summaryrefslogtreecommitdiffstats
path: root/zebra/zebra_pbr.h (follow)
Commit message (Collapse)AuthorAgeFilesLines
* zebra: use real MTYPEs for various objectsMark Stapp2022-12-051-0/+3
| | | | | | | Don't use MTYPE_TMP for many things in zebra: add specific mem types. Signed-off-by: Mark Stapp <mjs@labn.net>
* zebra: pass PBR expanded actions to the dataplaneAnuradha Karuppiah2022-06-271-0/+3
| | | | | | These attributes are needed for dpdk dataplane programming Signed-off-by: Anuradha Karuppiah <anuradhak@nvidia.com>
* zebra: expand pbr rule action for dataplane programmingAnuradha Karuppiah2022-06-271-1/+6
| | | | | | | | PBR rules are installed as match, action rules in most dataplanes. This requires the action to be resolved via a GW. And the GW to be subsequently resolved to {SMAC, DMAC}. Signed-off-by: Anuradha Karuppiah <anuradhak@nvidia.com>
* zebra: add support for maintaining local neigh entriesAnuradha Karuppiah2022-06-271-0/+17
| | | | | | | | | | Currently specific local neighbors (attached to SVIs) are maintatined in an EVPN specific database. There is a need to maintain L3 neighbors for other purposes including MAC resolution for PBR nexthops. Signed-off-by: Donald Sharp <sharpd@nvidia.com> Cleanup compile and fix crash Signed-off-by: Anuradha Karuppiah <anuradhak@nvidia.com>
* zebra: avoid pbr iptable added twice when used with flowspecPhilippe Guibert2022-05-251-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The usage of zebra dplane makes the job asyncronous which implies that a given job will try to add an iptable, while the second job will not know that its iptable is the same as the former one. The below exabgp rules stand for two bgp flowspec rules sent to the bgp device: flow { route {match { source 185.228.172.73/32; destination 0.0.0.0/0; source-port >=49156&<=49159; }then {redirect 213.242.114.113;}} route {match { source 185.228.172.73/32; destination 0.0.0.0/0; source-port >=49160&<=49163; }then {redirect 213.242.114.113;}} } This rule creates a single iptable, but in fact, the same iptable name is appended twice. This results in duplicated entries in the iptables context. This also results in contexts not flushed, when BGP session or 'flush' operation is performed. iptables-save: [..] -A PREROUTING -m set --match-set match0x55baf4c25cb0 src,src -g match0x55baf4c25cb0 -A PREROUTING -m set --match-set match0x55baf4c25cb0 src,src -g match0x55baf4c25cb0 -A match0x55baf4c25cb0 -j MARK --set-xmark 0x100/0xffffffff -A match0x55baf4c25cb0 -j ACCEPT -A match0x55baf4c25cb0 -j MARK --set-xmark 0x100/0xffffffff -A match0x55baf4c25cb0 -j ACCEPT [..] This commit addresses this issue, by checking that an iptable context is not already being processed. A flag is added in the original iptable context, and a check is done if the iptable context is not already being processed for install or uinstall. Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* zebra: update dataplane flowspec address family in ipset_infoPhilippe Guibert2021-11-031-0/+2
| | | | | | | | | It is needed for the ipset entry to know for which address family this ipset entry applies to. Actually, the family is in the original ipset structure and was not passed as attribute in the dataplane ipset_info structure. Add it. Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* *: require semicolon after DEFINE_HOOK & co.David Lamparter2021-03-171-2/+2
| | | | | | See previous commit. Signed-off-by: David Lamparter <equinox@diac24.net>
* zebra: move ipset and ipset_entry to zebra dplane contextsPhilippe Guibert2021-03-101-0/+12
| | | | | | | | | | | | | | | | | | like it has been done for iptable contexts, a zebra dplane context is created for each ipset/ipset entry event. The zebra_dplane_ctx job is then enqueued and processed by separate thread. Like it has been done for zebra_pbr_iptable context, the ipset and ipset entry contexts are encapsulated into an union of structures in zebra_dplane_ctx. There is a specificity in that when storing ipset_entry structure, there was a backpointer pointer to the ipset structure that is necessary to get some complementary information before calling the hook. The proposal is to use an ipset_entry_info structure next to the ipset_entry, in the zebra_dplane context. That information is used for ipset_entry processing. The ipset name and the ipset type are the only fields necessary. Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* zebra: move iptable handling in zebra_dplanePhilippe Guibert2021-03-041-3/+1
