]> git.proxmox.com Git - mirror_frr.git/blame - zebra/zebra_nhg.c
projects / mirror_frr.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge pull request #4801 from donaldsharp/nht_vrf_show_evil
[mirror_frr.git] / zebra / zebra_nhg.c
CommitLineData
ad28e79a
SW		 1/* Zebra Nexthop Group Code.
2 * Copyright (C) 2019 Cumulus Networks, Inc.
3 * Donald Sharp
4 * Stephen Worley
5 *
6 * This file is part of FRR.
7 *
8 * FRR is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the
10 * Free Software Foundation; either version 2, or (at your option) any
11 * later version.
12 *
13 * FRR is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with FRR; see the file COPYING. If not, write to the Free
20 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
21 * 02111-1307, USA.
22 */
23#include <zebra.h>
24
25#include "lib/nexthop.h"
50d89650 26#include "lib/nexthop_group_private.h"
ad28e79a
SW		 27#include "lib/routemap.h"
28
29#include "zebra/connected.h"
30#include "zebra/debug.h"
31#include "zebra/zebra_router.h"
32#include "zebra/zebra_nhg.h"
33#include "zebra/zebra_rnh.h"
34#include "zebra/zebra_routemap.h"
35#include "zebra/rt.h"
36
37static void nexthop_set_resolved(afi_t afi, const struct nexthop *newhop,
38 struct nexthop *nexthop)
39{
40 struct nexthop *resolved_hop;
41
42 resolved_hop = nexthop_new();
43 SET_FLAG(resolved_hop->flags, NEXTHOP_FLAG_ACTIVE);
44
45 resolved_hop->vrf_id = nexthop->vrf_id;
46 switch (newhop->type) {
47 case NEXTHOP_TYPE_IPV4:
48 case NEXTHOP_TYPE_IPV4_IFINDEX:
49 /* If the resolving route specifies a gateway, use it */
50 resolved_hop->type = newhop->type;
51 resolved_hop->gate.ipv4 = newhop->gate.ipv4;
52
53 if (newhop->ifindex) {
54 resolved_hop->type = NEXTHOP_TYPE_IPV4_IFINDEX;
55 resolved_hop->ifindex = newhop->ifindex;
56 }
57 break;
58 case NEXTHOP_TYPE_IPV6:
59 case NEXTHOP_TYPE_IPV6_IFINDEX:
60 resolved_hop->type = newhop->type;
61 resolved_hop->gate.ipv6 = newhop->gate.ipv6;
62
63 if (newhop->ifindex) {
64 resolved_hop->type = NEXTHOP_TYPE_IPV6_IFINDEX;
65 resolved_hop->ifindex = newhop->ifindex;
66 }
67 break;
68 case NEXTHOP_TYPE_IFINDEX:
69 /* If the resolving route is an interface route,
70 * it means the gateway we are looking up is connected
71 * to that interface. (The actual network is _not_ onlink).
72 * Therefore, the resolved route should have the original
73 * gateway as nexthop as it is directly connected.
74 *
75 * On Linux, we have to set the onlink netlink flag because
76 * otherwise, the kernel won't accept the route.
77 */
78 resolved_hop->flags |= NEXTHOP_FLAG_ONLINK;
79 if (afi == AFI_IP) {
80 resolved_hop->type = NEXTHOP_TYPE_IPV4_IFINDEX;
81 resolved_hop->gate.ipv4 = nexthop->gate.ipv4;
82 } else if (afi == AFI_IP6) {
83 resolved_hop->type = NEXTHOP_TYPE_IPV6_IFINDEX;
84 resolved_hop->gate.ipv6 = nexthop->gate.ipv6;
85 }
86 resolved_hop->ifindex = newhop->ifindex;
87 break;
88 case NEXTHOP_TYPE_BLACKHOLE:
89 resolved_hop->type = NEXTHOP_TYPE_BLACKHOLE;
90 resolved_hop->bh_type = nexthop->bh_type;
91 break;
92 }
93
94 if (newhop->flags & NEXTHOP_FLAG_ONLINK)
95 resolved_hop->flags |= NEXTHOP_FLAG_ONLINK;
96
97 /* Copy labels of the resolved route */
98 if (newhop->nh_label)
99 nexthop_add_labels(resolved_hop, newhop->nh_label_type,
100 newhop->nh_label->num_labels,
101 &newhop->nh_label->label[0]);
102
103 resolved_hop->rparent = nexthop;
50d89650 104 _nexthop_add(&nexthop->resolved, resolved_hop);
ad28e79a
SW		 105}
106
107/*
108 * Given a nexthop we need to properly recursively resolve
109 * the route. As such, do a table lookup to find and match
110 * if at all possible. Set the nexthop->ifindex as appropriate
111 */
112static int nexthop_active(afi_t afi, struct route_entry *re,
113 struct nexthop *nexthop, struct route_node *top)
114{
115 struct prefix p;
116 struct route_table *table;
117 struct route_node *rn;
118 struct route_entry *match = NULL;
119 int resolved;
120 struct nexthop *newhop;
121 struct interface *ifp;
122 rib_dest_t *dest;
123
124 if ((nexthop->type == NEXTHOP_TYPE_IPV4)
125 || nexthop->type == NEXTHOP_TYPE_IPV6)
126 nexthop->ifindex = 0;
127
128 UNSET_FLAG(nexthop->flags, NEXTHOP_FLAG_RECURSIVE);
129 nexthops_free(nexthop->resolved);
130 nexthop->resolved = NULL;
131 re->nexthop_mtu = 0;
132
133 /*
134 * If the kernel has sent us a route, then
135 * by golly gee whiz it's a good route.
