diff options
Diffstat (limited to 'zebra/zebra_pbr.c')
| -rw-r--r-- | zebra/zebra_pbr.c | 1454 |
1 files changed, 1454 insertions, 0 deletions
diff --git a/zebra/zebra_pbr.c b/zebra/zebra_pbr.c new file mode 100644 index 0000000..43e21a6 --- /dev/null +++ b/zebra/zebra_pbr.c @@ -0,0 +1,1454 @@ +/* Zebra Policy Based Routing (PBR) main handling. + * Copyright (C) 2018 Cumulus Networks, Inc. + * + * This file is part of FRR. + * + * FRR is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2, or (at your option) any + * later version. + * + * FRR is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with FRR; see the file COPYING. If not, write to the Free + * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA + * 02111-1307, USA. + */ + +#include <zebra.h> + +#include <jhash.h> +#include <hash.h> +#include <memory.h> +#include <hook.h> + +#include "zebra/zebra_router.h" +#include "zebra/zebra_pbr.h" +#include "zebra/rt.h" +#include "zebra/zapi_msg.h" +#include "zebra/zserv.h" +#include "zebra/debug.h" +#include "zebra/zebra_neigh.h" + +/* definitions */ +DEFINE_MTYPE_STATIC(ZEBRA, PBR_IPTABLE_IFNAME, "PBR interface list"); + +/* definitions */ +static const struct message ipset_type_msg[] = { + {IPSET_NET_PORT_NET, "net,port,net"}, + {IPSET_NET_PORT, "net,port"}, + {IPSET_NET_NET, "net,net"}, + {IPSET_NET, "net"}, + {0} +}; + +const struct message icmp_typecode_str[] = { + { 0 << 8, "echo-reply"}, + { 0 << 8, "pong"}, + { 3 << 8, "network-unreachable"}, + { (3 << 8) + 1, "host-unreachable"}, + { (3 << 8) + 2, "protocol-unreachable"}, + { (3 << 8) + 3, "port-unreachable"}, + { (3 << 8) + 4, "fragmentation-needed"}, + { (3 << 8) + 5, "source-route-failed"}, + { (3 << 8) + 6, "network-unknown"}, + { (3 << 8) + 7, "host-unknown"}, + { (3 << 8) + 9, "network-prohibited"}, + { (3 << 8) + 10, "host-prohibited"}, + { (3 << 8) + 11, "TOS-network-unreachable"}, + { (3 << 8) + 12, "TOS-host-unreachable"}, + { (3 << 8) + 13, "communication-prohibited"}, + { (3 << 8) + 14, "host-precedence-violation"}, + { (3 << 8) + 15, "precedence-cutoff"}, + { 4 << 8, "source-quench"}, + { 5 << 8, "network-redirect"}, + { (5 << 8) + 1, "host-redirect"}, + { (5 << 8) + 2, "TOS-network-redirect"}, + { (5 << 8) + 3, "TOS-host-redirect"}, + { 8 << 8, "echo-request"}, + { 8 << 8, "ping"}, + { 9 << 8, "router-advertisement"}, + { 10 << 8, "router-solicitation"}, + { 11 << 8, "ttl-zero-during-transit"}, + { (11 << 8) + 1, "ttl-zero-during-reassembly"}, + { 12 << 8, "ip-header-bad"}, + { (12 << 8) + 1, "required-option-missing"}, + { 13 << 8, "timestamp-request"}, + { 14 << 8, "timestamp-reply"}, + { 17 << 8, "address-mask-request"}, + { 18 << 8, "address-mask-reply"}, + {0} +}; + +const struct message icmpv6_typecode_str[] = { + { 128 << 8, "echo-request"}, + { 129 << 8, "echo-reply"}, + { 1 << 8, "no-route"}, + { (1 << 8) + 1, "communication-prohibited"}, + { (1 << 8) + 3, "address-unreachable"}, + { (1 << 8) + 4, "port-unreachable"}, + { (2 << 8), "packet-too-big"}, + { 3 << 0, "ttl-zero-during-transit"}, + { (3 << 8) + 1, "ttl-zero-during-reassembly"}, + { 4 << 0, "bad-header"}, + { (4 << 0) + 1, "unknown-header-type"}, + { (4 << 0) + 2, "unknown-option"}, + { 133 << 8, "router-solicitation"}, + { 134 << 8, "router-advertisement"}, + { 135 << 8, "neighbor-solicitation"}, + { 136 << 8, "neighbor-advertisement"}, + { 137 << 8, "redirect"}, + {0} +}; + +/* definitions */ +static const struct message tcp_value_str[] = { + {TCP_HEADER_FIN, "FIN"}, + {TCP_HEADER_SYN, "SYN"}, + {TCP_HEADER_RST, "RST"}, + {TCP_HEADER_PSH, "PSH"}, + {TCP_HEADER_ACK, "ACK"}, + {TCP_HEADER_URG, "URG"}, + {0} +}; + +static const struct message fragment_value_str[] = { + {1, "dont-fragment"}, + {2, "is-fragment"}, + {4, "first-fragment"}, + {8, "last-fragment"}, + {0} +}; + +struct zebra_pbr_env_display { + struct zebra_ns *zns; + struct vty *vty; + char *name; +}; + +/* static function declarations */ +DEFINE_HOOK(zebra_pbr_ipset_entry_get_stat, + (struct zebra_pbr_ipset_entry *ipset, uint64_t *pkts, + uint64_t *bytes), + (ipset, pkts, bytes)); + +DEFINE_HOOK(zebra_pbr_iptable_get_stat, + (struct zebra_pbr_iptable *iptable, uint64_t *pkts, + uint64_t *bytes), + (iptable, pkts, bytes)); + +DEFINE_HOOK(zebra_pbr_iptable_update, + (int cmd, struct zebra_pbr_iptable *iptable), (cmd, iptable)); + +DEFINE_HOOK(zebra_pbr_ipset_entry_update, + (int cmd, struct zebra_pbr_ipset_entry *ipset), (cmd, ipset)); + +DEFINE_HOOK(zebra_pbr_ipset_update, + (int cmd, struct zebra_pbr_ipset *ipset), (cmd, ipset)); + +/* resolve nexthop for dataplane (dpdk) programming */ +static bool zebra_pbr_expand_action; + +/* Private functions */ + +/* Public functions */ +void zebra_pbr_rules_free(void *arg) +{ + struct zebra_pbr_rule *rule; + + rule = (struct zebra_pbr_rule *)arg; + + (void)dplane_pbr_rule_delete(rule); + XFREE(MTYPE_TMP, rule); +} + +uint32_t zebra_pbr_rules_hash_key(const void *arg) +{ + const