| | | | | | | | | | | The iptable processing was not handled in remote dataplane, and was directly processed by the thread in charge of zapi calls. Now that call can be handled in the zebra_dplane separate thread. once a zebra_dplane_ctx is allocated for iptable handling, the hook call is performed later. Subsequently, a return code may be triggered to zclient interface if any problem occurs when calling the hook call. Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* zebra: add icmpv6 table of type / codePhilippe Guibert2020-08-211-0/+1
| | | | | | this table contains the list of icmp type/code for icmpv6. Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* bgp, zebra: add family attribute to ipset and iptable contextPhilippe Guibert2020-08-211-0/+6
| | | | | | | | in order to create appropriate policy route, family attribute is stored in ipset and iptable zapi contexts. This commit also adds the flow label attribute in iptables, for further usage. Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* zebra: remove old kernel one-update-at-a-time apiJakub Urbańczyk2020-08-101-7/+0
| | | | | | The old one is replaced by the api that is suitable for the batching. Signed-off-by: Jakub Urbańczyk <xthaid@gmail.com>
* pbrd, zebra, lib: DSCP / ECN-based PBR MatchingWesley Coakley2020-07-151-0/+2
| | | | | | | | | | | | | | | | Extend PBR maps to discriminate by Differentiated Services Code Point and / or Explicit Congestion Notification fields. These fields are used in the IP header for classifying network traffic. 0 1 2 3 4 5 6 7 +-----+-----+-----+-----+-----+-----+-----+-----+ | DS FIELD, DSCP | ECN FIELD | +-----+-----+-----+-----+-----+-----+-----+-----+ DSCP: differentiated services codepoint ECN: Explicit Congestion Notification Signed-off-by: Wesley Coakley <wcoakley@nvidia.com> Signed-off-by: Saurav Kumar Paul <saurav@cumulusnetworks.com>
* zebra: convert ip rule installation to use dplane threadJakub Urbańczyk2020-06-101-18/+4
| | | | | | | | | * Implement new dataplane operations * Convert existing code to use dataplane context object * Modify function preparing netlink message to use dataplane context object Signed-off-by: Jakub Urbańczyk <xthaid@gmail.com>
* zebra: define some explicit rule replace code pathsStephen Worley2020-04-091-0/+7
| | | | | | | | Define some explicit rule replace code paths into the dataplane code and improve the handling around it/releasing the the old rule from the hash table. Signed-off-by: Stephen Worley <sworley@cumulusnetworks.com>
* zebra: Don't bother ref'ing ifp in zebra_pbr_ruleStephen Worley2019-10-151-1/+1
| | | | | | | | | | | | If we only really use the ifp for the name, then don't bother referencing the ifp. If that ifp is freed, we don't expect zebra to handle the rules that use it (that's pbrd's job), so it is going to be pointing to unintialized memory when we decide to remove that rule later. Thus, just keep the name in the data and dont mess with pointer refs. Signed-off-by: Stephen Worley <sworley@cumulusnetworks.com>
* bgp, zebra, lib: add protocol support for iptablesPhilippe Guibert2019-07-081-0/+1
| | | | | | | in addition to support for tcpflags, it is possible to filter on any protocol. the filtering can then be based with iptables. Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* lib: hashing functions should take const argumentsQuentin Young2019-05-141-4/+4
| | | | | | | | | | It doesn't make much sense for a hash function to modify its argument, so const the hash input. BGP does it in a couple places, those cast away the const. Not great but not any worse than it was. Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
* add cplusplus guards to all zebra headersEmanuele Di Pascale2019-03-251-0/+8
| | | | Signed-off-by: Emanuele Di Pascale <emanuele@voltanet.io>
* zebra: Remove _wrap_script from hook namesDonald Sharp2018-10-241-5/+5
| | | | | | | The _wrap_script inclusion implies a certain end functionality of which we don't care. We just care that the hooks are called. Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
* zebra: Move ipset_hash, ipset_entry_hash and iptable_hash into zrouterDonald Sharp2018-10-241-36/+23
| | | | | | | These three data structures belong in the `zebra_router` structure as that they do not belong in `struct zebra_ns`. Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
* zebra: Move rules_hash to zrouterDonald Sharp2018-10-241-2/+4
