zebra/zebra_pbr.h

   1 /*
   2  * Zebra Policy Based Routing (PBR) Data structures and definitions
   3  * These are public definitions referenced by multiple files.
   4  * Copyright (C) 2018 Cumulus Networks, Inc.
   5  *
   6  * This file is part of FRR.
   7  *
   8  * FRR is free software; you can redistribute it and/or modify it
   9  * under the terms of the GNU General Public License as published by the
  10  * Free Software Foundation; either version 2, or (at your option) any
  11  * later version.
  12  *
  13  * FRR is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with FRR; see the file COPYING.  If not, write to the Free
  20  * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
  21  * 02111-1307, USA.
  22  */
  23
  24 #ifndef _ZEBRA_PBR_H
  25 #define _ZEBRA_PBR_H
  26
  27 #include <zebra.h>
  28
  29 #include "prefix.h"
  30 #include "if.h"
  31
  32 #include "rt.h"
  33 #include "pbr.h"
  34
  35 #ifdef __cplusplus
  36 extern "C" {
  37 #endif
  38
  39 /* Memory type for PBR objects. */
  40 DECLARE_MTYPE(PBR_OBJ);
  41
  42 struct zebra_pbr_action {
  43         afi_t afi;
  44
  45         /* currently only one nexthop is supported */
  46         union g_addr gate;
  47
  48         /* dest-interface */
  49         ifindex_t ifindex;
  50
  51         /* dataplane info */
  52         intptr_t dp_flow_ptr;
  53
  54         /* neigh */
  55         struct zebra_neigh_ent *neigh;
  56         /* zebra_pbr_rule is linked to neigh via neigh_listnode */
  57         struct listnode neigh_listnode;
  58 };
  59
  60 struct zebra_pbr_rule {
  61         int sock;
  62
  63         struct pbr_rule rule;
  64
  65         char ifname[INTERFACE_NAMSIZ];
  66
  67         struct zebra_pbr_action action;
  68
  69         vrf_id_t vrf_id;
  70 };
  71
  72 #define IS_RULE_FILTERING_ON_SRC_IP(r) \
  73         (r->rule.filter.filter_bm & PBR_FILTER_SRC_IP)
  74 #define IS_RULE_FILTERING_ON_DST_IP(r) \
  75         (r->rule.filter.filter_bm & PBR_FILTER_DST_IP)
  76 #define IS_RULE_FILTERING_ON_SRC_PORT(r) \
  77         (r->rule.filter.filter_bm & PBR_FILTER_SRC_PORT)
  78 #define IS_RULE_FILTERING_ON_DST_PORT(r) \
  79         (r->rule.filter.filter_bm & PBR_FILTER_DST_PORT)
  80 #define IS_RULE_FILTERING_ON_DSFIELD(r) \
  81         (r->rule.filter.filter_bm & PBR_FILTER_DSFIELD)
  82 #define IS_RULE_FILTERING_ON_FWMARK(r) \
  83         (r->rule.filter.filter_bm & PBR_FILTER_FWMARK)
  84
  85 /*
  86  * An IPSet Entry Filter
  87  *
  88  * This is a filter mapped on ipset entries
  89  */
  90 struct zebra_pbr_ipset_info {
  91         /* type is encoded as uint32_t
  92          * but value is an enum ipset_type
  93          */
  94         uint32_t type;
  95
  96         uint8_t family;
  97
  98         char ipset_name[ZEBRA_IPSET_NAME_SIZE];
  99 };
 100
 101 struct zebra_pbr_ipset {
 102         /*
 103          * Originating zclient sock fd, so we can know who to send
 104          * back to.
 105          */
 106         int sock;
 107
 108         vrf_id_t vrf_id;
 109
 110         uint32_t unique;
 111
 112         /* type is encoded as uint32_t
 113          * but value is an enum ipset_type
 114          */
 115         uint32_t type;
 116
 117         uint8_t family;
 118
 119         char ipset_name[ZEBRA_IPSET_NAME_SIZE];
 120 };
 121
 122
 123 /*
 124  * An IPSet Entry Filter
 125  *
 126  * This is a filter mapped on ipset entries
 127  */
 128 struct zebra_pbr_ipset_entry {
 129         /*
 130          * Originating zclient sock fd, so we can know who to send
 131          * back to.
