mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-12 11:36:35 +00:00
96c63fa739
Currently, VRFs require 1 oif and 1 iif rule per address family per
VRF. As the number of VRF devices increases it brings scalability
issues with the increasing rule list. All of the VRF rules have the
same format with the exception of the specific table id to direct the
lookup. Since the table id is available from the oif or iif in the
loopup, the VRF rules can be consolidated to a single rule that pulls
the table from the VRF device.
This patch introduces a new rule attribute l3mdev. The l3mdev rule
means the table id used for the lookup is pulled from the L3 master
device (e.g., VRF) rather than being statically defined. With the
l3mdev rule all of the basic VRF FIB rules are reduced to 1 l3mdev
rule per address family (IPv4 and IPv6).
If an admin wishes to insert higher priority rules for specific VRFs
those rules will co-exist with the l3mdev rule. This capability means
current VRF scripts will co-exist with this new simpler implementation.
Currently, the rules list for both ipv4 and ipv6 look like this:
$ ip ru ls
1000: from all oif vrf1 lookup 1001
1000: from all iif vrf1 lookup 1001
1000: from all oif vrf2 lookup 1002
1000: from all iif vrf2 lookup 1002
1000: from all oif vrf3 lookup 1003
1000: from all iif vrf3 lookup 1003
1000: from all oif vrf4 lookup 1004
1000: from all iif vrf4 lookup 1004
1000: from all oif vrf5 lookup 1005
1000: from all iif vrf5 lookup 1005
1000: from all oif vrf6 lookup 1006
1000: from all iif vrf6 lookup 1006
1000: from all oif vrf7 lookup 1007
1000: from all iif vrf7 lookup 1007
1000: from all oif vrf8 lookup 1008
1000: from all iif vrf8 lookup 1008
...
32765: from all lookup local
32766: from all lookup main
32767: from all lookup default
With the l3mdev rule the list is just the following regardless of the
number of VRFs:
$ ip ru ls
1000: from all lookup [l3mdev table]
32765: from all lookup local
32766: from all lookup main
32767: from all lookup default
(Note: the above pretty print of the rule is based on an iproute2
prototype. Actual verbage may change)
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
74 lines
1.6 KiB
C
74 lines
1.6 KiB
C
#ifndef __LINUX_FIB_RULES_H
|
|
#define __LINUX_FIB_RULES_H
|
|
|
|
#include <linux/types.h>
|
|
#include <linux/rtnetlink.h>
|
|
|
|
/* rule is permanent, and cannot be deleted */
|
|
#define FIB_RULE_PERMANENT 0x00000001
|
|
#define FIB_RULE_INVERT 0x00000002
|
|
#define FIB_RULE_UNRESOLVED 0x00000004
|
|
#define FIB_RULE_IIF_DETACHED 0x00000008
|
|
#define FIB_RULE_DEV_DETACHED FIB_RULE_IIF_DETACHED
|
|
#define FIB_RULE_OIF_DETACHED 0x00000010
|
|
|
|
/* try to find source address in routing lookups */
|
|
#define FIB_RULE_FIND_SADDR 0x00010000
|
|
|
|
struct fib_rule_hdr {
|
|
__u8 family;
|
|
__u8 dst_len;
|
|
__u8 src_len;
|
|
__u8 tos;
|
|
|
|
__u8 table;
|
|
__u8 res1; /* reserved */
|
|
__u8 res2; /* reserved */
|
|
__u8 action;
|
|
|
|
__u32 flags;
|
|
};
|
|
|
|
enum {
|
|
FRA_UNSPEC,
|
|
FRA_DST, /* destination address */
|
|
FRA_SRC, /* source address */
|
|
FRA_IIFNAME, /* interface name */
|
|
#define FRA_IFNAME FRA_IIFNAME
|
|
FRA_GOTO, /* target to jump to (FR_ACT_GOTO) */
|
|
FRA_UNUSED2,
|
|
FRA_PRIORITY, /* priority/preference */
|
|
FRA_UNUSED3,
|
|
FRA_UNUSED4,
|
|
FRA_UNUSED5,
|
|
FRA_FWMARK, /* mark */
|
|
FRA_FLOW, /* flow/class id */
|
|
FRA_TUN_ID,
|
|
FRA_SUPPRESS_IFGROUP,
|
|
FRA_SUPPRESS_PREFIXLEN,
|
|
FRA_TABLE, /* Extended table id */
|
|
FRA_FWMASK, /* mask for netfilter mark */
|
|
FRA_OIFNAME,
|
|
FRA_PAD,
|
|
FRA_L3MDEV, /* iif or oif is l3mdev goto its table */
|
|
__FRA_MAX
|
|
};
|
|
|
|
#define FRA_MAX (__FRA_MAX - 1)
|
|
|
|
enum {
|
|
FR_ACT_UNSPEC,
|
|
FR_ACT_TO_TBL, /* Pass to fixed table */
|
|
FR_ACT_GOTO, /* Jump to another rule */
|
|
FR_ACT_NOP, /* No operation */
|
|
FR_ACT_RES3,
|
|
FR_ACT_RES4,
|
|
FR_ACT_BLACKHOLE, /* Drop without notification */
|
|
FR_ACT_UNREACHABLE, /* Drop with ENETUNREACH */
|
|
FR_ACT_PROHIBIT, /* Drop with EACCES */
|
|
__FR_ACT_MAX,
|
|
};
|
|
|
|
#define FR_ACT_MAX (__FR_ACT_MAX - 1)
|
|
|
|
#endif
|