zebra, lib: store relative default ns id in each namespace
to be able to retrieve the network namespace identifier for each
namespace, the ns id is stored in each ns context. For default
namespace, the netns id is the same as that value.
Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
zebra, lib: add an internal API to get relative default nsid in other ns
as remind, the netns identifiers are local to a namespace. that is to
say that for instance, a vrf <vrfx> will have a netns id value in one
netns, and have an other netns id value in one other netns.
There is a need for zebra daemon to collect some cross information, like
the LINK_NETNSID information from interfaces having link layer in an
other network namespace. For that, it is needed to have a global
overview instead of a relative overview per namespace.
The first brick of this change is an API that sticks to netlink API,
that uses NETNSA_TARGET_NSID. from a given vrf vrfX, and a new vrf
created vrfY, the API returns the value of nsID from vrfX, inside the
new vrf vrfY.
The brick also gets the ns id value of default namespace in each other
namespace. An additional value in ns.h is offered, that permits to
retrieve the default namespace context.
Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
zebra: map vxlan interface to bridge interface with correct ns id
an incoming bridge index has been found, that is linked with vxlan
interface, and the search for that bridge interface is done. In
vrf-lite, the search is done across the same default namespace, because
bridge and vxlan may not be in the same vrf. But this behaviour is wrong
when using vrf netns backend, as the bridge and the vxlan have to be in
the same vrf ( hence in the same network namespace). To comply with
that, use the netnamespace of the vxlan interface. Like that, the
appropriate nsid is passed as parameter, and consequently, the search is
correct, and the mac address passed to BGP will be ok too.
Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
Philippe Guibert [Thu, 26 Sep 2019 16:49:59 +0000 (18:49 +0200)]
zebra: importation of bgp evpn rt5 from vni with other netns
With vrf-lite mechanisms, it is possible to create layer 3 vnis by
creating a bridge interface in default vr, by creating a vxlan interface
that is attached to that bridge interface, then by moving the vxlan
interface to the wished vrf.
With vrf-netns mechanism, it is slightly different since bridged
interfaces can not be separated in different network namespaces. To make
it work, the setup consists in :
- creating a vxlan interface on default vrf.
- move the vxlan interface to the wished vrf ( with an other netns)
- create a bridge interface in the wished vrf
- attach the vxlan interface to that bridged interface
from that point, if BGP is enabled to advertise vnis in default vrf,
then vxlan interfaces are discovered appropriately in other vrfs,
provided that the link interface still resides in the vrf where l2vpn is
advertised.
to import ipv4 entries from a separate vrf, into the l2vpn, the
configuration of vni in the dedicated vrf + the advertisement of ipv4
entries in bgp vrf will import the entries in the bgp l2vpn.
the modification consists in parsing the vxlan interfaces in all network
namespaces, where the link resides in the same network namespace as the
bgp core instance where bgp l2vpn is enabled.
Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
Donald Sharp [Mon, 17 Aug 2020 17:52:19 +0000 (13:52 -0400)]
bgpd: Actually respect RFC 6286 for router_id
The RFC states:
The BGP Identifier is a 4-octet, unsigned, non-zero integer that
should be unique within an AS. The value of the BGP Identifier
for a BGP speaker is determined on startup and is the same for
every local interface and every BGP peer.
We were going slightly beyond this and ensuring that the address
was a specific range of addresses which is no longer relevant.
Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
isisd : Transformational changes to support different VRFs.
1. Created a structure "isis master".
2. All the changes are related to handle ISIS with different vrf.
3. A new variable added in structure "isis" to store the vrf name.
4. The display commands for isis is changed to support different VRFs.
Donald Sharp [Thu, 13 Aug 2020 00:59:47 +0000 (20:59 -0400)]
tools: Remove zebra commands that have never existed
The support bundle feature(tm) asks for some data
from zebra in the form of a command that has
never existed in FRR. Looks like some
cruft snuck in remove.
Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
Rafael Zalamena [Wed, 12 Aug 2020 11:26:45 +0000 (08:26 -0300)]
topotests: fix default BFD peer shutdown state
The commit `bfdd: simplify and remove duplicated code` fixed a problem
that was causing the protocol configuration to override the user
configuration.
In this test case: the peer was configured to be disabled (default is
`shutdown`) and the test was expecting it to get activated (`no shutdown`)
when the protocol converged. I changed the peer default state to
`no shutdown`, however another way to get the same effect is to
configure the protocol to use a profile or don't configure a peer at all
(and use the defaults).
Signed-off-by: Rafael Zalamena <rzalamena@opensourcerouting.org>
Donald Sharp [Wed, 12 Aug 2020 13:49:20 +0000 (09:49 -0400)]
lib: Properly handle POLLERR from poll()
There are situations where POLLERR will be returned. But
since we were not handling it. Thread processing effectively
is turned into an infinite loop, which is bad.
Modify the code so that if we receive a POLLERR we turn it
into a read event to be handled as an error from the handler
function.
Chirag Shah [Fri, 7 Aug 2020 20:01:58 +0000 (13:01 -0700)]
zebra: Revert "zebra: probe local inactive neigh"
Reverting probing of neigh entry. There is a timing where
probe and remote macip add request comes at the same time resulting
in neigh to remain in local state event though it should be remote.
In mobility case, the host moves to remote VTEP, first MAC only type-2
route is received which triggers a PROBE of neighs (associated to MAC).