struct zebra_pbr_rule *rule; + uint32_t key; + + rule = arg; + key = jhash_3words(rule->rule.seq, rule->rule.priority, + rule->rule.action.table, + prefix_hash_key(&rule->rule.filter.src_ip)); + + key = jhash_3words(rule->rule.filter.fwmark, rule->vrf_id, + rule->rule.filter.ip_proto, key); + + key = jhash(rule->ifname, strlen(rule->ifname), key); + + return jhash_3words(rule->rule.filter.src_port, + rule->rule.filter.dst_port, + prefix_hash_key(&rule->rule.filter.dst_ip), + jhash_1word(rule->rule.unique, key)); +} + +bool zebra_pbr_rules_hash_equal(const void *arg1, const void *arg2) +{ + const struct zebra_pbr_rule *r1, *r2; + + r1 = (const struct zebra_pbr_rule *)arg1; + r2 = (const struct zebra_pbr_rule *)arg2; + + if (r1->rule.seq != r2->rule.seq) + return false; + + if (r1->rule.priority != r2->rule.priority) + return false; + + if (r1->rule.unique != r2->rule.unique) + return false; + + if (r1->rule.action.table != r2->rule.action.table) + return false; + + if (r1->rule.filter.src_port != r2->rule.filter.src_port) + return false; + + if (r1->rule.filter.dst_port != r2->rule.filter.dst_port) + return false; + + if (r1->rule.filter.fwmark != r2->rule.filter.fwmark) + return false; + + if (r1->rule.filter.ip_proto != r2->rule.filter.ip_proto) + return false; + + if (!prefix_same(&r1->rule.filter.src_ip, &r2->rule.filter.src_ip)) + return false; + + if (!prefix_same(&r1->rule.filter.dst_ip, &r2->rule.filter.dst_ip)) + return false; + + if (strcmp(r1->rule.ifname, r2->rule.ifname) != 0) + return false; + + if (r1->vrf_id != r2->vrf_id) + return false; + + return true; +} + +struct pbr_rule_unique_lookup { + struct zebra_pbr_rule *rule; + uint32_t unique; + char ifname[INTERFACE_NAMSIZ + 1]; + vrf_id_t vrf_id; +}; + +static int pbr_rule_lookup_unique_walker(struct hash_bucket *b, void *data) +{ + struct pbr_rule_unique_lookup *pul = data; + struct zebra_pbr_rule *rule = b->data; + + if (pul->unique == rule->rule.unique + && strncmp(pul->ifname, rule->rule.ifname, INTERFACE_NAMSIZ) == 0 + && pul->vrf_id == rule->vrf_id) { + pul->rule = rule; + return HASHWALK_ABORT; + } + + return HASHWALK_CONTINUE; +} + +static struct zebra_pbr_rule * +pbr_rule_lookup_unique(struct zebra_pbr_rule *zrule) +{ + struct pbr_rule_unique_lookup pul; + + pul.unique = zrule->rule.unique; + strlcpy(pul.ifname, zrule->rule.ifname, INTERFACE_NAMSIZ); + pul.rule = NULL; + pul.vrf_id = zrule->vrf_id; + hash_walk(zrouter.rules_hash, &pbr_rule_lookup_unique_walker, &pul); + + return pul.rule; +} + +void zebra_pbr_ipset_free(void *arg) +{ + struct zebra_pbr_ipset *ipset; + + ipset = (struct zebra_pbr_ipset *)arg; + hook_call(zebra_pbr_ipset_update, 0, ipset); + XFREE(MTYPE_TMP, ipset); +} + +uint32_t zebra_pbr_ipset_hash_key(const void *arg) +{ + const struct zebra_pbr_ipset *ipset = arg; + uint32_t *pnt = (uint32_t *)&ipset->ipset_name; + uint32_t key = jhash_1word(ipset->vrf_id, 0x63ab42de); + + key = jhash_1word(ipset->family, key); + + return jhash2(pnt, ZEBRA_IPSET_NAME_HASH_SIZE, key); +} + +bool zebra_pbr_ipset_hash_equal(const void *arg1, const void *arg2) +{ + const struct zebra_pbr_ipset *r1, *r2; + + r1 = (const struct zebra_pbr_ipset *)arg1; + r2 = (const struct zebra_pbr_ipset *)arg2; + + if (r1->type != r2->type) + return false; + if (r1->unique != r2->unique) + return false; + if (r1->vrf_id != r2->vrf_id) + return false; + if (r1->family != r2->family) + return false; + + if (strncmp(r1->ipset_name, r2->ipset_name, + ZEBRA_IPSET_NAME_SIZE)) + return false; + return true; +} + +void zebra_pbr_ipset_entry_free(void *arg) +{ + struct zebra_pbr_ipset_entry *ipset; + + ipset = (struct zebra_pbr_ipset_entry *)arg; + + hook_call(zebra_pbr_ipset_entry_update, 0, ipset); + + XFREE(MTYPE_TMP, ipset); +} + +uint32_t zebra_pbr_ipset_entry_hash_key(const void *arg) +{ + const struct zebra_pbr_ipset_entry *ipset; + uint32_t key; + + ipset = arg; + key = prefix_hash_key(&ipset->src); + key = jhash_1word(ipset->unique, key); + key = jhash_1word(prefix_hash_key(&ipset->dst), key); + key = jhash(&ipset->dst_port_min, 2, key); + key = jhash(&ipset->dst_port_max, 2, key); + key = jhash(&ipset->src_port_min, 2, key); + key = jhash(&ipset->src_port_max, 2, key); + key = jhash(&ipset->proto, 1, key); + + return key; +} + +bool zebra_pbr_ipset_entry_hash_equal(const void *arg1, const void *arg2) +{ + const struct zebra_pbr_ipset_entry *r1, *r2; + + r1 = (const struct zebra_pbr_ipset_entry *)arg1; + r2 = (const struct zebra_pbr_ipset_entry *)arg2; + + if (r1->unique != r2->unique) + return false; + + if (!prefix_same(&r1->src, &r2->src)) + return false; + + if (!prefix_same(&r1->dst, &r2->dst)) + return false; + + if (r1->src_port_min != r2->src_port_min) + return false; + + if (r1->src_port_max != r2->src_port_max) + return false; + + if (r1->dst_port_min != r2->dst_port_min) + return false; + + if (r1->dst_port_max != r2->dst_port_max) + return false; + + if (r1->proto != r2->proto) + return false; + return true; +} + +/* this function gives option to flush plugin memory contexts + * with all parameter. set it to true to flush all + * set it to false to flush only passed arg argument + */ +static void _zebra_pbr_iptable_free_all(void *arg, bool all) +{ + struct zebra_pbr_iptable *iptable; + struct listnode *node, *nnode; + char *name; + + iptable = (struct zebra_pbr_iptable *)arg; + + if (all) + hook_call(zebra_pbr_iptable_update, 0, iptable); + + if (iptable->interface_name_list) { + for (ALL_LIST_ELEMENTS(iptable->interface_name_list, node, + nnode, name)) { + XFREE(MTYPE_PBR_IPTABLE_IFNAME, name); + list_delete_node(iptable->interface_name_list, node); + } + list_delete(&iptable->interface_name_list); + } + XFREE(MTYPE_TMP, iptable); +} + +void zebra_pbr_iptable_free(void *arg) +{ + _zebra_pbr_iptable_free_all(arg, false); +} + +uint32_t zebra_pbr_iptable_hash_key(const void *arg) +{ + const struct zebra_pbr_iptable *iptable = arg; + uint32_t *pnt = (uint32_t *)&(iptable->ipset_name); + uint32_t key; + + key = jhash2(pnt, ZEBRA_IPSET_NAME_HASH_SIZE, + 0x63ab42de); + key = jhash_1word(iptable->fwmark, key); + key = jhash_1word(iptable->family, key); + key = jhash_1word(iptable->flow_label, key); + key = jhash_1word(iptable->pkt_len_min, key); + key = jhash_1word(iptable->pkt_len_max, key); + key = jhash_1word(iptable->tcp_flags, key); + key = jhash_1word(iptable->tcp_mask_flags, key); + key = jhash_1word(iptable->dscp_value, key); + key = jhash_1word(iptable->protocol, key); + key = jhash_1word(iptable->fragment, key); + key = jhash_1word(iptable->vrf_id, key); + + return jhash_3words(iptable->filter_bm, iptable->type, + iptable->unique, key); +} + +bool zebra_pbr_iptable_hash_equal(const void *arg1, const void *arg2) +{ + const struct zebra_pbr_iptable *r1, *r2; + + r1 = (const struct zebra_pbr_iptable *)arg1; + r2 = (const struct zebra_pbr_iptable *)arg2; + + if (r1->vrf_id != r2->vrf_id) + return false; + if (r1->type != r2->type) + return false; + if (r1->unique != r2->unique) + return false; + if (r1->filter_bm != r2->filter_bm) + return false; + if (r1->fwmark != r2->fwmark) + return false; + if (r1->action != r2->action) + return false; + if (strncmp(r1->ipset_name, r2->ipset_name, + ZEBRA_IPSET_NAME_SIZE)) + return false; + if (r1->family != r2->family) + return false; + if (r1->flow_label != r2->flow_label) + return false; + if (r1->pkt_len_min != r2->pkt_len_min) + return false; + if (r1->pkt_len_max != r2->pkt_len_max) + return false; + if (r1->tcp_flags != r2->tcp_flags) + return false; + if (r1->tcp_mask_flags != r2->tcp_mask_flags) + return false; + if (r1->dscp_value != r2->dscp_value) + return false; + if (r1->fragment != r2->fragment) + return false; + if (r1->protocol != r2->protocol) + return false; + return true; +} + +static void *pbr_rule_alloc_intern(void *arg) +{ + struct zebra_pbr_rule *zpr; + struct zebra_pbr_rule *new; + + zpr = (struct zebra_pbr_rule *)arg; + + new = XCALLOC(MTYPE_TMP, sizeof(*new)); + + memcpy(new, zpr, sizeof(*zpr)); + + return new; +} + +static struct zebra_pbr_rule *pbr_rule_free(struct zebra_pbr_rule *hash_data, + bool free_data) +{ + if (hash_data->action.neigh) + zebra_neigh_deref(hash_data); + hash_release(zrouter.rules_hash, hash_data); + if (free_data) { + XFREE(MTYPE_TMP, hash_data); + return NULL; + } + + return hash_data; +} + +static struct zebra_pbr_rule *pbr_rule_release(struct zebra_pbr_rule *rule, + bool free_data) +{ + struct zebra_pbr_rule *lookup; + + lookup = hash_lookup(zrouter.rules_hash, rule); + + if (!lookup) + return NULL; + + return pbr_rule_free(lookup, free_data); +} + +void zebra_pbr_show_rule_unit(struct zebra_pbr_rule *rule, struct vty *vty) +{ + struct pbr_rule *prule = &rule->rule; + struct zebra_pbr_action *zaction = &rule->action; + + vty_out(vty, "Rules if %s\n", rule->ifname); + vty_out(vty, " Seq %u pri %u\n", prule->seq, prule->priority); + if (prule->filter.filter_bm & PBR_FILTER_SRC_IP) + vty_out(vty, " SRC IP Match: %pFX\n", &prule->filter.src_ip); + if (prule->filter.filter_bm & PBR_FILTER_DST_IP) + vty_out(vty, " DST IP Match: %pFX\n", &prule->filter.dst_ip); + if (prule->filter.filter_bm & PBR_FILTER_IP_PROTOCOL) + vty_out(vty, " IP protocol Match: %u\n", + prule->filter.ip_proto); + if (prule->filter.filter_bm & PBR_FILTER_SRC_PORT) + vty_out(vty, " SRC Port Match: %u\n", prule->filter.src_port); + if (prule->filter.filter_bm & PBR_FILTER_DST_PORT) + vty_out(vty, " DST Port Match: %u\n", prule->filter.dst_port); + + if (prule->filter.filter_bm & PBR_FILTER_DSFIELD) { + vty_out(vty, " DSCP Match: %u\n", + (prule->filter.dsfield & PBR_DSFIELD_DSCP) >> 2); + vty_out(vty, " ECN Match: %u\n", + prule->filter.dsfield & PBR_DSFIELD_ECN); + } + + if (prule->filter.filter_bm & PBR_FILTER_FWMARK) + vty_out(vty, " MARK Match: %u\n", prule->filter.fwmark); + + vty_out(vty, " Tableid: %u\n", prule->action.table); + if (zaction->afi == AFI_IP) + vty_out(vty, " Action: nh: %pI4 intf: %s\n", + &zaction->gate.ipv4, + ifindex2ifname(zaction->ifindex, rule->vrf_id)); + if (zaction->afi == AFI_IP6) + vty_out(vty, " Action: nh: %pI6 intf: %s\n", + &zaction->gate.ipv6, + ifindex2ifname(zaction->ifindex, rule->vrf_id)); + if (zaction->neigh && (zaction->neigh->flags & ZEBRA_NEIGH_ENT_ACTIVE)) + vty_out(vty, " Action: mac: %pEA\n", &zaction->neigh->mac); +} + +static int zebra_pbr_show_rules_walkcb(struct hash_bucket *bucket, void *arg) +{ + struct zebra_pbr_rule *rule = (struct zebra_pbr_rule *)bucket->data; + struct zebra_pbr_env_display *env = (struct zebra_pbr_env_display *)arg; + struct vty *vty = env->vty; + + zebra_pbr_show_rule_unit(rule, vty); + + return HASHWALK_CONTINUE; +} + +void zebra_pbr_show_rule(struct vty *vty) +{ + struct zebra_pbr_env_display env; + + env.vty = vty; + hash_walk(zrouter.rules_hash, zebra_pbr_show_rules_walkcb, &env); +} + +void zebra_pbr_config_write(struct vty *vty) +{ + if (zebra_pbr_expand_action) + vty_out(vty, "pbr nexthop-resolve\n"); +} + +void zebra_pbr_expand_action_update(bool enable) +{ + zebra_pbr_expand_action = enable; +} + +static void zebra_pbr_expand_rule(struct zebra_pbr_rule *rule) +{ + struct prefix p; + struct route_table *table; + struct route_node *rn; + rib_dest_t *dest; + struct route_entry *re; + const struct nexthop_group *nhg; + const struct nexthop *nexthop; + struct zebra_pbr_action *action = &rule->action; + struct ipaddr ip; + + if (!zebra_pbr_expand_action) + return; + + table = zebra_vrf_get_table_with_table_id( + AFI_IP, SAFI_UNICAST, VRF_DEFAULT, rule->rule.action.table); + if (!table) + return; + + memset(&p, 0, sizeof(p)); + p.family = AF_INET; + + rn = route_node_lookup(table, &p); + if (!rn) + return; + + dest = rib_dest_from_rnode(rn); + re = dest->selected_fib; + if (!re) { + route_unlock_node(rn); + return; + } + + nhg = rib_get_fib_nhg(re); + if (!nhg) { + route_unlock_node(rn); + return; + } + + nexthop = nhg->nexthop; + if (nexthop) { + switch (nexthop->type) { + case NEXTHOP_TYPE_IPV4: + case NEXTHOP_TYPE_IPV4_IFINDEX: + action->afi = AFI_IP; + action->gate.ipv4 = nexthop->gate.ipv4; + action->ifindex = nexthop->ifindex; + ip.ipa_type = AF_INET; + ip.ipaddr_v4 = action->gate.ipv4; + zebra_neigh_ref(action->ifindex, &ip, rule); + break; + + case NEXTHOP_TYPE_IPV6: + case NEXTHOP_TYPE_IPV6_IFINDEX: + action->afi = AFI_IP6; + action->gate.ipv6 = nexthop->gate.ipv6; + action->ifindex = nexthop->ifindex; + ip.ipa_type = AF_INET6; + ip.ipaddr_v6 = action->gate.ipv6; + zebra_neigh_ref(action->ifindex, &ip, rule); + break; + + default: + action->afi = AFI_UNSPEC; + } + } + + route_unlock_node(rn); +} + +void zebra_pbr_add_rule(struct zebra_pbr_rule *rule) +{ + struct zebra_pbr_rule *found; + struct zebra_pbr_rule *old; + struct zebra_pbr_rule *new; + + /** + * Check if we already have it (this checks via a unique ID, walking + * over the hash table, not via a hash operation). + */ + found = pbr_rule_lookup_unique(rule); + + /* If found, this is an update */ + if (found) { + if (IS_ZEBRA_DEBUG_PBR) + zlog_debug( + "%s: seq: %d, prior: %d, unique: %d, ifname: %s -- update", + __func__, rule->rule.seq, rule->rule.priority, + rule->rule.unique, rule->rule.ifname); + + /* remove the old entry from the hash but don't free the hash + * data yet as we need it for the dplane update + */ + old = pbr_rule_release(found, false); + + /* insert new entry into hash */ + new = hash_get(zrouter.rules_hash, rule, pbr_rule_alloc_intern); + /* expand the action if needed */ + zebra_pbr_expand_rule(new); + /* update dataplane */ + (void)dplane_pbr_rule_update(found, new); + /* release the old hash data */ + if (old) + XFREE(MTYPE_TMP, old); + } else { + if (IS_ZEBRA_DEBUG_PBR) + zlog_debug( + "%s: seq: %d, prior: %d, unique: %d, ifname: %s -- new", + __func__, rule->rule.seq, rule->rule.priority, + rule->rule.unique, rule->rule.ifname); + + /* insert new entry into hash */ + new = hash_get(zrouter.rules_hash, rule, pbr_rule_alloc_intern); + /* expand the action if needed */ + zebra_pbr_expand_rule(new); + (void)dplane_pbr_rule_add(new); + } + +} + +void zebra_pbr_del_rule(struct zebra_pbr_rule *rule) +{ + if (IS_ZEBRA_DEBUG_PBR) + zlog_debug("%s: seq: %d, prior: %d, unique: %d, ifname: %s", + __func__, rule->rule.seq, rule->rule.priority, + rule->rule.unique, rule->rule.ifname); + + (void)dplane_pbr_rule_delete(rule); + + if (pbr_rule_release(rule, true)) + zlog_debug("%s: Rule being deleted we know nothing about", + __func__); +} + +void zebra_pbr_process_iptable(struct zebra_dplane_ctx *ctx) +{ + int mode, ret = 0; + struct zebra_pbr_iptable ipt; + + if (dplane_ctx_get_op(ctx) == DPLANE_OP_IPTABLE_ADD) + mode = 1; + else + mode = 0; + + dplane_ctx_get_pbr_iptable(ctx, &ipt); + + ret = hook_call(zebra_pbr_iptable_update, mode, &ipt); + if (ret) + dplane_ctx_set_status(ctx, ZEBRA_DPLANE_REQUEST_SUCCESS); + else + dplane_ctx_set_status(ctx, ZEBRA_DPLANE_REQUEST_FAILURE); +} + +void zebra_pbr_process_ipset(struct zebra_dplane_ctx *ctx) +{ + int mode, ret = 0; + struct zebra_pbr_ipset ipset; + + if (dplane_ctx_get_op(ctx) == DPLANE_OP_IPSET_ADD) + mode = 1; + else + mode = 0; + + dplane_ctx_get_pbr_ipset(ctx, &ipset); + + ret = hook_call(zebra_pbr_ipset_update, mode, &ipset); + if (ret) + dplane_ctx_set_status(ctx, ZEBRA_DPLANE_REQUEST_SUCCESS); + else + dplane_ctx_set_status(ctx, ZEBRA_DPLANE_REQUEST_FAILURE); +} + +void zebra_pbr_process_ipset_entry(struct zebra_dplane_ctx *ctx) +{ + int mode, ret = 0; + struct zebra_pbr_ipset_entry ipset_entry; + struct zebra_pbr_ipset ipset; + + if (dplane_ctx_get_op(ctx) == DPLANE_OP_IPSET_ENTRY_ADD) + mode = 1; + else + mode = 0; + + dplane_ctx_get_pbr_ipset_entry(ctx, &ipset_entry); + dplane_ctx_get_pbr_ipset(ctx, &ipset); + + ipset_entry.backpointer = &ipset; + + ret = hook_call(zebra_pbr_ipset_entry_update, mode, &ipset_entry); + if (ret) + dplane_ctx_set_status(ctx, ZEBRA_DPLANE_REQUEST_SUCCESS); + else + dplane_ctx_set_status(ctx, ZEBRA_DPLANE_REQUEST_FAILURE); +} + +static void zebra_pbr_cleanup_rules(struct hash_bucket *b, void *data) +{ + struct zebra_pbr_rule *rule = b->data; + int *sock = data; + + if (rule->sock == *sock) { + (void)dplane_pbr_rule_delete(rule); + pbr_rule_free(rule, true); + } +} + +static void zebra_pbr_cleanup_ipset(struct hash_bucket *b, void *data) +{ + struct zebra_pbr_ipset *ipset = b->data; + int *sock = data; + + if (ipset->sock == *sock) { + if (hash_release(zrouter.ipset_hash, ipset)) + zebra_pbr_ipset_free(ipset); + else + hook_call(zebra_pbr_ipset_update, 0, ipset); + } +} + +static void zebra_pbr_cleanup_ipset_entry(struct hash_bucket *b, void *data) +{ + struct zebra_pbr_ipset_entry *ipset = b->data; + int *sock = data; + + if (ipset->sock == *sock) { + if (hash_release(zrouter.ipset_entry_hash, ipset)) + zebra_pbr_ipset_entry_free(ipset); + else + hook_call(zebra_pbr_ipset_entry_update, 0, ipset); + } +} + +static void zebra_pbr_cleanup_iptable(struct hash_bucket *b, void *data) +{ + struct zebra_pbr_iptable *iptable = b->data; + int *sock = data; + + if (iptable->sock == *sock) { + if (hash_release(zrouter.iptable_hash, iptable)) + _zebra_pbr_iptable_free_all(iptable, true); + else + hook_call(zebra_pbr_iptable_update, 0, iptable); + } +} + +static int zebra_pbr_client_close_cleanup(struct zserv *client) +{ + int sock = client->sock; + + if (!sock) + return 0; + hash_iterate(zrouter.rules_hash, zebra_pbr_cleanup_rules, &sock); + hash_iterate(zrouter.iptable_hash, zebra_pbr_cleanup_iptable, &sock); + hash_iterate(zrouter.ipset_entry_hash, zebra_pbr_cleanup_ipset_entry, + &sock); + hash_iterate(zrouter.ipset_hash, zebra_pbr_cleanup_ipset, &sock); + return 1; +} + +void zebra_pbr_init(void) +{ + hook_register(zserv_client_close, zebra_pbr_client_close_cleanup); +} + +static void *pbr_ipset_alloc_intern(void *arg) +{ + struct zebra_pbr_ipset *zpi; + struct zebra_pbr_ipset *new; + + zpi = (struct zebra_pbr_ipset *)arg; + + new = XCALLOC(MTYPE_TMP, sizeof(struct zebra_pbr_ipset)); + + memcpy(new, zpi, sizeof(*zpi)); + + return new; +} + +void zebra_pbr_create_ipset(struct zebra_pbr_ipset *ipset) +{ + (void)hash_get(zrouter.ipset_hash, ipset, pbr_ipset_alloc_intern); + (void)dplane_pbr_ipset_add(ipset); +} + +void zebra_pbr_destroy_ipset(struct zebra_pbr_ipset *ipset) +{ + struct zebra_pbr_ipset *lookup; + + lookup = hash_lookup(zrouter.ipset_hash, ipset); + (void)dplane_pbr_ipset_delete(ipset); + if (lookup) { + hash_release(zrouter.ipset_hash, lookup); + XFREE(MTYPE_TMP, lookup); + } else + zlog_debug( + "%s: IPSet Entry being deleted we know nothing about", + __func__); +} + +struct pbr_ipset_name_lookup { + struct zebra_pbr_ipset *ipset; + char ipset_name[ZEBRA_IPSET_NAME_SIZE]; +}; + +const char *zebra_pbr_ipset_type2str(uint32_t type) +{ + return lookup_msg(ipset_type_msg, type, + "Unrecognized IPset Type"); +} + +static int zebra_pbr_ipset_pername_walkcb(struct hash_bucket *bucket, void *arg) +{ + struct pbr_ipset_name_lookup *pinl = + (struct pbr_ipset_name_lookup *)arg; + struct zebra_pbr_ipset *zpi = (struct zebra_pbr_ipset *)bucket->data; + + if (!strncmp(pinl->ipset_name, zpi->ipset_name, + ZEBRA_IPSET_NAME_SIZE)) { + pinl->ipset = zpi; + return HASHWALK_ABORT; + } + return HASHWALK_CONTINUE; +} + +struct zebra_pbr_ipset *zebra_pbr_lookup_ipset_pername(char *ipsetname) +{ + struct pbr_ipset_name_lookup pinl; + struct pbr_ipset_name_lookup *ptr = &pinl; + + if (!ipsetname) + return NULL; + memset(ptr, 0, sizeof(struct pbr_ipset_name_lookup)); + snprintf((char *)ptr->ipset_name, ZEBRA_IPSET_NAME_SIZE, "%s", + ipsetname); + hash_walk(zrouter.ipset_hash, zebra_pbr_ipset_pername_walkcb, ptr); + return ptr->ipset; +} + +static void *pbr_ipset_entry_alloc_intern(void *arg) +{ + struct zebra_pbr_ipset_entry *zpi; + struct zebra_pbr_ipset_entry *new; + + zpi = (struct zebra_pbr_ipset_entry *)arg; + + new = XCALLOC(MTYPE_TMP, sizeof(struct zebra_pbr_ipset_entry)); + + memcpy(new, zpi, sizeof(*zpi)); + + return new; +} + +void zebra_pbr_add_ipset_entry(struct zebra_pbr_ipset_entry *ipset) +{ + (void)hash_get(zrouter.ipset_entry_hash, ipset, + pbr_ipset_entry_alloc_intern); + (void)dplane_pbr_ipset_entry_add(ipset); +} + +void zebra_pbr_del_ipset_entry(struct zebra_pbr_ipset_entry *ipset) +{ + struct zebra_pbr_ipset_entry *lookup; + + lookup = hash_lookup(zrouter.ipset_entry_hash, ipset); + (void)dplane_pbr_ipset_entry_delete(ipset); + if (lookup) { + hash_release(zrouter.ipset_entry_hash, lookup); + XFREE(MTYPE_TMP, lookup); + } else + zlog_debug("%s: IPSet being deleted we know nothing about", + __func__); +} + +static void *pbr_iptable_alloc_intern(void *arg) +{ + struct zebra_pbr_iptable *zpi; + struct zebra_pbr_iptable *new; + struct listnode *ln; + char *ifname; + + zpi = (struct zebra_pbr_iptable *)arg; + + new = XCALLOC(MTYPE_TMP, sizeof(struct zebra_pbr_iptable)); + + /* Deep structure copy */ + memcpy(new, zpi, sizeof(*zpi)); + new->interface_name_list = list_new(); + + if (zpi->interface_name_list) { + for (ALL_LIST_ELEMENTS_RO(zpi->interface_name_list, ln, ifname)) + listnode_add(new->interface_name_list, + XSTRDUP(MTYPE_PBR_IPTABLE_IFNAME, ifname)); + } + + return new; +} + +void zebra_pbr_add_iptable(struct zebra_pbr_iptable *iptable) +{ + struct zebra_pbr_iptable *ipt_hash; + + ipt_hash = hash_get(zrouter.iptable_hash, iptable, + pbr_iptable_alloc_intern); + (void)dplane_pbr_iptable_add(ipt_hash); +} + +void zebra_pbr_del_iptable(struct zebra_pbr_iptable *iptable) +{ + struct zebra_pbr_iptable *lookup; + + lookup = hash_lookup(zrouter.iptable_hash, iptable); + (void)dplane_pbr_iptable_delete(iptable); + if (lookup) { + struct listnode *node, *nnode; + char *name; + + hash_release(zrouter.iptable_hash, lookup); + for (ALL_LIST_ELEMENTS(iptable->interface_name_list, + node, nnode, name)) { + XFREE(MTYPE_PBR_IPTABLE_IFNAME, name); + list_delete_node(iptable->interface_name_list, + node); + } + list_delete(&iptable->interface_name_list); + XFREE(MTYPE_TMP, lookup); + } else + zlog_debug("%s: IPTable being deleted we know nothing about", + __func__); +} + +/* + * Handle success or failure of rule (un)install in the kernel. + */ +void zebra_pbr_dplane_result(struct zebra_dplane_ctx *ctx) +{ + enum zebra_dplane_result res; + enum dplane_op_e op; + + res = dplane_ctx_get_status(ctx); + op = dplane_ctx_get_op(ctx); + if (op == DPLANE_OP_RULE_ADD || op == DPLANE_OP_RULE_UPDATE) + zsend_rule_notify_owner(ctx, res == ZEBRA_DPLANE_REQUEST_SUCCESS + ? ZAPI_RULE_INSTALLED + : ZAPI_RULE_FAIL_INSTALL); + else if (op == DPLANE_OP_RULE_DELETE) + zsend_rule_notify_owner(ctx, res == ZEBRA_DPLANE_REQUEST_SUCCESS + ? ZAPI_RULE_REMOVED + : ZAPI_RULE_FAIL_REMOVE); + else if (op == DPLANE_OP_IPTABLE_ADD) + zsend_iptable_notify_owner(ctx, + res == ZEBRA_DPLANE_REQUEST_SUCCESS + ? ZAPI_IPTABLE_INSTALLED + : ZAPI_IPTABLE_FAIL_INSTALL); + else if (op == DPLANE_OP_IPTABLE_DELETE) + zsend_iptable_notify_owner(ctx, + res == ZEBRA_DPLANE_REQUEST_SUCCESS + ? ZAPI_IPTABLE_REMOVED + : ZAPI_IPTABLE_FAIL_REMOVE); + else if (op == DPLANE_OP_IPSET_ADD) + zsend_ipset_notify_owner(ctx, + res == ZEBRA_DPLANE_REQUEST_SUCCESS + ? ZAPI_IPSET_INSTALLED + : ZAPI_IPSET_FAIL_INSTALL); + else if (op == DPLANE_OP_IPSET_DELETE) + zsend_ipset_notify_owner(ctx, + res == ZEBRA_DPLANE_REQUEST_SUCCESS + ? ZAPI_IPSET_REMOVED + : ZAPI_IPSET_FAIL_REMOVE); + else if (op == DPLANE_OP_IPSET_ENTRY_ADD) + zsend_ipset_entry_notify_owner( + ctx, res == ZEBRA_DPLANE_REQUEST_SUCCESS + ? ZAPI_IPSET_ENTRY_INSTALLED + : ZAPI_IPSET_ENTRY_FAIL_INSTALL); + else if (op == DPLANE_OP_IPSET_ENTRY_DELETE) + zsend_ipset_entry_notify_owner( + ctx, res == ZEBRA_DPLANE_REQUEST_SUCCESS + ? ZAPI_IPSET_ENTRY_REMOVED + : ZAPI_IPSET_ENTRY_FAIL_REMOVE); + else + flog_err( + EC_ZEBRA_PBR_RULE_UPDATE, + "Context received in pbr rule dplane result handler with incorrect OP code (%u)", + op); +} + +/* + * Handle rule delete notification from kernel. + */ +int kernel_pbr_rule_del(struct zebra_pbr_rule *rule) +{ + return 0; +} + +struct zebra_pbr_ipset_entry_unique_display { + struct zebra_pbr_ipset *zpi; + struct vty *vty; + struct zebra_ns *zns; +}; + + +static const char *zebra_pbr_prefix2str(union prefixconstptr pu, + char *str, int size) +{ + const struct prefix *p = pu.p; + char buf[PREFIX2STR_BUFFER]; + + if ((p->family == AF_INET && p->prefixlen == IPV4_MAX_BITLEN) + || (p->family == AF_INET6 && p->prefixlen == IPV6_MAX_BITLEN)) { + snprintf(str, size, "%s", inet_ntop(p->family, &p->u.prefix, + buf, PREFIX2STR_BUFFER)); + return str; + } + return prefix2str(pu, str, size); +} + +static void zebra_pbr_display_icmp(struct vty *vty, + struct zebra_pbr_ipset_entry *zpie) +{ + char decoded_str[20]; + uint16_t port; + struct zebra_pbr_ipset *zpi; + + zpi = zpie->backpointer; + + /* range icmp type */ + if (zpie->src_port_max || zpie->dst_port_max) { + vty_out(vty, ":icmp:[type <%u:%u>;code <%u:%u>", + zpie->src_port_min, zpie->src_port_max, + zpie->dst_port_min, zpie->dst_port_max); + } else { + port = ((zpie->src_port_min << 8) & 0xff00) + + (zpie->dst_port_min & 0xff); + memset(decoded_str, 0, sizeof(decoded_str)); + snprintf(decoded_str, sizeof(decoded_str), "%u/%u", + zpie->src_port_min, zpie->dst_port_min); + vty_out(vty, ":%s:%s", + zpi->family == AF_INET6 ? "ipv6-icmp" : "icmp", + lookup_msg(zpi->family == AF_INET6 ? + icmpv6_typecode_str : icmp_typecode_str, + port, decoded_str)); + } +} + +static void zebra_pbr_display_port(struct vty *vty, uint32_t filter_bm, + uint16_t port_min, uint16_t port_max, + uint8_t proto) +{ + if (!(filter_bm & PBR_FILTER_PROTO)) { + if (port_max) + vty_out(vty, ":udp/tcp:%d-%d", + port_min, port_max); + else + vty_out(vty, ":udp/tcp:%d", + port_min); + } else { + if (port_max) + vty_out(vty, ":proto %d:%d-%d", + proto, port_min, port_max); + else + vty_out(vty, ":proto %d:%d", + proto, port_min); + } +} + +static int zebra_pbr_show_ipset_entry_walkcb(struct hash_bucket *bucket, + void *arg) +{ + struct zebra_pbr_ipset_entry_unique_display *unique = + (struct zebra_pbr_ipset_entry_unique_display *)arg; + struct zebra_pbr_ipset *zpi = unique->zpi; + struct vty *vty = unique->vty; + struct zebra_pbr_ipset_entry *zpie = + (struct zebra_pbr_ipset_entry *)bucket->data; + uint64_t pkts = 0, bytes = 0; + int ret = 0; + + if (zpie->backpointer != zpi) + return HASHWALK_CONTINUE; + + if ((zpi->type == IPSET_NET_NET) || + (zpi->type == IPSET_NET_PORT_NET)) { + char buf[PREFIX_STRLEN]; + + zebra_pbr_prefix2str(&(zpie->src), buf, sizeof(buf)); + vty_out(vty, "\tfrom %s", buf); + if (zpie->filter_bm & PBR_FILTER_SRC_PORT && + zpie->proto != IPPROTO_ICMP) + zebra_pbr_display_port(vty, zpie->filter_bm, + zpie->src_port_min, + zpie->src_port_max, + zpie->proto); + vty_out(vty, " to "); + zebra_pbr_prefix2str(&(zpie->dst), buf, sizeof(buf)); + vty_out(vty, "%s", buf); + if (zpie->filter_bm & PBR_FILTER_DST_PORT && + zpie->proto != IPPROTO_ICMP) + zebra_pbr_display_port(vty, zpie->filter_bm, + zpie->dst_port_min, + zpie->dst_port_max, + zpie->proto); + if (zpie->proto == IPPROTO_ICMP) + zebra_pbr_display_icmp(vty, zpie); + } else if ((zpi->type == IPSET_NET) || + (zpi->type == IPSET_NET_PORT)) { + char buf[PREFIX_STRLEN]; + + if (zpie->filter_bm & PBR_FILTER_SRC_IP) { + zebra_pbr_prefix2str(&(zpie->src), buf, sizeof(buf)); + vty_out(vty, "\tfrom %s", buf); + } + if (zpie->filter_bm & PBR_FILTER_SRC_PORT && + zpie->proto != IPPROTO_ICMP) + zebra_pbr_display_port(vty, zpie->filter_bm, + zpie->src_port_min, + zpie->src_port_max, + zpie->proto); + if (zpie->filter_bm & PBR_FILTER_DST_IP) { + zebra_pbr_prefix2str(&(zpie->dst), buf, sizeof(buf)); + vty_out(vty, "\tto %s", buf); + } + if (zpie->filter_bm & PBR_FILTER_DST_PORT && + zpie->proto != IPPROTO_ICMP) + zebra_pbr_display_port(vty, zpie->filter_bm, + zpie->dst_port_min, + zpie->dst_port_max, + zpie->proto); + if (zpie->proto == IPPROTO_ICMP) + zebra_pbr_display_icmp(vty, zpie); + } + vty_out(vty, " (%u)\n", zpie->unique); + + ret = hook_call(zebra_pbr_ipset_entry_get_stat, zpie, &pkts, + &bytes); + if (ret && pkts > 0) + vty_out(vty, "\t pkts %" PRIu64 ", bytes %" PRIu64"\n", + pkts, bytes); + return HASHWALK_CONTINUE; +} + +static int zebra_pbr_show_ipset_walkcb(struct hash_bucket *bucket, void *arg) +{ + struct zebra_pbr_env_display *uniqueipset = + (struct zebra_pbr_env_display *)arg; + struct zebra_pbr_ipset *zpi = (struct zebra_pbr_ipset *)bucket->data; + struct zebra_pbr_ipset_entry_unique_display unique; + struct vty *vty = uniqueipset->vty; + struct zebra_ns *zns = uniqueipset->zns; + + vty_out(vty, "IPset %s type %s family %s\n", zpi->ipset_name, + zebra_pbr_ipset_type2str(zpi->type), + family2str(zpi->family)); + unique.vty = vty; + unique.zpi = zpi; + unique.zns = zns; + hash_walk(zrouter.ipset_entry_hash, zebra_pbr_show_ipset_entry_walkcb, + &unique); + vty_out(vty, "\n"); + return HASHWALK_CONTINUE; +} + +size_t zebra_pbr_tcpflags_snprintf(char *buffer, size_t len, + uint16_t tcp_val) +{ + size_t len_written = 0; + static struct message nt = {0}; + const struct message *pnt; + int incr = 0; + + for (pnt = tcp_value_str; + memcmp(pnt, &nt, sizeof(struct message)); pnt++) + if (pnt->key & tcp_val) { + len_written += snprintf(buffer + len_written, + len - len_written, + "%s%s", incr ? + ",":"", pnt->str); + incr++; + } + return len_written; +} + +/* + */ +void zebra_pbr_show_ipset_list(struct vty *vty, char *ipsetname) +{ + struct zebra_pbr_ipset *zpi; + struct zebra_ns *zns = zebra_ns_lookup(NS_DEFAULT); + struct zebra_pbr_ipset_entry_unique_display unique; + struct zebra_pbr_env_display uniqueipset; + + if (ipsetname) { + zpi = zebra_pbr_lookup_ipset_pername(ipsetname); + if (!zpi) { + vty_out(vty, "No