4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version
7 * 2 of the License, or (at your option) any later version.
9 * Authors: David Ahern <dsa@cumulusnetworks.com>
13 #include <sys/types.h>
15 #include <sys/socket.h>
16 #include <sys/mount.h>
17 #include <linux/bpf.h>
30 #include "ip_common.h"
33 #define CGRP_PROC_FILE "/cgroup.procs"
35 static struct link_filter vrf_filter
;
37 static void usage(void)
39 fprintf(stderr
, "Usage: ip vrf show [NAME] ...\n");
40 fprintf(stderr
, " ip vrf exec [NAME] cmd ...\n");
41 fprintf(stderr
, " ip vrf identify [PID]\n");
42 fprintf(stderr
, " ip vrf pids [NAME]\n");
48 * parse process based cgroup file looking for PATH/vrf/NAME where
49 * NAME is the name of the vrf the process is associated with
51 static int vrf_identify(pid_t pid
, char *name
, size_t len
)
58 snprintf(path
, sizeof(path
), "/proc/%d/cgroup", pid
);
59 fp
= fopen(path
, "r");
65 while (fgets(buf
, sizeof(buf
), fp
)) {
66 /* want the controller-less cgroup */
67 if (strstr(buf
, "::/") == NULL
)
70 vrf
= strstr(buf
, "/vrf/");
72 vrf
+= 5; /* skip past "/vrf/" */
73 end
= strchr(vrf
, '\n');
77 strlcpy(name
, vrf
, len
);
87 static int ipvrf_identify(int argc
, char **argv
)
96 invarg("Extra arguments specified\n", argv
[1]);
97 else if (get_unsigned(&pid
, argv
[0], 10))
98 invarg("Invalid pid\n", argv
[0]);
100 rc
= vrf_identify(pid
, vrf
, sizeof(vrf
));
105 fprintf(stderr
, "Failed to lookup vrf association: %s\n",
112 /* read PATH/vrf/NAME/cgroup.procs file */
113 static void read_cgroup_pids(const char *base_path
, char *name
)
119 if (snprintf(path
, sizeof(path
), "%s/vrf/%s%s",
120 base_path
, name
, CGRP_PROC_FILE
) >= sizeof(path
))
123 fp
= fopen(path
, "r");
125 return; /* no cgroup file, nothing to show */
127 /* dump contents (pids) of cgroup.procs */
128 while (fgets(buf
, sizeof(buf
), fp
)) {
131 nl
= strchr(buf
, '\n');
135 if (get_command_name(buf
, comm
, sizeof(comm
)))
136 strcpy(comm
, "<terminated?>");
138 printf("%5s %s\n", buf
, comm
);
144 /* recurse path looking for PATH[/NETNS]/vrf/NAME */
145 static int recurse_dir(char *base_path
, char *name
, const char *netns
)
153 d
= opendir(base_path
);
157 while ((de
= readdir(d
)) != NULL
) {
158 if (!strcmp(de
->d_name
, ".") || !strcmp(de
->d_name
, ".."))
161 if (!strcmp(de
->d_name
, "vrf")) {
162 const char *pdir
= strrchr(base_path
, '/');
164 /* found a 'vrf' directory. if it is for the given
165 * namespace then dump the cgroup pids
167 if (*netns
== '\0' ||
168 (pdir
&& !strcmp(pdir
+1, netns
)))
169 read_cgroup_pids(base_path
, name
);
174 /* is this a subdir that needs to be walked */
175 if (snprintf(path
, sizeof(path
), "%s/%s",
176 base_path
, de
->d_name
) >= sizeof(path
))
179 if (lstat(path
, &fstat
) < 0)
182 if (S_ISDIR(fstat
.st_mode
)) {
183 rc
= recurse_dir(path
, name
, netns
);
196 static int ipvrf_get_netns(char *netns
, int len
)
198 if (netns_identify_pid("self", netns
, len
-3)) {
199 fprintf(stderr
, "Failed to get name of network namespace: %s\n",
205 strcat(netns
, "-ns");
210 static int ipvrf_pids(int argc
, char **argv
)
217 fprintf(stderr
, "Invalid arguments\n");
222 if (!name_is_vrf(vrf
)) {
223 fprintf(stderr
, "Invalid VRF name\n");
227 mnt
= find_cgroup2_mount();
231 if (ipvrf_get_netns(netns
, sizeof(netns
)) < 0)
234 ret
