tunnel: add vxlan support

This patch extends the tunnel metadata object to define vxlan tunnel
specific configurations:

table netdev x {
	tunnel y {
		id 10
		ip saddr 192.168.2.10
		ip daddr 192.168.2.11
		sport 10
		dport 20
		ttl 10
		vxlan {
			gbp 200
		}
	}
}

Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/rule.h b/include/rule.h
index 71e9a07ebf83c9511b91eec071a10f8215bddb46..c52af2c49156fc03cb1b96893b90ad414670e308 100644 (file)
--- a/include/rule.h
+++ b/include/rule.h
@@ -495,6 +495,7 @@ struct secmark {
 enum tunnel_type {
        TUNNEL_UNSPEC = 0,
        TUNNEL_ERSPAN,
+       TUNNEL_VXLAN,
 };
 
 struct tunnel {
@@ -517,6 +518,9 @@ struct tunnel {
                                uint8_t         hwid;
                        } v2;
                } erspan;
+               struct {
+                       uint32_t        gbp;
+               } vxlan;
        };
 };
 

diff --git a/src/mnl.c b/src/mnl.c
index 4952a19464a82594ec264b59cfdc35c6f9177d2e..0949a694b0b64ec8df1f9b8c977eccbdf0da3d9e 100644 (file)
--- a/src/mnl.c
+++ b/src/mnl.c
@@ -1513,6 +1513,22 @@ static void obj_tunnel_add_opts(struct nftnl_obj *nlo, struct tunnel *tunnel)
                        break;
                }
 
+               nftnl_tunnel_opts_add(opts, opt);
+               nftnl_obj_set_data(nlo, NFTNL_OBJ_TUNNEL_OPTS, &opts, sizeof(struct nftnl_tunnel_opts *));
+               break;
+       case TUNNEL_VXLAN:
+               opts = nftnl_tunnel_opts_alloc(NFTNL_TUNNEL_TYPE_VXLAN);
+               if (!opts)
+                       memory_allocation_error();
+
+               opt = nftnl_tunnel_opt_alloc(NFTNL_TUNNEL_TYPE_VXLAN);
+               if (!opt)
+                       memory_allocation_error();
+
+               nftnl_tunnel_opt_set(opt, NFTNL_TUNNEL_VXLAN_GBP,
+                                    &tunnel->vxlan.gbp,
+                                    sizeof(tunnel->vxlan.gbp));
+
                nftnl_tunnel_opts_add(opts, opt);
                nftnl_obj_set_data(nlo, NFTNL_OBJ_TUNNEL_OPTS, &opts, sizeof(struct nftnl_tunnel_opts *));
                break;

diff --git a/src/netlink.c b/src/netlink.c
index 4ef88402451b1ff2ae08c6e23d8f1547f87b7c11..e132362bc93ffdcfea2405fb42523c9a51164b44 100644 (file)
--- a/src/netlink.c
+++ b/src/netlink.c
@@ -1836,6 +1836,13 @@ static int tunnel_parse_opt_cb(struct nftnl_tunnel_opt *opt, void *data) {
                                                        NFTNL_TUNNEL_ERSPAN_V2_DIR);
                }
                break;
+       case NFTNL_TUNNEL_TYPE_VXLAN:
+               obj->tunnel.type = TUNNEL_VXLAN;
+               if (nftnl_tunnel_opt_get_flags(opt) & (1 << NFTNL_TUNNEL_VXLAN_GBP)) {
+                       obj->tunnel.type = TUNNEL_VXLAN;
+                       obj->tunnel.vxlan.gbp = nftnl_tunnel_opt_get_u32(opt, NFTNL_TUNNEL_VXLAN_GBP);
+               }
+               break;
        default:
                break;
        }

diff --git a/src/parser_bison.y b/src/parser_bison.y
index 08d75dbba2cdab6abfcd9dd17d00d8e55b9904c8..ca93a658a7a6825f1d83fe4112a9f5060376332b 100644 (file)
--- a/src/parser_bison.y
+++ b/src/parser_bison.y
@@ -612,6 +612,7 @@ int nft_lex(void *, void *, void *);
 %token ERSPAN                  "erspan"
 %token EGRESS                  "egress"
 %token INGRESS                 "ingress"
+%token GBP                     "gbp"
 
