summaryrefslogtreecommitdiffstats
path: root/lib/pbr.h (follow)
Commit message (Collapse)AuthorAgeFilesLines
* *: Let's use the native IFNAMSIZ instead of INTERFACE_NAMSIZDonald Sharp2023-11-211-1/+1
| | | | | | | | INTERFACE_NAMSIZ is just a redefine of IFNAMSIZ and IFNAMSIZ is the standard for interface name length on all platforms that FRR currently compiles on. Signed-off-by: Donald Sharp <sharpd@nvidia.com>
* pbrd: add advisory flag PBR_ACTION_DROPG. Paul Ziemba2023-08-161-0/+1
| | | | | | | | | | | | | PBR configuration may specify "set nexthop blackhole" which, for linux dataplanes, is implemented as a table with a blackhole route. Other dataplanes might implement this action as an explicit packet-filtering "drop" action instead of a route. This new flag PBR_ACTION_DROP is now set when a rule has "set nexthop blackhole" as an aid to other dataplanes. Signed-off-by: G. Paul Ziemba <paulz@labn.net>
* pbrd: add packet mangling actions (src/dst ip-addr/port, dscp, ecn)G. Paul Ziemba2023-08-091-0/+16
| | | | Signed-off-by: G. Paul Ziemba <paulz@labn.net>
* pbrd: use flags to indicate active fieldsG. Paul Ziemba2023-08-091-7/+6
| | | | | | | | | | | | Before now, PBRD used non-zero values to imply that a rule's match or action field was active. This approach was getting cumbersome for fields where 0 is a valid active value and various field-specific magic values had to be used. This commit changes PBRD to use a flag bit per field to indicate that the field is active. Signed-off-by: G. Paul Ziemba <paulz@labn.net>
* pbrd: add explicit 'family' field for rulesG. Paul Ziemba2023-08-081-0/+1
| | | | | | | | | | | | | | | | | | | | | In the netlink-mediated kernel dataplane, each rule is stored in either an IPv4-specific database or an IPv6-specific database. PBRD opportunistically gleans each rule's address family value from its source or destination IP address match value (if either exists), or from its nexthop or nexthop-group (if it exists). The 'family' value is particularly needed for netlink during incremental rule deletion when none of the above fields remain set. Before now, this address family has been encoded by occult means in the (possibly otherwise unset) source/destination IP match fields in ZAPI and zebra. This commit documents the reasons for maintaining the 'family' field in the PBRD rule structure, adds a 'family' field in the common lib/pbr.h rule structure, and carries it explicitly in ZAPI. Signed-off-by: G. Paul Ziemba <paulz@labn.net>
* pbrd: PBR_FILTER_DSFIELD -> {PBR_FILTER_DSCP,PBR_FILTER_ECN}G. Paul Ziemba2023-08-081-1/+2
| | | | | | | DSCP and ECN matching are configured independently. Maintain these values in independent fields in pbrd, zapi, and zebra. Signed-off-by: G. Paul Ziemba <paulz@labn.net>
* lib: pbr.h: remove unused PBR_FILTER_PROTOG. Paul Ziemba2023-08-071-2/+2
| | | | Signed-off-by: G. Paul Ziemba <paulz@labn.net>
* lib: zapi PBR common encode/decodeG. Paul Ziemba2023-07-201-4/+13
| | | | | | | | | | | | | | bgpd, pbrd: use common pbr encoder zebra: use common pbr decoder tests: pbr_topo1: check more filter fields Purpose: 1. Reduce likelihood of zapi format mismatches when adding PBR fields due to multiple parallel encoder implementations 2. Encourage common PBR structure usage among various daemons 3. Reduce coding errors via explicit per-field enable flags Signed-off-by: G. Paul Ziemba <paulz@labn.net>
* pbrd: add vlan filters pcp/vlan-id/vlan-flags; ip-protocol any (pbr feature)G. Paul Ziemba2023-07-191-14/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Subset: feature in PBR New PBR rule fields: match ip-protocol (was only tcp|udp, now any value in /etc/protocols) match pcp (0-7) match vlan (1-4094) match vlan (tagged|untagged|untagged-or-zero) Filter flags Add filter_bm (flags) field internally to indicate which filter fields should be considered active. Bit definitions as in lib/pbr.h. This commit uses only the PBR_FILTER_PCP bit, but other fields will be added in future commits. (Fixes bug related to determining set/not-set state of pcp filter) Shift vlan filter flags to lib/pbr.h Changes by: Josh Werner <joshuawerner@mitre.org> Eli Baum <ebaum@mitre.org> G. Paul Ziemba <paulz@labn.net> Signed-off-by: G. Paul Ziemba <paulz@labn.net>
* *: auto-convert to SPDX License IDsDavid Lamparter2023-02-091-15/+1
| | | | | | Done with a combination of regex'ing and banging my head against a wall. Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
* pbrd: add vlan actions to vtyEli Baum2021-10-071-1/+8
| | | | Signed-off-by: Eli Baum <ebaum@mitre.org>
* lib, zebra: add ip_proto to the filter data structureDonald Sharp2021-07-081-0/+3
| | | | | | | Add ip_proto to the filter data structure and also account for it in the hash when stored. Signed-off-by: Donald Sharp <sharpd@nvidia.com>
* zebra: Add ability to encode/decode netlink FRA_IP_PROTO for rule changesDonald Sharp2021-07-081-1/+2
| | | | | | Encode/Decode the FRA_IP_PROTO but do nothing with it at the moment. Signed-off-by: Donald Sharp <sharpd@nvidia.com>
* bgpd, lib, pbrd, zebra: Pass by ifnameDonald Sharp2020-09-121-1/+2
