2 * Zebra Policy Based Routing (PBR) interaction with the kernel using
4 * Copyright (C) 2018 Cumulus Networks, Inc.
6 * This file is part of FRR.
8 * FRR is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the
10 * Free Software Foundation; either version 2, or (at your option) any
13 * FRR is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with FRR; see the file COPYING. If not, write to the Free
20 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
32 #include <linux/fib_rules.h>
33 #include "zebra/zserv.h"
34 #include "zebra/zebra_ns.h"
35 #include "zebra/zebra_vrf.h"
37 #include "zebra/interface.h"
38 #include "zebra/debug.h"
39 #include "zebra/rtadv.h"
40 #include "zebra/kernel_netlink.h"
41 #include "zebra/rule_netlink.h"
42 #include "zebra/zebra_pbr.h"
46 /* static function declarations */
48 /* Private functions */
50 /* Install or uninstall specified rule for a specific interface.
51 * Form netlink message and ship it. Currently, notify status after
52 * waiting for netlink status.
54 static int netlink_rule_update(int cmd
, struct zebra_pbr_rule
*rule
)
60 struct fib_rule_hdr frh
;
61 char buf
[NL_PKT_BUF_SIZE
];
63 struct zebra_ns
*zns
= zebra_ns_lookup(NS_DEFAULT
);
64 struct sockaddr_nl snl
;
65 char buf1
[PREFIX_STRLEN
];
66 char buf2
[PREFIX_STRLEN
];
68 memset(&req
, 0, sizeof(req
) - NL_PKT_BUF_SIZE
);
69 family
= PREFIX_FAMILY(&rule
->rule
.filter
.src_ip
);
70 bytelen
= (family
== AF_INET
? 4 : 16);
72 req
.n
.nlmsg_type
= cmd
;
73 req
.n
.nlmsg_len
= NLMSG_LENGTH(sizeof(struct rtmsg
));
74 req
.n
.nlmsg_flags
= NLM_F_REQUEST
;
75 req
.n
.nlmsg_pid
= zns
->netlink_cmd
.snl
.nl_pid
;
77 req
.frh
.family
= family
;
78 req
.frh
.action
= FR_ACT_TO_TBL
;
81 addattr32(&req
.n
, sizeof(req
), FRA_PRIORITY
, rule
->rule
.priority
);
83 /* interface on which applied */
85 addattr_l(&req
.n
, sizeof(req
), FRA_IFNAME
, rule
->ifp
->name
,
86 strlen(rule
->ifp
->name
) + 1);
88 /* source IP, if specified */
89 if (IS_RULE_FILTERING_ON_SRC_IP(rule
)) {
90 req
.frh
.src_len
= rule
->rule
.filter
.src_ip
.prefixlen
;
91 addattr_l(&req
.n
, sizeof(req
), FRA_SRC
,
92 &rule
->rule
.filter
.src_ip
.u
.prefix
, bytelen
);
94 /* destination IP, if specified */
95 if (IS_RULE_FILTERING_ON_DST_IP(rule
)) {
96 req
.frh
.dst_len
= rule
->rule
.filter
.dst_ip
.prefixlen
;
97 addattr_l(&req
.n
, sizeof(req
), FRA_DST
,
98 &rule
->rule
.filter
.dst_ip
.u
.prefix
, bytelen
);
101 /* fwmark, if specified */
102 if (IS_RULE_FILTERING_ON_FWMARK(rule
)) {
103 addattr32(&req
.n
, sizeof(req
), FRA_FWMARK
,
104 rule
->rule
.filter
.fwmark
);
107 /* Route table to use to forward, if filter criteria matches. */
108 if (rule
->rule
.action
.table
< 256)
109 req
.frh
.table
= rule
->rule
.action
.table
;
111 req
.frh
.table
= RT_TABLE_UNSPEC
;
112 addattr32(&req
.n
, sizeof(req
), FRA_TABLE
,
113 rule
->rule
.action
.table
);
116 if (IS_ZEBRA_DEBUG_KERNEL
)
118 "Tx %s family %s IF %s(%u) Pref %u Src %s Dst %s Table %u",
119 nl_msg_type_to_str(cmd
), nl_family_to_str(family
),
120 rule
->ifp
? rule
->ifp
->name
: "Unknown",
121 rule
->ifp
? rule
->ifp
->ifindex
: 0, rule
->rule
.priority
,
122 prefix2str(&rule
->rule
.filter
.src_ip
, buf1
,
124 prefix2str(&rule
->rule
.filter
.dst_ip
, buf2
,
126 rule
->rule
.action
.table
);
128 /* Ship off the message.
129 * Note: Currently, netlink_talk() is a blocking call which returns
132 memset(&snl
, 0, sizeof(snl
));
133 snl
.nl_family
= AF_NETLINK
;
134 return netlink_talk(netlink_talk_filter
, &req
.n
,
135 &zns
->netlink_cmd
, zns
, 0);
139 /* Public functions */
141 * Install specified rule for a specific interface. The preference is what
142 * goes in the rule to denote relative ordering; it may or may not be the
143 * same as the rule's user-defined sequence number.
