zebra/zebra_pbr.h

   1 /*
   2  * Zebra Policy Based Routing (PBR) Data structures and definitions
   3  * These are public definitions referenced by multiple files.
   4  * Copyright (C) 2018 Cumulus Networks, Inc.
   5  *
   6  * This file is part of FRR.
   7  *
   8  * FRR is free software; you can redistribute it and/or modify it
   9  * under the terms of the GNU General Public License as published by the
  10  * Free Software Foundation; either version 2, or (at your option) any
  11  * later version.
  12  *
  13  * FRR is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with FRR; see the file COPYING.  If not, write to the Free
  20  * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
  21  * 02111-1307, USA.
  22  */
  23
  24 #ifndef _ZEBRA_PBR_H
  25 #define _ZEBRA_PBR_H
  26
  27 #include <zebra.h>
  28
  29 #include "prefix.h"
  30 #include "if.h"
  31
  32 #include "rt.h"
  33 #include "pbr.h"
  34
  35 #ifdef __cplusplus
  36 extern "C" {
  37 #endif
  38
  39 struct zebra_pbr_rule {
  40         int sock;
  41
  42         struct pbr_rule rule;
  43
  44         char ifname[INTERFACE_NAMSIZ];
  45
  46         vrf_id_t vrf_id;
  47 };
  48
  49 #define IS_RULE_FILTERING_ON_SRC_IP(r) \
  50         (r->rule.filter.filter_bm & PBR_FILTER_SRC_IP)
  51 #define IS_RULE_FILTERING_ON_DST_IP(r) \
  52         (r->rule.filter.filter_bm & PBR_FILTER_DST_IP)
  53 #define IS_RULE_FILTERING_ON_SRC_PORT(r) \
  54         (r->rule.filter.filter_bm & PBR_FILTER_SRC_PORT)
  55 #define IS_RULE_FILTERING_ON_DST_PORT(r) \
  56         (r->rule.filter.filter_bm & PBR_FILTER_DST_PORT)
  57 #define IS_RULE_FILTERING_ON_DSFIELD(r) \
  58         (r->rule.filter.filter_bm & PBR_FILTER_DSFIELD)
  59 #define IS_RULE_FILTERING_ON_FWMARK(r) \
  60         (r->rule.filter.filter_bm & PBR_FILTER_FWMARK)
  61
  62 /*
  63  * An IPSet Entry Filter
  64  *
  65  * This is a filter mapped on ipset entries
  66  */
  67 struct zebra_pbr_ipset_info {
  68         /* type is encoded as uint32_t
  69          * but value is an enum ipset_type
  70          */
  71         uint32_t type;
  72
  73         uint8_t family;
  74
  75         char ipset_name[ZEBRA_IPSET_NAME_SIZE];
  76 };
  77
  78 struct zebra_pbr_ipset {
  79         /*
  80          * Originating zclient sock fd, so we can know who to send
  81          * back to.
  82          */
  83         int sock;
  84
  85         vrf_id_t vrf_id;
  86
  87         uint32_t unique;
  88
  89         /* type is encoded as uint32_t
  90          * but value is an enum ipset_type
  91          */
  92         uint32_t type;
  93
  94         uint8_t family;
  95
  96         char ipset_name[ZEBRA_IPSET_NAME_SIZE];
  97 };
  98
  99
 100 /*
 101  * An IPSet Entry Filter
 102  *
 103  * This is a filter mapped on ipset entries
 104  */
 105 struct zebra_pbr_ipset_entry {
 106         /*
 107          * Originating zclient sock fd, so we can know who to send
 108          * back to.
 109          */
 110         int sock;
 111
 112         uint32_t unique;
 113
 114         struct prefix src;
 115         struct prefix dst;
 116
 117         /* udp/tcp src port or icmp type */
 118         uint16_t src_port_min;
 119         uint16_t src_port_max;
 120         /* udp/tcp dst port or icmp code */
 121         uint16_t dst_port_min;
 122         uint16_t dst_port_max;
 123
 124         uint8_t proto;
 125
 126         uint32_t filter_bm;
 127
 128         struct zebra_pbr_ipset *backpointer;
 129 };
 130
 131 /*
 132  * An IPTables Action
 133  *
 134  * This is a filter mapped on ipset entries
 135  */
 136 struct zebra_pbr_iptable {
 137         /*
 138          * Originating zclient sock fd, so we can know who to send
 139          * back to.
