# Generated by confd
function reject_disabled_pools ()
{
{{range ls "/v1/ipam/v4/pool"}}{{$data := json (getv (printf "/v1/ipam/v4/pool/%s" .))}}
{{- if $data.disableBGPExport}}
  if ( net ~ {{$data.cidr}} ) then { reject; }
{{- end}}
{{- end}}
}

function reject_tunnel_routes () {
  # Don't export tunnel routes to other nodes, Felix programs them.
  # IPIP routes are handled by Bird, and it does not re-advertise them.
  if (defined(ifname)) then {
     if ((ifname ~ "*.cali") || (ifname ~ "*.calico")) then {
        reject;
     }
  }
}

function reject_local_routes () {
  # Don't export local routes learned via BPF as they should never leave the node.
  if (defined(ifname)) then {
     if (ifname ~ "bpf*.cali") then {
        reject;
     }
  }
}

function calico_export_to_bgp_peers(bool internal_peer) {
  # filter code terminates when it calls `accept;` or `reject;`,
  # call reject_disabled_pools() first, then reject_tunnel_routes(),
  # then apply_communities() and then calico_aggr()
  reject_disabled_pools();
  if (internal_peer) then {
    reject_tunnel_routes();
  }
  reject_local_routes();
  apply_communities();
  calico_aggr();
{{- $static_key := "/staticroutes"}}
{{- if ls $static_key}}

  # Export static routes.
  {{- range ls $static_key}}
    {{- $parts := split . "-"}}
    {{- $cidr := join $parts "/"}}
  if ( net ~ {{$cidr}} ) then { accept; }
  {{- end}}
{{- end}}
{{- $rr_cluster_id_key := printf "/bgp/v1/host/%s/rr_cluster_id" (getenv "NODENAME")}}
{{- $lb_ips := "/bgp/v1/global/svc_loadbalancer_ips"}}
{{- if exists $rr_cluster_id_key}}{{$rr_cluster_id := getv $rr_cluster_id_key}}
{{- if and (not (eq $rr_cluster_id "")) (exists $lb_ips)}}

  # Configured as a RR - accept any routes within configured LB service IP ranges
  {{- range split (getv $lb_ips) ","}}
    {{- $cidr := .}}
    {{- if not (contains $cidr ":")}}
  if ( net ~ {{$cidr}} ) then { accept; }
    {{- end}}
  {{- end}}
{{- end}}
{{- end}}
{{range ls "/v1/ipam/v4/pool"}}{{$data := json (getv (printf "/v1/ipam/v4/pool/%s" .))}}
{{- if $data.disableBGPExport}}
  # Skip {{$data.cidr}} as BGP export is disabled for it
{{- else}}
  if ( net ~ {{$data.cidr}} ) then {
    accept;
  }
{{- end}}
{{- end}}
}

{{$network_key := printf "/bgp/v1/host/%s/network_v4" (getenv "NODENAME")}}
filter calico_kernel_programming {
{{- $reject_key := "/rejectcidrs"}}
{{- if ls $reject_key}}

  # Don't program static routes into kernel.
  {{- range ls $reject_key}}
    {{- $parts := split . "-"}}
    {{- $cidr := join $parts "/"}}
  if ( net ~ {{$cidr}} ) then { reject; }
  {{- end}}

{{- end}}
{{- if exists $network_key}}{{$network := getv $network_key}}
{{range ls "/v1/ipam/v4/pool"}}{{$data := json (getv (printf "/v1/ipam/v4/pool/%s" .))}}
  if ( net ~ {{$data.cidr}} ) then {
{{- if $data.vxlan_mode}}
    # Don't program VXLAN routes into the kernel - these are handled by Felix.
    reject;
  }
{{- else if $data.ipip_mode}}{{if eq $data.ipip_mode "cross-subnet"}}
    if defined(bgp_next_hop) && ( bgp_next_hop ~ {{$network}} ) then
      krt_tunnel = "";                     {{- /* Destination in ipPool, mode is cross sub-net, route from-host on subnet, do not use IPIP */}}
    else
      krt_tunnel = "{{$data.ipip}}";       {{- /* Destination in ipPool, mode is cross sub-net, route from-host off subnet, set the tunnel (if IPIP not enabled, value will be "") */}}
    accept;
  } {{- else}}
    krt_tunnel = "{{$data.ipip}}";         {{- /* Destination in ipPool, mode not cross sub-net, set the tunnel (if IPIP not enabled, value will be "") */}}
    accept;
  } {{- end}} {{- else}}
    krt_tunnel = "{{$data.ipip}}";         {{- /* Destination in ipPool, mode field is not present, set the tunnel (if IPIP not enabled, value will be "") */}}
    accept;
  } {{- end}}
{{end}}
{{- end}}{{/* End of 'exists $network_key' */}}
  accept;                                  {{- /* Destination is not in any ipPool, accept  */}}
}