| | | | | | | | | | Move the rules_hash to the zrouter data structure and provide the additional bit of work needed to lookup the rule based upon the namespace id as well. Make the callers of functions not care about what namespace id we are in. Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com> Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
* *: Replace hash_cmp function return value to a boolDonald Sharp2018-10-191-4/+5
| | | | | | | | | The ->hash_cmp and linked list ->cmp functions were sometimes being used interchangeably and this really is not a good thing. So let's modify the hash_cmp function pointer to return a boolean and convert everything to use the new syntax. Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
* zebra: Create zebra_dplane.c and .hMark Stapp2018-09-201-7/+6
| | | | | | | Add first sketchy 'dplane' files. Signed-off-by: Mark Stapp <mjs@voltanet.io> Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
* zebra: show pbr iptable per iptablePhilippe Guibert2018-07-241-1/+1
| | | | | | Add ability to pass a ip table parameter. Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* zebra: handle policy routing fragment handlingPhilippe Guibert2018-06-281-0/+1
| | | | | | | incoming iptable entries with fragment parameter is handled. An iptable context is created for each fragment value received from BGP. Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* *: add flowspec dscp handlingPhilippe Guibert2018-06-281-0/+1
| | | | | | Only one dscp value is accepted as filtering option. Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* zebra: handling of policy routing iptable tcpflagsPhilippe Guibert2018-06-281-0/+4
| | | | Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* zebra: add packet length into pbr supportPhilippe Guibert2018-06-281-0/+3
| | | | | | | | The packet length is added to iptable zapi message. Then the iptable structure is taking into account the pkt_len field. The show pbr iptable command displays the packet length used if any. Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* bgpd: add comment to inform that icmp can be stored in that structPhilippe Guibert2018-06-281-0/+2
| | | | | | Generic ipset entry structure will be reused to host icmp information. Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* zebra: improve show zebra ipset output for icmpPhilippe Guibert2018-06-281-0/+2
| | | | | | | The icmp type/code is displayed. Also, the flags are correctly set in case ICMP protocol is elected. Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* zebra: pbr ipset_type2_str command is externalisedPhilippe Guibert2018-06-281-0/+2
| | | | | | The API of that function that converts ipset types is externalised. Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* zebra: Add knowledge of request success/failure for pbr rulesDonald Sharp2018-05-301-2/+2
| | | | | | | Add some nascent code to handle success/failure of the rule installation. Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
* zebra: Rename SOUTHBOUND_XXX to DP_XXXDonald Sharp2018-05-301-5/+5
| | | | | | | The SOUTHBOUND_XXX enum was named a bit poorly. Let's use a bit better name for what we are trying to do. Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
* zebra: PBR config and monitor IPSET/IPTABLE hooks declaredPhilippe Guibert2018-05-251-0/+22
| | | | | | | | | | The following PBR handlers: ipset, and iptables will prioritary call the hook from a possible plugin. If a plugin is attached, then it will return a positive value. That is why the return status is tested against 0 value, since that means that there are no plugin module plugged Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* zebra: handle iptable list of interfacesPhilippe Guibert2018-05-251-0/+6
| | | | | | | | | Upon reception of an iptable_add or iptable_del, a list of interface indexes may be passed in the zapi interface. The list is converted in interface name so that it is ready to be passed to be programmed to the underlying system. Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* zebra: add 3 fields to ipset_entry : src,dst port, and protoPhilippe Guibert2018-05-251-0/+7
| | | | | | | | | | | | Those 3 fields are read and written between zebra and bgpd. This permits extending the ipset_entry structure. Combinatories will be possible: - filtering with one of the src/dst port. - filtering with one of the range src/ range dst port usage of src or dst is exclusive in a FS entry. - filtering a port or a port range based on either src or dst port. Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* zebra: pbr vty show command for ipset and iptablesPhilippe Guibert2018-05-251-0/+3