 132          */
 133         int sock;
 134
 135         uint32_t unique;
 136
 137         struct prefix src;
 138         struct prefix dst;
 139
 140         /* udp/tcp src port or icmp type */
 141         uint16_t src_port_min;
 142         uint16_t src_port_max;
 143         /* udp/tcp dst port or icmp code */
 144         uint16_t dst_port_min;
 145         uint16_t dst_port_max;
 146
 147         uint8_t proto;
 148
 149         uint32_t filter_bm;
 150
 151         struct zebra_pbr_ipset *backpointer;
 152 };
 153
 154 /*
 155  * An IPTables Action
 156  *
 157  * This is a filter mapped on ipset entries
 158  */
 159 struct zebra_pbr_iptable {
 160         /*
 161          * Originating zclient sock fd, so we can know who to send
 162          * back to.
 163          */
 164         int sock;
 165
 166         vrf_id_t vrf_id;
 167
 168         uint32_t unique;
 169
 170         /* include ipset type
 171          */
 172         uint32_t type;
 173
 174         /* include which IP is to be filtered
 175          */
 176         uint32_t filter_bm;
 177
 178         uint32_t fwmark;
 179
 180         uint32_t action;
 181
 182         uint16_t pkt_len_min;
 183         uint16_t pkt_len_max;
 184         uint16_t tcp_flags;
 185         uint16_t tcp_mask_flags;
 186         uint8_t dscp_value;
 187         uint8_t fragment;
 188         uint8_t protocol;
 189
 190         uint32_t nb_interface;
 191         uint16_t flow_label;
 192
 193         uint8_t family;
 194
 195         struct list *interface_name_list;
 196
 197 #define IPTABLE_INSTALL_QUEUED 1 << 1
 198 #define IPTABLE_UNINSTALL_QUEUED 1 << 2
 199         uint8_t internal_flags;
 200         char ipset_name[ZEBRA_IPSET_NAME_SIZE];
 201 };
 202
 203 extern const struct message icmp_typecode_str[];
 204 extern const struct message icmpv6_typecode_str[];
 205
 206 const char *zebra_pbr_ipset_type2str(uint32_t type);
 207
 208 void zebra_pbr_add_rule(struct zebra_pbr_rule *rule);
 209 void zebra_pbr_del_rule(struct zebra_pbr_rule *rule);
 210 void zebra_pbr_create_ipset(struct zebra_pbr_ipset *ipset);
 211 void zebra_pbr_destroy_ipset(struct zebra_pbr_ipset *ipset);
 212 struct zebra_pbr_ipset *zebra_pbr_lookup_ipset_pername(char *ipsetname);
 213 void zebra_pbr_add_ipset_entry(struct zebra_pbr_ipset_entry *ipset);
 214 void zebra_pbr_del_ipset_entry(struct zebra_pbr_ipset_entry *ipset);
 215
 216 void zebra_pbr_add_iptable(struct zebra_pbr_iptable *iptable);
 217 void zebra_pbr_del_iptable(struct zebra_pbr_iptable *iptable);
 218 void zebra_pbr_process_iptable(struct zebra_dplane_ctx *ctx);
 219 void zebra_pbr_process_ipset(struct zebra_dplane_ctx *ctx);
 220 void zebra_pbr_process_ipset_entry(struct zebra_dplane_ctx *ctx);
 221
 222 /*
 223  * Get to know existing PBR rules in the kernel - typically called at startup.
 224  */
 225 extern void kernel_read_pbr_rules(struct zebra_ns *zns);
 226
 227 /*
 228  * Handle success or failure of rule (un)install in the kernel.