| | | | | | | | | | | | | | | | | | When installing rules pass by the interface name across zapi. This is being changed because we have a situation where if you quickly create/destroy ephermeal interfaces under linux the upper level protocol may be trying to add a rule for a interface that does not quite exist at the moment. Since ip rules actually want the interface name ( to handle just this sort of situation ) convert over to passing the interface name and storing it and using it in zebra. Ticket: CM-31042 Signed-off-by: Stephen Worley <sworley@nvidia.com> Signed-off-by: Donald Sharp <sharpd@nvidia.com>
* bgpd, lib: support for flow_label flowspec typePhilippe Guibert2020-08-211-0/+2
| | | | | | | | | | | | | | in ipv6 flowspec, a new type is defined to be able to do filtering rules based on 20 bits flow label field as depicted in [0]. The change include the decoding by flowspec, and the addition of a new attribute in policy routing rule, so that the data is ready to be sent to zebra. The commit also includes a check on fragment option, since dont fragment bit does not exist in ipv6, the value should always be set to 0, otherwise the flowspec rule becomes invalid. [0] https://tools.ietf.org/html/draft-ietf-idr-flow-spec-v6-09 Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* pbrd, zebra, lib: DSCP / ECN-based PBR MatchingWesley Coakley2020-07-151-0/+7
| | | | | | | | | | | | | | | | Extend PBR maps to discriminate by Differentiated Services Code Point and / or Explicit Congestion Notification fields. These fields are used in the IP header for classifying network traffic. 0 1 2 3 4 5 6 7 +-----+-----+-----+-----+-----+-----+-----+-----+ | DS FIELD, DSCP | ECN FIELD | +-----+-----+-----+-----+-----+-----+-----+-----+ DSCP: differentiated services codepoint ECN: Explicit Congestion Notification Signed-off-by: Wesley Coakley <wcoakley@nvidia.com> Signed-off-by: Saurav Kumar Paul <saurav@cumulusnetworks.com>
* lib: Use ifindex_t for struct pbr_ruleStephen Worley2019-10-151-1/+1
| | | | | | | We should be using the ifindex_t typedef here for the type, not uint32_t. Signed-off-by: Stephen Worley <sworley@cumulusnetworks.com>
* bgp, zebra, lib: add protocol support for iptablesPhilippe Guibert2019-07-081-0/+1
| | | | | | | in addition to support for tcpflags, it is possible to filter on any protocol. the filtering can then be based with iptables. Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* lib: add extern "C" {} blocks to all libfrr headersRenato Westphal2019-02-121-0/+8
| | | | | | | These are necessary to use functions defined in these headers from C++. Signed-off-by: David Lamparter <equinox@diac24.net> Signed-off-by: Renato Westphal <renato@opensourcerouting.org>
* bgpd: add an icmp flag for flowspec icmp entriesPhilippe Guibert2018-06-281-0/+1
| | | | | | | | Some values for icmp type/code can not be encoded like port source or port destination. This is the case of 0 value that is authorized for icmp. Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* bgpd: support for flowspec fragment list into policy routingPhilippe Guibert2018-06-281-0/+1
| | | | | | | | The flowspec fragment attribute is taken into account to be pushed in BGP policy routing entries. Valid values are enumerate list of 1, 2, 4, or 8 values. no combined value is supported yet. Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* bgpd: support for enumerate pkt lenPhilippe Guibert2018-06-281-0/+1
| | | | | | | The packet length can be injected from fs entry with an enumerate list; the negation of the value is also taken into account. Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* *: add flowspec dscp handlingPhilippe Guibert2018-06-281-0/+2
| | | | | | Only one dscp value is accepted as filtering option. Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* bgpd, lib: share flags values for iptable configurationPhilippe Guibert2018-06-281-0/+10
| | | | | | | Those flags can be shared between BGP and Zebra. That is why those flags are moved to common pbr.h header file. Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* bgpd: support for flowspec tcp flagsPhilippe Guibert2018-06-281-0/+14
| | | | | | Ability to handle flowspec tcp flags. Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* lib: fix missing includes in pbr.hQuentin Young2018-06-131-0/+4
| | | | Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
* pbrd, lib: move PBR_STR def. to libQuentin Young2018-06-131-0/+2
| | | | | | Per request Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
* zebra: add 3 fields to ipset_entry : src,dst port, and protoPhilippe Guibert2018-05-251-5/+8
| | | | | | | | | | | | Those 3 fields are read and written between zebra and bgpd. This permits extending the ipset_entry structure. Combinatories will be possible: - filtering with one of the src/dst port. - filtering with one of the range src/ range dst port usage of src or dst is exclusive in a FS entry. - filtering a port or a port range based on either src or dst port. Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* lib: enhance pbr_rule structure for zapi encode and for common usagePhilippe Guibert2018-04-161-0/+86
The pbr_rule structure is derived from zebra_pbr_rule, and is defined, so that a zclient will be able to encode the zebra_pbr_rule to send ADD_RULE or DEL_RULE command. Also, the same structure can be used by other daemons to derive a structure ( this will be the case for zebra_pbr_rule). Adding to this, an encoding function is defined, and will be used by remote daemon to encode that message. Those definitions are moved in new file pbr.h file. Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-04 14:38:37 +0100