zebra/zebra_pbr.h

   1 /*
   2  * Zebra Policy Based Routing (PBR) Data structures and definitions
   3  * These are public definitions referenced by multiple files.
   4  * Copyright (C) 2018 Cumulus Networks, Inc.
   5  *
   6  * This file is part of FRR.
   7  *
   8  * FRR is free software; you can redistribute it and/or modify it
   9  * under the terms of the GNU General Public License as published by the
  10  * Free Software Foundation; either version 2, or (at your option) any
  11  * later version.
  12  *
  13  * FRR is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with FRR; see the file COPYING.  If not, write to the Free
  20  * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
  21  * 02111-1307, USA.
  22  */
  23
  24 #ifndef _ZEBRA_PBR_H
  25 #define _ZEBRA_PBR_H
  26
  27 #include <zebra.h>
  28
  29 #include "prefix.h"
  30 #include "if.h"
  31
  32 #include "rt.h"
  33 #include "pbr.h"
  34
  35 struct zebra_pbr_rule {
  36         int sock;
  37
  38         struct pbr_rule rule;
  39
  40         struct interface *ifp;
  41 };
  42
  43 #define IS_RULE_FILTERING_ON_SRC_IP(r) \
  44         (r->rule.filter.filter_bm & PBR_FILTER_SRC_IP)
  45 #define IS_RULE_FILTERING_ON_DST_IP(r) \
  46         (r->rule.filter.filter_bm & PBR_FILTER_DST_IP)
  47 #define IS_RULE_FILTERING_ON_SRC_PORT(r) \
  48         (r->rule.filter.filter_bm & PBR_FILTER_SRC_PORT)
  49 #define IS_RULE_FILTERING_ON_DST_PORT(r) \
  50         (r->rule.filter.filter_bm & PBR_FILTER_DST_PORT)
  51 #define IS_RULE_FILTERING_ON_FWMARK(r) \
  52         (r->rule.filter.filter_bm & PBR_FILTER_FWMARK)
  53
  54 /*
  55  * An IPSet Entry Filter
  56  *
  57  * This is a filter mapped on ipset entries
  58  */
  59 struct zebra_pbr_ipset {
  60         /*
  61          * Originating zclient sock fd, so we can know who to send
  62          * back to.
  63          */
  64         int sock;
  65
  66         vrf_id_t vrf_id;
  67
  68         uint32_t unique;
  69
  70         /* type is encoded as uint32_t
  71          * but value is an enum ipset_type
  72          */
  73         uint32_t type;
  74         char ipset_name[ZEBRA_IPSET_NAME_SIZE];
  75 };
  76
  77 /*
  78  * An IPSet Entry Filter
  79  *
  80  * This is a filter mapped on ipset entries
  81  */
  82 struct zebra_pbr_ipset_entry {
  83         /*
  84          * Originating zclient sock fd, so we can know who to send
  85          * back to.
  86          */
  87         int sock;
  88
  89         uint32_t unique;
  90
  91         struct prefix src;
  92         struct prefix dst;
  93
  94         uint16_t src_port_min;
  95         uint16_t src_port_max;
  96         uint16_t dst_port_min;
  97         uint16_t dst_port_max;
  98
  99         uint8_t proto;
 100
 101         uint32_t filter_bm;
 102
 103         struct zebra_pbr_ipset *backpointer;
 104 };
 105
 106 /*
 107  * An IPTables Action
 108  *
 109  * This is a filter mapped on ipset entries
 110  */
 111 struct zebra_pbr_iptable {
 112         /*
 113          * Originating zclient sock fd, so we can know who to send
 114          * back to.
 115          */
 116         int sock;
 117
 118         vrf_id_t vrf_id;
 119
 120         uint32_t unique;
 121
 122         /* include ipset type
 123          */
 124         uint32_t type;
 125
 126         /* include which IP is to be filtered
 127          */
 128         uint32_t filter_bm;
 129
 130         uint32_t fwmark;
 131
 132         uint32_t action;
 133
 134         uint32_t nb_interface;
 135
 136         struct list *interface_name_list;
 137
 138         char ipset_name[ZEBRA_IPSET_NAME_SIZE];
 139 };
 140
 141 void zebra_pbr_add_rule(struct zebra_ns *zns, struct zebra_pbr_rule *rule);
 142 void zebra_pbr_del_rule(struct zebra_ns *zns, struct zebra_pbr_rule *rule);
 143 void zebra_pbr_create_ipset(struct zebra_ns *zns,
 144                             struct zebra_pbr_ipset *ipset);
 145 void zebra_pbr_destroy_ipset(struct zebra_ns *zns,
 146                              struct zebra_pbr_ipset *ipset);
 147 struct zebra_pbr_ipset *zebra_pbr_lookup_ipset_pername(struct zebra_ns *zns,
 148                                                        char *ipsetname);
 149 void zebra_pbr_add_ipset_entry(struct zebra_ns *zns,
 150                                struct zebra_pbr_ipset_entry *ipset);
 151 void zebra_pbr_del_ipset_entry(struct zebra_ns *zns,
 152                                struct zebra_pbr_ipset_entry *ipset);
 153
 154 void zebra_pbr_add_iptable(struct zebra_ns *zns,
 155                            struct zebra_pbr_iptable *iptable);
 156 void zebra_pbr_del_iptable(struct zebra_ns *zns,
 157                            struct zebra_pbr_iptable *iptable);
 158
 159 /*
 160  * Install specified rule for a specific interface.
