122,13 +125,33 @@ impl AddressFamily for Ipv4Unicast {
         }
     }
 
-    fn build_updates(queue: &mut NeighborUpdateQueue<Self>) -> Vec<Message> {
+    fn build_updates(
+        queue: &mut NeighborUpdateQueue<Self>,
+        role: Option<RoleName>,
+    ) -> Vec<Message> {
         let mut msgs = vec![];
         let reach = std::mem::take(&mut queue.reach);
         let unreach = std::mem::take(&mut queue.unreach);
 
         // Reachable prefixes.
         for (attrs, prefixes) in reach.into_iter() {
+            // RFC 9234: If a route already contains the OTC Attribute,
+            // it MUST NOT be propagated to Providers, Peers,or RSes.
+            //
+            // FIXIT: This logic was placed here as best fit. It necessitated
+            // the addition of 'role' argument to the function, which may /
+            // may not be necessary. If a better place can be found
+            //
+            if let Some(role) = role
+                && matches!(
+                    role,
+                    RoleName::Provider | RoleName::Peer | RoleName::Rs
+                )
+                && attrs.base.otc.is_some()
+            {
+                continue;
+            }
+
             let nexthop = Ipv4Addr::get(attrs.base.nexthop.unwrap()).unwrap();
             let max = (Message::MAX_LEN
                 - UpdateMsg::MIN_LEN
@@ -255,13 +278,32 @@ impl AddressFamily for Ipv6Unicast {
         }
     }
 
-    fn build_updates(queue: &mut NeighborUpdateQueue<Self>) -> Vec<Message> {
+    fn build_updates(
+        queue: &mut NeighborUpdateQueue<Self>,
+        role: Option<RoleName>,
+    ) -> Vec<Message> {
         let mut msgs = vec![];
         let reach = std::mem::take(&mut queue.reach);
         let unreach = std::mem::take(&mut queue.unreach);
 
         // Reachable prefixes.
         for (attrs, prefixes) in reach.into_iter() {
+            // RFC 9234: If a route already contains the OTC Attribute,
+            // it MUST NOT be propagated to Providers, Peers,or RSes.
+            //
+            // FIXIT: This logic was placed here as best fit. It necessitated
+            // the addition of 'role' argument to the function, which may /
+            // may not be necessary. If a better place can be found
+            if let Some(role) = role
+                && matches!(
+                    role,
+                    RoleName::Provider | RoleName::Peer | RoleName::Rs
+                )
+                && attrs.base.otc.is_some()
+            {
+                continue;
+            }
+
             let nexthop = Ipv6Addr::get(attrs.base.nexthop.unwrap()).unwrap();
             let ll_nexthop = attrs.base.ll_nexthop;
             let nexthop_len = if ll_nexthop.is_some() { 32 } else { 16 };

holo-bgp/src/events.rs

@@ -8,7 +8,7 @@ use std::net::IpAddr;
 
 use chrono::Utc;
 use holo_protocol::InstanceShared;
-use holo_utils::bgp::RouteType;
+use holo_utils::bgp::{RoleName, RouteType};
 use holo_utils::ibus::IbusChannelsTx;
 use holo_utils::ip::{IpAddrKind, IpNetworkKind};
 use holo_utils::policy::{PolicyResult, PolicyType};
@@ -285,6 +285,19 @@ fn process_nbr_reach_prefixes<A>(
         return;
     }
 
+    // RFC 9234: If a route is received from a Provider, a Peer or an RS and
+    // the OTC Attribute is not present, it MUST be added with AS number of
+    // remote AS.
+    //
+    // FIXIT: Confirmation for if the following check can be placed anywhere
+    // better should be done.
+    if let Some(role) = nbr.remote_role
+        && matches!(role, RoleName::Provider | RoleName::Peer | RoleName::Rs)
+        && attrs.base.otc.is_none()
+    {
+        let _ = attrs.base.otc.get_or_insert(nbr.config.peer_as);
+    }
+
     // Initialize route origin and type.
     let origin = RouteOrigin::Neighbor {
         identifier: nbr.identifier.unwrap(),
@@ -411,7 +424,8 @@ fn process_nbr_route_refresh(
     }
 