136 */
137 if (re->type == ZEBRA_ROUTE_KERNEL || re->type == ZEBRA_ROUTE_SYSTEM)
138 return 1;
139
140 /*
141 * Check to see if we should trust the passed in information
142 * for UNNUMBERED interfaces as that we won't find the GW
143 * address in the routing table.
144 * This check should suffice to handle IPv4 or IPv6 routes
145 * sourced from EVPN routes which are installed with the
146 * next hop as the remote VTEP IP.
147 */
148 if (CHECK_FLAG(nexthop->flags, NEXTHOP_FLAG_ONLINK)) {
149 ifp = if_lookup_by_index(nexthop->ifindex, nexthop->vrf_id);
150 if (!ifp) {
151 if (IS_ZEBRA_DEBUG_RIB_DETAILED)
152 zlog_debug(
153 "\t%s: Onlink and interface: %u[%u] does not exist",
154 __PRETTY_FUNCTION__, nexthop->ifindex,
155 nexthop->vrf_id);
156 return 0;
157 }
158 if (connected_is_unnumbered(ifp)) {
159 if (if_is_operative(ifp))
160 return 1;
161 else {
162 if (IS_ZEBRA_DEBUG_RIB_DETAILED)
163 zlog_debug(
164 "\t%s: Onlink and interface %s is not operative",
165 __PRETTY_FUNCTION__, ifp->name);
166 return 0;
167 }
168 }
169 if (!if_is_operative(ifp)) {
170 if (IS_ZEBRA_DEBUG_RIB_DETAILED)
171 zlog_debug(
172 "\t%s: Interface %s is not unnumbered",
173 __PRETTY_FUNCTION__, ifp->name);
174 return 0;
175 }
176 }
177
178 /* Make lookup prefix. */
179 memset(&p, 0, sizeof(struct prefix));
180 switch (afi) {
181 case AFI_IP:
182 p.family = AF_INET;
183 p.prefixlen = IPV4_MAX_PREFIXLEN;
184 p.u.prefix4 = nexthop->gate.ipv4;
185 break;
186 case AFI_IP6:
187 p.family = AF_INET6;
188 p.prefixlen = IPV6_MAX_PREFIXLEN;
189 p.u.prefix6 = nexthop->gate.ipv6;
190 break;
191 default:
192 assert(afi != AFI_IP && afi != AFI_IP6);
193 break;
194 }
195 /* Lookup table. */
196 table = zebra_vrf_table(afi, SAFI_UNICAST, nexthop->vrf_id);
197 if (!table) {
198 if (IS_ZEBRA_DEBUG_RIB_DETAILED)
199 zlog_debug("\t%s: Table not found",
200 __PRETTY_FUNCTION__);
201 return 0;
202 }
203
204 rn = route_node_match(table, (struct prefix *)&p);
205 while (rn) {
206 route_unlock_node(rn);
207
208 /* Lookup should halt if we've matched against ourselves ('top',
209 * if specified) - i.e., we cannot have a nexthop NH1 is
210 * resolved by a route NH1. The exception is if the route is a
211 * host route.
