Basic VRF support

Add basic VRF (virtual routing and forwarding) support. Protocols can be
associated with VRFs, such protocols will be restricted to interfaces
assigned to the VRF (as reported by Linux kernel) and will use sockets
bound to the VRF. E.g., different multihop BGP instances can use diffent
kernel routing tables to handle BGP TCP connections.

The VRF support is preliminary, currently there are several limitations:

- Recent Linux kernels (4.11) do not handle correctly sockets bound
to interaces that are part of VRF, so most protocols other than multihop
BGP do not work. This will be fixed by future kernel versions.

- Neighbor cache ignores VRFs. Breaks config with the same prefix on
local interfaces in different VRFs. Not much problem as single hop
protocols do not work anyways.

- Olock code ignores VRFs. Breaks config with multiple BGP peers with the
same IP address in different VRFs.

- Incoming BGP connections are not dispatched according to VRFs.
Breaks config with multiple BGP peers with the same IP address in
different VRFs. Perhaps we would need some kernel API to read VRF of
incoming connection? Or probably use multiple listening sockets in
int-new branch.

- We should handle master VRF interface up/down events and perhaps
disable associated protocols when VRF goes down. Or at least disable
associated interfaces.

- Also we should check if the master iface is really VRF iface and
not some other kind of master iface.

- BFD session request dispatch should be aware of VRFs.

- Perhaps kernel protocol should read default kernel table ID from VRF
iface so it is not necessary to configure it.

- Perhaps we should have per-VRF default table.

diff --git a/doc/bird.sgml b/doc/bird.sgml
index 516f4c6e57a4149587f008796ebff270b622a5da..03d37f46a3b7319231e2a58c7ed732f4bf853360 100644 (file)
--- a/doc/bird.sgml
+++ b/doc/bird.sgml
@@ -598,6 +598,15 @@ agreement").
 
        <tag><label id="proto-table">table <m/name/</tag>
        Connect this protocol to a non-default routing table.
+
+       <tag><label id="proto-vrf">vrf "<m/text/"</tag>
+       Associate the protocol with specific VRF. The protocol will be
+       restricted to interfaces assigned to the VRF and will use sockets bound
+       to the VRF. Appropriate VRF interface must exist on OS level. For kernel
+       protocol, an appropriate table still must be explicitly selected by
+       <cf/table/ option. Note that the VRF support in BIRD and Linux kernel
+       (4.11) is still in development and is currently problematic outside of
+       multihop BGP.
 </descrip>
 
 <p>There are several options that give sense only with certain protocols:

diff --git a/lib/socket.h b/lib/socket.h
index 2da5212756a6a9e497faad259ac6af4e1016b7b7..0769489b212d3d87fdbfc14eaa92874a42288a3a 100644 (file)
--- a/lib/socket.h
+++ b/lib/socket.h
@@ -26,6 +26,7 @@ typedef struct birdsock {
   int ttl;                             /* Time To Live, -1 = default */
   u32 flags;
   struct iface *iface;                 /* Interface; specify this for broad/multicast sockets */
+  struct iface *vrf;                   /* Related VRF instance, NULL if global */
 
   byte *rbuf, *rpos;                   /* NULL=allocate automatically */
   uint fast_rx;                                /* RX has higher priority in event loop */

diff --git a/nest/config.Y b/nest/config.Y
index 878224fea4baabc7a9460689da5562a0df5f019b..025e896955ade054e27c54c496636b9643ef4c1e 100644 (file)
--- a/nest/config.Y
+++ b/nest/config.Y
@@ -55,7 +55,7 @@ get_passwords(void)
 CF_DECLS
 
