February 2023 - gerrit-log - lists.osmocom.org

Change in osmo-upf[master]: tunmap: refactor nft ruleset: fix "martians" and "1024"

by neels

neels has submitted this change. ( https://gerrit.osmocom.org/c/osmo-upf/+/31165 ) Change subject: tunmap: refactor nft ruleset: fix "martians" and "1024" ...................................................................... tunmap: refactor nft ruleset: fix "martians" and "1024" Take care of two problems: - limitation of <= 1024 base chains in nftables, so far meaning we can establish at most 1024 GTP tunnel mappings. - mangling of source IP in prerouting so far meaning that the system needs to be configured to permit 'martian' packets The new ruleset separates in pre- and post-routing, so that we set a new destination IP address in pre-routing, and set a new source IP address in post-routing. Hence no problem with martian packet rejection. The new ruleset uses verdict maps, which are more efficient, and do not hit a limit of 1024 as base chains do. Before, the nft rule used one chain id. In the new ruleset, each tunmap now needs two distinct chain ids. Refactor. Related: SYS#6327 SYS#6264 Change-Id: Iccb975a1c0f8a2087f7b7dc4942a6b41f5675a13 --- M include/osmocom/upf/upf.h M include/osmocom/upf/upf_nft.h M src/osmo-upf/up_gtp_action.c M src/osmo-upf/upf.c M src/osmo-upf/upf_nft.c M src/osmo-upf/upf_vty.c M tests/nft-rule.vty 7 files changed, 245 insertions(+), 82 deletions(-) Approvals: Jenkins Builder: Verified pespin: Looks good to me, but someone else must approve osmith: Looks good to me, but someone else must approve laforge: Looks good to me, approved diff --git a/include/osmocom/upf/upf.h b/include/osmocom/upf/upf.h index ef7aa2b..2e80abe 100644 --- a/include/osmocom/upf/upf.h +++ b/include/osmocom/upf/upf.h @@ -110,8 +110,9 @@ struct nft_ctx *nft_ctx; char *table_name; - int priority; - uint32_t next_id_state; + int priority_pre; + int priority_post; + uint32_t next_chain_id_state; } nft; struct llist_head netinst; diff --git a/include/osmocom/upf/upf_nft.h b/include/osmocom/upf/upf_nft.h index 4cdcb51..cf0f0b9 100644 --- a/include/osmocom/upf/upf_nft.h +++ b/include/osmocom/upf/upf_nft.h @@ -27,28 +27,32 @@ #include <osmocom/core/socket.h> -#define NFT_CHAIN_NAME_PREFIX_TUNMAP "tunmap" - struct upf_nft_tunmap_desc { struct { struct osmo_sockaddr gtp_local_addr; uint32_t local_teid; struct osmo_sockaddr gtp_remote_addr; uint32_t remote_teid; + uint32_t chain_id; } access; struct { struct osmo_sockaddr gtp_local_addr; uint32_t local_teid; struct osmo_sockaddr gtp_remote_addr; uint32_t remote_teid; + uint32_t chain_id; } core; - /* id as in ruleset name 'tunmap<id>'. If zero, no id has been assigned yet. */ - uint32_t id; }; +int upf_nft_tunmap_to_str_buf(char *buf, size_t buflen, const struct upf_nft_tunmap_desc *tunmap); +char *upf_nft_tunmap_to_str_c(void *ctx, const struct upf_nft_tunmap_desc *tunmap); + int upf_nft_init(); int upf_nft_free(); +char *upf_nft_tunmap_get_table_init_str(void *ctx); +char *upf_nft_tunmap_get_vmap_init_str(void *ctx); char *upf_nft_tunmap_get_ruleset_str(void *ctx, struct upf_nft_tunmap_desc *tunmap); +char *upf_nft_tunmap_get_ruleset_del_str(void *ctx, struct upf_nft_tunmap_desc *tunmap); int upf_nft_tunmap_create(struct upf_nft_tunmap_desc *tunmap); int upf_nft_tunmap_delete(struct upf_nft_tunmap_desc *tunmap); diff --git a/src/osmo-upf/up_gtp_action.c b/src/osmo-upf/up_gtp_action.c index 68f5fb9..b331260 100644 --- a/src/osmo-upf/up_gtp_action.c +++ b/src/osmo-upf/up_gtp_action.c @@ -107,11 +107,11 @@ else rc = upf_gtp_dev_tunend_del(gtp_dev, &a->tunend); if (rc) { - LOG_UP_GTP_ACTION(a, LOGL_ERROR, "Failed to %s GTP tunnel: %d %s\n", - enable ? "enable" : "disable", rc, strerror(-rc)); + LOG_UP_GTP_ACTION(a, LOGL_ERROR, "Failed to %s GTP tunnel (rc=%d)\n", + enable ? "enable" : "disable", rc); return rc; } - LOG_UP_GTP_ACTION(a, LOGL_NOTICE, "%s GTP tunnel on dev %s\n", enable ? "Enabled" : "Disabled", + LOG_UP_GTP_ACTION(a, LOGL_NOTICE, "%s tunend on dev %s\n", enable ? "Enabled" : "Disabled", gtp_dev->name); return 0; @@ -122,32 +122,18 @@ return 0; } - if (enable && a->tunmap.id != 0) { - LOG_UP_GTP_ACTION(a, LOGL_ERROR, - "Cannot enable: nft GTP tunnel mapping rule has been enabled before" - " as nft rule id %u\n", a->tunmap.id); - return -EALREADY; - } - if (!enable && a->tunmap.id == 0) { - LOG_UP_GTP_ACTION(a, LOGL_ERROR, - "Cannot disable: nft GTP tunnel mapping rule has not been enabled" - " (no nft rule id)\n"); - return -ENOENT; - } if (enable) rc = upf_nft_tunmap_create(&a->tunmap); else rc = upf_nft_tunmap_delete(&a->tunmap); if (rc) { - LOG_UP_GTP_ACTION(a, LOGL_ERROR, - "Failed to %s nft GTP tunnel mapping %u:" - " %d %s\n", enable ? "enable" : "disable", a->tunmap.id, rc, strerror(-rc)); + LOG_UP_GTP_ACTION(a, LOGL_ERROR, "Failed to %s nft GTP tunnel mapping (rc=%d)\n", + enable ? "enable" : "disable", rc); return rc; } - LOG_UP_GTP_ACTION(a, LOGL_NOTICE, "%s nft GTP tunnel mapping %u\n", - enable ? "Enabled" : "Disabled", a->tunmap.id); - if (!enable) - a->tunmap.id = 0; + LOG_UP_GTP_ACTION(a, LOGL_NOTICE, "%s tunmap, nft chain IDs: access--%u-> <-%u--core\n", + enable ? "Enabled" : "Disabled", + a->tunmap.access.chain_id, a->tunmap.core.chain_id); return 0; default: diff --git a/src/osmo-upf/upf.c b/src/osmo-upf/upf.c index 0a84799..e26d9c7 100644 --- a/src/osmo-upf/upf.c +++ b/src/osmo-upf/upf.c @@ -51,7 +51,8 @@ }, }, .nft = { - .priority = -300, + .priority_pre = -300, + .priority_post = 400, }, .gtp = { /* TODO: recovery count state file; use lower byte of current time, poor person's random. */ diff --git a/src/osmo-upf/upf_nft.c b/src/osmo-upf/upf_nft.c index f30e30c..ddd556b 100644 --- a/src/osmo-upf/upf_nft.c +++ b/src/osmo-upf/upf_nft.c @@ -35,6 +35,30 @@ return talloc_asprintf(ctx, "add table inet %s\n", table_name); } +static char *upf_nft_ruleset_vmap_init(void *ctx, const char *table_name, int priority_pre, int priority_post) +{ + /* add chain inet osmo-upf pre { type filter hook prerouting priority -300; policy accept; } + * add chain inet osmo-upf post { type filter hook postrouting priority 400; policy accept; } + * add map inet osmo-upf tunmap-pre { typeof ip daddr . @ih,32,32 : verdict; } + * add map inet osmo-upf tunmap-post { typeof meta mark : verdict; } + * add rule inet osmo-upf pre udp dport 2152 ip daddr . @ih,32,32 vmap @tunmap-pre + * add rule inet osmo-upf post meta mark vmap @tunmap-post + */ + return talloc_asprintf(ctx, + "add chain inet %s pre { type filter hook prerouting priority %d; policy accept; };\n" + "add chain inet %s post { type filter hook postrouting priority %d; policy accept; };\n" + "add map inet %s tunmap-pre { typeof ip daddr . @ih,32,32 : verdict; };\n" + "add map inet %s tunmap-post { typeof meta mark : verdict; };\n" + "add rule inet %s pre udp dport %u ip daddr . @ih,32,32 vmap @tunmap-pre;\n" + "add rule inet %s post meta mark vmap @tunmap-post;\n", + table_name, priority_pre, + table_name, priority_post, + table_name, + table_name, + table_name, PORT_GTP1_U, + table_name); +} + static int upf_nft_run(const char *ruleset) { int rc; @@ -82,13 +106,19 @@ return -EIO; } - rc = upf_nft_run(upf_nft_ruleset_table_create(OTC_SELECT, g_upf->nft.table_name)); + rc = upf_nft_run(upf_nft_tunmap_get_table_init_str(OTC_SELECT)); if (rc) { LOGP(DNFT, LOGL_ERROR, "Failed to create nft table %s\n", osmo_quote_str_c(OTC_SELECT, g_upf->nft.table_name, -1)); return rc; } LOGP(DNFT, LOGL_NOTICE, "Created nft table %s\n", osmo_quote_str_c(OTC_SELECT, g_upf->nft.table_name, -1)); + + rc = upf_nft_run(upf_nft_tunmap_get_vmap_init_str(OTC_SELECT)); + if (rc) { + LOGP(DNFT, LOGL_ERROR, "Failed to initialize nft verdict map in table %s\n", g_upf->nft.table_name); + return rc; + } return 0; } @@ -110,53 +140,112 @@ const struct osmo_sockaddr *addr_local; /* The TEID that the peer sends to us in GTP packets. */ uint32_t teid_local; + /* The nft chain id that forwards packets received on addr_local,teid_local. Also used for the 'mark' id in + * the verdict map ruleset. */ + uint32_t chain_id; }; struct upf_nft_args { /* global table name */ const char *table_name; - /* chain name for this specific tunnel mapping */ - uint32_t chain_id; - int priority; struct upf_nft_args_peer peer_a; struct upf_nft_args_peer peer_b; }; -static int tunmap_single_direction(char *buf, size_t buflen, - const struct upf_nft_args *args, - const struct upf_nft_args_peer *from_peer, - const struct upf_nft_args_peer *to_peer) +static int tunmap_add_single_direction(char *buf, size_t buflen, + const struct upf_nft_args *args, + bool dir_a2b) { struct osmo_strbuf sb = { .buf = buf, .len = buflen }; + const struct upf_nft_args_peer *from_peer; + const struct upf_nft_args_peer *to_peer; - OSMO_STRBUF_PRINTF(sb, "add rule inet %s " NFT_CHAIN_NAME_PREFIX_TUNMAP "%u", args->table_name, args->chain_id); + if (dir_a2b) { + from_peer = &args->peer_a; + to_peer = &args->peer_b; + } else { + from_peer = &args->peer_b; + to_peer = &args->peer_a; + } - /* Match only UDP packets */ - OSMO_STRBUF_PRINTF(sb, " meta l4proto udp"); + /* # add chain for verdict map in prerouting + * add chain inet osmo-upf tunmap-pre-123 + * # mangle destination address at prerouting + * add rule inet osmo-upf tunmap-pre-123 ip daddr set 1.1.1.1 meta mark set 123 counter accept + * + * # add chain for verdict map in postrouting + * add chain inet osmo-upf tunmap-post-123 + * # mangle source address and GTP TID at postrouting + * add rule inet osmo-upf tunmap-post-123 ip saddr set 2.2.2.1 @ih,32,32 set 0x00000102 counter accept + * + * # add elements to verdict map, jump to chain + * add element inet osmo-upf tunmap-pre { 2.2.2.3 . 0x00000203 : jump tunmap-pre-123 } + * add element inet osmo-upf tunmap-post { 123 : jump tunmap-post-123 } + */ - /* Match on packets coming in at specific local IP */ - OSMO_STRBUF_PRINTF(sb, " ip daddr "); - OSMO_STRBUF_APPEND(sb, osmo_sockaddr_to_str_buf2, from_peer->addr_local); + OSMO_STRBUF_PRINTF(sb, "add chain inet %s tunmap-pre-%u;\n", + args->table_name, from_peer->chain_id); - /* Match on the TEID in the header */ - OSMO_STRBUF_PRINTF(sb, " @ih,32,32 0x%08x", from_peer->teid_local); - - /* Change outgoing address to local IP on outgoing interface */ - OSMO_STRBUF_PRINTF(sb, " ip saddr set "); - OSMO_STRBUF_APPEND(sb, osmo_sockaddr_to_str_buf2, to_peer->addr_local); - - /* Change destination address to to_peer */ + OSMO_STRBUF_PRINTF(sb, "add rule inet %s tunmap-pre-%u", + args->table_name, from_peer->chain_id); OSMO_STRBUF_PRINTF(sb, " ip daddr set "); OSMO_STRBUF_APPEND(sb, osmo_sockaddr_to_str_buf2, to_peer->addr_remote); + OSMO_STRBUF_PRINTF(sb, " meta mark set %u counter accept;\n", from_peer->chain_id); - /* Change the TEID in the header to the one to_peer expects */ - OSMO_STRBUF_PRINTF(sb, " @ih,32,32 set 0x%08x", to_peer->teid_remote); + OSMO_STRBUF_PRINTF(sb, "add chain inet %s tunmap-post-%u;\n", + args->table_name, from_peer->chain_id); - OSMO_STRBUF_PRINTF(sb, " counter"); + OSMO_STRBUF_PRINTF(sb, "add rule inet %s tunmap-post-%u", + args->table_name, from_peer->chain_id); + OSMO_STRBUF_PRINTF(sb, " ip saddr set "); + OSMO_STRBUF_APPEND(sb, osmo_sockaddr_to_str_buf2, to_peer->addr_local); + OSMO_STRBUF_PRINTF(sb, " @ih,32,32 set 0x%x", to_peer->teid_remote); + OSMO_STRBUF_PRINTF(sb, " counter accept;\n"); - OSMO_STRBUF_PRINTF(sb, " accept"); - OSMO_STRBUF_PRINTF(sb, ";\n"); + OSMO_STRBUF_PRINTF(sb, "add element inet %s tunmap-pre { ", + args->table_name); + OSMO_STRBUF_APPEND(sb, osmo_sockaddr_to_str_buf2, from_peer->addr_local); + OSMO_STRBUF_PRINTF(sb, " . 0x%x : jump tunmap-pre-%u };\n", + from_peer->teid_local, from_peer->chain_id); + + OSMO_STRBUF_PRINTF(sb, "add element inet %s tunmap-post { %u : jump tunmap-post-%u };\n", + args->table_name, from_peer->chain_id, from_peer->chain_id); + + return sb.chars_needed; +} + +static int tunmap_del_single_direction(char *buf, size_t buflen, + const struct upf_nft_args *args, + bool dir_a2b) +{ + struct osmo_strbuf sb = { .buf = buf, .len = buflen }; + const struct upf_nft_args_peer *from_peer; + + if (dir_a2b) + from_peer = &args->peer_a; + else + from_peer = &args->peer_b; + + /* delete element inet osmo-upf tunmap-pre { 2.2.2.3 . 0x203 } + * delete element inet osmo-upf tunmap-post { 123 } + * delete chain inet osmo-upf tunmap-pre-123 + * delete chain inet osmo-upf tunmap-post-123 + */ + + OSMO_STRBUF_PRINTF(sb, "delete element inet %s tunmap-pre { ", + args->table_name); + OSMO_STRBUF_APPEND(sb, osmo_sockaddr_to_str_buf2, from_peer->addr_local); + OSMO_STRBUF_PRINTF(sb, " . 0x%x };\n", from_peer->teid_local); + + OSMO_STRBUF_PRINTF(sb, "delete element inet %s tunmap-post { %u };\n", + args->table_name, from_peer->chain_id); + + OSMO_STRBUF_PRINTF(sb, "delete chain inet %s tunmap-pre-%u;\n", + args->table_name, from_peer->chain_id); + + OSMO_STRBUF_PRINTF(sb, "delete chain inet %s tunmap-post-%u;\n", + args->table_name, from_peer->chain_id); return sb.chars_needed; } @@ -165,34 +254,56 @@ { struct osmo_strbuf sb = { .buf = buf, .len = buflen }; - /* Add a chain for this tunnel mapping */ - OSMO_STRBUF_PRINTF(sb, "add chain inet %s " NFT_CHAIN_NAME_PREFIX_TUNMAP "%u { type filter hook prerouting priority %d; }\n", - args->table_name, args->chain_id, args->priority); - /* Forwarding from peer_a to peer_b */ - OSMO_STRBUF_APPEND(sb, tunmap_single_direction, args, &args->peer_a, &args->peer_b); + OSMO_STRBUF_APPEND(sb, tunmap_add_single_direction, args, true); /* And from peer_b to peer_a */ - OSMO_STRBUF_APPEND(sb, tunmap_single_direction, args, &args->peer_b, &args->peer_a); + OSMO_STRBUF_APPEND(sb, tunmap_add_single_direction, args, false); return sb.chars_needed; } static char *upf_nft_ruleset_tunmap_create_c(void *ctx, const struct upf_nft_args *args) { - OSMO_NAME_C_IMPL(ctx, 512, "ERROR", upf_nft_ruleset_tunmap_create_buf, args) + OSMO_NAME_C_IMPL(ctx, 1024, "ERROR", upf_nft_ruleset_tunmap_create_buf, args) } static int upf_nft_ruleset_tunmap_delete_buf(char *buf, size_t buflen, const struct upf_nft_args *args) { struct osmo_strbuf sb = { .buf = buf, .len = buflen }; - OSMO_STRBUF_PRINTF(sb, "delete chain inet %s " NFT_CHAIN_NAME_PREFIX_TUNMAP "%u\n", - args->table_name, args->chain_id); + + /* Forwarding from peer_a to peer_b */ + OSMO_STRBUF_APPEND(sb, tunmap_del_single_direction, args, true); + /* And from peer_b to peer_a */ + OSMO_STRBUF_APPEND(sb, tunmap_del_single_direction, args, false); + return sb.chars_needed; } static char *upf_nft_ruleset_tunmap_delete_c(void *ctx, const struct upf_nft_args *args) { - OSMO_NAME_C_IMPL(ctx, 64, "ERROR", upf_nft_ruleset_tunmap_delete_buf, args) + OSMO_NAME_C_IMPL(ctx, 512, "ERROR", upf_nft_ruleset_tunmap_delete_buf, args) +} + +int upf_nft_tunmap_to_str_buf(char *buf, size_t buflen, const struct upf_nft_tunmap_desc *tunmap) +{ + struct osmo_strbuf sb = { .buf = buf, .len = buflen }; + + /* ACCESS 1.1.1.2:0x102 <---> 2.2.2.1:0x201 UPF 2.2.2.3:0x203 <---> 3.3.3.2:0x302 CORE */ + OSMO_STRBUF_PRINTF(sb, "ACCESS "); + OSMO_STRBUF_APPEND(sb, osmo_sockaddr_to_str_buf2, &tunmap->access.gtp_remote_addr); + OSMO_STRBUF_PRINTF(sb, ":0x%x <---> ", tunmap->access.remote_teid); + OSMO_STRBUF_APPEND(sb, osmo_sockaddr_to_str_buf2, &tunmap->access.gtp_local_addr); + OSMO_STRBUF_PRINTF(sb, ":0x%x UPF ", tunmap->access.local_teid); + OSMO_STRBUF_APPEND(sb, osmo_sockaddr_to_str_buf2, &tunmap->core.gtp_local_addr); + OSMO_STRBUF_PRINTF(sb, ":0x%x <---> ", tunmap->core.local_teid); + OSMO_STRBUF_APPEND(sb, osmo_sockaddr_to_str_buf2, &tunmap->core.gtp_remote_addr); + OSMO_STRBUF_PRINTF(sb, ":0x%x CORE", tunmap->core.remote_teid); + return sb.chars_needed; +} + +char *upf_nft_tunmap_to_str_c(void *ctx, const struct upf_nft_tunmap_desc *tunmap) +{ + OSMO_NAME_C_IMPL(ctx, 128, "ERROR", upf_nft_tunmap_to_str_buf, tunmap) } static void upf_nft_args_from_tunmap_desc(struct upf_nft_args *args, const struct upf_nft_tunmap_desc *tunmap) @@ -204,39 +315,62 @@ *args = (struct upf_nft_args){ .table_name = g_upf->nft.table_name, - .chain_id = tunmap->id, - .priority = g_upf->nft.priority, .peer_a = { .addr_remote = &tunmap->access.gtp_remote_addr, .teid_remote = tunmap->access.remote_teid, .addr_local = &tunmap->access.gtp_local_addr, .teid_local = tunmap->access.local_teid, + .chain_id = tunmap->access.chain_id, }, .peer_b = { .addr_remote = &tunmap->core.gtp_remote_addr, .teid_remote = tunmap->core.remote_teid, .addr_local = &tunmap->core.gtp_local_addr, .teid_local = tunmap->core.local_teid, + .chain_id = tunmap->core.chain_id, }, }; } +char *upf_nft_tunmap_get_table_init_str(void *ctx) +{ + return upf_nft_ruleset_table_create(ctx, g_upf->nft.table_name); +} + +char *upf_nft_tunmap_get_vmap_init_str(void *ctx) +{ + return upf_nft_ruleset_vmap_init(ctx, g_upf->nft.table_name, g_upf->nft.priority_pre, + g_upf->nft.priority_post); +} + +static uint32_t chain_id_next(void) +{ + g_upf->nft.next_chain_id_state++; + if (!g_upf->nft.next_chain_id_state) + g_upf->nft.next_chain_id_state++; + return g_upf->nft.next_chain_id_state; +} + char *upf_nft_tunmap_get_ruleset_str(void *ctx, struct upf_nft_tunmap_desc *tunmap) { struct upf_nft_args args; - /* Give this tunnel mapping a new id, returned to the caller so that the tunnel mapping can be deleted later */ - if (!tunmap->id) { - g_upf->nft.next_id_state++; - if (!g_upf->nft.next_id_state) - g_upf->nft.next_id_state++; - tunmap->id = g_upf->nft.next_id_state; - } + if (!tunmap->access.chain_id) + tunmap->access.chain_id = chain_id_next(); + if (!tunmap->core.chain_id) + tunmap->core.chain_id = chain_id_next(); upf_nft_args_from_tunmap_desc(&args, tunmap); return upf_nft_ruleset_tunmap_create_c(ctx, &args); } +char *upf_nft_tunmap_get_ruleset_del_str(void *ctx, struct upf_nft_tunmap_desc *tunmap) +{ + struct upf_nft_args args; + upf_nft_args_from_tunmap_desc(&args, tunmap); + return upf_nft_ruleset_tunmap_delete_c(ctx, &args); +} + int upf_nft_tunmap_create(struct upf_nft_tunmap_desc *tunmap) { return upf_nft_run(upf_nft_tunmap_get_ruleset_str(OTC_SELECT, tunmap)); @@ -244,7 +378,5 @@ int upf_nft_tunmap_delete(struct upf_nft_tunmap_desc *tunmap) { - struct upf_nft_args args; - upf_nft_args_from_tunmap_desc(&args, tunmap); - return upf_nft_run(upf_nft_ruleset_tunmap_delete_c(OTC_SELECT, &args)); + return upf_nft_run(upf_nft_tunmap_get_ruleset_del_str(OTC_SELECT, tunmap)); } diff --git a/src/osmo-upf/upf_vty.c b/src/osmo-upf/upf_vty.c index 436d91f..70e0d69 100644 --- a/src/osmo-upf/upf_vty.c +++ b/src/osmo-upf/upf_vty.c @@ -300,12 +300,13 @@ .access = { .local_teid = 0x201, .remote_teid = 0x102, + .chain_id = 123, }, .core = { .local_teid = 0x203, .remote_teid = 0x302, + .chain_id = 321, }, - .id = 123, }; osmo_sockaddr_str_from_str2(&str, "1.1.1.1"); @@ -320,7 +321,14 @@ osmo_sockaddr_str_from_str2(&str, "3.3.3.3"); osmo_sockaddr_str_to_sockaddr(&str, &d.core.gtp_remote_addr.u.sas); + vty_out(vty, "%% init verdict map:%s", VTY_NEWLINE); + vty_out(vty, "%s%s", upf_nft_tunmap_get_table_init_str(OTC_SELECT), VTY_NEWLINE); + vty_out(vty, "%s%s", upf_nft_tunmap_get_vmap_init_str(OTC_SELECT), VTY_NEWLINE); + vty_out(vty, "%% add tunmap:%s", VTY_NEWLINE); + vty_out(vty, "%% %s%s", upf_nft_tunmap_to_str_c(OTC_SELECT, &d), VTY_NEWLINE); vty_out(vty, "%s%s", upf_nft_tunmap_get_ruleset_str(OTC_SELECT, &d), VTY_NEWLINE); + vty_out(vty, "%% delete tunmap:%s", VTY_NEWLINE); + vty_out(vty, "%s%s", upf_nft_tunmap_get_ruleset_del_str(OTC_SELECT, &d), VTY_NEWLINE); return CMD_SUCCESS; } diff --git a/tests/nft-rule.vty b/tests/nft-rule.vty index ec719ab..c226191 100644 --- a/tests/nft-rule.vty +++ b/tests/nft-rule.vty @@ -3,9 +3,40 @@ OsmoUPF(config)# tunmap OsmoUPF(config-tunmap)# show nft-rule tunmap example -add chain inet osmo-upf tunmap123 { type filter hook prerouting priority -300; } -add rule inet osmo-upf tunmap123 meta l4proto udp ip daddr 2.2.2.1 @ih,32,32 0x00000201 ip saddr set 2.2.2.3 ip daddr set 3.3.3.3 @ih,32,32 set 0x00000302 counter accept; -add rule inet osmo-upf tunmap123 meta l4proto udp ip daddr 2.2.2.3 @ih,32,32 0x00000203 ip saddr set 2.2.2.1 ip daddr set 1.1.1.1 @ih,32,32 set 0x00000102 counter accept; +% init verdict map: +add table inet osmo-upf + +add chain inet osmo-upf pre { type filter hook prerouting priority -300; policy accept; }; +add chain inet osmo-upf post { type filter hook postrouting priority 400; policy accept; }; +add map inet osmo-upf tunmap-pre { typeof ip daddr . @ih,32,32 : verdict; }; +add map inet osmo-upf tunmap-post { typeof meta mark : verdict; }; +add rule inet osmo-upf pre udp dport 2152 ip daddr . @ih,32,32 vmap @tunmap-pre; +add rule inet osmo-upf post meta mark vmap @tunmap-post; + +% add tunmap: +% ACCESS 1.1.1.1:0x102 <---> 2.2.2.1:0x201 UPF 2.2.2.3:0x203 <---> 3.3.3.3:0x302 CORE +add chain inet osmo-upf tunmap-pre-123; +add rule inet osmo-upf tunmap-pre-123 ip daddr set 3.3.3.3 meta mark set 123 counter accept; +add chain inet osmo-upf tunmap-post-123; +add rule inet osmo-upf tunmap-post-123 ip saddr set 2.2.2.3 @ih,32,32 set 0x302 counter accept; +add element inet osmo-upf tunmap-pre { 2.2.2.1 . 0x201 : jump tunmap-pre-123 }; +add element inet osmo-upf tunmap-post { 123 : jump tunmap-post-123 }; +add chain inet osmo-upf tunmap-pre-321; +add rule inet osmo-upf tunmap-pre-321 ip daddr set 1.1.1.1 meta mark set 321 counter accept; +add chain inet osmo-upf tunmap-post-321; +add rule inet osmo-upf tunmap-post-321 ip saddr set 2.2.2.1 @ih,32,32 set 0x102 counter accept; +add element inet osmo-upf tunmap-pre { 2.2.2.3 . 0x203 : jump tunmap-pre-321 }; +add element inet osmo-upf tunmap-post { 321 : jump tunmap-post-321 }; + +% delete tunmap: +delete element inet osmo-upf tunmap-pre { 2.2.2.1 . 0x201 }; +delete element inet osmo-upf tunmap-post { 123 }; +delete chain inet osmo-upf tunmap-pre-123; +delete chain inet osmo-upf tunmap-post-123; +delete element inet osmo-upf tunmap-pre { 2.2.2.3 . 0x203 }; +delete element inet osmo-upf tunmap-post { 321 }; +delete chain inet osmo-upf tunmap-pre-321; +delete chain inet osmo-upf tunmap-post-321; OsmoUPF(config-tunmap)# show nft-rule tunmap append % deprecated config option: 'show nft-rule tunmap append' -- To view, visit https://gerrit.osmocom.org/c/osmo-upf/+/31165 To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-upf Gerrit-Branch: master Gerrit-Change-Id: Iccb975a1c0f8a2087f7b7dc4942a6b41f5675a13 Gerrit-Change-Number: 31165 Gerrit-PatchSet: 6 Gerrit-Owner: neels <nhofmeyr(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: neels <nhofmeyr(a)sysmocom.de> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-MessageType: merged