 161  * It is possible that the user-defined sequence number and the one in the
 162  * forwarding plane may not coincide, hence the API requires a separate
 163  * rule priority - maps to preference/FRA_PRIORITY on Linux.
 164  */
 165 extern void kernel_add_pbr_rule(struct zebra_pbr_rule *rule);
 166
 167 /*
 168  * Uninstall specified rule for a specific interface.
 169  */
 170 extern void kernel_del_pbr_rule(struct zebra_pbr_rule *rule);
 171
 172 /*
 173  * Get to know existing PBR rules in the kernel - typically called at startup.
 174  */
 175 extern void kernel_read_pbr_rules(struct zebra_ns *zns);
 176
 177 enum southbound_results;
 178 /*
 179  * Handle success or failure of rule (un)install in the kernel.
 180  */
 181 extern void kernel_pbr_rule_add_del_status(struct zebra_pbr_rule *rule,
 182                                            enum southbound_results res);
 183
 184 /*
 185  * Handle success or failure of ipset kinds (un)install in the kernel.
 186  */
 187 extern void kernel_pbr_ipset_add_del_status(struct zebra_pbr_ipset *ipset,
 188                                            enum southbound_results res);
 189
 190 extern void kernel_pbr_ipset_entry_add_del_status(
 191                                 struct zebra_pbr_ipset_entry *ipset,
 192                                 enum southbound_results res);
 193
 194 extern void kernel_pbr_iptable_add_del_status(struct zebra_pbr_iptable *iptable,
 195                               enum southbound_results res);
 196
 197 /*
 198  * Handle rule delete notification from kernel.
 199  */
 200 extern int kernel_pbr_rule_del(struct zebra_pbr_rule *rule);
 201
 202 extern void zebra_pbr_rules_free(void *arg);
 203 extern uint32_t zebra_pbr_rules_hash_key(void *arg);
 204 extern int zebra_pbr_rules_hash_equal(const void *arg1, const void *arg2);
 205
 206 /* has operates on 32bit pointer
 207  * and field is a string of 8bit
 208  */
 209 #define ZEBRA_IPSET_NAME_HASH_SIZE (ZEBRA_IPSET_NAME_SIZE / 4)
 210
 211 extern void zebra_pbr_ipset_free(void *arg);
 212 extern uint32_t zebra_pbr_ipset_hash_key(void *arg);
 213 extern int zebra_pbr_ipset_hash_equal(const void *arg1, const void *arg2);
 214
 215 extern void zebra_pbr_ipset_entry_free(void *arg);
 216 extern uint32_t zebra_pbr_ipset_entry_hash_key(void *arg);
 217 extern int zebra_pbr_ipset_entry_hash_equal(const void *arg1, const void *arg2);
 218
 219 extern void zebra_pbr_iptable_free(void *arg);
 220 extern uint32_t zebra_pbr_iptable_hash_key(void *arg);
 221 extern int zebra_pbr_iptable_hash_equal(const void *arg1, const void *arg2);
 222
 223 extern void zebra_pbr_init(void);
 224 extern void zebra_pbr_show_ipset_list(struct vty *vty, char *ipsetname);
 225 extern void zebra_pbr_show_iptable(struct vty *vty);
 226 extern void zebra_pbr_iptable_update_interfacelist(struct stream *s,
 227                                    struct zebra_pbr_iptable *zpi);
 228
 229 DECLARE_HOOK(zebra_pbr_ipset_entry_wrap_script_get_stat, (struct zebra_ns *zns,
 230                                     struct zebra_pbr_ipset_entry *ipset,
 231                                     uint64_t *pkts, uint64_t *bytes),
 232                                      (zns, ipset, pkts, bytes))
 233 DECLARE_HOOK(zebra_pbr_iptable_wrap_script_get_stat, (struct zebra_ns *zns,
 234                                     struct zebra_pbr_iptable *iptable,
 235                                     uint64_t *pkts, uint64_t *bytes),
 236                                      (zns, iptable, pkts, bytes))
 237 DECLARE_HOOK(zebra_pbr_iptable_wrap_script_update, (struct zebra_ns *zns,
 238                                              int cmd,
 239                                              struct zebra_pbr_iptable *iptable),
 240                                              (zns, cmd, iptable));
 241
 242 DECLARE_HOOK(zebra_pbr_ipset_entry_wrap_script_update, (struct zebra_ns *zns,
 243                                   int cmd,
 244                                   struct zebra_pbr_ipset_entry *ipset),
 245                                      (zns, cmd, ipset));
 246 DECLARE_HOOK(zebra_pbr_ipset_wrap_script_update, (struct zebra_ns *zns,
 247                                   int cmd,
 248                                   struct zebra_pbr_ipset *ipset),
 249                                      (zns, cmd, ipset));
 250
 251 #endif /* _ZEBRA_PBR_H */