 CF_KEYWORDS(ROUTER, ID, PROTOCOL, TEMPLATE, PREFERENCE, DISABLED, DEBUG, ALL, OFF, DIRECT)
-CF_KEYWORDS(INTERFACE, IMPORT, EXPORT, FILTER, NONE, TABLE, STATES, ROUTES, FILTERS)
+CF_KEYWORDS(INTERFACE, IMPORT, EXPORT, FILTER, NONE, VRF, TABLE, STATES, ROUTES, FILTERS)
 CF_KEYWORDS(RECEIVE, LIMIT, ACTION, WARN, BLOCK, RESTART, DISABLE, KEEP, FILTERED)
 CF_KEYWORDS(PASSWORD, FROM, PASSIVE, TO, ID, EVENTS, PACKETS, PROTOCOLS, INTERFACES)
 CF_KEYWORDS(ALGORITHM, KEYED, HMAC, MD5, SHA1, SHA256, SHA384, SHA512)
@@ -227,6 +227,7 @@ proto_item:
  | IMPORT LIMIT limit_spec { this_proto->in_limit = $3; }
  | EXPORT LIMIT limit_spec { this_proto->out_limit = $3; }
  | IMPORT KEEP FILTERED bool { this_proto->in_keep_filtered = $4; }
+ | VRF TEXT { this_proto->vrf = if_get_by_name($2); }
  | TABLE rtable { this_proto->table = $2; }
  | ROUTER ID idval { this_proto->router_id = $3; }
  | DESCRIPTION text { this_proto->dsc = $2; }

diff --git a/nest/iface.c b/nest/iface.c
index ff362938e8922798a625a47f66e06116fac59e5d..3dd4506538a3962ee4156fd4b753635a7b3266d0 100644 (file)
--- a/nest/iface.c
+++ b/nest/iface.c
@@ -116,7 +116,7 @@ if_what_changed(struct iface *i, struct iface *j)
   unsigned c;
 
   if (((i->flags ^ j->flags) & ~(IF_UP | IF_SHUTDOWN | IF_UPDATED | IF_ADMIN_UP | IF_LINK_UP | IF_TMP_DOWN | IF_JUST_CREATED))
-      || i->index != j->index)
+      || (i->index != j->index) || (i->master != j->master))
     return IF_CHANGE_TOO_MUCH;
   c = 0;
   if ((i->flags ^ j->flags) & IF_UP)
@@ -133,12 +133,14 @@ if_copy(struct iface *to, struct iface *from)
 {
   to->flags = from->flags | (to->flags & IF_TMP_DOWN);
   to->mtu = from->mtu;
+  to->master_index = from->master_index;
+  to->master = from->master;
 }
 
 static inline void
 ifa_send_notify(struct proto *p, unsigned c, struct ifa *a)
 {
-  if (p->ifa_notify)
+  if (p->ifa_notify && (!p->vrf || p->vrf == a->iface->master))
     {
       if (p->debug & D_IFACES)
        log(L_TRACE "%s <%s address %I/%d on interface %s %s",
@@ -175,7 +177,7 @@ ifa_notify_change(unsigned c, struct ifa *a)
 static inline void
 if_send_notify(struct proto *p, unsigned c, struct iface *i)
 {
-  if (p->if_notify)
+  if (p->if_notify && (!p->vrf || p->vrf == i->master))
     {
       if (p->debug & D_IFACES)
        log(L_TRACE "%s < interface %s %s", p->name, i->name,
@@ -238,7 +240,8 @@ if_recalc_flags(struct iface *i, unsigned flags)
 {
   if ((flags & (IF_SHUTDOWN | IF_TMP_DOWN)) ||
       !(flags & IF_ADMIN_UP) ||
-      !i->addr)
+      !i->addr ||
+      (i->master_index && !i->master))
     flags &= ~IF_UP;
   else
     flags |= IF_UP;
@@ -771,7 +774,13 @@ if_show(void)
       if (i->flags & IF_SHUTDOWN)
        continue;
 
