Philippe Guibert [Thu, 17 Oct 2019 14:11:57 +0000 (16:11 +0200)]
bgpd: support for flowspec interface list per address-family
in addition to ipv4 flowspec, ipv6 flowspec address family can configure
its own list of interfaces to monitor. this permits filtering the policy
routing only on some interfaces.
Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
Philippe Guibert [Thu, 17 Oct 2019 14:08:16 +0000 (16:08 +0200)]
bgpd: support for bgp ipv6 ext community, and flowspec redirect ipv6
rfc 5701 is supported. it is possible to configure in bgp vpn, a list of
route target with ipv6 external communities to import. it is to be noted
that this ipv6 external community has been developed only for matching a
bgp flowspec update with same ipv6 ext commmunity.
adding to this, draft-ietf-idr-flow-spec-v6-09 is implemented regarding
the redirect ipv6 option.
Practically, under bgp vpn, under ipv6 unicast, it is possible to
configure : [no] rt6 redirect import <IPV6>:<AS> values.
An incoming bgp update with fs ipv6 and that option matching a bgp vrf,
will be imported in that bgp vrf.
Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
Philippe Guibert [Wed, 16 Oct 2019 09:07:41 +0000 (11:07 +0200)]
bgp, zebra: add family attribute to ipset and iptable context
in order to create appropriate policy route, family attribute is stored
in ipset and iptable zapi contexts. This commit also adds the flow label
attribute in iptables, for further usage.
Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
Philippe Guibert [Wed, 16 Oct 2019 08:05:36 +0000 (10:05 +0200)]
bgpd: support for redirect ipv6 simpson method
this commit supports [0] where ipv6 address is encoded in nexthop
attribute of nlri, and not in bgp redirect ip extended community. the
community contains only duplicate information or not.
Adding to this, because an action or a rule needs to apply to either
ipv4 or ipv6 flow, modify some internal structures so as to be aware of
which flow needs to be filtered. This work is needed when an ipv6
flowspec rule without ip addresses is mentioned, we need to know which
afi is served. Also, this work will be useful when doing redirect VRF.
[0] draft-simpson-idr-flowspec-redirect-02.txt
Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
Philippe Guibert [Wed, 16 Oct 2019 06:44:20 +0000 (08:44 +0200)]
bgpd, lib: support for flow_label flowspec type
in ipv6 flowspec, a new type is defined to be able to do filtering rules
based on 20 bits flow label field as depicted in [0]. The change include
the decoding by flowspec, and the addition of a new attribute in policy
routing rule, so that the data is ready to be sent to zebra.
The commit also includes a check on fragment option, since dont fragment
bit does not exist in ipv6, the value should always be set to 0,
otherwise the flowspec rule becomes invalid.
Philippe Guibert [Wed, 16 Oct 2019 06:42:30 +0000 (08:42 +0200)]
bgpd: ipv6 flowspec address decoding and validation
as per [0], ipv6 adress format introduces an ipv6 offset that needs to
be extracted too. The change include the validation, decoding for
further usage with policy-routing and decoding for dumping.
Philippe Guibert [Mon, 14 Oct 2019 16:02:22 +0000 (18:02 +0200)]
bgpd: flowspec code support for ipv6
until now, the assumption was done in bgp flowspec code that the
information contained was an ipv4 flowspec prefix. now that it is
possible to handle ipv4 or ipv6 flowspec prefixes, that information is
stored in prefix_flowspec attribute. Also, some unlocking is done in
order to process ipv4 and ipv6 flowspec entries.
Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
Philippe Guibert [Tue, 15 Oct 2019 13:01:39 +0000 (15:01 +0200)]
lib: add family attribute for flowspec prefix structure
to recognize whether a flowspec prefix has been carried out by
ipv4 flowspec or ipv6 flowspec ( actually, the hypothesis is that only
ipv4 flowspec is supported), then a new attribute should contain the
family value: AF_INET or AF_INET6. That value will be further used in
the BGP flowspec code.
