From c2f5b1a176a1b7f72658821d057e23414e839718 Mon Sep 17 00:00:00 2001 From: ISHIDA Wataru Date: Wed, 12 Aug 2015 12:47:47 +0900 Subject: doc: add flowspec document Signed-off-by: ISHIDA Wataru --- docs/sources/flowspec.md | 80 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 80 insertions(+) create mode 100644 docs/sources/flowspec.md (limited to 'docs/sources/flowspec.md') diff --git a/docs/sources/flowspec.md b/docs/sources/flowspec.md new file mode 100644 index 00000000..c59989eb --- /dev/null +++ b/docs/sources/flowspec.md @@ -0,0 +1,80 @@ +# Flowspec (RFC5575) + +GoBGP supports [RFC5575](https://tools.ietf.org/html/rfc5575) and +[draft-ietf-idr-flowspec-redirect-rt-bis-05](http://tools.ietf.org/html/draft-ietf-idr-flowspec-redirect-rt-bis-05). + +Implementation of IPv6 flowspec ([draft-ietf-idr-flow-spec-v6-06](https://tools.ietf.org/html/draft-ietf-idr-flow-spec-v6-06)) +is future work. + +## Prerequisites + +Assume you finished [Getting Started](https://github.com/osrg/gobgp/blob/master/docs/sources/getting-started.md). + +## Contents +- [Configuration](#section0) +- [Add Flowspec routes through CLI](#section1) + +## Configuration + +To advertise flowspec routes, enumerate `ipv4-flowspec` to neighbor's +afi-safi-list like below. + +```toml +[Global] + [Global.GlobalConfig] + As = 64512 + RouterId = "192.168.255.1" + +[Neighbors] + [[Neighbors.NeighborList]] + [Neighbors.NeighborList.NeighborConfig] + NeighborAddress = "10.0.255.1" + PeerAs = 64512 + [Neighbors.NeighborList.AfiSafis] + [[Neighbors.NeighborList.AfiSafis.AfiSafiList]] + AfiSafiName = "ipv4-flowspec" +``` + +## Add Flowspec routes through CLI + +CLI syntax to add flowspec is + +```shell +% global rib add match then -a ipv4-flowspec + : { destination | source | + protocol ... | fragment | tcp-flags ... | + { port | destination-port | source-port | icmp-type | icmp-code | packet-length | dscp } ... }... + : ipip, sctp, unknown, igmp, tcp, egp, rsvp, pim, icmp, igp, udp, gre, ospf + : not-a-fragment, is-a-fragment, first-fragment, last-fragment + : push, ack, urgent, fin, syn, rst + : &?{<|>|=} + : { accept | discard | rate-limit | redirect | mark | action { sample | terminal | sample-terminal } | rt ... }... + : xxx:yyy, xx.xx.xx.xx:yyy, xxx.xxx:yyy +``` + +### Examples + +```shell +# add a flowspec rule which redirect flows with dst 10.0.0.0/24 and src 20.0.0.0/24 to VRF with RT 10:10 +% gobgp global rib -a ipv4-flowspec add match destination 10.0.0.0/24 source 20.0.0.0/24 then redirect 10:10 + +# show flowspec table +% gobgp global rib -a ipv4-flowspec + Network Next Hop AS_PATH Age Attrs +*> [destination:10.0.0.0/24][source:20.0.0.0/24] 0.0.0.0 00:00:04 [{Origin: i} {Extcomms: [redirect: 10:10]}] + +# add another flowspec rule which discard flows whose ip protocol is tcp and destination port is 80 or greater than or equal to 8080 and lesser than or equal to 8888 +% gobgp global rib -a ipv4-flowspec add match protocol tcp destination-port '=80' '>=8080&<=8888' then discard + +% gobgp global rib -a ipv4-flowspec + Network Next Hop AS_PATH Age Attrs +*> [destination:10.0.0.0/24][source:20.0.0.0/24] 0.0.0.0 00:03:19 [{Origin: i} {Extcomms: [redirect: 10:10]}] +*> [protocol: tcp][destination-port: =80 >=8080&<=8888] 0.0.0.0 00:00:03 [{Origin: i} {Extcomms: [discard]}] + +# delete a flowspec rule +% gobgp global rib -a ipv4-flowspec del match destination 10.0.0.0/24 source 20.0.0.0/24 then redirect 10:10 + +% gobgp global rib -a ipv4-flowspec + Network Next Hop AS_PATH Age Attrs +*> [protocol: tcp][destination-port: =80 >=8080&<=8888] 0.0.0.0 00:00:03 [{Origin: i} {Extcomms: [discard]}] +``` -- cgit v1.2.3