-      cli_msg(-1001, "%s %s (index=%d)", i->name, (i->flags & IF_UP) ? "up" : "DOWN", i->index);
+      char mbuf[16 + sizeof(i->name)] = {};
+      if (i->master)
+       bsprintf(mbuf, " master=%s", i->master->name);
+      else if (i->master_index)
+       bsprintf(mbuf, " master=#%u", i->master_index);
+
+      cli_msg(-1001, "%s %s (index=%d%s)", i->name, (i->flags & IF_UP) ? "up" : "DOWN", i->index, mbuf);
       if (!(i->flags & IF_MULTIACCESS))
        type = "PtP";
       else

diff --git a/nest/iface.h b/nest/iface.h
index 56710e4a4b219d9d6329a0d2b75bb7e9d1d47b85..b8e6983846b2516373ecde70d3936e26be27b2a3 100644 (file)
--- a/nest/iface.h
+++ b/nest/iface.h
@@ -34,8 +34,10 @@ struct iface {
   unsigned flags;
   unsigned mtu;
   unsigned index;                      /* OS-dependent interface index */
+  unsigned master_index;               /* Interface index of master iface */
   list addrs;                          /* Addresses assigned to this interface */
   struct ifa *addr;                    /* Primary address */
+  struct iface *master;                        /* Master iface (e.g. for VRF) */
   list neighbors;                      /* All neighbors on this interface */
 };
 

diff --git a/nest/proto.c b/nest/proto.c
index 1091b32102a555af97d94bc98a55864d525c9469..64422ee372db4c1d7413c4feeb821f7c296fe847 100644 (file)
--- a/nest/proto.c
+++ b/nest/proto.c
@@ -386,6 +386,7 @@ proto_init(struct proto_config *c)
   q->core_state = FS_HUNGRY;
   q->export_state = ES_DOWN;
   q->last_state_change = now;
+  q->vrf = c->vrf;
 
   add_tail(&initial_proto_list, &q->n);
 
@@ -409,6 +410,7 @@ proto_reconfigure(struct proto *p, struct proto_config *oc, struct proto_config
   /* If there is a too big change in core attributes, ... */
   if ((nc->protocol != oc->protocol) ||
       (nc->disabled != p->disabled) ||
+      (nc->vrf != oc->vrf) ||
       (nc->table->table != oc->table->table))
     return 0;
 
@@ -1474,7 +1476,9 @@ proto_show_limit(struct proto_limit *l, const char *dsc)
 void
 proto_show_basic_info(struct proto *p)
 {
-  // cli_msg(-1006, "  Table:          %s", p->table->name);
+  if (p->vrf)
+    cli_msg(-1006, "  VRF:            %s", p->vrf->name);
+
   cli_msg(-1006, "  Preference:     %d", p->preference);
   cli_msg(-1006, "  Input filter:   %s", filter_name(p->cf->in_filter));
   cli_msg(-1006, "  Output filter:  %s", filter_name(p->cf->out_filter));

diff --git a/nest/protocol.h b/nest/protocol.h
index ec7873557bcf08d9f47125979a68a2caab4ccf39..3c30a58150536c07e52af0ee9b206a78659049c7 100644 (file)
--- a/nest/protocol.h
+++ b/nest/protocol.h
@@ -94,6 +94,7 @@ struct proto_config {
   unsigned preference, disabled;       /* Generic parameters */
   int in_keep_filtered;                        /* Routes rejected in import filter are kept */
   u32 router_id;                       /* Protocol specific router ID */
+  struct iface *vrf;                   /* Related VRF instance, NULL if global */
   struct rtable_config *table;         /* Table we're attached to */
   struct filter *in_filter, *out_filter; /* Attached filters */
   struct proto_limit *rx_limit;                /* Limit for receiving routes from protocol
@@ -213,6 +214,7 @@ struct proto {
   void (*rte_insert)(struct network *, struct rte *);
   void (*rte_remove)(struct network *, struct rte *);
 