2 years, 4 months

1
0
0 0

Change in osmo-upf[master]: fix various crashes on osmo_pfcp_endpoint_tx() err handling

by neels

neels has submitted this change. ( https://gerrit.osmocom.org/c/osmo-upf/+/31271 ) Change subject: fix various crashes on osmo_pfcp_endpoint_tx() err handling ...................................................................... fix various crashes on osmo_pfcp_endpoint_tx() err handling osmo_pfcp_endpoint_tx() deallocates the PFCP msg on error. Make sure osmo-upf doesn't use the PFCP msg after passing it to osmo_pfcp_endpoint_tx(). Change-Id: Ibb666d62b8469dbf0b13cdf25e6912c02fbc4fa9 --- M src/osmo-pfcp-tool/pfcp_tool.c M src/osmo-upf/up_peer.c 2 files changed, 4 insertions(+), 3 deletions(-) Approvals: Jenkins Builder: Verified osmith: Looks good to me, but someone else must approve pespin: Looks good to me, approved diff --git a/src/osmo-pfcp-tool/pfcp_tool.c b/src/osmo-pfcp-tool/pfcp_tool.c index aebb92c..ff93cd0 100644 --- a/src/osmo-pfcp-tool/pfcp_tool.c +++ b/src/osmo-pfcp-tool/pfcp_tool.c @@ -162,11 +162,11 @@ int peer_tx(struct pfcp_tool_peer *peer, struct osmo_pfcp_msg *m) { int rc; - rc = osmo_pfcp_endpoint_tx(g_pfcp_tool->ep, m); if (m->is_response) peer->last_resp = *m; else peer->last_req = *m; + rc = osmo_pfcp_endpoint_tx(g_pfcp_tool->ep, m); return rc; } diff --git a/src/osmo-upf/up_peer.c b/src/osmo-upf/up_peer.c index 6039b6a..ec50674 100644 --- a/src/osmo-upf/up_peer.c +++ b/src/osmo-upf/up_peer.c @@ -217,7 +217,8 @@ }; if (osmo_pfcp_endpoint_tx(peer->up_endpoint->pfcp_ep, resp)) { - OSMO_LOG_PFCP_MSG(resp, LOGL_ERROR, "Error sending response, cannot associate with peer\n"); + OSMO_LOG_PFCP_MSG(m, LOGL_ERROR, "Error sending response to this message," + " cannot associate with peer\n"); return -EIO; } return 0; @@ -234,7 +235,7 @@ }; if (osmo_pfcp_endpoint_tx(peer->up_endpoint->pfcp_ep, resp)) { - OSMO_LOG_PFCP_MSG(resp, LOGL_ERROR, "Error sending response\n"); + OSMO_LOG_PFCP_MSG(m, LOGL_ERROR, "Error sending response to this message\n"); return -EIO; } return 0; -- To view, visit https://gerrit.osmocom.org/c/osmo-upf/+/31271 To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-upf Gerrit-Branch: master Gerrit-Change-Id: Ibb666d62b8469dbf0b13cdf25e6912c02fbc4fa9 Gerrit-Change-Number: 31271 Gerrit-PatchSet: 1 Gerrit-Owner: neels <nhofmeyr(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: neels <nhofmeyr(a)sysmocom.de> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-MessageType: merged