212 */
213 if (top && rn == top)
214 if (((afi == AFI_IP) && (rn->p.prefixlen != 32))
215 || ((afi == AFI_IP6) && (rn->p.prefixlen != 128))) {
216 if (IS_ZEBRA_DEBUG_RIB_DETAILED)
217 zlog_debug(
218 "\t%s: Matched against ourself and prefix length is not max bit length",
219 __PRETTY_FUNCTION__);
220 return 0;
221 }
222
223 /* Pick up selected route. */
224 /* However, do not resolve over default route unless explicitly
225 * allowed. */
226 if (is_default_prefix(&rn->p)
227 && !rnh_resolve_via_default(p.family)) {
228 if (IS_ZEBRA_DEBUG_RIB_DETAILED)
229 zlog_debug(
230 "\t:%s: Resolved against default route",
231 __PRETTY_FUNCTION__);
232 return 0;
233 }
234
235 dest = rib_dest_from_rnode(rn);
236 if (dest && dest->selected_fib
237 && !CHECK_FLAG(dest->selected_fib->status,
238 ROUTE_ENTRY_REMOVED)
239 && dest->selected_fib->type != ZEBRA_ROUTE_TABLE)
240 match = dest->selected_fib;
241
242 /* If there is no selected route or matched route is EGP, go up
243 tree. */
244 if (!match) {
245 do {
246 rn = rn->parent;
247 } while (rn && rn->info == NULL);
248 if (rn)
249 route_lock_node(rn);
250
251 continue;
252 }
253
254 if (match->type == ZEBRA_ROUTE_CONNECT) {
255 /* Directly point connected route. */
256 newhop = match->ng.nexthop;
257 if (newhop) {
258 if (nexthop->type == NEXTHOP_TYPE_IPV4
259 || nexthop->type == NEXTHOP_TYPE_IPV6)
260 nexthop->ifindex = newhop->ifindex;
261 }
262 return 1;
263 } else if (CHECK_FLAG(re->flags, ZEBRA_FLAG_ALLOW_RECURSION)) {
264 resolved = 0;
265 for (ALL_NEXTHOPS(match->ng, newhop)) {
266 if (!CHECK_FLAG(match->status,
267 ROUTE_ENTRY_INSTALLED))
268 continue;
269 if (CHECK_FLAG(newhop->flags,
270 NEXTHOP_FLAG_RECURSIVE))
271 continue;
272
273 SET_FLAG(nexthop->flags,
274 NEXTHOP_FLAG_RECURSIVE);
ad28e79a
SW		 275 nexthop_set_resolved(afi, newhop, nexthop);
276 resolved = 1;
277 }
278 if (resolved)
279 re->nexthop_mtu = match->mtu;
280 if (!resolved && IS_ZEBRA_DEBUG_RIB_DETAILED)
281 zlog_debug("\t%s: Recursion failed to find",
282 __PRETTY_FUNCTION__);
283 return resolved;
284 } else if (re->type == ZEBRA_ROUTE_STATIC) {
285 resolved = 0;
286 for (ALL_NEXTHOPS(match->ng, newhop)) {
287 if (!CHECK_FLAG(match->status,
288 ROUTE_ENTRY_INSTALLED))
289 continue;
290 if (CHECK_FLAG(newhop->flags,
291 NEXTHOP_FLAG_RECURSIVE))
292 continue;
293
294 SET_FLAG(nexthop->flags,
295 NEXTHOP_FLAG_RECURSIVE);
296 nexthop_set_resolved(afi, newhop, nexthop);
297 resolved = 1;
298 }
299 if (resolved)
300 re->nexthop_mtu = match->mtu;
301
302 if (!resolved && IS_ZEBRA_DEBUG_RIB_DETAILED)
303 zlog_debug(
304 "\t%s: Static route unable to resolve",
305 __PRETTY_FUNCTION__);
306 return resolved;
307 } else {
308 if (IS_ZEBRA_DEBUG_RIB_DETAILED) {
309 zlog_debug(
310 "\t%s: Route Type %s has not turned on recursion",
311 __PRETTY_FUNCTION__,
312 zebra_route_string(re->type));
313 if (re->type == ZEBRA_ROUTE_BGP
314 && !CHECK_FLAG(re->flags, ZEBRA_FLAG_IBGP))
315 zlog_debug(
316 "\tEBGP: see \"disable-ebgp-connected-route-check\" or \"disable-connected-check\"");
317 }
318 return 0;
319 }
320 }
321 if (IS_ZEBRA_DEBUG_RIB_DETAILED)
322 zlog_debug("\t%s: Nexthop did not lookup in table",
323 __PRETTY_FUNCTION__);
324 return 0;
325}
326
327/* This function verifies reachability of one given nexthop, which can be
328 * numbered or unnumbered, IPv4 or IPv6. The result is unconditionally stored
329 * in nexthop->flags field. The nexthop->ifindex will be updated
330 * appropriately as well. An existing route map can turn
331 * (otherwise active) nexthop into inactive, but not vice versa.