+  struct iface *vrf;                   /* Related VRF instance, NULL if global */
   struct rtable *table;                        /* Our primary routing table */
   struct rte_src *main_source;         /* Primary route source */
   struct announce_hook *main_ahook;    /* Primary announcement hook */

diff --git a/proto/babel/packets.c b/proto/babel/packets.c
index 08054832839d4444fcc3d157426fd368ab03fcd9..9042183652c3f60b1738fe2274aa015a94eab10f 100644 (file)
--- a/proto/babel/packets.c
+++ b/proto/babel/packets.c
@@ -1080,6 +1080,7 @@ babel_open_socket(struct babel_iface *ifa)
   sk->sport = ifa->cf->port;
   sk->dport = ifa->cf->port;
   sk->iface = ifa->iface;
+  sk->vrf = p->p.vrf;
 
   sk->rx_hook = babel_rx_hook;
   sk->tx_hook = babel_tx_hook;

diff --git a/proto/bgp/bgp.c b/proto/bgp/bgp.c
index f706e76e64b78794d92118a92200d62bce828daf..913685a45011add99d6df6502b7325d87173d76d 100644 (file)
--- a/proto/bgp/bgp.c
+++ b/proto/bgp/bgp.c
@@ -745,6 +745,7 @@ bgp_connect(struct bgp_proto *p)    /* Enter Connect state and start establishing c
   s->daddr = p->cf->remote_ip;
   s->dport = p->cf->remote_port;
   s->iface = p->neigh ? p->neigh->iface : NULL;
+  s->vrf = p->p.vrf;
   s->ttl = p->cf->ttl_security ? 255 : hops;
   s->rbsize = p->cf->enable_extended_messages ? BGP_RX_BUFFER_EXT_SIZE : BGP_RX_BUFFER_SIZE;
   s->tbsize = p->cf->enable_extended_messages ? BGP_TX_BUFFER_EXT_SIZE : BGP_TX_BUFFER_SIZE;

diff --git a/proto/ospf/iface.c b/proto/ospf/iface.c
index 280fa4c1e718ad6e79221e05ce35bcf5c64b29ec..1795ec2203f189f727965cc7a79c566f6ada1fad 100644 (file)
--- a/proto/ospf/iface.c
+++ b/proto/ospf/iface.c
@@ -118,6 +118,7 @@ ospf_sk_open(struct ospf_iface *ifa)
   sk->dport = OSPF_PROTO;
   sk->saddr = ifa->addr->ip;
   sk->iface = ifa->iface;
+  sk->vrf = p->p.vrf;
 
   sk->tos = ifa->cf->tx_tos;
   sk->priority = ifa->cf->tx_priority;
@@ -200,6 +201,7 @@ ospf_open_vlink_sk(struct ospf_proto *p)
   sock *sk = sk_new(p->p.pool);
   sk->type = SK_IP;
   sk->dport = OSPF_PROTO;
+  sk->vrf = p->p.vrf;
 
   /* FIXME: configurable tos/priority ? */
   sk->tos = IP_PREC_INTERNET_CONTROL;

diff --git a/proto/radv/packets.c b/proto/radv/packets.c
index 19d71f97700d7bcfedac6ea5e24ce09eb7842a37..8a301854823910cea65c16562cf4b584f68dcea6 100644 (file)
--- a/proto/radv/packets.c
+++ b/proto/radv/packets.c
@@ -388,6 +388,7 @@ radv_sk_open(struct radv_iface *ifa)
   sk->type = SK_IP;
   sk->dport = ICMPV6_PROTO;
   sk->saddr = ifa->addr->ip;
+  sk->vrf = ifa->ra->p.vrf;
 
   sk->ttl = 255; /* Mandatory for Neighbor Discovery packets */
   sk->rx_hook = radv_rx_hook;

diff --git a/proto/rip/packets.c b/proto/rip/packets.c
index 468927e6e24d4f7a074435d76d1fd67bba819207..722a9012d95da1dc2e327f22a826d6f5476f4985 100644 (file)
--- a/proto/rip/packets.c
+++ b/proto/rip/packets.c
@@ -739,6 +739,7 @@ rip_open_socket(struct rip_iface *ifa)
   sk->sport = ifa->cf->port;
   sk->dport = ifa->cf->port;
   sk->iface = ifa->iface;
+  sk->vrf = p->p.vrf;
 