145 void kernel_add_pbr_rule(struct zebra_pbr_rule
*rule
)
149 ret
= netlink_rule_update(RTM_NEWRULE
, rule
);
150 kernel_pbr_rule_add_del_status(rule
,
151 (!ret
) ? SOUTHBOUND_INSTALL_SUCCESS
152 : SOUTHBOUND_INSTALL_FAILURE
);
156 * Uninstall specified rule for a specific interface.
158 void kernel_del_pbr_rule(struct zebra_pbr_rule
*rule
)
162 ret
= netlink_rule_update(RTM_DELRULE
, rule
);
163 kernel_pbr_rule_add_del_status(rule
,
164 (!ret
) ? SOUTHBOUND_DELETE_SUCCESS
165 : SOUTHBOUND_DELETE_FAILURE
);
169 * Handle netlink notification informing a rule add or delete.
170 * Handling of an ADD is TBD.
171 * DELs are notified up, if other attributes indicate it may be a
172 * notification of interest. The expectation is that if this corresponds
173 * to a PBR rule added by FRR, it will be readded.
175 int netlink_rule_change(struct nlmsghdr
*h
, ns_id_t ns_id
, int startup
)
177 struct zebra_ns
*zns
;
178 struct fib_rule_hdr
*frh
;
179 struct rtattr
*tb
[FRA_MAX
+ 1];
182 struct zebra_pbr_rule rule
;
183 char buf1
[PREFIX_STRLEN
];
184 char buf2
[PREFIX_STRLEN
];
186 /* Basic validation followed by extracting attributes. */
187 if (h
->nlmsg_type
!= RTM_NEWRULE
&& h
->nlmsg_type
!= RTM_DELRULE
)
191 if (h
->nlmsg_type
== RTM_NEWRULE
)
194 len
= h
->nlmsg_len
- NLMSG_LENGTH(sizeof(struct fib_rule_hdr
));
199 if (frh
->family
!= AF_INET
&& frh
->family
!= AF_INET6
)
201 if (frh
->action
!= FR_ACT_TO_TBL
)
204 memset(tb
, 0, sizeof(tb
));
205 netlink_parse_rtattr(tb
, FRA_MAX
, RTM_RTA(frh
), len
);
207 /* TBD: We don't care about rules not specifying an IIF. */
208 if (tb
[FRA_IFNAME
] == NULL
)
211 /* If we don't know the interface, we don't care. */
212 ifname
= (char *)RTA_DATA(tb
[FRA_IFNAME
]);
213 zns
= zebra_ns_lookup(ns_id
);
214 rule
.ifp
= if_lookup_by_name_per_ns(zns
, ifname
);
218 memset(&rule
, 0, sizeof(rule
));
219 if (tb
[FRA_PRIORITY
])
220 rule
.rule
.priority
= *(uint32_t *)RTA_DATA(tb
[FRA_PRIORITY
]);
223 if (frh
->family
== AF_INET
)
224 memcpy(&rule
.rule
.filter
.src_ip
.u
.prefix4
,
225 RTA_DATA(tb
[FRA_SRC
]), 4);
227 memcpy(&rule
.rule
.filter
.src_ip
.u
.prefix6
,
228 RTA_DATA(tb
[FRA_SRC
]), 16);
229 rule
.rule
.filter
.src_ip
.prefixlen
= frh
->src_len
;
230 rule
.rule
.filter
.filter_bm
|= PBR_FILTER_SRC_IP
;
234 if (frh
->family
== AF_INET
)
235 memcpy(&rule
.rule
.filter
.dst_ip
.u
.prefix4
,
236 RTA_DATA(tb
[FRA_DST
]), 4);
238 memcpy(&rule
.rule
.filter
.dst_ip
.u
.prefix6
,
239 RTA_DATA(tb
[FRA_DST
]), 16);
240 rule
.rule
.filter
.dst_ip
.prefixlen
= frh
->dst_len
;
241 rule
.rule
.filter
.filter_bm
|= PBR_FILTER_DST_IP
;
245 rule
.rule
.action
.table
= *(uint32_t *)RTA_DATA(tb
[FRA_TABLE
]);
247 rule
.rule
.action
.table
= frh
->table
;
249 if (IS_ZEBRA_DEBUG_KERNEL
)
251 "Rx %s family %s IF %s(%u) Pref %u Src %s Dst %s Table %u",
252 nl_msg_type_to_str(h
->nlmsg_type
),
253 nl_family_to_str(frh
->family
), rule
.ifp
->name
,
254 rule
.ifp
->ifindex
, rule
.rule
.priority
,
255 prefix2str(&rule
.rule
.filter
.src_ip
, buf1
,
257 prefix2str(&rule
.rule
.filter
.dst_ip
, buf2
,
259 rule
.rule
.action
.table
);
261 return kernel_pbr_rule_del(&rule
);
265 * Get to know existing PBR rules in the kernel - typically called at startup.
268 int netlink_rules_read(struct zebra_ns
*zns
)
273 #endif /* HAVE_NETLINK */