2 years, 4 months

1
0
0 0

Change in osmo-upf[master]: fix some PFCP peer,session error handling paths

by neels

neels has submitted this change. ( https://gerrit.osmocom.org/c/osmo-upf/+/31273 ) Change subject: fix some PFCP peer,session error handling paths ...................................................................... fix some PFCP peer,session error handling paths Fix various failures to return and/or discard a session on PFCP message errors. Change-Id: I12650037c7c74d98e1f33e0379cf91edcbd02d1a --- M src/osmo-upf/up_peer.c M src/osmo-upf/up_session.c 2 files changed, 17 insertions(+), 2 deletions(-) Approvals: Jenkins Builder: Verified osmith: Looks good to me, but someone else must approve pespin: Looks good to me, approved diff --git a/src/osmo-upf/up_peer.c b/src/osmo-upf/up_peer.c index ec50674..8499632 100644 --- a/src/osmo-upf/up_peer.c +++ b/src/osmo-upf/up_peer.c @@ -327,6 +327,8 @@ .cause = cause, }; osmo_pfcp_endpoint_tx(peer->up_endpoint->pfcp_ep, resp); + if (session) + up_session_discard(session); } static void up_peer_not_associated_action(struct osmo_fsm_inst *fi, uint32_t event, void *data) diff --git a/src/osmo-upf/up_session.c b/src/osmo-upf/up_session.c index 0c2f103..59d45c0 100644 --- a/src/osmo-upf/up_session.c +++ b/src/osmo-upf/up_session.c @@ -631,14 +631,20 @@ resp->up_f_seid_present = true; rc = osmo_pfcp_endpoint_tx(peer->up_endpoint->pfcp_ep, tx); - if (rc) + if (rc) { + /* sending ACK failed, discard session. It might seem like a good idea to keep the session around, + * because the creation succeeded, only the ACK failed. But in the greater scheme of things, if we + * cannot ACK to the PFCP peer, all is lost. Rather not keep stale sessions around. */ up_session_fsm_state_chg(UP_SESSION_ST_WAIT_USE_COUNT); + return; + } up_session_fsm_state_chg(UP_SESSION_ST_ESTABLISHED); return; nack_response: resp->created_pdr_count = 0; osmo_pfcp_endpoint_tx(peer->up_endpoint->pfcp_ep, tx); + /* No matter if sending the NACK succeeded or not, discard the session. */ up_session_fsm_state_chg(UP_SESSION_ST_WAIT_USE_COUNT); } @@ -719,8 +725,13 @@ goto nack_response; /* Success, send ACK */ - if (osmo_pfcp_endpoint_tx(peer->up_endpoint->pfcp_ep, tx)) + if (osmo_pfcp_endpoint_tx(peer->up_endpoint->pfcp_ep, tx)) { + /* sending ACK failed, discard session. It might seem like a good idea to keep the session around, + * because the modification succeeded, only the ACK failed. But in the greater scheme of things, if we + * cannot ACK to the PFCP peer, all is lost. Rather not keep stale sessions around. */ up_session_fsm_state_chg(UP_SESSION_ST_WAIT_USE_COUNT); + return; + } LOGPFSML(fi, LOGL_NOTICE, "Session modified: %s\n", up_session_gtp_status(session)); return; @@ -728,6 +739,7 @@ nack_response: resp->created_pdr_count = 0; osmo_pfcp_endpoint_tx(peer->up_endpoint->pfcp_ep, tx); + /* No matter if sending the NACK succeeded or not, discard the session. */ up_session_fsm_state_chg(UP_SESSION_ST_WAIT_USE_COUNT); } @@ -742,6 +754,7 @@ .cause = OSMO_PFCP_CAUSE_REQUEST_ACCEPTED }; osmo_pfcp_endpoint_tx(peer->up_endpoint->pfcp_ep, tx); + /* No matter if sending the deletion ACK succeeded or not, discard the session. */ up_session_fsm_state_chg(UP_SESSION_ST_WAIT_USE_COUNT); } -- To view, visit https://gerrit.osmocom.org/c/osmo-upf/+/31273 To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-upf Gerrit-Branch: master Gerrit-Change-Id: I12650037c7c74d98e1f33e0379cf91edcbd02d1a Gerrit-Change-Number: 31273 Gerrit-PatchSet: 1 Gerrit-Owner: neels <nhofmeyr(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: neels <nhofmeyr(a)sysmocom.de> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-MessageType: merged

2 years, 4 months

1
0
0 0

Change in osmo-upf[master]: osmo-pfcp-tool: avoid stale pointers on msg copy

by neels

neels has submitted this change. ( https://gerrit.osmocom.org/c/osmo-upf/+/31272 ) Change subject: osmo-pfcp-tool: avoid stale pointers on msg copy ...................................................................... osmo-pfcp-tool: avoid stale pointers on msg copy Upon copying a PFCP msg struct for the 'retrans' command, make sure the copy has no pointers that may go stale. Change-Id: I4278d1c6b6da48a10d72955d9b070790d631c664 --- M src/osmo-pfcp-tool/pfcp_tool.c 1 file changed, 11 insertions(+), 2 deletions(-) Approvals: Jenkins Builder: Verified osmith: Looks good to me, but someone else must approve dexter: Looks good to me, but someone else must approve laforge: Looks good to me, approved diff --git a/src/osmo-pfcp-tool/pfcp_tool.c b/src/osmo-pfcp-tool/pfcp_tool.c index ff93cd0..ae77f64 100644 --- a/src/osmo-pfcp-tool/pfcp_tool.c +++ b/src/osmo-pfcp-tool/pfcp_tool.c @@ -159,13 +159,22 @@ } } +static void copy_msg(struct osmo_pfcp_msg *dst, const struct osmo_pfcp_msg *m) +{ + *dst = *m; + dst->encoded = NULL; + dst->ctx.peer_use_token = NULL; + dst->ctx.session_use_token = NULL; + dst->ctx.resp_cb = NULL; +} + int peer_tx(struct pfcp_tool_peer *peer, struct osmo_pfcp_msg *m) { int rc; if (m->is_response) - peer->last_resp = *m; + copy_msg(&peer->last_resp, m); else - peer->last_req = *m; + copy_msg(&peer->last_req, m); rc = osmo_pfcp_endpoint_tx(g_pfcp_tool->ep, m); return rc; } -- To view, visit https://gerrit.osmocom.org/c/osmo-upf/+/31272 To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-upf Gerrit-Branch: master Gerrit-Change-Id: I4278d1c6b6da48a10d72955d9b070790d631c664 Gerrit-Change-Number: 31272 Gerrit-PatchSet: 1 Gerrit-Owner: neels <nhofmeyr(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: neels <nhofmeyr(a)sysmocom.de> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-MessageType: merged

2 years, 4 months

1
0
0 0

Change in osmo-upf[master]: move GTP port definitions to upf.h

by neels

neels has submitted this change. ( https://gerrit.osmocom.org/c/osmo-upf/+/31162 ) Change subject: move GTP port definitions to upf.h ...................................................................... move GTP port definitions to upf.h upf_gtp.h is for the GTP kernel module interaction. The GTP port numbers are also relevant for the netfilter part, upf_nft.h. An upcoming patch will use PORT_GTP1_U in the nft ruleset. Related: SYS#6327 SYS#6264 Change-Id: I37d13cfee225c7ee2cc45525b76d9579d65e847c --- M include/osmocom/upf/upf.h M include/osmocom/upf/upf_gtp.h 2 files changed, 6 insertions(+), 6 deletions(-) Approvals: Jenkins Builder: Verified laforge: Looks good to me, approved pespin: Looks good to me, but someone else must approve diff --git a/include/osmocom/upf/upf.h b/include/osmocom/upf/upf.h index fd4019c..c25acca 100644 --- a/include/osmocom/upf/upf.h +++ b/include/osmocom/upf/upf.h @@ -37,6 +37,12 @@ #define UPF_PFCP_LISTEN_DEFAULT "0.0.0.0" +#define PORT_GTP0_C 3386 +#define PORT_GTP0_U 3386 + +#define PORT_GTP1_C 2123 +#define PORT_GTP1_U 2152 + extern struct osmo_tdef_group g_upf_tdef_groups[]; struct pfcp_vty_cfg { diff --git a/include/osmocom/upf/upf_gtp.h b/include/osmocom/upf/upf_gtp.h index e3db918..ec27455 100644 --- a/include/osmocom/upf/upf_gtp.h +++ b/include/osmocom/upf/upf_gtp.h @@ -30,12 +30,6 @@ #define LOG_GTP_DEV(DEV, LEVEL, FMT, ARGS...) \ LOGP(DGTP, LEVEL, "%s: " FMT, upf_gtp_dev_to_str_c(OTC_SELECT, (DEV)), ##ARGS) -#define PORT_GTP0_C 3386 -#define PORT_GTP0_U 3386 - -#define PORT_GTP1_C 2123 -#define PORT_GTP1_U 2152 - struct upf_gtp_dev { struct llist_head entry; 1 is the latest approved patch-set. No files were changed between the latest approved patch-set and the submitted one. -- To view, visit https://gerrit.osmocom.org/c/osmo-upf/+/31162 To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-upf Gerrit-Branch: master Gerrit-Change-Id: I37d13cfee225c7ee2cc45525b76d9579d65e847c Gerrit-Change-Number: 31162 Gerrit-PatchSet: 2 Gerrit-Owner: neels <nhofmeyr(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: neels <nhofmeyr(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-MessageType: merged