     // Send UPDATE message(s) to the neighbor.
-    let msg_list = nbr.update_queues.build_updates();
+    let remote_role = nbr.remote_role;
+    let msg_list = nbr.update_queues.build_updates(remote_role);
     if !msg_list.is_empty() {
         nbr.message_list_send(msg_list);
     }
@@ -587,7 +601,8 @@ where
     }
 
     // Send UPDATE message(s) to the neighbor.
-    let msg_list = nbr.update_queues.build_updates();
+    let remote_role = nbr.remote_role;
+    let msg_list = nbr.update_queues.build_updates(remote_role);
     if !msg_list.is_empty() {
         nbr.message_list_send(msg_list);
     }
@@ -679,6 +694,7 @@ where
         let best_route = rib::best_path::<A>(
             dest,
             instance.config.asn,
+            neighbors,
             &table.nht,
             selection_cfg,
         );
@@ -793,7 +809,8 @@ fn withdraw_routes<A>(
     }
 
     // Send UPDATE message(s) to the neighbor.
-    let msg_list = nbr.update_queues.build_updates();
+    let remote_role = nbr.remote_role;
+    let msg_list = nbr.update_queues.build_updates(remote_role);
     if !msg_list.is_empty() {
         nbr.message_list_send(msg_list);
     }

holo-bgp/src/neighbor.rs

@@ -1075,7 +1075,8 @@ impl Neighbor {
                 // Re-send the current Adj-RIB-Out to this neighbor.
                 self.resend_adj_rib_out::<Ipv4Unicast>(instance);
                 self.resend_adj_rib_out::<Ipv6Unicast>(instance);
-                let msg_list = self.update_queues.build_updates();
+                let msg_list =
+                    self.update_queues.build_updates(self.remote_role);
                 if !msg_list.is_empty() {
                     self.message_list_send(msg_list);
                 }
@@ -1197,10 +1198,13 @@ impl MessageStatistics {
 // ===== impl NeighborUpdateQueues =====
 
 impl NeighborUpdateQueues {
-    pub(crate) fn build_updates(&mut self) -> Vec<Message> {
+    pub(crate) fn build_updates(
+        &mut self,
+        role: Option<RoleName>,
+    ) -> Vec<Message> {
         [
-            self.ipv4_unicast.build_updates(),
-            self.ipv6_unicast.build_updates(),
+            self.ipv4_unicast.build_updates(role),
+            self.ipv6_unicast.build_updates(role),
         ]
         .concat()
     }
@@ -1212,8 +1216,8 @@ impl<A> NeighborUpdateQueue<A>
 where
     A: AddressFamily,
 {
-    fn build_updates(&mut self) -> Vec<Message> {
-        A::build_updates(self)
+    fn build_updates(&mut self, role: Option<RoleName>) -> Vec<Message> {
+        A::build_updates(self, role)
     }
 }
 

holo-bgp/src/northbound/yang.rs

@@ -207,6 +207,7 @@ impl ToYang for RouteIneligibleReason {
             RouteIneligibleReason::Originator => "iana-bgp-rib-types:ineligible-originator".into(),
             RouteIneligibleReason::Confed => "iana-bgp-rib-types:ineligible-confed".into(),
             RouteIneligibleReason::Unresolvable => "holo-bgp:ineligible-unresolvable".into(),
+            RouteIneligibleReason::Role => "holo-bgp:ineligible-role".into(),
         }
     }
 }

holo-bgp/src/rib.rs

@@ -10,7 +10,7 @@ use std::net::{IpAddr, Ipv4Addr};
 use std::sync::Arc;
 use std::time::Instant;
 