   /*
    * For RIPv2, we explicitly choose a primary address, mainly to ensure that

diff --git a/sysdep/linux/netlink.c b/sysdep/linux/netlink.c
index 3658c46bac399493b0ee1cf69a55af1c02604965..4802897b0243f0ec62065d9c3db51102d6d51a08 100644 (file)
--- a/sysdep/linux/netlink.c
+++ b/sysdep/linux/netlink.c
@@ -300,6 +300,7 @@ struct nl_want_attrs {
 static struct nl_want_attrs ifla_attr_want[BIRD_IFLA_MAX] = {
   [IFLA_IFNAME]          = { 1, 0, 0 },
   [IFLA_MTU]     = { 1, 1, sizeof(u32) },
+  [IFLA_MASTER]          = { 1, 1, sizeof(u32) },
   [IFLA_WIRELESS] = { 1, 0, 0 },
 };
 
@@ -618,7 +619,7 @@ nl_parse_link(struct nlmsghdr *h, int scan)
   struct iface f = {};
   struct iface *ifi;
   char *name;
-  u32 mtu;
+  u32 mtu, master = 0;
   uint fl;
 
   if (!(i = nl_checkin(h, sizeof(*i))) || !nl_parse_attrs(IFLA_RTA(i), ifla_attr_want, a, sizeof(a)))
@@ -641,6 +642,9 @@ nl_parse_link(struct nlmsghdr *h, int scan)
   name = RTA_DATA(a[IFLA_IFNAME]);
   mtu = rta_get_u32(a[IFLA_MTU]);
 
+  if (a[IFLA_MASTER])
+    master = rta_get_u32(a[IFLA_MASTER]);
+
   ifi = if_find_by_index(i->ifi_index);
   if (!new)
     {
@@ -660,6 +664,9 @@ nl_parse_link(struct nlmsghdr *h, int scan)
       f.index = i->ifi_index;
       f.mtu = mtu;
 
+      f.master_index = master;
+      f.master = if_find_by_index(master);
+
       fl = i->ifi_flags;
       if (fl & IFF_UP)
        f.flags |= IF_ADMIN_UP;
@@ -835,6 +842,26 @@ kif_do_scan(struct kif_proto *p UNUSED)
     else
       log(L_DEBUG "nl_scan_ifaces: Unknown packet received (type=%d)", h->nlmsg_type);
 
+  /* Re-resolve master interface for slaves */
+  struct iface *i;
+  WALK_LIST(i, iface_list)
+    if (i->master_index)
+    {
+      struct iface f = {
+       .flags = i->flags,
+       .mtu = i->mtu,
+       .index = i->index,
+       .master_index = i->master_index,
+       .master = if_find_by_index(i->master_index)
+      };
+
+      if (f.master != i->master)
+      {
+       memcpy(f.name, i->name, sizeof(f.name));
+       if_update(&f);
+      }
+    }
+
   nl_request_dump(BIRD_AF, RTM_GETADDR);
   while (h = nl_get_scan())
     if (h->nlmsg_type == RTM_NEWADDR || h->nlmsg_type == RTM_DELADDR)

diff --git a/sysdep/unix/io.c b/sysdep/unix/io.c
index 561d4dea4b1776d437cc0c6a2637a8b406b6b106..6d6a09902cbd261646964dafa57953362db8c219 100644 (file)
--- a/sysdep/unix/io.c
+++ b/sysdep/unix/io.c
@@ -1211,6 +1211,18 @@ sk_setup(sock *s)
   }
 #endif
 
+  if (s->vrf && !s->iface)
+  {
+    /* Bind socket to associated VRF interface.
+       This is Linux-specific, but so is SO_BINDTODEVICE. */
+#ifdef SO_BINDTODEVICE
+    struct ifreq ifr = {};
+    strcpy(ifr.ifr_name, s->vrf->name);
+    if (setsockopt(s->fd, SOL_SOCKET, SO_BINDTODEVICE, &ifr, sizeof(ifr)) < 0)
+      ERR("SO_BINDTODEVICE");
+#endif
+  }
+
   if (s->iface)
   {
 #ifdef SO_BINDTODEVICE