2 years, 4 months

1
0
0 0

Change in osmo-upf[master]: drop unused function up_peer_tx

by neels

neels has submitted this change. ( https://gerrit.osmocom.org/c/osmo-upf/+/31274 ) Change subject: drop unused function up_peer_tx ...................................................................... drop unused function up_peer_tx Change-Id: Ib2808ad402555fd58b92a1ea4bef4a67305a4ae2 --- M src/osmo-upf/up_peer.c 1 file changed, 0 insertions(+), 5 deletions(-) Approvals: Jenkins Builder: Verified neels: Looks good to me, approved osmith: Looks good to me, approved diff --git a/src/osmo-upf/up_peer.c b/src/osmo-upf/up_peer.c index 8499632..c0e43e4 100644 --- a/src/osmo-upf/up_peer.c +++ b/src/osmo-upf/up_peer.c @@ -169,11 +169,6 @@ return up_peer_add(up_endpoint, remote_addr); } -int up_peer_tx(struct up_peer *peer, struct osmo_pfcp_msg *m) -{ - return osmo_pfcp_endpoint_tx(peer->up_endpoint->pfcp_ep, m); -} - static int up_peer_fsm_timer_cb(struct osmo_fsm_inst *fi) { //struct up_peer *peer = fi->priv; -- To view, visit https://gerrit.osmocom.org/c/osmo-upf/+/31274 To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-upf Gerrit-Branch: master Gerrit-Change-Id: Ib2808ad402555fd58b92a1ea4bef4a67305a4ae2 Gerrit-Change-Number: 31274 Gerrit-PatchSet: 1 Gerrit-Owner: neels <nhofmeyr(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: neels <nhofmeyr(a)sysmocom.de> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-MessageType: merged

2 years, 4 months

1
0
0 0

Change in osmo-upf[master]: deprecate cfg 'nft rule tunmap append'