-use holo_utils::bgp::RouteType;
+use holo_utils::bgp::{RoleName, RouteType};
 use holo_utils::ibus::IbusChannelsTx;
 use holo_utils::protocol::Protocol;
 use prefix_trie::map::PrefixMap;
@@ -19,7 +19,7 @@ use serde::{Deserialize, Serialize};
 use crate::af::{AddressFamily, Ipv4Unicast, Ipv6Unicast};
 use crate::debug::Debug;
 use crate::ibus;
-use crate::neighbor::{Neighbor, PeerType};
+use crate::neighbor::{Neighbor, Neighbors, PeerType};
 use crate::northbound::configuration::{
     DistanceCfg, InstanceTraceOptions, MultipathCfg, RouteSelectionCfg,
 };
@@ -145,6 +145,7 @@ pub enum RouteIneligibleReason {
     Originator,
     Confed,
     Unresolvable,
+    Role,
 }
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
@@ -689,6 +690,7 @@ where
 pub(crate) fn best_path<A>(
     dest: &mut Destination,
     local_asn: u32,
+    neighbors: &Neighbors,
     nht: &HashMap<IpAddr, NhtEntry<A>>,
     selection_cfg: &RouteSelectionCfg,
 ) -> Option<Box<Route>>
@@ -698,7 +700,7 @@ where
     let mut best_route = None;
 
     // Iterate over each Adj-RIB-In route for the destination.
-    for route in dest
+    'rib_loop: for route in dest
         .adj_rib
         .values_mut()
         // Pick the post-policy routes.
@@ -712,7 +714,37 @@ where
         // First, check if the route is eligible.
         if route.attrs.base.value.as_path.contains(local_asn) {
             route.ineligible_reason = Some(RouteIneligibleReason::AsLoop);
-            continue;
+            continue 'rib_loop;
+        }
+
+        // Check for RoleName and OTC validity.
+        // RFC 9234 Section 5.
+        //
+        // 1.
+        // If a route with the OTC Attribute is received from a Customer or an
+        // RS-Client, then it is a route leak and be considered ineligible.
+        //
+        // 2.
+        // If a route with the OTC Attribute is received from a Peer
+        // (i.e., remote AS with a Peer Role) and the Attribute has
+        // a value that is not equal to the remote (i.e., Peer's) AS number,
+        // then it is a route leak and be considered ineligible.
+        if let RouteOrigin::Neighbor { remote_addr, .. } = route.origin
+            && let Some(nbr) = neighbors.get(&remote_addr)
+            && let Some(role) = nbr.remote_role
+        {
+            if let Some(otc) = route.attrs.base.value.otc {
+                let is_leak = match role {
+                    RoleName::Customer | RoleName::RsClient => true,
+                    RoleName::Peer if otc != nbr.config.peer_as => true,
+                    _ => false,
+                };
+
+                if is_leak {
+                    route.ineligible_reason = Some(RouteIneligibleReason::Role);
+                    continue 'rib_loop;
+                }
+            }
         }
 
         // Get interior cost to the route's nexthop.
@@ -722,7 +754,7 @@ where
             if route.igp_cost.is_none() {
                 route.ineligible_reason =
                     Some(RouteIneligibleReason::Unresolvable);
-                continue;
+                continue 'rib_loop;
             };
         }
 
@@ -851,6 +883,22 @@ pub(crate) fn attrs_tx_update<A>(
 
             // Remove the LOCAL_PREF attribute.
             attrs.base.local_pref = None;
+
+            // RFC 9234 - Section 5:
+            // If a route is to be advertised to a Customer, a Peer, or an
+            // RS-Client (when the sender is an RS)
+            // and the OTC Attribute is not present, then when advertising the
+            // route, an OTC Attribute
+            // be added with a value equal to the AS number of the local AS
+            if let Some(remote_role) = nbr.remote_role
+                && matches!(
+                    remote_role,
+                    RoleName::Customer | RoleName::Peer | RoleName::Rs
+                )
+                && attrs.base.otc.is_none()
+            {
+                attrs.base.otc = Some(local_asn);
+            }
         }
     }
 

holo-yang/modules/augmentations/holo-bgp.yang

@@ -40,6 +40,14 @@ module holo-bgp {
       "Route was ineligible due to unresolvable next-hop";
   }
 
+  identity ineligible-role {
+    base brt:ineligible-route-reason;
+    description
+      "Route's OTC configuration was not compatible with neighbor.";
+    reference
+      "RFC 9234: Bgp Route Leak Prevention.";
+  }
+
   identity unknown-error {
     base bn:bgp-notification;
     description