332 *
333 * The return value is the final value of 'ACTIVE' flag.
334 */
335static unsigned nexthop_active_check(struct route_node *rn,
336 struct route_entry *re,
337 struct nexthop *nexthop)
338{
339 struct interface *ifp;
b68885f9 340 route_map_result_t ret = RMAP_PERMITMATCH;
ad28e79a
SW		 341 int family;
342 char buf[SRCDEST2STR_BUFFER];
343 const struct prefix *p, *src_p;
344 struct zebra_vrf *zvrf;
345
346 srcdest_rnode_prefixes(rn, &p, &src_p);
347
348 if (rn->p.family == AF_INET)
349 family = AFI_IP;
350 else if (rn->p.family == AF_INET6)
351 family = AFI_IP6;
352 else
353 family = 0;
354 switch (nexthop->type) {
355 case NEXTHOP_TYPE_IFINDEX:
356 ifp = if_lookup_by_index(nexthop->ifindex, nexthop->vrf_id);
357 if (ifp && if_is_operative(ifp))
358 SET_FLAG(nexthop->flags, NEXTHOP_FLAG_ACTIVE);
359 else
360 UNSET_FLAG(nexthop->flags, NEXTHOP_FLAG_ACTIVE);
361 break;
362 case NEXTHOP_TYPE_IPV4:
363 case NEXTHOP_TYPE_IPV4_IFINDEX:
364 family = AFI_IP;
365 if (nexthop_active(AFI_IP, re, nexthop, rn))
366 SET_FLAG(nexthop->flags, NEXTHOP_FLAG_ACTIVE);
367 else
368 UNSET_FLAG(nexthop->flags, NEXTHOP_FLAG_ACTIVE);
369 break;
370 case NEXTHOP_TYPE_IPV6:
371 family = AFI_IP6;
372 if (nexthop_active(AFI_IP6, re, nexthop, rn))
373 SET_FLAG(nexthop->flags, NEXTHOP_FLAG_ACTIVE);
374 else
375 UNSET_FLAG(nexthop->flags, NEXTHOP_FLAG_ACTIVE);
376 break;
377 case NEXTHOP_TYPE_IPV6_IFINDEX:
378 /* RFC 5549, v4 prefix with v6 NH */
379 if (rn->p.family != AF_INET)
380 family = AFI_IP6;
381 if (IN6_IS_ADDR_LINKLOCAL(&nexthop->gate.ipv6)) {
382 ifp = if_lookup_by_index(nexthop->ifindex,
383 nexthop->vrf_id);
384 if (ifp && if_is_operative(ifp))
385 SET_FLAG(nexthop->flags, NEXTHOP_FLAG_ACTIVE);
386 else
387 UNSET_FLAG(nexthop->flags, NEXTHOP_FLAG_ACTIVE);
388 } else {
389 if (nexthop_active(AFI_IP6, re, nexthop, rn))
390 SET_FLAG(nexthop->flags, NEXTHOP_FLAG_ACTIVE);
391 else
392 UNSET_FLAG(nexthop->flags, NEXTHOP_FLAG_ACTIVE);
393 }
394 break;
395 case NEXTHOP_TYPE_BLACKHOLE:
396 SET_FLAG(nexthop->flags, NEXTHOP_FLAG_ACTIVE);
397 break;
398 default:
399 break;
400 }
401 if (!CHECK_FLAG(nexthop->flags, NEXTHOP_FLAG_ACTIVE)) {
402 if (IS_ZEBRA_DEBUG_RIB_DETAILED)
403 zlog_debug("\t%s: Unable to find a active nexthop",
404 __PRETTY_FUNCTION__);
405 return 0;
406 }
407
408 /* XXX: What exactly do those checks do? Do we support
409 * e.g. IPv4 routes with IPv6 nexthops or vice versa?
410 */
411 if (RIB_SYSTEM_ROUTE(re) || (family == AFI_IP && p->family != AF_INET)
412 || (family == AFI_IP6 && p->family != AF_INET6))
413 return CHECK_FLAG(nexthop->flags, NEXTHOP_FLAG_ACTIVE);
414
415 /* The original code didn't determine the family correctly
416 * e.g. for NEXTHOP_TYPE_IFINDEX. Retrieve the correct afi
417 * from the rib_table_info in those cases.