by neels

neels has submitted this change. ( https://gerrit.osmocom.org/c/osmo-upf/+/31163 ) Change subject: deprecate cfg 'nft rule tunmap append' ...................................................................... deprecate cfg 'nft rule tunmap append' Subsequent patch will refactor the tunmap nft ruleset. Instead of adapting the 'tunmap append' feature to the new ruleset, rather drop this feature entirely. The 'nft rule tunmap append' was intended for enabling 'trace' in the nft ruleset. However, the same can be achieved via the nft cmdline tool. For example: sudo nft 'add chain filter trace_chain { type filter hook prerouting priority -301; }' sudo nft 'add rule filter trace_chain meta nftrace set 1' Related: SYS#6327 SYS#6264 Change-Id: I1ae36f2f520217254c81fd765d27333ff0f457b2 --- M include/osmocom/upf/upf.h M include/osmocom/upf/upf_nft.h M src/osmo-upf/up_gtp_action.c M src/osmo-upf/upf.c M src/osmo-upf/upf_nft.c M src/osmo-upf/upf_vty.c M tests/nft-rule.vty M tests/upf.vty 8 files changed, 33 insertions(+), 117 deletions(-) Approvals: Jenkins Builder: Verified laforge: Looks good to me, but someone else must approve pespin: Looks good to me, approved diff --git a/include/osmocom/upf/upf.h b/include/osmocom/upf/upf.h index c25acca..ef7aa2b 100644 --- a/include/osmocom/upf/upf.h +++ b/include/osmocom/upf/upf.h @@ -112,9 +112,6 @@ char *table_name; int priority; uint32_t next_id_state; - - /* list of struct string_listitem */ - struct llist_head rule_append; } nft; struct llist_head netinst; diff --git a/include/osmocom/upf/upf_nft.h b/include/osmocom/upf/upf_nft.h index 8333877..4cdcb51 100644 --- a/include/osmocom/upf/upf_nft.h +++ b/include/osmocom/upf/upf_nft.h @@ -49,7 +49,6 @@ int upf_nft_init(); int upf_nft_free(); -char *upf_nft_tunmap_get_ruleset_str(void *ctx, struct upf_nft_tunmap_desc *tunmap, - const struct llist_head *rule_append); -int upf_nft_tunmap_create(struct upf_nft_tunmap_desc *tunmap, const struct llist_head *rule_append); +char *upf_nft_tunmap_get_ruleset_str(void *ctx, struct upf_nft_tunmap_desc *tunmap); +int upf_nft_tunmap_create(struct upf_nft_tunmap_desc *tunmap); int upf_nft_tunmap_delete(struct upf_nft_tunmap_desc *tunmap); diff --git a/src/osmo-upf/up_gtp_action.c b/src/osmo-upf/up_gtp_action.c index 3b3da86..238d652 100644 --- a/src/osmo-upf/up_gtp_action.c +++ b/src/osmo-upf/up_gtp_action.c @@ -135,7 +135,7 @@ return -ENOENT; } if (enable) - rc = upf_nft_tunmap_create(&a->tunmap, &g_upf->nft.rule_append); + rc = upf_nft_tunmap_create(&a->tunmap); else rc = upf_nft_tunmap_delete(&a->tunmap); if (rc) { diff --git a/src/osmo-upf/upf.c b/src/osmo-upf/upf.c index 1476270..0a84799 100644 --- a/src/osmo-upf/upf.c +++ b/src/osmo-upf/upf.c @@ -61,7 +61,6 @@ INIT_LLIST_HEAD(&g_upf->gtp.vty_cfg.devs); INIT_LLIST_HEAD(&g_upf->gtp.devs); - INIT_LLIST_HEAD(&g_upf->nft.rule_append); INIT_LLIST_HEAD(&g_upf->netinst); } diff --git a/src/osmo-upf/upf_nft.c b/src/osmo-upf/upf_nft.c index d1a83ff..f30e30c 100644 --- a/src/osmo-upf/upf_nft.c +++ b/src/osmo-upf/upf_nft.c @@ -126,8 +126,7 @@ static int tunmap_single_direction(char *buf, size_t buflen, const struct upf_nft_args *args, const struct upf_nft_args_peer *from_peer, - const struct upf_nft_args_peer *to_peer, - const struct llist_head *rule_append) + const struct upf_nft_args_peer *to_peer) { struct osmo_strbuf sb = { .buf = buf, .len = buflen }; @@ -156,20 +155,13 @@ OSMO_STRBUF_PRINTF(sb, " counter"); - if (rule_append) { - struct string_listitem *i; - llist_for_each_entry(i, rule_append, entry) - OSMO_STRBUF_PRINTF(sb, " %s", i->str); - } - OSMO_STRBUF_PRINTF(sb, " accept"); OSMO_STRBUF_PRINTF(sb, ";\n"); return sb.chars_needed; } -static int upf_nft_ruleset_tunmap_create_buf(char *buf, size_t buflen, const struct upf_nft_args *args, - const struct llist_head *rule_append) +static int upf_nft_ruleset_tunmap_create_buf(char *buf, size_t buflen, const struct upf_nft_args *args) { struct osmo_strbuf sb = { .buf = buf, .len = buflen }; @@ -178,17 +170,16 @@ args->table_name, args->chain_id, args->priority); /* Forwarding from peer_a to peer_b */ - OSMO_STRBUF_APPEND(sb, tunmap_single_direction, args, &args->peer_a, &args->peer_b, rule_append); + OSMO_STRBUF_APPEND(sb, tunmap_single_direction, args, &args->peer_a, &args->peer_b); /* And from peer_b to peer_a */ - OSMO_STRBUF_APPEND(sb, tunmap_single_direction, args, &args->peer_b, &args->peer_a, rule_append); + OSMO_STRBUF_APPEND(sb, tunmap_single_direction, args, &args->peer_b, &args->peer_a); return sb.chars_needed; } -static char *upf_nft_ruleset_tunmap_create_c(void *ctx, const struct upf_nft_args *args, - const struct llist_head *rule_append) +static char *upf_nft_ruleset_tunmap_create_c(void *ctx, const struct upf_nft_args *args) { - OSMO_NAME_C_IMPL(ctx, 512, "ERROR", upf_nft_ruleset_tunmap_create_buf, args, rule_append) + OSMO_NAME_C_IMPL(ctx, 512, "ERROR", upf_nft_ruleset_tunmap_create_buf, args) } static int upf_nft_ruleset_tunmap_delete_buf(char *buf, size_t buflen, const struct upf_nft_args *args) @@ -230,8 +221,7 @@ }; } -char *upf_nft_tunmap_get_ruleset_str(void *ctx, struct upf_nft_tunmap_desc *tunmap, - const struct llist_head *rule_append) +char *upf_nft_tunmap_get_ruleset_str(void *ctx, struct upf_nft_tunmap_desc *tunmap) { struct upf_nft_args args; @@ -244,12 +234,12 @@ } upf_nft_args_from_tunmap_desc(&args, tunmap); - return upf_nft_ruleset_tunmap_create_c(ctx, &args, rule_append); + return upf_nft_ruleset_tunmap_create_c(ctx, &args); } -int upf_nft_tunmap_create(struct upf_nft_tunmap_desc *tunmap, const struct llist_head *rule_append) +int upf_nft_tunmap_create(struct upf_nft_tunmap_desc *tunmap) { - return upf_nft_run(upf_nft_tunmap_get_ruleset_str(OTC_SELECT, tunmap, rule_append)); + return upf_nft_run(upf_nft_tunmap_get_ruleset_str(OTC_SELECT, tunmap)); } int upf_nft_tunmap_delete(struct upf_nft_tunmap_desc *tunmap) diff --git a/src/osmo-upf/upf_vty.c b/src/osmo-upf/upf_vty.c index afea28d..436d91f 100644 --- a/src/osmo-upf/upf_vty.c +++ b/src/osmo-upf/upf_vty.c @@ -222,8 +222,6 @@ static int config_write_tunmap(struct vty *vty) { - struct string_listitem *i; - vty_out(vty, "tunmap%s", VTY_NEWLINE); if (g_upf->nft.mockup) @@ -232,8 +230,6 @@ if (g_upf->nft.table_name && strcmp(g_upf->nft.table_name, "osmo-upf")) vty_out(vty, " table-name %s%s", g_upf->nft.table_name, VTY_NEWLINE); - llist_for_each_entry(i, &g_upf->nft.rule_append, entry) - vty_out(vty, " nft-rule tunmap append %s%s", i->str, VTY_NEWLINE); return CMD_SUCCESS; } @@ -268,47 +264,29 @@ #define NFT_RULE_STR "nftables rule specifics\n" #define TUNMAP_STR "GTP tunmap use case (a.k.a. forwarding between two GTP tunnels)\n" +#define TUNMAP_APPEND_STR "'tunmap append' feature is no longer available.\n" -DEFUN(cfg_tunmap_nft_rule_append, cfg_tunmap_nft_rule_append_cmd, +DEFUN_DEPRECATED(cfg_tunmap_nft_rule_append, cfg_tunmap_nft_rule_append_cmd, "nft-rule tunmap append .NFT_RULE", - NFT_RULE_STR TUNMAP_STR - "To each tunmap nft rule, append the given text. For example, 'nft-rule append meta nftrace set 1' adds the nftables" - " instructions 'meta nftrace set 1' to each of the tunmap rules passed to netfilter. This command is cumulative," - " multiple 'nft-rule append' will append all of the items.\n" - "The text to append\n") + NFT_RULE_STR TUNMAP_STR TUNMAP_APPEND_STR TUNMAP_APPEND_STR) { - struct string_listitem *i; - i = talloc_zero(g_upf, struct string_listitem); - i->str = argv_concat(argv, argc, 0); - talloc_steal(i, i->str); - llist_add_tail(&i->entry, &g_upf->nft.rule_append); + vty_out(vty, "%% deprecated config option: 'nft-rule tunmap append'%s", VTY_NEWLINE); return CMD_SUCCESS; } -DEFUN(cfg_tunmap_no_nft_rule_append, cfg_tunmap_no_nft_rule_append_cmd, +DEFUN_DEPRECATED(cfg_tunmap_no_nft_rule_append, cfg_tunmap_no_nft_rule_append_cmd, "no nft-rule tunmap append", - NO_STR NFT_RULE_STR TUNMAP_STR - "Drop all additions to tunmap nft rules added by earlier 'nft-rule append' config\n") + NO_STR NFT_RULE_STR TUNMAP_STR TUNMAP_APPEND_STR TUNMAP_APPEND_STR) { - struct string_listitem *i; - while ((i = llist_first_entry_or_null(&g_upf->nft.rule_append, struct string_listitem, entry))) { - llist_del(&i->entry); - talloc_free(i); - } + vty_out(vty, "%% deprecated config option: 'no nft-rule tunmap append'%s", VTY_NEWLINE); return CMD_SUCCESS; } -DEFUN(show_nft_rule_append, show_nft_rule_append_cmd, +DEFUN_DEPRECATED(show_nft_rule_append, show_nft_rule_append_cmd, "show nft-rule tunmap append", - SHOW_STR NFT_RULE_STR TUNMAP_STR "List all tunmap 'nft-rule append' entries\n") + SHOW_STR NFT_RULE_STR TUNMAP_STR TUNMAP_APPEND_STR) { - struct string_listitem *i; - if (llist_empty(&g_upf->nft.rule_append)) { - vty_out(vty, " no nft-rule tunmap append%s", VTY_NEWLINE); - return CMD_SUCCESS; - } - llist_for_each_entry(i, &g_upf->nft.rule_append, entry) - vty_out(vty, " nft-rule tunmap append %s%s", i->str, VTY_NEWLINE); + vty_out(vty, "%% deprecated config option: 'show nft-rule tunmap append'%s", VTY_NEWLINE); return CMD_SUCCESS; } @@ -342,7 +320,7 @@ osmo_sockaddr_str_from_str2(&str, "3.3.3.3"); osmo_sockaddr_str_to_sockaddr(&str, &d.core.gtp_remote_addr.u.sas); - vty_out(vty, "%s%s", upf_nft_tunmap_get_ruleset_str(OTC_SELECT, &d, &g_upf->nft.rule_append), VTY_NEWLINE); + vty_out(vty, "%s%s", upf_nft_tunmap_get_ruleset_str(OTC_SELECT, &d), VTY_NEWLINE); return CMD_SUCCESS; } diff --git a/tests/nft-rule.vty b/tests/nft-rule.vty index c52ef0e..ec719ab 100644 --- a/tests/nft-rule.vty +++ b/tests/nft-rule.vty @@ -2,53 +2,14 @@ OsmoUPF# configure terminal OsmoUPF(config)# tunmap -OsmoUPF(config-tunmap)# show nft-rule tunmap append - no nft-rule tunmap append OsmoUPF(config-tunmap)# show nft-rule tunmap example add chain inet osmo-upf tunmap123 { type filter hook prerouting priority -300; } add rule inet osmo-upf tunmap123 meta l4proto udp ip daddr 2.2.2.1 @ih,32,32 0x00000201 ip saddr set 2.2.2.3 ip daddr set 3.3.3.3 @ih,32,32 set 0x00000302 counter accept; add rule inet osmo-upf tunmap123 meta l4proto udp ip daddr 2.2.2.3 @ih,32,32 0x00000203 ip saddr set 2.2.2.1 ip daddr set 1.1.1.1 @ih,32,32 set 0x00000102 counter accept; +OsmoUPF(config-tunmap)# show nft-rule tunmap append +% deprecated config option: 'show nft-rule tunmap append' OsmoUPF(config-tunmap)# nft-rule tunmap append meta nftrace set 1 -OsmoUPF(config-tunmap)# show nft-rule tunmap append - nft-rule tunmap append meta nftrace set 1 -OsmoUPF(config-tunmap)# show nft-rule tunmap example -add chain inet osmo-upf tunmap123 { type filter hook prerouting priority -300; } -add rule inet osmo-upf tunmap123 meta l4proto udp ip daddr 2.2.2.1 @ih,32,32 0x00000201 ip saddr set 2.2.2.3 ip daddr set 3.3.3.3 @ih,32,32 set 0x00000302 counter meta nftrace set 1 accept; -add rule inet osmo-upf tunmap123 meta l4proto udp ip daddr 2.2.2.3 @ih,32,32 0x00000203 ip saddr set 2.2.2.1 ip daddr set 1.1.1.1 @ih,32,32 set 0x00000102 counter meta nftrace set 1 accept; - -OsmoUPF(config-tunmap)# nft-rule tunmap append foo -OsmoUPF(config-tunmap)# show nft-rule tunmap append - nft-rule tunmap append meta nftrace set 1 - nft-rule tunmap append foo -OsmoUPF(config-tunmap)# show nft-rule tunmap example -add chain inet osmo-upf tunmap123 { type filter hook prerouting priority -300; } -add rule inet osmo-upf tunmap123 meta l4proto udp ip daddr 2.2.2.1 @ih,32,32 0x00000201 ip saddr set 2.2.2.3 ip daddr set 3.3.3.3 @ih,32,32 set 0x00000302 counter meta nftrace set 1 foo accept; -add rule inet osmo-upf tunmap123 meta l4proto udp ip daddr 2.2.2.3 @ih,32,32 0x00000203 ip saddr set 2.2.2.1 ip daddr set 1.1.1.1 @ih,32,32 set 0x00000102 counter meta nftrace set 1 foo accept; - -OsmoUPF(config-tunmap)# nft-rule tunmap append bar -OsmoUPF(config-tunmap)# show nft-rule tunmap append - nft-rule tunmap append meta nftrace set 1 - nft-rule tunmap append foo - nft-rule tunmap append bar -OsmoUPF(config-tunmap)# show nft-rule tunmap example -add chain inet osmo-upf tunmap123 { type filter hook prerouting priority -300; } -add rule inet osmo-upf tunmap123 meta l4proto udp ip daddr 2.2.2.1 @ih,32,32 0x00000201 ip saddr set 2.2.2.3 ip daddr set 3.3.3.3 @ih,32,32 set 0x00000302 counter meta nftrace set 1 foo bar accept; -add rule inet osmo-upf tunmap123 meta l4proto udp ip daddr 2.2.2.3 @ih,32,32 0x00000203 ip saddr set 2.2.2.1 ip daddr set 1.1.1.1 @ih,32,32 set 0x00000102 counter meta nftrace set 1 foo bar accept; - -OsmoUPF(config-tunmap)# show running-config -... -tunmap -... - nft-rule tunmap append meta nftrace set 1 - nft-rule tunmap append foo - nft-rule tunmap append bar -... - +% deprecated config option: 'nft-rule tunmap append' OsmoUPF(config-tunmap)# no nft-rule tunmap append -OsmoUPF(config-tunmap)# show nft-rule tunmap append - no nft-rule tunmap append -OsmoUPF(config-tunmap)# show nft-rule tunmap example -add chain inet osmo-upf tunmap123 { type filter hook prerouting priority -300; } -add rule inet osmo-upf tunmap123 meta l4proto udp ip daddr 2.2.2.1 @ih,32,32 0x00000201 ip saddr set 2.2.2.3 ip daddr set 3.3.3.3 @ih,32,32 set 0x00000302 counter accept; -add rule inet osmo-upf tunmap123 meta l4proto udp ip daddr 2.2.2.3 @ih,32,32 0x00000203 ip saddr set 2.2.2.1 ip daddr set 1.1.1.1 @ih,32,32 set 0x00000102 counter accept; +% deprecated config option: 'no nft-rule tunmap append' diff --git a/tests/upf.vty b/tests/upf.vty index bfaa0cc..6c278c9 100644 --- a/tests/upf.vty +++ b/tests/upf.vty @@ -56,9 +56,6 @@ mockup no mockup table-name TABLE_NAME - nft-rule tunmap append .NFT_RULE - no nft-rule tunmap append - show nft-rule tunmap append show nft-rule tunmap example OsmoUPF(config-tunmap)# exit @@ -68,16 +65,12 @@ mockup no mockup table-name TABLE_NAME - nft-rule tunmap append .NFT_RULE - no nft-rule tunmap append - show nft-rule tunmap append show nft-rule tunmap example OsmoUPF(config-tunmap)# mockup? mockup don't actually send rulesets to nftables, just return success OsmoUPF(config-tunmap)# no ? - mockup operate nftables rulesets normally - nft-rule nftables rule specifics + mockup operate nftables rulesets normally OsmoUPF(config-tunmap)# table-name? table-name Set the nft inet table name to create and place GTP tunnel forwarding chains in (as in 'nft add table inet foo'). If multiple instances of osmo-upf are running on the same system, each osmo-upf must have its own table name. Otherwise the names of created forwarding chains will collide. The default table name is "osmo-upf". @@ -85,13 +78,13 @@ TABLE_NAME nft inet table name OsmoUPF(config-tunmap)# nft-rule? - nft-rule nftables rule specifics +% There is no matched command. OsmoUPF(config-tunmap)# nft-rule ? - tunmap GTP tunmap use case (a.k.a. forwarding between two GTP tunnels) +% There is no matched command. OsmoUPF(config-tunmap)# nft-rule tunmap ? - append To each tunmap nft rule, append the given text. For example, 'nft-rule append meta nftrace set 1' adds the nftables instructions 'meta nftrace set 1' to each of the tunmap rules passed to netfilter. This command is cumulative, multiple 'nft-rule append' will append all of the items. +% There is no matched command. OsmoUPF(config-tunmap)# nft-rule tunmap append ? - NFT_RULE The text to append +% There is no matched command. OsmoUPF(config-tunmap)# show? show Show running system information @@ -102,5 +95,4 @@ OsmoUPF(config-tunmap)# show nft-rule ? tunmap GTP tunmap use case (a.k.a. forwarding between two GTP tunnels) OsmoUPF(config-tunmap)# show nft-rule tunmap ? - append List all tunmap 'nft-rule append' entries example Print a complete nftables ruleset for a tunmap filled with example IP addresses and TEIDs 1 is the latest approved patch-set. No files were changed between the latest approved patch-set and the submitted one. -- To view, visit https://gerrit.osmocom.org/c/osmo-upf/+/31163 To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-upf Gerrit-Branch: master Gerrit-Change-Id: I1ae36f2f520217254c81fd765d27333ff0f457b2 Gerrit-Change-Number: 31163 Gerrit-PatchSet: 2 Gerrit-Owner: neels <nhofmeyr(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: neels <nhofmeyr(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-MessageType: merged

