Teach Quagga about accept filtering, either custom or a per-interface settign to deny certain routes delivered from remote OSPF peers. This should finally solve the Multi-WAN+VPN issue with learned routes for interconnects preventing a VPN from restarting. Fixes #2712

5 files changed, 30 insertions, 3 deletions

diff --git a/config/quagga_ospfd/quagga_ospfd.inc b/config/quagga_ospfd/quagga_ospfd.inc
index aabd27a8..b2f800eb 100644
--- a/config/quagga_ospfd/quagga_ospfd.inc
+++ b/config/quagga_ospfd/quagga_ospfd.inc
@@ -73,6 +73,8 @@ function quagga_ospfd_install_conf() {
 	// Since we need to embed this in a string, copy to a var. Can't embed constnats.
 	$quagga_config_base = PKG_QUAGGA_CONFIG_BASE;
 
+	$noaccept = "";
+
 	if ($config['installedpackages']['quaggaospfd']['rawconfig'] && $config['installedpackages']['quaggaospfd']['rawconfig']['item']) {
 		// if there is a raw config specifyed in tthe config.xml use that instead of the assisted config
 		$conffile = implode("\n",$config['installedpackages']['quaggaospfd']['rawconfig']['item']);
@@ -132,6 +134,9 @@ function quagga_ospfd_install_conf() {
 				if ($interface_subnet == 32)
 					$interface_subnet = 30;
 				$subnet = gen_subnet($interface_ip, $interface_subnet);
+				if (!empty($conf['acceptfilter'])) {
+					$noaccept .= "ip prefix-list ACCEPTFILTER deny {$subnet}/{$interface_subnet}\n";
+				}
 				if (!empty($conf['interfacearea'])) {
 					$interface_networks[] = array( "subnet" => "{$subnet}/{$interface_subnet}", "area" => $conf['interfacearea']);
 				}
@@ -151,6 +156,9 @@ function quagga_ospfd_install_conf() {
 			foreach ($ospfd_conf['row'] as $redistr) {
 				if (empty($redistr['routevalue']))
 					continue;
+				if (isset($redistr['acceptfilter'])) {
+					$noaccept .= "ip prefix-list ACCEPTFILTER deny {$redistr['routevalue']}\n";
+				}
 				if (isset($redistr['redistribute'])) {
 					$noredist .= "  access-list dnr-list deny {$redistr['routevalue']}\n";
 				} else {
@@ -239,6 +247,12 @@ function quagga_ospfd_install_conf() {
 		$zebraconffile .= "password {$ospfd_conf['password']}\n";
 	if ($ospfd_conf['logging'])
 		$zebraconffile .= "log syslog\n";
+	if (!empty($noaccept)) {
+		$zebraconffile .= $noaccept;
+		$zebraconffile .= "route-map ACCEPTFILTER permit 10\n";
+		$zebraconffile .= "match ip address prefix-list ACCEPTFILTER\n";
+		$zebraconffile .= "ip protocol ospf route-map ACCEPTFILTER\n";
+	}
 	$fd = fopen("{$quagga_config_base}/zebra.conf", "w");
 	fwrite($fd, $zebraconffile);
 	fclose($fd);
diff --git a/config/quagga_ospfd/quagga_ospfd.xml b/config/quagga_ospfd/quagga_ospfd.xml
index 61bf3e94..86baaefb 100644
--- a/config/quagga_ospfd/quagga_ospfd.xml
+++ b/config/quagga_ospfd/quagga_ospfd.xml
@@ -1,6 +1,6 @@
 <packagegui>
 	<name>quagga_ospfd</name>
-	<version>0.5.4</version>
+	<version>0.6</version>
 	<title>Services: Quagga OSPFd</title>
 	<include_file>/usr/local/pkg/quagga_ospfd.inc</include_file>
 	<aftersaveredirect>pkg_edit.php?xml=quagga_ospfd.xml&amp;id=0</aftersaveredirect>
@@ -165,6 +165,13 @@
 					<size>20</size>
 				</rowhelperfield>
 				<rowhelperfield>
+					<fielddescr>Disable &lt;br/&gt;Acceptance</fielddescr>
+					<fieldname>acceptfilter</fieldname>
+					<description>Accept Filter</description>
+					<type>checkbox</type>
+					<size>20</size>
+				</rowhelperfield>
+				<rowhelperfield>
 					<fielddescr>Subnet to Route</fielddescr>
 					<fieldname>routevalue</fieldname>
 					<type>input</type>
diff --git a/config/quagga_ospfd/quagga_ospfd_interfaces.xml b/config/quagga_ospfd/quagga_ospfd_interfaces.xml
index 21bc877f..beb6f2b0 100644
--- a/config/quagga_ospfd/quagga_ospfd_interfaces.xml
+++ b/config/quagga_ospfd/quagga_ospfd_interfaces.xml
@@ -87,6 +87,12 @@
 			<type>checkbox</type>
 		</field>
 		<field>
+			<fielddescr>Accept Filter</fielddescr>
+			<fieldname>acceptfilter</fieldname>
+			<description>Do not add routes for this interface subnet from OSPF into the routing table. (Suggested for Multi-WAN environments).</description>
+			<type>checkbox</type>
+		</field>
+		<field>
 			<fielddescr>Enable MD5 password for this Quagga OSPFd interface (default no)</fielddescr>
 			<fieldname>md5password</fieldname>
 			<description>Enables the use of an MD5 password to on this instance</description>
diff --git a/pkg_config.8.xml b/pkg_config.8.xml
index e5ff9281..87af456e 100644
--- a/pkg_config.8.xml
+++ b/pkg_config.8.xml
@@ -1757,7 +1757,7 @@
 		<name>Quagga OSPF</name>
 		<descr>OSPF routing protocol using Quagga -- WARNING! Installs files to the same place as OpenOSPFD and OpenBGPD. Installing both will break things.</descr>
 		<maintainer>jimp@pfsense.org</maintainer>
-		<version>0.99.22.3 v0.5.4</version>
+		<version>0.99.22.3 v0.6</version>
 		<category>Routing</category>
 		<status>BETA</status>
 		<depends_on_package_base_url>http://files.pfsense.org/packages/8/All/</depends_on_package_base_url>
diff --git a/pkg_config.8.xml.amd64 b/pkg_config.8.xml.amd64
index a66f3d1c..090bc71a 100644
--- a/pkg_config.8.xml.amd64
+++ b/pkg_config.8.xml.amd64
@@ -1744,7 +1744,7 @@
 		<name>Quagga OSPF</name>
 		<descr>OSPF routing protocol using Quagga -- WARNING! Installs files to the same place as OpenOSPFD and OpenBGPD. Installing both will break things.</descr>
 		<maintainer>jimp@pfsense.org</maintainer>
-		<version>0.99.22.3 v0.5.4</version>
+		<version>0.99.22.3 v0.6</version>
 		<category>Routing</category>
 		<status>BETA</status>
 		<depends_on_package_base_url>http://files.pfsense.org/packages/amd64/8/All/</depends_on_package_base_url>