zebra/zebra_pbr.h

   1 /*
   2  * Zebra Policy Based Routing (PBR) Data structures and definitions
   3  * These are public definitions referenced by multiple files.
   4  * Copyright (C) 2018 Cumulus Networks, Inc.
   5  *
   6  * This file is part of FRR.
   7  *
   8  * FRR is free software; you can redistribute it and/or modify it
   9  * under the terms of the GNU General Public License as published by the
  10  * Free Software Foundation; either version 2, or (at your option) any
  11  * later version.
  12  *
  13  * FRR is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with FRR; see the file COPYING.  If not, write to the Free
  20  * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
  21  * 02111-1307, USA.
  22  */
  23
  24 #ifndef _ZEBRA_PBR_H
  25 #define _ZEBRA_PBR_H
  26
  27 #include <zebra.h>
  28
  29 #include "prefix.h"
  30 #include "if.h"
  31
  32 #include "rt.h"
  33 #include "pbr.h"
  34
  35 #ifdef __cplusplus
  36 extern "C" {
  37 #endif
  38
  39 struct zebra_pbr_rule {
  40         int sock;
  41
  42         struct pbr_rule rule;
  43
  44         struct interface *ifp;
  45
  46         vrf_id_t vrf_id;
  47 };
  48
  49 #define IS_RULE_FILTERING_ON_SRC_IP(r) \
  50         (r->rule.filter.filter_bm & PBR_FILTER_SRC_IP)
  51 #define IS_RULE_FILTERING_ON_DST_IP(r) \
  52         (r->rule.filter.filter_bm & PBR_FILTER_DST_IP)
  53 #define IS_RULE_FILTERING_ON_SRC_PORT(r) \
  54         (r->rule.filter.filter_bm & PBR_FILTER_SRC_PORT)
  55 #define IS_RULE_FILTERING_ON_DST_PORT(r) \
  56         (r->rule.filter.filter_bm & PBR_FILTER_DST_PORT)
  57 #define IS_RULE_FILTERING_ON_FWMARK(r) \
  58         (r->rule.filter.filter_bm & PBR_FILTER_FWMARK)
  59
  60 /*
  61  * An IPSet Entry Filter
  62  *
  63  * This is a filter mapped on ipset entries
  64  */
  65 struct zebra_pbr_ipset {
  66         /*
  67          * Originating zclient sock fd, so we can know who to send
  68          * back to.
  69          */
  70         int sock;
  71
  72         vrf_id_t vrf_id;
  73
  74         uint32_t unique;
  75
  76         /* type is encoded as uint32_t
  77          * but value is an enum ipset_type
  78          */
  79         uint32_t type;
  80         char ipset_name[ZEBRA_IPSET_NAME_SIZE];
  81 };
  82
  83 /*
  84  * An IPSet Entry Filter
  85  *
  86  * This is a filter mapped on ipset entries
  87  */
  88 struct zebra_pbr_ipset_entry {
  89         /*
  90          * Originating zclient sock fd, so we can know who to send
  91          * back to.
  92          */
  93         int sock;
  94
  95         uint32_t unique;
  96
  97         struct prefix src;
  98         struct prefix dst;
  99
 100         /* udp/tcp src port or icmp type */
 101         uint16_t src_port_min;
 102         uint16_t src_port_max;
 103         /* udp/tcp dst port or icmp code */
 104         uint16_t dst_port_min;
 105         uint16_t dst_port_max;
 106
 107         uint8_t proto;
 108
 109         uint32_t filter_bm;
 110
 111         struct zebra_pbr_ipset *backpointer;
 112 };
 113
 114 /*
 115  * An IPTables Action
 116  *
 117  * This is a filter mapped on ipset entries
 118  */
 119 struct zebra_pbr_iptable {
 120         /*
 121          * Originating zclient sock fd, so we can know who to send
 122          * back to.
 123          */
 124         int sock;
 125
 126         vrf_id_t vrf_id;
 127
 128         uint32_t unique;
 129
 130         /* include ipset type
 131          */
 132         uint32_t type;
 133
 134         /* include which IP is to be filtered
 135          */
 136         uint32_t filter_bm;
 137
 138         uint32_t fwmark;
 139
 140         uint32_t action;
 141
 142         uint16_t pkt_len_min;
 143         uint16_t pkt_len_max;
 144         uint16_t tcp_flags;
 145         uint16_t tcp_mask_flags;
 146         uint8_t dscp_value;
 147         uint8_t fragment;
 148
 149         uint32_t nb_interface;
 150
 151         struct list *interface_name_list;
 152
 153         char ipset_name[ZEBRA_IPSET_NAME_SIZE];
 154 };
 155
 156 extern const struct message icmp_typecode_str[];
 157
 158 const char *zebra_pbr_ipset_type2str(uint32_t type);
 159
 160 void zebra_pbr_add_rule(struct zebra_pbr_rule *rule);
 161 void zebra_pbr_del_rule(struct zebra_pbr_rule *rule);
 162 void zebra_pbr_create_ipset(struct zebra_pbr_ipset *ipset);
 163 void zebra_pbr_destroy_ipset(struct zebra_pbr_ipset *ipset);
 164 struct zebra_pbr_ipset *zebra_pbr_lookup_ipset_pername(char *ipsetname);
 165 void zebra_pbr_add_ipset_entry(struct zebra_pbr_ipset_entry *ipset);
 166 void zebra_pbr_del_ipset_entry(struct zebra_pbr_ipset_entry *ipset);
 167
 168 void zebra_pbr_add_iptable(struct zebra_pbr_iptable *iptable);
 169 void zebra_pbr_del_iptable(struct zebra_pbr_iptable *iptable);
 170
 171 /*
 172  * Install specified rule for a specific interface.