 140          */
 141         int sock;
 142
 143         vrf_id_t vrf_id;
 144
 145         uint32_t unique;
 146
 147         /* include ipset type
 148          */
 149         uint32_t type;
 150
 151         /* include which IP is to be filtered
 152          */
 153         uint32_t filter_bm;
 154
 155         uint32_t fwmark;
 156
 157         uint32_t action;
 158
 159         uint16_t pkt_len_min;
 160         uint16_t pkt_len_max;
 161         uint16_t tcp_flags;
 162         uint16_t tcp_mask_flags;
 163         uint8_t dscp_value;
 164         uint8_t fragment;
 165         uint8_t protocol;
 166
 167         uint32_t nb_interface;
 168         uint16_t flow_label;
 169
 170         uint8_t family;
 171
 172         struct list *interface_name_list;
 173
 174         char ipset_name[ZEBRA_IPSET_NAME_SIZE];
 175 };
 176
 177 extern const struct message icmp_typecode_str[];
 178 extern const struct message icmpv6_typecode_str[];
 179
 180 const char *zebra_pbr_ipset_type2str(uint32_t type);
 181
 182 void zebra_pbr_add_rule(struct zebra_pbr_rule *rule);
 183 void zebra_pbr_del_rule(struct zebra_pbr_rule *rule);
 184 void zebra_pbr_create_ipset(struct zebra_pbr_ipset *ipset);
 185 void zebra_pbr_destroy_ipset(struct zebra_pbr_ipset *ipset);
 186 struct zebra_pbr_ipset *zebra_pbr_lookup_ipset_pername(char *ipsetname);
 187 void zebra_pbr_add_ipset_entry(struct zebra_pbr_ipset_entry *ipset);
 188 void zebra_pbr_del_ipset_entry(struct zebra_pbr_ipset_entry *ipset);
 189
 190 void zebra_pbr_add_iptable(struct zebra_pbr_iptable *iptable);
 191 void zebra_pbr_del_iptable(struct zebra_pbr_iptable *iptable);
 192 void zebra_pbr_process_iptable(struct zebra_dplane_ctx *ctx);
 193 void zebra_pbr_process_ipset(struct zebra_dplane_ctx *ctx);
 194 void zebra_pbr_process_ipset_entry(struct zebra_dplane_ctx *ctx);
 195
 196 /*
 197  * Get to know existing PBR rules in the kernel - typically called at startup.
 198  */
 199 extern void kernel_read_pbr_rules(struct zebra_ns *zns);
 200
 201 /*
 202  * Handle success or failure of rule (un)install in the kernel.
 203  */
 204 extern void zebra_pbr_dplane_result(struct zebra_dplane_ctx *ctx);
 205
 206 /*
 207  * Handle success or failure of ipset kinds (un)install in the kernel.
 208  */
 209 extern void kernel_pbr_ipset_add_del_status(struct zebra_pbr_ipset *ipset,
 210                                            enum zebra_dplane_status res);
 211
 212 extern void kernel_pbr_ipset_entry_add_del_status(
 213                                 struct zebra_pbr_ipset_entry *ipset,
 214                                 enum zebra_dplane_status res);
 215
 216 /*
 217  * Handle rule delete notification from kernel.
 218  */
 219 extern int kernel_pbr_rule_del(struct zebra_pbr_rule *rule);
 220
 221 extern void zebra_pbr_rules_free(void *arg);
 222 extern uint32_t zebra_pbr_rules_hash_key(const void *arg);
 223 extern bool zebra_pbr_rules_hash_equal(const void *arg1, const void *arg2);
 224
 225 /* has operates on 32bit pointer
 226  * and field is a string of 8bit
 227  */
 228 #define ZEBRA_IPSET_NAME_HASH_SIZE (ZEBRA_IPSET_NAME_SIZE / 4)
 229
 230 extern void zebra_pbr_ipset_free(void *arg);
 231 extern uint32_t zebra_pbr_ipset_hash_key(const void *arg);
 232 extern bool zebra_pbr_ipset_hash_equal(const void *arg1, const void *arg2);
 233
 234 extern void zebra_pbr_ipset_entry_free(void *arg);
 235 extern uint32_t zebra_pbr_ipset_entry_hash_key(const void *arg);
 236 extern bool zebra_pbr_ipset_entry_hash_equal(const void *arg1,
 237                                              const void *arg2);
 238
 239 extern void zebra_pbr_iptable_free(void *arg);
 240 extern uint32_t zebra_pbr_iptable_hash_key(const void *arg);
 241 extern bool zebra_pbr_iptable_hash_equal(const void *arg1, const void *arg2);
 242
 243 extern void zebra_pbr_init(void);
 244 extern void zebra_pbr_show_ipset_list(struct vty *vty, char *ipsetname);
 245 extern void zebra_pbr_show_iptable(struct vty *vty, char *iptable);
 246 extern void zebra_pbr_iptable_update_interfacelist(struct stream *s,
 247                                    struct zebra_pbr_iptable *zpi);
 248 size_t zebra_pbr_tcpflags_snprintf(char *buffer, size_t len,
 249                                    uint16_t tcp_val);
 250
 251 DECLARE_HOOK(zebra_pbr_ipset_entry_get_stat,
 252              (struct zebra_pbr_ipset_entry *ipset, uint64_t *pkts,
 253               uint64_t *bytes),
 254              (ipset, pkts, bytes));
 255 DECLARE_HOOK(zebra_pbr_iptable_get_stat,
 256              (struct zebra_pbr_iptable *iptable, uint64_t *pkts,
 257               uint64_t *bytes),
 258              (iptable, pkts, bytes));
 259 DECLARE_HOOK(zebra_pbr_iptable_update,
 260              (int cmd, struct zebra_pbr_iptable *iptable), (cmd, iptable));
 261
 262 DECLARE_HOOK(zebra_pbr_ipset_entry_update,
 263              (int cmd, struct zebra_pbr_ipset_entry *ipset), (cmd, ipset));
 264 DECLARE_HOOK(zebra_pbr_ipset_update,
 265              (int cmd, struct zebra_pbr_ipset *ipset), (cmd, ipset));
 266
 267 #ifdef __cplusplus
 268 }
 269 #endif
 270
 271 #endif /* _ZEBRA_PBR_H */