1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
|
// SPDX-License-Identifier: GPL-2.0-or-later
/*
* Zebra Policy Based Routing (PBR) Data structures and definitions
* These are public definitions referenced by multiple files.
* Copyright (C) 2018 Cumulus Networks, Inc.
*/
#ifndef _ZEBRA_PBR_H
#define _ZEBRA_PBR_H
#include <zebra.h>
#include "prefix.h"
#include "if.h"
#include "rt.h"
#include "pbr.h"
#ifdef __cplusplus
extern "C" {
#endif
/* Memory type for PBR objects. */
DECLARE_MTYPE(PBR_OBJ);
struct zebra_pbr_action {
afi_t afi;
/* currently only one nexthop is supported */
union g_addr gate;
/* dest-interface */
ifindex_t ifindex;
/* dataplane info */
intptr_t dp_flow_ptr;
/* neigh */
struct zebra_neigh_ent *neigh;
/* zebra_pbr_rule is linked to neigh via neigh_listnode */
struct listnode neigh_listnode;
};
struct zebra_pbr_rule {
int sock;
struct pbr_rule rule;
char ifname[INTERFACE_NAMSIZ];
struct zebra_pbr_action action;
vrf_id_t vrf_id;
};
#define IS_RULE_FILTERING_ON_SRC_IP(r) \
(r->rule.filter.filter_bm & PBR_FILTER_SRC_IP)
#define IS_RULE_FILTERING_ON_DST_IP(r) \
(r->rule.filter.filter_bm & PBR_FILTER_DST_IP)
#define IS_RULE_FILTERING_ON_SRC_PORT(r) \
(r->rule.filter.filter_bm & PBR_FILTER_SRC_PORT)
#define IS_RULE_FILTERING_ON_DST_PORT(r) \
(r->rule.filter.filter_bm & PBR_FILTER_DST_PORT)
#define IS_RULE_FILTERING_ON_DSFIELD(r) \
(r->rule.filter.filter_bm & PBR_FILTER_DSFIELD)
#define IS_RULE_FILTERING_ON_FWMARK(r) \
(r->rule.filter.filter_bm & PBR_FILTER_FWMARK)
/*
* An IPSet Entry Filter
*
* This is a filter mapped on ipset entries
*/
struct zebra_pbr_ipset_info {
/* type is encoded as uint32_t
* but value is an enum ipset_type
*/
uint32_t type;
uint8_t family;
char ipset_name[ZEBRA_IPSET_NAME_SIZE];
};
struct zebra_pbr_ipset {
/*
* Originating zclient sock fd, so we can know who to send
* back to.
*/
int sock;
vrf_id_t vrf_id;
uint32_t unique;
/* type is encoded as uint32_t
* but value is an enum ipset_type
*/
uint32_t type;
uint8_t family;
char ipset_name[ZEBRA_IPSET_NAME_SIZE];
};
/*
* An IPSet Entry Filter
*
* This is a filter mapped on ipset entries
*/
struct zebra_pbr_ipset_entry {
/*
* Originating zclient sock fd, so we can know who to send
* back to.
*/
int sock;
uint32_t unique;
struct prefix src;
struct prefix dst;
/* udp/tcp src port or icmp type */
uint16_t src_port_min;
uint16_t src_port_max;
/* udp/tcp dst port or icmp code */
uint16_t dst_port_min;
uint16_t dst_port_max;
uint8_t proto;
uint32_t filter_bm;
struct zebra_pbr_ipset *backpointer;
};
/*
* An IPTables Action
*
* This is a filter mapped on ipset entries
*/
struct zebra_pbr_iptable {
/*
* Originating zclient sock fd, so we can know who to send
* back to.