 173  * It is possible that the user-defined sequence number and the one in the
 174  * forwarding plane may not coincide, hence the API requires a separate
 175  * rule priority - maps to preference/FRA_PRIORITY on Linux.
 176  */
 177 extern enum zebra_dplane_result kernel_add_pbr_rule(struct zebra_pbr_rule *rule);
 178
 179 /*
 180  * Uninstall specified rule for a specific interface.
 181  */
 182 extern enum zebra_dplane_result kernel_del_pbr_rule(struct zebra_pbr_rule *rule);
 183
 184 /*
 185  * Get to know existing PBR rules in the kernel - typically called at startup.
 186  */
 187 extern void kernel_read_pbr_rules(struct zebra_ns *zns);
 188
 189 /*
 190  * Handle success or failure of rule (un)install in the kernel.
 191  */
 192 extern void kernel_pbr_rule_add_del_status(struct zebra_pbr_rule *rule,
 193                                            enum zebra_dplane_status res);
 194
 195 /*
 196  * Handle success or failure of ipset kinds (un)install in the kernel.
 197  */
 198 extern void kernel_pbr_ipset_add_del_status(struct zebra_pbr_ipset *ipset,
 199                                            enum zebra_dplane_status res);
 200
 201 extern void kernel_pbr_ipset_entry_add_del_status(
 202                                 struct zebra_pbr_ipset_entry *ipset,
 203                                 enum zebra_dplane_status res);
 204
 205 extern void kernel_pbr_iptable_add_del_status(struct zebra_pbr_iptable *iptable,
 206                               enum zebra_dplane_status res);
 207
 208 /*
 209  * Handle rule delete notification from kernel.
 210  */
 211 extern int kernel_pbr_rule_del(struct zebra_pbr_rule *rule);
 212
 213 extern void zebra_pbr_rules_free(void *arg);
 214 extern uint32_t zebra_pbr_rules_hash_key(const void *arg);
 215 extern bool zebra_pbr_rules_hash_equal(const void *arg1, const void *arg2);
 216
 217 /* has operates on 32bit pointer
 218  * and field is a string of 8bit
 219  */
 220 #define ZEBRA_IPSET_NAME_HASH_SIZE (ZEBRA_IPSET_NAME_SIZE / 4)
 221
 222 extern void zebra_pbr_ipset_free(void *arg);
 223 extern uint32_t zebra_pbr_ipset_hash_key(const void *arg);
 224 extern bool zebra_pbr_ipset_hash_equal(const void *arg1, const void *arg2);
 225
 226 extern void zebra_pbr_ipset_entry_free(void *arg);
 227 extern uint32_t zebra_pbr_ipset_entry_hash_key(const void *arg);
 228 extern bool zebra_pbr_ipset_entry_hash_equal(const void *arg1,
 229                                              const void *arg2);
 230
 231 extern void zebra_pbr_iptable_free(void *arg);
 232 extern uint32_t zebra_pbr_iptable_hash_key(const void *arg);
 233 extern bool zebra_pbr_iptable_hash_equal(const void *arg1, const void *arg2);
 234
 235 extern void zebra_pbr_init(void);
 236 extern void zebra_pbr_show_ipset_list(struct vty *vty, char *ipsetname);
 237 extern void zebra_pbr_show_iptable(struct vty *vty, char *iptable);
 238 extern void zebra_pbr_iptable_update_interfacelist(struct stream *s,
 239                                    struct zebra_pbr_iptable *zpi);
 240 size_t zebra_pbr_tcpflags_snprintf(char *buffer, size_t len,
 241                                    uint16_t tcp_val);
 242
 243 DECLARE_HOOK(zebra_pbr_ipset_entry_get_stat,
 244              (struct zebra_pbr_ipset_entry *ipset, uint64_t *pkts,
 245               uint64_t *bytes),
 246              (ipset, pkts, bytes))
 247 DECLARE_HOOK(zebra_pbr_iptable_get_stat,
 248              (struct zebra_pbr_iptable *iptable, uint64_t *pkts,
 249               uint64_t *bytes),
 250              (iptable, pkts, bytes))
 251 DECLARE_HOOK(zebra_pbr_iptable_update,
 252              (int cmd, struct zebra_pbr_iptable *iptable), (cmd, iptable));
 253
 254 DECLARE_HOOK(zebra_pbr_ipset_entry_update,
 255              (int cmd, struct zebra_pbr_ipset_entry *ipset), (cmd, ipset));
 256 DECLARE_HOOK(zebra_pbr_ipset_update,
 257              (int cmd, struct zebra_pbr_ipset *ipset), (cmd, ipset));
 258
 259 #ifdef __cplusplus
 260 }
 261 #endif
 262
 263 #endif /* _ZEBRA_PBR_H */