418 * Possibly it may be better to use only the rib_table_info
419 * in every case.
420 */
421 if (!family) {
422 rib_table_info_t *info;
423
424 info = srcdest_rnode_table_info(rn);
425 family = info->afi;
426 }
427
428 memset(&nexthop->rmap_src.ipv6, 0, sizeof(union g_addr));
429
430 zvrf = zebra_vrf_lookup_by_id(nexthop->vrf_id);
431 if (!zvrf) {
432 if (IS_ZEBRA_DEBUG_RIB_DETAILED)
433 zlog_debug("\t%s: zvrf is NULL", __PRETTY_FUNCTION__);
434 return CHECK_FLAG(nexthop->flags, NEXTHOP_FLAG_ACTIVE);
435 }
436
437 /* It'll get set if required inside */
438 ret = zebra_route_map_check(family, re->type, re->instance, p, nexthop,
439 zvrf, re->tag);
440 if (ret == RMAP_DENYMATCH) {
441 if (IS_ZEBRA_DEBUG_RIB) {
442 srcdest_rnode2str(rn, buf, sizeof(buf));
443 zlog_debug(
444 "%u:%s: Filtering out with NH out %s due to route map",
445 re->vrf_id, buf,
446 ifindex2ifname(nexthop->ifindex,
447 nexthop->vrf_id));
448 }
449 UNSET_FLAG(nexthop->flags, NEXTHOP_FLAG_ACTIVE);
450 }
451 return CHECK_FLAG(nexthop->flags, NEXTHOP_FLAG_ACTIVE);
452}
453
454/*
455 * Iterate over all nexthops of the given RIB entry and refresh their
456 * ACTIVE flag. re->nexthop_active_num is updated accordingly. If any
457 * nexthop is found to toggle the ACTIVE flag, the whole re structure
458 * is flagged with ROUTE_ENTRY_CHANGED.
459 *
460 * Return value is the new number of active nexthops.
461 */
462int nexthop_active_update(struct route_node *rn, struct route_entry *re)
463{
464 struct nexthop *nexthop;
465 union g_addr prev_src;
466 unsigned int prev_active, new_active;
467 ifindex_t prev_index;
468
469 re->nexthop_active_num = 0;
470 UNSET_FLAG(re->status, ROUTE_ENTRY_CHANGED);
471
472 for (nexthop = re->ng.nexthop; nexthop; nexthop = nexthop->next) {
473 /* No protocol daemon provides src and so we're skipping
474 * tracking it */
475 prev_src = nexthop->rmap_src;
476 prev_active = CHECK_FLAG(nexthop->flags, NEXTHOP_FLAG_ACTIVE);
477 prev_index = nexthop->ifindex;
478 /*
479 * We need to respect the multipath_num here
480 * as that what we should be able to install from
481 * a multipath perpsective should not be a data plane
482 * decision point.
483 */
484 new_active = nexthop_active_check(rn, re, nexthop);
485 if (new_active
486 && re->nexthop_active_num >= zrouter.multipath_num) {
487 UNSET_FLAG(nexthop->flags, NEXTHOP_FLAG_ACTIVE);
488 new_active = 0;
489 }
490 if (new_active)
491 re->nexthop_active_num++;
492 /* Don't allow src setting on IPv6 addr for now */
493 if (prev_active != new_active || prev_index != nexthop->ifindex
494 || ((nexthop->type >= NEXTHOP_TYPE_IFINDEX
495 && nexthop->type < NEXTHOP_TYPE_IPV6)
496 && prev_src.ipv4.s_addr
497 != nexthop->rmap_src.ipv4.s_addr)
498 || ((nexthop->type >= NEXTHOP_TYPE_IPV6
499 && nexthop->type < NEXTHOP_TYPE_BLACKHOLE)
500 && !(IPV6_ADDR_SAME(&prev_src.ipv6,
501 &nexthop->rmap_src.ipv6)))
42fc558e 502 || CHECK_FLAG(re->status, ROUTE_ENTRY_LABELS_CHANGED))
ad28e79a 503 SET_FLAG(re->status, ROUTE_ENTRY_CHANGED);
ad28e79a
SW		 504 }
505
506 return re->nexthop_active_num;
507}
508
FRRouting mirror