Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

zebra: add PBR script wrapper framework to interact with script #2025

Closed
wants to merge 12 commits into from
Closed

zebra: add PBR script wrapper framework to interact with script #2025

wants to merge 12 commits into from

Commits on Apr 30, 2018

  1. zebra: rework pbr ipset entry 

    Add ns_id into zebra_pbr ipset
This is important so that each ipset entry knows on which NETNS the
ipset entry must be inkected

Signed-off-by: Philippe Guibert <[email protected]>
    @pguibert6WIND
    pguibert6WIND committed Apr 30, 2018
    Configuration menu
    Copy the full SHA
    dd4bf36 View commit details
    Browse the repository at this point in the history

  2. zebra: ipset and ipset entry deletion remove entry from hash list too 

    This commit is a fix that removes the structure from the hash list,
instead of just removing that structure.

Signed-off-by: Philippe Guibert <[email protected]>
    @pguibert6WIND
    pguibert6WIND committed Apr 30, 2018
    Configuration menu
    Copy the full SHA
    1cf1283 View commit details
    Browse the repository at this point in the history

  3. zebra: cleanup zebra policy context 

    Upon the remote daemon leaving, some contexts may have to be flushed.
This commit does the change. IPset and IPSet Entries and iptables are
flushed.

Signed-off-by: Philippe Guibert <[email protected]>
    @pguibert6WIND
    pguibert6WIND committed Apr 30, 2018
    Configuration menu
    Copy the full SHA
    5406e48 View commit details
    Browse the repository at this point in the history

  4. zebra: handle notification in case pbr ipset, or iptables is removed 

    In cast the removal of an iptable or an ipset pbr context is done,
then a notification is sent back to the relevant daemon that sent the
message.

Signed-off-by: Philippe Guibert <[email protected]>
    @pguibert6WIND
    pguibert6WIND committed Apr 30, 2018
    Configuration menu
    Copy the full SHA
    c86ef2e View commit details
    Browse the repository at this point in the history

  5. zebra: add netlink rule support for fwmark option 

    When a mark is set, incoming traffic having that mark set can be
redirected to a specific table identifier. This work is done through
netlink.

Signed-off-by: Philippe Guibert <[email protected]>
    @pguibert6WIND
    pguibert6WIND committed Apr 30, 2018
    Configuration menu
    Copy the full SHA
    d058854 View commit details
    Browse the repository at this point in the history

  6. zebra: add script wrapper framework to interact with script 

    This framework has 2 APIs,
- able to execute script show command, and return the output in
a json structure. Those script show command are tighted with iptables
and ipset output.
- able to analyse json tree, and extract pkts and bytes values.

This framework permits gaining time, since it allows frr to call some
external programs and rely on externals like the output.
This framework relies on plugin module. This module is called
zebra_wrap_script.

Signed-off-by: Philippe Guibert <[email protected]>
    @pguibert6WIND
    pguibert6WIND committed Apr 30, 2018
    Configuration menu
    Copy the full SHA
    f3fd193 View commit details
    Browse the repository at this point in the history

  7. doc: add wrap_script module in documentation 

    update documentation with zebra module script.

Signed-off-by: Philippe Guibert <[email protected]>
    @pguibert6WIND
    pguibert6WIND committed Apr 30, 2018
    Configuration menu
    Copy the full SHA
    911d32c View commit details
    Browse the repository at this point in the history

  8. zebra: add wrap script handlers for iptable/ipset config 

    In order to configure iptables, ipset entries and ipset contexts, 2
script handlers apis are available to pass scripts commands.

Signed-off-by: Philippe Guibert <[email protected]>
    @pguibert6WIND
    pguibert6WIND committed Apr 30, 2018
    Configuration menu
    Copy the full SHA
    0805728 View commit details
    Browse the repository at this point in the history

  9. zebra: add wrap_script_node to handle vty commands for wrap_script 

    This preparatory work introduces a new node that will be used to add vty
configuration commands, and the associated show running.

Signed-off-by: Philippe Guibert <[email protected]>
    @pguibert6WIND
    pguibert6WIND committed Apr 30, 2018
    Configuration menu
    Copy the full SHA
    a15f95f View commit details
    Browse the repository at this point in the history

  10. zebra: add vty command to configure target ip script 

    3 new vty commands permit to configure zebra wrap ip scripts:
- [no] wrap script ipset <>
- [no] wrap script iptable <>
- [no] wrap script iprule <>

Signed-off-by: Philippe Guibert <[email protected]>
    @pguibert6WIND
    pguibert6WIND committed Apr 30, 2018
    Configuration menu
    Copy the full SHA
    80f5d33 View commit details
    Browse the repository at this point in the history

  11. zebra: PBR configuration handlers may call wrap script handlers 

    The following PBR handlers: ip rule, ipset, and iptables will prioritary
call the wrap script handlers. If the script handler is not present ( or
returns 0 - that is why the script handlers may not return 0), then if
available an other configuration call may be called. This is the case
with ip rule PBR handler that also has a netlink API. This mechanism
guarantees that if wrap script can configure it, then no need to use
netlink.

Signed-off-by: Philippe Guibert <[email protected]>
    @pguibert6WIND
    pguibert6WIND committed Apr 30, 2018
    Configuration menu
    Copy the full SHA
    67b517c View commit details
    Browse the repository at this point in the history

  12. zebra: pbr vty show command for ipset and iptables 

    Two new vty show functions available:
show pbr ipset <NAME>
show pbr iptables <NAME>

Those function dump the underlying "kernel" contexts. It relies on the
zebra pbr contexts first. This helps then to know which zebra pbr
context has been configured since those contexts are mainly configured
by BGP Flowspec.
Also, it relies on zebra wrap context API. From this wrap API, it gets
some statistics information to know which context has been matching how
many packets and bytes.

Signed-off-by: Philippe Guibert <[email protected]>
    @pguibert6WIND
    pguibert6WIND committed Apr 30, 2018
    Configuration menu
    Copy the full SHA
    17e3736 View commit details
    Browse the repository at this point in the history