IPset %s found\n", ipsetname); + return; + } + vty_out(vty, "IPset %s type %s family %s\n", ipsetname, + zebra_pbr_ipset_type2str(zpi->type), + family2str(zpi->family)); + unique.vty = vty; + unique.zpi = zpi; + unique.zns = zns; + hash_walk(zrouter.ipset_entry_hash, + zebra_pbr_show_ipset_entry_walkcb, &unique); + return; + } + uniqueipset.zns = zns; + uniqueipset.vty = vty; + uniqueipset.name = NULL; + hash_walk(zrouter.ipset_hash, zebra_pbr_show_ipset_walkcb, + &uniqueipset); +} + +struct pbr_rule_fwmark_lookup { + struct zebra_pbr_rule *ptr; + uint32_t fwmark; +}; + +static int zebra_pbr_rule_lookup_fwmark_walkcb(struct hash_bucket *bucket, + void *arg) +{ + struct pbr_rule_fwmark_lookup *iprule = + (struct pbr_rule_fwmark_lookup *)arg; + struct zebra_pbr_rule *zpr = (struct zebra_pbr_rule *)bucket->data; + + if (iprule->fwmark == zpr->rule.filter.fwmark) { + iprule->ptr = zpr; + return HASHWALK_ABORT; + } + return HASHWALK_CONTINUE; +} + +static void zebra_pbr_show_iptable_unit(struct zebra_pbr_iptable *iptable, + struct vty *vty, + struct zebra_ns *zns) +{ + int ret; + uint64_t pkts = 0, bytes = 0; + + vty_out(vty, "IPtable %s family %s action %s (%u)\n", + iptable->ipset_name, + family2str(iptable->family), + iptable->action == ZEBRA_IPTABLES_DROP ? "drop" : "redirect", + iptable->unique); + if (iptable->type == IPSET_NET_PORT || + iptable->type == IPSET_NET_PORT_NET) { + if (!(iptable->filter_bm & MATCH_ICMP_SET)) { + if (iptable->filter_bm & PBR_FILTER_DST_PORT) + vty_out(vty, "\t lookup dst port\n"); + else if (iptable->filter_bm & PBR_FILTER_SRC_PORT) + vty_out(vty, "\t lookup src port\n"); + } + } + if (iptable->pkt_len_min || iptable->pkt_len_max) { + if (!iptable->pkt_len_max) + vty_out(vty, "\t pkt len %u\n", + iptable->pkt_len_min); + else + vty_out(vty, "\t pkt len [%u;%u]\n", + iptable->pkt_len_min, + iptable->pkt_len_max); + } + if (iptable->tcp_flags || iptable->tcp_mask_flags) { + char tcp_flag_str[64]; + char tcp_flag_mask_str[64]; + + zebra_pbr_tcpflags_snprintf(tcp_flag_str, + sizeof(tcp_flag_str), + iptable->tcp_flags); + zebra_pbr_tcpflags_snprintf(tcp_flag_mask_str, + sizeof(tcp_flag_mask_str), + iptable->tcp_mask_flags); + vty_out(vty, "\t tcpflags [%s/%s]\n", + tcp_flag_str, tcp_flag_mask_str); + } + if (iptable->filter_bm & (MATCH_DSCP_SET | MATCH_DSCP_INVERSE_SET)) { + vty_out(vty, "\t dscp %s %d\n", + iptable->filter_bm & MATCH_DSCP_INVERSE_SET ? + "not" : "", iptable->dscp_value); + } + if (iptable->filter_bm & (MATCH_FLOW_LABEL_SET | + MATCH_FLOW_LABEL_INVERSE_SET)) { + vty_out(vty, "\t flowlabel %s %d\n", + iptable->filter_bm & MATCH_FLOW_LABEL_INVERSE_SET ? + "not" : "", iptable->flow_label); + } + if (iptable->fragment) { + char val_str[10]; + + snprintf(val_str, sizeof(val_str), "%d", iptable->fragment); + vty_out(vty, "\t fragment%s %s\n", + iptable->filter_bm & MATCH_FRAGMENT_INVERSE_SET ? + " not" : "", lookup_msg(fragment_value_str, + iptable->fragment, val_str)); + } + if (iptable->protocol) { + vty_out(vty, "\t protocol %d\n", + iptable->protocol); + } + ret = hook_call(zebra_pbr_iptable_get_stat, iptable, &pkts, + &bytes); + if (ret && pkts > 0) + vty_out(vty, "\t pkts %" PRIu64 ", bytes %" PRIu64"\n", + pkts, bytes); + if (iptable->action != ZEBRA_IPTABLES_DROP) { + struct pbr_rule_fwmark_lookup prfl; + + prfl.fwmark = iptable->fwmark; + prfl.ptr = NULL; + hash_walk(zrouter.rules_hash, + &zebra_pbr_rule_lookup_fwmark_walkcb, &prfl); + if (prfl.ptr) { + struct zebra_pbr_rule *zpr = prfl.ptr; + + vty_out(vty, "\t table %u, fwmark %u\n", + zpr->rule.action.table, + prfl.fwmark); + } + } +} + +static int zebra_pbr_show_iptable_walkcb(struct hash_bucket *bucket, void *arg) +{ + struct zebra_pbr_iptable *iptable = + (struct zebra_pbr_iptable *)bucket->data; + struct zebra_pbr_env_display *env = (struct zebra_pbr_env_display *)arg; + struct vty *vty = env->vty; + struct zebra_ns *zns = env->zns; + char *iptable_name = env->name; + + if (!iptable_name) + zebra_pbr_show_iptable_unit(iptable, vty, zns); + else if (!strncmp(iptable_name, + iptable->ipset_name, + ZEBRA_IPSET_NAME_SIZE)) + zebra_pbr_show_iptable_unit(iptable, vty, zns); + return HASHWALK_CONTINUE; +} + +void zebra_pbr_show_iptable(struct vty *vty, char *iptable_name) +{ + struct zebra_ns *zns = zebra_ns_lookup(NS_DEFAULT); + struct zebra_pbr_env_display env; + + env.vty = vty; + env.zns = zns; + env.name = iptable_name; + hash_walk(zrouter.iptable_hash, zebra_pbr_show_iptable_walkcb, &env); +} + +void zebra_pbr_iptable_update_interfacelist(struct stream *s, + struct zebra_pbr_iptable *zpi) +{ + uint32_t i = 0, index; + struct interface *ifp; + char *name; + + for (i = 0; i < zpi->nb_interface; i++) { + STREAM_GETL(s, index); + ifp = if_lookup_by_index(index, zpi->vrf_id); + if (!ifp) + continue; + name = XSTRDUP(MTYPE_PBR_IPTABLE_IFNAME, ifp->name); + listnode_add(zpi->interface_name_list, name); + } +stream_failure: + return; +} |