2 years, 4 months

1
0
0 0

Change in libosmocore[master]: add contrib/talloc_count.sh

by neels

neels has posted comments on this change. ( https://gerrit.osmocom.org/c/libosmocore/+/31266 ) Change subject: add contrib/talloc_count.sh ...................................................................... Patch Set 3: Code-Review+2 (1 comment) Patchset: PS3: combine earlier votes after tweak -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/31266 To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I5b3242dd6e0649925ac6abfd1e96625c682b8934 Gerrit-Change-Number: 31266 Gerrit-PatchSet: 3 Gerrit-Owner: neels <nhofmeyr(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: neels <nhofmeyr(a)sysmocom.de> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Comment-Date: Fri, 10 Feb 2023 20:41:07 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

2 years, 4 months

1
0
0 0

Change in libosmocore[master]: add contrib/talloc_count.sh

by neels

Attention is currently required from: neels. Hello osmith, Jenkins Builder, laforge, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/libosmocore/+/31266 to look at the new patch set (#3). Change subject: add contrib/talloc_count.sh ...................................................................... add contrib/talloc_count.sh When a user reports a memory leak with a talloc report, this script is useful to quickly get a handle of what is being leaked. The alternative is eyeballing the talloc report for a very long time. Change-Id: I5b3242dd6e0649925ac6abfd1e96625c682b8934 --- A contrib/talloc_count.sh 1 file changed, 52 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/66/31266/3 -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/31266 To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I5b3242dd6e0649925ac6abfd1e96625c682b8934 Gerrit-Change-Number: 31266 Gerrit-PatchSet: 3 Gerrit-Owner: neels <nhofmeyr(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: neels <nhofmeyr(a)sysmocom.de> Gerrit-MessageType: newpatchset

2 years, 4 months

1
0
0 0

Change in osmo-bsc[master]: osmo-bsc: Fix 'apply-config-file' CTRL command

by arehbein

arehbein has posted comments on this change. ( https://gerrit.osmocom.org/c/osmo-bsc/+/31029 ) Change subject: osmo-bsc: Fix 'apply-config-file' CTRL command ...................................................................... Patch Set 3: (1 comment) File src/osmo-bsc/bsc_ctrl.c: https://gerrit.osmocom.org/c/osmo-bsc/+/31029/comment/9d87c63b_c63f09f7 PS2, Line 89: cmd->reply = talloc_asprintf(cmd, "Errors in neighbor configuration"); > Ah I misread the function being called, I thought the function validating the whole BTS config was b […] Done -- To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/31029 To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-bsc Gerrit-Branch: master Gerrit-Change-Id: I24ae8cd7e5e0d15eab9fd04b1858072bf0bad36a Gerrit-Change-Number: 31029 Gerrit-PatchSet: 3 Gerrit-Owner: arehbein <arehbein(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: arehbein <arehbein(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: msuraev <msuraev(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Fri, 10 Feb 2023 19:58:30 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: laforge <laforge(a)osmocom.org> Comment-In-Reply-To: pespin <pespin(a)sysmocom.de> Gerrit-MessageType: comment

2 years, 4 months

1
0
0 0

2025

2024

2023

2022

gerrit-log February 2023