Signed-off-by: Philippe Guibert <philippe.guibert@6wind.com>
Renato Westphal [Wed, 19 Aug 2020 23:33:40 +0000 (20:33 -0300)]
lib: adapt plugin to use new Sysrepo version
Sysrepo recently underwent a complete rewrite, where some substantial
architectural changes were made (the most important one being the
extinction of the sysrepod daemon). While most of the existing API
was preserved, quite a few backward-incompatible changes [1] were
introduced (mostly simplifications). This commit adapts our sysrepo
northbound plugin to those API changes in order for it to be compatible
with the latest Sysrepo version.
Additional notes:
* The old Sysrepo version is EOL and not supported anymore.
* The new Sysrepo version requires libyang 1.x.
Renato Westphal [Wed, 19 Aug 2020 22:48:21 +0000 (19:48 -0300)]
staticd: fix warning when creating routes without SR-TE colors
The SR-TE color YANG leaf is optional so it shouldn't be created
unconditionally (it doesn't have a default value).
Fixes warnings like this when routes are created without specifying
a SR-TE color:
STATIC: libyang: Invalid value "" in "srte-color" element.
(/frr-routing:routing/control-plane-protocols/control-plane-protocol[type='frr-s
taticd:staticd'][name='staticd'][vrf='default']/frr-staticd:staticd/route-list[p
refix='99.0.0.1/32'][afi-safi='frr-routing:ipv4-unicast']/path-list[distance='1'
]/frr-nexthops/nexthop[nh-type='ip4'][vrf='default'][gateway='192.168.1.2'][inte
rface='(null)']/srte-color)
Donald Sharp [Wed, 19 Aug 2020 14:11:06 +0000 (10:11 -0400)]
zebra: Add table id to debug output
There are a bunch of places where the table id is not being outputed
in debug messages for routing changes. Add in the table id we
are operating on. This is especially useful for the case where
pbr is working.
Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
Donald Sharp [Mon, 17 Aug 2020 17:52:19 +0000 (13:52 -0400)]
bgpd: Actually respect RFC 6286 for router_id
The RFC states:
The BGP Identifier is a 4-octet, unsigned, non-zero integer that
should be unique within an AS. The value of the BGP Identifier
for a BGP speaker is determined on startup and is the same for
every local interface and every BGP peer.
We were going slightly beyond this and ensuring that the address
was a specific range of addresses which is no longer relevant.
Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
Renato Westphal [Fri, 14 Aug 2020 22:49:41 +0000 (19:49 -0300)]
lib: don't ignore error messages generated during the commit apply phase
While a configuration transaction can't be rejected once it reaches
the APPLY phase, we should allow NB callbacks to generate error
or warning messages when a configuration change is being applied.
That should be useful, for example, to return warnings back to
the user informing that the applied configuration has some kind of
inconsistency or is missing something in order to be effectively
activated. The infrastructure for this was already present, but the
northbound layer was ignoring all errors/warnings generated during
the apply/abort phases instead of returning them to the user. This
commit changes that.
In the gRPC plugin, extend the Commit() RPC adding a new
"error_message" field to the response type. This is necessary to
allow errors/warnings to be returned even when the commit operation
succeeds (since grpc::Status::OK doesn't support error messages
like the other status codes).
isisd : Transformational changes to support different VRFs.
1. Created a structure "isis master".
2. All the changes are related to handle ISIS with different vrf.
3. A new variable added in structure "isis" to store the vrf name.
4. The display commands for isis is changed to support different VRFs.
Donald Sharp [Thu, 13 Aug 2020 00:59:47 +0000 (20:59 -0400)]
tools: Remove zebra commands that have never existed
The support bundle feature(tm) asks for some data
from zebra in the form of a command that has
never existed in FRR. Looks like some
cruft snuck in remove.
Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
Rafael Zalamena [Wed, 12 Aug 2020 11:26:45 +0000 (08:26 -0300)]
topotests: fix default BFD peer shutdown state
The commit `bfdd: simplify and remove duplicated code` fixed a problem
that was causing the protocol configuration to override the user
configuration.
In this test case: the peer was configured to be disabled (default is
`shutdown`) and the test was expecting it to get activated (`no shutdown`)
when the protocol converged. I changed the peer default state to
`no shutdown`, however another way to get the same effect is to
configure the protocol to use a profile or don't configure a peer at all
(and use the defaults).
Signed-off-by: Rafael Zalamena <rzalamena@opensourcerouting.org>
Donald Sharp [Wed, 12 Aug 2020 13:49:20 +0000 (09:49 -0400)]
lib: Properly handle POLLERR from poll()
There are situations where POLLERR will be returned. But
since we were not handling it. Thread processing effectively
is turned into an infinite loop, which is bad.
Modify the code so that if we receive a POLLERR we turn it
into a read event to be handled as an error from the handler
function.
Chirag Shah [Fri, 7 Aug 2020 20:01:58 +0000 (13:01 -0700)]
zebra: Revert "zebra: probe local inactive neigh"
Reverting probing of neigh entry. There is a timing where
probe and remote macip add request comes at the same time resulting
in neigh to remain in local state event though it should be remote.
In mobility case, the host moves to remote VTEP, first MAC only type-2
route is received which triggers a PROBE of neighs (associated to MAC).
PROBE request can go via network port to remote VTEP.
PROBE request picks up local neigh with MAC entry's outgoing port is
remote VTEP tunnel port.
The PROBE reply and MAC-IP (containing IP) almost comes same time at
DUT.
DUT first processes remote macip and installs neigh as remote.
Followed by receives neigh as REACHABLE which marks neigh as LOCAL.
FRR does have BPF filter which does not allow its own netlink request
to receive. Otherwise frr's request to program neigh as remote can move
neigh from local to remote.
Though ordering can not be guranteed that REACHABLE (PROBE's repsonse)
can come at anytime and move it to LOCAL.
This fix would not suffice the needs of converging LOCAL inactive neighs
to remove from DB. As mobility draft sugges to PROBE local neigh when
MAC moves to remote but it is not working with current framework.
Warning logs -
Logic error: Dereference of null pointer in zebra_evpn_mh.c, function zebra_evpn_es_evi_show_vni, line 360
See https://ci1.netdef.org/browse/FRR-FRRPULLREQ-13544/artifact/shared/static_analysis/report-b1eb72.html#EndPath
Pat Ruddy [Thu, 23 Jul 2020 21:51:10 +0000 (14:51 -0700)]
zebra: rename vni to evpn where appropriate
The main zebra_vni_t hash structure has been renamed to zebra_evpn_t
to allow for other transport underlays. Rename functions and variables
to reflect this change.
Sebastien Merle [Fri, 14 Feb 2020 14:49:25 +0000 (14:49 +0000)]
staticd: add support for SR Policies
Configuration example:
ip route 9.9.9.9/32 6.6.6.6 color 123
The SR Policy to be chosen is uniquely identified by the policy
endpoint (6.6.6.6) and the SR-TE color (123). Traffic will be
augmented with an MPLS label stack according to the active
candidate path of that particular policy.
Renato Westphal [Tue, 11 Aug 2020 23:58:00 +0000 (20:58 -0300)]
grpc: relicense the northbound service description file
The GPL license is too restrictive and can "contaminate" client scripts
using language bindings auto-generated from this file. We don't want
this to happen. Adopt the BSD-2-Clause license to avoid any problem
of this nature.
Quentin Young [Tue, 11 Aug 2020 18:24:56 +0000 (14:24 -0400)]
vrrpd: log errmsg, stricter nb validation
* When failing a config transaction due to a VRID conflict, describe the
error in the provided space
* When validating, allow the NB userdata lookup for interface object to
soft fail; but when applying, assert if it does not exist
projects / mirror / frr.git / log