= recurse_dir(mnt
, vrf
, netns
);
242 /* load BPF program to set sk_bound_dev_if for sockets */
243 static char bpf_log_buf
[256*1024];
245 static int prog_load(int idx
)
247 struct bpf_insn prog
[] = {
248 BPF_MOV64_REG(BPF_REG_6
, BPF_REG_1
),
249 BPF_MOV64_IMM(BPF_REG_3
, idx
),
250 BPF_MOV64_IMM(BPF_REG_2
,
251 offsetof(struct bpf_sock
, bound_dev_if
)),
252 BPF_STX_MEM(BPF_W
, BPF_REG_1
, BPF_REG_3
,
253 offsetof(struct bpf_sock
, bound_dev_if
)),
254 BPF_MOV64_IMM(BPF_REG_0
, 1), /* r0 = verdict */
258 return bpf_prog_load(BPF_PROG_TYPE_CGROUP_SOCK
, prog
, sizeof(prog
),
259 "GPL", bpf_log_buf
, sizeof(bpf_log_buf
));
262 static int vrf_configure_cgroup(const char *path
, int ifindex
)
264 int rc
= -1, cg_fd
, prog_fd
= -1;
266 cg_fd
= open(path
, O_DIRECTORY
| O_RDONLY
);
269 "Failed to open cgroup path: '%s'\n",
275 * Load bpf program into kernel and attach to cgroup to affect
278 prog_fd
= prog_load(ifindex
);
280 fprintf(stderr
, "Failed to load BPF prog: '%s'\n",
283 if (errno
!= EPERM
) {
285 "Kernel compiled with CGROUP_BPF enabled?\n");
290 if (bpf_prog_attach_fd(prog_fd
, cg_fd
, BPF_CGROUP_INET_SOCK_CREATE
)) {
291 fprintf(stderr
, "Failed to attach prog to cgroup: '%s'\n",
304 /* get base path for controller-less cgroup for a process.
305 * path returned does not include /vrf/NAME if it exists
307 static int vrf_path(char *vpath
, size_t len
)
314 snprintf(path
, sizeof(path
), "/proc/%d/cgroup", getpid());
315 fp
= fopen(path
, "r");
321 while (fgets(buf
, sizeof(buf
), fp
)) {
324 start
= strstr(buf
, "::/");
328 /* advance past '::' */
331 nl
= strchr(start
, '\n');
335 vrf
= strstr(start
, "/vrf");
339 strlcpy(vpath
, start
, len
);
341 /* if vrf path is just / then return nothing */
342 if (!strcmp(vpath
, "/"))
353 static int vrf_switch(const char *name
)
355 char path
[PATH_MAX
], *mnt
, pid
[16];
356 char vpath
[PATH_MAX
], netns
[256];
358 int rc
= -1, len
, fd
= -1;
360 if (strcmp(name
, "default")) {
361 ifindex
= name_is_vrf(name
);
363 fprintf(stderr
, "Invalid VRF name\n");
368 mnt
= find_cgroup2_mount();
372 /* -1 on length to add '/' to the end */
373 if (ipvrf_get_netns(netns
, sizeof(netns
) - 1) < 0)
376 if (vrf_path(vpath
, sizeof(vpath
)) < 0) {
377 fprintf(stderr
, "Failed to get base cgroup path: %s\n",
382 /* if path already ends in netns then don't add it again */
383 if (*netns
!= '\0') {
384 char *pdir
= strrchr(vpath
, '/');
391 if (strcmp(pdir
, netns
) == 0)
397 /* path to cgroup; make sure buffer has room to cat "/cgroup.procs"
398 * to the end of the path
400 len
= snprintf(path
, sizeof(path
) - sizeof(CGRP_PROC_FILE
),
402 mnt
, vpath
, netns
, ifindex
? name
: "");
403 if (len
> sizeof(path
) - sizeof(CGRP_PROC_FILE
)) {
404 fprintf(stderr
, "Invalid path to cgroup2 mount\n");
408 if (make_path(path
, 0755)) {
409 fprintf(stderr
, "Failed to setup vrf cgroup2 directory\n");
413 if (ifindex
&& vrf_configure_cgroup(path
, ifindex
))
417 * write pid to cgroup.procs making process part of cgroup
419 strcat(path
, CGRP_PROC_FILE
);
420 fd
= open(path
, O_RDWR
| O_APPEND
);
422 fprintf(stderr
, "Failed to open cgroups.procs file: %s.\n",
427 snprintf(pid
, sizeof(pid
), "%d", getpid());
428 if (write(fd
, pid
, strlen(pid
)) < 0) {
429 fprintf(stderr
, "Failed to join cgroup\n");
444 static int ipvrf_exec(int argc