*/
int sock;
vrf_id_t vrf_id;
uint32_t unique;
/* include ipset type
*/
uint32_t type;
/* include which IP is to be filtered
*/
uint32_t filter_bm;
uint32_t fwmark;
uint32_t action;
uint16_t pkt_len_min;
uint16_t pkt_len_max;
uint16_t tcp_flags;
uint16_t tcp_mask_flags;
uint8_t dscp_value;
uint8_t fragment;
uint8_t protocol;
uint32_t nb_interface;
uint16_t flow_label;
uint8_t family;
struct list *interface_name_list;
#define IPTABLE_INSTALL_QUEUED 1 << 1
#define IPTABLE_UNINSTALL_QUEUED 1 << 2
uint8_t internal_flags;
char ipset_name[ZEBRA_IPSET_NAME_SIZE];
};
extern const struct message icmp_typecode_str[];
extern const struct message icmpv6_typecode_str[];
const char *zebra_pbr_ipset_type2str(uint32_t type);
void zebra_pbr_add_rule(struct zebra_pbr_rule *rule);
void zebra_pbr_del_rule(struct zebra_pbr_rule *rule);
void zebra_pbr_create_ipset(struct zebra_pbr_ipset *ipset);
void zebra_pbr_destroy_ipset(struct zebra_pbr_ipset *ipset);
struct zebra_pbr_ipset *zebra_pbr_lookup_ipset_pername(char *ipsetname);
void zebra_pbr_add_ipset_entry(struct zebra_pbr_ipset_entry *ipset);
void zebra_pbr_del_ipset_entry(struct zebra_pbr_ipset_entry *ipset);
void zebra_pbr_add_iptable(struct zebra_pbr_iptable *iptable);
void zebra_pbr_del_iptable(struct zebra_pbr_iptable *iptable);
void zebra_pbr_process_iptable(struct zebra_dplane_ctx *ctx);
void zebra_pbr_process_ipset(struct zebra_dplane_ctx *ctx);
void zebra_pbr_process_ipset_entry(struct zebra_dplane_ctx *ctx);
/*
* Get to know existing PBR rules in the kernel - typically called at startup.
*/
extern void kernel_read_pbr_rules(struct zebra_ns *zns);
/*
* Handle success or failure of rule (un)install in the kernel.
*/
extern void zebra_pbr_dplane_result(struct zebra_dplane_ctx *ctx);
/*
* Handle success or failure of ipset kinds (un)install in the kernel.
*/
extern void kernel_pbr_ipset_add_del_status(struct zebra_pbr_ipset *ipset,
enum zebra_dplane_status res);
extern void kernel_pbr_ipset_entry_add_del_status(
struct zebra_pbr_ipset_entry *ipset,
enum zebra_dplane_status res);
/*
* Handle rule delete notification from kernel.
*/
extern int kernel_pbr_rule_del(struct zebra_pbr_rule *rule);
extern void zebra_pbr_rules_free(void *arg);
extern uint32_t zebra_pbr_rules_hash_key(const void *arg);
extern bool zebra_pbr_rules_hash_equal(const void *arg1, const void *arg2);
/* has operates on 32bit pointer
* and field is a string of 8bit
*/
#define ZEBRA_IPSET_NAME_HASH_SIZE (ZEBRA_IPSET_NAME_SIZE / 4)
extern void zebra_pbr_ipset_free(void *arg);
extern uint32_t zebra_pbr_ipset_hash_key(const void *arg);
extern bool zebra_pbr_ipset_hash_equal(const void *arg1, const void *arg2);
extern void zebra_pbr_ipset_entry_free(void *arg);
extern uint32_t zebra_pbr_ipset_entry_hash_key(const void *arg);
extern bool zebra_pbr_ipset_entry_hash_equal(const void *arg1,
const void *arg2);
extern void zebra_pbr_iptable_free(void *arg);
extern uint32_t zebra_pbr_iptable_hash_key(const void *arg);
extern bool zebra_pbr_iptable_hash_equal(const void *arg1, const void *arg2);
extern void zebra_pbr_config_write(struct vty *vty);
extern void zebra_pbr_expand_action_update(bool enable);
extern void zebra_pbr_init(void);
extern void zebra_pbr_show_ipset_list(struct vty *vty, char *ipsetname);
extern void zebra_pbr_show_iptable(struct vty *vty, char *iptable);
extern void zebra_pbr_iptable_update_interfacelist(struct stream *s,
struct zebra_pbr_iptable *zpi);
size_t zebra_pbr_tcpflags_snprintf(char *buffer, size_t len,
uint16_t tcp_val);
extern void zebra_pbr_show_rule(struct vty *vty);
extern void zebra_pbr_show_rule_unit(struct zebra_pbr_rule *rule,
struct vty *vty);
DECLARE_HOOK(zebra_pbr_ipset_entry_get_stat,
(struct zebra_pbr_ipset_entry *ipset, uint64_t *pkts,
uint64_t *bytes),
(ipset, pkts, bytes));
DECLARE_HOOK(zebra_pbr_iptable_get_stat,
(struct zebra_pbr_iptable *iptable, uint64_t *pkts,
uint64_t *bytes),
(iptable, pkts, bytes));
DECLARE_HOOK(zebra_pbr_iptable_update,
(int cmd, struct zebra_pbr_iptable *iptable), (cmd, iptable));
DECLARE_HOOK(zebra_pbr_ipset_entry_update,
(int cmd, struct zebra_pbr_ipset_entry *ipset), (cmd, ipset));
DECLARE_HOOK(zebra_pbr_ipset_update,
(int cmd, struct zebra_pbr_ipset *ipset), (cmd, ipset));
#ifdef __cplusplus
}
#endif
#endif /* _ZEBRA_PBR_H */
|