 229  */
 230 extern void zebra_pbr_dplane_result(struct zebra_dplane_ctx *ctx);
 231
 232 /*
 233  * Handle success or failure of ipset kinds (un)install in the kernel.
 234  */
 235 extern void kernel_pbr_ipset_add_del_status(struct zebra_pbr_ipset *ipset,
 236                                            enum zebra_dplane_status res);
 237
 238 extern void kernel_pbr_ipset_entry_add_del_status(
 239                                 struct zebra_pbr_ipset_entry *ipset,
 240                                 enum zebra_dplane_status res);
 241
 242 /*
 243  * Handle rule delete notification from kernel.
 244  */
 245 extern int kernel_pbr_rule_del(struct zebra_pbr_rule *rule);
 246
 247 extern void zebra_pbr_rules_free(void *arg);
 248 extern uint32_t zebra_pbr_rules_hash_key(const void *arg);
 249 extern bool zebra_pbr_rules_hash_equal(const void *arg1, const void *arg2);
 250
 251 /* has operates on 32bit pointer
 252  * and field is a string of 8bit
 253  */
 254 #define ZEBRA_IPSET_NAME_HASH_SIZE (ZEBRA_IPSET_NAME_SIZE / 4)
 255
 256 extern void zebra_pbr_ipset_free(void *arg);
 257 extern uint32_t zebra_pbr_ipset_hash_key(const void *arg);
 258 extern bool zebra_pbr_ipset_hash_equal(const void *arg1, const void *arg2);
 259
 260 extern void zebra_pbr_ipset_entry_free(void *arg);
 261 extern uint32_t zebra_pbr_ipset_entry_hash_key(const void *arg);
 262 extern bool zebra_pbr_ipset_entry_hash_equal(const void *arg1,
 263                                              const void *arg2);
 264
 265 extern void zebra_pbr_iptable_free(void *arg);
 266 extern uint32_t zebra_pbr_iptable_hash_key(const void *arg);
 267 extern bool zebra_pbr_iptable_hash_equal(const void *arg1, const void *arg2);
 268
 269 extern void zebra_pbr_config_write(struct vty *vty);
 270 extern void zebra_pbr_expand_action_update(bool enable);
 271 extern void zebra_pbr_init(void);
 272 extern void zebra_pbr_show_ipset_list(struct vty *vty, char *ipsetname);
 273 extern void zebra_pbr_show_iptable(struct vty *vty, char *iptable);
 274 extern void zebra_pbr_iptable_update_interfacelist(struct stream *s,
 275                                    struct zebra_pbr_iptable *zpi);
 276 size_t zebra_pbr_tcpflags_snprintf(char *buffer, size_t len,
 277                                    uint16_t tcp_val);
 278 extern void zebra_pbr_show_rule(struct vty *vty);
 279 extern void zebra_pbr_show_rule_unit(struct zebra_pbr_rule *rule,
 280                                      struct vty *vty);
 281
 282 DECLARE_HOOK(zebra_pbr_ipset_entry_get_stat,
 283              (struct zebra_pbr_ipset_entry *ipset, uint64_t *pkts,
 284               uint64_t *bytes),
 285              (ipset, pkts, bytes));
 286 DECLARE_HOOK(zebra_pbr_iptable_get_stat,
 287              (struct zebra_pbr_iptable *iptable, uint64_t *pkts,
 288               uint64_t *bytes),
 289              (iptable, pkts, bytes));
 290 DECLARE_HOOK(zebra_pbr_iptable_update,
 291              (int cmd, struct zebra_pbr_iptable *iptable), (cmd, iptable));
 292
 293 DECLARE_HOOK(zebra_pbr_ipset_entry_update,
 294              (int cmd, struct zebra_pbr_ipset_entry *ipset), (cmd, ipset));
 295 DECLARE_HOOK(zebra_pbr_ipset_update,
 296              (int cmd, struct zebra_pbr_ipset *ipset), (cmd, ipset));
 297
 298 #ifdef __cplusplus
 299 }
 300 #endif
 301
 302 #endif /* _ZEBRA_PBR_H */