, char **argv
)
447 fprintf(stderr
, "No VRF name specified\n");
451 fprintf(stderr
, "No command specified\n");
455 if (vrf_switch(argv
[0]))
458 return -cmd_exec(argv
[1], argv
+ 1, !!batch_mode
);
461 /* reset VRF association of current process to default VRF;
468 if (vrf_identify(getpid(), vrf
, sizeof(vrf
)) ||
472 vrf_switch("default");
475 static int ipvrf_filter_req(struct nlmsghdr
*nlh
, int reqlen
)
477 struct rtattr
*linkinfo
;
480 if (vrf_filter
.kind
) {
481 linkinfo
= addattr_nest(nlh
, reqlen
, IFLA_LINKINFO
);
483 err
= addattr_l(nlh
, reqlen
, IFLA_INFO_KIND
, vrf_filter
.kind
,
484 strlen(vrf_filter
.kind
));
488 addattr_nest_end(nlh
, linkinfo
);
494 /* input arg is linkinfo */
495 static __u32
vrf_table_linkinfo(struct rtattr
*li
[])
497 struct rtattr
*attr
[IFLA_VRF_MAX
+ 1];
499 if (li
[IFLA_INFO_DATA
]) {
500 parse_rtattr_nested(attr
, IFLA_VRF_MAX
, li
[IFLA_INFO_DATA
]);
502 if (attr
[IFLA_VRF_TABLE
])
503 return rta_getattr_u32(attr
[IFLA_VRF_TABLE
]);
509 static int ipvrf_print(struct nlmsghdr
*n
)
511 struct ifinfomsg
*ifi
= NLMSG_DATA(n
);
512 struct rtattr
*tb
[IFLA_MAX
+1];
513 struct rtattr
*li
[IFLA_INFO_MAX
+1];
514 int len
= n
->nlmsg_len
;
518 len
-= NLMSG_LENGTH(sizeof(*ifi
));
522 if (vrf_filter
.ifindex
&& vrf_filter
.ifindex
!= ifi
->ifi_index
)
525 parse_rtattr(tb
, IFLA_MAX
, IFLA_RTA(ifi
), len
);
527 /* kernel does not support filter by master device */
528 if (tb
[IFLA_MASTER
]) {
529 int master
= *(int *)RTA_DATA(tb
[IFLA_MASTER
]);
531 if (vrf_filter
.master
&& master
!= vrf_filter
.master
)
535 if (!tb
[IFLA_IFNAME
]) {
537 "BUG: device with ifindex %d has nil ifname\n",
541 name
= rta_getattr_str(tb
[IFLA_IFNAME
]);
543 /* missing LINKINFO means not VRF. e.g., kernel does not
544 * support filtering on kind, so userspace needs to handle
546 if (!tb
[IFLA_LINKINFO
])
549 parse_rtattr_nested(li
, IFLA_INFO_MAX
, tb
[IFLA_LINKINFO
]);
551 if (!li
[IFLA_INFO_KIND
])
554 if (strcmp(RTA_DATA(li
[IFLA_INFO_KIND
]), "vrf"))
557 tb_id
= vrf_table_linkinfo(li
);
560 "BUG: VRF %s is missing table id\n", name
);
564 printf("%-16s %5u", name
, tb_id
);
570 static int ipvrf_show(int argc
, char **argv
)
572 struct nlmsg_chain linfo
= { NULL
, NULL
};
575 vrf_filter
.kind
= "vrf";
583 tb_id
= ipvrf_get_table(argv
[0]);
585 fprintf(stderr
, "Invalid VRF\n");
588 printf("%s %u\n", argv
[0], tb_id
);
592 if (ip_link_list(ipvrf_filter_req
, &linfo
) == 0) {
593 struct nlmsg_list
*l
;
597 n
= printf("%-16s %5s\n", "Name", "Table");
598 printf("%.*s\n", n
-1, "-----------------------");
599 for (l
= linfo
.head
; l
; l
= l
->next
)
600 nvrf
+= ipvrf_print(&l
->h
);
603 printf("No VRF has been configured\n");
607 free_nlmsg_chain(&linfo
);
612 int do_ipvrf(int argc
, char **argv
)
615 return ipvrf_show(0, NULL
);
617 if (matches(*argv
, "identify") == 0)
618 return ipvrf_identify(argc
-1, argv
+1);
620 if (matches(*argv
, "pids") == 0)
621 return ipvrf_pids(argc
-1, argv
+1);
623 if (matches(*argv
, "exec") == 0)
624 return ipvrf_exec(argc
-1, argv
+1);
626 if (matches(*argv
, "show") == 0 ||
627 matches(*argv
, "lst") == 0 ||
628 matches(*argv
, "list") == 0)
629 return ipvrf_show(argc
-1, argv
+1);
631 if (matches(*argv
, "help") == 0)
634 fprintf(stderr
, "Command \"%s\" is unknown, try \"ip vrf help\".\n",