 %token COUNTERS                        "counters"
 %token QUOTAS                  "quotas"
@@ -770,7 +771,7 @@ int nft_lex(void *, void *, void *);
 %type <flowtable>              flowtable_block_alloc flowtable_block
 %destructor { flowtable_free($$); }    flowtable_block_alloc
 
-%type <obj>                    obj_block_alloc counter_block quota_block ct_helper_block ct_timeout_block ct_expect_block limit_block secmark_block synproxy_block tunnel_block erspan_block erspan_block_alloc
+%type <obj>                    obj_block_alloc counter_block quota_block ct_helper_block ct_timeout_block ct_expect_block limit_block secmark_block synproxy_block tunnel_block erspan_block erspan_block_alloc vxlan_block vxlan_block_alloc
 %destructor { obj_free($$); }  obj_block_alloc
 
 %type <list>                   stmt_list stateful_stmt_list set_elem_stmt_list
@@ -5011,6 +5012,27 @@ erspan_config            :       HDRVERSION      NUM
                        }
                        ;
 
+vxlan_block            :       /* empty */     { $$ = $<obj>-1; }
+                       |       vxlan_block     common_block
+                       |       vxlan_block     stmt_separator
+                       |       vxlan_block     vxlan_config    stmt_separator
+                       {
+                               $$ = $1;
+                       }
+                       ;
+
+vxlan_block_alloc      :       /* empty */
+                       {
+                               $$ = $<obj>-1;
+                       }
+                       ;
+
+vxlan_config           :       GBP     NUM
+                       {
+                               $<obj>0->tunnel.vxlan.gbp = $2;
+                       }
+                       ;
+
 tunnel_config          :       ID      NUM
                        {
                                $<obj>0->tunnel.id = $2;
@@ -5055,6 +5077,10 @@ tunnel_config            :       ID      NUM
                        {
                                $<obj>0->tunnel.type = TUNNEL_ERSPAN;
                        }
+                       |       VXLAN   vxlan_block_alloc '{' vxlan_block '}'
+                       {
+                               $<obj>0->tunnel.type = TUNNEL_VXLAN;
+                       }
                        ;
 
 tunnel_block           :       /* empty */     { $$ = $<obj>-1; }

diff --git a/src/rule.c b/src/rule.c
index 2557f4cc1d7222a86476c37e4a360f023a5d0d31..0450851c6501a5802406544e66b90b6cf81e3bc3 100644 (file)
--- a/src/rule.c
+++ b/src/rule.c
@@ -2043,6 +2043,16 @@ static void obj_print_data(const struct obj *obj,
                        }
                        nft_print(octx, "%s%s%s}",
                                  opts->nl, opts->tab, opts->tab);
+                       break;
+               case TUNNEL_VXLAN:
+                       nft_print(octx, "%s%s%svxlan {",
+                                 opts->nl, opts->tab, opts->tab);
+                       nft_print(octx, "%s%s%s%sgbp %u",
+                                 opts->nl, opts->tab, opts->tab, opts->tab,
+                                 obj->tunnel.vxlan.gbp);
+                       nft_print(octx, "%s%s%s}",
+                                 opts->nl, opts->tab, opts->tab);
+                       break;
                default:
                        break;
                }

diff --git a/src/scanner.l b/src/scanner.l
index 9695d710a01c37006ae06085146bbafcd88f0331..74ebca3b133f05620cb52a6b9700b6e9e139f157 100644 (file)
--- a/src/scanner.l
+++ b/src/scanner.l
@@ -827,6 +827,7 @@ addrstring  ({macaddr}|{ip4addr}|{ip6addr})
        "egress"                { return EGRESS; }
        "ingress"               { return INGRESS; }
        "path"                  { return PATH; }
+       "gbp"                   { return GBP; }
 }
 
 "notrack"              { return NOTRACK; }