PROBE request can go via network port to remote VTEP.
PROBE request picks up local neigh with MAC entry's outgoing port is
remote VTEP tunnel port.
The PROBE reply and MAC-IP (containing IP) almost comes same time at
DUT.
DUT first processes remote macip and installs neigh as remote.
Followed by receives neigh as REACHABLE which marks neigh as LOCAL.
FRR does have BPF filter which does not allow its own netlink request
to receive. Otherwise frr's request to program neigh as remote can move
neigh from local to remote.
Though ordering can not be guranteed that REACHABLE (PROBE's repsonse)
can come at anytime and move it to LOCAL.
This fix would not suffice the needs of converging LOCAL inactive neighs
to remove from DB. As mobility draft sugges to PROBE local neigh when
MAC moves to remote but it is not working with current framework.
Warning logs -
Logic error: Dereference of null pointer in zebra_evpn_mh.c, function zebra_evpn_es_evi_show_vni, line 360
See https://ci1.netdef.org/browse/FRR-FRRPULLREQ-13544/artifact/shared/static_analysis/report-b1eb72.html#EndPath
Pat Ruddy [Thu, 23 Jul 2020 21:51:10 +0000 (14:51 -0700)]
zebra: rename vni to evpn where appropriate
The main zebra_vni_t hash structure has been renamed to zebra_evpn_t
to allow for other transport underlays. Rename functions and variables
to reflect this change.
Sebastien Merle [Fri, 14 Feb 2020 14:49:25 +0000 (14:49 +0000)]
staticd: add support for SR Policies
Configuration example:
ip route 9.9.9.9/32 6.6.6.6 color 123
The SR Policy to be chosen is uniquely identified by the policy
endpoint (6.6.6.6) and the SR-TE color (123). Traffic will be
augmented with an MPLS label stack according to the active
candidate path of that particular policy.
Renato Westphal [Tue, 11 Aug 2020 23:58:00 +0000 (20:58 -0300)]
grpc: relicense the northbound service description file
The GPL license is too restrictive and can "contaminate" client scripts
using language bindings auto-generated from this file. We don't want
this to happen. Adopt the BSD-2-Clause license to avoid any problem
of this nature.
Quentin Young [Tue, 11 Aug 2020 18:24:56 +0000 (14:24 -0400)]
vrrpd: log errmsg, stricter nb validation
* When failing a config transaction due to a VRID conflict, describe the
error in the provided space
* When validating, allow the NB userdata lookup for interface object to
soft fail; but when applying, assert if it does not exist
Rafael Zalamena [Thu, 6 Aug 2020 19:25:44 +0000 (16:25 -0300)]
bfdd: implement passive mode
The passive mode is briefly described in the RFC 5880 Bidirectional
Forwarding Detection (BFD), Section 6.1. Overview:
> A system may take either an Active role or a Passive role in session
> initialization. A system taking the Active role MUST send BFD
> Control packets for a particular session, regardless of whether it
> has received any BFD packets for that session. A system taking the
> Passive role MUST NOT begin sending BFD packets for a particular
> session until it has received a BFD packet for that session, and thus
> has learned the remote system's discriminator value. At least one
> system MUST take the Active role (possibly both). The role that a
> system takes is specific to the application of BFD, and is outside
> the scope of this specification.
Signed-off-by: Rafael Zalamena <rzalamena@opensourcerouting.org>
Quentin Young [Thu, 30 Jul 2020 20:44:46 +0000 (16:44 -0400)]
vrrpd: fix improper NB query during validation
We were querying the NB for an interface and expecting it to exist, but
we were doing this during a validation run when the interface hasn't yet
been created, resulting in an abort. Adjust validation checks to handle
this scenario.
Quentin Young [Tue, 2 Jun 2020 19:33:05 +0000 (15:33 -0400)]
vrrpd: don't allow autocreated vr's in NB layer
Changing properties on an autoconfigured VRRP instance results in its
pointer being stored as a userdata in the NB tree, leading to UAF when
autoconfigure deletes the instance and then later NB operations take
place using the now-stale pointer.
Ticket: CM-29850 Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
Renato Westphal [Tue, 11 Aug 2020 02:20:05 +0000 (23:20 -0300)]
isisd: make calculation of the SPF run duration more correct
Don't use the same starting time for all SPF trees otherwise the
results won't be accurate (they will accumulate instead of being
computed separately).
Renato Westphal [Tue, 11 Aug 2020 02:09:12 +0000 (23:09 -0300)]
isisd: introduce per-area list of IS-IS adjacencies
This should simplify all code that needs to iterate over all
adjacencies of a given area (iterating over all adjacencies of all
circuits is cumbersome).
While here, repurpose isis_adj_exists() into a lookup function,
making it more generally useful.
Renato Westphal [Mon, 10 Aug 2020 15:23:14 +0000 (12:23 -0300)]
isisd: modify signature of isis_area_destroy()
Make that function accept an IS-IS area pointer instead of an
area name, making it more in line with the rest of the code base
(*delete() functions shouldn't perform lookups internally).
Renato Westphal [Mon, 10 Aug 2020 16:11:19 +0000 (13:11 -0300)]
isisd: don't display summary information of inactive SPF instances
This fixes a problem where "show isis summary" could display
inconsistent information about the IPv6 dst-src SPT when
"ipv6-dstsrc" wasn't explicitly configured.