| | | | | | | | | | | | | Two new vty show functions available: show pbr ipset <NAME> show pbr iptables <NAME> Those function dump the underlying "kernel" contexts. It relies on the zebra pbr contexts. This helps then to know which zebra pbr context has been configured since those contexts are mainly configured by BGP Flowspec. Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* zebra: add netlink rule support for fwmark optionPhilippe Guibert2018-05-251-0/+2
| | | | | | | | When a mark is set, incoming traffic having that mark set can be redirected to a specific table identifier. This work is done through netlink. Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* zebra: rework pbr ipset entryPhilippe Guibert2018-05-251-0/+4
| | | | | | | | Add ns_id into zebra_pbr ipset This is important so that each ipset entry knows on which NETNS the ipset entry must be inkected Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* zebra: upon zclient breaking, flush PBR entriesPhilippe Guibert2018-05-221-2/+1
| | | | | | | In case, the BGP or PBR daemon leaves, the PBR contexts created by this daemon are flushed. Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* zebra: adapt zebra_pbr_rule based with pbr_rulePhilippe Guibert2018-04-161-65/+9
| | | | | | | | | | | In order to avoid duplicates functions, the zebra_pbr_rule structure used by zebra to decode the zapi message, and send netlink messages, is slightly modified. the structure is derived from pbr_rule, but it also includes sock identifier that is used to send back information to the daemon that did the request. Also, the ifp pointer is stored in that structure. Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* zebra: add IPTABLE_ADD and IPTABLE_DEL commands in zapiPhilippe Guibert2018-04-161-0/+41
| | | | | | | | | | | Those messages permit a remote daemon to configure an iptable entry. A structure is defined that maps to an iptable entry. More specifically, this structure proposes to associate fwmark, and a table ID. Adding to the configuration, the initialisation of iptables hash list is done into zebra netnamespace. Also a hook for notifying the sender that the iptables has been correctly set is done. Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* zebra: pbr rule structure is being added fwmark tagPhilippe Guibert2018-04-161-0/+4
| | | | | | | PBR rule is being added a 32 bit value that can be used to record a rule in the kernel, by using a fwmark information. Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* zebra: handling notifications upon ipset creation/destruction donePhilippe Guibert2018-04-161-0/+15
| | | | | | | Once ipset entries are injected in the kernel, the relevant daemon is informed with a zebra message sent back. Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* lib: add ZEBRA IPSET definesPhilippe Guibert2018-04-161-0/+2
| | | | | | | ZEBRA IPSET defines are added for creating/deleting ipset contexts. Ans also create ipset hash sets. Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* zebra: handle entry pointfs for ipset creation/destructionPhilippe Guibert2018-04-161-0/+61
| | | | | | | | IPset and IPset entries structures are introduced. Those entries reflect the ipset structures and ipset hash sets that will be created on the kernel. Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
* zebra: Allow for deletion of rules when the originator goes awayDonald Sharp2018-03-161-0/+3
| | | | | | | When zebra detects that the originator has dissapeared delete all rules associated with that client. Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
* lib, zebra: Add Rule insertion success/failure messagesDonald Sharp2018-03-091-0/+9
| | | | | | | Add code to allow rule insertion notifications to be sent back up the stack. Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
* zebra: Make the ifp part of the rule structureDonald Sharp2018-03-091-11/+6
| | | | | | | | | | Every place we need to pass around the rule structure we need to pass around the ifp as well. Move it into the structure. This will also allow us to notify up to higher level protocols that this worked properly or not better too. Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-02 01:48:55 +0100